From patchwork Thu May 20 23:14:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1481943 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4FmQd31dzBz9sW4; Fri, 21 May 2021 09:17:43 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1ljruz-00018V-6a; Thu, 20 May 2021 23:17:29 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1ljrux-00018P-Iy for kernel-team@lists.ubuntu.com; Thu, 20 May 2021 23:17:27 +0000 Received: from 1.general.cascardo.us.vpn ([10.172.70.58] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1ljruw-0006jd-Kj for kernel-team@lists.ubuntu.com; Thu, 20 May 2021 23:17:27 +0000 From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [Unstable 0/2] set unprivileged_bpf_disabled sysctl default to 2 Date: Thu, 20 May 2021 20:14:45 -0300 Message-Id: <20210520231447.427392-1-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" This set introduces a new value for unprivileged_bpf_disabled sysctl, that disables unprivileged BPF, but allows it to be reenabled. The value 1 disables it, but does not allow it to be set back to 0. This has been tested to boot just fine and BPF was disabled for unprivileged users, but worked for root. It also could be reenabled back, and unprivileged users could then run their code inside the kernel again. Daniel Borkmann (1): bpf: Add kconfig knob for disabling unpriv bpf by default Thadeu Lima de Souza Cascardo (1): UBUNTU: [Config]: set CONFIG_BPF_UNPRIV_DEFAULT_OFF=y Documentation/admin-guide/sysctl/kernel.rst | 17 +++++++++--- debian.master/config/annotations | 1 + debian.master/config/config.common.ubuntu | 1 + init/Kconfig | 10 +++++++ kernel/bpf/syscall.c | 3 ++- kernel/sysctl.c | 29 +++++++++++++++++---- 6 files changed, 52 insertions(+), 9 deletions(-) Acked-by: Tim Gardner