linux-kernel - Re: [PATCH v10 5/9] bpf: Add bpf_lookup_*_key() and bpf_key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Aug 2022 16:22:27 +0000
From:   Daniel Müller <deso@...teo.net>
To:     Roberto Sassu <roberto.sassu@...wei.com>
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        "ast@...nel.org" <ast@...nel.org>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        "andrii@...nel.org" <andrii@...nel.org>,
        "martin.lau@...ux.dev" <martin.lau@...ux.dev>,
        "song@...nel.org" <song@...nel.org>, "yhs@...com" <yhs@...com>,
        "john.fastabend@...il.com" <john.fastabend@...il.com>,
        "kpsingh@...nel.org" <kpsingh@...nel.org>,
        "sdf@...gle.com" <sdf@...gle.com>,
        "haoluo@...gle.com" <haoluo@...gle.com>,
        "jolsa@...nel.org" <jolsa@...nel.org>,
        "corbet@....net" <corbet@....net>,
        "dhowells@...hat.com" <dhowells@...hat.com>,
        "jarkko@...nel.org" <jarkko@...nel.org>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com" <serge@...lyn.com>,
        "shuah@...nel.org" <shuah@...nel.org>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v10 5/9] bpf: Add bpf_lookup_*_key() and bpf_key_put()
 kfuncs

On Fri, Aug 12, 2022 at 08:11:00AM +0000, Roberto Sassu wrote:
> > From: Daniel Müller [mailto:deso@...teo.net]
> > Sent: Friday, August 12, 2022 1:52 AM
> > On Thu, Aug 11, 2022 at 12:02:57PM +0000, Roberto Sassu wrote:
> > > > From: Roberto Sassu [mailto:roberto.sassu@...wei.com]
> > > > Sent: Thursday, August 11, 2022 9:47 AM
> > > > > From: Alexei Starovoitov [mailto:alexei.starovoitov@...il.com]
> > > > > Sent: Wednesday, August 10, 2022 11:34 PM
> > > > > On Wed, Aug 10, 2022 at 06:59:28PM +0200, Roberto Sassu wrote:
> > > > > > +
> > > > > > +static int __init bpf_key_sig_kfuncs_init(void)
> > > > > > +{
> > > > > > +	int ret;
> > > > > > +
> > > > > > +	ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING,
> > > > > > +					&bpf_key_sig_kfunc_set);
> > > > > > +	if (!ret)
> > > > > > +		return 0;
> > > > > > +
> > > > > > +	return register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
> > > > > > +					 &bpf_key_sig_kfunc_set);
> > > > >
> > > > > Isn't this a watery water ?
> > > > > Don't you have a patch 1 ?
> > > > > What am I missing ?
> > > >
> > > > Uhm, yes. I had doubts too. That was what also KP did.
> > > >
> > > > It makes sense to register once, since we mapped LSM to
> > > > TRACING.
> > > >
> > > > Will resend only this patch. And I will figure out why CI failed.
> > >
> > > Adding in CC Daniel Müller, which worked on this.
> > >
> > > I think the issue is that some kernel options are set to =m.
> > > This causes the CI to miss all kernel modules, since they are
> > > not copied to the virtual machine that executes the tests.
> > >
> > > I'm testing this patch:
> > >
> > > https://github.com/robertosassu/libbpf-
> > ci/commit/b665e001b58c4ddb792a2a68098ea5dc6936b15c
> > 
> > I commented on the pull request. Would it make sense to adjust the
> > kernel configuration in this repository instead? I am worried that
> > otherwise everybody may need a similar work around, depending on how
> > selftests are ultimately run.
> 
> The issue seems specific of the eBPF CI. Others might be able to use
> kernel modules.
> 
> Either choice is fine for me.

I understand that depending on how tests are run, kernel modules may be
available to be loaded. My point is that I am not aware of anything that we
would loose by having the functionality built-in to begin with (others can
correct me). So it seems as if that's an easy way to sidestep any issues of that
sort from the start and, hence, would be my preference.

Thanks,
Daniel