From: Daniel Borkmann <daniel@iogearbox.net>
To: Chenbo Feng <chenbofeng.kernel@gmail.com>,
netdev@vger.kernel.org, David Miller <davem@davemloft.net>
Cc: Lorenzo Colitti <lorenzo@google.com>,
Chenbo Feng <fengc@google.com>,
ast@fb.com
Subject: Re: [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff
Date: Tue, 06 Jun 2017 18:40:38 +0200 [thread overview]
Message-ID: <5936DB06.5070601@iogearbox.net> (raw)
In-Reply-To: <59369A30.1060301@iogearbox.net>
On 06/06/2017 02:04 PM, Daniel Borkmann wrote:
> On 06/01/2017 03:15 AM, Chenbo Feng wrote:
>> From: Chenbo Feng <fengc@google.com>
>>
>> This allows cgroup eBPF program to classify packet based on their
>> protocol or other detail information. Currently program need
>> CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A
>> process with CAP_NET_ADMIN can already see all packets on the system,
>> for example, by creating an iptables rules that causes the packet to
>> be passed to userspace via NFLOG.
>>
>> Signed-off-by: Chenbo Feng <fengc@google.com>
>
> Sorry, but I am puzzled what above change log has to do with the
> below diff?! Back then we decided not to add BPF_PROG_TYPE_CGROUP_SKB
> to may_access_skb(), since one can already use bpf_skb_load_bytes()
> helper to access pkt data, which is a much more flexible interface.
> Mind to elaborate why you cannot use bpf_skb_load_bytes() instead?
See my other email [1], this one is also problematic wrt SKF_LL_OFF.
[1] http://patchwork.ozlabs.org/patch/771946/
next prev parent reply other threads:[~2017-06-06 16:40 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-01 1:15 [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff Chenbo Feng
2017-06-01 1:16 ` [PATCH net-next v2 2/2] bpf: Remove the capability check for cgroup skb eBPF program Chenbo Feng
2017-06-01 23:42 ` Alexei Starovoitov
[not found] ` <CAMOXUJkHsj8c6Yc8FSvJsFt3vPcf-UKV0PPVWY8ewcZuA2vUwA@mail.gmail.com>
2017-06-02 1:58 ` Alexei Starovoitov
2017-06-06 16:56 ` Daniel Borkmann
2017-06-06 22:44 ` Chenbo Feng
2017-06-07 15:57 ` Daniel Borkmann
2017-06-02 18:25 ` David Miller
2017-06-01 23:38 ` [PATCH net-next v2 1/2] bpf: Allow CGROUP_SKB eBPF program to access sk_buff Alexei Starovoitov
2017-06-02 18:24 ` David Miller
2017-06-06 12:04 ` Daniel Borkmann
2017-06-06 16:40 ` Daniel Borkmann [this message]
[not found] ` <CAMOXUJ=mUKvMMFnjfOUHuGms+p2fE+NkwEcORdV9eLBsFwyREQ@mail.gmail.com>
2017-06-06 20:26 ` David Miller
2017-06-06 20:27 ` Daniel Borkmann
2017-06-06 20:40 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5936DB06.5070601@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=ast@fb.com \
--cc=chenbofeng.kernel@gmail.com \
--cc=davem@davemloft.net \
--cc=fengc@google.com \
--cc=lorenzo@google.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.