> On Oct 24, 2023, at 4:03 PM, Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
>
> On Mon, Oct 23, 2023 at 11:30:52PM -0700, Song Liu wrote:
>> fsverity provides fast and reliable hash of files, namely fsverity_digest.
>> The digest can be used by security solutions to verify file contents.
>>
>> Add new kfunc bpf_get_fsverity_digest() so that we can access fsverity from
>> BPF LSM programs. This kfunc is added to fs/verity/measure.c because some
>> data structure used in the function is private to fsverity
>> (fs/verity/fsverity_private.h).
>>
>> To avoid recursion, bpf_get_fsverity_digest is only allowed in BPF LSM
>> programs.
>>
>> Signed-off-by: Song Liu <song@xxxxxxxxxx>
>> ---
>> fs/verity/fsverity_private.h | 10 +++++
>> fs/verity/init.c | 1 +
>> fs/verity/measure.c | 85 ++++++++++++++++++++++++++++++++++++
>> 3 files changed, 96 insertions(+)
>>
>> diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h
>> index d071a6e32581..f7124f89ab6f 100644
>> --- a/fs/verity/fsverity_private.h
>> +++ b/fs/verity/fsverity_private.h
>> @@ -145,4 +145,14 @@ static inline void fsverity_init_signature(void)
>>
>> void __init fsverity_init_workqueue(void);
>>
>> +/* measure.c */
>> +
>> +#ifdef CONFIG_BPF_SYSCALL
>> +int __init fsverity_init_bpf(void);
>> +#else
>> +static inline int fsverity_init_bpf(void)
>> +{
>> +}
>> +#endif
>
> This does not compile when !CONFIG_BPF_SYSCALL.
>
> fsverity_init_bpf() probably shouldn't have a return value, given that this code
> cannot be compiled as a loadable module. You can either panic on error, or
> ignore the error. I don't think there are any other options.
Got it. Updated fsverity_init_bpf to return void.
>
> Also, please keep the sections of this file in alphabetical order. The
> measure.c section should go between init.c and open.c sections.
>
>
>> diff --git a/fs/verity/measure.c b/fs/verity/measure.c
>> index eec5956141da..4b0617ea0499 100644
>> --- a/fs/verity/measure.c
>> +++ b/fs/verity/measure.c
>> @@ -8,6 +8,8 @@
>> #include "fsverity_private.h"
>>
>> #include <linux/uaccess.h>
>> +#include <linux/bpf.h>
>> +#include <linux/btf.h>
>
> Keep includes in alphabetical order, please.
Fixed in the next version.
Thanks,
Song
