Messages in this thread | | | Date | Fri, 9 Oct 2015 11:28:22 +0200 | From | Thomas Graf <> | Subject | Re: [PATCH v2 net-next 1/3] bpf: enable non-root eBPF programs |
| |
On 10/08/15 at 08:20pm, Hannes Frederic Sowa wrote: > Hi Alexei, > > On Thu, Oct 8, 2015, at 07:23, Alexei Starovoitov wrote: > > The feature is controlled by sysctl kernel.unprivileged_bpf_disabled. > > This toggle defaults to off (0), but can be set true (1). Once true, > > bpf programs and maps cannot be accessed from unprivileged process, > > and the toggle cannot be set back to false. > > This approach seems fine to me. > > I am wondering if it makes sense to somehow allow ebpf access per > namespace? I currently have no idea how that could work and on which > namespace type to depend or going with a prctl or even cgroup maybe. The > rationale behind this is, that maybe some namespaces like openstack > router namespaces could make usage of advanced ebpf capabilities in the > kernel, while other namespaces, especially where untrusted third parties > are hosted, shouldn't have access to those facilities. > > In that way, hosters would be able to e.g. deploy more efficient > performance monitoring container (which should still need not to run as > root) while the majority of the users has no access to that. Or think > about routing instances in some namespaces, etc. etc.
The standard way of granting privileges like this for containers is through CAP_ which does seem like a good fit for this as well and would also solve your mentioned openstack use case.
| |