[RFC,bpf-next,0/1] Enhancement for bpf_do_path() helper

Message

xufeng zhang Nov. 20, 2021, 5:18 a.m. UTC

Background:
--------------------------------------------------------------------------------------------------
This is our scenario:
We restrict process to do certain operations in LSM hookpoint based on user specified security rules, 
and one dimension of the rule is the process’s executable full path, so we use bpf_d_path() helper to
get the path, and do rule matching in hash maps to make the allow or deny decision. However, the
returned buffer is not our expected, there is always noisy data at the tail of the buffer and makes
hash map lookup fails to work.
We have tried several ways to workaround this problem, such as using __builtin_memset() to clear
the returned buffer, but it does not work because __builtin_memset() cannot accept variable sized
buffer; and we also tried use a loop the iterate every byte of the buffer and clear the noisy data,
this works in simple bpf programs but makes a lot of trouble to us for complex bpf program cases,
e.g. reaching 1M instruction limitation or stack overflow.
Thus, we want to enhance the origin bpf_do_path() implementation, clearing the noisy tail buffer
helps a lot to us.

Appreciate for your suggestion.

Xufeng Zhang (1):
bpf: Clear the noisy tail buffer for bpf_d_path() helper
---
 kernel/trace/bpf_trace.c | 2 ++
 1 file changed, 2 insertions(+)