bpf: Add kconfig knob for disabling unpriv bpf by default

Browse source

Add a kconfig knob which allows for unprivileged bpf to be disabled by default.
If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2.

This still allows a transition of 2 -> {0,1} through an admin. Similarly,
this also still keeps 1 -> {1} behavior intact, so that once set to permanently
disabled, it cannot be undone aside from a reboot.

We've also added extra2 with max of 2 for the procfs handler, so that an admin
still has a chance to toggle between 0 <-> 2.

Either way, as an additional alternative, applications can make use of CAP_BPF
that we added a while ago.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net

...

This commit is contained in:

Daniel Borkmann 2021-05-11 22:35:17 +02:00 • committed by Alexei Starovoitov

parent b24abcff91

commit 08389d8882

4 changed files with 50 additions and 9 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

17

Documentation/admin-guide/sysctl/kernel.rst

View file

10

kernel/bpf/Kconfig

View file

3

kernel/bpf/syscall.c

View file

29

kernel/sysctl.c

View file