lkml.org 
[lkml]   [2019]   [Dec]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH bpf-next v1 10/13] bpf: lsm: Handle attachment of the same program
    On Fri, Dec 20, 2019 at 7:42 AM KP Singh <kpsingh@chromium.org> wrote:
    >
    > From: KP Singh <kpsingh@google.com>
    >
    > Allow userspace to attach a newer version of a program without having
    > duplicates of the same program.
    >
    > If BPF_F_ALLOW_OVERRIDE is passed, the attachment logic compares the
    > name of the new program to the names of existing attached programs. The
    > names are only compared till a "__" (or '\0', if there is no "__"). If
    > a successful match is found, the existing program is replaced with the
    > newer attachment.
    >
    > ./loader Attaches "env_dumper__v1" followed by "env_dumper__v2"
    > to the bprm_check_security hook..
    >
    > ./loader
    > ./loader
    >
    > Before:
    >
    > cat /sys/kernel/security/bpf/process_execution
    > env_dumper__v1
    > env_dumper__v2
    >
    > After:
    >
    > cat /sys/kernel/security/bpf/process_execution
    > env_dumper__v2
    >
    > Signed-off-by: KP Singh <kpsingh@google.com>
    > ---


    Andrey Ignatov just posted patch set few days ago solving similar
    problem for cgroup BPF programs. His approach was to actually also
    specify FD of BPF program to be replaced. This seems like a more
    reliable way than doing this based on name only. Please take a look at
    that patch and see if same approach can work for your use case.

    > security/bpf/ops.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
    > 1 file changed, 56 insertions(+), 1 deletion(-)
    >

    [...]

    \
     
     \ /
      Last update: 2019-12-24 07:39    [W:4.425 / U:0.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site