Re: [PATCH 18/27] bpf: Restrict kernel image access functions when the kernel is locked down
From: David Howells <dhowells@redhat.com>
Date: 2017-10-23 14:51:24
Also in:
lkml
Alexei Starovoitov [off-list ref] wrote:
If you want to lock down read access you'd need to disable not only bpf, but all of kprobe and likey ftrace, since untrusted root can infer kernel data by observing function execution even if it cannot load modules and bpf progs.
Okay. David