linux-kernel - [PATCH v2 0/2] bpf: Add BPF_MAP_TYPE_CRED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250912222539.149952-1-dwindsor@gmail.com>
Date: Fri, 12 Sep 2025 18:25:37 -0400
From: David Windsor <dwindsor@...il.com>
To: bpf@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
	martin.lau@...ux.dev,
	ast@...nel.org,
	daniel@...earbox.net,
	andrii@...nel.org,
	eddyz87@...il.com,
	song@...nel.org,
	yonghong.song@...ux.dev,
	john.fastabend@...il.com,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org,
	dwindsor@...il.com
Subject: [PATCH v2 0/2] bpf: Add BPF_MAP_TYPE_CRED_STORAGE support

This series adds BPF_MAP_TYPE_CRED_STORAGE, enabling BPF programs to
associate data with credential structures (struct cred).

Like other local storage types (task, inode, sk), this provides automatic
lifecycle management and is useful for LSM programs tracking credential
state across LSM calls. Lifetime management is necessary for detecting
credential leaks and enforcing time-based security policies.

The implementation uses kfuncs (bpf_cred_storage_get/delete) that return
bpf_local_storage_data pointers, with map values accessible via the data
field.

v2:
- fix kernel ci build error

David Windsor (2):
  bpf: Add BPF_MAP_TYPE_CRED_STORAGE map type and kfuncs
  selftests/bpf: Add cred local storage tests

 include/linux/bpf_lsm.h                       |  35 ++++
 include/linux/bpf_types.h                     |   1 +
 include/uapi/linux/bpf.h                      |   1 +
 kernel/bpf/Makefile                           |   1 +
 kernel/bpf/bpf_cred_storage.c                 | 175 ++++++++++++++++++
 kernel/bpf/syscall.c                          |  10 +-
 kernel/cred.c                                 |   7 +
 security/bpf/hooks.c                          |   1 +
 .../selftests/bpf/prog_tests/cred_storage.c   |  52 ++++++
 .../selftests/bpf/progs/cred_storage.c        |  87 +++++++++
 10 files changed, 367 insertions(+), 3 deletions(-)
 create mode 100644 kernel/bpf/bpf_cred_storage.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/cred_storage.c
 create mode 100644 tools/testing/selftests/bpf/progs/cred_storage.c

-- 
2.43.0