All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andrii Nakryiko <andrii@kernel.org>
To: bpf@vger.kernel.org, netdev@vger.kernel.org, paul@paul-moore.com,
	brauner@kernel.org
Cc: torvalds@linux-foundation.org, linux-fsdevel@vger.kernel.org,
	linux-security-module@vger.kernel.org, kernel-team@meta.com
Subject: [PATCH v2 bpf-next 28/30] libbpf: support BPF token path setting through LIBBPF_BPF_TOKEN_PATH envvar
Date: Tue, 23 Jan 2024 18:21:25 -0800	[thread overview]
Message-ID: <20240124022127.2379740-29-andrii@kernel.org> (raw)
In-Reply-To: <20240124022127.2379740-1-andrii@kernel.org>

To allow external admin authority to override default BPF FS location
(/sys/fs/bpf) for implicit BPF token creation, teach libbpf to recognize
LIBBPF_BPF_TOKEN_PATH envvar. If it is specified and user application
didn't explicitly specify bpf_token_path option, it will be treated
exactly like bpf_token_path option, overriding default /sys/fs/bpf
location and making BPF token mandatory.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 tools/lib/bpf/libbpf.c | 6 ++++++
 tools/lib/bpf/libbpf.h | 8 ++++++++
 2 files changed, 14 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index a2866329d8f2..38a0e1e9a472 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -7585,6 +7585,12 @@ static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf,
 		return ERR_PTR(-EINVAL);
 
 	token_path = OPTS_GET(opts, bpf_token_path, NULL);
+	/* if user didn't specify bpf_token_path explicitly, check if
+	 * LIBBPF_BPF_TOKEN_PATH envvar was set and treat it as bpf_token_path
+	 * option
+	 */
+	if (!token_path)
+		token_path = getenv("LIBBPF_BPF_TOKEN_PATH");
 	if (token_path && strlen(token_path) >= PATH_MAX)
 		return ERR_PTR(-ENAMETOOLONG);
 
diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 535ae15ed493..5723cbbfcc41 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -183,6 +183,14 @@ struct bpf_object_open_opts {
 	 * that accept BPF token (e.g., map creation, BTF and program loads,
 	 * etc) automatically within instantiated BPF object.
 	 *
+	 * If bpf_token_path is not specified, libbpf will consult
+	 * LIBBPF_BPF_TOKEN_PATH environment variable. If set, it will be
+	 * taken as a value of bpf_token_path option and will force libbpf to
+	 * either create BPF token from provided custom BPF FS path, or will
+	 * disable implicit BPF token creation, if envvar value is an empty
+	 * string. bpf_token_path overrides LIBBPF_BPF_TOKEN_PATH, if both are
+	 * set at the same time.
+	 *
 	 * Setting bpf_token_path option to empty string disables libbpf's
 	 * automatic attempt to create BPF token from default BPF FS mount
 	 * point (/sys/fs/bpf), in case this default behavior is undesirable.
-- 
2.34.1


  parent reply	other threads:[~2024-01-24  2:23 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-24  2:20 [PATCH v2 bpf-next 00/30] BPF token Andrii Nakryiko
2024-01-24  2:20 ` [PATCH v2 bpf-next 01/30] bpf: align CAP_NET_ADMIN checks with bpf_capable() approach Andrii Nakryiko
2024-01-24  2:20 ` [PATCH v2 bpf-next 02/30] bpf: add BPF token delegation mount options to BPF FS Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 03/30] bpf: introduce BPF token object Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 04/30] bpf: add BPF token support to BPF_MAP_CREATE command Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 05/30] bpf: add BPF token support to BPF_BTF_LOAD command Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 06/30] bpf: add BPF token support to BPF_PROG_LOAD command Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 07/30] bpf: take into account BPF token when fetching helper protos Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 08/30] bpf: consistently use BPF token throughout BPF verifier logic Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 09/30] bpf,lsm: refactor bpf_prog_alloc/bpf_prog_free LSM hooks Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 10/30] bpf,lsm: refactor bpf_map_alloc/bpf_map_free " Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 11/30] bpf,lsm: add BPF token " Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 12/30] libbpf: add bpf_token_create() API Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 13/30] libbpf: add BPF token support to bpf_map_create() API Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 14/30] libbpf: add BPF token support to bpf_btf_load() API Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 15/30] libbpf: add BPF token support to bpf_prog_load() API Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 16/30] selftests/bpf: add BPF token-enabled tests Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 17/30] bpf,selinux: allocate bpf_security_struct per BPF token Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 18/30] bpf: fail BPF_TOKEN_CREATE if no delegation option was set on BPF FS Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 19/30] bpf: support symbolic BPF FS delegation mount options Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 20/30] selftests/bpf: utilize string values for delegate_xxx " Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 21/30] libbpf: split feature detectors definitions from cached results Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 22/30] libbpf: further decouple feature checking logic from bpf_object Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 23/30] libbpf: move feature detection code into its own file Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 24/30] libbpf: wire up token_fd into feature probing logic Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 25/30] libbpf: wire up BPF token support at BPF object level Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 26/30] selftests/bpf: add BPF object loading tests with explicit token passing Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 27/30] selftests/bpf: add tests for BPF object load with implicit token Andrii Nakryiko
2024-01-24  2:21 ` Andrii Nakryiko [this message]
2024-01-24  2:21 ` [PATCH v2 bpf-next 29/30] selftests/bpf: add tests for LIBBPF_BPF_TOKEN_PATH envvar Andrii Nakryiko
2024-01-24  2:21 ` [PATCH v2 bpf-next 30/30] selftests/bpf: incorporate LSM policy to token-based tests Andrii Nakryiko
2024-01-25  0:10 ` [PATCH v2 bpf-next 00/30] BPF token patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240124022127.2379740-29-andrii@kernel.org \
    --to=andrii@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=brauner@kernel.org \
    --cc=kernel-team@meta.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=paul@paul-moore.com \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.