* [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show
@ 2025-07-22 11:58 Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage Tao Chen
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Tao Chen @ 2025-07-22 11:58 UTC (permalink / raw)
To: qmo, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev, Tao Chen
Add `bpftool token show` command to get token info
from bpffs in /proc/mounts.
Example plain output for `token show`:
token_info /sys/fs/bpf/token
allowed_cmds:
map_create prog_load
allowed_maps:
allowed_progs:
kprobe
allowed_attachs:
xdp
token_info /sys/fs/bpf/token2
allowed_cmds:
map_create prog_load
allowed_maps:
allowed_progs:
kprobe
allowed_attachs:
xdp
Example json output for `token show`:
[{
"token_info": "/sys/fs/bpf/token",
"allowed_cmds": ["map_create", "prog_load"],
"allowed_maps": [],
"allowed_progs": ["kprobe"],
"allowed_attachs": ["xdp"]
}, {
"token_info": "/sys/fs/bpf/token2",
"allowed_cmds": ["map_create", "prog_load"],
"allowed_maps": [],
"allowed_progs": ["kprobe"],
"allowed_attachs": ["xdp"]
}]
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
tools/bpf/bpftool/main.c | 3 +-
tools/bpf/bpftool/main.h | 1 +
tools/bpf/bpftool/token.c | 232 ++++++++++++++++++++++++++++++++++++++
3 files changed, 235 insertions(+), 1 deletion(-)
create mode 100644 tools/bpf/bpftool/token.c
diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
index 2b7f2bd3a7d..0f1183b2ed0 100644
--- a/tools/bpf/bpftool/main.c
+++ b/tools/bpf/bpftool/main.c
@@ -61,7 +61,7 @@ static int do_help(int argc, char **argv)
" %s batch file FILE\n"
" %s version\n"
"\n"
- " OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter }\n"
+ " OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter | token }\n"
" " HELP_SPEC_OPTIONS " |\n"
" {-V|--version} }\n"
"",
@@ -87,6 +87,7 @@ static const struct cmd commands[] = {
{ "gen", do_gen },
{ "struct_ops", do_struct_ops },
{ "iter", do_iter },
+ { "token", do_token },
{ "version", do_version },
{ 0 }
};
diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
index 6db704fda5c..a2bb0714b3d 100644
--- a/tools/bpf/bpftool/main.h
+++ b/tools/bpf/bpftool/main.h
@@ -166,6 +166,7 @@ int do_tracelog(int argc, char **arg) __weak;
int do_feature(int argc, char **argv) __weak;
int do_struct_ops(int argc, char **argv) __weak;
int do_iter(int argc, char **argv) __weak;
+int do_token(int argc, char **argv) __weak;
int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what);
int prog_parse_fd(int *argc, char ***argv);
diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
new file mode 100644
index 00000000000..f72a116f9c6
--- /dev/null
+++ b/tools/bpf/bpftool/token.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2025 Didi Technology Co., Tao Chen */
+
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <mntent.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "json_writer.h"
+#include "main.h"
+
+#define MOUNTS_FILE "/proc/mounts"
+
+static bool has_delegate_options(const char *mnt_ops)
+{
+ return strstr(mnt_ops, "delegate_cmds") != NULL ||
+ strstr(mnt_ops, "delegate_maps") != NULL ||
+ strstr(mnt_ops, "delegate_progs") != NULL ||
+ strstr(mnt_ops, "delegate_attachs") != NULL;
+}
+
+static char *get_delegate_value(const char *opts, const char *key)
+{
+ char *token, *rest, *ret = NULL;
+ char *opts_copy = strdup(opts);
+
+ if (!opts_copy)
+ return NULL;
+
+ for (token = strtok_r(opts_copy, ",", &rest); token != NULL;
+ token = strtok_r(NULL, ",", &rest)) {
+ if (strncmp(token, key, strlen(key)) == 0 &&
+ token[strlen(key)] == '=') {
+ ret = token + strlen(key) + 1;
+ break;
+ }
+ }
+ free(opts_copy);
+
+ return ret;
+}
+
+static void print_items_per_line(const char *input, int items_per_line)
+{
+ char *str, *rest, *strs;
+ int cnt = 0;
+
+ if (!input)
+ return;
+
+ strs = strdup(input);
+ if (!strs)
+ return;
+
