Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use LPM_TRIE maps in sb_mount LSM hook #134

Open
vadorovsky opened this issue Jan 12, 2022 · 0 comments
Open

Use LPM_TRIE maps in sb_mount LSM hook #134

vadorovsky opened this issue Jan 12, 2022 · 0 comments
Assignees
@vadorovsky

Comments

@vadorovsky
Copy link
Member

Currently we put allowed mount paths in a BPF hash map, where those paths are values and for cheching each mount, we iterate over that whole map and search for the string match. Not very optimal.

Instead, we should try to use LPM_TRIE maps which allow to match the prefix in optimal way:
@vadorovsky vadorovsky mentioned this issue Jan 12, 2022
Closed
@vadorovsky vadorovsky self-assigned this Mar 2, 2022
vadorovsky added a commit to vadorovsky/lockc that referenced this issue May 3, 2022
@vadorovsky
Rewrite in Rust
bb18d5e 
Finally, we are getting rid of C and libbpf here. This PR replaces
all the eBPF programs with Rust programs written in Aya.

The part of this PR is also:

* fetching recent, relevant changes in aya-template
* using LpmTrie maps for mount policies (TODO)
* detecting new processes only with tracepoints, the task LSM program
  was removed

Fixes: lockc-project#49
Fixes: lockc-project#134
Fixes: lockc-project#137
Fixes: lockc-project#138
Signed-off-by: Michal Rostecki <[email protected]>
@vadorovsky vadorovsky mentioned this issue May 3, 2022
Merged
vadorovsky added a commit to vadorovsky/lockc that referenced this issue May 4, 2022
@vadorovsky
Rewrite in Rust
240fffe 
Finally, we are getting rid of C and libbpf here. This PR replaces
all the eBPF programs with Rust programs written in Aya.

The part of this PR is also:

* fetching recent, relevant changes in aya-template
* using LpmTrie maps for mount policies (TODO)
* detecting new processes only with tracepoints, the task LSM program
  was removed

Fixes: lockc-project#49
Fixes: lockc-project#134
Fixes: lockc-project#137
Fixes: lockc-project#138
Signed-off-by: Michal Rostecki <[email protected]>
vadorovsky added a commit to vadorovsky/lockc that referenced this issue May 4, 2022
@vadorovsky
Rewrite in Rust
50e07a9 
Finally, we are getting rid of C and libbpf here. This PR replaces
all the eBPF programs with Rust programs written in Aya.

The part of this PR is also:

* fetching recent, relevant changes in aya-template
* using LpmTrie maps for mount policies (TODO)
* detecting new processes only with tracepoints, the task LSM program
  was removed

Fixes: lockc-project#49
Fixes: lockc-project#134
Fixes: lockc-project#137
Fixes: lockc-project#138
Signed-off-by: Michal Rostecki <[email protected]>
vadorovsky added a commit to vadorovsky/lockc that referenced this issue May 4, 2022
@vadorovsky
Rewrite in Rust
4e7662d 
Finally, we are getting rid of C and libbpf here. This PR replaces
all the eBPF programs with Rust programs written in Aya.

The part of this PR is also:

* fetching recent, relevant changes in aya-template
* using LpmTrie maps for mount policies (TODO)
* detecting new processes only with tracepoints, the task LSM program
  was removed

Fixes: lockc-project#49
Fixes: lockc-project#134
Fixes: lockc-project#137
Fixes: lockc-project#138
Signed-off-by: Michal Rostecki <[email protected]>
vadorovsky added a commit to vadorovsky/lockc that referenced this issue May 13, 2022
@vadorovsky
Rewrite in Rust
56bf38e 
Finally, we are getting rid of C and libbpf here. This PR replaces
all the eBPF programs with Rust programs written in Aya.

The part of this PR is also:

* fetching recent, relevant changes in aya-template
* using LpmTrie maps for mount policies (TODO)
* detecting new processes only with tracepoints, the task LSM program
  was removed

Fixes: lockc-project#49
Fixes: lockc-project#134
Fixes: lockc-project#137
Fixes: lockc-project#138
Signed-off-by: Michal Rostecki <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vadorovsky vadorovsky

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@vadorovsky