Re: [kernel-hardening] Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-27 Thread James Morris
On Wed, 23 Aug 2017, Mickaël Salaün wrote: > >> + struct { > >> + __u32 abi; /* minimal ABI version, cf. user doc */ > > > > the concept of abi (version) sounds a bit weird to me. > > Why bother with it at all? > > Once the first set of patches lands the kernel as whole will

Re: [kernel-hardening] Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-27 Thread James Morris
On Wed, 23 Aug 2017, Mickaël Salaün wrote: > >> + struct { > >> + __u32 abi; /* minimal ABI version, cf. user doc */ > > > > the concept of abi (version) sounds a bit weird to me. > > Why bother with it at all? > > Once the first set of patches lands the kernel as whole will

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-27 Thread James Morris
On Tue, 22 Aug 2017, Alexei Starovoitov wrote: > more general question: what is the status of security/ bits? > I'm assuming they still need to be reviewed and explicitly acked by James, > right? Yep, along with other core security developers where possible. -- James Morris

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-27 Thread James Morris
On Tue, 22 Aug 2017, Alexei Starovoitov wrote: > more general question: what is the status of security/ bits? > I'm assuming they still need to be reviewed and explicitly acked by James, > right? Yep, along with other core security developers where possible. -- James Morris

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-23 Thread Alexei Starovoitov
On Wed, Aug 23, 2017 at 09:45:24AM +0200, Mickaël Salaün wrote: > >> > >> +union bpf_prog_subtype { > >> + struct { > >> + __u32 abi; /* minimal ABI version, cf. user doc */ > > > > the concept of abi (version) sounds a bit weird to me. > > Why bother with it at all? > >

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-23 Thread Alexei Starovoitov
On Wed, Aug 23, 2017 at 09:45:24AM +0200, Mickaël Salaün wrote: > >> > >> +union bpf_prog_subtype { > >> + struct { > >> + __u32 abi; /* minimal ABI version, cf. user doc */ > > > > the concept of abi (version) sounds a bit weird to me. > > Why bother with it at all? > >

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-23 Thread Mickaël Salaün
On 23/08/2017 04:44, Alexei Starovoitov wrote: > On Mon, Aug 21, 2017 at 02:09:25AM +0200, Mickaël Salaün wrote: >> The goal of the program subtype is to be able to have different static >> fine-grained verifications for a unique program type. >> >> The struct bpf_verifier_ops gets a new optional

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-23 Thread Mickaël Salaün
On 23/08/2017 04:44, Alexei Starovoitov wrote: > On Mon, Aug 21, 2017 at 02:09:25AM +0200, Mickaël Salaün wrote: >> The goal of the program subtype is to be able to have different static >> fine-grained verifications for a unique program type. >> >> The struct bpf_verifier_ops gets a new optional

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-22 Thread Alexei Starovoitov
On Mon, Aug 21, 2017 at 02:09:25AM +0200, Mickaël Salaün wrote: > The goal of the program subtype is to be able to have different static > fine-grained verifications for a unique program type. > > The struct bpf_verifier_ops gets a new optional function: > is_valid_subtype(). This new verifier is

Re: [PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-22 Thread Alexei Starovoitov
On Mon, Aug 21, 2017 at 02:09:25AM +0200, Mickaël Salaün wrote: > The goal of the program subtype is to be able to have different static > fine-grained verifications for a unique program type. > > The struct bpf_verifier_ops gets a new optional function: > is_valid_subtype(). This new verifier is

[PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-20 Thread Mickaël Salaün
The goal of the program subtype is to be able to have different static fine-grained verifications for a unique program type. The struct bpf_verifier_ops gets a new optional function: is_valid_subtype(). This new verifier is called at the beginning of the eBPF program verification to check if the

[PATCH net-next v7 02/10] bpf: Add eBPF program subtype and is_valid_subtype() verifier

2017-08-20 Thread Mickaël Salaün
The goal of the program subtype is to be able to have different static fine-grained verifications for a unique program type. The struct bpf_verifier_ops gets a new optional function: is_valid_subtype(). This new verifier is called at the beginning of the eBPF program verification to check if the