* [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI
@ 2016-08-04 7:12 Sargun Dhillon
2016-08-04 9:52 ` Daniel Borkmann
0 siblings, 1 reply; 3+ messages in thread
From: Sargun Dhillon @ 2016-08-04 7:12 UTC (permalink / raw)
To: linux-kernel; +Cc: alexei.starovoitov, daniel, linux-security-module, netdev
I think it makes sense to restrict Checmate to loading programs that have been
compiled with the current kernel ABI. We can further stabilize the ABI, and
perhaps lift this restriction later.
Signed-off-by: Sargun Dhillon <sargun@sargun.me>
---
kernel/bpf/syscall.c | 2 +-
samples/bpf/checmate1_kern.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 228f962..2a37b4d 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr)
if (attr->insn_cnt >= BPF_MAXINSNS)
return -EINVAL;
- if (type == BPF_PROG_TYPE_KPROBE &&
+ if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) &&
attr->kern_version != LINUX_VERSION_CODE)
return -EINVAL;
diff --git a/samples/bpf/checmate1_kern.c b/samples/bpf/checmate1_kern.c
index f78b66b..d4ec1fa 100644
--- a/samples/bpf/checmate1_kern.c
+++ b/samples/bpf/checmate1_kern.c
@@ -3,6 +3,7 @@
#include <linux/in.h>
#include <linux/checmate.h>
#include "bpf_helpers.h"
+#include <linux/version.h>
SEC("checmate")
int prog(struct checmate_ctx *ctx)
@@ -24,4 +25,4 @@ int prog(struct checmate_ctx *ctx)
}
char _license[] SEC("license") = "GPL";
-
+u32 _version SEC("version") = LINUX_VERSION_CODE;
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI
2016-08-04 7:12 [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI Sargun Dhillon
@ 2016-08-04 9:52 ` Daniel Borkmann
2016-08-04 9:54 ` Daniel Borkmann
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Borkmann @ 2016-08-04 9:52 UTC (permalink / raw)
To: Sargun Dhillon, linux-kernel
Cc: alexei.starovoitov, linux-security-module, netdev
On 08/04/2016 09:12 AM, Sargun Dhillon wrote:
> I think it makes sense to restrict Checmate to loading programs that have been
> compiled with the current kernel ABI. We can further stabilize the ABI, and
> perhaps lift this restriction later.
>
> Signed-off-by: Sargun Dhillon <sargun@sargun.me>
> ---
> kernel/bpf/syscall.c | 2 +-
> samples/bpf/checmate1_kern.c | 3 ++-
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 228f962..2a37b4d 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr)
> if (attr->insn_cnt >= BPF_MAXINSNS)
> return -EINVAL;
>
> - if (type == BPF_PROG_TYPE_KPROBE &&
> + if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) &&
> attr->kern_version != LINUX_VERSION_CODE)
Btw, this check is correct, program types are not masks.
BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now
require every type to have a version code ...
> return -EINVAL;
>
> diff --git a/samples/bpf/checmate1_kern.c b/samples/bpf/checmate1_kern.c
> index f78b66b..d4ec1fa 100644
> --- a/samples/bpf/checmate1_kern.c
> +++ b/samples/bpf/checmate1_kern.c
> @@ -3,6 +3,7 @@
> #include <linux/in.h>
> #include <linux/checmate.h>
> #include "bpf_helpers.h"
> +#include <linux/version.h>
>
> SEC("checmate")
> int prog(struct checmate_ctx *ctx)
> @@ -24,4 +25,4 @@ int prog(struct checmate_ctx *ctx)
> }
>
> char _license[] SEC("license") = "GPL";
> -
> +u32 _version SEC("version") = LINUX_VERSION_CODE;
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI
2016-08-04 9:52 ` Daniel Borkmann
@ 2016-08-04 9:54 ` Daniel Borkmann
0 siblings, 0 replies; 3+ messages in thread
From: Daniel Borkmann @ 2016-08-04 9:54 UTC (permalink / raw)
To: Sargun Dhillon, linux-kernel
Cc: alexei.starovoitov, linux-security-module, netdev
On 08/04/2016 11:52 AM, Daniel Borkmann wrote:
> On 08/04/2016 09:12 AM, Sargun Dhillon wrote:
>> I think it makes sense to restrict Checmate to loading programs that have been
>> compiled with the current kernel ABI. We can further stabilize the ABI, and
>> perhaps lift this restriction later.
>>
>> Signed-off-by: Sargun Dhillon <sargun@sargun.me>
>> ---
>> kernel/bpf/syscall.c | 2 +-
>> samples/bpf/checmate1_kern.c | 3 ++-
>> 2 files changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 228f962..2a37b4d 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -741,7 +741,7 @@ static int bpf_prog_load(union bpf_attr *attr)
>> if (attr->insn_cnt >= BPF_MAXINSNS)
>> return -EINVAL;
>>
>> - if (type == BPF_PROG_TYPE_KPROBE &&
>> + if ((type & (BPF_PROG_TYPE_KPROBE | BPF_PROG_TYPE_CHECMATE)) &&
>> attr->kern_version != LINUX_VERSION_CODE)
>
> Btw, this check is correct, program types are not masks.
Sorry, I meant to write *not* correct, which was hopefully inferable from
the rest.
> BPF_PROG_TYPE_KPROBE (== 2) and BPF_PROG_TYPE_CHECMATE (== 7) will now
> require every type to have a version code ...
>
>> return -EINVAL;
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-08-04 10:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-04 7:12 [RFC 4/4] bpf: Restrict Checmate bpf programs to current kernel ABI Sargun Dhillon
2016-08-04 9:52 ` Daniel Borkmann
2016-08-04 9:54 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).