netdev - Re: [RFC PATCH net-next 0/6] seccomp filter JIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Apr 2013 13:46:29 +0200
From:	Daniel Borkmann <dborkman@...hat.com>
To:	Heiko Carstens <heiko.carstens@...ibm.com>
CC:	Xi Wang <xi.wang@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	Russell King <linux@....linux.org.uk>,
	Eric Dumazet <edumazet@...gle.com>,
	Will Drewry <wad@...omium.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	Nicolas Schichan <nschichan@...ebox.fr>,
	Mircea Gherzan <mgherzan@...il.com>
Subject: Re: [RFC PATCH net-next 0/6] seccomp filter JIT

On 04/26/2013 01:25 PM, Heiko Carstens wrote:
> On Fri, Apr 26, 2013 at 03:51:40AM -0400, Xi Wang wrote:
>> This patchset brings JIT support to seccomp filters for x86_64 and ARM.
>> It is against the net-next tree.
>>
>> The current BPF JIT interface only accepts sk_filter, not seccomp_filter.
>> Patch 1/6 refactors the interface to make it more general.
>>
>> With the refactored interface, patches 2/6 and 3/6 implement the seccomp
>> BPF_S_ANC_SECCOMP_LD_W instruction in x86 & ARM JIT.
>>
>> Status:
>>
>> * x86_64 & ARM: JIT tested with seccomp examples.
>>
>> * powerpc [4/6]: no seccomp change - compile checked.
>>
>> * sparc [5/6] & s390 [6/6]: no seccomp change - untested.
>>
>> Sorry I have no sparc or s390 build environment here.  Can someone help
>> check 5/6 and 6/6?  Thanks.
>
> Your patches are against which tree?
> They don't apply on top of linux-next or Linus' linux tree.

In the subject line it says net-next.

> Btw. are there any test cases around for BPF JIT?
> Not only for the new seccomp but also netfilter?

BPF is used in packet(7) sockets, not Netfilter. But yeah, test
cases for different archs would be really good, i.e. if seccomp
wants to use BPF JIT, where seccomp is used for user space program
sand-boxing (e.g. in Chromium), I can already guess that this will
put attention to certain people. :-)

I think BPF JIT for seccomp on ARM recently got applied to -mm tree
if I'm not mistaken. It was from Nicolas Schichan (cc):

http://thread.gmane.org/gmane.linux.ports.arm.kernel/233416/
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html