On Sun, Jan 15, 2023 at 10:32 PM Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > On Fri, Jan 13, 2023 at 11:53 PM Roland <kernel.pwn@xxxxxxxxxxx> wrote: > > > > In container environment, ebpf helpers could be used maliciously to > > leak information, DOS, even escape from containers. > > CONFIG_BPF_HELPER_STRICT is as a mitigation of it. > > Related Link: https://rolandorange.zone/report.html > > The link is arguing that a process with CAP_SYS_ADMIN permissions > can read memory of user processes, leak kernel addresses, etc. > And this is somehow an issue with bpf helpers? > and your suggested "temporary mitigation" is to CONFIG_BPF=n ? > While this patch is a "proper fix" ? > Sorry, but please stay with your "temporary mitigation" forever. 100% agreeing with Alexei here, if you are running your containers with CAP_SYS_ADMIN there are a lot of other things you need to worry about than just BPF helpers. You need to revisit your threat model and consider not using CAP_SYS_ADMIN and more fine grained policies using Mandatory Access Control.
