bpf: introduce BPF token object

Add new kind of BPF kernel object, BPF token. BPF token is meant to allow delegating privileged BPF functionality, like loading a BPF program or creating a BPF map, from privileged process to a *trusted* unprivileged process, all while having a good amount of control over which privileged operations could be performed using provided BPF token. This is achieved through mounting BPF FS instance with extra delegation mount options, which determine what operations are delegatable, and also constraining it to the owning user namespace (as mentioned in the previous patch). BPF token itself is just a derivative from BPF FS and can be created through a new bpf() syscall command, BPF_TOKEN_CREATE, which accepts BPF FS FD, which can be attained through open() API by opening BPF FS mount point. Currently, BPF token "inherits" delegated command, map types, prog type, and attach type bit sets from BPF FS as is. In the future, having an BPF token as a separate object with its own FD, we can allow to further restrict BPF token's allowable set of things either at the creation time or after the fact, allowing the process to guard itself further from unintentionally trying to load undesired kind of BPF programs. But for now we keep things simple and just copy bit sets as is. When BPF token is created from BPF FS mount, we take reference to the BPF super block's owning user namespace, and then use that namespace for checking all the {CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN} capabilities that are normally only checked against init userns (using capable()), but now we check them using ns_capable() instead (if BPF token is provided). See bpf_token_capable() for details. Such setup means that BPF token in itself is not sufficient to grant BPF functionality. User namespaced process has to *also* have necessary combination of capabilities inside that user namespace. So while previously CAP_BPF was useless when granted within user namespace, now it gains a meaning and allows container managers and sys admins to have a flexible control over which processes can and need to use BPF functionality within the user namespace (i.e., container in practice). And BPF FS delegation mount options and derived BPF tokens serve as a per-container "flag" to grant overall ability to use bpf() (plus further restrict on which parts of bpf() syscalls are treated as namespaced). Note also, BPF_TOKEN_CREATE command itself requires ns_capable(CAP_BPF) within the BPF FS owning user namespace, rounding up the ns_capable() story of BPF token.

Andrii Nakryiko committed 2 years ago

Commit 45273581 parent 40bba147 files · +354 −6Browse files

Unified · Split

7 files

include/linux/bpf.h +41 −0
include/uapi/linux/bpf.h +37 −0
kernel/bpf/Makefile +1 −1
kernel/bpf/inode.c +7 −5
kernel/bpf/syscall.c +17 −0
kernel/bpf/token.c +214 −0
tools/include/uapi/linux/bpf.h +37 −0

