On Mon, Oct 9, 2023 at 3:53 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > > On Wed, Sep 27, 2023 at 12:03 PM Andrii Nakryiko > <andrii.nakryiko@xxxxxxxxx> wrote: > > On Wed, Sep 27, 2023 at 2:52 AM Christian Brauner <brauner@xxxxxxxxxx> wrote: > > ... > > > > IOW, everything stays the same apart from the fact that bpf token fds > > > are actually file descriptors referring to a detached bpffs file instead > > > of an anonymous inode file. IOW, bpf tokens are actual bpffs objects > > > tied to a bpffs instance. > > > > Ah, ok, this is a much smaller change than what I was about to make. > > I'm glad I asked and thanks for elaborating! I'll use > > alloc_file_pseudo() using bpffs mount in the next revision. > > Just a FYI, I'm still looking at v6 now, but moving from an anon_inode > to a bpffs inode may mean we need to drop a LSM hook in > bpf_token_create() to help mark the inode as a BPF token. Not a big > deal either way, and I think it makes sense to use a bpffs inode as > opposed to an anonymous inode, just wanted to let you know. Thanks for the heads up. I was about to post a new revision rebased on the latest bpf-next and with an unrelated selftest fix, but I'll give it a bit more time to get your feedback and incorporate it into the next revision. Thanks! > > -- > paul-moore.com
