Re: [PATCH bpf-next v3 1/2] bpf, cgroup: Don't populate prog_attach_flags array when effective query

[Martin KaFai Lau]

On 9/14/22 9:17 AM, Pu Lehui wrote:
> From: Pu Lehui <pulehui@xxxxxxxxxx>
>
> Attach flags is only valid for attached progs of this layer cgroup,
> but not for effective progs. For querying with EFFECTIVE flags,
> exporting attach flags does not make sense. so we don't need to
> populate prog_attach_flags array when effective query.

prog_attach_flags has been added to 6.0 which is in rc5.  It is still 
doable (and cleaner) to reject prog_attach_flags when it is an 
effective_query.  This should be done regardless of 'type == 
BPF_LSM_CGROUP' or not.  Something like:

if (effective_query && prog_attach_flags)
    return -EINVAL;

Otherwise, the whole prog_attach_flags needs to be set to 0 during 
effective_query.  Please target the change to the bpf tree instead of 
bpf-next such that this uapi bit can be fixed before 6.0.

Also, the effective_query issue is not limited to the prog_attach_flags? 
For the older uattr->query.attach_flags, it should be set to 0 also when 
it is an effective_query, right?