netdev - Re: [PATCH bpf-next 3/8] tools: bpftool: add probes for kernel configuration options

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0965abad-e7cb-7ad3-dcd7-8fcd790a57ca@netronome.com>
Date:   Sat, 15 Dec 2018 03:32:11 +0000
From:   Quentin Monnet <quentin.monnet@...ronome.com>
To:     Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>
Cc:     netdev@...r.kernel.org, oss-drivers@...ronome.com,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jesper Dangaard Brouer <brouer@...hat.com>,
        Stanislav Fomichev <sdf@...gle.com>
Subject: Re: [PATCH bpf-next 3/8] tools: bpftool: add probes for kernel
 configuration options

2018-12-15 00:56 UTC+0100 ~ Daniel Borkmann <daniel@...earbox.net>
> On 12/13/2018 01:19 PM, Quentin Monnet wrote:
>> Add probes to dump a number of options set (or not set) for compiling
>> the kernel image. These parameters provide information about what BPF
>> components should be available on the system. A number of them are not
>> directly related to eBPF, but are in fact used in the kernel as
>> conditions on which to compile, or not to compile, some of the eBPF
>> helper functions.
>>
>> Sample output:
>>
>>     # bpftool feature probe kernel
>>     Scanning system configuration...
>>     ...
>>     CONFIG_BPF is set to y
>>     CONFIG_BPF_SYSCALL is set to y
>>     CONFIG_HAVE_EBPF_JIT is set to y
>>     ...
>>
>>     # bpftool --pretty --json feature probe kernel
>>     {
>>         "system_config": {
>>             ...
>>             "CONFIG_BPF": "y",
>>             "CONFIG_BPF_SYSCALL": "y",
>>             "CONFIG_HAVE_EBPF_JIT": "y",
>>             ...
>>         }
>>     }
>>
>>     # bpftool feature probe kernel macros prefix BPFTOOL_
>>     /*** System configuration ***/
>>     ...
>>     #define BPFTOOL_CONFIG_BPF y
>>     #define BPFTOOL_CONFIG_BPF_SYSCALL y
>>     #define BPFTOOL_CONFIG_HAVE_EBPF_JIT y
>>     ...
> 
> Looks reasonable. I think as a user next question that would
> follow-up from it would be whether this set of config means
> that e.g. requirements for XDP, cgroups bpf, tracing or xyz is
> fulfilled. Perhaps it makes sense to split the options[] into
> base_options[], bpf_trace_options[], bpf_tc_options[] etc such
> that it might become obvious that base_options[] + bpf_tc_options[]
> are supported and thus cls_bpf could be used. I'd see this part
> here in general more as giving a hint to the user in that some
> basic assumptions could be made and providing some info on the
> misc ones on what might potentially be missing. Though more
> concrete info would come from the actual helper / map / prog
> type probing.

Good idea. I admit that the list of options dumped with no explanations
whatsoever is hard to interpret. I'll try to divide the list into
meaningful subsections.