linux-kernel - Re: [PATCH v5 0/4] net/sched: Load modules via alias

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 2 Feb 2024 13:21:37 +0100
From: Jiri Pirko <jiri@...nulli.us>
To: Michal Koutný <mkoutny@...e.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org, cake@...ts.bufferbloat.net,
	"David S . Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Cong Wang <xiyou.wangcong@...il.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...gle.com>,
	Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
	Toke Høiland-Jørgensen <toke@...e.dk>,
	Vinicius Costa Gomes <vinicius.gomes@...el.com>,
	Stephen Hemminger <stephen@...workplumber.org>,
	Simon Horman <horms@...nel.org>,
	Pedro Tammela <pctammela@...atatu.com>
Subject: Re: [PATCH v5 0/4] net/sched: Load modules via alias

Thu, Feb 01, 2024 at 02:09:39PM CET, mkoutny@...e.com wrote:
>These modules may be loaded lazily without user's awareness and
>control. Add respective aliases to modules and request them under these
>aliases so that modprobe's blacklisting mechanism (through aliases)
>works for them. (The same pattern exists e.g. for filesystem
>modules.)
>
>For example (before the change):
>  $ tc filter add dev lo parent 10: protocol ip prio 10 handle 1: cgroup
>  # cls_cgroup module is loaded despite a `blacklist cls_cgroup` entry
>  # in /etc/modprobe.d/*.conf
>
>After the change:
>  $ tc filter add dev lo parent 10: protocol ip prio 10 handle 1: cgroup
>  Error: TC classifier not found.
>  We have an error talking to the kernel
>  # explicit/acknowledged (privileged) action is needed
>  $ modprobe cls_cgroup
>  # blacklist entry won't apply to this direct modprobe, module is
>  # loaded with awareness
>
>A considered alternative was invoking `modprobe -b` always from
>request_module(), however, dismissed as too intrusive and slightly
>confusing in favor of the precedented aliases (the commit 7f78e0351394
>("fs: Limit sys_mount to only request filesystem modules.").
>
>User experience suffers in both alternatives. Its improvement is
>orthogonal to blacklist honoring.
>
>Changes from v1 (https://lore.kernel.org/r/20231121175640.9981-1-mkoutny@suse.com)
>- Treat sch_ and act_ modules analogously to cls_
>
>Changes from v2 (https://lore.kernel.org/r/20231206192752.18989-1-mkoutny@suse.com)
>- reorganized commits (one generated commit + manual pre-/post- work)
>- used alias names more fitting the existing net- aliases
>- more info in commit messages and cover letter
>- rebased on current master
>
>Changes from v3 (https://lore.kernel.org/r/20240112180646.13232-1-mkoutny@suse.com)
>- rebase on netdev/net-next/main
>- correct aliases in cls_* modules (wrong sed)
>- replace repeated prefix strings with a macro
>- patch also request_module call in qdisc_set_default()
>
>Changes from v4 (https://lore.kernel.org/r/20240123135242.11430-1-mkoutny@suse.com)
>- update example in cover letter to existing module (cls_tcindex->cls_cgroup)
>  - tested that ':-)
>- remove __stringify in alias macro, net-cls-cgroup instead of net-cls-"cgroup"
>- pass correct argument to request_module() (Simon)
>- rebased on netdev-next/main
>
>Michal Koutný (4):
>  net/sched: Add helper macros with module names
>  net/sched: Add module aliases for cls_,sch_,act_ modules
>  net/sched: Load modules via their alias
>  net/sched: Remove alias of sch_clsact

Set looks fine to me:

Reviewed-by: Jiri Pirko <jiri@...dia.com>