+ for (str = strtok_r(strs, ":", &rest); str != NULL;
+ str = strtok_r(NULL, ":", &rest)) {
+ if (cnt % items_per_line == 0)
+ printf("\n\t ");
+
+ printf("%-20s", str);
+ cnt++;
+ }
+
+ free(strs);
+}
+
+#define ITEMS_PER_LINE 4
+static void show_token_info_plain(struct mntent *mntent)
+{
+ char *value;
+
+ printf("token_info %s", mntent->mnt_dir);
+
+ printf("\n\tallowed_cmds:");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+ print_items_per_line(value, ITEMS_PER_LINE);
+
+ printf("\n\tallowed_maps:");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+ print_items_per_line(value, ITEMS_PER_LINE);
+
+ printf("\n\tallowed_progs:");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+ print_items_per_line(value, ITEMS_PER_LINE);
+
+ printf("\n\tallowed_attachs:");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+ print_items_per_line(value, ITEMS_PER_LINE);
+ printf("\n");
+}
+
+static void split_json_array_str(const char *input)
+{
+ char *str, *rest, *strs;
+
+ if (!input) {
+ jsonw_start_array(json_wtr);
+ jsonw_end_array(json_wtr);
+ return;
+ }
+
+ strs = strdup(input);
+ if (!strs)
+ return;
+
+ jsonw_start_array(json_wtr);
+ for (str = strtok_r(strs, ":", &rest); str != NULL;
+ str = strtok_r(NULL, ":", &rest)) {
+ jsonw_string(json_wtr, str);
+ }
+ jsonw_end_array(json_wtr);
+
+ free(strs);
+}
+
+static void show_token_info_json(struct mntent *mntent)
+{
+ char *value;
+
+ jsonw_start_object(json_wtr);
+
+ jsonw_string_field(json_wtr, "token_info", mntent->mnt_dir);
+
+ jsonw_name(json_wtr, "allowed_cmds");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
+ split_json_array_str(value);
+
+ jsonw_name(json_wtr, "allowed_maps");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
+ split_json_array_str(value);
+
+ jsonw_name(json_wtr, "allowed_progs");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
+ split_json_array_str(value);
+
+ jsonw_name(json_wtr, "allowed_attachs");
+ value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
+ split_json_array_str(value);
+
+ jsonw_end_object(json_wtr);
+}
+
+static int __show_token_info(struct mntent *mntent)
+{
+
+ if (json_output)
+ show_token_info_json(mntent);
+ else
+ show_token_info_plain(mntent);
+
+ return 0;
+}
+
+static int show_token_info(void)
+{
+ FILE *fp;
+ struct mntent *ent;
+ bool hit = false;
+
+ fp = setmntent(MOUNTS_FILE, "r");
+ if (!fp) {
+ p_err("Failed to open: %s", MOUNTS_FILE);
+ return -1;
+ }
+
+ if (json_output)
+ jsonw_start_array(json_wtr);
+
+ while ((ent = getmntent(fp)) != NULL) {
+ if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
+ if (has_delegate_options(ent->mnt_opts)) {
+ __show_token_info(ent);
+ hit = true;
+ }
+ }
+ }
+
+ if (json_output)
+ jsonw_end_array(json_wtr);
+
+ if (!hit)
+ p_info("Token info not found");
+
+ endmntent(fp);
+
+ return 0;
+}
+
+static int do_show(int argc, char **argv)
+{
+ if (argc)
+ return BAD_ARG();
+
+ return show_token_info();
+}
+
+static int do_help(int argc, char **argv)
+{
+ if (json_output) {
+ jsonw_null(json_wtr);
+ return 0;
+ }
+
+ fprintf(stderr,
+ "Usage: %1$s %2$s { show | list }\n"
+ " %1$s %2$s help\n"
+ "\n"
+ "",
+ bin_name, argv[-2]);
+ return 0;
+}
+
+static const struct cmd cmds[] = {
+ { "show", do_show },
+ { "list", do_show },
+ { "help", do_help },
+ { 0 }
+};
+
+int do_token(int argc, char **argv)
+{
+ return cmd_select(cmds, argc, argv, do_help);
+}
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage
2025-07-22 11:58 [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
@ 2025-07-22 11:58 ` Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument Tao Chen
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Tao Chen @ 2025-07-22 11:58 UTC (permalink / raw)
To: qmo, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev, Tao Chen
Add bpftool-token manpage with information and examples of token-related
commands.
