[RESEND PATCH bpf-next v2 1/3] bpftool: Add bpf_token show

[RESEND PATCH bpf-next v2 1/3] bpftool: Add bpf_token show

[Tao Chen]

Add `bpftool token show` command to get token info
from bpffs in /proc/mounts.

Example plain output for `token show`:
token_info  /sys/fs/bpf/token
	allowed_cmds:
	  map_create          prog_load
	allowed_maps:
	allowed_progs:
	  kprobe
	allowed_attachs:
	  xdp
token_info  /sys/fs/bpf/token2
	allowed_cmds:
	  map_create          prog_load
	allowed_maps:
	allowed_progs:
	  kprobe
	allowed_attachs:
	  xdp

Example json output for `token show`:
[{
	"token_info": "/sys/fs/bpf/token",
	"allowed_cmds": ["map_create", "prog_load"],
	"allowed_maps": [],
	"allowed_progs": ["kprobe"],
	"allowed_attachs": ["xdp"]
}, {
	"token_info": "/sys/fs/bpf/token2",
	"allowed_cmds": ["map_create", "prog_load"],
	"allowed_maps": [],
	"allowed_progs": ["kprobe"],
	"allowed_attachs": ["xdp"]
}]

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 tools/bpf/bpftool/main.c  |   3 +-
 tools/bpf/bpftool/main.h  |   1 +
 tools/bpf/bpftool/token.c | 232 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 235 insertions(+), 1 deletion(-)
 create mode 100644 tools/bpf/bpftool/token.c

Change list:
 v1 -> v2:
  Quentin suggested:
  - patch1
   - remove zclose macro.
   - rename __json_array_str to split_json_array_str
   - print empty array when value is null for json format.
   - show all tokens info and format plain output for readable.
   - add info when token not found.
   - add copyright in token.c
  - patch2
   - update 'eBPF progs' to 'eBPF tokens'.
   - update description.
  - patch3
   - add bash-completion.
 v1: https://lore.kernel.org/bpf/20250720173310.1334483-1-chen.dylane@linux.dev

diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index 2b7f2bd3a7d..0f1183b2ed0 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -61,7 +61,7 @@ static int do_help(int argc, char **argv)
 		"       %s batch file FILE\n"
 		"       %s version\n"
 		"\n"
-		"       OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter }\n"
+		"       OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter | token }\n"
 		"       " HELP_SPEC_OPTIONS " |\n"
 		"                    {-V|--version} }\n"
 		"",
@@ -87,6 +87,7 @@ static const struct cmd commands[] = {
 	{ "gen",	do_gen },
 	{ "struct_ops",	do_struct_ops },
 	{ "iter",	do_iter },
+	{ "token",	do_token },
 	{ "version",	do_version },
 	{ 0 }
 };
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 6db704fda5c..a2bb0714b3d 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -166,6 +166,7 @@ int do_tracelog(int argc, char **arg) __weak;
 int do_feature(int argc, char **argv) __weak;
 int do_struct_ops(int argc, char **argv) __weak;
 int do_iter(int argc, char **argv) __weak;
+int do_token(int argc, char **argv) __weak;
 
