Feature #11827: Disable unprivileged BPF

Feature #11827

Disable unprivileged BPF

Added by cypherpunks 2016-09-23 00:20:19 . Updated 2017-01-24 20:42:48 .

Status:

Resolved

Priority:

Normal

Assignee:

Category:

Target version:

Tails 2.10

Start date:

2016-09-22

Due date:

% Done:

100%

Feature Branch:

feature/11827-disable-unprivileged-bpf

Type of work:

Code

Blueprint:

Starter:

Affected tool:

Deliverable for:

Description

Since upgrading to kernel 4.6, unprivileged users can use the bpf() syscall, which is a security concern, even with JIT disabled. Tails should set the kernel.unprivileged_bpf_disabled sysctl to 1. No programs on Tails use it, so this won’t cause any regressions, and will increase security quite a bit.

Subtasks

History

#1 Updated by intrigeri 2016-09-24 01:39:26

Assignee set to cypherpunks
QA Check set to Info Needed

> No programs on Tails use it, so this won’t cause any regressions

May I ask how you’ve checked that?

Once this is clarified, I’m open to running our test suite with this sysctl turned on.

#2 Updated by cypherpunks 2016-09-24 02:52:31

intrigeri wrote:
> > No programs on Tails use it, so this won’t cause any regressions
>
> May I ask how you’ve checked that?
>
> Once this is clarified, I’m open to running our test suite with this sysctl turned on.

It’s only used for things like network profiling in userspace, nothing that a Tails user would have or need. Plus, it wasn’t available before Tails 2.6, so unless new network profiling tools were added to the kernel, removing it has no effect. Note that disabling the bpf() does not mean disabling all BPF/eBPF. Netfilter still uses BPF, seccomp still uses BPF, etc. All it means is that userspace network profiling tools and such will not function.