5 ms·
The idea with having eBPF in the kernel is that we can limit the amount of trust given to a particular user-space task. Accepting compiled stuff in the form of
by codyps 9y ago
The idea with having eBPF in the kernel is that we can limit the amount of trust given to a particular user-space task.
Accepting compiled stuff in the form of a kernel module requires root privileges and requires that the kernel essentially have complete trust in the code being loaded.
Loading eBPF eliminates the need to trust the process/user doing the loading to that level.
- dangisafascist 9y agoThe bpf() system call and SOCK_RAW both require root. Is there an example of using bpf that doesn't require root?
- sargun 9y agoThe BPF syscalls don't require cap sys admin. Only specific invocations. You can setup a socket filter without sys admin, and a device or XDP filter with net admin.
- dangisafascist 9y agoSure but how common is that case? How common are multi-tenant Linux systems with untrusted users that give those specific permissions? Do you want untrusted users sniffing the packets of others?