Linux 7.3 Adds New "bpf_sock_read_xattr" Feature For systemd, BPF Programs

Linux 7.3 introduces a new bpf_sock_read_xattr() kernel function, developed by Christian Brauner, that lets BPF programs efficiently and locklessly read user.* extended attributes from a socket's sockfs inode. This builds on the extended attributes on sockets feature merged earlier in Linux 7.1, which systemd and GNOME use for socket rate limiting and tagging sockets for purposes like implementing a Varlink registry. The kfunc is registered as KF_RCU and restricted to BPF LSM programs, since struct socket is only guaranteed to live in sockfs when handed out via an LSM socket hook; sockets embedded elsewhere (tun, tap) are excluded. The read never sleeps and takes no locks, resolving values via an RCU-protected rhashtable lookup, making it usable from both sleepable and non-sleepable LSM hooks. The support has been merged for the upcoming Linux 7.3 kernel.

Source: https://www.phoronix.com/news/Linux-7.3-bpf_sock_read_xattr. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.