Patches Updated For Hooking eBPF Programs Into The Linux Kernel Scheduler

[phoronix]

Phoronix: Patches Updated For Hooking eBPF Programs Into The Linux Kernel Scheduler

Published back in November were a set of patches for allowing (e)BPF to extend the Linux kernel's scheduler. That interesting work is continuing with Friday having brought a second revision to the patches...

https://www.phoronix.com/news/Linux-Scheduler-eBPF-v2-sched

[joshx1]

eBPF is a really neat concept, and I really like the tools it allows.

Have a look at the tools in https://github.com/iovisor/bpftrace .

I'm writing a tool similar to Ananicy/Ananicy-cpp, but where it won't set the niceness for the child processes (children have their parent processes niceness).

This is made super easy with eBPF, using `sched_process_fork` and `sched_process_exec` trace events to monitor processes.

[stormcrow]

eBPF is a really neat concept, and I really like the tools it allows.

Have a look at the tools in https://github.com/iovisor/bpftrace .

I'm writing a tool similar to Ananicy/Ananicy-cpp, but where it won't set the niceness for the child processes (children have their parent processes niceness).

This is made super easy with eBPF, using `sched_process_fork` and `sched_process_exec` trace events to monitor processes.

Yeah it's great. But with great (kernel!) power comes great responsibility. Malware can use eBPF just as easily - and is increasingly doing so. Root access is optional (for malware thanks to privilege escalation attacks or even admins configuring eBPF to allow arbitrary users to place eBPF programs for execution!!).

Instead have a look at what eBPF can do - and by extension anyone using eBPF (good or bad) and then decide if you really want to open that can of worms. My bet is that most people shouldn't even if you think you want to.

https://redcanary.com/blog/ebpf-malware/

(In short, if your use case doesn't require eBPF, you shouldn't use it. It's not a performance silver bullet.)

[Weasel]

Yeah it's great. But with great (kernel!) power comes great responsibility. Malware can use eBPF just as easily - and is increasingly doing so. Root access is optional (for malware thanks to privilege escalation attacks or even admins configuring eBPF to allow arbitrary users to place eBPF programs for execution!!).

If you have privilege escalation, eBPF is the least of your worries, since the malware can simply inject and load kernel modules at that point.

I agree that eBPF should be absolutely controlled, which makes it perfectly safe (at least, compared to having no eBPF at all). It's not more dangerous when it comes to privilege escalation, that's just paranoia.

[aviallon]

eBPF is a really neat concept, and I really like the tools it allows.

Have a look at the tools in https://github.com/iovisor/bpftrace .

I'm writing a tool similar to Ananicy/Ananicy-cpp, but where it won't set the niceness for the child processes (children have their parent processes niceness).

This is made super easy with eBPF, using `sched_process_fork` and `sched_process_exec` trace events to monitor processes.

Oh, that's interesting! I'm the original author of ananicy-cpp, and I'd loved to use eBPF in such a way!
It would probably be much more performant too!

[dragonn]

I'm writing a tool similar to Ananicy/Ananicy-cpp, but where it won't set the niceness for the child processes (children have their parent processes niceness).

This is made super easy with eBPF, using `sched_process_fork` and `sched_process_exec` trace events to monitor processes.

Any link to your version that uses eBPF?