Restrict eBPF to administrators

Why it matters

eBPF lets programs load small pieces of code that the kernel runs for them. The kernel checks that code with a verifier, and bugs in that verifier have repeatedly let ordinary users escape to full control of the machine. If only privileged programs may load eBPF, those bugs are out of reach for everyone else.

How it works

Sets kernel.unprivileged_bpf_disabled to 1. Calls to bpf() without CAP_BPF or CAP_SYS_ADMIN then fail with a permission error. The kernel documentation says that once set to 1 this cannot be cleared until reboot; value 2 disables it but lets an admin change it later.

Who should use it

Right for most desktops and servers. Leave it off if you run eBPF tools as a normal user, such as some tracing or networking experiments.

What you may notice

Programs that load eBPF without privileges fail with Operation not permitted. Run them as root or with the right capability. Standard desktop software rarely needs this.

Check it on your computer

Read the current value:

sysctl kernel.unprivileged_bpf_disabled

A stricter value than this one is also fine.

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.unprivileged_bpf_disabled=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-unprivileged-bpf.conf <<'EOF'
kernel.unprivileged_bpf_disabled = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Harden the eBPF compiler
• Restrict performance events

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.unprivileged_bpf_disabled