On 10/11/23 11:51 AM, Daan De Meyer wrote:
Changes since v10:
* Removed extra check from bpf_sock_addr_set_sun_path() again in favor of
calling unix_validate_addr() everywhere in af_unix.c before calling the hooks.
Changes since v9:
* Renamed bpf_sock_addr_set_unix_addr() to bpf_sock_addr_set_sun_path() and
rennamed arguments to match the new name.
* Added an extra check to bpf_sock_addr_set_sun_path() to disallow changing the
address of an unnamed unix socket.
* Removed unnecessary NULL check on uaddrlen in
__cgroup_bpf_run_filter_sock_addr().
[ ... ]
This patch series extends the cgroup sockaddr hooks to include support for unix
sockets. To add support for unix sockets, struct bpf_sock_addr_kern is extended
to expose the socket address length to the bpf program. Along with that, a new
kfunc bpf_sock_addr_set_unix_addr() is added to safely allow modifying an
AF_UNIX sockaddr from bpf programs.
I intend to use these new hooks in systemd to reimplement the LogNamespace=
feature, which allows running multiple instances of systemd-journald to
process the logs of different services. systemd-journald also processes
syslog messages, so currently, using log namespaces means all services running
in the same log namespace have to live in the same private mount namespace
so that systemd can mount the journal namespace's associated syslog socket
over /dev/log to properly direct syslog messages from all services running
in that log namespace to the correct systemd-journald instance. We want to
relax this requirement so that processes running in disjoint mount namespaces
can still run in the same log namespace. To achieve this, we can use these
new hooks to rewrite the socket address of any connect(), sendto(), ...
syscalls to /dev/log to the socket address of the journal namespace's syslog
socket instead, which will transparently do the redirection without requiring
use of a mount namespace and mounting over /dev/log.
Aside from the above usecase, these hooks can more generally be used to
transparently redirect unix sockets to different addresses as required by
services.
I have changed to use the "uaddr" test in patch 2 per the discussion in v10.
Patch 4 in v11 was changed based on the discussion in v10 (call bpf after
unix_validate_addr), so I carried Kuniyuki's reviewed-by tag from v9.
Applied. Thanks.
