Hacker News Reader

> ows from these premises that vendors should be careful about enabling non-root access to eBPF;

The thing is that it would be really nice to be able to set up a seccomp filter without a suid :\

seccomp does not use the eBPF userspace interface or any of the associated permission checks. seccomp (and also the classic socket filter interface) take cBPF (classic BPF), with no privilege checks; they use completely separate verification logic for this cBPF bytecode (the eBPF verifier is not involved IIRC), and then the cBPF code is (on almost all architectures) translated into eBPF. The eBPF kernel component is then only responsible for execution/JITting of this already-verified code, nothing else.

Makes sense, thanks.

Reply on news.ycombinator.com