Re: [PATCH v2 bpf-next 1/4] bpf: unprivileged BPF access via /dev/bpf

[Song Liu <songliubraving@fb.com>]

> On Jun 28, 2019, at 2:01 AM, Lorenz Bauer <lmb@cloudflare.com> wrote:
> 
> On Thu, 27 Jun 2019 at 21:19, Song Liu <songliubraving@fb.com> wrote:
>> 
>> This patch introduce unprivileged BPF access. The access control is
>> achieved via device /dev/bpf. Users with write access to /dev/bpf are able
>> to call sys_bpf().
>> 
>> Two ioctl command are added to /dev/bpf:
>> 
>> The two commands enable/disable permission to call sys_bpf() for current
>> task. This permission is noted by bpf_permitted in task_struct. This
>> permission is inherited during clone(CLONE_THREAD).
> 
> If I understand it correctly, a process would have to open /dev/bpf before
> spawning other threads for this to work?
> 
> That still wouldn't work for Go I'm afraid. The runtime creates and destroys
> threads on an ad-hoc basis, and there is no way to "initialize" in the
> first thread.

There should be a master thread, no? Can we do that from the master thread at
the beginning of the execution?

> With the API as is, any Go wrapper wishing to use this would have to do the
> following _for every BPF syscall_:
> 
> 1. Use runtime.LockOSThread() to prevent the scheduler from moving the
>    goroutine.
> 2. Open /dev/bpf to set the bit in current_task
> 3. Execute the syscall
> 4. Call runtime.UnlockOSThread()
> 
> Note that calling into C code via CGo doesn't change this. Is it not possible to
> set the bit on all processes in the current thread group?

I think that's possible, with some extra work. And there will be overhead, as 
we need to atomic operation for all these processes. I would rather not to this
path unless it is really necessary. 

Thanks,
Song