On 12/19/19, 07:47, "Daniel Borkmann" <daniel@xxxxxxxxxxxxx> wrote: > What about CAP_BPF? What is the status of this? It might solve some of the problems, but it is still puts testing BPF outside reach of normal users. > IIRC, there are also other issues e.g. you could abuse the test interface as a packet > generator (bpf_clone_redirect) which is not something fully unpriv should be doing. Good point. I suspect solutions exist - I'm trying to ascertain if they are worth pursuing or if the idea of unprivileged testing is a complete non-starter to begin with. Are there other helpers of concern that come immediately to mind? A first stab might add these to the list in the verifier that require privilege. This has the drawback that programs that actually need this kind of functionality are beyond the test framework. Another idea might be to have some kind of test classification stored in the program context. That way, dangerous helpers could be replaced by versions that mock the functionality in some safe way. Perhaps having test programs only have access to a subset of virtual netdevs for clone redirect, for example. Regards, Edwin Peer
