Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1545576

Re: Potential issues (security and otherwise) with the current cgroup-bpf API

From Alexei Starovoitov <alexei.starovoitov@gmail.com>
Newsgroups linux.kernel
Subject Re: Potential issues (security and otherwise) with the current cgroup-bpf API
Date 2016-12-21 05:10 +0100
Message-ID <sQGo1-6Sv-3@gated-at.bofh.it> (permalink)
References (5 earlier) <sQjKN-99-9@gated-at.bofh.it> <sQpQe-4jH-53@gated-at.bofh.it> <sQwoG-8wo-15@gated-at.bofh.it> <sQxuq-IB-27@gated-at.bofh.it> <sQxNM-Pw-27@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Tue, Dec 20, 2016 at 10:49:25AM -0800, Andy Lutomirski wrote:
> >> FWIW, everywhere I say ioctl(), the bpf() syscall would be okay, too.
> >> It doesn't make a semantic difference, except that I dislike
> >> BPF_PROG_DETACH because that particular command isn't BPF-specific at
> >> all.
> >
> > Well, I think it is; it pops the bpf program from a target and drops the
> > reference on it. It's not much code, but it's certainly bpf-specific.
> 
> I mean the interface isn't bpf-specific.  If there was something that
> wasn't bpf attached to the target, you'd still want an API to detach
> it.

This discussion won't go anywhere while you keep thinking that this api
has to be generalized. As I explained several times earlier
BPF_CGROUP_INET_SOCK_CREATE hook is bpf specific. There is nothing
in the kernel that can take advantage of it today, so by definition
the hook is bpf specific. Period. Saying that something in the future
may come along that would want to use that is like saying I want
to design the generic steering wheel for any car that will ever need it.

Hence if you want to change 'target_fd' in BPF_PROG_ATTACH/DETACH cmds
from being fd of open("cgroupdir") to fd of open("cgroupdir/cgroup.bpf")
file inside it then I'm ok with that.
All other proposals with non-extensible ioctls() and crazy text based
per-hook permissions is nack.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Potential issues (security and otherwise) with the current cgroup-bpf API Andy Lutomirski <luto@kernel.org> - 2016-12-17 19:20 +0100
  Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Mickaël Salaün <mic@digikod.net> - 2016-12-17 20:40 +0100
    Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-17 21:10 +0100
  Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-19 22:00 +0100
    Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@kernel.org> - 2016-12-19 22:30 +0100
      Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 01:10 +0100
        Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 01:30 +0100
          Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 02:50 +0100
          Re: Potential issues (security and otherwise) with the current  cgroup-bpf API David Ahern <dsahern@gmail.com> - 2016-12-20 02:50 +0100
            Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 03:00 +0100
              Re: Potential issues (security and otherwise) with the current  cgroup-bpf API David Ahern <dsahern@gmail.com> - 2016-12-20 04:00 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 04:20 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 05:50 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 06:30 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 06:40 +0100
              Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Peter Zijlstra <peterz@infradead.org> - 2016-12-20 10:20 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Michal Hocko <mhocko@kernel.org> - 2017-01-03 11:30 +0100
          Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 04:20 +0100
            Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 05:00 +0100
              Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 05:50 +0100
              Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Daniel Mack <daniel@zonque.org> - 2016-12-20 11:30 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 18:30 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Daniel Mack <daniel@zonque.org> - 2016-12-20 19:40 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 20:00 +0100
                Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-21 05:10 +0100
        Re: Potential issues (security and otherwise) with the current  cgroup-bpf API David Miller <davem@davemloft.net> - 2016-12-20 02:40 +0100
          Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 02:50 +0100
            Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-12-20 06:00 +0100
              Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2016-12-20 06:30 +0100

csiph-web