netdev - Re: [PATCH v3 bpf-next 0/3] bpf: add bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Mar 2019 22:42:04 +0000
From:   Javier Honduvilla Coto <javierhonduco@...com>
To:     Daniel Borkmann <daniel@...earbox.net>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Yonghong Song <yhs@...com>, Kernel Team <Kernel-team@...com>
Subject: Re: [PATCH v3 bpf-next 0/3] bpf: add bpf_progenyof helper

On Thu, Mar 07, 2019 at 10:26:22AM +0100, Daniel Borkmann wrote:
> On 03/05/2019 11:47 PM, Javier Honduvilla Coto wrote:
> > Hi all,
> >
> > This patch add the bpf_progenyof helper which receives a PID and returns
> > 1 if the process currently being executed is in the process hierarchy,
> > including itself or 0 if not.
> >
> > This is very useful in tracing programs when we want to filter by a
> > given PID and all the children it might have. The current workarounds
> > most people implement for this purpose have issues:
> >
> > - Attaching to process spawning syscalls and dynamically add those PIDs
> >   to  some bpf map that would be used to filter is cumbersome and
> > potentially racy.
> > - Unrolling some loop to perform what this helper is doing consumes lots
> >   of instructions. That and the impossibility to jump backwards makes it
> > really hard to be correct in really large process chains.
> >
> > Let me know what do you think!
> >
> > Thanks,
> >
> > ---
> > Changed in V3:
> >         - Removed RCU read (un)locking as BPF programs alredy run in RCU locked
> >                 context
> >         - progenyof(0) now returns 1, which, semantically makes more sense
> >         - Added new test case for PID 0 and changed sentinel value for errors
> >         - Rebase on latest bpf-next/master
> >         - Used my work email as somehow I accidentally used my personal one in v2
> >
> > Changed in V2:
> >         - Adding missing docs in include/uapi/linux/bpf.h
> >
> > Javier Honduvilla Coto (3):
> >   bpf: add bpf_progenyof helper
> >   bpf: sync kernel uapi headers
> >   bpf: add tests for bpf_progenyof
> >
> >  include/linux/bpf.h                           |   1 +
> >  include/uapi/linux/bpf.h                      |  10 +-
> >  kernel/bpf/core.c                             |   1 +
> >  kernel/bpf/helpers.c                          |  32 +++
> >  kernel/trace/bpf_trace.c                      |   2 +
> >  tools/include/uapi/linux/bpf.h                |   9 +-
> >  tools/testing/selftests/bpf/.gitignore        |   1 +
> >  tools/testing/selftests/bpf/Makefile          |   2 +-
> >  tools/testing/selftests/bpf/bpf_helpers.h     |   1 +
> >  .../selftests/bpf/progs/test_progenyof_kern.c |  46 +++
> >  .../selftests/bpf/test_progenyof_user.c       | 268 ++++++++++++++++++
> >  11 files changed, 370 insertions(+), 3 deletions(-)
> >  create mode 100644 tools/testing/selftests/bpf/progs/test_progenyof_kern.c
> >  create mode 100644 tools/testing/selftests/bpf/test_progenyof_user.c
> >
>
> bpf-next is closed right now due to merge window, please resubmit once it
> opens, thanks!

Just did! Thanks :)