From: Andrii Nakryiko [mailto:andrii.nakryiko@gmail.com] Sent: Wednesday, March 30, 2022 1:51 AM On Mon, Mar 28, 2022 at 10:51 AM Roberto Sassu roberto.sassu@huawei.com wrote:
[...]
Patches 1-2 export some definitions, to build out-of-tree kernel modules with eBPF programs to preload. Patches 3-4 allow eBPF programs to pin objects by themselves. Patches 5-10 automatically generate the methods
for
preloading in the light skeleton. Patches 11-14 make it possible to preload multiple eBPF programs. Patch 15 automatically generates the kernel
module
for preloading an eBPF program, patch 16 does a kernel mount of the bpf filesystem, and finally patches 17-18 test the functionality introduced.
This approach of moving tons of pretty generic code into codegen of lskel seems suboptimal. Why so much code has to be codegenerated? Especially that tiny module code?
Hi Andrii
the main goal of this patch set is to use the preloading mechanism to plug in securely LSMs implemented as eBPF programs.
I have a use case, I want to plug in my eBPF program, DIGLIM eBPF.
I started to modify the preloading code manually, and I realized how complicated the process is if you want to add something more than the existing iterators_bpf program.
First, you have to look at which objects you want to preload, then write code for each of them. This process is repetitive and deterministic, this is why I immediately thought that it is a good case for automatic code generation.
My idea is that, if this mechanism is accepted, an implementer of an LSM wishing to be preloaded at the very beginning, only has to write his eBPF code, the kernel and bpftool take care of the rest. Generation of the preloading code is optional, and need to be enabled with the -P option, in addition to -L.
The light skeleton of DIGLIM eBPF looks like:
https://github.com/robertosassu/linux/blob/bpf-preload-v1/kernel/bpf/preload...
The preloading interface is very similar to the one used by the security subsystem: an ordered list of eBPF programs to preload set in the kernel configuration, that can be overwritten with the kernel option bpf_preload_list=.
The changes that would be required to preload DIGLIM eBPF look like:
https://github.com/robertosassu/linux/commit/c07e1a78584ee688aeb812f07dc7ab3...
Thanks
Roberto
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 Managing Director: Li Peng, Zhong Ronghua
Can you please elaborate on why it can't be done in a way that doesn't require such extensive light skeleton codegen changes?
Roberto Sassu (18): bpf: Export bpf_link_inc() bpf-preload: Move bpf_preload.h to include/linux bpf-preload: Generalize object pinning from the kernel bpf-preload: Export and call bpf_obj_do_pin_kernel() bpf-preload: Generate static variables bpf-preload: Generate free_objs_and_skel() bpf-preload: Generate preload() bpf-preload: Generate load_skel() bpf-preload: Generate code to pin non-internal maps bpf-preload: Generate bpf_preload_ops bpf-preload: Store multiple bpf_preload_ops structures in a linked list bpf-preload: Implement new registration method for preloading eBPF programs bpf-preload: Move pinned links and maps to a dedicated directory in bpffs bpf-preload: Switch to new preload registration method bpf-preload: Generate code of kernel module to preload bpf-preload: Do kernel mount to ensure that pinned objects don't disappear bpf-preload/selftests: Add test for automatic generation of preload methods bpf-preload/selftests: Preload a test eBPF program and check pinned objects
please use proper prefixes: bpf (for kernel-side changes), libbpf, bpftool, selftests/bpf, etc
.../admin-guide/kernel-parameters.txt | 8 + fs/namespace.c | 1 + include/linux/bpf.h | 5 + include/linux/bpf_preload.h | 37 ++ init/main.c | 2 + kernel/bpf/inode.c | 295 +++++++++-- kernel/bpf/preload/Kconfig | 25 +- kernel/bpf/preload/bpf_preload.h | 16 - kernel/bpf/preload/bpf_preload_kern.c | 85 +--- kernel/bpf/preload/iterators/Makefile | 9 +- .../bpf/preload/iterators/iterators.lskel.h | 466 +++++++++++------- kernel/bpf/syscall.c | 1 + .../bpf/bpftool/Documentation/bpftool-gen.rst | 13 + tools/bpf/bpftool/bash-completion/bpftool | 6 +- tools/bpf/bpftool/gen.c | 331 +++++++++++++ tools/bpf/bpftool/main.c | 7 +- tools/bpf/bpftool/main.h | 1 + tools/testing/selftests/bpf/Makefile | 32 +- .../bpf/bpf_testmod_preload/.gitignore | 7 + .../bpf/bpf_testmod_preload/Makefile | 20 + .../gen_preload_methods.expected.diff | 97 ++++ .../bpf/prog_tests/test_gen_preload_methods.c | 27 + .../bpf/prog_tests/test_preload_methods.c | 69 +++ .../selftests/bpf/progs/gen_preload_methods.c | 23 + 24 files changed, 1246 insertions(+), 337 deletions(-) create mode 100644 include/linux/bpf_preload.h delete mode 100644 kernel/bpf/preload/bpf_preload.h create mode 100644
tools/testing/selftests/bpf/bpf_testmod_preload/.gitignore
create mode 100644
tools/testing/selftests/bpf/bpf_testmod_preload/Makefile
create mode 100644
tools/testing/selftests/bpf/prog_tests/gen_preload_methods.expected.diff
create mode 100644
tools/testing/selftests/bpf/prog_tests/test_gen_preload_methods.c
create mode 100644
tools/testing/selftests/bpf/prog_tests/test_preload_methods.c
create mode 100644
tools/testing/selftests/bpf/progs/gen_preload_methods.c
-- 2.32.0