include/linux/bpf.h+41−0

@@ -51,6 +51,10 @@ struct module; · 50 unmodified lines
51	struct bpf_func_state;	51	struct bpf_func_state;
52	struct ftrace_ops;	52	struct ftrace_ops;
53	struct cgroup;	53	struct cgroup;
		54	struct bpf_token;
		55	struct user_namespace;
		56	struct super_block;
		57	struct inode;
54		58
55	extern struct idr btf_idr;	59	extern struct idr btf_idr;
56	extern spinlock_t btf_idr_lock;	60	extern spinlock_t btf_idr_lock;
@@ -1591,6 +1595,13 @@ struct bpf_mount_opts { · 1534 unmodified lines
1591	u64 delegate_attachs;	1595	u64 delegate_attachs;
1592	};	1596	};
1593		1597
		1598	struct bpf_token {
		1599	struct work_struct work;
		1600	atomic64_t refcnt;
		1601	struct user_namespace *userns;
		1602	u64 allowed_cmds;
		1603	};
		1604
1594	struct bpf_struct_ops_value;	1605	struct bpf_struct_ops_value;
1595	struct btf_member;	1606	struct btf_member;
1596		1607
@@ -2048,6 +2059,7 @@ static inline void bpf_enable_instrumentation(void) · 451 unmodified lines
2048	migrate_enable();	2059	migrate_enable();
2049	}	2060	}
2050		2061
		2062	extern const struct super_operations bpf_super_ops;
2051	extern const struct file_operations bpf_map_fops;	2063	extern const struct file_operations bpf_map_fops;
2052	extern const struct file_operations bpf_prog_fops;	2064	extern const struct file_operations bpf_prog_fops;
2053	extern const struct file_operations bpf_iter_fops;	2065	extern const struct file_operations bpf_iter_fops;
@@ -2182,6 +2194,8 @@ static inline void bpf_map_dec_elem_count(struct bpf_map *map) · 128 unmodified lines
2182		2194
2183	extern int sysctl_unprivileged_bpf_disabled;	2195	extern int sysctl_unprivileged_bpf_disabled;
2184		2196
		2197	bool bpf_token_capable(const struct bpf_token *token, int cap);
		2198
2185	static inline bool bpf_allow_ptr_leaks(void)	2199	static inline bool bpf_allow_ptr_leaks(void)
2186	{	2200	{
2187	return perfmon_capable();	2201	return perfmon_capable();
@@ -2216,8 +2230,17 @@ int bpf_link_new_fd(struct bpf_link *link); · 28 unmodified lines
2216	struct bpf_link *bpf_link_get_from_fd(u32 ufd);	2230	struct bpf_link *bpf_link_get_from_fd(u32 ufd);
2217	struct bpf_link bpf_link_get_curr_or_next(u32 id);	2231	struct bpf_link bpf_link_get_curr_or_next(u32 id);
2218		2232
		2233	void bpf_token_inc(struct bpf_token *token);
		2234	void bpf_token_put(struct bpf_token *token);
		2235	int bpf_token_create(union bpf_attr *attr);
		2236	struct bpf_token *bpf_token_get_from_fd(u32 ufd);
		2237
		2238	bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
		2239
2219	int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);	2240	int bpf_obj_pin_user(u32 ufd, int path_fd, const char __user *pathname);
2220	int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);	2241	int bpf_obj_get_user(int path_fd, const char __user *pathname, int flags);
		2242	struct inode bpf_get_inode(struct super_block sb, const struct inode *dir,
		2243	umode_t mode);
2221		2244
2222	#define BPF_ITER_FUNC_PREFIX "bpf_iter_"	2245	#define BPF_ITER_FUNC_PREFIX "bpf_iter_"
2223	#define DEFINE_BPF_ITER_FUNC(target, args...) \	2246	#define DEFINE_BPF_ITER_FUNC(target, args...) \
@@ -2580,6 +2603,24 @@ static inline int bpf_obj_get_user(const char __user *pathname, int flags) · 356 unmodified lines
2580	return -EOPNOTSUPP;	2603	return -EOPNOTSUPP;
2581	}	2604	}
2582		2605
		2606	static inline bool bpf_token_capable(const struct bpf_token *token, int cap)
		2607	{
		2608	return capable(cap) \|\| (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));
		2609	}
		2610
		2611	static inline void bpf_token_inc(struct bpf_token *token)
		2612	{
		2613	}
		2614
		2615	static inline void bpf_token_put(struct bpf_token *token)
		2616	{
		2617	}
		2618
		2619	static inline struct bpf_token *bpf_token_get_from_fd(u32 ufd)
		2620	{
		2621	return ERR_PTR(-EOPNOTSUPP);
		2622	}
		2623
2583	static inline void __dev_flush(void)	2624	static inline void __dev_flush(void)
2584	{	2625	{
2585	}	2626	}

