linux-kernel - [PATCHSET v7] Inherited restrictions and BPF filtering for io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260127183311.86505-1-axboe@kernel.dk>
Date: Tue, 27 Jan 2026 11:29:55 -0700
From: Jens Axboe <axboe@...nel.dk>
To: io-uring@...r.kernel.org
Cc: brauner@...nel.org,
	cyphar@...har.com,
	jannh@...gle.com,
	kees@...nel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCHSET v7] Inherited restrictions and BPF filtering for io_uring

Hi,

Followup to v6 here:

https://lore.kernel.org/io-uring/20260119235456.1722452-1-axboe@kernel.dk/

Mostly just addressing a bit of feedback, feature wise this is all the
same as before. See the changelog section for more details.

Kernel branch can be found here:

https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git/log/?h=io_uring-bpf-restrictions.4

and a liburing branch with support helpers, man page, and a fairly
substantial test case can be found here:

https://git.kernel.org/pub/scm/linux/kernel/git/axboe/liburing.git/log/?h=bpf-restrictions

Feedback welcome!

Changes since v6
- Add pdu_size to struct io_uring_bpf_ctx. This will help future proof
  filters as they can check if they agree with the kernel on what is
  available, and it eliminates the need to pad the struct out for future
  expansion (Christian)
- Various code cleanups (Christian)
- Fix for FORTIFY on how the bctx filter struct is cleared.
- Rebase on current for-7.0/io_uring tree.

 include/linux/io_uring.h                 |  14 +-
 include/linux/io_uring_types.h           |  13 +
 include/linux/sched.h                    |   1 +
 include/uapi/linux/io_uring.h            |  10 +
 include/uapi/linux/io_uring/bpf_filter.h |  62 ++++
 io_uring/Kconfig                         |   5 +
 io_uring/Makefile                        |   1 +
 io_uring/bpf_filter.c                    | 430 +++++++++++++++++++++++
 io_uring/bpf_filter.h                    |  48 +++
 io_uring/io_uring.c                      |  48 +++
 io_uring/io_uring.h                      |   1 +
 io_uring/net.c                           |   9 +
 io_uring/net.h                           |   6 +
 io_uring/openclose.c                     |   9 +
 io_uring/openclose.h                     |   3 +
 io_uring/register.c                      |  91 +++++
 io_uring/tctx.c                          |  42 ++-
 kernel/fork.c                            |   5 +
 18 files changed, 788 insertions(+), 10 deletions(-)

--
Jens Axboe