4 ms·

There is lots of interesting kernel surface that is rarely locked down. eBPF is a (relative) the new kid on the block but there is also Netlink and the other ne

by jpgvm 2y ago

There is lots of interesting kernel surface that is rarely locked down. eBPF is a (relative) the new kid on the block but there is also Netlink and the other new kid io_uring. Unfortunately security features for these transports are limited so if you have to say run a daemon that manages network device state that now becomes attack surface for other juicy things you can do with Netlink (because once you have CAP_NET_ADMIN everything is up for grabs). io_uring is similar in this regard with both currently pretty much "trusted" APIs. Netlink is pretty awesome, you can sort of think of it like ioctl on steroids. As a result it's proliferated around the kernel as much nicer replacement for ioctls or implementing a custom character device or something for userspace/kernel communication. Knowledge of this isn't widespread however, even security experts I have spoken to that don't have deep kernel development background aren't really aware of how widespread Netlink is in generic non-network related subsystems.

alephnerd 2y ago
> Knowledge of this isn't widespread however, even security experts I have spoken to that don't have deep kernel development background aren't really aware of how widespread Netlink is in generic non-network related subsystems. Depends on the scene. This is why my portfolio companies as well as my previous employer when I was a PM and SWE began moving engineering (and even PM) hiring to Israel, CEE, and India. I've noticed a severe degradation in OS, Systems, and Networking knowledge in the US market over the past 15 years. Everyone went gungho into "fullstack" or "backend" and significantly deskilled. > Netlink is pretty awesome It really is. Most security products will use a mix of Netlink and eBPF to gain observability and enforcement capabilities on Linux workloads. > if you have to say run a daemon that manages network device state that now becomes attack surface for other juicy things you can do with Netlink (because once you have CAP_NET_ADMIN everything is up for grabs) Big reason most companies I know of would prevent third party software from being granted CAP_NET_ADMIN
api 2y ago
I don’t think I’d call netlink awesome. Ever had to program with it?
- jpgvm 2y ago
  Yes I have actually. I have used it from userspace for all sorts of things, including crazy things like reading out conntrack state to build network flow visualisation etc. I have also implemented my own kernel modules that used netlink for userspace communication. I think awesome in kernel terms is always relative. It's awesome compared to ioctl or custom character devices (or the very dirty option of custom syscalls). I suspect io_uring would be a much much nicer alternative but it's also much more modern and not something I have worked with yet.

by jpgvm 2y ago

alephnerd 2y ago

> Knowledge of this isn't widespread however, even security experts I have spoken to that don't have deep kernel development background aren't really aware of how widespread Netlink is in generic non-network related subsystems. Depends on the scene. This is why my portfolio companies as well as my previous employer when I was a PM and SWE began moving engineering (and even PM) hiring to Israel, CEE, and India. I've noticed a severe degradation in OS, Systems, and Networking knowledge in the US market over the past 15 years. Everyone went gungho into "fullstack" or "backend" and significantly deskilled. > Netlink is pretty awesome It really is. Most security products will use a mix of Netlink and eBPF to gain observability and enforcement capabilities on Linux workloads. > if you have to say run a daemon that manages network device state that now becomes attack surface for other juicy things you can do with Netlink (because once you have CAP_NET_ADMIN everything is up for grabs) Big reason most companies I know of would prevent third party software from being granted CAP_NET_ADMIN

api 2y ago

I don’t think I’d call netlink awesome. Ever had to program with it?

jpgvm 2y ago
Yes I have actually. I have used it from userspace for all sorts of things, including crazy things like reading out conntrack state to build network flow visualisation etc. I have also implemented my own kernel modules that used netlink for userspace communication. I think awesome in kernel terms is always relative. It's awesome compared to ioctl or custom character devices (or the very dirty option of custom syscalls). I suspect io_uring would be a much much nicer alternative but it's also much more modern and not something I have worked with yet.