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
.../bpftool/Documentation/bpftool-token.rst | 63 +++++++++++++++++++
1 file changed, 63 insertions(+)
create mode 100644 tools/bpf/bpftool/Documentation/bpftool-token.rst
diff --git a/tools/bpf/bpftool/Documentation/bpftool-token.rst b/tools/bpf/bpftool/Documentation/bpftool-token.rst
new file mode 100644
index 00000000000..c5fe9292258
--- /dev/null
+++ b/tools/bpf/bpftool/Documentation/bpftool-token.rst
@@ -0,0 +1,63 @@
+.. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+
+================
+bpftool-token
+================
+-------------------------------------------------------------------------------
+tool for inspection and simple manipulation of eBPF tokens
+-------------------------------------------------------------------------------
+
+:Manual section: 8
+
+.. include:: substitutions.rst
+
+SYNOPSIS
+========
+
+**bpftool** [*OPTIONS*] **token** *COMMAND*
+
+*OPTIONS* := { |COMMON_OPTIONS| }
+
+*COMMANDS* := { **show** | **list** | **help** }
+
+TOKEN COMMANDS
+===============
+
+| **bpftool** **token** { **show** | **list** }
+| **bpftool** **token help**
+|
+
+DESCRIPTION
+===========
+bpftool token { show | list }
+ List all the speciafic allowed types for **bpf**\ () system call
+ commands, maps, programs, and attach types, as well as the
+ *bpffs* mount point used to set the token information.
+
+bpftool prog help
+ Print short help message.
+
+OPTIONS
+========
+.. include:: common_options.rst
+
+EXAMPLES
+========
+|
+| **# mkdir -p /sys/fs/bpf/token**
+| **# mount -t bpf bpffs /sys/fs/bpf/token** \
+| **-o delegate_cmds=prog_load:map_create** \
+| **-o delegate_progs=kprobe** \
+| **-o delegate_attachs=xdp**
+| **# bpftool token list**
+
+::
+
+ token_info /sys/fs/bpf/token
+ allowed_cmds:
+ map_create prog_load
+ allowed_maps:
+ allowed_progs:
+ kprobe
+ allowed_attachs:
+ xdp
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument
2025-07-22 11:58 [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage Tao Chen
@ 2025-07-22 11:58 ` Tao Chen
2025-07-22 12:12 ` [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
2025-07-22 15:01 ` Quentin Monnet
3 siblings, 0 replies; 6+ messages in thread
From: Tao Chen @ 2025-07-22 11:58 UTC (permalink / raw)
To: qmo, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev, Tao Chen
This commit updates the bash completion script with the new token
argument.
$ bpftool
batch cgroup gen iter map perf struct_ops
btf feature help link net prog token
Signed-off-by: Tao Chen <chen.dylane@linux.dev>
---
tools/bpf/bpftool/bash-completion/bpftool | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index a759ba24471..527bb47ac46 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -1215,6 +1215,17 @@ _bpftool()
;;
esac
;;
+ token)
+ case $command in
+ show|list)
+ return 0
+ ;;
+ *)
+ [[ $prev == $object ]] && \
+ COMPREPLY=( $( compgen -W 'help show list' -- "$cur" ) )
+ ;;
+ esac
+ ;;
esac
} &&
complete -F _bpftool bpftool
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show
2025-07-22 11:58 [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument Tao Chen
@ 2025-07-22 12:12 ` Tao Chen
2025-07-22 15:01 ` Quentin Monnet
3 siblings, 0 replies; 6+ messages in thread
From: Tao Chen @ 2025-07-22 12:12 UTC (permalink / raw)
To: qmo, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev
在 2025/7/22 19:58, Tao Chen 写道:
Change list not added, please ignore this patchset, and i have resent
it. Sorry for the noise.
