New Attempt Pursued At Using eBPF Within Linux's HID Subsystem

[phoronix]

Phoronix: New Attempt Pursued At Using eBPF Within Linux's HID Subsystem

Back in February was the interesting work laid out by Red Hat engineers for their looking at using eBPF within the kernel's HID subsystem. A new patch series attempting this innovative use of the in-kernel JIT virtual machine has been published...

https://www.phoronix.com/scan.php?page=news_item&px=HID-eBPF-New-Attempt

[tildearrow]

loaded at boot time

Just at boot time and not when the system is running?

[S.Pam]

eBPF keylogging should be fun

[intelfx]

eBPF keylogging should be fun

As if something stops you from keylogging straight out of evdev right now if you have the appropriate privileges?

[sinepgib]

As if something stops you from keylogging straight out of evdev right now if you have the appropriate privileges?

But is it not much more fun when you can blame New Stuff?

[khanich]

eBPF keylogging should be fun

https://gist.github.com/robertklep/5124355

Here, an X11 keylogger. You don't even need root (this was not even 5 minutes of web searching, although I haven't tested if it works across multiple users).

[tildearrow]

As if something stops you from keylogging straight out of evdev right now if you have the appropriate privileges?

Excep that with eBPF keylogging you can log every event, even those not registered by evdev (like non-HID-compliant data (e.g. macro keys in gaming keyboards)).

[intelfx]

Excep that with eBPF keylogging you can log every event, even those not registered by evdev (like non-HID-compliant data (e.g. macro keys in gaming keyboards)).

Doesn't matter. I understood the OP's comment as a sarcastic remark about a (purported) security hole created by this feature. My response was meant to show that Linux already has very similar mechanisms in terms of security impact, and hence the negativity was misplaced. And the subtler takeaway is that neither of those features actually is a security impact, because you need to have root privileges to use them.

[catpig]

Excep that with eBPF keylogging you can log every event, even those not registered by evdev (like non-HID-compliant data (e.g. macro keys in gaming keyboards)).

Because macro keys are a concern if regular keys are being logged? Come on