bpf: add boot parameters for sysctl knobs
Subsystems (3)
v2 cover bpf: add boot parameters for sysctl knobs
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
Eugene Syromiatnikov (3):
bpf: add ability to configure unprivileged BPF via boot-time parameter
bpf: add ability to configure BPF JIT hardening via boot-time
parameter
bpf: add ability to configure BPF JIT kallsyms export at the boot time
Documentation/admin-guide/kernel-parameters.txt | 28 ++++++++ init/Kconfig | 90 +++++++++++++++++++++++++ kernel/bpf/core.c | 31 +++++++++ kernel/bpf/syscall.c | 16 +++++ 4 files changed, 165 insertions(+)
Signature · 1 line
2.1.4
Quoted 5 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Quoted 8 lines
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier. How that make sense?
- bpf_jit_kallsyms sysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?
- jit_harden can be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?
Quoted 24 lines · On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov…
Quoted 5 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Quoted 8 lines
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier. How that make sense?
Quoted 8 lines
-
bpf_jit_kallsymssysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?-
jit_hardencan be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?
I think you are missing that, we want the ability to change these defaults in-order to avoid depending on /etc/sysctl.conf settings, and that the these sysctl.conf setting happen too late.
For example with jit_harden, there will be a difference between the loaded BPF program that got loaded at boot-time with systemd (no constant blinding) and when someone reloads that systemd service after /etc/sysctl.conf have been evaluated and setting bpf_jit_harden (now
slower due to constant blinding). This is inconsistent behavior.
Signature · 4 lines
Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer
Quoted 37 lines · Jesper Dangaard Brouer
Quoted 24 lines · On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov…
Quoted 5 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Quoted 8 lines
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier. How that make sense?
Quoted 8 lines
-
bpf_jit_kallsymssysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?-
jit_hardencan be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?
Quoted 3 lines
I think you are missing that, we want the ability to change these defaults in-order to avoid depending on
/etc/sysctl.confsettings, and that the these sysctl.conf setting happen too late.
What does it mean 'happens too late' ?
Too late for what?
sysctl.conf has plenty of system critical knobs like kernel.perf_event_paranoid, kernel.core_pattern, etc
The behavior of the host is drastically different after sysctl config is applied.
Quoted 5 lines
For example with
jit_harden, there will be a difference between the loaded BPF program that got loaded at boot-time with systemd (no constant blinding) and when someone reloads that systemd service after/etc/sysctl.confhave been evaluated and settingbpf_jit_harden(now
slower due to constant blinding). This is inconsistent behavior.
net.core.bpf_jit_harden can be flipped back and forth at run-time, so bpf progs before and after will be either blinded or not. I don't see any inconsistency.
In general I think bootparams should be used only for things like kpti=on/off that cannot be set by sysctl.
Quoted 16 lines · Alexei Starovoitov
Quoted 15 lines · Jesper Dangaard Brouer
Quoted 12 lines · On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov…
Quoted 11 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 2 lines
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
systemd also runs a lot of code, some of which is unprivileged.
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier.
No, it will force systemd not to use SO_REUSEPORT BPF.
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
-
bpf_jit_kallsymssysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?
Well, that one was for completeness.
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
-
jit_hardencan be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?
I'm worried that systemd can be exploited for a JIT spraying attack.
Another thing I'm concerned with is that the generated code is different, which introduces additional complication during debugging.
Quoted 17 lines
Quoted 3 lines
I think you are missing that, we want the ability to change these defaults in-order to avoid depending on
/etc/sysctl.confsettings, and that the these sysctl.conf setting happen too late.What does it mean 'happens too late' ?
Too late for what?
sysctl.conf has plenty of system critical knobs like kernel.perf_event_paranoid, kernel.core_pattern, etc
The behavior of the host is drastically different after sysctl config is applied.Quoted 5 lines
For example with
jit_harden, there will be a difference between the loaded BPF program that got loaded at boot-time with systemd (no constant blinding) and when someone reloads that systemd service after/etc/sysctl.confhave been evaluated and settingbpf_jit_harden(now
slower due to constant blinding). This is inconsistent behavior.
Quoted 3 lines
net.core.bpf_jit_harden can be flipped back and forth at run-time, so bpf progs before and after will be either blinded or not. I don't see any inconsistency.
That can't be the reason to maintain that inconsistency.
Quoted 17 lines · Eugene Syromiatnikov
Quoted 16 lines · Alexei Starovoitov
Quoted 15 lines · Jesper Dangaard Brouer
Quoted 12 lines · On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov…
Quoted 11 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
Quoted 7 lines
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 2 lines
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
systemd also runs a lot of code, some of which is unprivileged.
systemd processes sysctl configs first. It's essential for system security to do so. If you have concerns in how systemd does that please bring it up with systemd folks.