> Add `bpftool token show` command to get token info
> from bpffs in /proc/mounts.
>
> Example plain output for `token show`:
> token_info /sys/fs/bpf/token
> allowed_cmds:
> map_create prog_load
> allowed_maps:
> allowed_progs:
> kprobe
> allowed_attachs:
> xdp
> token_info /sys/fs/bpf/token2
> allowed_cmds:
> map_create prog_load
> allowed_maps:
> allowed_progs:
> kprobe
> allowed_attachs:
> xdp
>
> Example json output for `token show`:
> [{
> "token_info": "/sys/fs/bpf/token",
> "allowed_cmds": ["map_create", "prog_load"],
> "allowed_maps": [],
> "allowed_progs": ["kprobe"],
> "allowed_attachs": ["xdp"]
> }, {
> "token_info": "/sys/fs/bpf/token2",
> "allowed_cmds": ["map_create", "prog_load"],
> "allowed_maps": [],
> "allowed_progs": ["kprobe"],
> "allowed_attachs": ["xdp"]
> }]
>
> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
> ---
> tools/bpf/bpftool/main.c | 3 +-
> tools/bpf/bpftool/main.h | 1 +
> tools/bpf/bpftool/token.c | 232 ++++++++++++++++++++++++++++++++++++++
> 3 files changed, 235 insertions(+), 1 deletion(-)
> create mode 100644 tools/bpf/bpftool/token.c
>
> diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
> index 2b7f2bd3a7d..0f1183b2ed0 100644
> --- a/tools/bpf/bpftool/main.c
> +++ b/tools/bpf/bpftool/main.c
> @@ -61,7 +61,7 @@ static int do_help(int argc, char **argv)
> " %s batch file FILE\n"
> " %s version\n"
> "\n"
> - " OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter }\n"
> + " OBJECT := { prog | map | link | cgroup | perf | net | feature | btf | gen | struct_ops | iter | token }\n"
> " " HELP_SPEC_OPTIONS " |\n"
> " {-V|--version} }\n"
> "",
> @@ -87,6 +87,7 @@ static const struct cmd commands[] = {
> { "gen", do_gen },
> { "struct_ops", do_struct_ops },
> { "iter", do_iter },
> + { "token", do_token },
> { "version", do_version },
> { 0 }
> };
> diff --git a/tools/bpf/bpftool/main.h b/tools/bpf/bpftool/main.h
> index 6db704fda5c..a2bb0714b3d 100644
> --- a/tools/bpf/bpftool/main.h
> +++ b/tools/bpf/bpftool/main.h
> @@ -166,6 +166,7 @@ int do_tracelog(int argc, char **arg) __weak;
> int do_feature(int argc, char **argv) __weak;
> int do_struct_ops(int argc, char **argv) __weak;
> int do_iter(int argc, char **argv) __weak;
> +int do_token(int argc, char **argv) __weak;
>
> int parse_u32_arg(int *argc, char ***argv, __u32 *val, const char *what);
> int prog_parse_fd(int *argc, char ***argv);
> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
> new file mode 100644
> index 00000000000..f72a116f9c6
> --- /dev/null
> +++ b/tools/bpf/bpftool/token.c
> @@ -0,0 +1,232 @@
> +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +/* Copyright (C) 2025 Didi Technology Co., Tao Chen */
> +
> +#ifndef _GNU_SOURCE
> +#define _GNU_SOURCE
> +#endif
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <stdbool.h>
> +#include <stdio.h>
> +#include <stdlib.h>
> +#include <string.h>
> +#include <unistd.h>
> +#include <mntent.h>
> +#include <sys/types.h>
> +#include <sys/stat.h>
> +
> +#include "json_writer.h"
> +#include "main.h"
> +
> +#define MOUNTS_FILE "/proc/mounts"
> +
> +static bool has_delegate_options(const char *mnt_ops)
> +{
> + return strstr(mnt_ops, "delegate_cmds") != NULL ||
> + strstr(mnt_ops, "delegate_maps") != NULL ||
> + strstr(mnt_ops, "delegate_progs") != NULL ||
> + strstr(mnt_ops, "delegate_attachs") != NULL;
> +}
> +
> +static char *get_delegate_value(const char *opts, const char *key)
> +{
> + char *token, *rest, *ret = NULL;
> + char *opts_copy = strdup(opts);
> +
> + if (!opts_copy)
> + return NULL;
> +
> + for (token = strtok_r(opts_copy, ",", &rest); token != NULL;
> + token = strtok_r(NULL, ",", &rest)) {
