linux-kernel - Re: [RFC v2 bpf-next 0/9] mm/bpf/perf: Store build id in inode object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y/9yIJ9kOHcZqIzo@kernel.org>
Date:   Wed, 1 Mar 2023 12:41:20 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Dave Chinner <david@...morbit.com>
Cc:     Jiri Olsa <jolsa@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Hao Luo <haoluo@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Matthew Wilcox <willy@...radead.org>, bpf@...r.kernel.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-perf-users@...r.kernel.org,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Namhyung Kim <namhyung@...il.com>
Subject: Re: [RFC v2 bpf-next 0/9] mm/bpf/perf: Store build id in inode object

Em Wed, Mar 01, 2023 at 09:07:14AM +1100, Dave Chinner escreveu:
> On Tue, Feb 28, 2023 at 10:31:57AM +0100, Jiri Olsa wrote:
> > this is RFC patchset for adding build id under inode's object.

> > The main change to previous post [1] is to use inode object instead of file
> > object for build id data.
> 
> Please explain what a "build id" is, the use case for it, why we
> need to store it in VFS objects, what threat model it is protecting
> the system against, etc.

[root@...co ~]# file /bin/bash
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=160df51238a38ca27d03290f3ad5f7df75560ae0, for GNU/Linux 3.2.0, stripped
[root@...co ~]# file /lib64/libc.so.6
/lib64/libc.so.6: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8257ee907646e9b057197533d1e4ac8ede7a9c5c, for GNU/Linux 3.2.0, not stripped
[root@...co ~]#

Those BuildID[sha1]= bits, that is present in all binaries I think in
all distros for quite a while.

This page, from when this was initially designed, has a discussion about
it, why it is needed, etc:

  https://fedoraproject.org/wiki/RolandMcGrath/BuildID

'perf record' will receive MMAP records, initially without build-ids,
now we have one that has, but collecting it when the mmap is executed
(and thus a PERF_RECORD_MMAP* record is emitted) may not work, thus this
work from Jiri.

- Arnaldo
 
> > 
> > However.. ;-) while using inode as build id storage place saves some memory
> > by keeping just one copy of the build id for all file instances, there seems
> > to be another problem.
 
> Yes, the problem being that we can cache hundreds of millions of
> inodes in memory, and only a very small subset of them are going to
> have open files associated with them. And an even smaller subset are
> going to be mmapped.
 
> So, in reality, this proposal won't save any memory at all - it
> costs memory for every inode that is not currently being used as
> a mmapped elf executable, right?
> 
> > The problem is that we read the build id when the file is mmap-ed.
> 
> Why? I'm completely clueless as to what this thing does or how it's
> used....
> 
> > Which is fine for our use case,
> 
> Which is?
> 
> -Dave.
> -- 
> Dave Chinner
> david@...morbit.com