This series implements a file local storage map for eBPF LSM programs. This allows to tie lifetime of data in the map to an open file description (in POSIX parlance). Like other local storage map types, lifetime of data is tied to the struct file instance. The main purpose is a general purpose map keyed by fd where the open file underlying the fd (struct file *) serves as the key into the map. It is possible to use struct file * from kernelspace, but sharing update access with userspace means userspace has no way except kcmp-aring with another known fd with a key. This is pretty wasteful. It can also be used to treat the map as a set of files that have been added to it, such that multiples sets can be looked up for matching purposes in O(1) instead of O(n) using kcmp(2) from userspace (for same struct file *). There are multiple other usecases served by this map. One of the motivating ones is the ability to now implement a Capsicum [0] style capability based sandbox using eBPF LSM, but the actual mechanism is much more generic and allows applications to enforce rights of their own per open file that they delegate to other users by conventional fd-passing on UNIX (dup/fork/SCM_RIGHTS). Implementation is similar to that of bpf_inode_storage, with some modifications to use struct file * as map key. [0]: https://www.usenix.org/legacy/event/sec10/tech/full_papers/Watson.pdf Changelog: ---------- RFC v1 -> v2 v1: https://lore.kernel.org/bpf/20210821184824.2052643-1-memxor@xxxxxxxxx * Expand selftest to demonstrate sample use, and add spin lock in test Kumar Kartikeya Dwivedi (5): bpf: Implement file local storage tools: sync bpf.h header libbpf: Add bpf_probe_map_type support for file local storage tools: bpf: update bpftool for file_storage map tools: testing: Add selftest for file local storage map include/linux/bpf_lsm.h | 21 ++ include/linux/bpf_types.h | 1 + include/uapi/linux/bpf.h | 39 +++ kernel/bpf/Makefile | 2 +- kernel/bpf/bpf_file_storage.c | 244 ++++++++++++++++++ kernel/bpf/bpf_lsm.c | 4 + kernel/bpf/syscall.c | 3 +- kernel/bpf/verifier.c | 10 + security/bpf/hooks.c | 2 + .../bpf/bpftool/Documentation/bpftool-map.rst | 2 +- tools/bpf/bpftool/bash-completion/bpftool | 3 +- tools/bpf/bpftool/map.c | 3 +- tools/include/uapi/linux/bpf.h | 39 +++ tools/lib/bpf/libbpf_probes.c | 1 + .../bpf/prog_tests/test_local_storage.c | 55 ++++ .../selftests/bpf/progs/local_storage.c | 43 +++ 16 files changed, 467 insertions(+), 5 deletions(-) create mode 100644 kernel/bpf/bpf_file_storage.c -- 2.33.0
