cdsphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget /translations/zh_CN/bpf/prog_lsmmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget /translations/zh_TW/bpf/prog_lsmmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget /translations/it_IT/bpf/prog_lsmmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget /translations/ja_JP/bpf/prog_lsmmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget /translations/ko_KR/bpf/prog_lsmmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget /translations/sp_SP/bpf/prog_lsmmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h!SPDX-License-Identifier: GPL-2.0+h]h!SPDX-License-Identifier: GPL-2.0+}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh:/var/lib/git/docbuild/linux/Documentation/bpf/prog_lsm.rsthKubh)}(hCopyright (C) 2020 Google LLC.h]hCopyright (C) 2020 Google LLC.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(hLSM BPF Programsh]hLSM BPF Programs}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hThese BPF programs allow runtime instrumentation of the LSM hooks by privileged users to implement system-wide MAC (Mandatory Access Control) and Audit policies using eBPF.h]hThese BPF programs allow runtime instrumentation of the LSM hooks by privileged users to implement system-wide MAC (Mandatory Access Control) and Audit policies using eBPF.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(h Structureh]h Structure}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh)}(hYThe example shows an eBPF program that can be attached to the ``file_mprotect`` LSM hook:h](h>The example shows an eBPF program that can be attached to the }(hhhhhNhNubhliteral)}(h``file_mprotect``h]h file_mprotect}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhubh LSM hook:}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](singlefile_mprotect (C function)c.file_mprotecthNtauh1jhhhhhNhNubhdesc)}(hhh](hdesc_signature)}(hYint file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot);h]hdesc_signature_line)}(hYint file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot);h](hdesc_sig_keyword_type)}(hinth]hint}(hj>hhhNhNubah}(h]h ]ktah"]h$]h&]uh1j<hj8hhhhhKubhdesc_sig_space)}(h h]h }(hjOhhhNhNubah}(h]h ]wah"]h$]h&]uh1jMhj8hhhhhKubh desc_name)}(h file_mprotecth]h desc_sig_name)}(h file_mprotecth]h file_mprotect}(hjfhhhNhNubah}(h]h ]nah"]h$]h&]uh1jdhj`ubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1j^hj8hhhhhKubhdesc_parameterlist)}(hG(struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot)h](hdesc_parameter)}(hstruct vm_area_struct *vmah](hdesc_sig_keyword)}(hstructh]hstruct}(hjhhhNhNubah}(h]h ]kah"]h$]h&]uh1jhjubjN)}(h h]h }(hjhhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjubh)}(hhh]je)}(hvm_area_structh]hvm_area_struct}(hjhhhNhNubah}(h]h ]jqah"]h$]h&]uh1jdhjubah}(h]h ]h"]h$]h&] refdomaincreftype identifier reftargetjmodnameN classnameN c:parent_keysphinx.domains.c LookupKey)}data]j ASTIdentifier)}jjhsbc.file_mprotectasbuh1hhjubjN)}(h h]h }(hjhhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjubhdesc_sig_punctuation)}(h*h]h*}(hjhhhNhNubah}(h]h ]pah"]h$]h&]uh1jhjubje)}(hvmah]hvma}(hjhhhNhNubah}(h]h ]jqah"]h$]h&]uh1jdhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hunsigned long reqproth](j=)}(hunsignedh]hunsigned}(hj hhhNhNubah}(h]h ]jIah"]h$]h&]uh1j<hjubjN)}(h h]h }(hjhhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjubj=)}(hlongh]hlong}(hj(hhhNhNubah}(h]h ]jIah"]h$]h&]uh1j<hjubjN)}(h h]h }(hj6hhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjubje)}(hreqproth]hreqprot}(hjDhhhNhNubah}(h]h ]jqah"]h$]h&]uh1jdhjubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubj)}(hunsigned long proth](j=)}(hunsignedh]hunsigned}(hj]hhhNhNubah}(h]h ]jIah"]h$]h&]uh1j<hjYubjN)}(h h]h }(hjkhhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjYubj=)}(hlongh]hlong}(hjyhhhNhNubah}(h]h ]jIah"]h$]h&]uh1j<hjYubjN)}(h h]h }(hjhhhNhNubah}(h]h ]jZah"]h$]h&]uh1jMhjYubje)}(hproth]hprot}(hjhhhNhNubah}(h]h ]jqah"]h$]h&]uh1jdhjYubeh}(h]h ]h"]h$]h&]noemphhhuh1jhjubeh}(h]h ]h"]h$]h&]hhuh1j}hj8hhhhhKubj)}(h;h]h;}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj8hhhhhKubeh}(h]h ]h"]h$]h&]hh add_permalinkuh1j6sphinx_line_type declaratorhj2hhhhhKubah}(h]j)ah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1j0hhhKhj-hhubh desc_content)}(hhh]h}(h]h ]h"]h$]h&]uh1jhj-hhhhhKubeh}(h]h ](jfunctioneh"]h$]h&]domainjobjtypejdesctypejnoindex noindexentrynocontentsentryuh1j+hhhhhNhNubh)}(hROther LSM hooks which can be instrumented can be found in ``security/security.c``.h](h:Other LSM hooks which can be instrumented can be found in }(hjhhhNhNubj)}(h``security/security.c``h]hsecurity/security.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hX eBPF programs that use Documentation/bpf/btf.rst do not need to include kernel headers for accessing information from the attached eBPF program's context. They can simply declare the structures in the eBPF program and only specify the fields that need to be accessed.h]hX eBPF programs that use Documentation/bpf/btf.rst do not need to include kernel headers for accessing information from the attached eBPF program’s context. They can simply declare the structures in the eBPF program and only specify the fields that need to be accessed.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh literal_block)}(hX.struct mm_struct { unsigned long start_brk, brk, start_stack; } __attribute__((preserve_access_index)); struct vm_area_struct { unsigned long start_brk, brk, start_stack; unsigned long vm_start, vm_end; struct mm_struct *vm_mm; } __attribute__((preserve_access_index));h]hX.struct mm_struct { unsigned long start_brk, brk, start_stack; } __attribute__((preserve_access_index)); struct vm_area_struct { unsigned long start_brk, brk, start_stack; unsigned long vm_start, vm_end; struct mm_struct *vm_mm; } __attribute__((preserve_access_index));}hjsbah}(h]h ]h"]h$]h&]hhforcelanguagejhighlight_args}uh1jhhhKhhhhubhnote)}(h&The order of the fields is irrelevant.h]h)}(hj0h]h&The order of the fields is irrelevant.}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK)hj.ubah}(h]h ]h"]h$]h&]uh1j,hhhhhhhNubh)}(h}This can be further simplified (if one has access to the BTF information at build time) by generating the ``vmlinux.h`` with:h](hjThis can be further simplified (if one has access to the BTF information at build time) by generating the }(hjEhhhNhNubj)}(h ``vmlinux.h``h]h vmlinux.h}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjEubh with:}(hjEhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK+hhhhubj)}(hB# bpftool btf dump file format c > vmlinux.hh]hB# bpftool btf dump file format c > vmlinux.h}hjesbah}(h]h ]h"]h$]h&]hhj(j)consolej*}uh1jhhhK.hhhhubj-)}(h``path-to-btf-vmlinux`` can be ``/sys/kernel/btf/vmlinux`` if the build environment matches the environment the BPF programs are deployed in.h]h)}(h``path-to-btf-vmlinux`` can be ``/sys/kernel/btf/vmlinux`` if the build environment matches the environment the BPF programs are deployed in.h](j)}(h``path-to-btf-vmlinux``h]hpath-to-btf-vmlinux}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjyubh can be }(hjyhhhNhNubj)}(h``/sys/kernel/btf/vmlinux``h]h/sys/kernel/btf/vmlinux}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjyubhS if the build environment matches the environment the BPF programs are deployed in.