MIME-Version: 1.0
Date: Tue, 11 Feb 2020 09:56:35 +0000
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: "Ariadne Conill" <ariadne@dereferenced.org>
Message-ID: <0ce680254adefb97ca977a49b59bbe93@dereferenced.org>
Subject: Proposed change: Enable eBPF for root users only
To: ~alpine/devel@lists.alpinelinux.org

Hello,=0A=0AAt present, Alpine does not ship kernels that are eBPF enable=
d.  An=0Aincreasing amount of tools are dependent on eBPF, such as the su=
pport=0Afor VRFs in iproute2.  Accordingly, I would like to enable eBPF=
=0Asupport for the root user only.=0A=0AI believe that restricting eBPF t=
o privileged users does not introduce=0Aany new access or privilege to th=
ose users that does not already exist.=0AIf you have to be root to make u=
se of the bpf(2) syscall, then you=0Ahave to have already rooted the mach=
ine in order for eBPF to be useful=0Ato you.  There is a sysctl we can en=
able which locks bpf(2) down to=0Aroot usage only, and I propose that we =
enable it by default: users who=0Awish to expose eBPF to unprivileged use=
rs may adjust their configuration=0Ato do so.  This would involve placing=
 a warning in the appropriate=0Aconfiguration file that notes that eBPF c=
ould be potentially used by=0Aan unprivileged user to compromise the mach=
ine.=0A=0AOverall, I believe that exposing eBPF to the root user can be u=
sed to=0Aenable many security wins in Alpine, such as making it easy to u=
se=0AVRFs to isolate the management plane from the application plane, e.g=
.=0Aplacing sshd into vrf-mgmt and nginx into vrf-prod or similar.  eBPF=
=0Aprograms can also be used in place of netfilter, allowing for more=0Ap=
owerful packet filtering possibilities.  While those are not yet=0Arealiz=
ed, putting these tools in the hands of the Alpine community=0Awill allow=
 us to realize both of these possibilities in the future,=0Apossibly in t=
he 3.12 release window (as it is still quite early!)=0A=0AIf there are no=
 objections to this change, I will roll it out this=0Aweek.=0A=0AThanks,=
=0AAriadne