Comment on eBPF Verification Is UntenableparentComments−saagarjha3yOk but you can like put a tracepoint on read/write and peek at what’s going through those, no?−madog3yNope. Tracepoint eBPF programs require root to load always. For eBPF you select a program type, and that limits what you can do (aka what helper functions are available to you) and what privileges are required.−tptacek3yI have no idea, because every system I've ever worked on has disabled unprivileged eBPF.
Comments
Ok but you can like put a tracepoint on read/write and peek at what’s going through those, no?
Nope. Tracepoint eBPF programs require root to load always. For eBPF you select a program type, and that limits what you can do (aka what helper functions are available to you) and what privileges are required.
I have no idea, because every system I've ever worked on has disabled unprivileged eBPF.