eBPF – Adding functionality to OS at runtime to achieve performance and security

Re:eBPF – Adding functionality to OS at runtime to achieve p... by sillystuff on Sunday November 06, 2022 @01:39PM (#33495692)

'bpftool' provides a list of loaded bpf programs, but playing around with it just now, it is not obvious to me how to get the actual loaded bpf program details (e.g, pre-JIT version of the loaded program [or even the JIT version]). The man page is pretty terse.

'bpftool prog' / 'bpftool prog list' / 'bpftool prog show' all provided the same output (sample below), and e.g., adding the index in the list, to any of the above commands is an error.

e.g.,

  # bpftool prog
  8: cgroup_device  name sd_devices  tag 1f97e470ec084ee5  gpl
        loaded_at 2022-11-02T08:58:10-0700  uid 0
        xlated 464B  jited 292B  memlock 4096B
  173: cgroup_device  name sd_devices  tag c7286db13d0052fa  gpl
        loaded_at 2022-11-05T23:53:24-0700  uid 0
        xlated 464B  jited 292B  memlock 4096B
  174: cgroup_skb  name sd_fw_egress  tag 6deef7357e7b4530  gpl
        loaded_at 2022-11-05T23:53:24-0700  uid 0
        xlated 64B  jited 58B  memlock 4096B
  .
  .
  .

Does anyone know if it is possible, and how to get the details on the loaded bpf programs?

[ Parent | on HN ]

Re:eBPF – Adding functionality to OS at runtime to achieve p... by mdaverde on Sunday November 06, 2022 @02:14PM (#33495982)

You can see the interpreter instructions through bpftool:

  bpftool prog dump xlated id 173

To see the JITed instructions:

  bpftool prog dump jited id 173

For the interpreted insns, you can also see the instructions in different forms, which is pretty neat. For example you can get a control flow graph in DOT format with `visual` specified at the end:

  bpftool prog dump xlated id 173 visual

I learned about these commands through this blog post: https://qmonnet.github.io/whirl-offload/2021/09/23/bpftool-f...

[ Parent | on HN ]

Re:eBPF – Adding functionality to OS at runtime to achieve p... by sillystuff on Sunday November 06, 2022 @02:32PM (#33496168)

Thanks. Visibility seems to be pretty good. Something like AIDE/Tripwire for BPF might be the next step.

[ Parent | on HN ]

Re:eBPF – Adding functionality to OS at runtime to achieve p... by nickstinemates on Sunday November 06, 2022 @04:04PM (#33497136)

This is effectively what Falco(https://falco.org/) is

[ Parent | on HN ]

Re:eBPF – Adding functionality to OS at runtime to achieve p... by tkhattra on Sunday November 06, 2022 @02:20PM (#33496048)

the bpftool-prog(8) man page documents the bpftool-prog subcommands

[ Parent | on HN ]

Re:eBPF – Adding functionality to OS at runtime to achieve p... by alexgartrell on Sunday November 06, 2022 @06:42PM (#33498922)

FWIW, programs compiled through a modern toolchain can ship their own debug data. For example, the restrict_filesystems program loaded by systemd

    $ sudo bpftool prog dump xlated id 50
    int restrict_filesystems(unsigned long long \* ctx):
    ; int BPF_PROG(restrict_filesystems, struct file *file, int ret)
       0: (79) r3 = *(u64 *)(r1 +0)  
       1: (79) r0 = *(u64 *)(r1 +8)
       2: (b7) r1 = 0 
    ; uint32_t *value, *magic_map, zero = 0, *is_allow;
       3: (63) *(u32 *)(r10 -20) = r1
    ; int BPF_PROG(restrict_filesystems, struct file \*file, int ret)
       4: (bf) r1 = r0                                                             
       5: (67) r1 <<= 32             
       6: (77) r1 >>= 32
    ; if (ret != 0)           
       7: (55) if r1 != 0x0 goto pc+59                                             
       8: (b7) r1 = 32               
       9: (0f) r3 += r1
      10: (bf) r6 = r10

https://github.com/systemd/systemd/blob/c76691d708ac7fe13b7c...

Unfortunately, most of the programs loaded by systemd are more-or-less hand-generated (the ingress/egress programs specifically) and do not include this information.

It's a surprisingly small group of folks who work in this space upstream, but I know that they're aware of this as an opportunity to improve things :)

[ Parent | on HN ]