Message-Id: 
 <170188683075.21405.15376441127449245098.git-patchwork-notify@kernel.org>
Date: Wed, 06 Dec 2023 18:20:30 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Andrii Nakryiko <andrii@...nel.org>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org, paul@...l-moore.com,
 brauner@...nel.org, linux-fsdevel@...r.kernel.org,
 linux-security-module@...r.kernel.org, keescook@...omium.org,
 kernel-team@...a.com, sargun@...gun.me
Subject: Re: [PATCH v12 bpf-next 00/17] BPF token and BPF FS-based delegation

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@...nel.org>:

On Thu, 30 Nov 2023 10:52:12 -0800 you wrote:
> This patch set introduces an ability to delegate a subset of BPF subsystem
> functionality from privileged system-wide daemon (e.g., systemd or any other
> container manager) through special mount options for userns-bound BPF FS to
> a *trusted* unprivileged application. Trust is the key here. This
> functionality is not about allowing unconditional unprivileged BPF usage.
> Establishing trust, though, is completely up to the discretion of respective
> privileged application that would create and mount a BPF FS instance with
> delegation enabled, as different production setups can and do achieve it
> through a combination of different means (signing, LSM, code reviews, etc),
> and it's undesirable and infeasible for kernel to enforce any particular way
> of validating trustworthiness of particular process.
> 
> [...]

Here is the summary with links:
  - [v12,bpf-next,01/17] bpf: align CAP_NET_ADMIN checks with bpf_capable() approach
    https://git.kernel.org/bpf/bpf-next/c/909fa05dd3c1
  - [v12,bpf-next,02/17] bpf: add BPF token delegation mount options to BPF FS
    https://git.kernel.org/bpf/bpf-next/c/40bba140c60f
  - [v12,bpf-next,03/17] bpf: introduce BPF token object
    https://git.kernel.org/bpf/bpf-next/c/4527358b7686
  - [v12,bpf-next,04/17] bpf: add BPF token support to BPF_MAP_CREATE command
    https://git.kernel.org/bpf/bpf-next/c/688b7270b3cb
  - [v12,bpf-next,05/17] bpf: add BPF token support to BPF_BTF_LOAD command
    https://git.kernel.org/bpf/bpf-next/c/ee54b1a910e4
  - [v12,bpf-next,06/17] bpf: add BPF token support to BPF_PROG_LOAD command
    https://git.kernel.org/bpf/bpf-next/c/e1cef620f598
  - [v12,bpf-next,07/17] bpf: take into account BPF token when fetching helper protos
    https://git.kernel.org/bpf/bpf-next/c/4cbb270e115b
  - [v12,bpf-next,08/17] bpf: consistently use BPF token throughout BPF verifier logic
    https://git.kernel.org/bpf/bpf-next/c/8062fb12de99
  - [v12,bpf-next,09/17] bpf,lsm: refactor bpf_prog_alloc/bpf_prog_free LSM hooks
    https://git.kernel.org/bpf/bpf-next/c/c3dd6e94df71
  - [v12,bpf-next,10/17] bpf,lsm: refactor bpf_map_alloc/bpf_map_free LSM hooks
    https://git.kernel.org/bpf/bpf-next/c/66d636d70a79
  - [v12,bpf-next,11/17] bpf,lsm: add BPF token LSM hooks
    https://git.kernel.org/bpf/bpf-next/c/d734ca7b33db
  - [v12,bpf-next,12/17] libbpf: add bpf_token_create() API
    https://git.kernel.org/bpf/bpf-next/c/ecd435143eb0
  - [v12,bpf-next,13/17] libbpf: add BPF token support to bpf_map_create() API
    https://git.kernel.org/bpf/bpf-next/c/37891cea6699
  - [v12,bpf-next,14/17] libbpf: add BPF token support to bpf_btf_load() API
    https://git.kernel.org/bpf/bpf-next/c/1a8df7fa00aa
  - [v12,bpf-next,15/17] libbpf: add BPF token support to bpf_prog_load() API
    https://git.kernel.org/bpf/bpf-next/c/1571740a9ba0
  - [v12,bpf-next,16/17] selftests/bpf: add BPF token-enabled tests
    https://git.kernel.org/bpf/bpf-next/c/dc5196fac40c
  - [v12,bpf-next,17/17] bpf,selinux: allocate bpf_security_struct per BPF token
    https://git.kernel.org/bpf/bpf-next/c/36fb94944b35

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Powered by blists - more mailing lists