From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0DCA8C2D0CF for ; Tue, 24 Dec 2019 06:36:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D513A2071A for ; Tue, 24 Dec 2019 06:36:21 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q0fI68b6" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726084AbfLXGgV (ORCPT ); Tue, 24 Dec 2019 01:36:21 -0500 Received: from mail-qk1-f195.google.com ([209.85.222.195]:34756 "EHLO mail-qk1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726043AbfLXGgV (ORCPT ); Tue, 24 Dec 2019 01:36:21 -0500 Received: by mail-qk1-f195.google.com with SMTP id j9so15764595qkk.1; Mon, 23 Dec 2019 22:36:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9f49rZjJKxHQwfDaONd7CPvs6B/LdSmBjADe//pqNas=; b=Q0fI68b6Cz4xabYadXmuPHobPKvFG2OM8qtvz8n0gm8iaRy3QkQsf70C667oqYKFz7 BbI26kf9LSBYxPmQNBrn3mVmcj6aafUbeda7TeVJXEF0yUbnnrR9UyW1fKM9D1Vv9IFV cx5hM2YiJ8YArAo+JKOqpVlxtmu3Iu1/Lxg2MXOUfKWnPp/g55P6tl8qjLvfZCKRWkyF FN1T92sjrgi6Kr6aaAFRvrwLM68W468QdIfSmsqidLKwQtPfX1yaJ9qT0Hls3JA/VeRf 77/Ye1FIneqm2xNioqZXdt0RY6nOm1WHooixyQIarWb4B5BdsAml5GnIII/wXZLXLna9 Uuug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9f49rZjJKxHQwfDaONd7CPvs6B/LdSmBjADe//pqNas=; b=IdeS6jf0k4mQaC4TPVx1Ha/ecDPmIl8D+yYqC9CrvUI4uZ3V3/dzW9UcKYvYaSdHcx QUF2TY6mVrXXIBMWqj2y4zeQy0Ogauiu7mXdfl64yQXVGuKB1M1mgHljyS0DbV1NYnA/ m81KDHly/ASdJb+sOsDWA6oZqTo9+fHzvPTbU4v4i1a7bk9jP+pWfGWLr4sJYiRgBC5n 30tVapHMC9WdALyZ30cM2+ZKlaaHNIVKNsNbnQNElnnog6olhVrH3mmck1Q3pV23Wptu j92lt8J3HNsMzuTaAGueIOImzqcd58btWR5PtSEX/GdAu/x/Xsv14WShfehyOLJh/a7P F1Sw== X-Gm-Message-State: APjAAAVD3C/ZxhAUmDj06Ca6m+QD6NZ+jI3T2p+ioExi2NUHCQKitKoJ fgNqfhCWC8w6gHLyLzIgFPWGjEq0SScYI9RJA4c= X-Google-Smtp-Source: APXvYqzAaS5x91eisBrBiUd9yh3gyBoa1BMy6JI4p5M2rCh8P5rjFxKBEJ84ucdaMez0uun3rPsL8FDjllogmrn39ZM= X-Received: by 2002:a37:a685:: with SMTP id p127mr30971238qke.449.1577169379912; Mon, 23 Dec 2019 22:36:19 -0800 (PST) MIME-Version: 1.0 References: <20191220154208.15895-1-kpsingh@chromium.org> <20191220154208.15895-10-kpsingh@chromium.org> In-Reply-To: <20191220154208.15895-10-kpsingh@chromium.org> From: Andrii Nakryiko Date: Mon, 23 Dec 2019 22:36:08 -0800 Message-ID: Subject: Re: [PATCH bpf-next v1 09/13] bpf: lsm: Add a helper function bpf_lsm_event_output To: KP Singh Cc: open list , bpf , linux-security-module@vger.kernel.org, Alexei Starovoitov , Daniel Borkmann , James Morris , Kees Cook , Thomas Garnier , Michael Halcrow , Paul Turner , Brendan Gregg , Jann Horn , Matthew Garrett , Christian Brauner , =?UTF-8?B?TWlja2HDq2wgU2FsYcO8bg==?= , Florent Revest , Brendan Jackman , Martin KaFai Lau , Song Liu , Yonghong Song , "Serge E. Hallyn" , Mauro Carvalho Chehab , "David S. Miller" , Greg Kroah-Hartman , Nicolas Ferre , Stanislav Fomichev , Quentin Monnet , Andrey Ignatov , Joe Stringer Content-Type: text/plain; charset="UTF-8" Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On Fri, Dec 20, 2019 at 7:43 AM KP Singh wrote: > > From: KP Singh > > This helper is similar to bpf_perf_event_output except that > it does need a ctx argument which is more usable in the > BTF based LSM programs where the context is converted to > the signature of the attacthed BTF type. > > An example usage of this function would be: > > struct { > __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); > __uint(key_size, sizeof(int)); > __uint(value_size, sizeof(u32)); > } perf_map SEC(".maps"); > > BPF_TRACE_1(bpf_prog1, "lsm/bprm_check_security, > struct linux_binprm *, bprm) > { > char buf[BUF_SIZE]; > int len; > u64 flags = BPF_F_CURRENT_CPU; > > /* some logic that fills up buf with len data */ > len = fill_up_buf(buf); > if (len < 0) > return len; > if (len > BU) > return 0; > > bpf_lsm_event_output(&perf_map, flags, buf, len); This seems to be generally useful and not LSM-specific, so maybe name it more generically as bpf_event_output instead? I'm also curious why we needed both bpf_perf_event_output and bpf_perf_event_output_raw_tp, if it could be done as simply as you did it here. What's different between those three and why your bpf_lsm_event_output doesn't need pt_regs passed into them? > return 0; > } > > Signed-off-by: KP Singh > --- > include/uapi/linux/bpf.h | 10 +++++++++- > kernel/bpf/verifier.c | 1 + > security/bpf/ops.c | 21 +++++++++++++++++++++ > tools/include/uapi/linux/bpf.h | 10 +++++++++- > 4 files changed, 40 insertions(+), 2 deletions(-) > [...]