linux-kernel - Re: [PATCH bpf-next] bpftool: bash-completion: Add nopasswd sudo prefix for bpftool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <97fd1bbb-1261-4af5-9321-27353547dbf7@kernel.org>
Date: Wed, 12 Feb 2025 11:00:34 +0000
From: Quentin Monnet <qmo@...nel.org>
To: Rong Tao <rtoax@...mail.com>, ast@...nel.org, daniel@...earbox.net,
 andrii@...nel.org
Cc: rongtao@...t.ccn, Rong Tao <rongtao@...tc.cn>,
 Martin KaFai Lau <martin.lau@...ux.dev>, Eduard Zingerman
 <eddyz87@...il.com>, Song Liu <song@...nel.org>,
 Yonghong Song <yonghong.song@...ux.dev>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, Tao Chen <chen.dylane@...il.com>,
 Mykyta Yatsenko <yatsenko@...a.com>, Daniel Xu <dxu@...uu.xyz>,
 "open list:BPF [TOOLING] (bpftool)" <bpf@...r.kernel.org>,
 open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpftool: bash-completion: Add nopasswd sudo
 prefix for bpftool

2025-02-12 18:14 UTC+0800 ~ Rong Tao <rtoax@...mail.com>
> From: Rong Tao <rongtao@...tc.cn>
> 
> In the bpftool script of bash-completion, many bpftool commands require
> superuser privileges to execute. Otherwise, Operation not permission will
> be displayed. Here, we check whether ordinary users are exempt from
> entering the sudo password. If so, we need to add the sudo prefix to the
> bpftool command to be executed. In this way, we can obtain the correct
> command completion content instead of the wrong one.
> 
> For example, when updating array_of_maps, the wrong 'hex' is completed:
> 
>     $ sudo bpftool map update name arr_maps key 0 0 0 0 value [tab]
>     $ sudo bpftool map update name arr_maps key 0 0 0 0 value hex
> 
> However, what we need is "id name pinned". Similarly, there is the same
> problem in getting the map 'name' and 'id':
> 
>     $ sudo bpftool map show name [tab] < get nothing
>     $ sudo bpftool map show id [tab]   < get nothing
> 
> This commit fixes the issue.
> 
>     $ sudo bpftool map update name arr_maps key 0 0 0 0 value [tab]
>     id      name    pinned
> 
>     $ sudo bpftool map show name
>     arr_maps         cgroup_hash      inner_arr1       inner_arr2
> 
>     $ sudo bpftool map show id
>     11    1383  4091  4096
> 
> Signed-off-by: Rong Tao <rongtao@...tc.cn>

Hi, thanks for the patch.

I agree it's annoying to have a partially-working completion for
non-root users, however, I don't feel very comfortable introducing calls
to "sudo" in bash completion, without the user noticing. For what it's
worth, I searched other bash completion files (from
https://github.com/scop/bash-completion/) and I can't find any of them
running sudo to help complete commands, so it doesn't seem to be
something usual in completion. I think I'd rather keep the current state
(or fix the first example to have the right keywords displayed but
without running sudo).

Quentin