Re: [PATCH v2 net-next 0/3] bpf: share helpers between tracing and networking

[Daniel Borkmann]

On 06/16/2015 05:28 AM, Alexei Starovoitov wrote:
> On 6/15/15 4:01 PM, David Miller wrote:
> > Although I agree with the sentiment that this thing can cause
> > surprising results and can be asking for trouble.
> >
> > If someone wants to filter traffic "by UID" they might make
> > a simple ingress TC ebpf program using these new interfaces
> > and expect it to work.
> >
> > But the UID their program will see will be the UID of whatever
> > randomly happened to be executing when the packet was received
> > and processed.
>
> yes, you're right. Such tc filters will be incorrect.
> Will send a partial revert disallowing them in tc.

Sorry for late reply [on vacation]; if you really want to, you
could go via skb->sk->sk_socket->file and then retrieve credentials
from there for egress side (you can have a look at xt_owner). You'd
need a different *_proto helper for tc in that case, which would
then map to BPF_FUNC_get_current_uid_gid, etc. But that doesn't work
for ingress however, even if you would have early demux, so you
would need to let the eBPF helper function return an error code in
that case.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/