Re: [PATCH bpf-next v3 2/6] bpf: Verify signed loader metadata at load time
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.linux-security-module,org.kernel.vger.bpf |
|---|---|
| Message-ID | <CAHC9VhRk=j4_cNH5v+iCvSpJXz2g=dTK_+1O-kgT=E+OESENiA@mail.gmail.com> |
On Thu, Jul 2, 2026 at 6:33 PM Alexei Starovoitov <[email protected]> wrote: > On Thu Jul 2, 2026 at 3:05 PM PDT, Paul Moore wrote: ... > > With this patch, even in cases where SELinux will prevent the BPF > > program load operation, it is not able to do so before the process > > triggers a potential sizable memory allocation, opening the door for a > > local DoS attack. > > Not true either. Worst case is 1M which is 8Mbyte. > Not even close to anything DoS worthy. That's 8MB in a single allocation that can be triggered directly by userspace. I suspect most systems allow a fair number of processes per user; that 8MB allocation can quickly multiply into a big number, especially for more modest, non-server systems/VMs. -- paul-moore.com