From: Eric Biggers <ebiggers@kernel.org>
To: Song Liu <song@kernel.org>
Cc: bpf@vger.kernel.org, fsverity@lists.linux.dev, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, martin.lau@kernel.org,
kernel-team@meta.com, tytso@mit.edu,
roberto.sassu@huaweicloud.com
Subject: Re: [PATCH v5 bpf-next 5/9] bpf, fsverity: Add kfunc bpf_get_fsverity_digest
Date: Tue, 24 Oct 2023 16:03:37 -0700 [thread overview]
Message-ID: <20231024230337.GA2320@sol.localdomain> (raw)
In-Reply-To: <20231024063056.1008702-6-song@kernel.org>
On Mon, Oct 23, 2023 at 11:30:52PM -0700, Song Liu wrote:
> fsverity provides fast and reliable hash of files, namely fsverity_digest.
> The digest can be used by security solutions to verify file contents.
>
> Add new kfunc bpf_get_fsverity_digest() so that we can access fsverity from
> BPF LSM programs. This kfunc is added to fs/verity/measure.c because some
> data structure used in the function is private to fsverity
> (fs/verity/fsverity_private.h).
>
> To avoid recursion, bpf_get_fsverity_digest is only allowed in BPF LSM
> programs.
>
> Signed-off-by: Song Liu <song@kernel.org>
> ---
> fs/verity/fsverity_private.h | 10 +++++
> fs/verity/init.c | 1 +
> fs/verity/measure.c | 85 ++++++++++++++++++++++++++++++++++++
> 3 files changed, 96 insertions(+)
>
> diff --git a/fs/verity/fsverity_private.h b/fs/verity/fsverity_private.h
> index d071a6e32581..f7124f89ab6f 100644
> --- a/fs/verity/fsverity_private.h
> +++ b/fs/verity/fsverity_private.h
> @@ -145,4 +145,14 @@ static inline void fsverity_init_signature(void)
>
> void __init fsverity_init_workqueue(void);
>
> +/* measure.c */
> +
> +#ifdef CONFIG_BPF_SYSCALL
> +int __init fsverity_init_bpf(void);
> +#else
> +static inline int fsverity_init_bpf(void)
> +{
> +}
> +#endif
This does not compile when !CONFIG_BPF_SYSCALL.
fsverity_init_bpf() probably shouldn't have a return value, given that this code
cannot be compiled as a loadable module. You can either panic on error, or
ignore the error. I don't think there are any other options.
Also, please keep the sections of this file in alphabetical order. The
measure.c section should go between init.c and open.c sections.
> diff --git a/fs/verity/measure.c b/fs/verity/measure.c
> index eec5956141da..4b0617ea0499 100644
> --- a/fs/verity/measure.c
> +++ b/fs/verity/measure.c
> @@ -8,6 +8,8 @@
> #include "fsverity_private.h"
>
> #include <linux/uaccess.h>
> +#include <linux/bpf.h>
> +#include <linux/btf.h>
Keep includes in alphabetical order, please.
- Eric
next prev parent reply other threads:[~2023-10-24 23:03 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-24 6:30 [PATCH v5 bpf-next 0/9] bpf: File verification with LSM and fsverity Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 1/9] bpf: Expose bpf_dynptr_slice* kfuncs for in kernel use Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 2/9] bpf: Factor out helper check_reg_const_str() Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 3/9] bpf: Introduce KF_ARG_PTR_TO_CONST_STR Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 4/9] bpf: Add kfunc bpf_get_file_xattr Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 5/9] bpf, fsverity: Add kfunc bpf_get_fsverity_digest Song Liu
2023-10-24 23:03 ` Eric Biggers [this message]
2023-10-24 23:21 ` Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 6/9] Documentation/bpf: Add documentation for filesystem kfuncs Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 7/9] selftests/bpf: Sort config in alphabetic order Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 8/9] selftests/bpf: Add tests for filesystem kfuncs Song Liu
2023-10-24 6:30 ` [PATCH v5 bpf-next 9/9] selftests/bpf: Add test that uses fsverity and xattr to sign a file Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231024230337.GA2320@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=fsverity@lists.linux.dev \
--cc=kernel-team@meta.com \
--cc=martin.lau@kernel.org \
--cc=roberto.sassu@huaweicloud.com \
--cc=song@kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.