Re: [GIT PULL] BPF changes for 7.4

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 21, 2026 at 06:26 PM Paul Moore <paul@paul-moore.com> wrote:
>
> "... just as the maintenence of bpf_fs_funcs.c falls to the VFS." is
> the rest of that sentence.  We're not asking for a type of
> cross-subsystem relationship without precedent.

That file has a history.

Nov 2023. Song added bpf_get_file_xattr() for BPF LSM progs to
kernel/trace/bpf_trace.c:
commit ac9c05e0e453 ("bpf: Add kfunc bpf_get_file_xattr")

Mar 2024. Matt's v2 was adding more kfuncs for BPF LSM progs next to it.
Christian replied:
"Conditio sine qua non is that all such kfunc definitions must live in
the respective file in fs/. They won't be hidden somewhere in
kernel/bpf/."
https://lore.kernel.org/bpf/20240306-zeitumstellung-darben-7857ca9817c0@brauner/

Jul 2024. After discussions with Christian at LSFMMBPF Matt created
fs/bpf_fs_kfuncs.c in v3:
commit d08e2045ebf0 ("bpf: introduce new VFS based BPF kfuncs")
Christian acked it and asked for more:
"I also wouldn't mind follow-up patches that move the xattr bpf kfuncs
under fs/ as well."
https://lore.kernel.org/bpf/20240726-clown-geantwortet-eb29a17890c3@brauner/

Aug 2024. Song moved bpf_get_file_xattr() there:
commit fa4e5afa9758 ("bpf: Move bpf_get_file_xattr to fs/bpf_fs_kfuncs.c")
"We are putting all fs kfuncs in fs/bpf_fs_kfuncs.c."

Every xattr kfunc since then went there: bpf_get_dentry_xattr(),
bpf_{set,remove}_dentry_xattr(), bpf_cgroup_read_xattr() from Song,
bpf_sock_read_xattr() from Christian.
David's v1 in April put the new one next to them.
It cannot be in fs/ and in security/ at the same time.

> One might question the placement of some of the other BPF kfuncs
> located in bpf_fs_kfuncs.c as the file is conditionally built based on
> CONFIG_BPF_LSM as opposed to CONFIG_BPF_SYSCALL or some other generic
> BPF Kconfig knob, but there is no sense in worrying about that until
> we settle this.

Back in 2024 all kfuncs in that file were for BPF LSM progs. Matt's v2
from Mar 2024 even called the set lsm_kfunc_set_ids. They moved to fs/
anyway. Hence CONFIG_BPF_LSM.

> The lsm_get_xattr_slot() function is intended for use by LSMs
> (it's not an external LSM "hook") and the fact that the kfunc in
> question calls into it (and not a single VFS function) is one of the
> reasons why I'm arguing strongly that this is purely a LSM kfunc and
> should be located in security/bpf_lsm_funcs.c.

BPF LSM is in kernel/bpf/bpf_lsm.c since 2020 and includes lsm_hooks.h
since then. bpf_bprm_opts_set(), bpf_ima_inode_hash(), bpf_ima_file_hash()
helpers that only BPF LSM progs can call are there too.
security/bpf/hooks.c is 43 lines that register it.

I don't feel we will converge here.

Linus,
it's your call. If you think the kfunc should move I'll send a follow up.
bpf progs don't see which file a kfunc is in, so there is no need to
hold the pull request for that.
imo xattrs are VFS territory.