this is why eBPF is restricted to root in alpine. all distributions should do that.
Conversation
Replying to
unfortunately, that is not practical. many new kernel features are controlled through eBPF, such as VRFs, `ip vrf exec` depends on eBPF.
1
3
other examples include the newer performance tracing functionality, etc. all of it is unfortunately built on eBPF.
1
1
Replying to
yes, but when you enable some options, like CONFIG_BPF_SYSCALL, you have CONFIG_BPF_JIT=y automatically, and you can't get rid of it. and unfortunately, the bpf syscall is now a popular one for these new toys.
1
2
Replying to
Are you sure? There are plenty of archs with no JIT. JIT should be independent.
1
Replying to
apparently they turn it on as a "security mitigation" where its available, see CONFIG_BPF_JIT_ALWAYS_ON.
apparently this is because the interpreter does speculation
1
1
The issue is that the interpreter provides very useful Spectre 2 gadgets simply by existing.
git.kernel.org/pub/scm/linux/
There are gadgets all over the kernel so this mitigation is very questionable. It's comparable to removing/changing code to eliminate well known ROP gadgets...
1
2
6
Once an attacker has developed a scripting framework for finding Spectre 2 gadgets, then this accomplishes very little. It's not a real barrier but rather at most an inconvenience: a well known and useful set of gadgets isn't available. It's security through obscurity at best.
Since most distributions now enable BPF_JIT_ALWAYS_ON, any value it provides via obscurity is essentially already there.
If you configure your kernel without it, then sure, you have an easy source of useful Spectre 2 gadgets, but since hardly anyone else does, it's as obscure...
2
1
most distributions likely blindly enable BPF_JIT_ALWAYS_ON. it is basically default yes.
i see. well, with stuff like XDP, i am sure people would be upset if we turned the JIT off anyway, but they go to some level of effort to make it hard to do so.
1
CONFIG_BPF_JIT_ALWAYS_ON is a config switch you can switch off though, no?
1
It forces the JIT to always be enabled at compile-time in order to avoid compiling the interpreter into the kernel. You can build the kernel without it. If the kernel is built with it, then there's no option to use the interpreter. It's how most distributions build Linux now.
2
1
Show replies