netdev - Re: [PATCH 0/5] Return fds from privileged sockhash/sockmap lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87y2s7xayn.fsf@cloudflare.com>
Date:   Wed, 11 Mar 2020 14:44:32 +0100
From:   Jakub Sitnicki <jakub@...udflare.com>
To:     Daniel Borkmann <daniel@...earbox.net>,
        John Fastabend <john.fastabend@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Lorenz Bauer <lmb@...udflare.com>, kernel-team@...udflare.com,
        netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH 0/5] Return fds from privileged sockhash/sockmap lookup

On Tue, Mar 10, 2020 at 06:47 PM CET, Lorenz Bauer wrote:
> We want to use sockhash and sockmap to build the control plane for
> our upcoming BPF socket dispatch work. We realised that it's
> difficult to resize or otherwise rebuild these maps if needed,
> because there is no way to get at their contents. This patch set
> allows a privileged user to retrieve fds from these map types,
> which removes this obstacle.

Since it takes just a few lines of code to get an FD for a sock:

	fd = get_unused_fd_flags(O_CLOEXEC);
	if (unlikely(fd < 0))
		return fd;
        fd_install(fd, get_file(sk->sk_socket->file));

... I can't help but wonder where's the catch?

IOW, why wasn't this needed so far?
How does Cilium avoid resizing & rebuilding sockmaps?

Just asking out of curiosity.

[...]