ebpf icon indicating copy to clipboard operation
ebpf copied to clipboard

info: error on loading wrong BPF object type

Open mtardy opened this issue 1 year ago • 5 comments

Fixes https://github.com/cilium/ebpf/issues/1566.

Before this patch, ebpf.LoadPinnedMap and ebpf.LoadPinnedProg both succeed when used with the wrong object type. Meaning that you can open a prog using epbf.LoadPinnedMap or vice-versa and you'll get garbage data in the object's info.

To my knowledge, there are two ways of knowing from an opened FD which object type it is:

  • checking for specific fields in /proc/self/fdinfo/;
  • running readlink(2) on /proc/self/fd/ and check for anon_inode:bpf-prog or anon_inode:bpf-map.

This is a breaking change for users relying on LoadPinned to open any object: I've been using that behavior to scan BPF filesystem.

Note to the reviewer: I've been writing this fairly quickly, I'm sure I'm breaking all your conventions style-wise and I was very hesitant to return an error on failing to run readlink. Please feel free to comment on anything, I just wanted to start with something.

mtardy avatar Oct 09 '24 17:10 mtardy