netdev - Re: [PATCH v3 bpf-next 0/3] bpf: add bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fc910d8a-3ad9-2626-ee38-72125c7f5b2c@iogearbox.net>
Date:   Thu, 7 Mar 2019 10:26:22 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Javier Honduvilla Coto <javierhonduco@...com>,
        netdev@...r.kernel.org
Cc:     yhs@...com, kernel-team@...com
Subject: Re: [PATCH v3 bpf-next 0/3] bpf: add bpf_progenyof helper

On 03/05/2019 11:47 PM, Javier Honduvilla Coto wrote:
> Hi all,
> 
> This patch add the bpf_progenyof helper which receives a PID and returns
> 1 if the process currently being executed is in the process hierarchy,
> including itself or 0 if not.
> 
> This is very useful in tracing programs when we want to filter by a
> given PID and all the children it might have. The current workarounds
> most people implement for this purpose have issues:
> 
> - Attaching to process spawning syscalls and dynamically add those PIDs
>   to  some bpf map that would be used to filter is cumbersome and
> potentially racy.
> - Unrolling some loop to perform what this helper is doing consumes lots
>   of instructions. That and the impossibility to jump backwards makes it
> really hard to be correct in really large process chains.
> 
> Let me know what do you think!
> 
> Thanks,
> 
> ---
> Changed in V3:
>         - Removed RCU read (un)locking as BPF programs alredy run in RCU locked
>                 context
>         - progenyof(0) now returns 1, which, semantically makes more sense
>         - Added new test case for PID 0 and changed sentinel value for errors
>         - Rebase on latest bpf-next/master
>         - Used my work email as somehow I accidentally used my personal one in v2
> 
> Changed in V2:
>         - Adding missing docs in include/uapi/linux/bpf.h
> 
> Javier Honduvilla Coto (3):
>   bpf: add bpf_progenyof helper
>   bpf: sync kernel uapi headers
>   bpf: add tests for bpf_progenyof
> 
>  include/linux/bpf.h                           |   1 +
>  include/uapi/linux/bpf.h                      |  10 +-
>  kernel/bpf/core.c                             |   1 +
>  kernel/bpf/helpers.c                          |  32 +++
>  kernel/trace/bpf_trace.c                      |   2 +
>  tools/include/uapi/linux/bpf.h                |   9 +-
>  tools/testing/selftests/bpf/.gitignore        |   1 +
>  tools/testing/selftests/bpf/Makefile          |   2 +-
>  tools/testing/selftests/bpf/bpf_helpers.h     |   1 +
>  .../selftests/bpf/progs/test_progenyof_kern.c |  46 +++
>  .../selftests/bpf/test_progenyof_user.c       | 268 ++++++++++++++++++
>  11 files changed, 370 insertions(+), 3 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/progs/test_progenyof_kern.c
>  create mode 100644 tools/testing/selftests/bpf/test_progenyof_user.c
> 

bpf-next is closed right now due to merge window, please resubmit once it
opens, thanks!