Re: [PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option... | linux-security-module

[PATCH bpf-next 0/8] BPF token support in libbpf's BPF object · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
[PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
Re: [PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS · Christian Brauner <brauner@kernel.org> · 2023-12-08
Re: [PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS · Andrii Nakryiko <hidden> · 2023-12-08
RE: [PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 2/8] libbpf: split feature detectors definitions from cached results · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 2/8] libbpf: split feature detectors definitions from cached results · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 5/8] libbpf: wire up token_fd into feature probing logic · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 5/8] libbpf: wire up token_fd into feature probing logic · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 6/8] libbpf: wire up BPF token support at BPF object level · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 6/8] libbpf: wire up BPF token support at BPF object level · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
Re: [PATCH bpf-next 6/8] libbpf: wire up BPF token support at BPF object level · Andrii Nakryiko <hidden> · 2023-12-12
Re: [PATCH bpf-next 6/8] libbpf: wire up BPF token support at BPF object level · John Fastabend <john.fastabend@gmail.com> · 2023-12-12
[PATCH bpf-next 7/8] selftests/bpf: add BPF object loading tests with explicit token passing · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 7/8] selftests/bpf: add BPF object loading tests with explicit token passing · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 8/8] selftests/bpf: add tests for BPF object load with implicit token · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 8/8] selftests/bpf: add tests for BPF object load with implicit token · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 4/8] libbpf: move feature detection code into its own file · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
RE: [PATCH bpf-next 4/8] libbpf: move feature detection code into its own file · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
[PATCH bpf-next 3/8] libbpf: further decouple feature checking logic from bpf_object · Andrii Nakryiko <andrii@kernel.org> · 2023-12-07
Re: [PATCH bpf-next 3/8] libbpf: further decouple feature checking logic from bpf_object · Eduard Zingerman <eddyz87@gmail.com> · 2023-12-10
Re: [PATCH bpf-next 3/8] libbpf: further decouple feature checking logic from bpf_object · Andrii Nakryiko <hidden> · 2023-12-11
RE: [PATCH bpf-next 3/8] libbpf: further decouple feature checking logic from bpf_object · John Fastabend <john.fastabend@gmail.com> · 2023-12-11
Re: [PATCH bpf-next 3/8] libbpf: further decouple feature checking logic from bpf_object · Andrii Nakryiko <hidden> · 2023-12-11
Re: [PATCH bpf-next 0/8] BPF token support in libbpf's BPF object · Eduard Zingerman <eddyz87@gmail.com> · 2023-12-10
Re: [PATCH bpf-next 0/8] BPF token support in libbpf's BPF object · Andrii Nakryiko <hidden> · 2023-12-11

Re: [PATCH bpf-next 1/8] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS

From: Christian Brauner <brauner@kernel.org>
Date: 2023-12-08 21:49:56
Also in: bpf, linux-fsdevel, netdev

On Thu, Dec 07, 2023 at 10:54:36AM -0800, Andrii Nakryiko wrote:

It's quite confusing in practice when it's possible to successfully
create a BPF token from BPF FS that didn't have any of delegate_xxx
mount options set up. While it's not wrong, it's actually more
meaningful to reject BPF_TOKEN_CREATE with specific error code (-ENOENT)
to let user-space know that no token delegation is setup up.

So, instead of creating empty BPF token that will be always ignored
because it doesn't have any of the allow_xxx bits set, reject it with
-ENOENT. If we ever need empty BPF token to be possible, we can support
that with extra flag passed into BPF_TOKEN_CREATE.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---

Might consider EOPNOTSUPP (or whatever the correct way of spelling this
is). Otherwise,
Acked-by: Christian Brauner <brauner@kernel.org>

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help