lkml.org 
[lkml]   [2022]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] bpf: make unprivileged BPF a compile time choice
On Mon, Apr 4, 2022 at 3:03 PM Matteo Croce <mcroce@linux.microsoft.com> wrote:
>
> From: Matteo Croce <mcroce@microsoft.com>
>
> Add a compile time option to permanently disable unprivileged BPF and
> the corresponding sysctl handler so that there's absolutely no
> concern about unprivileged BPF being enabled from userspace during
> runtime. Special purpose kernels can benefit from the build-time
> assurance that unprivileged eBPF is disabled in all of their kernel
> builds rather than having to rely on userspace to permanently disable
> it at boot time.
> The default behaviour is left unchanged, which is: unprivileged BPF
> compiled in but disabled at boot.

That is an insane level of "security" paranoia.
If you're so concerned about bpf do CONFIG_BPF_SYSCALL=n

\
 
 \ /
  Last update: 2022-04-05 01:09    [W:0.026 / U:0.272 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site