On Tue, Jul 15, 2025 at 3:27 PM Blaise Boscaccy
[off-list ref] wrote:
[...]

+/**
+ * lsm_bpf_map_alloc - allocate a composite bpf_map blob
+ * @map: the bpf_map that needs a blob
+ *
+ * Allocate the bpf_map blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_bpf_map_alloc(struct bpf_map *map)
+{
+       if (blob_sizes.lbs_bpf_map == 0) {
+               map->security = NULL;
+               return 0;
+       }
+
+       map->security = kzalloc(blob_sizes.lbs_bpf_map, GFP_KERNEL);
+       if (!map->security)
+               return -ENOMEM;
+
+       return 0;
+}
+
+/**
+ * lsm_bpf_prog_alloc - allocate a composite bpf_prog blob
+ * @prog: the bpf_prog that needs a blob
+ *
+ * Allocate the bpf_prog blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_bpf_prog_alloc(struct bpf_prog *prog)
+{
+       if (blob_sizes.lbs_bpf_prog == 0) {
+               prog->aux->security = NULL;
+               return 0;
+       }
+
+       prog->aux->security = kzalloc(blob_sizes.lbs_bpf_prog, GFP_KERNEL);
+       if (!prog->aux->security)
+               return -ENOMEM;
+
+       return 0;
+}
+
+/**
+ * lsm_bpf_token_alloc - allocate a composite bpf_token blob
+ * @token: the bpf_token that needs a blob
+ *
+ * Allocate the bpf_token blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_bpf_token_alloc(struct bpf_token *token)
+{
+       if (blob_sizes.lbs_bpf_token == 0) {
+               token->security = NULL;
+               return 0;
+       }
+
+       token->security = kzalloc(blob_sizes.lbs_bpf_token, GFP_KERNEL);
+       if (!token->security)
+               return -ENOMEM;
+
+       return 0;
+}

We need the above 3 functions inside #ifdef CONFIG_BPF_SYSCALL.

Also, can we use lsm_blob_alloc() in these functions?

Thanks,
Song

[...]