include/uapi/linux/bpf.h+37−0

@@ -847,6 +847,36 @@ union bpf_iter_link_info { · 846 unmodified lines
847	* Returns zero on success. On error, -1 is returned and errno	847	* Returns zero on success. On error, -1 is returned and errno
848	* is set appropriately.	848	* is set appropriately.
849	*	849	*
		850	* BPF_TOKEN_CREATE
		851	* Description
		852	* Create BPF token with embedded information about what
		853	* BPF-related functionality it allows:
		854	* - a set of allowed bpf() syscall commands;
		855	* - a set of allowed BPF map types to be created with
		856	* BPF_MAP_CREATE command, if BPF_MAP_CREATE itself is allowed;
		857	* - a set of allowed BPF program types and BPF program attach
		858	* types to be loaded with BPF_PROG_LOAD command, if
		859	* BPF_PROG_LOAD itself is allowed.
		860	*
		861	* BPF token is created (derived) from an instance of BPF FS,
		862	* assuming it has necessary delegation mount options specified.
		863	* This BPF token can be passed as an extra parameter to various
		864	* bpf() syscall commands to grant BPF subsystem functionality to
		865	* unprivileged processes.
		866	*
		867	* When created, BPF token is "associated" with the owning
		868	* user namespace of BPF FS instance (super block) that it was
		869	* derived from, and subsequent BPF operations performed with
		870	* BPF token would be performing capabilities checks (i.e.,
		871	* CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN) within
		872	* that user namespace. Without BPF token, such capabilities
		873	* have to be granted in init user namespace, making bpf()
		874	* syscall incompatible with user namespace, for the most part.
		875	*
		876	* Return
		877	* A new file descriptor (a nonnegative integer), or -1 if an
		878	* error occurred (in which case, errno is set appropriately).
		879	*
850	* NOTES	880	* NOTES
851	* eBPF objects (maps and programs) can be shared between processes.	881	* eBPF objects (maps and programs) can be shared between processes.
852	*	882	*
@@ -901,6 +931,8 @@ enum bpf_cmd { · 48 unmodified lines
901	BPF_ITER_CREATE,	931	BPF_ITER_CREATE,
902	BPF_LINK_DETACH,	932	BPF_LINK_DETACH,
903	BPF_PROG_BIND_MAP,	933	BPF_PROG_BIND_MAP,
		934	BPF_TOKEN_CREATE,
		935	__MAX_BPF_CMD,
904	};	936	};
905		937
906	enum bpf_map_type {	938	enum bpf_map_type {
@@ -1712,6 +1744,11 @@ union bpf_attr { · 805 unmodified lines
1712	__u32 flags; /* extra flags */	1744	__u32 flags; /* extra flags */
1713	} prog_bind_map;	1745	} prog_bind_map;
1714		1746
		1747	struct { /* struct used by BPF_TOKEN_CREATE command */
		1748	__u32 flags;
		1749	__u32 bpffs_fd;
		1750	} token_create;
		1751
1715	} __attribute__((aligned(8)));	1752	} __attribute__((aligned(8)));
1716		1753
1717	/* The description below is an attempt at providing documentation to eBPF	1754	/* The description below is an attempt at providing documentation to eBPF

kernel/bpf/Makefile+1−1

@@ -6,7 +6,7 @@ cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse · 5 unmodified lines
6	endif	6	endif
7	CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy)	7	CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy)
8		8
9	obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o	9	obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o log.o token.o
10	obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o	10	obj-$(CONFIG_BPF_SYSCALL) += bpf_iter.o map_iter.o task_iter.o prog_iter.o link_iter.o
11	obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o	11	obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o bloom_filter.o
12	obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o	12	obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o

kernel/bpf/inode.c+7−5

 static const struct inode_operations bpf_map_iops  = { };
 static const struct inode_operations bpf_link_iops  = { };
-static struct inode *bpf_get_inode(struct super_block *sb,
+struct inode *bpf_get_inode(struct super_block *sb,
-				   const struct inode *dir,
+			    const struct inode *dir,
-				   umode_t mode)
+			    umode_t mode)
 {
 	struct inode *inode;
 {
 	struct bpf_mount_opts *opts = root->d_sb->s_fs_info;
 	umode_t mode = d_inode(root)->i_mode & S_IALLUGO & ~S_ISVTX;
+	u64 mask;
 	if (mode != S_IRWXUGO)
 		seq_printf(m, ",mode=%o", mode);
-	if (opts->delegate_cmds == ~0ULL)
+	mask = (1ULL << __MAX_BPF_CMD) - 1;
+	if ((opts->delegate_cmds & mask) == mask)
 		seq_printf(m, ",delegate_cmds=any");
 	else if (opts->delegate_cmds)
 		seq_printf(m, ",delegate_cmds=0x%llx", opts->delegate_cmds);
 	free_inode_nonrcu(inode);
 }
-static const struct super_operations bpf_super_ops = {
+const struct super_operations bpf_super_ops = {
 	.statfs		= simple_statfs,
 	.drop_inode	= generic_delete_inode,
 	.show_options	= bpf_show_options,

kernel/bpf/syscall.c+17−0

@@ -5377,6 +5377,20 @@ out_prog_put: · 5376 unmodified lines
5377	return ret;	5377	return ret;
5378	}	5378	}
5379		5379
		5380	#define BPF_TOKEN_CREATE_LAST_FIELD token_create.bpffs_fd
		5381
		5382	static int token_create(union bpf_attr *attr)
		5383	{
		5384	if (CHECK_ATTR(BPF_TOKEN_CREATE))
		5385	return -EINVAL;
		5386
		5387	/* no flags are supported yet */
		5388	if (attr->token_create.flags)
		5389	return -EINVAL;
		5390
		5391	return bpf_token_create(attr);
		5392	}
		5393
5380	static int __sys_bpf(int cmd, bpfptr_t uattr, unsigned int size)	5394	static int __sys_bpf(int cmd, bpfptr_t uattr, unsigned int size)
5381	{	5395	{
5382	union bpf_attr attr;	5396	union bpf_attr attr;
@@ -5510,6 +5524,9 @@ static int __sys_bpf(int cmd, bpfptr_t uattr, unsigned int size) · 127 unmodified lines
5510	case BPF_PROG_BIND_MAP:	5524	case BPF_PROG_BIND_MAP:
5511	err = bpf_prog_bind_map(&attr);	5525	err = bpf_prog_bind_map(&attr);
5512	break;	5526	break;
		5527	case BPF_TOKEN_CREATE:
		5528	err = token_create(&attr);
		5529	break;
5513	default:	5530	default:
5514	err = -EINVAL;	5531	err = -EINVAL;
5515	break;	5532	break;

