lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220831134450.GB8153@breakpoint.cc> Date: Wed, 31 Aug 2022 15:44:50 +0200 From: Florian Westphal <fw@...len.de> To: Florian Westphal <fw@...len.de> Cc: Toke Høiland-Jørgensen <toke@...nel.org>, netfilter-devel@...r.kernel.org, bpf@...r.kernel.org, netdev@...r.kernel.org Subject: Re: [PATCH nf-next] netfilter: nf_tables: add ebpf expression Florian Westphal <fw@...len.de> wrote: > Toke Høiland-Jørgensen <toke@...nel.org> wrote: > > > Tag and program id are dumped to userspace on 'list' to allow to see which > > > program is in use in case the filename isn't available/present. > > > > It seems a bit odd to include the file path in the kernel as well. > > Its needed to be able to re-load the ruleset. In particular, I can't find any better alternative. load by id -> works, easy to echo back to userspace, but not stable identifier across reboots or add/del operations of the program. load by tag -> similar, except that this time the tag needs to be adjusted whenever the program changes, so not ideal either. load via ELF name -> same problems as the proposed 'pinned' mode, but perhaps a bit easier to use? It has the slight advantage that users don't need to load/pin the program first, lifetime of the program would be tied to the nftables rule. The downside is that nft needs to deal with possible rejection of the program instead of 'outsourcing' this problem to bpftool (or another program).
Powered by blists - more mailing lists