lkml.org 
[lkml]   [2023]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] bpf: Add CONFIG_BPF_HELPER_STRICT
On Fri, Jan 13, 2023 at 11:53 PM Roland <kernel.pwn@outlook.com> wrote:
>
> In container environment, ebpf helpers could be used maliciously to
> leak information, DOS, even escape from containers.
> CONFIG_BPF_HELPER_STRICT is as a mitigation of it.
> Related Link: https://rolandorange.zone/report.html

The link is arguing that a process with CAP_SYS_ADMIN permissions
can read memory of user processes, leak kernel addresses, etc.
And this is somehow an issue with bpf helpers?
and your suggested "temporary mitigation" is to CONFIG_BPF=n ?
While this patch is a "proper fix" ?
Sorry, but please stay with your "temporary mitigation" forever.

\
 
 \ /
  Last update: 2023-03-26 23:42    [W:0.063 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site