Messages in this thread | | | Date | Tue, 16 Jun 2015 11:19:40 +0200 | From | Daniel Borkmann <> | Subject | Re: [PATCH v2 net-next 0/3] bpf: share helpers between tracing and networking |
| |
On 06/16/2015 05:28 AM, Alexei Starovoitov wrote: > On 6/15/15 4:01 PM, David Miller wrote: >> >> Although I agree with the sentiment that this thing can cause >> surprising results and can be asking for trouble. >> >> If someone wants to filter traffic "by UID" they might make >> a simple ingress TC ebpf program using these new interfaces >> and expect it to work. >> >> But the UID their program will see will be the UID of whatever >> randomly happened to be executing when the packet was received >> and processed. > > yes, you're right. Such tc filters will be incorrect. > Will send a partial revert disallowing them in tc.
Sorry for late reply [on vacation]; if you really want to, you could go via skb->sk->sk_socket->file and then retrieve credentials from there for egress side (you can have a look at xt_owner). You'd need a different *_proto helper for tc in that case, which would then map to BPF_FUNC_get_current_uid_gid, etc. But that doesn't work for ingress however, even if you would have early demux, so you would need to let the eBPF helper function return an error code in that case.
| |