You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -244,12 +252,14 @@ The caller does not have the **CAP_SYS_ADMIN** capability and the
244
252
245
253
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
246
254
io_uring_register_bpf_filter_task(&bpf);
255
+
```
247
256
248
257
**Discover**\ kernel pdu_size for an opcode
249
258
250
259
This example demonstrates how to use the **-EMSGSIZE** write-back to
251
260
discover the kernel's expected payload size.
252
261
262
+
```c
253
263
struct sock_filter allow[] = {
254
264
BPF_STMT(BPF_RET | BPF_K, 1),
255
265
};
@@ -274,6 +284,7 @@ discover the kernel's expected payload size.
274
284
/* retry with correct size */
275
285
ret = io_uring_register_bpf_filter(&ring, &bpf);
276
286
}
287
+
```
277
288
278
289
# NOTES
279
290
@@ -287,7 +298,9 @@ with elevated privileges but under the attacker-controlled filter.
287
298
288
299
To set the **no_new_privs** attribute, call:
289
300
301
+
```c
290
302
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
303
+
```
291
304
292
305
Once set, **no_new_privs** cannot be unset and is inherited by child
293
306
processes across [fork](https://man7.org/linux/man-pages/man2/fork.2.html) and preserved across [execve](https://man7.org/linux/man-pages/man2/execve.2.html).
@@ -244,12 +253,14 @@ The caller does not have the **CAP_SYS_ADMIN** capability and the
244
253
245
254
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
246
255
io_uring_register_bpf_filter_task(&bpf);
256
+
```
247
257
248
258
**Discover**\ kernel pdu_size for an opcode
249
259
250
260
This example demonstrates how to use the **-EMSGSIZE** write-back to
251
261
discover the kernel's expected payload size.
252
262
263
+
```c
253
264
struct sock_filter allow[] = {
254
265
BPF_STMT(BPF_RET | BPF_K, 1),
255
266
};
@@ -274,6 +285,7 @@ discover the kernel's expected payload size.
274
285
/* retry with correct size */
275
286
ret = io_uring_register_bpf_filter(&ring, &bpf);
276
287
}
288
+
```
277
289
278
290
# NOTES
279
291
@@ -287,7 +299,9 @@ with elevated privileges but under the attacker-controlled filter.
287
299
288
300
To set the **no_new_privs** attribute, call:
289
301
302
+
```c
290
303
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
304
+
```
291
305
292
306
Once set, **no_new_privs** cannot be unset and is inherited by child
293
307
processes across [fork](https://man7.org/linux/man-pages/man2/fork.2.html) and preserved across [execve](https://man7.org/linux/man-pages/man2/execve.2.html).
0 commit comments