3 ms·

I asked about this when they presented the project at the Linux Plumbers conference. They replied that it's not really intended to be a security boundary, and t

I asked about this when they presented the project at the Linux Plumbers conference. They replied that it's not really intended to be a security boundary, and that you should not let anyone malicious load these programs. Given this thread model, I think their project is entirely reasonable. Safe Rust will prevent accidental mistakes even if you could technically circumvent it if you really try.

IshKebab 9mo ago
As I understand it eBPF has also given up on that due to Spectre. As a result you need root to use it on most distros anyway, and the kernel devs aren't going to expand its use (some systems are stuck on cBPF). So it's not like eBPF is secure and this isn't. They're both insecure in different ways.
- westurner 9mo ago
  So eBPF for a WAF isn't worth it? re: eBPF and WAFs: https://news.ycombinator.com/item?id=45951011 https://news.ycombinator.com/item?id=45951011 From https://news.ycombinator.com/context?id=43564972 https://news.ycombinator.com/context?id=43564972 : > Should a microkernel implement eBPF and WASM, or, for the same reasons that justify a microkernel should eBPF and most other things be confined or relegated or segregated in userspace; in terms of microkernel goals like separation of concerns and least privilege and then performance? "Isolated Execution Environment for eBPF" (2025-04) https://news.ycombinator.com/item?id=43697214 https://news.ycombinator.com/item?id=43697214 "ePass: Verifier-Cooperative Runtime Enforcement for eBPF" (2025-12) https://ebpf.foundation/epass-verifier-cooperative-runtime-enforcement-for-ebpf/ https://ebpf.foundation/epass-verifier-cooperative-runtime-e... .. https://news.ycombinator.com/item?id=46412121 https://news.ycombinator.com/item?id=46412121
tptacek 9mo ago
eBPF's limitations are as much about reliability as security. The bounded loop restriction, for instance, prevents eBPF programs from locking up your machine.
- loeg 9mo ago
  You could still imagine terminating these programs after some bounded time or cycle count. It isn't as good as static verification, but it's certainly more flexible.
  - tptacek 9mo ago
    If you're doing this kind of "optimistic" reliability story, where developers who stay on the happy path are unlikely to cause any real problems, I don't get what the value of something like this is over just doing a normal Rust LKM that isn't locked into a specific set of helpers.
    - eptcyka 9mo ago
      You can extend the kernel functionality without having to develop a whole kernel module? Just because your module has no memory errors does not mean that it is working as intended. Further, if you want to hook into specific parts of the kernel, you might well end up writing far more boilerplate instead of just intercepting the one call you're actually interested in and adding some metadata or doing some access control. I personally am all for a kernel that can do more things for more people with less bespoke kernel modules or patches.
      - tptacek 9mo ago
        I guess my point is that the delta between a "whole kernel module" and a "Rex extension" is pretty small.
        zem 9mo ago
        if nothing else, rex makes a good central place to evolve a set of helper code for doing ebpf-like stuff in a rust kernel module. wouldn't be too surprised if it eventually becomes closer to an embedded dsl.
    - loeg 9mo ago
      Sure! Can't disagree with that.

IshKebab 9mo ago

As I understand it eBPF has also given up on that due to Spectre. As a result you need root to use it on most distros anyway, and the kernel devs aren't going to expand its use (some systems are stuck on cBPF). So it's not like eBPF is secure and this isn't. They're both insecure in different ways.

westurner 9mo ago
So eBPF for a WAF isn't worth it? re: eBPF and WAFs: https://news.ycombinator.com/item?id=45951011 https://news.ycombinator.com/item?id=45951011 From https://news.ycombinator.com/context?id=43564972 https://news.ycombinator.com/context?id=43564972 : > Should a microkernel implement eBPF and WASM, or, for the same reasons that justify a microkernel should eBPF and most other things be confined or relegated or segregated in userspace; in terms of microkernel goals like separation of concerns and least privilege and then performance? "Isolated Execution Environment for eBPF" (2025-04) https://news.ycombinator.com/item?id=43697214 https://news.ycombinator.com/item?id=43697214 "ePass: Verifier-Cooperative Runtime Enforcement for eBPF" (2025-12) https://ebpf.foundation/epass-verifier-cooperative-runtime-enforcement-for-ebpf/ https://ebpf.foundation/epass-verifier-cooperative-runtime-e... .. https://news.ycombinator.com/item?id=46412121 https://news.ycombinator.com/item?id=46412121

tptacek 9mo ago

eBPF's limitations are as much about reliability as security. The bounded loop restriction, for instance, prevents eBPF programs from locking up your machine.

loeg 9mo ago
You could still imagine terminating these programs after some bounded time or cycle count. It isn't as good as static verification, but it's certainly more flexible.
- tptacek 9mo ago
  If you're doing this kind of "optimistic" reliability story, where developers who stay on the happy path are unlikely to cause any real problems, I don't get what the value of something like this is over just doing a normal Rust LKM that isn't locked into a specific set of helpers.
  - eptcyka 9mo ago
    You can extend the kernel functionality without having to develop a whole kernel module? Just because your module has no memory errors does not mean that it is working as intended. Further, if you want to hook into specific parts of the kernel, you might well end up writing far more boilerplate instead of just intercepting the one call you're actually interested in and adding some metadata or doing some access control. I personally am all for a kernel that can do more things for more people with less bespoke kernel modules or patches.
    - tptacek 9mo ago
      I guess my point is that the delta between a "whole kernel module" and a "Rex extension" is pretty small.
      - zem 9mo ago
        if nothing else, rex makes a good central place to evolve a set of helper code for doing ebpf-like stuff in a rust kernel module. wouldn't be too surprised if it eventually becomes closer to an embedded dsl.
  - loeg 9mo ago
    Sure! Can't disagree with that.