Messages in this thread |  | | From | Alexei Starovoitov <> | Date | Sun, 15 Jan 2023 13:32:04 -0800 | Subject | Re: [PATCH] bpf: Add CONFIG_BPF_HELPER_STRICT |
| |
On Fri, Jan 13, 2023 at 11:53 PM Roland <kernel.pwn@outlook.com> wrote: > > In container environment, ebpf helpers could be used maliciously to > leak information, DOS, even escape from containers. > CONFIG_BPF_HELPER_STRICT is as a mitigation of it. > Related Link: https://rolandorange.zone/report.html
The link is arguing that a process with CAP_SYS_ADMIN permissions can read memory of user processes, leak kernel addresses, etc. And this is somehow an issue with bpf helpers? and your suggested "temporary mitigation" is to CONFIG_BPF=n ? While this patch is a "proper fix" ? Sorry, but please stay with your "temporary mitigation" forever.
|  |