-1

I'm using ebpf and bcc to write an ebpf-lsm program. I want to block a connected USB device and send its info to userspace and the user send me whether I bind that device or no.

how can I do this? I know using ebpf maps we can receive data from userspace, well how can I wait for that? in another word, how can I block ebpf program until user responses?

thank you for any guidness!

Improve this question

1 Answer 1

Reset to default
1

That's not possible with BPF today; you can't block the program's execution until some userspace process answers.

You may want to look at ptrace(2) and/or seccomp-bpf instead. See for example Deferring seccomp decisions to user space on LWN.net.

Improve this answer
1
  • oh.... well I was tried this before but it's problem is it is process based. can we use seccomp-bpf program system wide?? and another question, can I do this with pure lsm?? that's mean I block lsm and wait for user response. not in bpf, in pure lsm.
    – Redwan
    Commented Jun 15, 2021 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .