SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: add options to delegate BPFFS token creation

Browse Source 
Add four new options BPFDelegate{Commands,Maps,Programs,Attachments}=
in order to delegate to a BPFFS instance the permission to create tokens.

The value is a list of options taken from:
https://github.com/torvalds/linux/blob/v6.14/include/uapi/linux/bpf.h#L922-L1121
The special value "any" means to allow every possible values.

More informations about BPF tokens here:
https://lwn.net/Articles/947173/
This commit is contained in:
Matteo Croce
2025-07-08 22:35:29 +02:00
parent 3a47437fc9
commit ea9826eb94
21 changed files with 677 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+50
View File
@@ -2565,6 +2565,56 @@ RestrictNamespaces=~cgroup net</programlisting>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>BPFDelegateCommands=</varname></term>
<listitem><para>Accepts a list of BPF commands to allow or <literal>any</literal> to allow everything.
Defaults to none. The accepted values are:
<xi:include href="bpf-delegate.xml" xpointer="bpf_delegate_cmd"/>
Requires <varname>PrivateBPF=</varname> enabled to be effective.
This will set the <constant>delegate_cmds</constant> bpffs mount option.
A more detailed explanation of the feature can be found in this
<ulink url="https://lwn.net/Articles/947173/">LWN post</ulink>.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>BPFDelegateMaps=</varname></term>
<listitem><para>Accepts a list of BPF maps to allow or <literal>any</literal> to allow everything.
Defaults to none. The accepted values are:
<xi:include href="bpf-delegate.xml" xpointer="bpf_delegate_map_type"/>
This will set the <constant>delegate_maps</constant> bpffs mount option.
See <varname>BPFDelegateCommands=</varname> for dependencies and more details.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>BPFDelegatePrograms=</varname></term>
<listitem><para>Accepts a list of BPF programs to allow or <literal>any</literal> to allow everything.
Defaults to none. The accepted values are:
<xi:include href="bpf-delegate.xml" xpointer="bpf_delegate_prog_type"/>
This will set the <constant>delegate_progs</constant> bpffs mount option.
See <varname>BPFDelegateCommands=</varname> for dependencies and more details.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>BPFDelegateAttachments=</varname></term>
<listitem><para>Accepts a list of BPF attach points to allow or <literal>any</literal> to allow everything.
Defaults to none. The accepted values are:
<xi:include href="bpf-delegate.xml" xpointer="bpf_delegate_attach_type"/>
This will set the <constant>delegate_attachs</constant> bpffs mount option.
See <varname>BPFDelegateCommands=</varname> for dependencies and more details.</para>
<xi:include href="version-info.xml" xpointer="v258"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>LockPersonality=</varname></term>