Speaker
Description
BPF usage has traditionally required system-wide capabilities, and giving an application access to using BPF is an all-or-nothing proposition. With BPF tokens, we gained the ability to delegate BPF capabilities to user namespaces with more granularity, and with an LSM we can increase granularity further.
Both BPF token usage, and an LSM require a userspace implementation of the policy enforcement mechanism. bpf-rbacd is such an implementation, which runs as a system service and supports granting permissions to applications or containers on the system using either BPF token delegation or syscall proxying. A policy language restricts which subset of BPF an application is allowed to use, with high granularity, enforced through an LSM written in BPF.
We are working on making bpf-rbacd a core part of the Fedora and RHEL distributions. In this talk we'll present the architecture of bpf-rbacd and solicit feedback from the community on the design of the system, in the hope that this can prove useful to other distributions and operators as well.