netdev - Re: BPF probe namespacing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 20 Nov 2018 15:57:04 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Peter Parkanyi <peter@...sift.io>
Cc:     netdev@...r.kernel.org
Subject: Re: BPF probe namespacing

On Mon, Nov 19, 2018 at 03:29:07PM +0000, Peter Parkanyi wrote:
> Hi,
> 
> At LPC I raised the observation that currently it doesn't seem
> feasible to insert a BPF probe from within a container that sees
> events happening outside of the container, while it is possible to
> insert a kernel module.
> 
> It was suggested that this is not the case, and things should just work.
> I wanted to get a minimal reproduction of what I've seen in Docker
> containers, so if somebody could take a look, I'd appreciate any
> comments on the right way of doing this.
> 
> The kprobe in question:
> https://github.com/redsift/ingraind/blob/master/bpf/file.c

I suspect there is something in the bpf prog that makes it skip in-chroot
events.
Can you add bpf_trace_printk-s throught the code to see what's wrong?
Like does your test can even create the test file?
As far as I can see on the kernel side kprobe will be firing.