Messages in this thread | | | Date | Wed, 23 Jul 2014 17:06:15 -0700 | Subject | Re: [PATCH RFC v2 net-next 13/16] tracing: allow eBPF programs to be attached to events | From | Alexei Starovoitov <> |
| |
On Wed, Jul 23, 2014 at 4:46 PM, Kees Cook <keescook@chromium.org> wrote: >> >> eBPF programs can call in-kernel helper functions to: >> - lookup/update/delete elements in maps >> - memcmp >> - trace_printk >> - load_pointer >> - dump_stack > > Ah, this must be the pointer leaking you mentioned. :) > > > Can the existing tracing mechanisms already expose kernel addresses? I > suspect "yes". So I guess existing limitations on tracing exposure > should already cover access control here? (I'm trying to figure out if > a separate CONFIG is needed -- I don't think so: nothing "new" is > exposed via eBPF, is that right?)
correct. through debugfs/tracing the whole kernel is already exposed. Idea of eBPF for tracing is to give kernel developers and performance engineers a tool to analyze what kernel is doing by writing programs in C and attaching them to kprobe/tracepoint events, so it's definitely for root only.
| |