 int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what);
 int prog_parse_fd(int *argc, char ***argv);
diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
new file mode 100644
index 00000000000..f72a116f9c6
--- /dev/null
+++ b/tools/bpf/bpftool/token.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2025 Didi Technology Co., Tao Chen */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <mntent.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "json_writer.h"
+#include "main.h"
+
+#define MOUNTS_FILE "/proc/mounts"
+
+static bool has_delegate_options(const char *mnt_ops)
+{
+	return strstr(mnt_ops, "delegate_cmds") != NULL ||
+	       strstr(mnt_ops, "delegate_maps") != NULL ||
+	       strstr(mnt_ops, "delegate_progs") != NULL ||
+	       strstr(mnt_ops, "delegate_attachs") != NULL;
+}
+
+static char *get_delegate_value(const char *opts, const char *key)
+{
+	char *token, *rest, *ret = NULL;
+	char *opts_copy = strdup(opts);
+
+	if (!opts_copy)
+		return NULL;
+
+	for (token = strtok_r(opts_copy, ",", &rest); token != NULL;
+			token = strtok_r(NULL, ",", &rest)) {
+		if (strncmp(token, key, strlen(key)) == 0 &&
+				token[strlen(key)] == '=') {
+			ret = token + strlen(key) + 1;
+			break;
+		}
+	}
+	free(opts_copy);
+
+	return ret;
+}
+
+static void print_items_per_line(const char *input, int items_per_line)
+{
+	char *str, *rest, *strs;
+	int cnt = 0;
+
+	if (!input)
+		return;
+
+	strs = strdup(input);
+	if (!strs)
+		return;
+
+	for (str = strtok_r(strs, ":", &rest); str != NULL;
+			str = strtok_r(NULL, ":", &rest)) {
+		if (cnt % items_per_line == 0)
+			printf("\n\t  ");
+
+		printf("%-20s", str);
+		cnt++;
+	}
+
+	free(strs);
+}
+
+#define ITEMS_PER_LINE 4
+static void show_token_info_plain(struct mntent *mntent)
+{
+	char *value;
+
+	printf("token_info  %s", mntent->mnt_dir);
+
+	printf("\n\tallowed_cmds:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_maps:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_progs:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_attachs:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+	print_items_per_line(value, ITEMS_PER_LINE);
+	printf("\n");
+}
+
+static void split_json_array_str(const char *input)
+{
+	char *str, *rest, *strs;
+
+	if (!input) {
+		jsonw_start_array(json_wtr);
+		jsonw_end_array(json_wtr);
+		return;
+	}
+
+	strs = strdup(input);
+	if (!strs)
+		return;
+
+	jsonw_start_array(json_wtr);
+	for (str = strtok_r(strs, ":", &rest); str != NULL;
+			str = strtok_r(NULL, ":", &rest)) {
+		jsonw_string(json_wtr, str);
+	}
+	jsonw_end_array(json_wtr);
+
+	free(strs);
+}
+
+static void show_token_info_json(struct mntent *mntent)
+{
+	char *value;
+
+	jsonw_start_object(json_wtr);
+
+	jsonw_string_field(json_wtr, "token_info", mntent->mnt_dir);
+
+	jsonw_name(json_wtr, "allowed_cmds");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_maps");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_progs");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_attachs");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+	split_json_array_str(value);
+
+	jsonw_end_object(json_wtr);
+}
+
+static int __show_token_info(struct mntent *mntent)
+{
+
+	if (json_output)
+		show_token_info_json(mntent);
+	else
+		show_token_info_plain(mntent);
+
+	return 0;
+}
+
+static int show_token_info(void)
+{
+	FILE *fp;
+	struct mntent *ent;
+	bool hit = false;
+
+	fp = setmntent(MOUNTS_FILE, "r");
+	if (!fp) {
+		p_err("Failed to open: %s", MOUNTS_FILE);
+		return -1;
+	}
+
+	if (json_output)
+		jsonw_start_array(json_wtr);
+
+	while ((ent = getmntent(fp)) != NULL) {
+		if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
+			if (has_delegate_options(ent->mnt_opts)) {
+				__show_token_info(ent);
+				hit = true;
+			}
+		}
+	}
+
+	if (json_output)
+		jsonw_end_array(json_wtr);
+
+	if (!hit)
+		p_info("Token info not found");
+
+	endmntent(fp);
+
+	return 0;
+}
+
+static int do_show(int argc, char **argv)
+{
+	if (argc)
+		return BAD_ARG();
+
+	return show_token_info();
+}
+
+static int do_help(int argc, char **argv)
+{
+	if (json_output) {
+		jsonw_null(json_wtr);
+		return 0;
+	}
+
+	fprintf(stderr,
+		"Usage: %1$s %2$s { show | list }\n"
+		"	%1$s %2$s help\n"
+		"\n"
+		"",
+		bin_name, argv[-2]);
+	return 0;
+}
+
+static const struct cmd cmds[] = {
+	{ "show",	do_show },
+	{ "list",	do_show },
+	{ "help",	do_help },
+	{ 0 }
+};
+
+int do_token(int argc, char **argv)
+{
+	return cmd_select(cmds, argc, argv, do_help);
+}
-- 
2.48.1

[PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage

[Tao Chen]

Add bpftool-token manpage with information and examples of token-related
commands.

