From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51C6EC48BD3 for ; Wed, 26 Jun 2019 07:35:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 338E3208E3 for ; Wed, 26 Jun 2019 07:35:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726957AbfFZHfR (ORCPT ); Wed, 26 Jun 2019 03:35:17 -0400 Received: from smtp-sh.infomaniak.ch ([128.65.195.4]:48195 "EHLO smtp-sh.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725876AbfFZHfQ (ORCPT ); Wed, 26 Jun 2019 03:35:16 -0400 Received: from smtp7.infomaniak.ch (smtp7.infomaniak.ch [83.166.132.30]) by smtp-sh.infomaniak.ch (8.14.5/8.14.5) with ESMTP id x5Q7XpeS029374 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jun 2019 09:33:51 +0200 Received: from ns3096276.ip-94-23-54.eu (ns3096276.ip-94-23-54.eu [94.23.54.103]) (authenticated bits=0) by smtp7.infomaniak.ch (8.14.5/8.14.5) with ESMTP id x5Q7XZKl136464 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Wed, 26 Jun 2019 09:33:46 +0200 Subject: Re: [PATCH bpf-next v9 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier To: Alexei Starovoitov Cc: LKML , Aleksa Sarai , Alexander Viro , Alexei Starovoitov , Andrew Morton , Andy Lutomirski , Arnaldo Carvalho de Melo , Casey Schaufler , Daniel Borkmann , David Drysdale , "David S . Miller" , "Eric W . Biederman" , James Morris , Jann Horn , John Johansen , Jonathan Corbet , Kees Cook , Michael Kerrisk , =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Shuah Khan , Stephen Smalley , Tejun Heo , Tetsuo Handa , Thomas Graf , Tycho Andersen , Will Drewry , Kernel Hardening , Linux API , Linux-Fsdevel , LSM List , Network Development References: <20190625215239.11136-1-mic@digikod.net> <20190625215239.11136-3-mic@digikod.net> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Openpgp: preference=signencrypt Message-ID: <1b87e170-0779-fad0-f623-8cf677843338@digikod.net> Date: Wed, 26 Jun 2019 09:33:35 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: On 26/06/2019 01:02, Alexei Starovoitov wrote: > On Tue, Jun 25, 2019 at 3:04 PM Mickaël Salaün wrote: >> >> The goal of the program subtype is to be able to have different static >> fine-grained verifications for a unique program type. >> >> The struct bpf_verifier_ops gets a new optional function: >> is_valid_subtype(). This new verifier is called at the beginning of the >> eBPF program verification to check if the (optional) program subtype is >> valid. >> >> The new helper bpf_load_program_xattr() enables to verify a program with >> subtypes. >> >> For now, only Landlock eBPF programs are using a program subtype (see >> next commits) but this could be used by other program types in the >> future. >> >> Signed-off-by: Mickaël Salaün >> Cc: Alexei Starovoitov >> Cc: Daniel Borkmann >> Cc: David S. Miller >> Link: https://lkml.kernel.org/r/20160827205559.GA43880@ast-mbp.thefacebook.com >> --- >> >> Changes since v8: >> * use bpf_load_program_xattr() instead of bpf_load_program() and add >> bpf_verify_program_xattr() to deal with subtypes >> * remove put_extra() since there is no more "previous" field (for now) >> >> Changes since v7: >> * rename LANDLOCK_SUBTYPE_* to LANDLOCK_* >> * move subtype in bpf_prog_aux and use only one bit for has_subtype >> (suggested by Alexei Starovoitov) > > sorry to say, but I don't think the landlock will ever land, > since posting huge patches once a year is missing a lot of development > that is happening during that time. You're right that it's been a while since the last patch set, but the main reasons behind this was a lack of feedback (probably because of the size of the patch set, which is now reduce to a consistent minimum), the rework needed to address everyone's concern (Landlock modify kernel components from different maintainers), and above all, the LSM stacking infrastructure which was quite beefy and then took some time to land: https://lore.kernel.org/lkml/50db058a-7dde-441b-a7f9-f6837fe8b69f@schaufler-ca.com/ This stacking infrastructure was required to have a useful version of Landlock (which is used as a use case example), and it was released with Linux v5.1 (last month). Now, I think everything is finally ready to move forward. > This 2/10 patch is an example. > subtype concept was useful 2 years ago when v6 was posted. > Since then bpf developers faced very similar problem in other parts > and it was solved with 'expected_attach_type' field. > See commit 5e43f899b03a ("bpf: Check attach type at prog load time") > dated March 2018. I saw this nice feature but I wasn't sure if it was the right field to use. Indeed, I need more than a "type", but also some values (triggers) as shown by this patch. What do you suggest?