lkml.org 
[lkml]   [2020]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH bpf-next v6 0/7] Generalizing bpf_local_storage
    Date
    From: KP Singh <kpsingh@google.com>

    # v5 -> v6

    - Fixed a build warning.
    - Rebase.

    # v4 -> v5

    - Split non-functional changes into separate commits.
    - Updated the cache macros to be simpler.
    - Fixed some bugs noticed by Martin.
    - Updated the userspace map functions to use an fd for lookups, updates
    and deletes.
    - Rebase.

    # v3 -> v4

    - Fixed a missing include to bpf_sk_storage.h in bpf_sk_storage.c
    - Fixed some functions that were not marked as static which led to
    W=1 compilation warnings.

    # v2 -> v3

    * Restructured the code as per Martin's suggestions:
    - Common functionality in bpf_local_storage.c
    - bpf_sk_storage functionality remains in net/bpf_sk_storage.
    - bpf_inode_storage is kept separate as it is enabled only with
    CONFIG_BPF_LSM.
    * A separate cache for inode and sk storage with macros to define it.
    * Use the ops style approach as suggested by Martin instead of the
    enum + switch style.
    * Added the inode map to bpftool bash completion and docs.
    * Rebase and indentation fixes.

    # v1 -> v2

    * Use the security blob pointer instead of dedicated member in
    struct inode.
    * Better code re-use as suggested by Alexei.
    * Dropped the inode count arithmetic as pointed out by Alexei.
    * Minor bug fixes and rebase.

    bpf_sk_storage can already be used by some BPF program types to annotate
    socket objects. These annotations are managed with the life-cycle of the
    object (i.e. freed when the object is freed) which makes BPF programs
    much simpler and less prone to errors and leaks.

    This patch series:

    * Generalizes the bpf_sk_storage infrastructure to allow easy
    implementation of local storage for other objects
    * Implements local storage for inodes
    * Makes both bpf_{sk, inode}_storage available to LSM programs.

    Local storage is safe to use in LSM programs as the attachment sites are
    limited and the owning object won't be freed, however, this is not the
    case for tracing. Usage in tracing is expected to follow a white-list
    based approach similar to the d_path helper
    (https://lore.kernel.org/bpf/20200506132946.2164578-1-jolsa@kernel.org).

    Access to local storage would allow LSM programs to implement stateful
    detections like detecting the unlink of a running executable from the
    examples shared as a part of the KRSI series
    https://lore.kernel.org/bpf/20200329004356.27286-1-kpsingh@chromium.org/
    and
    https://github.com/sinkap/linux-krsi/blob/patch/v1/examples/samples/bpf/lsm_detect_exec_unlink.c

    KP Singh (7):
    bpf: Renames to prepare for generalizing sk_storage.
    bpf: Generalize caching for sk_storage.
    bpf: Generalize bpf_sk_storage
    bpf: Split bpf_local_storage to bpf_sk_storage
    bpf: Implement bpf_local_storage for inodes
    bpf: Allow local storage to be used from LSM programs
    bpf: Add selftests for local_storage

    include/linux/bpf.h | 13 +
    include/linux/bpf_local_storage.h | 175 ++++
    include/linux/bpf_lsm.h | 21 +
    include/linux/bpf_types.h | 3 +
    include/net/bpf_sk_storage.h | 12 +
    include/net/sock.h | 4 +-
    include/uapi/linux/bpf.h | 54 +-
    kernel/bpf/Makefile | 2 +
    kernel/bpf/bpf_inode_storage.c | 353 ++++++++
    kernel/bpf/bpf_local_storage.c | 519 ++++++++++++
    kernel/bpf/bpf_lsm.c | 21 +-
    kernel/bpf/syscall.c | 3 +-
    kernel/bpf/verifier.c | 10 +
    net/core/bpf_sk_storage.c | 759 ++++--------------
    security/bpf/hooks.c | 7 +
    .../bpf/bpftool/Documentation/bpftool-map.rst | 2 +-
    tools/bpf/bpftool/bash-completion/bpftool | 3 +-
    tools/bpf/bpftool/map.c | 3 +-
    tools/include/uapi/linux/bpf.h | 54 +-
    tools/lib/bpf/libbpf_probes.c | 5 +-
    .../bpf/prog_tests/test_local_storage.c | 60 ++
    .../selftests/bpf/progs/local_storage.c | 136 ++++
    22 files changed, 1593 insertions(+), 626 deletions(-)
    create mode 100644 include/linux/bpf_local_storage.h
    create mode 100644 kernel/bpf/bpf_inode_storage.c
    create mode 100644 kernel/bpf/bpf_local_storage.c
    create mode 100644 tools/testing/selftests/bpf/prog_tests/test_local_storage.c
    create mode 100644 tools/testing/selftests/bpf/progs/local_storage.c

    --
    2.28.0.rc0.105.gf9edc3c819-goog

    \
     
     \ /
      Last update: 2020-07-23 13:51    [W:4.941 / U:0.452 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site