netdev - Re: [PATCH bpf-next] bpftool: Add BPF_F_QUERY_EFFECTIVE support in bpftool cgroup [show|tree]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190624145111.49176d8e@cakuba.netronome.com>
Date:   Mon, 24 Jun 2019 14:51:11 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Takshak Chahande <ctakshak@...com>, netdev@...r.kernel.org,
        ast@...nel.org, rdna@...com, kernel-team@...com,
        Stanislav Fomichev <sdf@...gle.com>
Subject: Re: [PATCH bpf-next] bpftool: Add BPF_F_QUERY_EFFECTIVE support in
 bpftool cgroup [show|tree]

On Mon, 24 Jun 2019 16:22:25 +0200, Daniel Borkmann wrote:
> On 06/22/2019 12:33 AM, Takshak Chahande wrote:
> > With different bpf attach_flags available to attach bpf programs specially
> > with BPF_F_ALLOW_OVERRIDE and BPF_F_ALLOW_MULTI, the list of effective
> > bpf-programs available to any sub-cgroups really needs to be available for
> > easy debugging.
> > 
> > Using BPF_F_QUERY_EFFECTIVE flag, one can get the list of not only attached
> > bpf-programs to a cgroup but also the inherited ones from parent cgroup.
> > 
> > So "-e" option is introduced to use BPF_F_QUERY_EFFECTIVE query flag here to
> > list all the effective bpf-programs available for execution at a specified
> > cgroup.
> > 
> > Reused modified test program test_cgroup_attach from tools/testing/selftests/bpf:
> >   # ./test_cgroup_attach
> > 
> > With old bpftool (without -e option):
> > 
> >   # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/
> >   ID       AttachType      AttachFlags     Name
> >   271      egress          multi           pkt_cntr_1
> >   272      egress          multi           pkt_cntr_2
> > 
> >   Attached new program pkt_cntr_4 in cg2 gives following:
> > 
> >   # bpftool cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2
> >   ID       AttachType      AttachFlags     Name
> >   273      egress          override        pkt_cntr_4
> > 
> > And with new "-e" option it shows all effective programs for cg2:
> > 
> >   # bpftool -e cgroup show /sys/fs/cgroup/cgroup-test-work-dir/cg1/cg2
> >   ID       AttachType      AttachFlags     Name
> >   273      egress          override        pkt_cntr_4
> >   271      egress          override        pkt_cntr_1
> >   272      egress          override        pkt_cntr_2
> > 
> > Signed-off-by: Takshak Chahande <ctakshak@...com>
> > Acked-by: Andrey Ignatov <rdna@...com>  
> 
> Applied, thanks!

This is a cgroup-specific flag, right?  It should be a parameter 
to cgroup show, not a global flag.  Can we please drop this patch 
from the tree?