From patchwork Thu Dec 13 12:19:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Quentin Monnet X-Patchwork-Id: 1012825 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netronome.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="e80u1KOF"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43Ft6h3ySSz9s5c for ; Thu, 13 Dec 2018 23:20:12 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729119AbeLMMUL (ORCPT ); Thu, 13 Dec 2018 07:20:11 -0500 Received: from mail-wr1-f67.google.com ([209.85.221.67]:41637 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728926AbeLMMUK (ORCPT ); Thu, 13 Dec 2018 07:20:10 -0500 Received: by mail-wr1-f67.google.com with SMTP id x10so1777134wrs.8 for ; Thu, 13 Dec 2018 04:20:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=t6BDxjuIjQROBGslESHxxO+KOL1ASaWue84gmdrases=; b=e80u1KOFyesSijc7RUqeFNYPX3urLhyUkE6o9bHUNA9fEJNFBDMS+eGCkJrWKAIezU fIdi9vkM2vWb82N2OnzB91kKbA39Vranbr57fXZl6rw+bOYxwxuIMa1nVB15aUyOfAtJ Qvx0lmauP9xU4T90cvKL3fK+1RMQYR2JTxOJtdCg7u5bu1KeFjz98XvDgoGv9NBPWCdj WMAiHut6ZqpWcHEBYHw7DGjXl8SmooMZejT+ca/9sIfmp2iBW3NTPglSsHCd/jybd+EU nh64YlEVJWBjuFfyYEBUZIwtJdzM1pg0ea8VcnDpGSMTLjIZ3T2UyWBvTpKt1wOZLeXm yR7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=t6BDxjuIjQROBGslESHxxO+KOL1ASaWue84gmdrases=; b=AhXl3ez9zHOFq3g4WuqaonPi3gRDHK0l73kCvn7hxJjRNkjCMhvJSqtYeAq272rWa7 WMmH7Y3RikSRaOo0y5OTb1HuiSXYUAYVogj+tCmp3pL2R4DMam44CMcz53giHnO5A3rM qrRCCqT/B8meVqDRfl/+8VJNH7fl0P9aHa3j8O2YWzG9XzDAB7zWc9eTevShVPzmn5m0 4Ny/sXstbwbiD2NfLoo/Opap6lTKtAq8Ho6omjKXCB+RNpRa3SOov3Nr63LFkXpcFt/V ep2W6qMZVRXYQGk8dCFRBd3gJ+Vbhp7UK2hFzjJUG7OlkwU/5Np/b9Eqcema9laPCqJw HB5w== X-Gm-Message-State: AA+aEWbj3f1Rle79D2jfkZyVWoMOY9SMZGDa6A8t1en8bs2f8kdo7Bxx DFbN+dj6dw0vkQe6DoUSZ4i1hw== X-Google-Smtp-Source: AFSGD/Wqklpb/Qp+eS34L4qAhQ/I7lhqRMD5ErzLp/QVtDju2ytZsjmerYjXTF4VyKzmOaDr/a+4DQ== X-Received: by 2002:adf:c711:: with SMTP id k17mr19927763wrg.197.1544703607898; Thu, 13 Dec 2018 04:20:07 -0800 (PST) Received: from cbtest32.netronome.com ([217.38.71.146]) by smtp.gmail.com with ESMTPSA id t70sm2410070wmd.36.2018.12.13.04.20.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 13 Dec 2018 04:20:06 -0800 (PST) From: Quentin Monnet To: Alexei Starovoitov , Daniel Borkmann Cc: netdev@vger.kernel.org, oss-drivers@netronome.com, Quentin Monnet , Arnaldo Carvalho de Melo , Jesper Dangaard Brouer , Stanislav Fomichev Subject: [PATCH bpf-next 2/8] tools: bpftool: add probes for /proc/ eBPF parameters Date: Thu, 13 Dec 2018 12:19:16 +0000 Message-Id: <20181213121922.6652-3-quentin.monnet@netronome.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181213121922.6652-1-quentin.monnet@netronome.com> References: <20181213121922.6652-1-quentin.monnet@netronome.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Add a set of probes to dump the eBPF-related parameters available from /proc/: availability of bpf() syscall for unprivileged users, JIT compiler status and hardening status, kallsyms exports status. Sample output: # bpftool feature probe kernel Scanning system configuration... bpf() syscall for unprivileged users is enabled JIT compiler is disabled JIT compiler hardening is disabled JIT compiler kallsyms exports are disabled ... # bpftool --json --pretty feature probe kernel { "system_config": { "unprivileged_bpf_disabled": 0, "bpf_jit_enable": 0, "bpf_jit_harden": 0, "bpf_jit_kallsyms": 0 }, ... } # bpftool feature probe kernel macros prefix BPFTOOL_ #define UNPRIVILEGED_BPF_DISABLED UNPRIVILEGED_BPF_DISABLED_OFF #define UNPRIVILEGED_BPF_DISABLED_OFF 0 #define UNPRIVILEGED_BPF_DISABLED_ON 1 #define UNPRIVILEGED_BPF_DISABLED_UNKNOWN -1 #define JIT_COMPILER_ENABLE JIT_COMPILER_ENABLE_OFF #define JIT_COMPILER_ENABLE_OFF 0 #define JIT_COMPILER_ENABLE_ON 1 #define JIT_COMPILER_ENABLE_ON_WITH_DEBUG 2 #define JIT_COMPILER_ENABLE_UNKNOWN -1 #define JIT_COMPILER_HARDEN JIT_COMPILER_HARDEN_OFF #define JIT_COMPILER_HARDEN_OFF 0 #define JIT_COMPILER_HARDEN_FOR_UNPRIVILEGED 1 #define JIT_COMPILER_HARDEN_FOR_ALL_USERS 2 #define JIT_COMPILER_HARDEN_UNKNOWN -1 #define JIT_COMPILER_KALLSYMS JIT_COMPILER_KALLSYMS_OFF #define JIT_COMPILER_KALLSYMS_OFF 0 #define JIT_COMPILER_KALLSYMS_FOR_ROOT 1 #define JIT_COMPILER_KALLSYMS_UNKNOWN -1 ... These probes are skipped if procfs is not mounted. