Re: [PATCH] bpf: Add CONFIG_BPF_HELPER_STRICT

[KP Singh]

On Sun, Jan 15, 2023 at 10:32 PM Alexei Starovoitov
<alexei.starovoitov@xxxxxxxxx> wrote:
>
> On Fri, Jan 13, 2023 at 11:53 PM Roland <kernel.pwn@xxxxxxxxxxx> wrote:
> >
> > In container environment, ebpf helpers could be used maliciously to
> >    leak information, DOS, even escape from containers.
> >    CONFIG_BPF_HELPER_STRICT is as a mitigation of it.
> >    Related Link: https://rolandorange.zone/report.html
>
> The link is arguing that a process with CAP_SYS_ADMIN permissions
> can read memory of user processes, leak kernel addresses, etc.
> And this is somehow an issue with bpf helpers?
> and your suggested "temporary mitigation" is to CONFIG_BPF=n ?
> While this patch is a "proper fix" ?
> Sorry, but please stay with your "temporary mitigation" forever.

100% agreeing with Alexei here, if you are running your containers
with CAP_SYS_ADMIN there are a lot of other things you need to worry
about than just BPF helpers. You need to revisit your threat model and
consider not using CAP_SYS_ADMIN and more fine grained policies using
Mandatory Access Control.