Exclusive maps allow maps to only be accessed by program with a program with a matching hash which is specified in the excl_prog_hash attr. For the signing use-case, this allows the trusted loader program to load the map and verify the integrity
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -1522,6 +1522,12 @@ union bpf_attr { · 1521 unmodified lines | |||
| 1522 | * If provided, map_flags should have BPF_F_TOKEN_FD flag set. | 1522 | * If provided, map_flags should have BPF_F_TOKEN_FD flag set. |
| 1523 | */ | 1523 | */ |
| 1524 | __s32 map_token_fd; | 1524 | __s32 map_token_fd; |
| 1525 | |||
| 1526 | /* Hash of the program that has exclusive access to the map. | ||
| 1527 | */ | ||
| 1528 | __aligned_u64 excl_prog_hash; | ||
| 1529 | /* Size of the passed excl_prog_hash. */ | ||
| 1530 | __u32 excl_prog_hash_size; | ||
| 1525 | }; | 1531 | }; |
| 1526 | 1532 | ||
| 1527 | struct { /* anonymous struct used by BPF_MAP_*_ELEM and BPF_MAP_FREEZE commands */ | 1533 | struct { /* anonymous struct used by BPF_MAP_*_ELEM and BPF_MAP_FREEZE commands */ |