On Fri, Feb 11, 2022 at 05:47:04PM +0000, Frank van der Linden wrote: > From: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > > commit 08389d888287c3823f80b0216766b71e17f0aba5 upstream. > > Add a kconfig knob which allows for unprivileged bpf to be disabled by default. > If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2. > > This still allows a transition of 2 -> {0,1} through an admin. Similarly, > this also still keeps 1 -> {1} behavior intact, so that once set to permanently > disabled, it cannot be undone aside from a reboot. > > We've also added extra2 with max of 2 for the procfs handler, so that an admin > still has a chance to toggle between 0 <-> 2. > > Either way, as an additional alternative, applications can make use of CAP_BPF > that we added a while ago. > > Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx> > Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@xxxxxxxxxxxxx > [fllinden@xxxxxxxxxx: backported to 5.4] > Signed-off-by: Frank van der Linden <fllinden@xxxxxxxxxx> Thanks for the backports, all now queued up. greg k-h