Hacker News Reader

Root adding eBPF code is not worse than root being able to `insmod` a kernel module.

It adds a layer where complex attacks can hide. I'm not so much worried about the 'insmod' as I am about long term data exfiltration being used against me. This certainly does seem to make that a little easier.

A kernel module could exfiltrate data just as easily though.

Wrong, eBPF is way, way worse.

At the very least, Linux kernel has signed driver modules.

Can you explain why you consider it to be worse?

eBPF is also working on signed programs [0]

[0] https://lwn.net/Articles/853489/

eBPF has a way to go before it is secured enough.

One should not use eBPF in production machines (along with many other things that uses the mixed write-execute memory regions such as web browsers with JavaScript enabled).

Reply on news.ycombinator.com