Quoted 4 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier.
No, it will force systemd not to use
SO_REUSEPORTBPF.
sorry this argument makes no sense to me.
Quoted 4 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
-
bpf_jit_kallsymssysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?Well, that one was for completeness.
Should we convert all sysctls to bootparams for 'completeness' ?
Quoted 5 lines
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
-
jit_hardencan be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?I'm worried that systemd can be exploited for a JIT spraying attack.
I'm afraid we're not on the same page with definition of 'JIT spraying attack'.
Quoted 2 lines
Another thing I'm concerned with is that the generated code is different, which introduces additional complication during debugging.
specifically what kind of complication?
Quoted 35 lines · On Fri, 25 May 2018 12:44:01 -0700 Alexei Starovoitov…
Quoted 17 lines · Eugene Syromiatnikov
Quoted 16 lines · Alexei Starovoitov
Quoted 15 lines · Jesper Dangaard Brouer
Quoted 12 lines · On Wed, 23 May 2018 15:02:45 -0700 Alexei Starovoitov…
Quoted 11 lines · Eugene Syromiatnikov
Some BPF sysctl knobs affect the loading of BPF programs, and during system boot/init stages these sysctls are not yet configured. A concrete example is systemd, that has implemented loading of BPF programs.
Thus, to allow controlling these setting at early boot, this patch set adds the ability to change the default setting of these sysctl knobs as well as option to override them via a boot-time kernel parameter (in order to avoid rebuilding kernel each time a need of changing these defaults arises).
Quoted 7 lines
Quoted 6 lines
Quoted 6 lines
Quoted 6 lines
Quoted 2 lines
The sysctl knobs in question are kernel.unprivileged_bpf_disable, net.core.bpf_jit_harden, and net.core.bpf_jit_kallsyms.
- systemd is root. today it only uses cgroup-bpf progs which require root, so disabling unpriv during boot time makes no difference to systemd. what is the actual reason to present time?
systemd also runs a lot of code, some of which is unprivileged.
systemd processes sysctl configs first. It's essential for system security to do so. If you have concerns in how systemd does that please bring it up with systemd folks.
Quoted 4 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
- say in the future systemd wants to use so_reuseport+bpf for faster networking. With unpriv disable during boot, it will force systemd to do such networking from root, which will lower its security barrier.
No, it will force systemd not to use
SO_REUSEPORTBPF.
Quoted 8 lines
sorry this argument makes no sense to me.
Quoted 4 lines
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
-
bpf_jit_kallsymssysctl has immediate effect on loaded programs. Flipping it during the boot or right after or any time after is the same thing. Why add such boot flag then?Well, that one was for completeness.
Should we convert all sysctls to bootparams for 'completeness' ?
The bpf_jit_kallsyms option is not there for 'completeness', it is there because I know Daniel talked about changing the default, and this would provide an easy option for allowing changing this default (to on) in different distros before flipping it on in some kernel release.
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
-
jit_hardencan be turned on by systemd. so turning it during the boot will make systemd progs to be constant blinded.
Constant blinding protects kernel from unprivileged JIT spraying. Are you worried that systemd will attack the kernel with JIT spraying?
Quoted 9 lines
Quoted 1 line
I'm worried that systemd can be exploited for a JIT spraying attack.
I'm afraid we're not on the same page with definition of 'JIT spraying attack'.
Quoted 2 lines
Another thing I'm concerned with is that the generated code is different, which introduces additional complication during debugging.
specifically what kind of complication?
I think kernel.unprivileged_bpf_disable is the best example, why we need this facility. Once kernel.unprivileged_bpf_disable is set to 1, it cannot be turned back to 0.
It is a policy decision that I want unprivileged_bpf_disable=1. Setting this policy in the sysctl step is too late, because as you write above, you expect that e.g. systemd or other boot-scripts want/can load bpf-progs in unpriv mode. Thus, they can violate my policy choice.
This also leads to the before mentioned inconsistency issue. The init-script/systemd-service will during boot successfully load unpriv bpf-prog, but when I afterwards when I reload (or stop/start) the service, it will fail as it no longer can load the unpriv bpf program.
If a distribution makes this policy choice, then users cannot change it back to unprivileged_bpf_disable=0 via sysctl. Thus, we need a boot param to allow users to change this policy. If the disto didn't change this default, then we still need the boot-param, to allow users to enforce this policy choice towards init-scripts (as explained above).
Signature · 4 lines
Best regards, Jesper Dangaard Brouer MSc.CS, Principal Kernel Engineer at Red Hat LinkedIn: http://www.linkedin.com/in/brouer