[Unstable v2 1/2] bpf: Add kconfig knob for disabling unpriv bpf by default

[Thadeu Lima de Souza Cascardo]

From: Daniel Borkmann <daniel at iogearbox.net>

Add a kconfig knob which allows for unprivileged bpf to be disabled by default.
If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2.

This still allows a transition of 2 -> {0,1} through an admin. Similarly,
this also still keeps 1 -> {1} behavior intact, so that once set to permanently
disabled, it cannot be undone aside from a reboot.

We've also added extra2 with max of 2 for the procfs handler, so that an admin
still has a chance to toggle between 0 <-> 2.

Either way, as an additional alternative, applications can make use of CAP_BPF
that we added a while ago.

Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast at kernel.org>
Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net
(backported from commit 08389d888287c3823f80b0216766b71e17f0aba5)
[cascardo: move the Kconfig option on init/Kconfig]
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
---
 init/Kconfig | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/init/Kconfig b/init/Kconfig
index dc3b6e6e20c0..0ae51861aa62 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1760,6 +1760,16 @@ config BPF_JIT_DEFAULT_ON
 	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
 	depends on HAVE_EBPF_JIT && BPF_JIT
 
+config BPF_UNPRIV_DEFAULT_OFF
+	bool "Disable unprivileged BPF by default"
+	depends on BPF_SYSCALL
+	help
+	  Disables unprivileged BPF by default by setting the corresponding
+	  /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
+	  still reenable it by setting it to 0 later on, or permanently
+	  disable it by setting it to 1 (from which no other transition to
+	  0 is possible anymore).
+
 source "kernel/bpf/preload/Kconfig"
 
 config USERFAULTFD
-- 
2.30.2