Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1

From	Michael Biebl <biebl@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1
Date	2021-06-28 15:50 +0200
Message-ID	<CuZOa-WF-3@gated-at.bofh.it> (permalink)
References	<CuZ1M-jK-9@gated-at.bofh.it> <CuZ1M-jK-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Am 28.06.21 um 14:52 schrieb Tomas Pospisek:
> Package: systemd
> Version: 247.3-5
> Severity: wishlist
> Tags: security
> X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
> 
> Hi,
> 
> TLDR:
> 
>      $ sudo sysctl kernel.unprivileged_bpf_disabled
>      kernel.unprivileged_bpf_disabled = 0
> 
> please disable unprivileged BPF by default, it seems that it
> is not safe to be allowed by default in the general case.
> 
> I'm not sure if systemd is the right place to report this
> security/wishlist ticket against. I've chosen systemd because it
> ships `/etc/sysctl.d/99-sysctl.conf` which seems to me to be the
> nearest fit to where `kernel.unprivileged_bpf_disabled` should
> be set. Please reassign if there's a better package to stick
> this report to.

/etc/sysctl.d/99-sysctl.conf is just a symlink pointing at
99-sysctl.conf -> ../sysctl.conf

$ dpkg -S /etc/sysctl.conf
procps: /etc/sysctl.conf

tbh, I'd prefer the security oder kernel team to make that judgement call.

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Michael Biebl <biebl@debian.org> - 2021-06-28 15:50 +0200
  Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Tomas Pospisek <tpo_deb@sourcepole.ch> - 2021-06-30 21:30 +0200
    Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Michael Biebl <biebl@debian.org> - 2021-06-30 21:40 +0200
      Processed: Re: Bug#990411: systemd: set kernel.unprivileged_bpf_disabled  = 1 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-06-30 22:00 +0200
    Processed (with 5 errors): Re: Bug#990411: systemd: set  kernel.unprivileged_bpf_disabled = 1 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-06-30 21:40 +0200
    Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Moritz Mühlenhoff <jmm@inutil.org> - 2021-07-06 15:10 +0200

csiph-web