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski --- tools/bpf/bpftool/feature.c | 271 ++++++++++++++++++++++++++++++++++++ 1 file changed, 271 insertions(+) diff --git a/tools/bpf/bpftool/feature.c b/tools/bpf/bpftool/feature.c index e1784611575d..9fa7016c7d21 100644 --- a/tools/bpf/bpftool/feature.c +++ b/tools/bpf/bpftool/feature.c @@ -5,6 +5,7 @@ #include #include #include +#include #include #include @@ -13,11 +14,29 @@ #include "main.h" +#ifndef PROC_SUPER_MAGIC +# define PROC_SUPER_MAGIC 0x9fa0 +#endif + enum probe_component { COMPONENT_UNSPEC, COMPONENT_KERNEL, }; +/* Miscellaneous utility functions */ + +static bool check_procfs(void) +{ + struct statfs st_fs; + + if (statfs("/proc", &st_fs) < 0) + return false; + if ((unsigned long)st_fs.f_type != PROC_SUPER_MAGIC) + return false; + + return true; +} + /* Printing utility functions */ static void @@ -49,6 +68,236 @@ print_start_section(const char *json_title, const char *define_comment, /* Probing functions */ +static int read_procfs(const char *path) +{ + char *endptr, *line = NULL; + size_t len = 0; + FILE *fd; + int res; + + fd = fopen(path, "r"); + if (!fd) + return -1; + + res = getline(&line, &len, fd); + fclose(fd); + if (res < 0) + return -1; + + errno = 0; + res = strtol(line, &endptr, 10); + if (errno || *line == '\0' || *endptr != '\n') + res = -1; + free(line); + + return res; +} + +static void probe_unprivileged_disabled(const char *define_prefix) +{ + int res; + + res = read_procfs("/proc/sys/kernel/unprivileged_bpf_disabled"); + if (json_output) { + jsonw_int_field(json_wtr, "unprivileged_bpf_disabled", res); + } else if (define_prefix) { + printf("#define %sUNPRIVILEGED_BPF_DISABLED ", define_prefix); + switch (res) { + case 0: + printf("%sUNPRIVILEGED_BPF_DISABLED_OFF\n", + define_prefix); + break; + case 1: + printf("%sUNPRIVILEGED_BPF_DISABLED_ON\n", + define_prefix); + break; + case -1: + printf("%sUNPRIVILEGED_BPF_DISABLED_UNKNOWN\n", + define_prefix); + break; + default: + printf("%d\n", res); + } + printf("#define %sUNPRIVILEGED_BPF_DISABLED_OFF 0\n", + define_prefix); + printf("#define %sUNPRIVILEGED_BPF_DISABLED_ON 1\n", + define_prefix); + printf("#define %sUNPRIVILEGED_BPF_DISABLED_UNKNOWN -1\n", + define_prefix); + } else { + switch (res) { + case 0: + printf("bpf() syscall for unprivileged users is enabled\n"); + break; + case 1: + printf("bpf() syscall restricted to privileged users\n"); + break; + case -1: + printf("Unable to retrieve required privileges for bpf() syscall\n"); + break; + default: + printf("bpf() syscall restriction has unknown value %d\n", res); + } + } +} + +static void probe_jit_enable(const char *define_prefix) +{ + int res; + + res = read_procfs("/proc/sys/net/core/bpf_jit_enable"); + if (json_output) { + jsonw_int_field(json_wtr, "bpf_jit_enable", res); + } else if (define_prefix) { + printf("#define %sJIT_COMPILER_ENABLE ", define_prefix); + switch (res) { + case 0: + printf("%sJIT_COMPILER_ENABLE_OFF\n", define_prefix); + break; + case 1: + printf("%sJIT_COMPILER_ENABLE_ON\n", define_prefix); + break; + case 2: + printf("%sJIT_COMPILER_ENABLE_ON_WITH_DEBUG\n", + define_prefix); + break; + case -1: + printf("%sJIT_COMPILER_ENABLE_UNKNOWN\n", + define_prefix); + break; + default: + printf("%d\n", res); + } + printf("#define %sJIT_COMPILER_ENABLE_OFF 0\n", define_prefix); + printf("#define %sJIT_COMPILER_ENABLE_ON 1\n", define_prefix); + printf("#define %sJIT_COMPILER_ENABLE_ON_WITH_DEBUG 2\n", + define_prefix); + printf("#define %sJIT_COMPILER_ENABLE_UNKNOWN -1\n", + define_prefix); + } else { + switch (res) { + case 0: + printf("JIT compiler is disabled\n"); + break; + case 1: + printf("JIT compiler is enabled\n"); + break; + case 2: + printf("JIT compiler is enabled with debugging traces in kernel logs\n"); + break; + case -1: + printf("Unable to retrieve JIT-compiler status\n"); + break; + default: + printf("JIT-compiler status has unknown value %d\n", + res); + } + } +} + +static void probe_jit_harden(const char *define_prefix) +{ + int res; + + res = read_procfs("/proc/sys/net/core/bpf_jit_harden"); + if (json_output) { + jsonw_int_field(json_wtr, "bpf_jit_harden", res); + } else if (define_prefix) { + printf("#define %sJIT_COMPILER_HARDEN ", define_prefix); + switch (res) { + case 0: + printf("%sJIT_COMPILER_HARDEN_OFF\n", define_prefix); + break; + case 1: + printf("%sJIT_COMPILER_HARDEN_FOR_UNPRIVILEGED\n", + define_prefix); + break; + case 2: + printf("%sJIT_COMPILER_HARDEN_FOR_ALL_USERS\n", + define_prefix); + break; + case -1: + printf("%sJIT_COMPILER_HARDEN_UNKNOWN\n", + define_prefix); + break; + default: + printf("%d\n", res); + } + printf("#define %sJIT_COMPILER_HARDEN_OFF 0\n", define_prefix); + printf("#define %sJIT_COMPILER_HARDEN_FOR_UNPRIVILEGED 1\n", + define_prefix); + printf("#define %sJIT_COMPILER_HARDEN_FOR_ALL_USERS 2\n", + define_prefix); + printf("#define %sJIT_COMPILER_HARDEN_UNKNOWN -1\n", + define_prefix); + } else { + switch (res) { + case 0: + printf("JIT compiler hardening is disabled\n"); + break; + case 1: + printf("JIT compiler hardening is enabled for unprivileged users\n"); + break; + case 2: + printf("JIT compiler hardening is enabled for all users\n"); + break; + case -1: + printf("Unable to retrieve JIT hardening status\n"); + break; + default: + printf("JIT hardening status has unknown value %d\n", + res); + } + } +} + +static void probe_jit_kallsyms(const char *define_prefix) +{ + int res; + + res = read_procfs("/proc/sys/net/core/bpf_jit_kallsyms"); + if (json_output) { + jsonw_int_field(json_wtr, "bpf_jit_kallsyms", res); + } else if (define_prefix) { + printf("#define %sJIT_COMPILER_KALLSYMS ", define_prefix); + switch (res) { + case 0: + printf("%sJIT_COMPILER_KALLSYMS_OFF\n", define_prefix); + break; + case 1: + printf("%sJIT_COMPILER_KALLSYMS_FOR_ROOT\n", + define_prefix); + break; + case -1: + printf("%sJIT_COMPILER_KALLSYMS_UNKNOWN\n", + define_prefix); + break; + default: + printf("%d\n", res); + } + printf("#define %sJIT_COMPILER_KALLSYMS_OFF 0\n", + define_prefix); + printf("#define %sJIT_COMPILER_KALLSYMS_FOR_ROOT 1\n", + define_prefix); + printf("#define %sJIT_COMPILER_KALLSYMS_UNKNOWN -1\n", + define_prefix); + } else { + switch (res) { + case 0: + printf("JIT compiler kallsyms exports are disabled\n"); + break; + case 1: + printf("JIT compiler kallsyms exports are enabled for root\n"); + break; + case -1: + printf("Unable to retrieve JIT kallsyms export status\n"); + break; + default: + printf("JIT kallsyms exports status has unknown value %d\n", res); + } + } +} + static int probe_kernel_version(const char *define_prefix) { int version, subversion, patchlevel, code = 0; @@ -138,6 +387,28 @@ static int do_probe(int argc, char **argv) if (json_output) jsonw_start_object(json_wtr); + switch (target) { + case COMPONENT_KERNEL: + case COMPONENT_UNSPEC: + print_start_section("system_config", + "/*** System configuration ***/", + "Scanning system configuration...", + define_prefix); + if (check_procfs()) { + probe_unprivileged_disabled(define_prefix); + probe_jit_enable(define_prefix); + probe_jit_harden(define_prefix); + probe_jit_kallsyms(define_prefix); + } else { + p_info("/* procfs not mounted, skipping related probes */"); + } + if (json_output) + jsonw_end_object(json_wtr); + else + printf("\n"); + break; + } + print_start_section("syscall_config", "/*** System call and kernel version ***/", "Scanning system call and kernel version...",