@@ -66,14 +66,22 @@ static int restore_priv_caps(__u64 old_caps)
66
66
return cap_enable_effective (old_caps , NULL );
67
67
}
68
68
69
- static int set_delegate_mask (int fs_fd , const char * key , __u64 mask )
69
+ static int set_delegate_mask (int fs_fd , const char * key , __u64 mask , const char * mask_str )
70
70
{
71
71
char buf [32 ];
72
72
int err ;
73
73
74
- snprintf (buf , sizeof (buf ), "0x%llx" , (unsigned long long )mask );
74
+ if (!mask_str ) {
75
+ if (mask == ~0ULL ) {
76
+ mask_str = "any" ;
77
+ } else {
78
+ snprintf (buf , sizeof (buf ), "0x%llx" , (unsigned long long )mask );
79
+ mask_str = buf ;
80
+ }
81
+ }
82
+
75
83
err = sys_fsconfig (fs_fd , FSCONFIG_SET_STRING , key ,
76
- mask == ~ 0ULL ? "any" : buf , 0 );
84
+ mask_str , 0 );
77
85
if (err < 0 )
78
86
err = - errno ;
79
87
return err ;
@@ -86,6 +94,10 @@ struct bpffs_opts {
86
94
__u64 maps ;
87
95
__u64 progs ;
88
96
__u64 attachs ;
97
+ const char * cmds_str ;
98
+ const char * maps_str ;
99
+ const char * progs_str ;
100
+ const char * attachs_str ;
89
101
};
90
102
91
103
static int create_bpffs_fd (void )
@@ -104,16 +116,16 @@ static int materialize_bpffs_fd(int fs_fd, struct bpffs_opts *opts)
104
116
int mnt_fd , err ;
105
117
106
118
/* set up token delegation mount options */
107
- err = set_delegate_mask (fs_fd , "delegate_cmds" , opts -> cmds );
119
+ err = set_delegate_mask (fs_fd , "delegate_cmds" , opts -> cmds , opts -> cmds_str );
108
120
if (!ASSERT_OK (err , "fs_cfg_cmds" ))
109
121
return err ;
110
- err = set_delegate_mask (fs_fd , "delegate_maps" , opts -> maps );
122
+ err = set_delegate_mask (fs_fd , "delegate_maps" , opts -> maps , opts -> maps_str );
111
123
if (!ASSERT_OK (err , "fs_cfg_maps" ))
112
124
return err ;
113
- err = set_delegate_mask (fs_fd , "delegate_progs" , opts -> progs );
125
+ err = set_delegate_mask (fs_fd , "delegate_progs" , opts -> progs , opts -> progs_str );
114
126
if (!ASSERT_OK (err , "fs_cfg_progs" ))
115
127
return err ;
116
- err = set_delegate_mask (fs_fd , "delegate_attachs" , opts -> attachs );
128
+ err = set_delegate_mask (fs_fd , "delegate_attachs" , opts -> attachs , opts -> attachs_str );
117
129
if (!ASSERT_OK (err , "fs_cfg_attachs" ))
118
130
return err ;
119
131
@@ -295,13 +307,13 @@ static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callba
295
307
}
296
308
297
309
/* ensure unprivileged child cannot set delegation options */
298
- err = set_delegate_mask (fs_fd , "delegate_cmds" , 0x1 );
310
+ err = set_delegate_mask (fs_fd , "delegate_cmds" , 0x1 , NULL );
299
311
ASSERT_EQ (err , - EPERM , "delegate_cmd_eperm" );
300
- err = set_delegate_mask (fs_fd , "delegate_maps" , 0x1 );
312
+ err = set_delegate_mask (fs_fd , "delegate_maps" , 0x1 , NULL );
301
313
ASSERT_EQ (err , - EPERM , "delegate_maps_eperm" );
302
- err = set_delegate_mask (fs_fd , "delegate_progs" , 0x1 );
314
+ err = set_delegate_mask (fs_fd , "delegate_progs" , 0x1 , NULL );
303
315
ASSERT_EQ (err , - EPERM , "delegate_progs_eperm" );
304
- err = set_delegate_mask (fs_fd , "delegate_attachs" , 0x1 );
316
+ err = set_delegate_mask (fs_fd , "delegate_attachs" , 0x1 , NULL );
305
317
ASSERT_EQ (err , - EPERM , "delegate_attachs_eperm" );
306
318
307
319
/* pass BPF FS context object to parent */
@@ -325,22 +337,22 @@ static void child(int sock_fd, struct bpffs_opts *opts, child_callback_fn callba
325
337
}
326
338
327
339
/* ensure unprivileged child cannot reconfigure to set delegation options */
328
- err = set_delegate_mask (fs_fd , "delegate_cmds" , ~ 0ULL );
340
+ err = set_delegate_mask (fs_fd , "delegate_cmds" , 0 , "any" );
329
341
if (!ASSERT_EQ (err , - EPERM , "delegate_cmd_eperm_reconfig" )) {
330
342
err = - EINVAL ;
331
343
goto cleanup ;
332
344
}
333
- err = set_delegate_mask (fs_fd , "delegate_maps" , ~ 0ULL );
345
+ err = set_delegate_mask (fs_fd , "delegate_maps" , 0 , "any" );
334
346
if (!ASSERT_EQ (err , - EPERM , "delegate_maps_eperm_reconfig" )) {
335
347
err = - EINVAL ;
336
348
goto cleanup ;
337
349
}
338
- err = set_delegate_mask (fs_fd , "delegate_progs" , ~ 0ULL );
350
+ err = set_delegate_mask (fs_fd , "delegate_progs" , 0 , "any" );
339
351
if (!ASSERT_EQ (err , - EPERM , "delegate_progs_eperm_reconfig" )) {
340
352
err = - EINVAL ;
341
353
goto cleanup ;
342
354
}
343
- err = set_delegate_mask (fs_fd , "delegate_attachs" , ~ 0ULL );
355
+ err = set_delegate_mask (fs_fd , "delegate_attachs" , 0 , "any" );
344
356
if (!ASSERT_EQ (err , - EPERM , "delegate_attachs_eperm_reconfig" )) {
345
357
err = - EINVAL ;
346
358
goto cleanup ;
@@ -933,8 +945,8 @@ void test_token(void)
933
945
{
934
946
if (test__start_subtest ("map_token" )) {
935
947
struct bpffs_opts opts = {
936
- .cmds = 1ULL << BPF_MAP_CREATE ,
937
- .maps = 1ULL << BPF_MAP_TYPE_STACK ,
948
+ .cmds_str = "map_create" ,
949
+ .maps_str = "stack" ,
938
950
};
939
951
940
952
subtest_userns (& opts , userns_map_create );
@@ -948,9 +960,9 @@ void test_token(void)
948
960
}
949
961
if (test__start_subtest ("prog_token" )) {
950
962
struct bpffs_opts opts = {
951
- .cmds = 1ULL << BPF_PROG_LOAD ,
952
- .progs = 1ULL << BPF_PROG_TYPE_XDP ,
953
- .attachs = 1ULL << BPF_XDP ,
963
+ .cmds_str = "PROG_LOAD" ,
964
+ .progs_str = "XDP" ,
965
+ .attachs_str = "xdp" ,
954
966
};
955
967
956
968
subtest_userns (& opts , userns_prog_load );
0 commit comments