bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: KP Singh <kpsingh@kernel.org>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: bpf <bpf@vger.kernel.org>,
	LSM List <linux-security-module@vger.kernel.org>,
	 Blaise Boscaccy <bboscaccy@linux.microsoft.com>,
	Paul Moore <paul@paul-moore.com>,
	 "K. Y. Srinivasan" <kys@microsoft.com>,
	Alexei Starovoitov <ast@kernel.org>,
	 Daniel Borkmann <daniel@iogearbox.net>,
	Andrii Nakryiko <andrii@kernel.org>
Subject: Re: [PATCH 03/12] bpf: Implement exclusive map creation
Date: Thu, 12 Jun 2025 01:05:12 +0200	[thread overview]
Message-ID: <CACYkzJ6zmgrOBzTKoQ_Ta9cwyQAC6H0H=JcbX2d-9tV36SoEVA@mail.gmail.com> (raw)
In-Reply-To: <CAADnVQK5J2REAWXp_KrLThOp9n1=QA=ugxB2Mb7=JmXnSFxQYg@mail.gmail.com>

On Thu, Jun 12, 2025 at 12:55 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Wed, Jun 11, 2025 at 2:44 PM KP Singh <kpsingh@kernel.org> wrote:
> >
> > On Mon, Jun 9, 2025 at 10:58 PM Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:

[...]

> > can add inner maps. I think this is a valid combination as it would
> > still retain exclusivity over the outer maps elements.
>
> I don't follow.
> What do you mean by "map can add inner maps ?"

Ah, I missed this bit, a program cannot call bpf_map_update_elem on
maps of maps and such updates happen only in userspace.

Thanks, updated the code.

- KP


> The exclusivity is a contract between prog<->map.
> It doesn't matter whether the map is outer or inner.
> The prog cannot add an inner map.
> Only the user space can and such inner maps are detached
> from anything.
> Technically we can come up with a requirement that inner maps
> have to have the same prog sha as outer map.
> This can be enforced by bpf_map_meta_equal() logic.
> But that feels like overkill.
> The user space can query prog's sha, create an inner map with
> such prog sha and add it to outer map. So the additional check
> in bpf_map_meta_equal() would be easy to bypass.
> Since so, I would not add such artificial obstacle.
> Let all types of maps have this exclusive feature.

  reply	other threads:[~2025-06-11 23:05 UTC|newest]