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 .../bpftool/Documentation/bpftool-token.rst   | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 tools/bpf/bpftool/Documentation/bpftool-token.rst

diff --git a/tools/bpf/bpftool/Documentation/bpftool-token.rst b/tools/bpf/bpftool/Documentation/bpftool-token.rst
new file mode 100644
index 00000000000..c5fe9292258
--- /dev/null
+++ b/tools/bpf/bpftool/Documentation/bpftool-token.rst
@@ -0,0 +1,63 @@
+.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+
+================
+bpftool-token
+================
+-------------------------------------------------------------------------------
+tool for inspection and simple manipulation of eBPF tokens
+-------------------------------------------------------------------------------
+
+:Manual section: 8
+
+.. include:: substitutions.rst
+
+SYNOPSIS
+========
+
+**bpftool** [*OPTIONS*] **token** *COMMAND*
+
+*OPTIONS* := { |COMMON_OPTIONS| }
+
+*COMMANDS* := { **show** | **list** | **help** }
+
+TOKEN COMMANDS
+===============
+
+| **bpftool** **token** { **show** | **list** }
+| **bpftool** **token help**
+|
+
+DESCRIPTION
+===========
+bpftool token { show | list }
+    List all the speciafic allowed types for **bpf**\ () system call
+    commands, maps, programs, and attach types, as well as the
+    *bpffs* mount point used to set the token information.
+
+bpftool prog help
+    Print short help message.
+
+OPTIONS
+========
+.. include:: common_options.rst
+
+EXAMPLES
+========
+|
+| **# mkdir -p /sys/fs/bpf/token**
+| **# mount -t bpf bpffs /sys/fs/bpf/token** \
+|         **-o delegate_cmds=prog_load:map_create** \
+|         **-o delegate_progs=kprobe** \
+|         **-o delegate_attachs=xdp**
+| **# bpftool token list**
+
+::
+
+    token_info  /sys/fs/bpf/token
+            allowed_cmds:
+              map_create          prog_load
+            allowed_maps:
+            allowed_progs:
+              kprobe
+            allowed_attachs:
+              xdp
-- 
2.48.1

Re: [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage

[Quentin Monnet]

2025-07-22 20:09 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
> Add bpftool-token manpage with information and examples of token-related
> commands.
> 
> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
> ---
>  .../bpftool/Documentation/bpftool-token.rst   | 63 +++++++++++++++++++
>  1 file changed, 63 insertions(+)
>  create mode 100644 tools/bpf/bpftool/Documentation/bpftool-token.rst
> 
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-token.rst b/tools/bpf/bpftool/Documentation/bpftool-token.rst
> new file mode 100644
> index 00000000000..c5fe9292258
> --- /dev/null
> +++ b/tools/bpf/bpftool/Documentation/bpftool-token.rst
> @@ -0,0 +1,63 @@
> +.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +
> +================
> +bpftool-token
> +================
> +-------------------------------------------------------------------------------
> +tool for inspection and simple manipulation of eBPF tokens
> +-------------------------------------------------------------------------------
> +
> +:Manual section: 8
> +
> +.. include:: substitutions.rst
> +
> +SYNOPSIS
> +========
> +
> +**bpftool** [*OPTIONS*] **token** *COMMAND*
> +
> +*OPTIONS* := { |COMMON_OPTIONS| }
> +
> +*COMMANDS* := { **show** | **list** | **help** }
> +
> +TOKEN COMMANDS
> +===============
> +
> +| **bpftool** **token** { **show** | **list** }
> +| **bpftool** **token help**
> +|
> +
> +DESCRIPTION
> +===========
> +bpftool token { show | list }
> +    List all the speciafic allowed types for **bpf**\ () system call


Typo: "speciafic". 


