bpf_real_data_inode() must be usable from the bprm_check_security, mmap_file and file_mprotect hooks for systemd's RestrictFilesystemAccess BPF LSM program, so have it take a struct file instead of a dentry. Amir Goldstein suggests: While doing so, rename it from bpf_real_inode() to bpf_real_data_inode(). For a regular file on a union/overlay filesystem it resolves to the underlying inode that hosts the data, but for a non-regular file it returns the overlay inode. The new name makes the "inode hosting the data" intent explicit and avoids the ambiguity of "the real inode backing a file". Document the non-regular-file behavior in the kfunc too. Both the signature change and the rename are safe because the kfunc landed this cycle and has no released users. Fixes: 9af8c8a54f6e ("bpf: add bpf_real_inode() kfunc") Signed-off-by: Christian Brauner (Amutable) --- Changes in v2: - Rename bpf_real_inode() -> bpf_real_data_inode() (Amir); the new name makes the "inode hosting the data" intent explicit. - Document that the kfunc returns the overlay inode for non-regular files. - Link to v1: https://patch.msgid.link/20260622-work-bpf-real_inode-v1-1-4014eb4cbefd@kernel.org --- fs/bpf_fs_kfuncs.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c index 768aca2dc0f0..f1863a891db6 100644 --- a/fs/bpf_fs_kfuncs.c +++ b/fs/bpf_fs_kfuncs.c @@ -360,18 +360,23 @@ __bpf_kfunc int bpf_cgroup_read_xattr(struct cgroup *cgroup, const char *name__s #endif /* CONFIG_CGROUPS */ /** - * bpf_real_inode - get the real inode backing a dentry - * @dentry: dentry to resolve + * bpf_real_data_inode - get the real inode hosting a file's data + * @file: file to resolve * - * If the dentry is on a union/overlay filesystem, return the underlying, real - * inode that hosts the data. Otherwise return the inode attached to the - * dentry itself. + * Resolve @file to the inode that hosts its data. For a regular file on a + * union/overlay filesystem this is the underlying (upper or lower) inode that + * stores the data, not the overlay inode. * - * Return: The real inode backing the dentry, or NULL for a negative dentry. + * Data resolution only applies to regular files. For a non-regular file (e.g. + * a device node, fifo or socket) on a union/overlay filesystem the overlay + * inode itself is returned; for any file on a non-union filesystem the inode + * attached to @file is returned. + * + * Return: The inode hosting @file's data, or NULL. */ -__bpf_kfunc struct inode *bpf_real_inode(struct dentry *dentry) +__bpf_kfunc struct inode *bpf_real_data_inode(struct file *file) { - return d_real_inode(dentry); + return d_real_inode(file_dentry(file)); } __bpf_kfunc_end_defs(); @@ -384,7 +389,7 @@ BTF_ID_FLAGS(func, bpf_get_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE) -BTF_ID_FLAGS(func, bpf_real_inode, KF_SLEEPABLE | KF_RET_NULL) +BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL) BTF_KFUNCS_END(bpf_fs_kfunc_set_ids) static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id) --- base-commit: 5b33fc6492a7b7a62359157db0f92f5b6e9af690 change-id: 20260622-work-bpf-real_inode-c3202dbaf0ab