Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

(off-list ancestor, not in this archive)
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-07-30
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Song Liu <hidden> · 2019-07-31
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-07-31
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Song Liu <hidden> · 2019-08-02
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-04
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Song Liu <hidden> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-05
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-06
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-07
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Lorenz Bauer <hidden> · 2019-08-07
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-07
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-13
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Daniel Colascione <hidden> · 2019-08-13
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-13
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-13
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-14
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Jordan Glover <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Jordan Glover <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Thomas Gleixner <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Jordan Glover <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Thomas Gleixner <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Thomas Gleixner <hidden> · 2019-08-19
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-19
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-19
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Jordan Glover <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Kees Cook <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-15
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@amacapital.net> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Song Liu <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Christian Brauner <hidden> · 2019-08-16
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Christian Brauner <hidden> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Christian Brauner <hidden> · 2019-08-17
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Daniel Borkmann <daniel@iogearbox.net> · 2019-08-22
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Andy Lutomirski <luto@kernel.org> · 2019-08-22
RFC: very rough draft of a bpf permission model · Andy Lutomirski <luto@kernel.org> · 2019-08-22
Re: RFC: very rough draft of a bpf permission model · Alexei Starovoitov <hidden> · 2019-08-22
Re: RFC: very rough draft of a bpf permission model · Andy Lutomirski <luto@kernel.org> · 2019-08-23
Re: RFC: very rough draft of a bpf permission model · Alexei Starovoitov <hidden> · 2019-08-26
Re: RFC: very rough draft of a bpf permission model · Andy Lutomirski <luto@kernel.org> · 2019-08-27
Re: RFC: very rough draft of a bpf permission model · Alexei Starovoitov <hidden> · 2019-08-27
Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf · Alexei Starovoitov <hidden> · 2019-08-22

From: Andy Lutomirski <luto@amacapital.net>
Date: 2019-08-05 22:21:13
Also in: bpf, linux-api, netdev

On Aug 5, 2019, at 2:25 PM, Andy Lutomirski [off-list ref] wrote:

On Mon, Aug 5, 2019 at 12:21 PM Alexei Starovoitov
[off-list ref] wrote:

quoted

What we need is to drop privileges sooner in daemons like systemd.

This is doable right now: systemd could fork off a subprocess and
delegate its cgroup operations to it.  It would be maybe a couple
hundred lines of code.  As an added benefit, that subprocess could
verify that the bpf operations in question are reasonable.
Alternatively, if there was a CAP_BPF_ADMIN, systemd could retain that
capability and flip it on and off as needed.

I tried to look at the code and I couldn’t find it. Does systemd drop privileges at all?  Can you point me at the code you’re thinking of

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help