> +    commands, maps, programs, and attach types, as well as the
> +    *bpffs* mount point used to set the token information.


This sentence needs to be adjusted now that you can print info for
several mountpoints.

How about:

    List BPF token information for each *bpffs* mount point containing token
    information on the system. Information include mount point path, allowed
    **bpf**\ () system call commands, maps, programs, and attach types for the
    token.


> +
> +bpftool prog help
> +    Print short help message.
> +
> +OPTIONS
> +========
> +.. include:: common_options.rst
> +
> +EXAMPLES
> +========
> +|
> +| **# mkdir -p /sys/fs/bpf/token**
> +| **# mount -t bpf bpffs /sys/fs/bpf/token** \
> +|         **-o delegate_cmds=prog_load:map_create** \
> +|         **-o delegate_progs=kprobe** \
> +|         **-o delegate_attachs=xdp**
> +| **# bpftool token list**
> +
> +::
> +
> +    token_info  /sys/fs/bpf/token
> +            allowed_cmds:
> +              map_create          prog_load
> +            allowed_maps:
> +            allowed_progs:
> +              kprobe
> +            allowed_attachs:
> +              xdp

Re: [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage

[Tao Chen]

在 2025/7/22 23:01, Quentin Monnet 写道:
> 2025-07-22 20:09 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
>> Add bpftool-token manpage with information and examples of token-related
>> commands.
>>
>> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
>> ---
>>   .../bpftool/Documentation/bpftool-token.rst   | 63 +++++++++++++++++++
>>   1 file changed, 63 insertions(+)
>>   create mode 100644 tools/bpf/bpftool/Documentation/bpftool-token.rst
>>
>> diff --git a/tools/bpf/bpftool/Documentation/bpftool-token.rst b/tools/bpf/bpftool/Documentation/bpftool-token.rst
>> new file mode 100644
>> index 00000000000..c5fe9292258
>> --- /dev/null
>> +++ b/tools/bpf/bpftool/Documentation/bpftool-token.rst
>> @@ -0,0 +1,63 @@
>> +.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
>> +
>> +================
>> +bpftool-token
>> +================
>> +-------------------------------------------------------------------------------
>> +tool for inspection and simple manipulation of eBPF tokens
>> +-------------------------------------------------------------------------------
>> +
>> +:Manual section: 8
>> +
>> +.. include:: substitutions.rst
>> +
>> +SYNOPSIS
>> +========
>> +
>> +**bpftool** [*OPTIONS*] **token** *COMMAND*
>> +
>> +*OPTIONS* := { |COMMON_OPTIONS| }
>> +
>> +*COMMANDS* := { **show** | **list** | **help** }
>> +
>> +TOKEN COMMANDS
>> +===============
>> +
>> +| **bpftool** **token** { **show** | **list** }
>> +| **bpftool** **token help**
>> +|
>> +
>> +DESCRIPTION
>> +===========
>> +bpftool token { show | list }
>> +    List all the speciafic allowed types for **bpf**\ () system call
> 
> 
> Typo: "speciafic".
> 

will fix it, thanks.

> 
>> +    commands, maps, programs, and attach types, as well as the
>> +    *bpffs* mount point used to set the token information.
> 
> 
> This sentence needs to be adjusted now that you can print info for
> several mountpoints.
> 
> How about:
> 
>      List BPF token information for each *bpffs* mount point containing token
>      information on the system. Information include mount point path, allowed
>      **bpf**\ () system call commands, maps, programs, and attach types for the
>      token.
> 

This really looks better, thank you for your help.