> + if (strncmp(token, key, strlen(key)) == 0 &&
> + token[strlen(key)] == '=') {
> + ret = token + strlen(key) + 1;
> + break;
> + }
> + }
> + free(opts_copy);
> +
> + return ret;
> +}
> +
> +static void print_items_per_line(const char *input, int items_per_line)
> +{
> + char *str, *rest, *strs;
> + int cnt = 0;
> +
> + if (!input)
> + return;
> +
> + strs = strdup(input);
> + if (!strs)
> + return;
> +
> + for (str = strtok_r(strs, ":", &rest); str != NULL;
> + str = strtok_r(NULL, ":", &rest)) {
> + if (cnt % items_per_line == 0)
> + printf("\n\t ");
> +
> + printf("%-20s", str);
> + cnt++;
> + }
> +
> + free(strs);
> +}
> +
> +#define ITEMS_PER_LINE 4
> +static void show_token_info_plain(struct mntent *mntent)
> +{
> + char *value;
> +
> + printf("token_info %s", mntent->mnt_dir);
> +
> + printf("\n\tallowed_cmds:");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
> + print_items_per_line(value, ITEMS_PER_LINE);
> +
> + printf("\n\tallowed_maps:");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
> + print_items_per_line(value, ITEMS_PER_LINE);
> +
> + printf("\n\tallowed_progs:");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
> + print_items_per_line(value, ITEMS_PER_LINE);
> +
> + printf("\n\tallowed_attachs:");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
> + print_items_per_line(value, ITEMS_PER_LINE);
> + printf("\n");
> +}
> +
> +static void split_json_array_str(const char *input)
> +{
> + char *str, *rest, *strs;
> +
> + if (!input) {
> + jsonw_start_array(json_wtr);
> + jsonw_end_array(json_wtr);
> + return;
> + }
> +
> + strs = strdup(input);
> + if (!strs)
> + return;
> +
> + jsonw_start_array(json_wtr);
> + for (str = strtok_r(strs, ":", &rest); str != NULL;
> + str = strtok_r(NULL, ":", &rest)) {
> + jsonw_string(json_wtr, str);
> + }
> + jsonw_end_array(json_wtr);
> +
> + free(strs);
> +}
> +
> +static void show_token_info_json(struct mntent *mntent)
> +{
> + char *value;
> +
> + jsonw_start_object(json_wtr);
> +
> + jsonw_string_field(json_wtr, "token_info", mntent->mnt_dir);
> +
> + jsonw_name(json_wtr, "allowed_cmds");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_cmds");
> + split_json_array_str(value);
> +
> + jsonw_name(json_wtr, "allowed_maps");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_maps");
> + split_json_array_str(value);
> +
> + jsonw_name(json_wtr, "allowed_progs");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_progs");
> + split_json_array_str(value);
> +
> + jsonw_name(json_wtr, "allowed_attachs");
> + value = get_delegate_value(mntent->mnt_opts, "delegate_attachs");
> + split_json_array_str(value);
> +
> + jsonw_end_object(json_wtr);
> +}
> +
> +static int __show_token_info(struct mntent *mntent)
> +{
> +
> + if (json_output)
> + show_token_info_json(mntent);
> + else
> + show_token_info_plain(mntent);
> +
> + return 0;
> +}
> +
> +static int show_token_info(void)
> +{
> + FILE *fp;
> + struct mntent *ent;
> + bool hit = false;
> +
> + fp = setmntent(MOUNTS_FILE, "r");
> + if (!fp) {
> + p_err("Failed to open: %s", MOUNTS_FILE);
> + return -1;
> + }
> +
> + if (json_output)
> + jsonw_start_array(json_wtr);
> +
> + while ((ent = getmntent(fp)) != NULL) {
> + if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
> + if (has_delegate_options(ent->mnt_opts)) {
> + __show_token_info(ent);
> + hit = true;
> + }
> + }
> + }
> +
> + if (json_output)
> + jsonw_end_array(json_wtr);
> +
> + if (!hit)
> + p_info("Token info not found");
> +
> + endmntent(fp);
> +
> + return 0;
> +}
> +
> +static int do_show(int argc, char **argv)
> +{
> + if (argc)
> + return BAD_ARG();
> +
> + return show_token_info();
> +}
> +
