Add BPF token support for program and map loading #1948
Open
javiercardona-work wants to merge 2 commits intocilium:mainfrom
Open
Add BPF token support for program and map loading #1948javiercardona-work wants to merge 2 commits intocilium:mainfrom
javiercardona-work wants to merge 2 commits intocilium:mainfrom
Conversation
Add TokenFD field to ProgramOptions and MapOptions to support loading BPF programs and creating maps using a BPF token. This enables unprivileged BPF operations in user namespaces with delegated BPF capabilities. When TokenFD is set to a positive value, the token file descriptor is passed to the kernel with the BPF_F_TOKEN_FD flag during program load and map creation syscalls. Also add internal/token package for global token storage and features.SetGlobalToken/GetGlobalToken for setting a default token to be used by feature probes. Signed-off-by: Javier Cardona <jcardona@meta.com>
Add tests for internal/token and features/token packages: - TestGlobalTokenDefault: verify default value is -1 - TestSetGetGlobalToken: verify set/get operations - TestGlobalTokenConcurrent: verify thread safety with concurrent readers and writers - TestGlobalTokenWrapper: verify features package correctly wraps internal/token Signed-off-by: Javier Cardona <jcardona@meta.com>
javiercardona-work
force-pushed
the
pr1
branch
from
700ce01 to
6f625a5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for loading BPF programs and creating maps using BPF tokens,
enabling unprivileged BPF operations in user namespaces with delegated
capabilities.
Changes:
TokenFDfield toProgramOptionsandMapOptionsBPF_F_TOKEN_FDflag during syscallsinternal/tokenpackage for global token storagefeatures.SetGlobalToken()/GetGlobalToken()for feature probe supportThis is the first step toward full BPF token support. Future work includes using the global token in feature probes and BTF loading.