From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DBC7E92FF8 for ; Fri, 6 Oct 2023 09:05:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230238AbjJFJF0 (ORCPT ); Fri, 6 Oct 2023 05:05:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231215AbjJFJFZ (ORCPT ); Fri, 6 Oct 2023 05:05:25 -0400 Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F111F93; Fri, 6 Oct 2023 02:05:23 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id ffacd0b85a97d-3231d6504e1so1719922f8f.2; Fri, 06 Oct 2023 02:05:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1696583122; x=1697187922; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=tV8vdtRv0dLgQHb0i++2h3/DMYxrtErGTtvFqRlaYuM=; b=dZa02X+kRu9jyFk9y1mToMqN33813nIXY7XQmwBsE+PgI7CrbMS1sTE/Wgl06sM04R NySjt3Hn44CQrU0Z9OQY0qsThUsWktrF6eu8Ax4bdcqmS9sGFWXg8oZa5OTP7h+6b7W3 h6HbSW2iizKvk0r1HV00dqj4/wFrXzkSv8qqhcpd9H8ItTg+FV42T8KV7MFgbRvbMJ3+ Sm/rdBLzzqoLbKAdRLtNV9olcAsa9BlOQYGbbbwGv3T1TWyxpWtP4gV1uglDmbBHOan7 QBtw1tc4MuDkgZt4TEiKocPKByUQ5KMWVuj4QD0wZhaiLQgQRgP0vGXRpdF2/GOEdoIp 6U+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696583122; x=1697187922; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=tV8vdtRv0dLgQHb0i++2h3/DMYxrtErGTtvFqRlaYuM=; b=mTZkyA/+gUWs+4hKxw4SKFPhquL2gIo3+/bQQYul4m9LUfZGW1iLt/QLCkKZ55qS5j DWuWT2AeuJ8Et8MRqx8QAx96qB3/gb2YHwO7wED5ZkB5qE+g6KrHdoKBFddBNtjJFT+K Z1vVQc4rT+T4bqM57QbeyYzXkRBB9CoX+FmYjkz2kM30G5StbS8nEhjB5E1X91MeX+Hf gctu73srKOtZ6aWvgbr+H8VHZP37b+fwSIaPFoxO45zpi8PxrsXgU4CPnLeNv8xHH6rN jFkFG9VOU7Ab3jXApjZOCO2U0Q6VGNHtBSybGwYRloDD3nsLBJyvM+PSBbSBm9RrHx8S wWcQ== X-Gm-Message-State: AOJu0YwtOfKtDZaQSEFkJdX2WwXCJVd/1Umy4OUmaEvl24gJxcB9qk5V x/n2QfkKhANOAs3xjePcxLs= X-Google-Smtp-Source: AGHT+IHw6Yxkg8as3r/flQofvYoN/GP3MsFDBicu3V1whChqfhmdL98ABCljUUSixXXHiG2DHxuQSA== X-Received: by 2002:a05:6000:18b:b0:323:1689:6607 with SMTP id p11-20020a056000018b00b0032316896607mr6995613wrx.5.1696583121924; Fri, 06 Oct 2023 02:05:21 -0700 (PDT) Received: from krava (2001-1ae9-1c2-4c00-726e-c10f-8833-ff22.ip6.tmcz.cz. [2001:1ae9:1c2:4c00:726e:c10f:8833:ff22]) by smtp.gmail.com with ESMTPSA id n9-20020adff089000000b0031ad2f9269dsm1167270wro.40.2023.10.06.02.05.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Oct 2023 02:05:21 -0700 (PDT) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Fri, 6 Oct 2023 11:05:19 +0200 To: KP Singh Cc: Jiri Olsa , linux-security-module@vger.kernel.org, bpf@vger.kernel.org, paul@paul-moore.com, keescook@chromium.org, casey@schaufler-ca.com, song@kernel.org, daniel@iogearbox.net, ast@kernel.org, renauld@google.com Subject: Re: [PATCH v5 4/5] bpf: Only enable BPF LSM hooks when an LSM program is attached Message-ID: References: <20230928202410.3765062-1-kpsingh@kernel.org> <20230928202410.3765062-5-kpsingh@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: On Fri, Oct 06, 2023 at 09:27:57AM +0200, Jiri Olsa wrote: SNIP > > static int __bpf_trampoline_link_prog(struct bpf_tramp_link *link, > > struct bpf_trampoline *tr) > > { > > enum bpf_tramp_prog_type kind; > > struct bpf_tramp_link *link_exiting; > > - int err = 0, num_lsm_progs = 0; > > + int err = 0; > > int cnt = 0, i; > > > > kind = bpf_attach_type_to_tramp(link->link.prog); > > @@ -547,15 +566,14 @@ static int __bpf_trampoline_link_prog(struct > > bpf_tramp_link *link, struct bpf_tr > > /* prog already linked */ > > return -EBUSY; > > > > - if (link_exiting->link.prog->type == BPF_PROG_TYPE_LSM) > > - num_lsm_progs++; > > } > > > > - if (!num_lsm_progs && link->link.prog->type == BPF_PROG_TYPE_LSM) > > - bpf_lsm_toggle_hook(tr->func.addr, true); > > - > > hlist_add_head(&link->tramp_hlist, &tr->progs_hlist[kind]); > > tr->progs_cnt[kind]++; > > + > > + if (link->link.prog->type == BPF_PROG_TYPE_LSM) > > + bpf_trampoline_toggle_lsm(tr, kind); > > how about keeping BPF_PROG_TYPE_LSM progs type count of attached programs > in bpf_trampoline and toggle lsm on first coming in and last going out? hm we actually allow other tracing program types to attach to bpf_lsm_* functions, so I wonder we should toggle the lsm hook for each program type (for bpf_lsm_* trampolines) because they'd expect the hook is called but I'm not sure it's a valid use case to have like normal fentry program attached to bpf_lsm_XXX function jirka > > also the trampoline attach is actually made in bpf_trampoline_update, > so I wonder it'd make more sense to put it in there, but it's already > complicated, so it actually might be easier in here > > jirka > > > + > > err = bpf_trampoline_update(tr, true /* lock_direct_mutex */); > > if (err) { > > hlist_del_init(&link->tramp_hlist); > > @@ -578,7 +596,6 @@ static int __bpf_trampoline_unlink_prog(struct > > bpf_tramp_link *link, struct bpf_ > > { > > struct bpf_tramp_link *link_exiting; > > enum bpf_tramp_prog_type kind; > > - bool lsm_link_found = false; > > int err, num_lsm_progs = 0; > > > > kind = bpf_attach_type_to_tramp(link->link.prog); > > @@ -595,18 +612,14 @@ static int __bpf_trampoline_unlink_prog(struct > > bpf_tramp_link *link, struct bpf_ > > tramp_hlist) { > > if (link_exiting->link.prog->type == BPF_PROG_TYPE_LSM) > > num_lsm_progs++; > > - > > - if (link_exiting->link.prog == link->link.prog) > > - lsm_link_found = true; > > } > > } > > > > hlist_del_init(&link->tramp_hlist); > > tr->progs_cnt[kind]--; > > > > - if (lsm_link_found && num_lsm_progs == 1) > > - bpf_lsm_toggle_hook(tr->func.addr, false); > > - > > + if (link->link.prog->type == BPF_PROG_TYPE_LSM) > > + bpf_trampoline_toggle_lsm(tr, kind); > > return bpf_trampoline_update(tr, true /* lock_direct_mutex */); > > } > > > > > > - KP