> +static int do_help(int argc, char **argv)
> +{
> + if (json_output) {
> + jsonw_null(json_wtr);
> + return 0;
> + }
> +
> + fprintf(stderr,
> + "Usage: %1$s %2$s { show | list }\n"
> + " %1$s %2$s help\n"
> + "\n"
> + "",
> + bin_name, argv[-2]);
> + return 0;
> +}
> +
> +static const struct cmd cmds[] = {
> + { "show", do_show },
> + { "list", do_show },
> + { "help", do_help },
> + { 0 }
> +};
> +
> +int do_token(int argc, char **argv)
> +{
> + return cmd_select(cmds, argc, argv, do_help);
> +}
--
Best Regards
Tao Chen
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show
2025-07-22 11:58 [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
` (2 preceding siblings ...)
2025-07-22 12:12 ` [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
@ 2025-07-22 15:01 ` Quentin Monnet
2025-07-22 16:10 ` Tao Chen
3 siblings, 1 reply; 6+ messages in thread
From: Quentin Monnet @ 2025-07-22 15:01 UTC (permalink / raw)
To: Tao Chen, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev
2025-07-22 19:58 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
> Add `bpftool token show` command to get token info
> from bpffs in /proc/mounts.
>
> Example plain output for `token show`:
> token_info /sys/fs/bpf/token
> allowed_cmds:
> map_create prog_load
> allowed_maps:
> allowed_progs:
> kprobe
> allowed_attachs:
> xdp
> token_info /sys/fs/bpf/token2
> allowed_cmds:
> map_create prog_load
> allowed_maps:
> allowed_progs:
> kprobe
> allowed_attachs:
> xdp
>
> Example json output for `token show`:
> [{
> "token_info": "/sys/fs/bpf/token",
> "allowed_cmds": ["map_create", "prog_load"],
> "allowed_maps": [],
> "allowed_progs": ["kprobe"],
> "allowed_attachs": ["xdp"]
> }, {
> "token_info": "/sys/fs/bpf/token2",
> "allowed_cmds": ["map_create", "prog_load"],
> "allowed_maps": [],
> "allowed_progs": ["kprobe"],
> "allowed_attachs": ["xdp"]
> }]
>
> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
> ---
> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
> new file mode 100644
> index 00000000000..f72a116f9c6
> --- /dev/null
> +++ b/tools/bpf/bpftool/token.c
> +static int show_token_info(void)
> +{
> + FILE *fp;
> + struct mntent *ent;
> + bool hit = false;
> +
> + fp = setmntent(MOUNTS_FILE, "r");
> + if (!fp) {
> + p_err("Failed to open: %s", MOUNTS_FILE);
> + return -1;
> + }
> +
> + if (json_output)
> + jsonw_start_array(json_wtr);
> +
> + while ((ent = getmntent(fp)) != NULL) {
> + if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
> + if (has_delegate_options(ent->mnt_opts)) {
> + __show_token_info(ent);
> + hit = true;
> + }
> + }
> + }
> +
> + if (json_output)
> + jsonw_end_array(json_wtr);
> +
> + if (!hit)
> + p_info("Token info not found");
Woops I take this one back. It made sense to have a p_info() message in
your v1 because you were only looking at one bpffs mount point, but now
we list all the ones we find, we should remove this message and silently
ignore mount points without token info (and I think we can remove the
"hit" variable entirely). Sorry! :)
The rest of this patch looks good to me, thank you
Quentin
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show
2025-07-22 15:01 ` Quentin Monnet
@ 2025-07-22 16:10 ` Tao Chen
0 siblings, 0 replies; 6+ messages in thread
From: Tao Chen @ 2025-07-22 16:10 UTC (permalink / raw)
To: Quentin Monnet, ast, daniel, andrii, martin.lau, eddyz87, song,
yonghong.song, john.fastabend, kpsingh, sdf, haoluo, jolsa, davem,
kuba, hawk
Cc: linux-kernel, bpf, netdev
在 2025/7/22 23:01, Quentin Monnet 写道:
> 2025-07-22 19:58 UTC+0800 ~ Tao Chen <chen.dylane@linux.dev>
>> Add `bpftool token show` command to get token info
>> from bpffs in /proc/mounts.
