On Wed, Nov 29, 2023 at 1:37 AM Song Liu <song@xxxxxxxxxx> wrote: > > It is common practice for security solutions to store tags/labels in > xattrs. To implement similar functionalities in BPF LSM, add new kfunc > bpf_get_file_xattr(). > > The first use case of bpf_get_file_xattr() is to implement file > verifications with asymmetric keys. Specificially, security applications > could use fsverity for file hashes and use xattr to store file signatures. > (kfunc for fsverity hash will be added in a separate commit.) > > Currently, only xattrs with "user." prefix can be read with kfunc > bpf_get_file_xattr(). As use cases evolve, we may add a dedicated prefix > for bpf_get_file_xattr(). > > To avoid recursion, bpf_get_file_xattr can be only called from LSM hooks. > > Signed-off-by: Song Liu <song@xxxxxxxxxx> > Acked-by: Christian Brauner <brauner@xxxxxxxxxx> Acked-by: KP Singh <kpsingh@xxxxxxxxxx>
