Re: [PATCH bpf-next 2/8] tools: bpftool: add probes for /proc/ eBPF parameters
From: Quentin Monnet <hidden>
Date: 2018-12-15 03:31:58
2018-12-15 00:40 UTC+0100 ~ Daniel Borkmann [off-list ref]
On 12/13/2018 01:19 PM, Quentin Monnet wrote:quoted
Add a set of probes to dump the eBPF-related parameters available from /proc/: availability of bpf() syscall for unprivileged users, JIT compiler status and hardening status, kallsyms exports status. Sample output: # bpftool feature probe kernel Scanning system configuration... bpf() syscall for unprivileged users is enabled JIT compiler is disabled JIT compiler hardening is disabled JIT compiler kallsyms exports are disabled ... # bpftool --json --pretty feature probe kernel { "system_config": { "unprivileged_bpf_disabled": 0, "bpf_jit_enable": 0, "bpf_jit_harden": 0, "bpf_jit_kallsyms": 0 }, ... } # bpftool feature probe kernel macros prefix BPFTOOL_ #define UNPRIVILEGED_BPF_DISABLED UNPRIVILEGED_BPF_DISABLED_OFF #define UNPRIVILEGED_BPF_DISABLED_OFF 0 #define UNPRIVILEGED_BPF_DISABLED_ON 1 #define UNPRIVILEGED_BPF_DISABLED_UNKNOWN -1 #define JIT_COMPILER_ENABLE JIT_COMPILER_ENABLE_OFF #define JIT_COMPILER_ENABLE_OFF 0 #define JIT_COMPILER_ENABLE_ON 1 #define JIT_COMPILER_ENABLE_ON_WITH_DEBUG 2 #define JIT_COMPILER_ENABLE_UNKNOWN -1 #define JIT_COMPILER_HARDEN JIT_COMPILER_HARDEN_OFF #define JIT_COMPILER_HARDEN_OFF 0 #define JIT_COMPILER_HARDEN_FOR_UNPRIVILEGED 1 #define JIT_COMPILER_HARDEN_FOR_ALL_USERS 2 #define JIT_COMPILER_HARDEN_UNKNOWN -1 #define JIT_COMPILER_KALLSYMS JIT_COMPILER_KALLSYMS_OFF #define JIT_COMPILER_KALLSYMS_OFF 0 #define JIT_COMPILER_KALLSYMS_FOR_ROOT 1 #define JIT_COMPILER_KALLSYMS_UNKNOWN -1 ...Hm, given these knobs may change at any point in time, what would be a use case in an application for these if they cannot be relied upon? (At least the jit_enable and jit_harden are transparent to the user.)
Granted, for those parameters it's a snapshot of the system at the time the probes are run. It can be useful, I suppose, if a server is not expected to change them often... And the plain output might be useful to a sysadmin who wants to have a quick look at BPF-related parameters, maybe?