linux-kernel - [RFC] [PATCH bpf-next 0/1] Enhancement for bpf_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211120051839.28212-1-yunbo.xufeng@linux.alibaba.com>
Date:   Sat, 20 Nov 2021 13:18:38 +0800
From:   Xufeng Zhang <yunbo.xufeng@...ux.alibaba.com>
To:     jolsa@...nel.org, kpsingh@...gle.com, andriin@...com,
        ast@...nel.org, daniel@...earbox.net, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     netdev@...r.kernel.org, yunbo.xufeng@...ux.alibaba.com
Subject: [RFC] [PATCH bpf-next 0/1] Enhancement for bpf_do_path() helper

Background:
--------------------------------------------------------------------------------------------------
This is our scenario:
We restrict process to do certain operations in LSM hookpoint based on user specified security rules, 
and one dimension of the rule is the process’s executable full path, so we use bpf_d_path() helper to
get the path, and do rule matching in hash maps to make the allow or deny decision. However, the
returned buffer is not our expected, there is always noisy data at the tail of the buffer and makes
hash map lookup fails to work.
We have tried several ways to workaround this problem, such as using __builtin_memset() to clear
the returned buffer, but it does not work because __builtin_memset() cannot accept variable sized
buffer; and we also tried use a loop the iterate every byte of the buffer and clear the noisy data,
this works in simple bpf programs but makes a lot of trouble to us for complex bpf program cases,
e.g. reaching 1M instruction limitation or stack overflow.
Thus, we want to enhance the origin bpf_do_path() implementation, clearing the noisy tail buffer
helps a lot to us.

Appreciate for your suggestion.

Xufeng Zhang (1):
bpf: Clear the noisy tail buffer for bpf_d_path() helper
---
 kernel/trace/bpf_trace.c | 2 ++
 1 file changed, 2 insertions(+)