lkml.org 
[lkml]   [2023]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [RFC PATCH bpf-next 00/13] bpf: Introduce BPF namespace
    On Sun, Mar 26, 2023 at 2:22 AM Yafang Shao <laoar.shao@gmail.com> wrote:
    >
    > Currently only CAP_SYS_ADMIN can iterate BPF object IDs and convert IDs
    > to FDs, that's intended for BPF's security model[1]. Not only does it
    > prevent non-privilidged users from getting other users' bpf program, but
    > also it prevents the user from iterating his own bpf objects.
    >
    > In container environment, some users want to run bpf programs in their
    > containers. These users can run their bpf programs under CAP_BPF and
    > some other specific CAPs, but they can't inspect their bpf programs in a
    > generic way. For example, the bpftool can't be used as it requires
    > CAP_SYS_ADMIN. That is very inconvenient.

    Agreed that it is important to enable tools like bpftool without
    CAP_SYS_ADMIN. However, I am not sure whether we need a new
    namespace for this. Can we reuse some existing namespace for this?

    If we do need a new namespace, maybe we should share some effort
    with tracer namespace proposal [1]?

    Thanks,
    Song

    [1] https://lpc.events/event/16/contributions/1237/

    \
     
     \ /
      Last update: 2023-03-27 21:05    [W:4.267 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site