>>
>> Example plain output for `token show`:
>> token_info /sys/fs/bpf/token
>> allowed_cmds:
>> map_create prog_load
>> allowed_maps:
>> allowed_progs:
>> kprobe
>> allowed_attachs:
>> xdp
>> token_info /sys/fs/bpf/token2
>> allowed_cmds:
>> map_create prog_load
>> allowed_maps:
>> allowed_progs:
>> kprobe
>> allowed_attachs:
>> xdp
>>
>> Example json output for `token show`:
>> [{
>> "token_info": "/sys/fs/bpf/token",
>> "allowed_cmds": ["map_create", "prog_load"],
>> "allowed_maps": [],
>> "allowed_progs": ["kprobe"],
>> "allowed_attachs": ["xdp"]
>> }, {
>> "token_info": "/sys/fs/bpf/token2",
>> "allowed_cmds": ["map_create", "prog_load"],
>> "allowed_maps": [],
>> "allowed_progs": ["kprobe"],
>> "allowed_attachs": ["xdp"]
>> }]
>>
>> Signed-off-by: Tao Chen <chen.dylane@linux.dev>
>> ---
>
>> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
>> new file mode 100644
>> index 00000000000..f72a116f9c6
>> --- /dev/null
>> +++ b/tools/bpf/bpftool/token.c
>
>> +static int show_token_info(void)
>> +{
>> + FILE *fp;
>> + struct mntent *ent;
>> + bool hit = false;
>> +
>> + fp = setmntent(MOUNTS_FILE, "r");
>> + if (!fp) {
>> + p_err("Failed to open: %s", MOUNTS_FILE);
>> + return -1;
>> + }
>> +
>> + if (json_output)
>> + jsonw_start_array(json_wtr);
>> +
>> + while ((ent = getmntent(fp)) != NULL) {
>> + if (strncmp(ent->mnt_type, "bpf", 3) == 0) {
>> + if (has_delegate_options(ent->mnt_opts)) {
>> + __show_token_info(ent);
>> + hit = true;
>> + }
>> + }
>> + }
>> +
>> + if (json_output)
>> + jsonw_end_array(json_wtr);
>> +
>> + if (!hit)
>> + p_info("Token info not found");
>
> Woops I take this one back. It made sense to have a p_info() message in
> your v1 because you were only looking at one bpffs mount point, but now
> we list all the ones we find, we should remove this message and silently
> ignore mount points without token info (and I think we can remove the
> "hit" variable entirely). Sorry! :)
>
It‘s okay, i will remove it in v3, thanks anyway.
> The rest of this patch looks good to me, thank you
>
> Quentin
--
Best Regards
Tao Chen
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-07-22 16:11 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-22 11:58 [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 2/3] bpftool: Add bpftool-token manpage Tao Chen
2025-07-22 11:58 ` [PATCH bpf-next v2 3/3] bpftool: Add bash completion for token argument Tao Chen
2025-07-22 12:12 ` [PATCH bpf-next v2 1/3] bpftool: Add bpf_token show Tao Chen
2025-07-22 15:01 ` Quentin Monnet
2025-07-22 16:10 ` Tao Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).