{"id":1191519,"date":"2023-10-12T10:40:47","date_gmt":"2023-10-12T14:40:47","guid":{"rendered":"https:\/\/www.prime-wow.com\/?p=1191519"},"modified":"2023-10-12T10:40:47","modified_gmt":"2023-10-12T14:40:47","slug":"finer-grained-bpf-tokens","status":"publish","type":"post","link":"https:\/\/www.prime-wow.com\/?p=1191519","title":{"rendered":"[$] Finer-grained BPF tokens"},"content":{"rendered":"<p>Programs running in the BPF machine can, depending on how they are<br \/>\nattached, perform a number of privileged operations; the ability to load<br \/>\nand run those programs, thus, must be a privileged operation in its own<br \/>\nright.  Almost since the beginning of the extended-BPF era, developers have<br \/>\nstruggled to find a way to allow users to run the programs they need<br \/>\nwithout giving away more privilege than is necessary.  Earlier this year,<br \/>\nthe idea of a <a href=\"https:\/\/lwn.net\/Articles\/935195\/\">BPF token<\/a> ran into some<br \/>\nopposition from security-oriented developers.  Andrii Nakryiko has since<br \/>\nreturned with <a href=\"https:\/\/lwn.net\/ml\/linux-fsdevel\/20230927225809.2049655-1-andrii@kernel.org\/\">an<br \/>\nupdated patch set<\/a> that significantly increases the granularity of the<br \/>\nprivileges that can be conferred with a BPF token.&#013;<br \/>\n&#013;<br \/>\nSource: LWN.net &#8211; <a href=\"https:\/\/lwn.net\/Articles\/947173\/\" target=\"_blank\" rel=\"noopener\">[$] Finer-grained BPF tokens<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Programs running in the BPF machine can, depending on how they are attached, perform a number of privileged operations; the ability to load and run those programs, thus, must be a privileged operation in its own right. Almost since the &hellip; <a href=\"https:\/\/www.prime-wow.com\/?p=1191519\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72],"tags":[75],"class_list":["post-1191519","post","type-post","status-publish","format-standard","hentry","category-linux","tag-linux"],"_links":{"self":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1191519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1191519"}],"version-history":[{"count":0,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1191519\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1191519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1191519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1191519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}