netdev - Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <57A310E5.7030000@iogearbox.net>
Date:	Thu, 04 Aug 2016 11:54:45 +0200
From:	Daniel Borkmann <daniel@...earbox.net>
To:	Sargun Dhillon <sargun@...gun.me>, linux-kernel@...r.kernel.org
CC:	alexei.starovoitov@...il.com,
	linux-security-module@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel
 ABI

On 08/04/2016 11:52 AM, Daniel Borkmann wrote:
> On 08/04/2016 09:12 AM, Sargun Dhillon wrote:
>> I think it makes sense to restrict Checmate to loading programs that have been
>> compiled with the current kernel ABI. We can further stabilize the ABI, and
>> perhaps lift this restriction later.
>>
>> Signed-off-by: Sargun Dhillon <sargun@...gun.me>
>> ---
>>   kernel/bpf/syscall.c         | 2 +-
>>   samples/bpf/checmate1_kern.c | 3 ++-
>>   2 files changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 228f962..2a37b4d 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr)
>>       if (attr->insn_cnt >= BPF_MAXINSNS)
>>           return -EINVAL;
>>
>> -    if (type == BPF_PROG_TYPE_KPROBE &&
>> +    if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) &&
>>           attr->kern_version != LINUX_VERSION_CODE)
>
> Btw, this check is correct, program types are not masks.

Sorry, I meant to write *not* correct, which was hopefully inferable from
the rest.

> BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now
> require every type to have a version code ...
>
>>           return -EINVAL;
>>