From: KP Singh <kpsingh@chromium.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: KP Singh <kpsingh@chromium.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux Security Module list
<linux-security-module@vger.kernel.org>,
bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v4 3/8] bpf: lsm: provide attachment points for BPF LSM programs
Date: Fri, 21 Feb 2020 12:44:58 +0100 [thread overview]
Message-ID: <20200221114458.GA56944@google.com> (raw)
In-Reply-To: <0ef26943-9619-3736-4452-fec536a8d169@schaufler-ca.com>
On 20-Feb 15:49, Casey Schaufler wrote:
> On 2/20/2020 9:52 AM, KP Singh wrote:
> > From: KP Singh <kpsingh@google.com>
>
> Sorry about the heavy list pruning - the original set
> blows thunderbird up.
>
> >
> > The BPF LSM programs are implemented as fexit trampolines to avoid the
> > overhead of retpolines. These programs cannot be attached to security_*
> > wrappers as there are quite a few security_* functions that do more than
> > just calling the LSM callbacks.
> >
> > This was discussed on the lists in:
> >
> > https://lore.kernel.org/bpf/20200123152440.28956-1-kpsingh@chromium.org/T/#m068becce588a0cdf01913f368a97aea4c62d8266
> >
> > Adding a NOP callback after all the static LSM callbacks are called has
> > the following benefits:
> >
> > - The BPF programs run at the right stage of the security_* wrappers.
> > - They run after all the static LSM hooks allowed the operation,
> > therefore cannot allow an action that was already denied.
>
> I still say that the special call-out to BPF is unnecessary.
> I remain unconvinced by the arguments. You aren't doing anything
> so special that the general mechanism won't work.
The existing mechanism would work functionally, but the cost of an
indirect call for all the hooks, even those that are completely unused
is not really acceptable for KRSI’s use cases. It’s easy to avoid and
I do think that what we’re doing here (with hooks being defined at
runtime) has significant functional differences from existing LSMs.
- KP
>
> >
> > There are some hooks which do not call call_int_hooks or
> > call_void_hooks. It's not possible to call the bpf_lsm_* functions
> > without checking if there is BPF LSM program attached to these hooks.
> > This is added further in a subsequent patch. For now, these hooks are
> > marked as NO_BPF (i.e. attachment of BPF programs is not possible).
> >
[...]
next prev parent reply other threads:[~2020-02-21 11:45 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-20 17:52 [PATCH bpf-next v4 0/8] MAC and Audit policy using eBPF (KRSI) KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 1/8] bpf: Introduce BPF_PROG_TYPE_LSM KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 2/8] security: Refactor declaration of LSM hooks KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 3/8] bpf: lsm: provide attachment points for BPF LSM programs KP Singh
2020-02-20 23:49 ` Casey Schaufler
2020-02-21 11:44 ` KP Singh [this message]
2020-02-21 18:23 ` Casey Schaufler
2020-02-22 4:22 ` Kees Cook
2020-02-23 22:08 ` Alexei Starovoitov
2020-02-24 16:32 ` Casey Schaufler
2020-02-24 17:13 ` KP Singh
2020-02-24 18:45 ` Casey Schaufler
2020-02-24 21:41 ` Kees Cook
2020-02-24 22:29 ` Casey Schaufler
2020-02-25 5:41 ` Alexei Starovoitov
2020-02-25 15:31 ` Kees Cook
2020-02-25 19:31 ` KP Singh
2020-02-26 0:30 ` Casey Schaufler
2020-02-26 5:15 ` KP Singh
2020-02-26 15:35 ` Casey Schaufler
2020-02-25 19:29 ` KP Singh
2020-02-24 16:09 ` Casey Schaufler
2020-02-24 17:23 ` KP Singh
2020-02-21 2:25 ` Alexei Starovoitov
2020-02-21 11:47 ` KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 4/8] bpf: lsm: Add support for enabling/disabling BPF hooks KP Singh
2020-02-21 18:57 ` Casey Schaufler
2020-02-21 19:11 ` James Morris
2020-02-22 4:26 ` Kees Cook
2020-02-20 17:52 ` [PATCH bpf-next v4 5/8] bpf: lsm: Implement attach, detach and execution KP Singh
2020-02-21 2:17 ` Alexei Starovoitov
2020-02-21 12:02 ` KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 6/8] tools/libbpf: Add support for BPF_PROG_TYPE_LSM KP Singh
2020-02-25 6:45 ` Andrii Nakryiko
2020-02-20 17:52 ` [PATCH bpf-next v4 7/8] bpf: lsm: Add selftests " KP Singh
2020-02-20 17:52 ` [PATCH bpf-next v4 8/8] bpf: lsm: Add Documentation KP Singh
2020-02-21 19:19 ` [PATCH bpf-next v4 0/8] MAC and Audit policy using eBPF (KRSI) Casey Schaufler
2020-02-21 19:41 ` KP Singh
2020-02-21 22:31 ` Casey Schaufler
2020-02-21 23:09 ` KP Singh
2020-02-21 23:49 ` Casey Schaufler
2020-02-22 0:22 ` Kees Cook
2020-02-22 1:04 ` Casey Schaufler
2020-02-22 3:36 ` Kees Cook
2020-02-27 18:40 ` Dr. Greg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200221114458.GA56944@google.com \
--to=kpsingh@chromium.org \
--cc=bpf@vger.kernel.org \
--cc=casey@schaufler-ca.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).