4 ms·
The sudoers example to me was the most illustrative. Though it's still not exactly clear to me what the verifier intends to prevent. I can understand that it l
by miggol 2y ago
The sudoers example to me was the most illustrative.
Though it's still not exactly clear to me what the verifier intends to prevent. I can understand that it limits how far you can look up into the stack and what memory your eBPF program can read. But can we otherwise just run any random code in eBPF? The register value tracking and DAG stuff kind of goes over my head.
In short, could I write a Scheme in eBPF and pass it a program at runtime, through a map?
- dwattttt 2y agoIt also prevents backwards edges in the control flow graph; no loops (unless entirely unrolled), no recursion
- jakobson14 2y agoThe verifier is mostly targeted at not letting a program run forever.