kernel/bpf/token.c+214−0

@@ -0,0 +1,214 @@
	1	#include <linux/bpf.h>
	2	#include <linux/vmalloc.h>
	3	#include <linux/fdtable.h>
	4	#include <linux/file.h>
	5	#include <linux/fs.h>
	6	#include <linux/kernel.h>
	7	#include <linux/idr.h>
	8	#include <linux/namei.h>
	9	#include <linux/user_namespace.h>
	10
	11	bool bpf_token_capable(const struct bpf_token *token, int cap)
	12	{
	13	/* BPF token allows ns_capable() level of capabilities, but only if
	14	* token's userns is exactly the same as current user's userns
	15	*/
	16	if (token && current_user_ns() == token->userns) {
	17	if (ns_capable(token->userns, cap))
	18	return true;
	19	if (cap != CAP_SYS_ADMIN && ns_capable(token->userns, CAP_SYS_ADMIN))
	20	return true;
	21	}
	22	/* otherwise fallback to capable() checks */
	23	return capable(cap) \|\| (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN));
	24	}
	25
	26	void bpf_token_inc(struct bpf_token *token)
	27	{
	28	atomic64_inc(&token->refcnt);
	29	}
	30
	31	static void bpf_token_free(struct bpf_token *token)
	32	{
	33	put_user_ns(token->userns);
	34	kvfree(token);
	35	}
	36
	37	static void bpf_token_put_deferred(struct work_struct *work)
	38	{
	39	struct bpf_token *token = container_of(work, struct bpf_token, work);
	40
	41	bpf_token_free(token);
	42	}
	43
	44	void bpf_token_put(struct bpf_token *token)
	45	{
	46	if (!token)
	47	return;
	48
	49	if (!atomic64_dec_and_test(&token->refcnt))
	50	return;
	51
	52	INIT_WORK(&token->work, bpf_token_put_deferred);
	53	schedule_work(&token->work);
	54	}
	55
	56	static int bpf_token_release(struct inode inode, struct file filp)
	57	{
	58	struct bpf_token *token = filp->private_data;
	59
	60	bpf_token_put(token);
	61	return 0;
	62	}
	63
	64	static void bpf_token_show_fdinfo(struct seq_file m, struct file filp)
	65	{
	66	struct bpf_token *token = filp->private_data;
	67	u64 mask;
	68
	69	BUILD_BUG_ON(__MAX_BPF_CMD >= 64);
	70	mask = (1ULL << __MAX_BPF_CMD) - 1;
	71	if ((token->allowed_cmds & mask) == mask)
	72	seq_printf(m, "allowed_cmds:\tany\n");
	73	else
	74	seq_printf(m, "allowed_cmds:\t0x%llx\n", token->allowed_cmds);
	75	}
	76
	77	#define BPF_TOKEN_INODE_NAME "bpf-token"
	78
	79	static const struct inode_operations bpf_token_iops = { };
	80
	81	static const struct file_operations bpf_token_fops = {
	82	.release = bpf_token_release,
	83	.show_fdinfo = bpf_token_show_fdinfo,
	84	};
	85
	86	int bpf_token_create(union bpf_attr *attr)
	87	{
	88	struct bpf_mount_opts *mnt_opts;
	89	struct bpf_token *token = NULL;
	90	struct user_namespace *userns;
	91	struct inode *inode;
	92	struct file *file;
	93	struct path path;
	94	struct fd f;
	95	umode_t mode;
	96	int err, fd;
	97
	98	f = fdget(attr->token_create.bpffs_fd);
	99	if (!f.file)
	100	return -EBADF;
	101
	102	path = f.file->f_path;
	103	path_get(&path);
	104	fdput(f);
	105
	106	if (path.dentry != path.mnt->mnt_sb->s_root) {
	107	err = -EINVAL;
	108	goto out_path;
	109	}
	110	if (path.mnt->mnt_sb->s_op != &bpf_super_ops) {
	111	err = -EINVAL;
	112	goto out_path;
	113	}
	114	err = path_permission(&path, MAY_ACCESS);
	115	if (err)
	116	goto out_path;
	117
	118	userns = path.dentry->d_sb->s_user_ns;
	119	/*
	120	* Enforce that creators of BPF tokens are in the same user
	121	* namespace as the BPF FS instance. This makes reasoning about
	122	* permissions a lot easier and we can always relax this later.
	123	*/
	124	if (current_user_ns() != userns) {
	125	err = -EPERM;
	126	goto out_path;
	127	}
	128	if (!ns_capable(userns, CAP_BPF)) {
	129	err = -EPERM;
	130	goto out_path;
	131	}
	132
	133	mode = S_IFREG \| ((S_IRUSR \| S_IWUSR) & ~current_umask());
	134	inode = bpf_get_inode(path.mnt->mnt_sb, NULL, mode);
	135	if (IS_ERR(inode)) {
	136	err = PTR_ERR(inode);
	137	goto out_path;
	138	}
	139
	140	inode->i_op = &bpf_token_iops;
	141	inode->i_fop = &bpf_token_fops;
	142	clear_nlink(inode); /* make sure it is unlinked */
	143
	144	file = alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME, O_RDWR, &bpf_token_fops);
	145	if (IS_ERR(file)) {
	146	iput(inode);
	147	err = PTR_ERR(file);
	148	goto out_path;
	149	}
	150
	151	token = kvzalloc(sizeof(*token), GFP_USER);
	152	if (!token) {
	153	err = -ENOMEM;
	154	goto out_file;
	155	}
	156
	157	atomic64_set(&token->refcnt, 1);
	158
	159	/* remember bpffs owning userns for future ns_capable() checks */
	160	token->userns = get_user_ns(userns);
	161
	162	mnt_opts = path.dentry->d_sb->s_fs_info;
	163	token->allowed_cmds = mnt_opts->delegate_cmds;
	164
	165	fd = get_unused_fd_flags(O_CLOEXEC);
	166	if (fd < 0) {
	167	err = fd;
	168	goto out_token;
	169	}
	170
	171	file->private_data = token;
	172	fd_install(fd, file);
	173
	174	path_put(&path);
	175	return fd;
	176
	177	out_token:
	178	bpf_token_free(token);
	179	out_file:
	180	fput(file);
	181	out_path:
	182	path_put(&path);
	183	return err;
	184	}
	185
	186	struct bpf_token *bpf_token_get_from_fd(u32 ufd)
	187	{
	188	struct fd f = fdget(ufd);
	189	struct bpf_token *token;
	190
	191	if (!f.file)
	192	return ERR_PTR(-EBADF);
	193	if (f.file->f_op != &bpf_token_fops) {
	194	fdput(f);
	195	return ERR_PTR(-EINVAL);
	196	}
	197
	198	token = f.file->private_data;
	199	bpf_token_inc(token);
	200	fdput(f);
	201
	202	return token;
	203	}
	204
	205	bool bpf_token_allow_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
	206	{
	207	/* BPF token can be used only within exactly the same userns in which
	208	* it was created
	209	*/
	210	if (!token \|\| current_user_ns() != token->userns)
	211	return false;
	212
	213	return token->allowed_cmds & (1ULL << cmd);
	214	}

