Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What are you talking about?

I have been using bpf in seccomp for non-root for years.

Maybe your distro patched that out. The stock kernel allows bpf for non-root.



Sort of... there's been push back in the post spectre days of expanding non root usage of BPF. Right now, a subset of trace programs and seccomp are allowed for non-root, but that hasn't expanded since 2016. Everything else requires CAP_SYS_ADMIN.

They would probably remove those too if the balance of Linux didn't put "don't break user space" higher than "defense in depth security".


Just in recent months we've had CVE-2020-2717{0,1} (memory exposure) followed by CVE-2021-29154 (arbitrary code execution on x86). None of which have even had fixes applied by certain distros[0].

I don't really know what the use cases for unprivileged BPF are though.

[0] https://access.redhat.com/security/cve/cve-2021-29154




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: