[PATCH v11 bpf-next 1/7] fs/xattr: bpf: Introduce security.bpf. xattr name prefix

[Song Liu]

Hi Matt,

> On Jan 30, 2025, at 2:57 AM, Matt Bobrowski <mattbobrowski at google.com> wrote:
> 
> On Wed, Jan 29, 2025 at 12:59:51PM -0800, Song Liu wrote:
>> Introduct new xattr name prefix security.bpf., and enable reading these
>> xattrs from bpf kfuncs bpf_get_[file|dentry]_xattr().
>> 
>> As we are on it, correct the comments for return value of
>> bpf_get_[file|dentry]_xattr(), i.e. return length the xattr value on
>> success.
> 
> Reviewed-by: Matt Bobrowski <mattbobrowski at google.com>

Thanks for the review!

[...]
> 
>> - * Return: 0 on success, a negative value on error.
>> + * Return: length of the xattr value on success, a negative value on error.
>>  */
>> __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__str,
>>     struct bpf_dynptr *value_p)
>> @@ -117,7 +123,9 @@ __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__st
>> if (WARN_ON(!inode))
>> return -EINVAL;
>> 
>> - if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
>> + /* Allow reading xattr with user. and security.bpf. prefix */
>> + if (strncmp(name__str, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
>> +    !match_security_bpf_prefix(name__str))
> 
> I think it would be cleaner to have single function
> i.e. is_allowed_xattr_prefix(const char *name__str) which simply
> checks all the allowed xattr prefixes that can be read by this BPF
> kfunc.

Sure, we can add bpf_xattr_read_permission() which pairs with 
bpf_xattr_write_permission(). 

Thanks,
Song

> 
>> return -EPERM;
>> 
>> value_len = __bpf_dynptr_size(value_ptr);
>> @@ -139,9 +147,10 @@ __bpf_kfunc int bpf_get_dentry_xattr(struct dentry *dentry, const char *name__st
>>  *
>>  * Get xattr *name__str* of *file* and store the output in *value_ptr*.
>>  *
>> - * For security reasons, only *name__str* with prefix "user." is allowed.
>> + * For security reasons, only *name__str* with prefix "user." or
>                      ^ prefixes
> 
>> + * "security.bpf." is allowed.
>            ^ are
> 
>> - * Return: 0 on success, a negative value on error.
>> + * Return: length of the xattr value on success, a negative value on error.
>>  */
>> __bpf_kfunc int bpf_get_file_xattr(struct file *file, const char *name__str,
>>   struct bpf_dynptr *value_p)
>> diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
>> index 9854f9cff3c6..c7c85bb504ba 100644
>> --- a/include/uapi/linux/xattr.h
>> +++ b/include/uapi/linux/xattr.h
>> @@ -83,6 +83,10 @@ struct xattr_args {
>> #define XATTR_CAPS_SUFFIX "capability"
>> #define XATTR_NAME_CAPS XATTR_SECURITY_PREFIX XATTR_CAPS_SUFFIX
>> 
>> +#define XATTR_BPF_LSM_SUFFIX "bpf."
>> +#define XATTR_NAME_BPF_LSM (XATTR_SECURITY_PREFIX XATTR_BPF_LSM_SUFFIX)
>> +#define XATTR_NAME_BPF_LSM_LEN (sizeof(XATTR_NAME_BPF_LSM) - 1)
>> +
>> #define XATTR_POSIX_ACL_ACCESS  "posix_acl_access"
>> #define XATTR_NAME_POSIX_ACL_ACCESS XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_ACCESS
>> #define XATTR_POSIX_ACL_DEFAULT  "posix_acl_default"
>> -- 
>> 2.43.5
>>