On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov <alexei.starovoi...@gmail.com> wrote:
> On Wed, May 23, 2018 at 02:18:19PM +0200, Eugene Syromiatnikov wrote: > > Some BPF sysctl knobs affect the loading of BPF programs, and during > > system boot/init stages these sysctls are not yet configured. > > A concrete example is systemd, that has implemented loading of BPF > > programs. > > > > Thus, to allow controlling these setting at early boot, this patch set > > adds the ability to change the default setting of these sysctl knobs > > as well as option to override them via a boot-time kernel parameter > > (in order to avoid rebuilding kernel each time a need of changing these > > defaults arises). > > > > The sysctl knobs in question are kernel.unprivileged_bpf_disable, > > net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms. > > - systemd is root. today it only uses cgroup-bpf progs which require root, > so disabling unpriv during boot time makes no difference to systemd. > what is the actual reason to present time? > > - say in the future systemd wants to use so_reuseport+bpf for faster > networking. With unpriv disable during boot, it will force systemd > to do such networking from root, which will lower its security barrier. > How that make sense? > > - bpf_jit_kallsyms sysctl has immediate effect on loaded programs. > Flipping it during the boot or right after or any time after > is the same thing. Why add such boot flag then? > > - jit_harden can be turned on by systemd. so turning it during the boot > will make systemd progs to be constant blinded. > Constant blinding protects kernel from unprivileged JIT spraying. > Are you worried that systemd will attack the kernel with JIT spraying? I think you are missing that, we want the ability to change these defaults in-order to avoid depending on /etc/sysctl.conf settings, and that the these sysctl.conf setting happen too late. For example with jit_harden, there will be a difference between the loaded BPF program that got loaded at boot-time with systemd (no constant blinding) and when someone reloads that systemd service after /etc/sysctl.conf have been evaluated and setting bpf_jit_harden (now slower due to constant blinding). This is inconsistent behavior. -- Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer
