Lsm cgroup api #1135

altugbozkurt07 · 2025-01-14T16:01:20Z

This is the refactored work based on the discussion we have had on discord.
Let me know if i missed anything.

Best

This change is

netlify · 2025-01-14T16:02:14Z

✅ Deploy Preview for aya-rs-docs ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`f2493ab`
🔍 Latest deploy log	https://app.netlify.com/sites/aya-rs-docs/deploys/6787bcd81568b4000893d05e
😎 Deploy Preview	https://deploy-preview-1135--aya-rs-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

tamird · 2025-01-14T16:05:22Z

Please avoid opening a new PR each time. There are comments I left in #1131 that remain unaddressed.

altugbozkurt07 · 2025-01-14T18:02:45Z

@tamird sorry, since we have changed the way we implemented api, i thought it deserved a new pr.

For the comments that remain unaddressed;
1- nix package is used in init crate so that is why i left it there. If you still want me to remove it from workspace and include it in specific crates where its used.
2- Done
3- Done
4- Removed the empty comment line
5- The changes proposed in this pr

Am i missing something other than what is stated in your comments?

dave-tucker

I've take a quick pass over and there are a few nits that need clearing up.
Please also check that the docs build and render correctly 🙏

dave-tucker · 2025-01-14T18:06:20Z

Cargo.toml

@@ -78,7 +78,7 @@ indoc = { version = "2.0", default-features = false }
 libc = { version = "0.2.105", default-features = false }
 log = { version = "0.4", default-features = false }
 netns-rs = { version = "0.1", default-features = false }
-nix = { version = "0.29.0", default-features = false }
+nix = { version = "0.29.0", default-features = true }


Per comment in the previous review this should be:

nix = { version = "0.29.0", default-features = false }

dave-tucker · 2025-01-14T18:09:05Z

test/integration-test/Cargo.toml

@@ -28,6 +28,7 @@ test-case = { workspace = true }
 test-log = { workspace = true, features = ["log"] }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time"] }
 xdpilone = { workspace = true }
+nix = { workspace = true, features = ["process"] }


You would add any other features that were required from nix here.
I assume you needed something from the default featureset given the change in the main Cargo.toml.

dave-tucker · 2025-01-14T18:10:17Z

aya-ebpf-macros/src/lsm.rs

@@ -19,6 +19,7 @@ impl Lsm {
        let hook = pop_string_arg(&mut args, "hook");
        let sleepable = pop_bool_arg(&mut args, "sleepable");
        err_on_unknown_args(&args)?;
+


stray newline

dave-tucker · 2025-01-14T18:10:32Z

aya-ebpf-macros/src/lsm.rs

@@ -39,15 +40,15 @@ impl Lsm {
            block: _,
        } = item;
        let section_prefix = if *sleepable { "lsm.s" } else { "lsm" };
-        let section_name: Cow<'_, _> = if let Some(hook) = hook {
-            format!("{}/{}", section_prefix, hook).into()
+        let section_name: Cow<'_, _> = if let Some(name) = hook {


There's no need to rename these variables.

dave-tucker · 2025-01-14T18:10:45Z

aya-ebpf-macros/src/lsm.rs

        } else {
            section_prefix.into()
        };
+        let fn_name = &sig.ident;


Also no need to move this line.

sorry but i didnt understand the problem on this one, can you elobarate on this ?

Just undo this change.

dave-tucker · 2025-01-14T18:21:20Z

aya/src/programs/lsm.rs

 /// [1]: https://elixir.bootlin.com/linux/latest/source/include/linux/lsm_hook_defs.h
 #[derive(Debug)]
 #[doc(alias = "BPF_PROG_TYPE_LSM")]
 pub struct Lsm {
    pub(crate) data: ProgramData<LsmLink>,
+    pub(crate) attach_type: LsmAttachType,


You can remove this.

dave-tucker · 2025-01-14T18:22:07Z

aya/src/programs/lsm.rs

@@ -60,7 +62,7 @@ impl Lsm {
    /// * `lsm_hook_name` - full name of the LSM hook that the program should
    ///   be attached to
    pub fn load(&mut self, lsm_hook_name: &str, btf: &Btf) -> Result<(), ProgramError> {
-        self.data.expected_attach_type = Some(BPF_LSM_MAC);
+        self.data.expected_attach_type = Some(self.attach_type.into());


This can be reverted also

dave-tucker · 2025-01-14T18:22:34Z

aya/src/programs/lsm_cgroup.rs

+/// The minimum kernel version required to use this feature is 6.0.
+///
+/// # Examples
+/// ## LSM with cgroup attachment type


