netdev - Re: [PATCH bpf-next 2/8] tools: bpftool: add probes for /proc/ eBPF parameters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3fb543d9-0f76-20cf-e8ed-70d055e2503d@netronome.com>
Date:   Sat, 15 Dec 2018 03:31:55 +0000
From:   Quentin Monnet <quentin.monnet@...ronome.com>
To:     Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>
Cc:     netdev@...r.kernel.org, oss-drivers@...ronome.com,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Stanislav Fomichev <sdf@...gle.com>
Subject: Re: [PATCH bpf-next 2/8] tools: bpftool: add probes for /proc/ eBPF
 parameters

2018-12-15 00:40 UTC+0100 ~ Daniel Borkmann <daniel@...earbox.net>
> On 12/13/2018 01:19 PM, Quentin Monnet wrote:
>> Add a set of probes to dump the eBPF-related parameters available from
>> /proc/: availability of bpf() syscall for unprivileged users,
>> JIT compiler status and hardening status, kallsyms exports status.
>>
>> Sample output:
>>
>>     # bpftool feature probe kernel
>>     Scanning system configuration...
>>     bpf() syscall for unprivileged users is enabled
>>     JIT compiler is disabled
>>     JIT compiler hardening is disabled
>>     JIT compiler kallsyms exports are disabled
>>     ...
>>
>>     # bpftool --json --pretty feature probe kernel
>>     {
>>         "system_config": {
>>             "unprivileged_bpf_disabled": 0,
>>             "bpf_jit_enable": 0,
>>             "bpf_jit_harden": 0,
>>             "bpf_jit_kallsyms": 0
>>         },
>>         ...
>>     }
>>
>>     # bpftool feature probe kernel macros prefix BPFTOOL_
>>     #define UNPRIVILEGED_BPF_DISABLED UNPRIVILEGED_BPF_DISABLED_OFF
>>     #define  UNPRIVILEGED_BPF_DISABLED_OFF 0
>>     #define  UNPRIVILEGED_BPF_DISABLED_ON 1
>>     #define  UNPRIVILEGED_BPF_DISABLED_UNKNOWN -1
>>     #define JIT_COMPILER_ENABLE JIT_COMPILER_ENABLE_OFF
>>     #define  JIT_COMPILER_ENABLE_OFF 0
>>     #define  JIT_COMPILER_ENABLE_ON 1
>>     #define  JIT_COMPILER_ENABLE_ON_WITH_DEBUG 2
>>     #define  JIT_COMPILER_ENABLE_UNKNOWN -1
>>     #define JIT_COMPILER_HARDEN JIT_COMPILER_HARDEN_OFF
>>     #define  JIT_COMPILER_HARDEN_OFF 0
>>     #define  JIT_COMPILER_HARDEN_FOR_UNPRIVILEGED 1
>>     #define  JIT_COMPILER_HARDEN_FOR_ALL_USERS 2
>>     #define  JIT_COMPILER_HARDEN_UNKNOWN -1
>>     #define JIT_COMPILER_KALLSYMS JIT_COMPILER_KALLSYMS_OFF
>>     #define  JIT_COMPILER_KALLSYMS_OFF 0
>>     #define  JIT_COMPILER_KALLSYMS_FOR_ROOT 1
>>     #define  JIT_COMPILER_KALLSYMS_UNKNOWN -1
>>     ...
> 
> Hm, given these knobs may change at any point in time, what would
> be a use case in an application for these if they cannot be relied
> upon? (At least the jit_enable and jit_harden are transparent to
> the user.)
> 

Granted, for those parameters it's a snapshot of the system at the time
the probes are run. It can be useful, I suppose, if a server is not
expected to change them often... And the plain output might be useful to
a sysadmin who wants to have a quick look at BPF-related parameters, maybe?