Files
linux/Documentation
Daniel Borkmann ecb6af1fce bpf: Add kconfig knob for disabling unpriv bpf by default
commit 08389d8882 upstream.

Add a kconfig knob which allows for unprivileged bpf to be disabled by default.
If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2.

This still allows a transition of 2 -> {0,1} through an admin. Similarly,
this also still keeps 1 -> {1} behavior intact, so that once set to permanently
disabled, it cannot be undone aside from a reboot.

We've also added extra2 with max of 2 for the procfs handler, so that an admin
still has a chance to toggle between 0 <-> 2.

Either way, as an additional alternative, applications can make use of CAP_BPF
that we added a while ago.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net
[fllinden@amazon.com: backported to 4.9]
Signed-off-by: Frank van der Linden <fllinden@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-16 12:42:13 +09:00
..
2016-05-31 16:41:55 +08:00
2017-11-09 18:58:24 -07:00
2015-06-08 23:15:45 +02:00
2016-10-11 15:06:33 -07:00
2017-10-13 11:27:08 +00:00
2023-05-16 11:09:32 +09:00
2023-05-16 11:09:32 +09:00
2023-05-16 11:09:32 +09:00
2016-06-30 13:07:33 -06:00
2023-05-15 13:40:23 +09:00
2016-06-07 22:57:10 +02:00
2016-06-07 22:57:10 +02:00
2016-09-20 18:46:36 -06:00
2014-12-08 09:07:11 -05:00
2016-05-17 14:48:04 +02:00
2016-04-28 08:02:36 -06:00