Received-SPF: pass (google.com: domain of linux-kernel+bounces-4545-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Mon, 18 Dec 2023 16:55:13 -0800
From: Jakub Kicinski <kuba@kernel.org>
To: torvalds@linuxfoundation.org
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>, davem@davemloft.net,
 edumazet@google.com, pabeni@redhat.com, daniel@iogearbox.net,
 andrii@kernel.org, peterz@infradead.org, brauner@kernel.org,
 netdev@vger.kernel.org, bpf@vger.kernel.org, kernel-team@fb.com,
 linux-kernel@vger.kernel.org
Subject: Re: pull-request: bpf-next 2023-12-18
Message-ID: <20231218165513.24717ec1@kernel.org>
In-Reply-To: <20231219000520.34178-1-alexei.starovoitov@gmail.com>
References: <20231219000520.34178-1-alexei.starovoitov@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Mon, 18 Dec 2023 16:05:20 -0800 Alexei Starovoitov wrote:
> 2) Introduce BPF token object, from Andrii Nakryiko.
> It adds an ability to delegate a subset of BPF features from privileged daemon
> (e.g., systemd) through special mount options for userns-bound BPF FS to a
> trusted unprivileged application. The design accommodates suggestions from
> Christian Brauner and Paul Moore.
> Example:
> $ sudo mkdir -p /sys/fs/bpf/token
> $ sudo mount -t bpf bpffs /sys/fs/bpf/token \
>              -o delegate_cmds=prog_load:MAP_CREATE \
>              -o delegate_progs=kprobe \
>              -o delegate_attachs=xdp

LGTM, but what do I know about file systems.. Adding LKML to the CC
list, if anyone has any late comments on the BPF token come forward
now, petty please?