}(hjyhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK2hjuubah}(h]h ]h"]h$]h&]uh1j,hhhhhhhNubh)}(hpThe ``vmlinux.h`` can then simply be included in the BPF programs without requiring the definition of the types.h](hThe }(hjhhhNhNubj)}(h ``vmlinux.h``h]h vmlinux.h}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh_ can then simply be included in the BPF programs without requiring the definition of the types.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK6hhhhubh)}(hzThe eBPF programs can be declared using the``BPF_PROG`` macros defined in `tools/lib/bpf/bpf_tracing.h`_. In this example:h](hJThe eBPF programs can be declared using the``BPF_PROG`` macros defined in }(hjhhhNhNubh reference)}(h`tools/lib/bpf/bpf_tracing.h`_h]htools/lib/bpf/bpf_tracing.h}(hjhhhNhNubah}(h]h ]h"]h$]h&]nametools/lib/bpf/bpf_tracing.hrefuriahttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/lib/bpf/bpf_tracing.huh1jhjresolvedKubh. In this example:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK9hhhhubh block_quote)}(h* ``"lsm/file_mprotect"`` indicates the LSM hook that the program must be attached to * ``mprotect_audit`` is the name of the eBPF program h]h bullet_list)}(hhh](h list_item)}(hS``"lsm/file_mprotect"`` indicates the LSM hook that the program must be attached toh]h)}(hS``"lsm/file_mprotect"`` indicates the LSM hook that the program must be attached toh](j)}(h``"lsm/file_mprotect"``h]h"lsm/file_mprotect"}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh< indicates the LSM hook that the program must be attached to}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK=hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h3``mprotect_audit`` is the name of the eBPF program h]h)}(h2``mprotect_audit`` is the name of the eBPF programh](j)}(h``mprotect_audit``h]hmprotect_audit}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj+ubh is the name of the eBPF program}(hj+hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK?hj'ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bulletjuh1jhhhK=hjubah}(h]h ]h"]h$]h&]uh1jhhhK=hhhhubj)}(hXiSEC("lsm/file_mprotect") int BPF_PROG(mprotect_audit, struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot, int ret) { /* ret is the return value from the previous BPF program * or 0 if it's the first hook. */ if (ret != 0) return ret; int is_heap; is_heap = (vma->vm_start >= vma->vm_mm->start_brk && vma->vm_end <= vma->vm_mm->brk); /* Return an -EPERM or write information to the perf events buffer * for auditing */ if (is_heap) return -EPERM; }h]hXiSEC("lsm/file_mprotect") int BPF_PROG(mprotect_audit, struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot, int ret) { /* ret is the return value from the previous BPF program * or 0 if it's the first hook. */ if (ret != 0) return ret; int is_heap; is_heap = (vma->vm_start >= vma->vm_mm->start_brk && vma->vm_end <= vma->vm_mm->brk); /* Return an -EPERM or write information to the perf events buffer * for auditing */ if (is_heap) return -EPERM; }}hjZsbah}(h]h ]h"]h$]h&]hhj(j)jj*}uh1jhhhKAhhhhubh)}(hX?The ``__attribute__((preserve_access_index))`` is a clang feature that allows the BPF verifier to update the offsets for the access at runtime using the Documentation/bpf/btf.rst information. Since the BPF verifier is aware of the types, it also validates all the accesses made to the various types in the eBPF program.h](hThe }(hjihhhNhNubj)}(h*``__attribute__((preserve_access_index))``h]h&__attribute__((preserve_access_index))}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjiubhX is a clang feature that allows the BPF verifier to update the offsets for the access at runtime using the Documentation/bpf/btf.rst information. Since the BPF verifier is aware of the types, it also validates all the accesses made to the various types in the eBPF program.