linux-kernel - Re: [PATCH v3 bpf-next 0/4] Introduce bpf_cgroup_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPhsuW5Afn7h5W4+ZY-Ly=y55ByXd3TCXej3PXUYkBcj89X7mw@mail.gmail.com>
Date: Tue, 1 Jul 2025 09:23:30 -0700
From: Song Liu <song@...nel.org>
To: Christian Brauner <brauner@...nel.org>
Cc: Song Liu <songliubraving@...a.com>, 
	Alexei Starovoitov <alexei.starovoitov@...il.com>, Kernel Team <kernel-team@...a.com>, 
	Andrii Nakryiko <andrii@...nel.org>, Eduard <eddyz87@...il.com>, 
	Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Alexander Viro <viro@...iv.linux.org.uk>, Jan Kara <jack@...e.cz>, 
	KP Singh <kpsingh@...nel.org>, Matt Bobrowski <mattbobrowski@...gle.com>, 
	Amir Goldstein <amir73il@...il.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	Tejun Heo <tj@...nel.org>, Daan De Meyer <daan.j.demeyer@...il.com>, bpf <bpf@...r.kernel.org>, 
	Linux-Fsdevel <linux-fsdevel@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, 
	LSM List <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH v3 bpf-next 0/4] Introduce bpf_cgroup_read_xattr

On Tue, Jul 1, 2025 at 1:32 AM Christian Brauner <brauner@...nel.org> wrote:
>
> On Fri, Jun 27, 2025 at 04:20:58PM +0000, Song Liu wrote:
> >
> >
> > > On Jun 27, 2025, at 8:59 AM, Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:
> > >
> > > On Thu, Jun 26, 2025 at 9:04 PM Song Liu <song@...nel.org> wrote:
> > >>
> > >> On Thu, Jun 26, 2025 at 7:14 PM Alexei Starovoitov
> > >> <alexei.starovoitov@...il.com> wrote:
> > >> [...]
> > >>> ./test_progs -t lsm_cgroup
> > >>> Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
> > >>> ./test_progs -t lsm_cgroup
> > >>> Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED
> > >>> ./test_progs -t cgroup_xattr
> > >>> Summary: 1/8 PASSED, 0 SKIPPED, 0 FAILED
> > >>> ./test_progs -t lsm_cgroup
> > >>> test_lsm_cgroup_functional:PASS:bind(ETH_P_ALL) 0 nsec
> > >>> (network_helpers.c:121: errno: Cannot assign requested address) Failed
> > >>> to bind socket
> > >>> test_lsm_cgroup_functional:FAIL:start_server unexpected start_server:
> > >>> actual -1 < expected 0
> > >>> (network_helpers.c:360: errno: Bad file descriptor) getsockopt(SOL_PROTOCOL)
> > >>> test_lsm_cgroup_functional:FAIL:connect_to_fd unexpected
> > >>> connect_to_fd: actual -1 < expected 0
> > >>> test_lsm_cgroup_functional:FAIL:accept unexpected accept: actual -1 < expected 0
> > >>> test_lsm_cgroup_functional:FAIL:getsockopt unexpected getsockopt:
> > >>> actual -1 < expected 0
> > >>> test_lsm_cgroup_functional:FAIL:sk_priority unexpected sk_priority:
> > >>> actual 0 != expected 234
> > >>> ...
> > >>> Summary: 0/1 PASSED, 0 SKIPPED, 1 FAILED
> > >>>
> > >>>
> > >>> Song,
> > >>> Please follow up with the fix for selftest.
> > >>> It will be in bpf-next only.
> > >>
> > >> The issue is because cgroup_xattr calls "ip link set dev lo up"
> > >> in setup, and calls "ip link set dev lo down" in cleanup. Most
> > >> other tests only call "ip link set dev lo up". IOW, it appears to
> > >> me that cgroup_xattr is doing the cleanup properly. To fix this,
> > >> we can either remove "dev lo down" from cgroup_xattr, or add
> > >> "dev lo up" to lsm_cgroups. Do you have any preference one
> > >> way or another?
> > >
> > > It messes with "lo" without switching netns? Ouch.
> >
> > Ah, I see the problem now.
> >
> > > Not sure what tests you copied that code from,
> > > but all "ip" commands, ping_group_range, and sockets
> > > don't need to be in the test. Instead of triggering
> > > progs through lsm/socket_connect hook can't you use
> > > a simple hook like lsm/bpf or lsm/file_open that doesn't require
> > > networking setup ?
> >
> > Yeah, let me fix the test with a different hook.
>
> Where's the patch?

Here is a fix to kernel/bpf/helprs.c by Eduard:
https://lore.kernel.org/bpf/20250627175309.2710973-1-eddyz87@gmail.com/

This fix addresses build errors with certain config.

Here is my fix to the selftests:
https://lore.kernel.org/bpf/20250627191221.765921-1-song@kernel.org/

I didn't CC linux-fsdevel because all the changes are in the
selftests, and the error is independent of the new code.

Thanks,
Song