linux-kernel - Re: [RFC PATCH bpf-next 4/5] bpf: load and verify kernel module BTFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 Nov 2020 17:46:16 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Andrii Nakryiko <andrii@...nel.org>, bpf@...r.kernel.org,
        netdev@...r.kernel.org, ast@...com, daniel@...earbox.net,
        kernel-team@...com, Arnaldo Carvalho de Melo <acme@...hat.com>,
        Jessica Yu <jeyu@...nel.org>, linux-kernel@...r.kernel.org,
        "Rafael J. Wysocki" <rafael@...nel.org>
Subject: Re: [RFC PATCH bpf-next 4/5] bpf: load and verify kernel module BTFs

On Thu, Nov 05, 2020 at 08:39:25AM -0800, Jakub Kicinski wrote:
> On Wed, 4 Nov 2020 20:51:39 -0800 Andrii Nakryiko wrote:
> > Add kernel module listener that will load/validate and unload module BTF.
> > Module BTFs gets ID generated for them, which makes it possible to iterate
> > them with existing BTF iteration API. They are given their respective module's
> > names, which will get reported through GET_OBJ_INFO API. They are also marked
> > as in-kernel BTFs for tooling to distinguish them from user-provided BTFs.
> > 
> > Also, similarly to vmlinux BTF, kernel module BTFs are exposed through
> > sysfs as /sys/kernel/btf/<module-name>. This is convenient for user-space
> > tools to inspect module BTF contents and dump their types with existing tools:
> 
> Is there any precedent for creating per-module files under a new
> sysfs directory structure? My intuition would be that these files 
> belong under /sys/module/

Ick, why?  What's wrong with them under btf?  The module core code
"owns" the /sys/modules/ tree.  If you want others to mess with that, it
will get tricky.


> Also the CC list on these patches is quite narrow. You should have 
> at least CCed the module maintainer. Adding some folks now.
> 
> > [vmuser@...hvm bpf]$ ls -la /sys/kernel/btf
> > total 0
> > drwxr-xr-x  2 root root       0 Nov  4 19:46 .
> > drwxr-xr-x 13 root root       0 Nov  4 19:46 ..
> > 
> > ...
> > 
> > -r--r--r--  1 root root     888 Nov  4 19:46 irqbypass
> > -r--r--r--  1 root root  100225 Nov  4 19:46 kvm
> > -r--r--r--  1 root root   35401 Nov  4 19:46 kvm_intel
> > -r--r--r--  1 root root     120 Nov  4 19:46 pcspkr
> > -r--r--r--  1 root root     399 Nov  4 19:46 serio_raw
> > -r--r--r--  1 root root 4094095 Nov  4 19:46 vmlinux
> > 
> > Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
> > ---
> >  include/linux/bpf.h    |   2 +
> >  include/linux/module.h |   4 +
> >  kernel/bpf/btf.c       | 193 +++++++++++++++++++++++++++++++++++++++++
> >  kernel/bpf/sysfs_btf.c |   2 +-
> >  kernel/module.c        |  32 +++++++
> >  5 files changed, 232 insertions(+), 1 deletion(-)
> > 
> > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > index 2fffd30e13ac..3cb89cd7177b 100644
> > --- a/include/linux/bpf.h
> > +++ b/include/linux/bpf.h
> > @@ -36,9 +36,11 @@ struct seq_operations;
> >  struct bpf_iter_aux_info;
> >  struct bpf_local_storage;
> >  struct bpf_local_storage_map;
> > +struct kobject;
> >  
> >  extern struct idr btf_idr;
> >  extern spinlock_t btf_idr_lock;
> > +extern struct kobject *btf_kobj;

I don't see any Documentation/ABI/ updates for the sysfs changes here,
did I miss it?

thanks,

greg k-h