> 
>> +
>> +bpftool prog help
>> +    Print short help message.
>> +
>> +OPTIONS
>> +========
>> +.. include:: common_options.rst
>> +
>> +EXAMPLES
>> +========
>> +|
>> +| **# mkdir -p /sys/fs/bpf/token**
>> +| **# mount -t bpf bpffs /sys/fs/bpf/token** \
>> +|         **-o delegate_cmds=prog_load:map_create** \
>> +|         **-o delegate_progs=kprobe** \
>> +|         **-o delegate_attachs=xdp**
>> +| **# bpftool token list**
>> +
>> +::
>> +
>> +    token_info  /sys/fs/bpf/token
>> +            allowed_cmds:
>> +              map_create          prog_load
>> +            allowed_maps:
>> +            allowed_progs:
>> +              kprobe
>> +            allowed_attachs:
>> +              xdp
> 


-- 
Best Regards
Tao Chen

[PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument

[Tao Chen]

This commit updates the bash completion script with the new token
argument.
$ bpftool
batch       cgroup      gen         iter        map         perf        struct_ops
btf         feature     help        link        net         prog        token

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 tools/bpf/bpftool/bash-completion/bpftool | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index a759ba24471..527bb47ac46 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -1215,6 +1215,17 @@ _bpftool()
                     ;;
             esac
             ;;
+        token)
+            case $command in
+               show|list)
+                   return 0
+                   ;;
+               *)
+                   [[ $prev == $object ]] && \
+                       COMPREPLY=( $( compgen -W 'help show list' -- "$cur" ) )
+                   ;;
+            esac
+            ;;
     esac
 } &&
 complete -F _bpftool bpftool
-- 
2.48.1

Re: [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument

[Quentin Monnet]

2025-07-22 20:09 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
> This commit updates the bash completion script with the new token
> argument.
> $ bpftool
> batch       cgroup      gen         iter        map         perf        struct_ops
> btf         feature     help        link        net         prog        token


This is a terrible example, offering "token" as completion for just
"bpftool [tab]" works without this patch :) The main commands are parsed
from the output of "bpftool help" so it should work after your first
patch. In this one, we add "list", "show" and "help" for completing
"bpftool token [tab]".


> 
> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
> ---
>  tools/bpf/bpftool/bash-completion/bpftool | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
> index a759ba24471..527bb47ac46 100644
> --- a/tools/bpf/bpftool/bash-completion/bpftool
> +++ b/tools/bpf/bpftool/bash-completion/bpftool
> @@ -1215,6 +1215,17 @@ _bpftool()
>                      ;;
>              esac
>              ;;
> +        token)
> +            case $command in
> +               show|list)
> +                   return 0
> +                   ;;
> +               *)
> +                   [[ $prev == $object ]] && \
> +                       COMPREPLY=( $( compgen -W 'help show list' -- "$cur" ) )
> +                   ;;
> +            esac
> +            ;;
>      esac
>  } &&
>  complete -F _bpftool bpftool


Other than the example in the description, this looks good.

Reviewed-by: Quentin Monnet <qmo@kernel.org>

Thanks

Re: [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument

[Tao Chen]

在 2025/7/22 23:02, Quentin Monnet 写道:
> 2025-07-22 20:09 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
>> This commit updates the bash completion script with the new token
>> argument.
>> $ bpftool
>> batch       cgroup      gen         iter        map         perf        struct_ops
>> btf         feature     help        link        net         prog        token
> 
> 
> This is a terrible example, offering "token" as completion for just
> "bpftool [tab]" works without this patch :) The main commands are parsed
> from the output of "bpftool help" so it should work after your first
> patch. In this one, we add "list", "show" and "help" for completing
> "bpftool token [tab]".
> 

As you said, how about this one? I will change it in v3, thanks.
     $ bpftool token
     help  list  show