Thread overview: 79+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-06 23:29 [PATCH 00/12] Signed BPF programs KP Singh
2025-06-06 23:29 ` [PATCH 01/12] bpf: Implement an internal helper for SHA256 hashing KP Singh
2025-06-09  9:31   ` kernel test robot
2025-06-09 16:56   ` Alexei Starovoitov
2025-06-12 19:07   ` Eric Biggers
2025-06-16 23:40     ` KP Singh
2025-06-16 23:48       ` Eric Biggers
2025-06-17  0:04         ` KP Singh
2025-06-06 23:29 ` [PATCH 02/12] bpf: Update the bpf_prog_calc_tag to use SHA256 KP Singh
2025-06-09 17:46   ` Alexei Starovoitov
2025-06-06 23:29 ` [PATCH 03/12] bpf: Implement exclusive map creation KP Singh
2025-06-09 20:58   ` Alexei Starovoitov
2025-06-11 21:44     ` KP Singh
2025-06-11 22:55       ` Alexei Starovoitov
2025-06-11 23:05         ` KP Singh [this message]
2025-06-06 23:29 ` [PATCH 04/12] libbpf: Implement SHA256 internal helper KP Singh
2025-06-12 22:55   ` Andrii Nakryiko
2025-06-06 23:29 ` [PATCH 05/12] libbpf: Support exclusive map creation KP Singh
2025-06-07  9:16   ` kernel test robot
2025-06-12 22:55   ` Andrii Nakryiko
2025-06-12 23:41     ` KP Singh
2025-06-13 16:51       ` Andrii Nakryiko
2025-07-12  0:50         ` KP Singh
2025-07-12  0:53     ` KP Singh
2025-07-14 20:56       ` Andrii Nakryiko
2025-07-14 12:29     ` KP Singh
2025-07-14 12:55       ` KP Singh
2025-07-14 21:05         ` Andrii Nakryiko
2025-06-06 23:29 ` [PATCH 06/12] selftests/bpf: Add tests for exclusive maps KP Singh
2025-06-06 23:29 ` [PATCH 07/12] bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD KP Singh
2025-06-07  9:26   ` kernel test robot
2025-06-08 13:11   ` kernel test robot
2025-06-09 21:30   ` Alexei Starovoitov
2025-06-11 14:27     ` KP Singh
2025-06-11 15:04       ` Alexei Starovoitov
2025-06-11 16:05         ` KP Singh
2025-06-06 23:29 ` [PATCH 08/12] bpf: Implement signature verification for BPF programs KP Singh
2025-06-09 21:39   ` Alexei Starovoitov
2025-06-10 16:37   ` Blaise Boscaccy
2025-06-06 23:29 ` [PATCH 09/12] libbpf: Update light skeleton for signing KP Singh
2025-06-09 21:41   ` Alexei Starovoitov
2025-06-06 23:29 ` [PATCH 10/12] libbpf: Embed and verify the metadata hash in the loader KP Singh
2025-06-10  0:08   ` Alexei Starovoitov
2025-06-10 16:51   ` Blaise Boscaccy
2025-06-10 17:43     ` KP Singh
2025-06-10 18:15       ` Blaise Boscaccy
2025-06-10 19:47         ` KP Singh
2025-06-10 21:24           ` James Bottomley
2025-06-10 22:31             ` Paul Moore
2025-06-10 22:35             ` KP Singh
2025-06-11 11:59               ` James Bottomley
2025-06-11 12:33                 ` KP Singh
2025-06-11 13:12                   ` James Bottomley
2025-06-11 13:24                     ` KP Singh
2025-06-11 13:18                   ` James Bottomley
2025-06-11 13:41                     ` KP Singh
2025-06-11 14:43                       ` James Bottomley
2025-06-11 14:45                         ` KP Singh
2025-06-10 20:56         ` KP Singh
2025-06-12 22:56   ` Andrii Nakryiko
2025-06-06 23:29 ` [PATCH 11/12] bpftool: Add support for signing BPF programs KP Singh
2025-06-08 14:03   ` James Bottomley
2025-06-10  8:50     ` KP Singh
2025-06-10 15:56       ` James Bottomley
2025-06-10 16:41         ` KP Singh
2025-06-10 16:34       ` Blaise Boscaccy
2025-06-06 23:29 ` [PATCH 12/12] selftests/bpf: Enable signature verification for all lskel tests KP Singh
2025-06-10  0:45   ` Alexei Starovoitov
2025-06-10 16:39   ` Blaise Boscaccy
2025-06-10 16:42     ` KP Singh
2025-06-09  8:20 ` [PATCH 00/12] Signed BPF programs Toke Høiland-Jørgensen
2025-06-09 11:40   ` KP Singh
2025-06-10  9:45     ` Toke Høiland-Jørgensen
2025-06-10 11:18       ` KP Singh
2025-06-10 11:58         ` Toke Høiland-Jørgensen
2025-06-10 12:26           ` KP Singh
2025-06-10 14:25             ` Toke Høiland-Jørgensen
2025-07-08 15:15 ` Blaise Boscaccy
2025-07-10 14:49   ` KP Singh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CACYkzJ6zmgrOBzTKoQ_Ta9cwyQAC6H0H=JcbX2d-9tV36SoEVA@mail.gmail.com' \
    --to=kpsingh@kernel.org \
    --cc=alexei.starovoitov@gmail.com \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bboscaccy@linux.microsoft.com \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=kys@microsoft.com \
    --cc=linux-security-module@vger.kernel.org \
    --cc=paul@paul-moore.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).