G'day All,
The original cover letter providing background context and motivating
factors around the needs for the BPF kfuncs introduced within this
patch series can be found here [0], so please do reference that if
need be.
Notably, one of the main contention points within v1 of this patch
series was that we were effectively leaning on some preexisting
in-kernel APIs such as get_task_exe_file() and get_mm_exe_file()
within some of the newly introduced BPF kfuncs. As noted in my
response here [1] though, I struggle to understand the technical
reasoning behind why exposing such in-kernel helpers, specifically
only to BPF LSM program types in the form of BPF kfuncs, is inherently
a terrible idea. So, until someone provides me with a sound technical
explanation as to why this cannot or should not be done, I'll continue
to lean on them. The alternative is to reimplement the necessary
in-kernel APIs within the BPF kfuncs, but that's just nonsensical IMO.
Changes since v1:
* Dropped the probe-read related patches [2, 3], which focused on
retroactively fixing bpf_d_path() such that it's susceptability
to memory corruption issues is drastically reduced. Rightfully so
though, it was deemed that reimplementing a semi-functional
variant of d_path() that was effectively backed by
copy_from_kernel_nofault() is suboptimal.
[0] https://lore.kernel.org/bpf/cover.1708377880.git.mattbobrowski@xxxxxxxxxx/
[1] https://lore.kernel.org/bpf/ZdX83H7rTEwMYvs2@xxxxxxxxxx/
[2] https://lore.kernel.org/bpf/5643840bd57d0c2345635552ae228dfb2ed3428c.1708377880.git.mattbobrowski@xxxxxxxxxx/
[3] https://lore.kernel.org/bpf/18c7b587d43bbc7e80593bf51ea9d3eb99e47bc1.1708377880.git.mattbobrowski@xxxxxxxxxx/
Matt Bobrowski (9):
bpf: rename fs_kfunc_set_ids to lsm_kfunc_set_ids
bpf: add new acquire/release BPF kfuncs for mm_struct
bpf/selftests: add selftests for mm_struct acquire/release BPF kfuncs
bpf: add new acquire/release based BPF kfuncs for exe_file
bpf/selftests: add selftests for exe_file acquire/release BPF kfuncs
bpf: add acquire/release based BPF kfuncs for fs_struct's paths
bpf/selftests: add selftests for root/pwd path based BPF kfuncs
bpf: add trusted d_path() based BPF kfunc bpf_path_d_path()
bpf/selftests: adapt selftests test_d_path for BPF kfunc
bpf_path_d_path()
kernel/trace/bpf_trace.c | 248 +++++++++++++++++-
.../testing/selftests/bpf/prog_tests/d_path.c | 80 ++++++
.../selftests/bpf/prog_tests/exe_file_kfunc.c | 49 ++++
.../selftests/bpf/prog_tests/mm_kfunc.c | 48 ++++
.../selftests/bpf/prog_tests/path_kfunc.c | 48 ++++
.../selftests/bpf/progs/d_path_common.h | 35 +++
.../bpf/progs/d_path_kfunc_failure.c | 66 +++++
.../bpf/progs/d_path_kfunc_success.c | 25 ++
.../bpf/progs/exe_file_kfunc_common.h | 23 ++
.../bpf/progs/exe_file_kfunc_failure.c | 181 +++++++++++++
.../bpf/progs/exe_file_kfunc_success.c | 52 ++++
.../selftests/bpf/progs/mm_kfunc_common.h | 19 ++
.../selftests/bpf/progs/mm_kfunc_failure.c | 103 ++++++++
.../selftests/bpf/progs/mm_kfunc_success.c | 30 +++
.../selftests/bpf/progs/path_kfunc_common.h | 20 ++
.../selftests/bpf/progs/path_kfunc_failure.c | 114 ++++++++
.../selftests/bpf/progs/path_kfunc_success.c | 30 +++
.../testing/selftests/bpf/progs/test_d_path.c | 20 +-
.../bpf/progs/test_d_path_check_rdonly_mem.c | 8 +-
.../bpf/progs/test_d_path_check_types.c | 8 +-
20 files changed, 1160 insertions(+), 47 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/exe_file_kfunc.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/mm_kfunc.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/path_kfunc.c
create mode 100644 tools/testing/selftests/bpf/progs/d_path_common.h
create mode 100644 tools/testing/selftests/bpf/progs/d_path_kfunc_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/d_path_kfunc_success.c
create mode 100644 tools/testing/selftests/bpf/progs/exe_file_kfunc_common.h
create mode 100644 tools/testing/selftests/bpf/progs/exe_file_kfunc_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/exe_file_kfunc_success.c
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_common.h
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/mm_kfunc_success.c
create mode 100644 tools/testing/selftests/bpf/progs/path_kfunc_common.h
create mode 100644 tools/testing/selftests/bpf/progs/path_kfunc_failure.c
create mode 100644 tools/testing/selftests/bpf/progs/path_kfunc_success.c
--
2.44.0.278.ge034bb2e1d-goog
/M
