Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220404220314.112912-1-mcroce@linux.microsoft.com>
In-Reply-To: <20220404220314.112912-1-mcroce@linux.microsoft.com>
From:   Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date:   Mon, 4 Apr 2022 15:45:31 -0700
Message-ID: <CAADnVQLqXKPpfe3M1fnrUj=Cq91KucX9R95eSF+ExavWo2Wv_Q@mail.gmail.com>
Subject: Re: [PATCH] bpf: make unprivileged BPF a compile time choice
To:     Matteo Croce <mcroce@linux.microsoft.com>
Cc:     bpf <bpf@vger.kernel.org>, Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Apr 4, 2022 at 3:03 PM Matteo Croce <mcroce@linux.microsoft.com> wrote:
>
> From: Matteo Croce <mcroce@microsoft.com>
>
> Add a compile time option to permanently disable unprivileged BPF and
> the corresponding sysctl handler so that there's absolutely no
> concern about unprivileged BPF being enabled from userspace during
> runtime. Special purpose kernels can benefit from the build-time
> assurance that unprivileged eBPF is disabled in all of their kernel
> builds rather than having to rely on userspace to permanently disable
> it at boot time.
> The default behaviour is left unchanged, which is: unprivileged BPF
> compiled in but disabled at boot.

That is an insane level of "security" paranoia.
If you're so concerned about bpf do CONFIG_BPF_SYSCALL=n