On Thu, Oct 31, 2024 at 9:02 AM Song Liu <songliubraving@xxxxxxxx> wrote: > > > Not sure how you want to best handle that. > > We may also introduce other prefixes for future use cases. bpf infra makes zero effort to prevent insecure/nonsensical bpf programs. It's futile. Humans will always find ways to shoot themselves in the foot. Before bpf-lsm existed people were selling "security" products where _tracing_ bpf programs monitored syscall activity with kprobes suffering all TOCTOU issues and signaling root user same daemon via bpf maps/ring buffers to kill "bad" processes. Such startups still exist. There is no technical solution to human "ingenuity".
