| 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | |
| 3 | # BPF interpreter that, for example, classic socket filters depend on. |
| 4 | config BPF |
| 5 | bool |
| 6 | select CRYPTO_LIB_SHA256 |
| 7 | |
| 8 | # Used by archs to tell that they support BPF JIT compiler plus which |
| 9 | # flavour. Only one of the two can be selected for a specific arch since |
| 10 | # eBPF JIT supersedes the cBPF JIT. |
| 11 | |
| 12 | # Classic BPF JIT (cBPF) |
| 13 | config HAVE_CBPF_JIT |
| 14 | bool |
| 15 | |
| 16 | # Extended BPF JIT (eBPF) |
| 17 | config HAVE_EBPF_JIT |
| 18 | bool |
| 19 | |
| 20 | # Used by archs to tell that they want the BPF JIT compiler enabled by |
| 21 | # default for kernels that were compiled with BPF JIT support. |
| 22 | config ARCH_WANT_DEFAULT_BPF_JIT |
| 23 | bool |
| 24 | |
| 25 | menu "BPF subsystem" |
| 26 | |
| 27 | config BPF_SYSCALL |
| 28 | bool "Enable bpf() system call" |
| 29 | select BPF |
| 30 | select IRQ_WORK |
| 31 | select NEED_TASKS_RCU |
| 32 | select TASKS_TRACE_RCU |
| 33 | select BINARY_PRINTF |
| 34 | select NET_SOCK_MSG if NET |
| 35 | select NET_XGRESS if NET |
| 36 | select PAGE_POOL if NET |
| 37 | default n |
| 38 | help |
| 39 | Enable the bpf() system call that allows to manipulate BPF programs |
| 40 | and maps via file descriptors. |
| 41 | |
| 42 | config BPF_JIT |
| 43 | bool "Enable BPF Just In Time compiler" |
| 44 | depends on BPF |
| 45 | depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT |
| 46 | select EXECMEM |
| 47 | help |
| 48 | BPF programs are normally handled by a BPF interpreter. This option |
| 49 | allows the kernel to generate native code when a program is loaded |
| 50 | into the kernel. This will significantly speed-up processing of BPF |
| 51 | programs. |
| 52 | |
| 53 | Note, an admin should enable this feature changing: |
| 54 | /proc/sys/net/core/bpf_jit_enable |
| 55 | /proc/sys/net/core/bpf_jit_harden (optional) |
| 56 | /proc/sys/net/core/bpf_jit_kallsyms (optional) |
| 57 | |
| 58 | config BPF_JIT_ALWAYS_ON |
| 59 | bool "Permanently enable BPF JIT and remove BPF interpreter" |
| 60 | depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT |
| 61 | help |
| 62 | Enables BPF JIT and removes BPF interpreter to avoid speculative |
| 63 | execution of BPF instructions by the interpreter. |
| 64 | |
| 65 | When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable |
| 66 | is permanently set to 1 and setting any other value than that will |
| 67 | return failure. |
| 68 | |
| 69 | config BPF_JIT_DEFAULT_ON |
| 70 | def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON |
| 71 | depends on HAVE_EBPF_JIT && BPF_JIT |
| 72 | |
| 73 | config BPF_UNPRIV_DEFAULT_OFF |
| 74 | bool "Disable unprivileged BPF by default" |
| 75 | default y |
| 76 | depends on BPF_SYSCALL |
| 77 | help |
| 78 | Disables unprivileged BPF by default by setting the corresponding |
| 79 | /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can |
| 80 | still reenable it by setting it to 0 later on, or permanently |
| 81 | disable it by setting it to 1 (from which no other transition to |
| 82 | 0 is possible anymore). |
| 83 | |
| 84 | Unprivileged BPF could be used to exploit certain potential |
| 85 | speculative execution side-channel vulnerabilities on unmitigated |
| 86 | affected hardware. |
| 87 | |
| 88 | If you are unsure how to answer this question, answer Y. |
| 89 | |
| 90 | source "kernel/bpf/preload/Kconfig" |
| 91 | |
| 92 | config BPF_LSM |
| 93 | bool "Enable BPF LSM Instrumentation" |
| 94 | depends on BPF_EVENTS |
| 95 | depends on BPF_SYSCALL |
| 96 | depends on SECURITY |
| 97 | depends on BPF_JIT |
| 98 | help |
| 99 | Enables instrumentation of the security hooks with BPF programs for |
| 100 | implementing dynamic MAC and Audit Policies. |
| 101 | |
| 102 | If you are unsure how to answer this question, answer N. |
| 103 | |
| 104 | endmenu # "BPF subsystem" |