LWN: Comments on "eBPF seccomp() filters"

eBPF seccomp() filters

davecb — Thu, 03 Jun 2021 18:21:09 +0000

Hmmn, instead of doing an updater (old to new), I wonder if one could simply reject all the dangerous bits, and allow authors to use the newer notation so long as they avoided a particular feature-set?

That assumes, of course, that you can tell dangerous from safe syntactically.

eBPF seccomp() filters

jpsamaroo — Wed, 02 Jun 2021 14:22:30 +0000

Minor nitpick:

> Those filter programs, though, run on the "classic" BPF virtual machine

They actually run on the eBPF virtual machine (see latest update from Kees Cook on the bpf ML); the cBPF programs are just transformed into eBPF programs internally.

eBPF seccomp() filters

post-factum — Tue, 01 Jun 2021 09:49:48 +0000

cgroupv1^WeBPF was a nice proof-of-concept, welcome cgroupv2^WeBPFv2.