Understanding the Security of Linux eBPF Subsystem

著者: Mohamed Husain Noor Mohamed, Xiaoguang Wang, Binoy Ravindran - Proceedings of the 14th ACM SIGOPS Asia-Pacific Workshop on Systems 2023 被引用: 15

Linux eBPF allows a userspace application to execute code inside the Linux kernel without modifying the kernel code or inserting a kernel module. An in-kernel eBPF verifier pre-verifies any untrusted eBPF bytecode before running it in kernel context. Currently, users trust the verifier to block malicious bytecode from being executed.