Bpftool sync 2025-09-01 #212
Merged
+315
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add `bpftool token show` command to get token info
from bpffs in /proc/mounts.
Example plain output for `token show`:
token_info /sys/fs/bpf/token
allowed_cmds:
map_create prog_load
allowed_maps:
allowed_progs:
kprobe
allowed_attachs:
xdp
token_info /sys/fs/bpf/token2
allowed_cmds:
map_create prog_load
allowed_maps:
allowed_progs:
kprobe
allowed_attachs:
xdp
Example json output for `token show`:
[{
"token_info": "/sys/fs/bpf/token",
"allowed_cmds": ["map_create", "prog_load"],
"allowed_maps": [],
"allowed_progs": ["kprobe"],
"allowed_attachs": ["xdp"]
}, {
"token_info": "/sys/fs/bpf/token2",
"allowed_cmds": ["map_create", "prog_load"],
"allowed_maps": [],
"allowed_progs": ["kprobe"],
"allowed_attachs": ["xdp"]
}]
Reviewed-by: Quentin Monnet <[email protected]>
Signed-off-by: Tao Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Alexei Starovoitov <[email protected]>
Add bpftool-token manpage with information and examples of token-related commands. Suggested-by: Quentin Monnet <[email protected]> Reviewed-by: Quentin Monnet <[email protected]> Signed-off-by: Tao Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
This commit updates the bash completion script with the new token argument. $ bpftool token help list show Reviewed-by: Quentin Monnet <[email protected]> Signed-off-by: Tao Chen <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
From bpftool's github repository issue [0]: When a Linux distribution has the kernel.kptr_restrict set to 2, bpftool prog dump jited returns "no instructions returned". This message can be puzzling to bpftool users who are not familiar with kernel BPF internals, so add a small hint for bpftool users to check the kernel.kptr_restrict setting similar to the DUMP_XLATED case. Outside of kernel.kptr_restrict, no instructions could also be returned in case the JIT was disabled. Signed-off-by: Vincent Li <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Daniel Borkmann <[email protected]> Link: libbpf#184 [0] Link: https://lore.kernel.org/bpf/[email protected]
Pull latest libbpf from mirror. Libbpf version: 1.7.0 Libbpf commit: 3f077472ee7e703b733c2c9ae15ef3f4c13ee25b Signed-off-by: Quentin Monnet <[email protected]>
The 'commit 35f96de04127 ("bpf: Introduce BPF token object")' added
BPF token as a new kind of BPF kernel object. And BPF_OBJ_GET_INFO_BY_FD
already used to get BPF object info, so we can also get token info with
this cmd.
One usage scenario, when program runs failed with token, because of
the permission failure, we can report what BPF token is allowing with
this API for debugging.
Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Tao Chen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Alexei Starovoitov <[email protected]>
Syncing latest bpftool commits from kernel repository. Baseline bpf-next commit: e860a98c8aebd8de82c0ee901acf5a759acd4570 Checkpoint bpf-next commit: 21aeabb68258ce17b91af113a768760b3a491d93 Baseline bpf commit: bf4807c89d8f92c47404b1e4eeeefb42259d1b50 Checkpoint bpf commit: 27861fc720be2c39b861d8bdfb68287f54de6855 Tao Chen (4): bpf: Add struct bpf_token_info bpftool: Add bpf_token show bpftool: Add bpftool-token manpage bpftool: Add bash completion for token argument Vincent Li (1): bpftool: Add kernel.kptr_restrict hint for no instructions bash-completion/bpftool | 11 ++ docs/bpftool-token.rst | 64 +++++++++++ include/uapi/linux/bpf.h | 8 ++ src/main.c | 3 +- src/main.h | 1 + src/prog.c | 2 +- src/token.c | 225 +++++++++++++++++++++++++++++++++++++++ 7 files changed, 312 insertions(+), 2 deletions(-) create mode 100644 docs/bpftool-token.rst create mode 100644 src/token.c Signed-off-by: Quentin Monnet <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull latest libbpf from mirror and sync bpftool repo with kernel, up to the commits used for libbpf sync. This is an automatic update performed by calling the sync script from this repo: