[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd.
From: |
Daniel P . Berrangé |
Subject: |
Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd. |
Date: |
Tue, 22 Jun 2021 09:27:10 +0100 |
User-agent: |
Mutt/2.0.7 (2021-05-04) |
On Tue, Jun 22, 2021 at 10:25:19AM +0200, Toke Høiland-Jørgensen wrote:
> Jason Wang <jasowang@redhat.com> writes:
>
> > 在 2021/6/22 上午11:29, Yuri Benditovich 写道:
> >> On Mon, Jun 21, 2021 at 12:20 PM Jason Wang <jasowang@redhat.com> wrote:
> >>>
> >>> 在 2021/6/19 上午4:03, Andrew Melnichenko 写道:
> >>>> Hi Jason,
> >>>> I've checked "kernel.unprivileged_bpf_disabled=0" on Fedora, Ubuntu,
> >>>> and Debian - no need permissions to update BPF maps.
> >>>
> >>> How about RHEL :) ?
> >> If I'm not mistaken, the RHEL releases do not use modern kernels yet
> >> (for BPF we need 5.8+).
> >> So this will be (probably) relevant for RHEL 9. Please correct me if I'm
> >> wrong.
> >
> > Adding Toke for more ideas on this.
>
> Ignore the kernel version number; we backport all of BPF to RHEL,
> basically. RHEL8.4 is up to upstream kernel 5.10, feature-wise.
>
> However, we completely disable unprivileged BPF on RHEL kernels. Also,
> there's upstream commit:
> 08389d888287 ("bpf: Add kconfig knob for disabling unpriv bpf by default")
>
> which adds a new value of '2' to the unprivileged_bpf_disable sysctl. I
> believe this may end up being the default on Fedora as well.
>
> So any design relying on unprivileged BPF is likely to break; I'd
> suggest you look into how you can get this to work with CAP_BPF :)
QEMU will never have any capabilities. Any resources that required
privileges have to be opened by a separate privileged helper, and the
open FD then passed across to the QEMU process. This relies on the
capabilities checks only being performed at time of initial opening,
and *not* on operations performed on the already open FD.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., (continued)
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/11
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Andrew Melnichenko, 2021/06/11
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Daniel P . Berrangé, 2021/06/11
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/15
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Andrew Melnichenko, 2021/06/15
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Andrew Melnichenko, 2021/06/18
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/21
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Yuri Benditovich, 2021/06/21
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Toke Høiland-Jørgensen, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd.,
Daniel P . Berrangé <=
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Toke Høiland-Jørgensen, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Andrew Melnichenko, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Toke Høiland-Jørgensen, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/22
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Yuri Benditovich, 2021/06/28
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Jason Wang, 2021/06/28
- Re: [RFC PATCH 0/5] ebpf: Added ebpf helper for libvirtd., Andrew Melnichenko, 2021/06/30