Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable writing xattr from BPF programs #8261

Closed
wants to merge 8 commits into from
Closed

Enable writing xattr from BPF programs #8261

wants to merge 8 commits into from

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: Enable writing xattr from BPF programs
version: 4
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 58ecb3a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 58ecb3a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 58ecb3a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a7c2051
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a7c2051
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918509
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a7c2051
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918978
version: 5

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 8eef6ac
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=918978
version: 5

@kernel-patches-daemon-bpf
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=918978 expired. Closing PR.

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: c5d2bac
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=919679
version: 7

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: c5d2bac
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=919679
version: 7

@liu-song-6
fs/xattr: bpf: Introduce security.bpf. xattr name prefix
6b23589 
Introduct new xattr name prefix security.bpf., and enable reading these
xattrs from bpf kfuncs bpf_get_[file|dentry]_xattr().

As we are on it, correct the comments for return value of
bpf_get_[file|dentry]_xattr(), i.e. return length the xattr value on
success.

Signed-off-by: Song Liu <[email protected]>
Acked-by: Christian Brauner <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
@liu-song-6
selftests/bpf: Extend test fs_kfuncs to cover security.bpf. xattr names
79b1179 
Extend test_progs fs_kfuncs to cover different xattr names. Specifically:
xattr name "user.kfuncs" and "security.bpf.xxx" can be read from BPF
program with kfuncs bpf_get_[file|dentry]_xattr(); while "security.bpf"
and "security.selinux" cannot be read.

Signed-off-by: Song Liu <[email protected]>
@liu-song-6
bpf: lsm: Add two more sleepable hooks
86b8d9a 
Add bpf_lsm_inode_removexattr and bpf_lsm_inode_post_removexattr to list
sleepable_lsm_hooks. These two hooks are always called from sleepable
context.

Signed-off-by: Song Liu <[email protected]>
@liu-song-6
bpf: Extend btf_kfunc_id_set to handle kfunc polymorphism
2cc929a 
Polymorphism exists in kernel functions, BPF helpers, as well as kfuncs.
When called from different contexts, it is necessary to pick the right
version of a kfunc. One of such example is bpf_dynptr_from_skb vs.
bpf_dynptr_from_skb_rdonly.

To avoid the burden on the users, the verifier can inspect the calling
context and select the right version of kfunc. However, with more kfuncs
being added to the kernel, it is not scalable to push all these logic
to the verifiler.

Extend btf_kfunc_id_set to handle kfunc polymorphism. Specifically,
a list of kfuncs, "hidden_set", and a new method "remap" is added to
btf_kfunc_id_set. kfuncs in hidden_set do not have BTF_SET8_KFUNCS flag,
and are not exposed in vmlinux.h. The remap method is used to inspect
the calling context, and when necessary, remap the user visible kfuncs
(for example, bpf_dynptr_from_skb), to its hidden version (for example,
bpf_dynptr_from_skb_rdonly).

The verifier calls in these remap logic via the new btf_kfunc_id_remap()
API, and picks the right kfuncs for the context.

Signed-off-by: Song Liu <[email protected]>
@liu-song-6
bpf: Use btf_kfunc_id_set.remap logic for bpf_dynptr_from_skb
30b3768 
btf_kfunc_id_set.remap can pick proper version of a kfunc for the calling
context. Use this logic to select bpf_dynptr_from_skb or
bpf_dynptr_from_skb_rdonly. This will make the verifier simpler.

Unfortunately, btf_kfunc_id_set.remap cannot cover the DYNPTR_TYPE_SKB
logic in check_kfunc_args(). This can be addressed later.

Signed-off-by: Song Liu <[email protected]>
@liu-song-6
bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs
2f335a5 
Add the following kfuncs to set and remove xattrs from BPF programs:

  bpf_set_dentry_xattr
  bpf_remove_dentry_xattr
  bpf_set_dentry_xattr_locked
  bpf_remove_dentry_xattr_locked

The _locked version of these kfuncs are called from hooks where
dentry->d_inode is already locked. Instead of requiring the user
to know which version of the kfuncs to use, the verifier will pick
the proper kfunc based on the calling hook.

Signed-off-by: Song Liu <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: c5d2bac
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=919679
version: 7

@liu-song-6
selftests/bpf: Test kfuncs that set and remove xattr from BPF programs
d80c70d 
Two sets of tests are added to exercise the not _locked and _locked
version of the kfuncs. For both tests, user space accesses xattr
security.bpf.foo on a testfile. The BPF program is triggered by user
space access (on LSM hook inode_[set|get]_xattr) and sets or removes
xattr security.bpf.bar. Then user space then validates that xattr
security.bpf.bar is set or removed as expected.

Note that, in both tests, the BPF programs use the not _locked kfuncs.
The verifier picks the proper kfuncs based on the calling context.

Signed-off-by: Song Liu <[email protected]>
@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the bpf-next_base branch 3 times, most recently from aee9254 to da86bde Compare December 31, 2024 04:17
@kernel-patches-daemon-bpf
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=919642 irrelevant now. Closing PR.

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot deleted the series/916534=>bpf-next branch January 2, 2025 22:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next superseded V6
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@liu-song-6