This series adds BPF_MAP_TYPE_CRED_STORAGE, enabling BPF programs to associate data with credential structures (struct cred). Like other local storage types (task, inode, sk), this provides automatic lifecycle management and is useful for LSM programs tracking credential state across LSM calls. Lifetime management is necessary for detecting credential leaks and enforcing time-based security policies. The implementation uses kfuncs (bpf_cred_storage_get/delete) that return bpf_local_storage_data pointers, with map values accessible via the data field. v2: - fix kernel ci build error David Windsor (2): bpf: Add BPF_MAP_TYPE_CRED_STORAGE map type and kfuncs selftests/bpf: Add cred local storage tests include/linux/bpf_lsm.h | 35 ++++ include/linux/bpf_types.h | 1 + include/uapi/linux/bpf.h | 1 + kernel/bpf/Makefile | 1 + kernel/bpf/bpf_cred_storage.c | 175 ++++++++++++++++++ kernel/bpf/syscall.c | 10 +- kernel/cred.c | 7 + security/bpf/hooks.c | 1 + .../selftests/bpf/prog_tests/cred_storage.c | 52 ++++++ .../selftests/bpf/progs/cred_storage.c | 87 +++++++++ 10 files changed, 367 insertions(+), 3 deletions(-) create mode 100644 kernel/bpf/bpf_cred_storage.c create mode 100644 tools/testing/selftests/bpf/prog_tests/cred_storage.c create mode 100644 tools/testing/selftests/bpf/progs/cred_storage.c -- 2.43.0
