On Fri, Jul 11, 2025 at 2:45 AM Tao Chen <chen.dylane@xxxxxxxxx> wrote:
>
> The 'commit 35f96de04127 ("bpf: Introduce BPF token object")' added
> BPF token as a new kind of BPF kernel object. And BPF_OBJ_GET_INFO_BY_FD
> already used to get BPF object info, so we can also get token info with
> this cmd.
>
Do you have a specific use case in mind for this API? I can see how
this might be useful for some hypothetical cases, but I have a few
reservations as of right now:
- we don't allow iterating all BPF token objects in the system the
same way we do it for progs, maps, and btfs, so bpftool cannot take
advantage of this to list all available tokens and their info, which
makes this API a bit less useful, IMO;
- BPF token was designed in a way that users don't really need to
know allowed_* values (and if they do, they can get it from BPF FS's
mount information (e.g., from /proc/mounts).
As I said, I can come up with some hypothetical situations where a
user might want to avoid doing something that otherwise they'd do
outside of userns, but I'm wondering what your motivations are for
this?
> Signed-off-by: Tao Chen <chen.dylane@xxxxxxxxx>
> ---
> include/linux/bpf.h | 11 +++++++++++
> include/uapi/linux/bpf.h | 8 ++++++++
> kernel/bpf/syscall.c | 18 ++++++++++++++++++
> kernel/bpf/token.c | 30 ++++++++++++++++++++++++++++--
> tools/include/uapi/linux/bpf.h | 8 ++++++++
> 5 files changed, 73 insertions(+), 2 deletions(-)
>
[...]