tools/include/uapi/linux/bpf.h+37−0

@@ -847,6 +847,36 @@ union bpf_iter_link_info { · 846 unmodified lines
847	* Returns zero on success. On error, -1 is returned and errno	847	* Returns zero on success. On error, -1 is returned and errno
848	* is set appropriately.	848	* is set appropriately.
849	*	849	*
		850	* BPF_TOKEN_CREATE
		851	* Description
		852	* Create BPF token with embedded information about what
		853	* BPF-related functionality it allows:
		854	* - a set of allowed bpf() syscall commands;
		855	* - a set of allowed BPF map types to be created with
		856	* BPF_MAP_CREATE command, if BPF_MAP_CREATE itself is allowed;
		857	* - a set of allowed BPF program types and BPF program attach
		858	* types to be loaded with BPF_PROG_LOAD command, if
		859	* BPF_PROG_LOAD itself is allowed.
		860	*
		861	* BPF token is created (derived) from an instance of BPF FS,
		862	* assuming it has necessary delegation mount options specified.
		863	* This BPF token can be passed as an extra parameter to various
		864	* bpf() syscall commands to grant BPF subsystem functionality to
		865	* unprivileged processes.
		866	*
		867	* When created, BPF token is "associated" with the owning
		868	* user namespace of BPF FS instance (super block) that it was
		869	* derived from, and subsequent BPF operations performed with
		870	* BPF token would be performing capabilities checks (i.e.,
		871	* CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_ADMIN) within
		872	* that user namespace. Without BPF token, such capabilities
		873	* have to be granted in init user namespace, making bpf()
		874	* syscall incompatible with user namespace, for the most part.
		875	*
		876	* Return
		877	* A new file descriptor (a nonnegative integer), or -1 if an
		878	* error occurred (in which case, errno is set appropriately).
		879	*
850	* NOTES	880	* NOTES
851	* eBPF objects (maps and programs) can be shared between processes.	881	* eBPF objects (maps and programs) can be shared between processes.
852	*	882	*
@@ -901,6 +931,8 @@ enum bpf_cmd { · 48 unmodified lines
901	BPF_ITER_CREATE,	931	BPF_ITER_CREATE,
902	BPF_LINK_DETACH,	932	BPF_LINK_DETACH,
903	BPF_PROG_BIND_MAP,	933	BPF_PROG_BIND_MAP,
		934	BPF_TOKEN_CREATE,
		935	__MAX_BPF_CMD,
904	};	936	};
905		937
906	enum bpf_map_type {	938	enum bpf_map_type {
@@ -1712,6 +1744,11 @@ union bpf_attr { · 805 unmodified lines
1712	__u32 flags; /* extra flags */	1744	__u32 flags; /* extra flags */
1713	} prog_bind_map;	1745	} prog_bind_map;
1714		1746
		1747	struct { /* struct used by BPF_TOKEN_CREATE command */
		1748	__u32 flags;
		1749	__u32 bpffs_fd;
		1750	} token_create;
		1751
1715	} __attribute__((aligned(8)));	1752	} __attribute__((aligned(8)));
1716		1753
1717	/* The description below is an attempt at providing documentation to eBPF	1754	/* The description below is an attempt at providing documentation to eBPF