linux-kernel - Re: [PATCH v2 net-next 0/3] bpf: share helpers between tracing and networking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 16 Jun 2015 11:19:40 +0200
From:	Daniel Borkmann <daniel@...earbox.net>
To:	Alexei Starovoitov <ast@...mgrid.com>,
	David Miller <davem@...emloft.net>
CC:	luto@...capital.net, mingo@...nel.org, rostedt@...dmis.org,
	wangnan0@...wei.com, lizefan@...wei.com,
	daniel.wagner@...-carit.de, linux-api@...r.kernel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 net-next 0/3] bpf: share helpers between tracing and
 networking

On 06/16/2015 05:28 AM, Alexei Starovoitov wrote:
> On 6/15/15 4:01 PM, David Miller wrote:
>>
>> Although I agree with the sentiment that this thing can cause
>> surprising results and can be asking for trouble.
>>
>> If someone wants to filter traffic "by UID" they might make
>> a simple ingress TC ebpf program using these new interfaces
>> and expect it to work.
>>
>> But the UID their program will see will be the UID of whatever
>> randomly happened to be executing when the packet was received
>> and processed.
>
> yes, you're right. Such tc filters will be incorrect.
> Will send a partial revert disallowing them in tc.

Sorry for late reply [on vacation]; if you really want to, you
could go via skb->sk->sk_socket->file and then retrieve credentials
from there for egress side (you can have a look at xt_owner). You'd
need a different *_proto helper for tc in that case, which would
then map to BPF_FUNC_get_current_uid_gid, etc. But that doesn't work
for ingress however, even if you would have early demux, so you
would need to let the eBPF helper function return an error code in
that case.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/