From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751773AbcGXEgl (ORCPT ); Sun, 24 Jul 2016 00:36:41 -0400 Received: from mail-pf0-f176.google.com ([209.85.192.176]:35450 "EHLO mail-pf0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750741AbcGXEgi (ORCPT ); Sun, 24 Jul 2016 00:36:38 -0400 Date: Sat, 23 Jul 2016 21:36:33 -0700 From: Alexei Starovoitov To: Sargun Dhillon Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: Re: Relax kern_version constraints on bpf kprobes? Message-ID: <20160724043630.GA36109@ast-mbp.thefacebook.com> References: <20160724040139.GA2025@ircssh.c.rugged-nimbus-611.internal> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160724040139.GA2025@ircssh.c.rugged-nimbus-611.internal> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, Jul 23, 2016 at 09:01:39PM -0700, Sargun Dhillon wrote: > In kernel/bpf/syscall.c we restrict programs loading bpf kprobe programs so > attr.kern_version must be exactly equal to what the user is running at the > moment. This makes a lot of sense because kprobes can touch lots of > unstable bits of the kernel ABI. > > Unfortunately, this makes it really difficult to ship binary bpf programs > for debugging, and most customers don't want to go through all the steps > of preparing for compilation and installation of bpf programs for their > specific kernel that was shipped by their vendor. > > This is especially problematic when the probe is touching only stable ABIs > (syscalls), or alternatively is just logging performance events. I realize > that we can change this section pretty easily by reading the version at > load time and modifying it, but it's kind of a pain. > > For programs that we know are safe, is there a mechanism by which we can > bypass this check, and tell the loader that we know what we're doing > since these programs are only accessible to CAP_SYS_ADMIN? The proper alternative is to always compile programs on the fly for the given kernel like iovisor/bcc does. Integrated clang/llvm has other advantages, like being able to search/replace in bpf C program before installing it in the kernel. So different command line flags come with zero overhead when not in use.