From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751039AbcGXEBo (ORCPT ); Sun, 24 Jul 2016 00:01:44 -0400 Received: from mail-it0-f46.google.com ([209.85.214.46]:36692 "EHLO mail-it0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750738AbcGXEBm (ORCPT ); Sun, 24 Jul 2016 00:01:42 -0400 Date: Sat, 23 Jul 2016 21:01:39 -0700 From: Sargun Dhillon To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Cc: alexei.starovoitov@gmail.com Subject: Relax kern_version constraints on bpf kprobes? Message-ID: <20160724040139.GA2025@ircssh.c.rugged-nimbus-611.internal> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In kernel/bpf/syscall.c we restrict programs loading bpf kprobe programs so attr.kern_version must be exactly equal to what the user is running at the moment. This makes a lot of sense because kprobes can touch lots of unstable bits of the kernel ABI. Unfortunately, this makes it really difficult to ship binary bpf programs for debugging, and most customers don't want to go through all the steps of preparing for compilation and installation of bpf programs for their specific kernel that was shipped by their vendor. This is especially problematic when the probe is touching only stable ABIs (syscalls), or alternatively is just logging performance events. I realize that we can change this section pretty easily by reading the version at load time and modifying it, but it's kind of a pain. For programs that we know are safe, is there a mechanism by which we can bypass this check, and tell the loader that we know what we're doing since these programs are only accessible to CAP_SYS_ADMIN?