Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BPF: A New Type of Software

brendangregg.com

Post reply on HN
Print view View original

51–60 of 192 posts

Re: BPF: A New Type of Software

#51

Post by rhinoceraptor »

ComSubVie wrote: post #18

Haven't used it till now (except maybe via nft?). What I'm not sure is: who is preventing BPF to be used as rootkits? Since they are run inside the kernel and cannot be inspected (?) can they be used to hide malicious activity?

You can see which bpf programs are loaded in the kernel via the bpf() syscall.

Theoretically it could be used for a rootkit, but the programs needed to loaded as root, and they can't have side effects. BPF has also been around for a long time, and it's in basically all of the nix operating systems.

Re: BPF: A New Type of Software

#53

Post by TickleSteve »

ClumsyPilot wrote: post #48

This looks very similar to webassembly work going on right now, both use a secure VM, and both run in kernel space. Would webassembly be a more general purpose way of accomplishing something like this?

A BPF interpreter can literally be ~100 LoC. A WebAssembly VM on the other hand will likely be ~1million LoC (without checking).

One is suitable for embedding into a kernel, the other isn't.

Re: BPF: A New Type of Software

#54

Post by badfrog »

yehia2amer wrote: post #50

This is one of the moments that i read an article and say to myself: “Those stuff needs a smarter programmer than i am” I will try to watch the video, hopefully it is simpler to understand !

I've thought that many times and always been wrong. At the end of the day, code is just code. After you take the time to understand the environment it's running in, it's not that much different than anything else you could write.

Creating BPF in the first place took a lot of cleverness. Figuring out how to fit it into a massive infrastructure at a place like Facebook took a lot of cleverness. But most of the people actually working on the implementations are just normal software engineers.

Re: BPF: A New Type of Software

#55

Post by rhinoceraptor »

baybal2 wrote: post #15

Question from me, why reinvent the bicycle and not just write proper kernel modules in C?

BPF is completely production safe. So there is no way for a BPF program to crash the kernel, introduce significant performance latency, or have any side effects on the kernel/user space. Obviously, kernel modules have none of those properties.

Also, BPF has been around for almost 30 years, and you're likely using it. tcpdump is basically just a BPF bytecode frontend, for example.

Re: BPF: A New Type of Software

#56

Post by sanxiyn »

TickleSteve wrote: post #53
ClumsyPilot wrote: post #48

This looks very similar to webassembly work going on right now, both use a secure VM, and both run in kernel space. Would webassembly be a more general purpose way of accomplishing something like this?

A BPF interpreter can literally be ~100 LoC. A WebAssembly VM on the other hand will likely be ~1million LoC (without checking). One is suitable for embedding into a kernel, the other isn't.

Where did you get ~1million number? https://github.com/bytecodealliance/wasm-micro-runtime is less than 100K LoC for example.

Re: BPF: A New Type of Software

#57

Post by nicoburns »

TickleSteve wrote: post #53
ClumsyPilot wrote: post #48

This looks very similar to webassembly work going on right now, both use a secure VM, and both run in kernel space. Would webassembly be a more general purpose way of accomplishing something like this?

A BPF interpreter can literally be ~100 LoC. A WebAssembly VM on the other hand will likely be ~1million LoC (without checking). One is suitable for embedding into a kernel, the other isn't.

> One is suitable for embedding into a kernel, the other isn't.

I'd be very surprised if the linux kernel doesn't eventually get web assembly support.

Re: BPF: A New Type of Software

#59

Post by sanxiyn »

rhinoceraptor wrote: post #51
ComSubVie wrote: post #18

Haven't used it till now (except maybe via nft?). What I'm not sure is: who is preventing BPF to be used as rootkits? Since they are run inside the kernel and cannot be inspected (?) can they be used to hide malicious activity?

You can see which bpf programs are loaded in the kernel via the bpf() syscall. Theoretically it could be used for a rootkit, but the programs needed to loaded as root, and they can't have side effects. BPF has also been around for a long time, and it's in basically all of the nix operating systems.

Generally agreed, but Linux BPF is considerably more powerful than traditional Unix BPF, so I wouldn't depend on "it has been around for a long time" for safety.

I would like to see some academic research on Linux BPF verifier. If you are a graduate student working on formal methods looking for a topic, this is a hint.

Re: BPF: A New Type of Software

#60

Post by mwcampbell »

TickleSteve wrote: post #53
ClumsyPilot wrote: post #48

This looks very similar to webassembly work going on right now, both use a secure VM, and both run in kernel space. Would webassembly be a more general purpose way of accomplishing something like this?

A BPF interpreter can literally be ~100 LoC. A WebAssembly VM on the other hand will likely be ~1million LoC (without checking). One is suitable for embedding into a kernel, the other isn't.

> without checking

Then how can you possibly know? Do you just assume that because it has "Web" in the name, it must be insanely complicated?

Post reply on HN