Re: [PATCH bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

[Song Liu]

> On Jun 26, 2019, at 8:26 AM, Lorenz Bauer <l...@cloudflare.com> wrote:
> 
> On Wed, 26 Jun 2019 at 16:19, Song Liu <songliubrav...@fb.com> wrote:
>>> I know nothing about the scheduler, so pardon my ignorance. Does
>>> TASK_BPF_FLAG_PERMITTED apply per user-space process, or per thread?
>> 
>> It is per thread. clone() also clears the bit. I will make it more
>> clear int the commit log.
> 
> In that case this is going to be very hard if not impossible to use
> from languages that
> don't allow controlling threads, aka Go. I'm sure there are other
> examples as well.
> 
> Is it possible to make this per-process instead?

We can probably use CLONE_THREAD flag to differentiate clone() and 
fork(). I need to read it more carefully to determine whether this is 
accurate and safe. 

Thanks,
Song