On Fri, Nov 3, 2023 at 3:38 PM Song Liu <song@xxxxxxxxxx> wrote:
>
> On Fri, Nov 3, 2023 at 3:30 PM Song Liu <song@xxxxxxxxxx> wrote:
> >
> > On Fri, Nov 3, 2023 at 3:10 PM Andrii Nakryiko
> > <andrii.nakryiko@xxxxxxxxx> wrote:
> > >
> > > On Fri, Nov 3, 2023 at 2:46 PM Song Liu <song@xxxxxxxxxx> wrote:
> > > >
> > > > It is common practice for security solutions to store tags/labels in
> > > > xattrs. To implement similar functionalities in BPF LSM, add new kfunc
> > > > bpf_get_file_xattr().
> > > >
> > > > The first use case of bpf_get_file_xattr() is to implement file
> > > > verifications with asymmetric keys. Specificially, security applications
> > > > could use fsverity for file hashes and use xattr to store file signatures.
> > > > (kfunc for fsverity hash will be added in a separate commit.)
> > > >
> > > > Currently, only xattrs with "user." prefix can be read with kfunc
> > > > bpf_get_file_xattr(). As use cases evolve, we may add a dedicated prefix
> > > > for bpf_get_file_xattr().
> > > >
> > > > To avoid recursion, bpf_get_file_xattr can be only called from LSM hooks.
> > > >
> > > > Signed-off-by: Song Liu <song@xxxxxxxxxx>
> > > > ---
> > > > kernel/trace/bpf_trace.c | 64 ++++++++++++++++++++++++++++++++++++++++
> > > > 1 file changed, 64 insertions(+)
> > > >
> > > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > > > index bfe6fb83e8d0..82eaa099053b 100644
> > > > --- a/kernel/trace/bpf_trace.c
> > > > +++ b/kernel/trace/bpf_trace.c
> > > > @@ -24,6 +24,7 @@
> > > > #include <linux/key.h>
> > > > #include <linux/verification.h>
> > > > #include <linux/namei.h>
> > > > +#include <linux/fileattr.h>
> > > >
> > > > #include <net/bpf_sk_storage.h>
> > > >
> > > > @@ -1431,6 +1432,69 @@ static int __init bpf_key_sig_kfuncs_init(void)
> > > > late_initcall(bpf_key_sig_kfuncs_init);
> > > > #endif /* CONFIG_KEYS */
> > > >
> > > > +/* filesystem kfuncs */
> > > > +__diag_push();
> > > > +__diag_ignore_all("-Wmissing-prototypes",
> > > > + "kfuncs which will be used in BPF programs");
> > > > +
> > >
> > > please use __bpf_kfunc_{start,end}_defs macros, from [0]
> > >
> > > [0] https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=391145ba2acc
> >
> > Nice! I was thinking about the same issue (-Wmissing-declarations).
> >
> > But this patch is not pulled into bpf-next yet (only in bpf). How about we keep
> > __diag_ignore_all() etc for now?
>
> I will add __diag_ignore_all("-Wmissing-declarations",) so it is
> equivalent to the marcos.
Ah, it's bpf tree, not bpf-next, I see. Ok, we'll have to leave it as
is for now and then clean up later.
>
> Thanks,
> Song
