BPF filesystem kfuncs¶
BPF LSM programs need to access filesystem data from LSM hooks. The following BPF kfuncs can be used to get these data.
bpf_get_file_xattr()
bpf_get_fsverity_digest()
To avoid recursions, these kfuncs follow the following rules:
These kfuncs are only permitted from BPF LSM function.
These kfuncs should not call into other LSM hooks, i.e. security_*(). For example,
bpf_get_file_xattr()
does not usevfs_getxattr()
, because the latter calls LSM hooksecurity_inode_getxattr
.