10 Aug, 2020

1 commit

  • To build host programs, you need to add the program names to 'hostprogs'
    to use the necessary build rule, but it is not enough to build them
    because there is no dependency.

    There are two types of host programs: built as the prerequisite of
    another (e.g. gen_crc32table in lib/Makefile), or always built when
    Kbuild visits the Makefile (e.g. genksyms in scripts/genksyms/Makefile).

    The latter is typical in Makefiles under scripts/, which contains host
    programs globally used during the kernel build. To build them, you need
    to add them to both 'hostprogs' and 'always-y'.

    This commit adds hostprogs-always-y as a shorthand.

    The same applies to user programs. net/bpfilter/Makefile builds
    bpfilter_umh on demand, hence always-y is unneeded. In contrast,
    programs under samples/ are added to both 'userprogs' and 'always-y'
    so they are always built when Kbuild visits the Makefiles.

    userprogs-always-y works as a shorthand.

    Signed-off-by: Masahiro Yamada
    Acked-by: Miguel Ojeda

    Masahiro Yamada
     

17 May, 2020

1 commit

  • This userspace program includes UAPI headers exported to usr/include/.
    'make headers' always works for the target architecture (i.e. the same
    architecture as the kernel), so the sample program should be built for
    the target as well. Kbuild now supports 'userprogs' for that.

    I also guarded the CONFIG option by 'depends on CC_CAN_LINK' because
    $(CC) may not provide libc.

    Signed-off-by: Masahiro Yamada
    Acked-by: Sam Ravnborg

    Masahiro Yamada
     

25 Mar, 2020

1 commit


04 Feb, 2020

1 commit

  • In old days, the "host-progs" syntax was used for specifying host
    programs. It was renamed to the current "hostprogs-y" in 2004.

    It is typically useful in scripts/Makefile because it allows Kbuild to
    selectively compile host programs based on the kernel configuration.

    This commit renames like follows:

    always -> always-y
    hostprogs-y -> hostprogs

    So, scripts/Makefile will look like this:

    always-$(CONFIG_BUILD_BIN2C) += ...
    always-$(CONFIG_KALLSYMS) += ...
    ...
    hostprogs := $(always-y) $(always-m)

    I think this makes more sense because a host program is always a host
    program, irrespective of the kernel configuration. We want to specify
    which ones to compile by CONFIG options, so always-y will be handier.

    The "always", "hostprogs-y", "hostprogs-m" will be kept for backward
    compatibility for a while.

    Signed-off-by: Masahiro Yamada

    Masahiro Yamada
     

24 Jun, 2019

1 commit


05 Jun, 2019

1 commit

  • Define __NR_pidfd_send_signal if it isn't to prevent a compilation error.

    To make pidfd-metadata compile on all arches, irrespective of whether
    or not syscall numbers are assigned, define the syscall number to -1.
    If it isn't defined this will cause the kernel to return -ENOSYS.

    Fixes: 43c6afee48d4 ("samples: show race-free pidfd metadata access")
    Reported-by: Arnd Bergmann
    Reported-by: Guenter Roeck
    Cc: Christian Brauner
    Signed-off-by: Guenter Roeck
    [christian@brauner.io: tweak commit message]
    Signed-off-by: Christian Brauner

    Guenter Roeck
     

10 May, 2019

1 commit


07 May, 2019

1 commit

  • This is a sample program showing userspace how to get race-free access
    to process metadata from a pidfd. It is rather easy to do and userspace
    can actually simply reuse code that currently parses a process's status
    file in procfs.
    The program can easily be extended into a generic helper suitable for
    inclusion in a libc to make it even easier for userspace to gain metadata
    access.

    Since this came up in a discussion because this API is going to be used
    in various service managers: A lot of programs will have a whitelist
    seccomp filter that returns for all new syscalls. This
    means that programs might get confused if CLONE_PIDFD works but the
    later pidfd_send_signal() syscall doesn't. Hence, here's a ahead of
    time check that pidfd_send_signal() is supported:

    bool pidfd_send_signal_supported()
    {
    int procfd = open("/proc/self", O_DIRECTORY | O_RDONLY | O_CLOEXEC);
    if (procfd < 0)
    return false;

    /*
    * A process is always allowed to signal itself so
    * pidfd_send_signal() should never fail this test. If it does
    * it must mean it is not available, blocked by an LSM, seccomp,
    * or other.
    */
    return pidfd_send_signal(procfd, 0, NULL, 0) == 0;
    }

    Signed-off-by: Christian Brauner
    Co-developed-by: Jann Horn
    Signed-off-by: Jann Horn
    Reviewed-by: Oleg Nesterov
    Cc: Arnd Bergmann
    Cc: "Eric W. Biederman"
    Cc: Kees Cook
    Cc: Thomas Gleixner
    Cc: David Howells
    Cc: "Michael Kerrisk (man-pages)"
    Cc: Andy Lutomirsky
    Cc: Andrew Morton
    Cc: Aleksa Sarai
    Cc: Linus Torvalds
    Cc: Al Viro

    Christian Brauner