Speaker
Description
Triggered by:
Subject: [PATCH 0/4] bpf: add a few hooks for sandboxing
Message-Id: 20260220-work-bpf-namespace-v1-0-866207db7b83@kernel.org
Problem statements:
- Users (admins) are sometimes confused by some entity (PAM, systemd, container
runtimes) migrating their processes away from intended cgroup.
- Coarse-grained DAC doesn't express well who (migrating process) can operate
on what (cgroup) to what (migrated task).
- Limited immutability of membership assignment after certain point.
Proposed solution:
BPF LSM hook for cgroup_attach_permissions
(combination with other existing migration vetting mechanisms
association of permissions with PIDs instead of UIDs?)
Alternate solutions:
- stick with regular cgroup FS permissions
- utilization of other existing LSM hooks