4 ms·

Let's not forget also that we can give CAP_BPF to containers. With things like Cilium on the rise, the attack vector of landing in container environment that ha

Let's not forget also that we can give CAP_BPF to containers. With things like Cilium on the rise, the attack vector of landing in container environment that has cap_bpf is more and more realistic

tptacek 2y ago
I don't believe shared-kernel container systems are real security boundaries to begin with, so, to me, a container running with CAP_BPF isn't much different than any other program a machine owner might opt to run; the point is that you trust the workload, and so the verifier is more of a safety net than a vault door.
- kortilla 2y ago
  That pessimistic view is not shared by everyone who is working on namespaces, cgroups, etc so I think that’s a pretty unproductive comment in this context. It reminds me of early days in hypervisors when someone would get an exploit to break out of the isolation and someone would dismiss it because “virtual machines aren’t real isolation anyway”. Look, I get it and I frankly agree with you in the current state of the world, but this is the time to shut up and get out of the way of people trying to make forward progress. Breakouts of containers are a big deal for people pushing the boundary there.
  - tptacek 2y ago
    I don't know who you're really talking to (it's not me), but all I'm saying is that CAP_BPF doesn't bother me much, because it's problematic only for a security boundary that is already problematic with a much lower degree of difficulty for attackers than the eBPF verifier.
    - kortilla 2y ago
      > it's problematic only for a security boundary that is already problematic I’m absolutely talking to you because you’re dismissing an issue in a space where people are actively working to make it not “already problematic”. “I don’t care about hypervisor vulnerabilities because they are only problematic for a security boundary that is already problematic. Smart people are bare metal only.”
      - tptacek 2y ago
        Then I don't understand your point. You don't improve security by being optimistic about attack surfaces.
        kortilla 2y ago
        My point is you don’t dismiss something as unworthy of attention because it’s in a larger area that needs active attention. That pattern I’ve seen repeated for decades for things like “using credit cards to buy things online” to “cryptography protecting websites” to “hypervisors providing security”. It’s pointlessly negative and doesn’t contribute to meaningful technical discussions. It’s a useful opinion if you’re advising tech stacks to adopt today or whatever, but that’s not interesting for the state of the art.

Let's not forget also that we can give CAP_BPF to containers. With things like Cilium on the rise, the attack vector of landing in container environment that has cap_bpf is more and more realistic

tptacek 2y ago

I don't believe shared-kernel container systems are real security boundaries to begin with, so, to me, a container running with CAP_BPF isn't much different than any other program a machine owner might opt to run; the point is that you trust the workload, and so the verifier is more of a safety net than a vault door.

kortilla 2y ago
That pessimistic view is not shared by everyone who is working on namespaces, cgroups, etc so I think that’s a pretty unproductive comment in this context. It reminds me of early days in hypervisors when someone would get an exploit to break out of the isolation and someone would dismiss it because “virtual machines aren’t real isolation anyway”. Look, I get it and I frankly agree with you in the current state of the world, but this is the time to shut up and get out of the way of people trying to make forward progress. Breakouts of containers are a big deal for people pushing the boundary there.
- tptacek 2y ago
  I don't know who you're really talking to (it's not me), but all I'm saying is that CAP_BPF doesn't bother me much, because it's problematic only for a security boundary that is already problematic with a much lower degree of difficulty for attackers than the eBPF verifier.
  - kortilla 2y ago
    > it's problematic only for a security boundary that is already problematic I’m absolutely talking to you because you’re dismissing an issue in a space where people are actively working to make it not “already problematic”. “I don’t care about hypervisor vulnerabilities because they are only problematic for a security boundary that is already problematic. Smart people are bare metal only.”
    - tptacek 2y ago
      Then I don't understand your point. You don't improve security by being optimistic about attack surfaces.
      - kortilla 2y ago
        My point is you don’t dismiss something as unworthy of attention because it’s in a larger area that needs active attention. That pattern I’ve seen repeated for decades for things like “using credit cards to buy things online” to “cryptography protecting websites” to “hypervisors providing security”. It’s pointlessly negative and doesn’t contribute to meaningful technical discussions. It’s a useful opinion if you’re advising tech stacks to adopt today or whatever, but that’s not interesting for the state of the art.