lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 3 Aug 2022 17:29:53 -0700 From: Hao Luo <haoluo@...gle.com> To: Andrii Nakryiko <andrii.nakryiko@...il.com> Cc: Yosry Ahmed <yosryahmed@...gle.com>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau <kafai@...com>, Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>, Tejun Heo <tj@...nel.org>, Zefan Li <lizefan.x@...edance.com>, Johannes Weiner <hannes@...xchg.org>, Shuah Khan <shuah@...nel.org>, Michal Hocko <mhocko@...nel.org>, KP Singh <kpsingh@...nel.org>, Benjamin Tissoires <benjamin.tissoires@...hat.com>, John Fastabend <john.fastabend@...il.com>, Michal Koutný <mkoutny@...e.com>, Roman Gushchin <roman.gushchin@...ux.dev>, David Rientjes <rientjes@...gle.com>, Stanislav Fomichev <sdf@...gle.com>, Greg Thelen <gthelen@...gle.com>, Shakeel Butt <shakeelb@...gle.com>, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, bpf@...r.kernel.org, cgroups@...r.kernel.org, Kui-Feng Lee <kuifeng@...com> Subject: Re: [PATCH bpf-next v5 4/8] bpf: Introduce cgroup iter On Wed, Aug 3, 2022 at 1:40 PM Andrii Nakryiko <andrii.nakryiko@...il.com> wrote: > > On Wed, Aug 3, 2022 at 1:30 PM Hao Luo <haoluo@...gle.com> wrote: > > > > On Tue, Aug 2, 2022 at 3:50 PM Andrii Nakryiko > > <andrii.nakryiko@...il.com> wrote: > > > > > > On Tue, Aug 2, 2022 at 3:27 PM Hao Luo <haoluo@...gle.com> wrote: > > > > > > > > On Mon, Aug 1, 2022 at 8:43 PM Andrii Nakryiko > > > > <andrii.nakryiko@...il.com> wrote: > > > > > > > > > > On Fri, Jul 22, 2022 at 10:48 AM Yosry Ahmed <yosryahmed@...gle.com> wrote: [...] > > > > > > +}; > > > > > > + > > > > > > union bpf_iter_link_info { > > > > > > struct { > > > > > > __u32 map_fd; > > > > > > } map; > > > > > > + > > > > > > + /* cgroup_iter walks either the live descendants of a cgroup subtree, or the > > > > > > + * ancestors of a given cgroup. > > > > > > + */ > > > > > > + struct { > > > > > > + /* Cgroup file descriptor. This is root of the subtree if walking > > > > > > + * descendants; it's the starting cgroup if walking the ancestors. > > > > > > + * If it is left 0, the traversal starts from the default cgroup v2 > > > > > > + * root. For walking v1 hierarchy, one should always explicitly > > > > > > + * specify the cgroup_fd. > > > > > > + */ > > > > > > + __u32 cgroup_fd; > > > > > > > > > > Now, similar to what I argued in regard of pidfd vs pid, I think the > > > > > same applied to cgroup_fd vs cgroup_id. Why can't we support both? > > > > > cgroup_fd has some benefits, but cgroup_id is nice due to simplicity > > > > > and not having to open/close/keep extra FDs (which can add up if we > > > > > want to periodically query something about a large set of cgroups). > > > > > Please see my arguments from [0] above. > > > > > > > > > > Thoughts? > > > > > > > > > > > > > We can support both, it's a good idea IMO. But what exactly is the > > > > interface going to look like? Can you be more specific about that? > > > > Below is something I tried based on your description. > > > > > > > > @@ -91,6 +91,18 @@ union bpf_iter_link_info { > > > > struct { > > > > __u32 map_fd; > > > > } map; > > > > + struct { > > > > + /* PRE/POST/UP/SELF */ > > > > + __u32 order; > > > > + struct { > > > > + __u32 cgroup_fd; > > > > + __u64 cgroup_id; > > > > + } cgroup; > > > > + struct { > > > > + __u32 pid_fd; > > > > + __u64 pid; > > > > + } task; > > > > + }; > > > > }; > > > > > > > > > > So I wouldn't combine task and cgroup definition together, let's keep > > > them independent. > > > > > > then for cgroup we can do something like: > > > > > > struct { > > > __u32 order; > > > __u32 cgroup_fd; /* cgroup_fd ^ cgroup_id, exactly one can be non-zero */ > > > __u32 cgroup_id; > > > } cgroup > > > > > > Similar idea with task, but it's a bit more complicated because there > > > we have target that can be pid, pidfd, or cgroup (cgroup_fd and > > > cgroup_id). I haven't put much thought into the best representation, > > > though. > > > > > > > The cgroup part sounds good to me. For the full picture, how about > > this? I'm just trying a prototype, hoping that it can help people to > > get a clear picture. > > > > union bpf_iter_link_info { > > struct { > > __u32 map_fd; > > } map; > > struct { > > __u32 order; /* PRE/POST/UP/SELF */ > > __u32 cgroup_fd; > > __u64 cgroup_id; > > } cgroup; > > lgtm > > > struct { > > __u32 pid; > > __u32 pid_fd; > > __u64 cgroup_id; > > __u32 cgroup_fd; > > __u32 mode; /* SELF or others */ > > I'd move mode to be first. I'm undecided on using 4 separate fields > for pid/pid_fd/cgroup_{id,fd} vs a single union (or just generic "u64 > target" and then mode can define how we should treat target -- > whether it's pid, pid_fd, cgroup ID or FD. I'm fine either way, I > think. But for cgroup case not having to duplicate PRE/POST/UP/SELF > for cgroup id and then for cgroup fd seems like a win. So separate > fields might be better. It's also pretty extendable. And I'm > personally not worried about using few more bytes in bpf_attr for > disjoin fields like this. > Sounds good. Thanks for clarification. Using separate fields looks good to me. Since we settled on the cgroup part, I will apply update in cgroup_iter v7. > > } task; > > }; > > > > > > > > + __u32 traversal_order; > > > > > > + } cgroup; > > > > > > }; > > > > > > > > > > > > /* BPF syscall commands, see bpf(2) man-page for more details. */ > > > > > > > > > > [...]
Powered by blists - more mailing lists