12 ms·
The bpf() system call and SOCK_RAW both require root. Is there an example of using bpf that doesn't require root?
by dangisafascist 9y ago
The bpf() system call and SOCK_RAW both require root. Is there an example of using bpf that doesn't require root?
- sargun 9y agoThe BPF syscalls don't require cap sys admin. Only specific invocations. You can setup a socket filter without sys admin, and a device or XDP filter with net admin.
- dangisafascist 9y agoSure but how common is that case? How common are multi-tenant Linux systems with untrusted users that give those specific permissions? Do you want untrusted users sniffing the packets of others?