BPF and Security. Friends and Foes
summary
Claims that unprivileged BPF helped discover speculative‑execution CPU bugs and that BPF_LSM plus BPF/XDP actually protect hyperscaler clouds are backed by concrete tooling and results: XDP at Meta absorbs multi‑gigabit DDoS peaks (notably a half a terabit attack), the verifier performs symbolic speculative analysis, and mitigations include the array_index_nospec macro and a trivial stack sanitization patch. Countermeasures also force jit always on to remove the interpreter, and kernels default to disabling unprivileged BPF via sysctl while offering finer capBPF controls.
AI-written summary · about
chapters (24)
- 0:00BPF overview
- 1:49BPF as assembly
- 4:58BPF mission growth
- 7:06BPF program types
- 10:18Networking XDP DDoS
- 15:16BPF LSM sleepable
- 21:45BPF scheduler custom
- 21:55Unprivileged BPF history
- 23:33Spectre vulnerabilities
- 29:57Mitigating Spectre V1
- 31:05Spectre V2 risks
- 32:53JIT kernel security
- 36:06Verifier speculative analysis
- 37:54BPF exploit mitigations
- 39:00Disable unprivileged BPF
- 40:25CAP_BPF permission model
- 43:12CAP_BPF limitations
- 44:39BPF security perception
- 47:36Verifier 32-bit checks
- 50:25BPF startups marketing
- 51:31Systemd BPF security
- 54:20BPF vs kernel modules
- 55:48BPF portability advantages
- 56:10BPF security future
related talks
01h 03mBPF and Spectre: Mitigating transient execution attacks
33meBPF: exploring use case of BPF kernel infrastructure
20mEPF: Evil Packet Filter
32meBPF: The Next Power Tool of SREs
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
14mWill eBPF Save Us From the Next Global Outage?
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel