Re: [PATCH bpf-next v3 05/15] lsm: Add the bpf_lsm_policy_from_fd kfunc

[bot+bpf-ci]

> diff --git a/security/bpf_lsm_kfuncs.c b/security/bpf_lsm_kfuncs.c
> index e1190215d477..988dcd6f4dd9 100644
> --- a/security/bpf_lsm_kfuncs.c
> +++ b/security/bpf_lsm_kfuncs.c

[ ... ]

> @@ -14,11 +14,50 @@
>
>  __bpf_kfunc_start_defs();
>
> +/**
> + * bpf_lsm_policy_from_fd - Get an LSM policy object from a fd
> + * @fd: file descriptor referring to a policy object, resolved in the
> + *      file descriptor table of the task running the program
> + * @flags: reserved for future use, must be 0
> + *
> + * Translate @fd, as set up through the owning LSM's own userspace
> + * interface, into a referenced policy object.  The fd identifies the
> + * LSM asked to translate it: each LSM recognizes its own fds and
> + * declines every other.  Only syscall programs may call this kfunc:
> + * they run in the context of the task invoking them, where the fd is
> + * meaningful.  The reference must be released with
> + * bpf_lsm_policy_release().
> + *
> + * Return: A referenced policy object, or NULL if @flags is not 0, if
> + * no enabled LSM recognizes @fd as one of its policy objects, or if
> + * the recognizing LSM fails to translate it.
> + */
> +__bpf_kfunc struct lsm_policy_object *bpf_lsm_policy_from_fd(int fd, u32 flags)
> +{
> +	struct lsm_static_call *scall;
> +	struct lsm_policy_object *object;
> +	int err;
> +
> +	if (flags)
> +		return NULL;
> +
> +	lsm_for_each_hook(scall, policy_object_from_fd) {
> +		err = scall->hl->hook.policy_object_from_fd(fd, &object);
> +		if (err == -EOPNOTSUPP)
> +			/* Not this LSM's fd: let another claim it. */
> +			continue;
> +		if (err)
> +			return NULL;
> +		return object;
> +	}
> +	return NULL;
> +}
> +
>  /**
>   * bpf_lsm_policy_release - Release a policy object reference
>   * @object: policy object to release
>   *
> - * Release an acquired reference on a policy object.
> + * Release a reference acquired with bpf_lsm_policy_from_fd().
>   */

This isn't a bug, but would keeping the more general wording here
('Release an acquired reference on a policy object') age better than
listing the acquiring kfuncs? A reference can also come out of a map kptr
field via bpf_kptr_xchg(), so the comment might need amending again when
other acquiring kfuncs are added.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34398515657