On 03-Mär 14:12, Andrii Nakryiko wrote: > On Tue, Mar 3, 2020 at 6:12 AM KP Singh <kpsingh@xxxxxxxxxxxx> wrote: > > > > From: KP Singh <kpsingh@xxxxxxxxxx> > > > > This was brought up in the KRSI v4 discussion and found to be useful > > both for security and tracing programs. > > > > https://lore.kernel.org/bpf/20200225193108.GB22391@xxxxxxxxxxxx/ > > > > The modify_return programs are allowed for security hooks (with an > > extra CAP_MAC_ADMIN check) and functions whitelisted for error > > injection (ALLOW_ERROR_INJECTION). > > > > The "security_" check is expected to be cleaned up with the KRSI patch > > series. > > > > Here is an example of how a fmod_ret program behaves: > > > > int func_to_be_attached(int a, int b) > > { <--- do_fentry > > > > do_fmod_ret: > > <update ret by calling fmod_ret> > > if (ret != 0) > > goto do_fexit; > > > > original_function: > > > > <side_effects_happen_here> > > > > } <--- do_fexit > > > > ALLOW_ERROR_INJECTION(func_to_be_attached, ERRNO) > > > > The fmod_ret program attached to this function can be defined as: > > > > SEC("fmod_ret/func_to_be_attached") > > BPF_PROG(func_name, int a, int b, int ret) > > nit: int BPF_PROG(...) Noted. Thanks! - KP > > > > { > > // This will skip the original function logic. > > return -1; > > } > > > > KP Singh (7): > > bpf: Refactor trampoline update code > > bpf: JIT helpers for fmod_ret progs > > bpf: Introduce BPF_MODIFY_RETURN > > bpf: Attachment verification for BPF_MODIFY_RETURN > > tools/libbpf: Add support for BPF_MODIFY_RETURN > > bpf: Add test ops for BPF_PROG_TYPE_TRACING > > bpf: Add selftests for BPF_MODIFY_RETURN > > > > arch/x86/net/bpf_jit_comp.c | 261 +++++++++++++----- > > include/linux/bpf.h | 24 +- > > include/uapi/linux/bpf.h | 1 + > > kernel/bpf/bpf_struct_ops.c | 13 +- > > kernel/bpf/btf.c | 27 +- > > kernel/bpf/syscall.c | 1 + > > kernel/bpf/trampoline.c | 66 +++-- > > kernel/bpf/verifier.c | 32 +++ > > kernel/trace/bpf_trace.c | 1 + > > net/bpf/test_run.c | 57 +++- > > tools/include/uapi/linux/bpf.h | 1 + > > tools/lib/bpf/libbpf.c | 4 + > > .../selftests/bpf/prog_tests/fentry_fexit.c | 12 +- > > .../selftests/bpf/prog_tests/fentry_test.c | 14 +- > > .../selftests/bpf/prog_tests/fexit_test.c | 69 ++--- > > .../selftests/bpf/prog_tests/modify_return.c | 65 +++++ > > .../selftests/bpf/progs/modify_return.c | 49 ++++ > > 17 files changed, 509 insertions(+), 188 deletions(-) > > create mode 100644 tools/testing/selftests/bpf/prog_tests/modify_return.c > > create mode 100644 tools/testing/selftests/bpf/progs/modify_return.c > > > > -- > > 2.20.1 > >
