From: Mahe Tardy <mahe.tardy@gmail.com>
To: bpf@vger.kernel.org
Cc: andrii@kernel.org, ast@kernel.org, daniel@iogearbox.net,
davem@davemloft.net, willemb@google.com, eddyz87@gmail.com,
edumazet@google.com, john.fastabend@gmail.com, kuba@kernel.org,
horms@kernel.org, liamwisehart@meta.com, martin.lau@linux.dev,
pabeni@redhat.com, song@kernel.org, netdev@vger.kernel.org,
sdf.kernel@gmail.com, yonghong.song@linux.dev, jolsa@kernel.org,
kuniyu@google.com, memxor@gmail.com, emil@etsalapatis.com,
almagui@kernel.org, Mahe Tardy <mahe.tardy@gmail.com>
Subject: [PATCH bpf-next 2/8] selftests/bpf: Test allowed bpf_ksock operations at send LSM attach
Date: Tue, 20 Oct 2026 10:25:06 +0000 [thread overview]
Message-ID: <20261020102512.518479-3-mahe.tardy@gmail.com> (raw)
In-Reply-To: <20261020102512.518479-1-mahe.tardy@gmail.com>
This test makes sure that bpf_ksock_acquire() and bpf_ksock_release()
can be called from programs attached to ksock_socket_sendmsg().
Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
---
.../selftests/bpf/progs/ksock_lsm_verifier.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
index fd2ccfdb5802..740ed370d28f 100644
--- a/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
+++ b/tools/testing/selftests/bpf/progs/ksock_lsm_verifier.c
@@ -12,7 +12,7 @@ char send_data[11] = "dummy data";
SEC("lsm.s/socket_sendmsg")
__description("bpf_ksock_send is rejected from socket_sendmsg LSM hook")
__failure __msg("calling kernel function bpf_ksock_send is not allowed")
-int BPF_PROG(ksock_socket_sendmsg, struct socket *sock, struct msghdr *msg,
+int BPF_PROG(socket_sendmsg_ksock_send, struct socket *sock, struct msghdr *msg,
int size, int ret)
{
struct __ksock_ctx_value *v;
@@ -32,4 +32,21 @@ int BPF_PROG(ksock_socket_sendmsg, struct socket *sock, struct msghdr *msg,
return ret;
}
+SEC("lsm.s/socket_sendmsg")
+__description("bpf_ksock operations other than send are allowed from socket_sendmsg LSM hook")
+__success
+int BPF_PROG(socket_sendmsg_ksock_allowed, struct socket *sock,
+ struct msghdr *msg, int size, int ret)
+{
+ struct bpf_ksock *ks;
+
+ ks = ksock_ctx_get();
+ if (!ks)
+ return ret;
+
+ bpf_ksock_release(ks);
+ return ret;
+}
+
+
char __license[] SEC("license") = "GPL";
--
2.43.0
next prev parent reply other threads:[~2026-10-20 10:25 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 10:25 [PATCH bpf-next 0/8] bpf: Expand ksock send-path support Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 1/8] bpf: improve ksock_kfunc_set LSM recursion filter Mahe Tardy
2026-10-20 10:25 ` Mahe Tardy [this message]
2026-10-20 10:52 ` [PATCH bpf-next 2/8] selftests/bpf: Test allowed bpf_ksock operations at send LSM attach bot+bpf-ci
2026-10-20 11:06 ` Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 3/8] bpf: move ksock_connect() out of init kfunc set Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 4/8] selftests/bpf: Test verifier filter for ksock connect on LSM attach Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 5/8] selftests/bpf: Test ksock connect/send combinations Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 6/8] bpf: add bpf_ksock_sendto() kfunc Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 7/8] selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach Mahe Tardy
2026-10-20 10:52 ` bot+bpf-ci
2026-10-20 11:08 ` Mahe Tardy
2026-10-20 10:25 ` [PATCH bpf-next 8/8] selftests/bpf: Test ksock sendto() Mahe Tardy
2026-10-20 15:07 ` [PATCH bpf-next 0/8] bpf: Expand ksock send-path support Alexei Starovoitov
2026-10-20 15:47 ` Mahe Tardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020102512.518479-3-mahe.tardy@gmail.com \
--to=mahe.tardy@gmail.com \
--cc=almagui@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=liamwisehart@meta.com \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sdf.kernel@gmail.com \
--cc=song@kernel.org \
--cc=willemb@google.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox