kernel_optimize_test/kernel/bpf
Daniel Borkmann f1f7714ea5 bpf: rework prog_digest into prog_tag
Commit 7bd509e311 ("bpf: add prog_digest and expose it via
fdinfo/netlink") was recently discussed, partially due to
admittedly suboptimal name of "prog_digest" in combination
with sha1 hash usage, thus inevitably and rightfully concerns
about its security in terms of collision resistance were
raised with regards to use-cases.

The intended use cases are for debugging resp. introspection
only for providing a stable "tag" over the instruction sequence
that both kernel and user space can calculate independently.
It's not usable at all for making a security relevant decision.
So collisions where two different instruction sequences generate
the same tag can happen, but ideally at a rather low rate. The
"tag" will be dumped in hex and is short enough to introspect
in tracepoints or kallsyms output along with other data such
as stack trace, etc. Thus, this patch performs a rename into
prog_tag and truncates the tag to a short output (64 bits) to
make it obvious it's not collision-free.

Should in future a hash or facility be needed with a security
relevant focus, then we can think about requirements, constraints,
etc that would fit to that situation. For now, rework the exposed
parts for the current use cases as long as nothing has been
released yet. Tested on x86_64 and s390x.

Fixes: 7bd509e311 ("bpf: add prog_digest and expose it via fdinfo/netlink")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-16 14:03:31 -05:00
..
arraymap.c bpf: do not use KMALLOC_SHIFT_MAX 2017-01-10 18:31:54 -08:00
bpf_lru_list.c bpf: Fix compilation warning in __bpf_lru_list_rotate_inactive 2016-11-16 11:30:56 -05:00
bpf_lru_list.h bpf: Add percpu LRU list 2016-11-15 11:50:20 -05:00
cgroup.c bpf: Add new cgroup attach type to enable sock modifications 2016-12-02 13:46:08 -05:00
core.c bpf: rework prog_digest into prog_tag 2017-01-16 14:03:31 -05:00
hashtab.c bpf: do not use KMALLOC_SHIFT_MAX 2017-01-10 18:31:54 -08:00
helpers.c bpf: add helper for retrieving current numa node id 2016-10-22 17:05:52 -04:00
inode.c bpf: allow for mount options to specify permissions 2016-11-27 20:38:47 -05:00
Makefile cgroup: add support for eBPF programs 2016-11-25 16:25:52 -05:00
percpu_freelist.c bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
percpu_freelist.h bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
stackmap.c bpf: add BPF_CALL_x macros for declaring helpers 2016-09-09 19:36:04 -07:00
syscall.c bpf: rework prog_digest into prog_tag 2017-01-16 14:03:31 -05:00
verifier.c bpf: rework prog_digest into prog_tag 2017-01-16 14:03:31 -05:00