Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable writing xattr from BPF programs #8335

Open
wants to merge 7 commits into
base: bpf-next_base
Choose a base branch
from
Open

Enable writing xattr from BPF programs #8335

wants to merge 7 commits into from
+740 −63

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: Enable writing xattr from BPF programs
version: 8
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=923532

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: bfaac2a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923532
version: 8

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e8ec1c9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923532
version: 8

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e8ec1c9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e8ec1c9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e8ec1c9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a43796b
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: defac89
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 95ad526
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 87c5441
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a8d1c48
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 556a399
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 556a399
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: b53b63d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: f8a0569
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

@liu-song-6
fs/xattr: bpf: Introduce security.bpf. xattr name prefix
3a80ca9 
Introduct new xattr name prefix security.bpf., and enable reading these
xattrs from bpf kfuncs bpf_get_[file|dentry]_xattr().

As we are on it, correct the comments for return value of
bpf_get_[file|dentry]_xattr(), i.e. return length the xattr value on
success.

Signed-off-by: Song Liu <song@kernel.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
@liu-song-6
selftests/bpf: Extend test fs_kfuncs to cover security.bpf. xattr names
b96885e 
Extend test_progs fs_kfuncs to cover different xattr names. Specifically:
xattr name "user.kfuncs" and "security.bpf.xxx" can be read from BPF
program with kfuncs bpf_get_[file|dentry]_xattr(); while "security.bpf"
and "security.selinux" cannot be read.

Signed-off-by: Song Liu <song@kernel.org>
@liu-song-6
bpf: lsm: Add two more sleepable hooks
73fefe0 
Add bpf_lsm_inode_removexattr and bpf_lsm_inode_post_removexattr to list
sleepable_lsm_hooks. These two hooks are always called from sleepable
context.

Signed-off-by: Song Liu <song@kernel.org>
@liu-song-6
bpf: Extend btf_kfunc_id_set to handle kfunc polymorphism
4aac14d 
Polymorphism exists in kernel functions, BPF helpers, as well as kfuncs.
When called from different contexts, it is necessary to pick the right
version of a kfunc. One of such example is bpf_dynptr_from_skb vs.
bpf_dynptr_from_skb_rdonly.

To avoid the burden on the users, the verifier can inspect the calling
context and select the right version of kfunc. However, with more kfuncs
being added to the kernel, it is not scalable to push all these logic
to the verifiler.

Extend btf_kfunc_id_set to handle kfunc polymorphism. Specifically,
a list of kfuncs, "hidden_set", and a new method "remap" is added to
btf_kfunc_id_set. kfuncs in hidden_set do not have BTF_SET8_KFUNCS flag,
and are not exposed in vmlinux.h. The remap method is used to inspect
the calling context, and when necessary, remap the user visible kfuncs
(for example, bpf_dynptr_from_skb), to its hidden version (for example,
bpf_dynptr_from_skb_rdonly).

The verifier calls in these remap logic via the new btf_kfunc_id_remap()
API, and picks the right kfuncs for the context.

Signed-off-by: Song Liu <song@kernel.org>
@liu-song-6
bpf: Use btf_kfunc_id_set.remap logic for bpf_dynptr_from_skb
0f30992 
btf_kfunc_id_set.remap can pick proper version of a kfunc for the calling
context. Use this logic to select bpf_dynptr_from_skb or
bpf_dynptr_from_skb_rdonly. This will make the verifier simpler.

Unfortunately, btf_kfunc_id_set.remap cannot cover the DYNPTR_TYPE_SKB
logic in check_kfunc_args(). This can be addressed later.

Signed-off-by: Song Liu <song@kernel.org>
@liu-song-6
bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs
a7f3327 
Add the following kfuncs to set and remove xattrs from BPF programs:

  bpf_set_dentry_xattr
  bpf_remove_dentry_xattr
  bpf_set_dentry_xattr_locked
  bpf_remove_dentry_xattr_locked

The _locked version of these kfuncs are called from hooks where
dentry->d_inode is already locked. Instead of requiring the user
to know which version of the kfuncs to use, the verifier will pick
the proper kfunc based on the calling hook.

Signed-off-by: Song Liu <song@kernel.org>
@liu-song-6
selftests/bpf: Test kfuncs that set and remove xattr from BPF programs
0417639 
Two sets of tests are added to exercise the not _locked and _locked
version of the kfuncs. For both tests, user space accesses xattr
security.bpf.foo on a testfile. The BPF program is triggered by user
space access (on LSM hook inode_[set|get]_xattr) and sets or removes
xattr security.bpf.bar. Then user space then validates that xattr
security.bpf.bar is set or removed as expected.

Note that, in both tests, the BPF programs use the not _locked kfuncs.
The verifier picks the proper kfuncs based on the calling context.

Signed-off-by: Song Liu <song@kernel.org>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: e055a46
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=923973
version: 9

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next needs-ack V9-ci-fail V9
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@liu-song-6