Re: Filter/Parse NETLINK_KOBJECT_UEVENT Messages

[Ryan McClue <re.mcclue@xxxxxxxxxxxxxx>]

Earlier you said that .nl_groups = 2 will get kernel uevents augmented by udev. So, at some stage doesn't udev have to parse the raw kernel uevents, i.e. .nl_groups = 1? How does it do this? Does it use BPF to achieve this or the string parsing?

--
Ryan McClue, Sydney

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Tuesday, September 14th, 2021 at 5:24 PM, Lennart Poettering <lennart@xxxxxxxxxxxxxx> wrote:

> On Di, 14.09.21 01:08, Ryan McClue (re.mcclue@xxxxxxxxxxxxxx) wrote:
>
> > I understand this is slightly off-topic, but I'm completely new to
> >
> > BPF. Analyzing libudev source and Internet I understand the general
> >
> > idea. However, I don't understand how information/what information
> >
> > is passed to the filter from the socket. For example, in my case the
> >
> > socket payload, i.e. buf_str =
> >
> > add@/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2.4/1-2.4:1.0/input/input38/event14
>
> > 1.  How do I pass this string to the sock_filter/sock_fprog
> >
> >     structures?
>
> You don't. The bpf filtering, and in particular the bloom filter that
>
> is used for that is mostly internal to udev, and not something that is
>
> consider official API and should be reimplemented.
>
> Use sd-device/libudev, it implements all of this, and is the only official API
>
> to the bpf bloom filter stuff udev does there.
>
> Lennart
>
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Lennart Poettering, Berlin