Messages in this thread | | | Date | Fri, 11 Sep 2015 15:39:14 +0200 | From | Daniel Borkmann <> | Subject | Re: [PATCH v2 3/5] ebpf: add a way to dump an eBPF program |
| |
On 09/11/2015 02:21 AM, Tycho Andersen wrote: > This commit adds a way to dump eBPF programs. The initial implementation > doesn't support maps, and therefore only allows dumping seccomp ebpf > programs which themselves don't currently support maps. > > v2: don't export a prog_id for the filter > > Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com> > CC: Kees Cook <keescook@chromium.org> > CC: Will Drewry <wad@chromium.org> > CC: Oleg Nesterov <oleg@redhat.com> > CC: Andy Lutomirski <luto@amacapital.net> > CC: Pavel Emelyanov <xemul@parallels.com> > CC: Serge E. Hallyn <serge.hallyn@ubuntu.com> > CC: Alexei Starovoitov <ast@kernel.org> > CC: Daniel Borkmann <daniel@iogearbox.net> [...] > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index dc9b464..58ae9f4 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -586,6 +586,44 @@ free_prog: > return err; > } > > +static int bpf_prog_dump(union bpf_attr *attr, union bpf_attr __user *uattr) > +{ > + int ufd = attr->prog_fd; > + struct fd f = fdget(ufd); > + struct bpf_prog *prog; > + int ret = -EINVAL; > + > + prog = get_prog(f); > + if (IS_ERR(prog)) > + return PTR_ERR(prog); > + > + /* For now, let's refuse to dump anything that isn't a seccomp program. > + * Other program types have support for maps, which our current dump > + * code doesn't support. > + */ > + if (prog->type != BPF_PROG_TYPE_SECCOMP) > + goto out;
Yep, also when you start adding helper calls (next to map objects) you'd need to undo kernel pointers that the verifier sets here.
| |