From: "Theodore Ts'o" <tytso@mit.edu>
To: Song Liu <song@kernel.org>
Cc: bpf@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, kernel-team@meta.com,
andrii@kernel.org, eddyz87@gmail.com, ast@kernel.org,
daniel@iogearbox.net, martin.lau@linux.dev,
viro@zeniv.linux.org.uk, brauner@kernel.org, jack@suse.cz,
kpsingh@kernel.org, mattbobrowski@google.com,
liamwisehart@meta.com, shankaran@meta.com
Subject: Re: [PATCH v3 bpf-next 0/6] Enable writing xattr from BPF programs
Date: Wed, 11 Dec 2024 08:18:04 -0500 [thread overview]
Message-ID: <20241211131804.GA1912640@mit.edu> (raw)
In-Reply-To: <20241210220627.2800362-1-song@kernel.org>
On Tue, Dec 10, 2024 at 02:06:21PM -0800, Song Liu wrote:
> Add support to set and remove xattr from BPF program. Also add
> security.bpf. xattr name prefix.
If the system allows for the execution of unprivileged BPF programs
(e.g., ones where a random user can load their own BPF programs), will
they have hte ability to set and remove security.bpf.* xattrs? If the
answer is yes, should this be disallowed?
I note that one of the use cases seems to be BPF-based LSM's, so we
may want to have something even more restrictive since otherwise any
BPF program could potentially have the same power as the LSM?
- Ted
next prev parent reply other threads:[~2024-12-11 13:18 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-10 22:06 [PATCH v3 bpf-next 0/6] Enable writing xattr from BPF programs Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 1/6] fs/xattr: bpf: Introduce security.bpf. xattr name prefix Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 2/6] selftests/bpf: Extend test fs_kfuncs to cover security.bpf. xattr names Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 3/6] bpf: lsm: Add two more sleepable hooks Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 4/6] bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs Song Liu
2024-12-12 10:24 ` Jan Kara
2024-12-12 18:01 ` Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 5/6] selftests/bpf: Test kfuncs that set and remove xattr from BPF programs Song Liu
2024-12-10 22:06 ` [PATCH v3 bpf-next 6/6] selftests/bpf: Add __failure tests for set/remove xattr kfuncs Song Liu
2024-12-11 13:18 ` Theodore Ts'o [this message]
2024-12-11 16:48 ` [PATCH v3 bpf-next 0/6] Enable writing xattr from BPF programs Song Liu
2024-12-12 19:39 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241211131804.GA1912640@mit.edu \
--to=tytso@mit.edu \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=jack@suse.cz \
--cc=kernel-team@meta.com \
--cc=kpsingh@kernel.org \
--cc=liamwisehart@meta.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mattbobrowski@google.com \
--cc=shankaran@meta.com \
--cc=song@kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.