[PATCH v4 bpf-next 4/6] bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs

Song Liu songliubraving at meta.com
Tue Dec 17 18:24:42 UTC 2024


Hi Alexei, 

Thanks for the review!

> On Dec 17, 2024, at 8:50 AM, Alexei Starovoitov <alexei.starovoitov at gmail.com> wrote:
> 
> On Mon, Dec 16, 2024 at 10:38 PM Song Liu <song at kernel.org> wrote:
>> 
>> Add the following kfuncs to set and remove xattrs from BPF programs:
>> 
>>  bpf_set_dentry_xattr
>>  bpf_remove_dentry_xattr
>>  bpf_set_dentry_xattr_locked
>>  bpf_remove_dentry_xattr_locked
>> 
>> The _locked version of these kfuncs are called from hooks where
>> dentry->d_inode is already locked.
> 
> ...
> 
>> + *
>> + * Setting and removing xattr requires exclusive lock on dentry->d_inode.
>> + * Some hooks already locked d_inode, while some hooks have not locked
>> + * d_inode. Therefore, we need different kfuncs for different hooks.
>> + * Specifically, hooks in the following list (d_inode_locked_hooks)
>> + * should call bpf_[set|remove]_dentry_xattr_locked; while other hooks
>> + * should call bpf_[set|remove]_dentry_xattr.
>> + */
> 
> the inode locking rules might change, so let's hide this
> implementation detail from the bpf progs by making kfunc polymorphic.
> 
> To struct bpf_prog_aux add:
> bool use_locked_kfunc:1;
> and set it in bpf_check_attach_target() if it's attaching
> to one of d_inode_locked_hooks
> 
> Then in fixup_kfunc_call() call some helper that
> if (prog->aux->use_locked_kfunc &&
>    insn->imm == special_kfunc_list[KF_bpf_remove_dentry_xattr])
>     insn->imm = special_kfunc_list[KF_bpf_remove_dentry_xattr_locked];
> 
> The progs will be simpler and will suffer less churn
> when the kernel side changes.

I was thinking about something in similar direction. 

If we do this, shall we somehow hide the _locked version of the 
kfuncs, so that the user cannot use it? If so, what's the best 
way to do it? 

Thanks,
Song



More information about the Linux-security-module-archive mailing list