Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1063233

Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Am 28.06.21 um 14:52 schrieb Tomas Pospisek:
> Package: systemd
> Version: 247.3-5
> Severity: wishlist
> Tags: security
> X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
> 
> Hi,
> 
> TLDR:
> 
>      $ sudo sysctl kernel.unprivileged_bpf_disabled
>      kernel.unprivileged_bpf_disabled = 0
> 
> please disable unprivileged BPF by default, it seems that it
> is not safe to be allowed by default in the general case.
> 
> I'm not sure if systemd is the right place to report this
> security/wishlist ticket against. I've chosen systemd because it
> ships `/etc/sysctl.d/99-sysctl.conf` which seems to me to be the
> nearest fit to where `kernel.unprivileged_bpf_disabled` should
> be set. Please reassign if there's a better package to stick
> this report to.

/etc/sysctl.d/99-sysctl.conf is just a symlink pointing at
99-sysctl.conf -> ../sysctl.conf

$ dpkg -S /etc/sysctl.conf
procps: /etc/sysctl.conf

tbh, I'd prefer the security oder kernel team to make that judgement call.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Tomas Pospisek <tpo_deb@sourcepole.ch> - 2021-06-28 15:00 +0200
  Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Michael Biebl <biebl@debian.org> - 2021-06-28 15:50 +0200
    Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Tomas Pospisek <tpo_deb@sourcepole.ch> - 2021-06-30 21:30 +0200
      Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Michael Biebl <biebl@debian.org> - 2021-06-30 21:40 +0200
      Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Moritz Mühlenhoff <jmm@inutil.org> - 2021-07-06 15:10 +0200
  Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Salvatore Bonaccorso <carnil@debian.org> - 2021-06-30 23:00 +0200
  Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Ben Hutchings <ben@decadent.org.uk> - 2021-08-02 21:50 +0200
    Bug#990411: systemd: set kernel.unprivileged_bpf_disabled = 1 Salvatore Bonaccorso <carnil@debian.org> - 2021-08-02 22:10 +0200

csiph-web