linux-kernel - Re: [RFC v2 bpf-next 0/9] mm/bpf/perf: Store build id in inode object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Mar 2023 09:35:39 +0100
From:   Jiri Olsa <olsajiri@...il.com>
To:     Dave Chinner <david@...morbit.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Hao Luo <haoluo@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Matthew Wilcox <willy@...radead.org>, bpf@...r.kernel.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-perf-users@...r.kernel.org,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Namhyung Kim <namhyung@...il.com>
Subject: Re: [RFC v2 bpf-next 0/9] mm/bpf/perf: Store build id in inode object

On Wed, Mar 01, 2023 at 09:07:14AM +1100, Dave Chinner wrote:
> On Tue, Feb 28, 2023 at 10:31:57AM +0100, Jiri Olsa wrote:
> > hi,
> > this is RFC patchset for adding build id under inode's object.
> > 
> > The main change to previous post [1] is to use inode object instead of file
> > object for build id data.
> 
> Please explain what a "build id" is, the use case for it, why we
> need to store it in VFS objects, what threat model it is protecting
> the system against, etc.

hum I still did not get your email from mailing list, just saw it
from Arnaldo's reply and downloaded it from lore

our use case is for hubble/tetragon [1] and we are asked to report
buildid of executed binary.. but the monitoring process is running
in its own pod and can't access the the binaries outside of it, so
we need to be able to read it in kernel

we want to read build id from BPF program attached to sched_exec
tracepoint, and from BPF iterator

we considered adding BPF helper and then kfunc for that, but it turned
out it'd be usefull for other use cases (like retrieving build id from
atomic context [2]) to have the build id stored in file (or inode) object

[1] https://github.com/cilium/tetragon/
[2] https://lore.kernel.org/bpf/CA+khW7juLEcrTOd7iKG3C_WY8L265XKNo0iLzV1fE=o-cyeHcQ@mail.gmail.com/

> 
> > 
> > However.. ;-) while using inode as build id storage place saves some memory
> > by keeping just one copy of the build id for all file instances, there seems
> > to be another problem.
> 
> Yes, the problem being that we can cache hundreds of millions of
> inodes in memory, and only a very small subset of them are going to
> have open files associated with them. And an even smaller subset are
> going to be mmapped.

ok, file seems like better option now

> 
> So, in reality, this proposal won't save any memory at all - it
> costs memory for every inode that is not currently being used as
> a mmapped elf executable, right?

right

> 
> > The problem is that we read the build id when the file is mmap-ed.
> 
> Why? I'm completely clueless as to what this thing does or how it's
> used....

we need the build id only when the file is mmap-ed, so it seemed like
the best way to read it when the file is mmaped

> 
> > Which is fine for our use case,
> 
> Which is?

please see above

thanks,
jirka