Remove this subheading

if i remove this subheading, should i also remove it from lsm.rs ?

dave-tucker · 2025-01-14T18:22:50Z

aya/src/programs/lsm_cgroup.rs

+/// program.load("security_bprm_exec", &btf)?;
+/// program.attach(file)?;
+/// # Ok::<(), LsmError>(())
+/// ```


I think you might need a newline after the end of the code block.

dave-tucker · 2025-01-14T18:23:17Z

aya/src/programs/lsm_cgroup.rs

+        let prog_fd = self.fd()?;
+        let prog_fd = prog_fd.as_fd();
+        let cgroup_fd = cgroup.as_fd();
+        let attach_type = self.data.expected_attach_type.unwrap();


Suggested change

let attach_type = self.data.expected_attach_type.unwrap();

let attach_type = Some(BPF_LSM_CGROUP);

tamird · 2025-01-14T18:29:20Z

Please let us know when the tests are passing, or if you need help understanding the failures.

altugbozkurt07 · 2025-01-15T14:02:45Z

@dave-tucker thanks for your detailed feedback, i have updated the commit accordingly. Let me know if things are good to go for this one.

tamird

Tests are failing.

tamird · 2025-01-15T14:40:01Z

aya/src/bpf.rs

@@ -649,14 +651,17 @@ impl<'a> EbpfLoader<'a> {
                        ProgramSection::RawTracePoint => Program::RawTracePoint(RawTracePoint {
                            data: ProgramData::new(prog_name, obj, btf_fd, *verifier_log_level),
                        }),
-                        ProgramSection::Lsm { sleepable } => {
+                        ProgramSection::Lsm { sleepable , .. } => {


Undo this please.

tamird · 2025-01-15T14:40:12Z

aya/src/programs/lsm.rs

@@ -1,7 +1,6 @@
 //! LSM probes.
-
 use crate::{


tamird · 2025-01-15T14:41:27Z

aya/src/programs/mod.rs

@@ -967,7 +979,6 @@ impl_from_pin!(
    CgroupSysctl,
    LircMode2,
    PerfEvent,
-    Lsm,


Why did this change?

mergify bot added aya This is about aya (userspace) aya-bpf This is about aya-bpf (kernel) aya-obj Relating to the aya-obj crate test A PR that improves test cases or CI labels Jan 14, 2025

altugbozkurt07 force-pushed the lsm_cgroup_api branch from 92a61ab to 6a0721a Compare January 14, 2025 18:00

altugbozkurt07 force-pushed the lsm_cgroup_api branch from 6a0721a to 91ff050 Compare January 14, 2025 18:08

dave-tucker requested changes Jan 14, 2025

View reviewed changes

lsm :: cgroup attachment type support

f2493ab

altugbozkurt07 force-pushed the lsm_cgroup_api branch from 91ff050 to f2493ab Compare January 15, 2025 13:49

tamird reviewed Jan 15, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Lsm cgroup api #1135

Lsm cgroup api #1135

altugbozkurt07 commented Jan 14, 2025 •

edited

Loading

netlify bot commented Jan 14, 2025 •

edited

Loading

tamird commented Jan 14, 2025

altugbozkurt07 commented Jan 14, 2025

dave-tucker left a comment

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

altugbozkurt07 Jan 15, 2025

tamird Jan 15, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

altugbozkurt07 Jan 15, 2025

dave-tucker Jan 14, 2025

dave-tucker Jan 14, 2025

tamird commented Jan 14, 2025

altugbozkurt07 commented Jan 15, 2025

tamird left a comment

tamird Jan 15, 2025

tamird Jan 15, 2025

tamird Jan 15, 2025

	let attach_type = self.data.expected_attach_type.unwrap();
	let attach_type = Some(BPF_LSM_CGROUP);

Lsm cgroup api #1135

Are you sure you want to change the base?

Lsm cgroup api #1135

Conversation

altugbozkurt07 commented Jan 14, 2025 • edited Loading

netlify bot commented Jan 14, 2025 • edited Loading

✅ Deploy Preview for aya-rs-docs ready!

tamird commented Jan 14, 2025

altugbozkurt07 commented Jan 14, 2025

dave-tucker left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tamird commented Jan 14, 2025

altugbozkurt07 commented Jan 15, 2025

tamird left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

altugbozkurt07 commented Jan 14, 2025 •

edited

Loading

netlify bot commented Jan 14, 2025 •

edited

Loading