From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932271AbbJMCGi (ORCPT ); Mon, 12 Oct 2015 22:06:38 -0400 Received: from shards.monkeyblade.net ([149.20.54.216]:42946 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932100AbbJMCGg (ORCPT ); Mon, 12 Oct 2015 22:06:36 -0400 Date: Mon, 12 Oct 2015 19:22:32 -0700 (PDT) Message-Id: <20151012.192232.764687069258026388.davem@davemloft.net> To: ast@plumgrid.com Cc: luto@amacapital.net, mingo@kernel.org, hannes@stressinduktion.org, edumazet@google.com, daniel@iogearbox.net, keescook@chromium.org, linux-api@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2 net-next 0/3] bpf: unprivileged From: David Miller In-Reply-To: <1444281803-24274-1-git-send-email-ast@plumgrid.com> References: <1444281803-24274-1-git-send-email-ast@plumgrid.com> X-Mailer: Mew version 6.4 on Emacs 23.4 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 12 Oct 2015 19:06:36 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexei Starovoitov Date: Wed, 7 Oct 2015 22:23:20 -0700 > v1-v2: > - this set logically depends on cb patch > "bpf: fix cb access in socket filter programs": > http://patchwork.ozlabs.org/patch/527391/ > which is must have to allow unprivileged programs. > Thanks Daniel for finding that issue. > - refactored sysctl to be similar to 'modules_disabled' > - dropped bpf_trace_printk > - split tests into separate patch and added more tests > based on discussion > > v1 cover letter: > I think it is time to liberate eBPF from CAP_SYS_ADMIN. > As was discussed when eBPF was first introduced two years ago > the only piece missing in eBPF verifier is 'pointer leak detection' > to make it available to non-root users. > Patch 1 adds this pointer analysis. > The eBPF programs, obviously, need to see and operate on kernel addresses, > but with these extra checks they won't be able to pass these addresses > to user space. > Patch 2 adds accounting of kernel memory used by programs and maps. > It changes behavoir for existing root users, but I think it needs > to be done consistently for both root and non-root, since today > programs and maps are only limited by number of open FDs (RLIMIT_NOFILE). > Patch 2 accounts program's and map's kernel memory as RLIMIT_MEMLOCK. > > Unprivileged eBPF is only meaningful for 'socket filter'-like programs. > eBPF programs for tracing and TC classifiers/actions will stay root only. > > In parallel the bpf fuzzing effort is ongoing and so far > we've found only one verifier bug and that was already fixed. > The 'constant blinding' pass also being worked on. > It will obfuscate constant-like values that are part of eBPF ISA > to make jit spraying attacks even harder. Scary stuff, but I don't see any major problems, so series applied!