netdev - Re: [PATCH iproute2 -next] tc, bpf: finalize eBPF support for cls and act front-end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 02 Apr 2015 20:38:54 +0200
From:	Daniel Borkmann <daniel@...earbox.net>
To:	Alexei Starovoitov <ast@...mgrid.com>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	stephen@...workplumber.org
CC:	jiri@...nulli.us, tgraf@...g.ch, netdev@...r.kernel.org,
	Jamal Hadi Salim <jhs@...atatu.com>
Subject: Re: [PATCH iproute2 -next] tc, bpf: finalize eBPF support for cls
 and act front-end

On 04/02/2015 06:14 PM, Alexei Starovoitov wrote:
> On 4/2/2015 5:08 AM, Daniel Borkmann wrote:
>> On 04/02/2015 01:30 PM, Hannes Frederic Sowa wrote:
>>>> ... perhaps such a built-in fake device for retrieving bpf map fds
>>>> might be interesting, e.g. exec 4<>/dev/bpf/<obj-file>/<map-name> if
>>>> that has been given to bash?
>>>>
>>>> Anyway, I think to have some utility for shell scripts, as you
>>>> suggest, certainly sounds interesting!
>>>
>>> All file descriptors will be inherited by exec as long as the O_CLOEXEC
>>> flag wasn't specified on them. So you can retrieve the fds via af_unix
>>> and just exec a new shell. The file descriptors will stay open and you
>>> can pass the numbers of the fds via environment. This wouldn't need
>>> changes to bash or kernel.
>>
>> Okay, I will give it a try. Thanks!
>
> I think even if it's little awkward to do it in user space, it's better
> than adding stuff to kernel. This /dev/bpf/obj-file/map-name or sysfs
> might start hitting scalability issues when we try to load thousands
> of bpf programs.

So I was just hacking a prototype together to execve(2) and pass those
map fds over env to the bash instance, so you have them there next to
stdin, stdout, etc. Bit funny, but works as well for bpf(2). It might
not work on a larger-scale, but perhaps for experimenting with eBPF
maps, it would be good as a start. I'll try to carve something out for
a follow-up to make it useful in shell scripts, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html