This series implements a file local storage map for eBPF LSM programs. This allows to tie lifetime of data in the map to an open file description (in POSIX parlance). Like other local storage map types, lifetime of data is tied to the struct file instance. The main purpose is a general purpose map keyed by fd where the open file underlying the fd (struct file *) serves as the key into the map. It is possible to use struct file * from kernelspace, but sharing update access with userspace means userspace has no way except kcmp-aring with another known fd with a key. This is pretty wasteful. It can also be used to treat the map as a set of files that have been added to it, such that multiples sets can be looked up for matching purposes in O(1) instead of O(n) using kcmp(2) from userspace (for same struct file *). There are multiple other usecases served by this map. One of the motivating ones is the ability to now implement a Capsicum [0] style capability based sandbox using eBPF LSM, but the actual mechanism is much more generic and allows applications to enforce rights of their own per open file that they delegate to other users by conventional fd-passing on UNIX (dup/fork/SCM_RIGHTS). The implementation is exactly the same as bpf_inode_storage, except some modifications to use struct file * as the key instead of struct inode *. [0]: https://www.usenix.org/legacy/event/sec10/tech/full_papers/Watson.pdf Kumar Kartikeya Dwivedi (5): bpf: Implement file local storage tools: sync bpf.h header libbpf: Add bpf_probe_map_type support for file local storage tools: bpf: update bpftool for file_storage map tools: testing: Add selftest for file local storage map include/linux/bpf_lsm.h | 21 ++ include/linux/bpf_types.h | 1 + include/uapi/linux/bpf.h | 39 +++ kernel/bpf/Makefile | 2 +- kernel/bpf/bpf_file_storage.c | 244 ++++++++++++++++++ kernel/bpf/bpf_lsm.c | 4 + kernel/bpf/syscall.c | 3 +- kernel/bpf/verifier.c | 10 + security/bpf/hooks.c | 2 + .../bpf/bpftool/Documentation/bpftool-map.rst | 2 +- tools/bpf/bpftool/bash-completion/bpftool | 3 +- tools/bpf/bpftool/map.c | 3 +- tools/include/uapi/linux/bpf.h | 39 +++ tools/lib/bpf/libbpf_probes.c | 1 + .../bpf/prog_tests/test_local_storage.c | 51 ++++ .../selftests/bpf/progs/local_storage.c | 23 ++ 16 files changed, 443 insertions(+), 5 deletions(-) create mode 100644 kernel/bpf/bpf_file_storage.c -- 2.33.0
