linux-kernel - Re: [PATCH bpf-next] bpftool: bash-completion: Add nopasswd sudo prefix for bpftool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_1256C865894AC1EBCFA804628181A1105A06@qq.com>
Date: Wed, 12 Feb 2025 19:21:59 +0800
From: Rong Tao <rtoax@...mail.com>
To: Quentin Monnet <qmo@...nel.org>, ast@...nel.org, daniel@...earbox.net,
 andrii@...nel.org
Cc: rongtao@...tc.cn, Rong Tao <rongtao@...tc.cn>,
 Martin KaFai Lau <martin.lau@...ux.dev>, Eduard Zingerman
 <eddyz87@...il.com>, Song Liu <song@...nel.org>,
 Yonghong Song <yonghong.song@...ux.dev>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, Tao Chen <chen.dylane@...il.com>,
 Mykyta Yatsenko <yatsenko@...a.com>, Daniel Xu <dxu@...uu.xyz>,
 "open list:BPF [TOOLING] (bpftool)" <bpf@...r.kernel.org>,
 open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpftool: bash-completion: Add nopasswd sudo
 prefix for bpftool


On 2/12/25 19:00, Quentin Monnet wrote:
> 2025-02-12 18:14 UTC+0800 ~ Rong Tao <rtoax@...mail.com>
>> From: Rong Tao <rongtao@...tc.cn>
>>
>> In the bpftool script of bash-completion, many bpftool commands require
>> superuser privileges to execute. Otherwise, Operation not permission will
>> be displayed. Here, we check whether ordinary users are exempt from
>> entering the sudo password. If so, we need to add the sudo prefix to the
>> bpftool command to be executed. In this way, we can obtain the correct
>> command completion content instead of the wrong one.
>>
>> For example, when updating array_of_maps, the wrong 'hex' is completed:
>>
>>      $ sudo bpftool map update name arr_maps key 0 0 0 0 value [tab]
>>      $ sudo bpftool map update name arr_maps key 0 0 0 0 value hex
>>
>> However, what we need is "id name pinned". Similarly, there is the same
>> problem in getting the map 'name' and 'id':
>>
>>      $ sudo bpftool map show name [tab] < get nothing
>>      $ sudo bpftool map show id [tab]   < get nothing
>>
>> This commit fixes the issue.
>>
>>      $ sudo bpftool map update name arr_maps key 0 0 0 0 value [tab]
>>      id      name    pinned
>>
>>      $ sudo bpftool map show name
>>      arr_maps         cgroup_hash      inner_arr1       inner_arr2
>>
>>      $ sudo bpftool map show id
>>      11    1383  4091  4096
>>
>> Signed-off-by: Rong Tao <rongtao@...tc.cn>
> Hi, thanks for the patch.
>
> I agree it's annoying to have a partially-working completion for
> non-root users, however, I don't feel very comfortable introducing calls
> to "sudo" in bash completion, without the user noticing. For what it's
> worth, I searched other bash completion files (from
> https://github.com/scop/bash-completion/) and I can't find any of them
> running sudo to help complete commands, so it doesn't seem to be
> something usual in completion. I think I'd rather keep the current state
> (or fix the first example to have the right keywords displayed but
> without running sudo).

Thanks for the reply.

Using sudo to perform bash-completion is indeed not a perfect solution. 
However, using "bpftool map show" to obtain map information may be the 
only way, and this operation requires CAP_ADMIN, which may be a 
compromise. There is no other way.

Rong Tao