In case you want to learn to write BPF kernel programs using Rust
https://www.amazon.com/Oxidize-eBPF-programming-Rust/dp/B0BP...
File Expiration Using BPF
21–24 of 24 posts
Re: File Expiration Using BPF
#22Author here! As some comments mention, there are other approaches that could make more sense. The aim of this proof-of-concept was to showcase how BPF enables the kernel to be programmable. Many behaviours can be retrofitted without having to submit changes upstream. In some cases the overhead may be lower than using other methods (due to avoiding context switches, etc). Even if you decide that the changes can be use…
Interesting! I'm in the process of learning Rust (early days, early days) and whatever I write in Rust in the near future will have to interface nicely with C, AND for various reasons I also need to become far more expert in BPF than I currently am (just at the "uh, that's what happens I make these seccomp calls" stage right now), so this is a great little project for me to explore. Thank you for that.
That said (you knew there was a "but" coming, right? :->), why ptrace? Was that the only or just the simplest way to do this?
I know this is a PoC, but given disabling ptrace is considered by some (many?) an important security practice (moo), I'm wondering if there is a better alternative?
Thanks!
Re: File Expiration Using BPF
#23Author here! As some comments mention, there are other approaches that could make more sense. The aim of this proof-of-concept was to showcase how BPF enables the kernel to be programmable. Many behaviours can be retrofitted without having to submit changes upstream. In some cases the overhead may be lower than using other methods (due to avoiding context switches, etc). Even if you decide that the changes can be use…
Interesting! I'm in the process of learning Rust (early days, early days) and whatever I write in Rust in the near future will have to interface nicely with C, AND for various reasons I also need to become far more expert in BPF than I currently am (just at the "uh, that's what happens I make these seccomp calls" stage right now), so this is a great little project for me to explore. Thank you for that. That said (you…
ptrace is not used in this project, is it possible you meant some other system call or project?
Re: File Expiration Using BPF
#24Earlier quoted context omitted.
Interesting! I'm in the process of learning Rust (early days, early days) and whatever I write in Rust in the near future will have to interface nicely with C, AND for various reasons I also need to become far more expert in BPF than I currently am (just at the "uh, that's what happens I make these seccomp calls" stage right now), so this is a great little project for me to explore. Thank you for that. That said (you…
ptrace is not used in this project, is it possible you meant some other system call or project?
My apologies! I saw the inclusion of ptrace.h in run_bpf and assumed the underlying mechanism was ptrace.