> 
>>
>> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
>> ---
>>   tools/bpf/bpftool/bash-completion/bpftool | 11 +++++++++++
>>   1 file changed, 11 insertions(+)
>>
>> diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
>> index a759ba24471..527bb47ac46 100644
>> --- a/tools/bpf/bpftool/bash-completion/bpftool
>> +++ b/tools/bpf/bpftool/bash-completion/bpftool
>> @@ -1215,6 +1215,17 @@ _bpftool()
>>                       ;;
>>               esac
>>               ;;
>> +        token)
>> +            case $command in
>> +               show|list)
>> +                   return 0
>> +                   ;;
>> +               *)
>> +                   [[ $prev == $object ]] && \
>> +                       COMPREPLY=( $( compgen -W 'help show list' -- "$cur" ) )
>> +                   ;;
>> +            esac
>> +            ;;
>>       esac
>>   } &&
>>   complete -F _bpftool bpftool
> 
> 
> Other than the example in the description, this looks good.
> 
> Reviewed-by: Quentin Monnet <qmo@kernel.org>
> 
> Thanks


-- 
Best Regards
Tao Chen

Re: [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument

[Quentin Monnet]

2025-07-23 00:35 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
> 在 2025/7/22 23:02, Quentin Monnet 写道:
>> 2025-07-22 20:09 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
>>> This commit updates the bash completion script with the new token
>>> argument.
>>> $ bpftool
>>> batch       cgroup      gen         iter        map        
>>> perf        struct_ops
>>> btf         feature     help        link        net        
>>> prog        token
>>
>>
>> This is a terrible example, offering "token" as completion for just
>> "bpftool [tab]" works without this patch :) The main commands are parsed
>> from the output of "bpftool help" so it should work after your first
>> patch. In this one, we add "list", "show" and "help" for completing
>> "bpftool token [tab]".
>>
> 
> As you said, how about this one? I will change it in v3, thanks.
>     $ bpftool token
>     help  list  show

Yes, perfect

[PATCH bpf-next v2 1/3] bpftool: Add bpf_token show

[Tao Chen]

Add `bpftool token show` command to get token info
from bpffs in /proc/mounts.

Example plain output for `token show`:
token_info  /sys/fs/bpf/token
	allowed_cmds:
	  map_create          prog_load
	allowed_maps:
	allowed_progs:
	  kprobe
	allowed_attachs:
	  xdp
token_info  /sys/fs/bpf/token2
	allowed_cmds:
	  map_create          prog_load
	allowed_maps:
	allowed_progs:
	  kprobe
	allowed_attachs:
	  xdp

Example json output for `token show`:
[{
	"token_info": "/sys/fs/bpf/token",
	"allowed_cmds": ["map_create", "prog_load"],
	"allowed_maps": [],
	"allowed_progs": ["kprobe"],
	"allowed_attachs": ["xdp"]
}, {
	"token_info": "/sys/fs/bpf/token2",
	"allowed_cmds": ["map_create", "prog_load"],
	"allowed_maps": [],
	"allowed_progs": ["kprobe"],
	"allowed_attachs": ["xdp"]
}]

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 tools/bpf/bpftool/main.c  |   3 +-
 tools/bpf/bpftool/main.h  |   1 +
 tools/bpf/bpftool/token.c | 232 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 235 insertions(+), 1 deletion(-)
 create mode 100644 tools/bpf/bpftool/token.c

diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index 2b7f2bd3a7d..0f1183b2ed0 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -61,7 +61,7 @@ static int do_help(int argc, char **argv)
 		"       %s batch file FILE\n"
 		"       %s version\n"
 		"\n"
-		"       OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter }\n"
+		"       OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter | token }\n"
 		"       " HELP_SPEC_OPTIONS " |\n"
 		"                    {-V|--version} }\n"
 		"",
@@ -87,6 +87,7 @@ static const struct cmd commands[] = {
 	{ "gen",	do_gen },
 	{ "struct_ops",	do_struct_ops },
 	{ "iter",	do_iter },
+	{ "token",	do_token },
 	{ "version",	do_version },
 	{ 0 }
 };
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 6db704fda5c..a2bb0714b3d 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -166,6 +166,7 @@ int do_tracelog(int argc, char **arg) __weak;
 int do_feature(int argc, char **argv) __weak;
 int do_struct_ops(int argc, char **argv) __weak;
 int do_iter(int argc, char **argv) __weak;
+int do_token(int argc, char **argv) __weak;
 
