linux-kernel - Re: [PATCH bpf-next] bpf: allow CGROUP_SKB programs to use bpf_get_current_cgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Jun 2019 19:08:00 +0000
From:   Roman Gushchin <guro@...com>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>
CC:     Kernel Team <Kernel-team@...com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Yonghong Song <yhs@...com>
Subject: Re: [PATCH bpf-next] bpf: allow CGROUP_SKB programs to use
 bpf_get_current_cgroup_id() helper

On Thu, Jun 06, 2019 at 11:59:11AM -0700, Roman Gushchin wrote:
> Currently bpf_get_current_cgroup_id() is not supported for
> CGROUP_SKB programs. An attempt to load such a program generates an
> error like this:
>     libbpf:
>     0: (b7) r6 = 0
>     ...
>     8: (63) *(u32 *)(r10 -28) = r6
>     9: (85) call bpf_get_current_cgroup_id#80
>     unknown func bpf_get_current_cgroup_id#80
> 
> There are no particular reasons for denying it,
> and we have some use cases where it might be useful.

Ah, sorry, it's not so simple, as we probably need to take
the cgroup pointer from the socket, not from current.

So the implementation of the helper should be different
for this type of programs.

So I wonder if it's better to introduce a new helper
bpf_get_sock_cgroup_id()?

What do you think?

Thanks!