Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-10 Thread Alexei Starovoitov
On Mon, Oct 08, 2018 at 01:57:40PM +0200, Jiri Olsa wrote: > > I check that discussion and it's related only to bpf program load/unload, > is there any plan to also notify about bpf program attachment? > > in the step 2 you described: > > step 2 (future work) > single event for bpf prog_load

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-08 Thread Jiri Olsa
On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > On Thu, 4 Oct 2018 21:41:17 +0200 Daniel Borkmann > > wrote: > > > > > On 10/04/2018 08:39 PM, Jesper Dangaard Brouer wrote: > > > > On Thu, 4 Oct 201

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-07 Thread Jesper Dangaard Brouer
On Sat, 6 Oct 2018 00:05:22 +0200 Jiri Olsa wrote: > On Fri, Oct 05, 2018 at 11:44:35AM -0700, Alexei Starovoitov wrote: > > On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote: > > > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > > > > On Thu, Oct 04, 2018 at 10:

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-05 Thread Jiri Olsa
On Fri, Oct 05, 2018 at 11:44:35AM -0700, Alexei Starovoitov wrote: > On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote: > > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > > > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > > > On Thu, 4 Oc

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-05 Thread Alexei Starovoitov
On Fri, Oct 05, 2018 at 04:42:49PM -0300, Arnaldo Carvalho de Melo wrote: > > Is there a way for us to synthesize those prog load/unload for > preexisting loaded bpf objects? see 'bpftool prog show'. get_next_id + get_fd_by_id solve it race free.

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-05 Thread Arnaldo Carvalho de Melo
Em Fri, Oct 05, 2018 at 11:44:35AM -0700, Alexei Starovoitov escreveu: > On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote: > > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > > > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > > > My use-ca

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-05 Thread Alexei Starovoitov
On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote: > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > > On Thu, 4 Oct 2018 21:41:17 +0200 Daniel Borkmann > > > wrote: > > > > > > > On 10/04

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Jiri Olsa
On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote: > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > > On Thu, 4 Oct 2018 21:41:17 +0200 Daniel Borkmann > > wrote: > > > > > On 10/04/2018 08:39 PM, Jesper Dangaard Brouer wrote: > > > > On Thu, 4 Oct 201

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Alexei Starovoitov
On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote: > On Thu, 4 Oct 2018 21:41:17 +0200 Daniel Borkmann > wrote: > > > On 10/04/2018 08:39 PM, Jesper Dangaard Brouer wrote: > > > On Thu, 4 Oct 2018 10:11:43 -0700 Alexei Starovoitov > > > wrote: > > >> On Thu, Oct 04, 2018

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Jesper Dangaard Brouer
On Thu, 4 Oct 2018 21:41:17 +0200 Daniel Borkmann wrote: > On 10/04/2018 08:39 PM, Jesper Dangaard Brouer wrote: > > On Thu, 4 Oct 2018 10:11:43 -0700 Alexei Starovoitov > > wrote: > >> On Thu, Oct 04, 2018 at 03:50:38PM +0200, Daniel Borkmann wrote: [...] > >> > >> If the purpose of the pa

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Daniel Borkmann
On 10/04/2018 08:39 PM, Jesper Dangaard Brouer wrote: > On Thu, 4 Oct 2018 10:11:43 -0700 > Alexei Starovoitov wrote: >> On Thu, Oct 04, 2018 at 03:50:38PM +0200, Daniel Borkmann wrote: >>> Allow for audit messages to be emitted upon BPF program load and >>> unload for having a timeline of events.

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Jesper Dangaard Brouer
On Thu, 4 Oct 2018 10:11:43 -0700 Alexei Starovoitov wrote: > On Thu, Oct 04, 2018 at 03:50:38PM +0200, Daniel Borkmann wrote: > > Allow for audit messages to be emitted upon BPF program load and > > unload for having a timeline of events. The load itself is in > > syscall context, so additional

Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Alexei Starovoitov
On Thu, Oct 04, 2018 at 03:50:38PM +0200, Daniel Borkmann wrote: > Allow for audit messages to be emitted upon BPF program load and > unload for having a timeline of events. The load itself is in > syscall context, so additional info about the process initiating > the BPF prog creation can be logge

[PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload

2018-10-04 Thread Daniel Borkmann
Allow for audit messages to be emitted upon BPF program load and unload for having a timeline of events. The load itself is in syscall context, so additional info about the process initiating the BPF prog creation can be logged and later directly correlated to the unload event. The only info reall