 int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what);
 int prog_parse_fd(int *argc, char ***argv);
diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
new file mode 100644
index 00000000000..f72a116f9c6
--- /dev/null
+++ b/tools/bpf/bpftool/token.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2025 Didi Technology Co., Tao Chen */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <mntent.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "json_writer.h"
+#include "main.h"
+
+#define MOUNTS_FILE "/proc/mounts"
+
+static bool has_delegate_options(const char *mnt_ops)
+{
+	return strstr(mnt_ops, "delegate_cmds") != NULL ||
+	       strstr(mnt_ops, "delegate_maps") != NULL ||
+	       strstr(mnt_ops, "delegate_progs") != NULL ||
+	       strstr(mnt_ops, "delegate_attachs") != NULL;
+}
+
+static char *get_delegate_value(const char *opts, const char *key)
+{
+	char *token, *rest, *ret = NULL;
+	char *opts_copy = strdup(opts);
+
+	if (!opts_copy)
+		return NULL;
+
+	for (token = strtok_r(opts_copy, ",", &rest); token != NULL;
+			token = strtok_r(NULL, ",", &rest)) {
+		if (strncmp(token, key, strlen(key)) == 0 &&
+				token[strlen(key)] == '=') {
+			ret = token + strlen(key) + 1;
+			break;
+		}
+	}
+	free(opts_copy);
+
+	return ret;
+}
+
+static void print_items_per_line(const char *input, int items_per_line)
+{
+	char *str, *rest, *strs;
+	int cnt = 0;
+
+	if (!input)
+		return;
+
+	strs = strdup(input);
+	if (!strs)
+		return;
+
+	for (str = strtok_r(strs, ":", &rest); str != NULL;
+			str = strtok_r(NULL, ":", &rest)) {
+		if (cnt % items_per_line == 0)
+			printf("\n\t  ");
+
+		printf("%-20s", str);
+		cnt++;
+	}
+
+	free(strs);
+}
+
+#define ITEMS_PER_LINE 4
+static void show_token_info_plain(struct mntent *mntent)
+{
+	char *value;
+
+	printf("token_info  %s", mntent->mnt_dir);
+
+	printf("\n\tallowed_cmds:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_maps:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_progs:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+	print_items_per_line(value, ITEMS_PER_LINE);
+
+	printf("\n\tallowed_attachs:");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+	print_items_per_line(value, ITEMS_PER_LINE);
+	printf("\n");
+}
+
+static void split_json_array_str(const char *input)
+{
+	char *str, *rest, *strs;
+
+	if (!input) {
+		jsonw_start_array(json_wtr);
+		jsonw_end_array(json_wtr);
+		return;
+	}
+
+	strs = strdup(input);
+	if (!strs)
+		return;
+
+	jsonw_start_array(json_wtr);
+	for (str = strtok_r(strs, ":", &rest); str != NULL;
+			str = strtok_r(NULL, ":", &rest)) {
+		jsonw_string(json_wtr, str);
+	}
+	jsonw_end_array(json_wtr);
+
+	free(strs);
+}
+
+static void show_token_info_json(struct mntent *mntent)
+{
+	char *value;
+
+	jsonw_start_object(json_wtr);
+
+	jsonw_string_field(json_wtr, "token_info", mntent->mnt_dir);
+
+	jsonw_name(json_wtr, "allowed_cmds");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_maps");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_progs");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+	split_json_array_str(value);
+
+	jsonw_name(json_wtr, "allowed_attachs");
+	value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+	split_json_array_str(value);
+
+	jsonw_end_object(json_wtr);
+}
+
+static int __show_token_info(struct mntent *mntent)
+{
+
+	if (json_output)
+		show_token_info_json(mntent);
+	else
+		show_token_info_plain(mntent);
+
+	return 0;
+}
+
+static int show_token_info(void)
+{
+	FILE *fp;
+	struct mntent *ent;
+	bool hit = false;
+
+	fp = setmntent(MOUNTS_FILE, "r");
+	if (!fp) {
+		p_err("Failed to open: %s", MOUNTS_FILE);
+		return -1;
+	}
+
+	if (json_output)
+		jsonw_start_array(json_wtr);
+
+	while ((ent = getmntent(fp)) != NULL) {
+		if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
+			if (has_delegate_options(ent->mnt_opts)) {
+				__show_token_info(ent);
+				hit = true;
+			}
+		}
+	}
+
+	if (json_output)
+		jsonw_end_array(json_wtr);
+
+	if (!hit)
+		p_info("Token info not found");
+
+	endmntent(fp);
+
+	return 0;
+}
+
+static int do_show(int argc, char **argv)
+{
+	if (argc)
+		return BAD_ARG();
+
+	return show_token_info();
+}
+
+static int do_help(int argc, char **argv)
+{
+	if (json_output) {
+		jsonw_null(json_wtr);
+		return 0;
+	}
+
+	fprintf(stderr,
+		"Usage: %1$s %2$s { show | list }\n"
+		"	%1$s %2$s help\n"
+		"\n"
+		"",
+		bin_name, argv[-2]);
+	return 0;
+}
+
+static const struct cmd cmds[] = {
+	{ "show",	do_show },
+	{ "list",	do_show },
+	{ "help",	do_help },
+	{ 0 }
+};
+
+int do_token(int argc, char **argv)
+{
+	return cmd_select(cmds, argc, argv, do_help);
+}
-- 
2.48.1

[PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage

[Tao Chen]

Add bpftool-token manpage with information and examples of token-related
commands.

Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
 .../bpftool/Documentation/bpftool-token.rst   | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 tools/bpf/bpftool/Documentation/bpftool-token.rst

diff --git a/tools/bpf/bpftool/Documentation/bpftool-token.rst b/tools/bpf/bpftool/Documentation/bpftool-token.rst
new file mode 100644
index 00000000000..c5fe9292258
--- /dev/null
+++ b/tools/bpf/bpftool/Documentation/bpftool-token.rst
@@ -0,0 +1,63 @@
+.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+
+================
+bpftool-token
+================
+-------------------------------------------------------------------------------
+tool for inspection and simple manipulation of eBPF tokens
+-------------------------------------------------------------------------------
+
+:Manual section: 8
+
+.. include:: substitutions.rst
+
+SYNOPSIS
+========
+
+**bpftool** [*OPTIONS*] **token** *COMMAND*
+
+*OPTIONS* := { |COMMON_OPTIONS| }
+
+*COMMANDS* := { **show** | **list** | **help** }
+
+TOKEN COMMANDS
+===============
+
+| **bpftool** **token** { **show** | **list** }
+| **bpftool** **token help**
+|
+
+DESCRIPTION
+===========
+bpftool token { show | list }
+    List all the speciafic allowed types for **bpf**\ () system call
+    commands, maps, programs, and attach types, as well as the
+    *bpffs* mount point used to set the token information.
+
+bpftool prog help
+    Print short help message.
+
+OPTIONS
+========
+.. include:: common_options.rst
+
+EXAMPLES
+========
+|
+| **# mkdir -p /sys/fs/bpf/token**
+| **# mount -t bpf bpffs /sys/fs/bpf/token** \
+|         **-o delegate_cmds=prog_load:map_create** \
+|         **-o delegate_progs=kprobe** \
+|         **-o delegate_attachs=xdp**
+| **# bpftool token list**
+
+::
+
+    token_info  /sys/fs/bpf/token
+            allowed_cmds:
+              map_create          prog_load
+            allowed_maps:
+            allowed_progs:
+              kprobe
+            allowed_attachs:
+              xdp
-- 
2.48.1