Re: [PATCH bpf 0/2] bpf: Gate dynptr probe-read kfuncs like helpers

[Alexei Starovoitov]

On Thu Oct 29, 2026 at 5:15 PM UTC, Chris Down wrote:
> Hey Alexei,
>
> Alexei Starovoitov writes:
>> It's fine as-is. Won't fix.
>
> Could you expand a bit on the lockdown side of this? I ran into the same 
> discrepancy independently and was preparing fixes until I found this thread 
> while looking for prior discussion.
>
> The CAP_PERFMON side is now covered by 81c975aae375 ("bpf: Require CAP_PERFMON 
> for kfuncs reading memory"), but the probe_read_kernel helpers still check 
> LOCKDOWN_BPF_READ_KERNEL while the matching dynptr kfuncs don't. Is that 
> intentional?

lockdown is a security circus. It was broken from day one. It never worked.
So all these 'ohh let's fix it' missing the point.