On Mon, Sep 19, 2016 at 01:13:27PM -0700, Alexei Starovoitov wrote:
> On Mon, Sep 19, 2016 at 09:19:10PM +0200, Pablo Neira Ayuso wrote:
> > 2) This will turn the stack into a nightmare to debug I predict. If
> > any process with CAP_NET_ADMIN can potentially attach bpf blobs
> > via these hooks, we will have to include in the network stack
> a process without CAP_NET_ADMIN can attach bpf blobs to
> system calls via seccomp. bpf is already used for security and policing.
That is a local mechanism, it applies to parent process and child
processes, just like SO_ATTACH_FILTER.
The usecase that we're discussing here enforces a global policy.