}(hjihhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKYhhhhubeh}(h] structureah ]h"] structureah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(hLoadingh]hLoading}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK`ubh)}(h]eBPF programs can be loaded with the :manpage:`bpf(2)` syscall's ``BPF_PROG_LOAD`` operation:h](h%eBPF programs can be loaded with the }(hjhhhNhNubhmanpage)}(h:manpage:`bpf(2)`h]hbpf(2)}(hjhhhNhNubah}(h]h ]jah"]h$]h&]hhpathbpf(2)pagebpfsection2uh1jhjubh syscall’s }(hjhhhNhNubj)}(h``BPF_PROG_LOAD``h]h BPF_PROG_LOAD}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh operation:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKbhjhhubj)}(hVstruct bpf_object *obj; obj = bpf_object__open("./my_prog.o"); bpf_object__load(obj);h]hVstruct bpf_object *obj; obj = bpf_object__open("./my_prog.o"); bpf_object__load(obj);}hjsbah}(h]h ]h"]h$]h&]hhj(j)jj*}uh1jhhhKehjhhubh)}(hKThis can be simplified by using a skeleton header generated by ``bpftool``:h](h?This can be simplified by using a skeleton header generated by }(hjhhhNhNubj)}(h ``bpftool``h]hbpftool}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKlhjhhubj)}(h1# bpftool gen skeleton my_prog.o > my_prog.skel.hh]h1# bpftool gen skeleton my_prog.o > my_prog.skel.h}hj sbah}(h]h ]h"]h$]h&]hhj(j)consolej*}uh1jhhhKnhjhhubh)}(hyand the program can be loaded by including ``my_prog.skel.h`` and using the generated helper, ``my_prog__open_and_load``.h](h+and the program can be loaded by including }(hjhhhNhNubj)}(h``my_prog.skel.h``h]hmy_prog.skel.h}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh! and using the generated helper, }(hjhhhNhNubj)}(h``my_prog__open_and_load``h]hmy_prog__open_and_load}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKrhjhhubeh}(h]loadingah ]h"]loadingah$]h&]uh1hhhhhhhhK`ubh)}(hhh](h)}(hAttachment to LSM Hooksh]hAttachment to LSM Hooks}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjUhhhhhKvubh)}(hThe LSM allows attachment of eBPF programs as LSM hooks using :manpage:`bpf(2)` syscall's ``BPF_RAW_TRACEPOINT_OPEN`` operation or more simply by using the libbpf helper ``bpf_program__attach_lsm``.h](h>The LSM allows attachment of eBPF programs as LSM hooks using }(hjfhhhNhNubj)}(h:manpage:`bpf(2)`h]hbpf(2)}(hjnhhhNhNubah}(h]h ]jah"]h$]h&]hhjbpf(2)jbpfjjuh1jhjfubh syscall’s }(hjfhhhNhNubj)}(h``BPF_RAW_TRACEPOINT_OPEN``h]hBPF_RAW_TRACEPOINT_OPEN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjfubh5 operation or more simply by using the libbpf helper }(hjfhhhNhNubj)}(h``bpf_program__attach_lsm``h]hbpf_program__attach_lsm}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjfubh.}(hjfhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKxhjUhhubh)}(hThe program can be detached from the LSM hook by *destroying* the ``link`` link returned by ``bpf_program__attach_lsm`` using ``bpf_link__destroy``.h](h1The program can be detached from the LSM hook by }(hjhhhNhNubhemphasis)}(h *destroying*h]h destroying}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh the }(hjhhhNhNubj)}(h``link``h]hlink}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh link returned by }(hjhhhNhNubj)}(h``bpf_program__attach_lsm``h]hbpf_program__attach_lsm}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh using }(hjhhhNhNubj)}(h``bpf_link__destroy``h]hbpf_link__destroy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK|hjUhhubh)}(hOne can also use the helpers generated in ``my_prog.skel.h`` i.e. ``my_prog__attach`` for attachment and ``my_prog__destroy`` for cleaning up.h](h*One can also use the helpers generated in }(hjhhhNhNubj)}(h``my_prog.skel.h``h]hmy_prog.skel.h}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh i.e. }(hjhhhNhNubj)}(h``my_prog__attach``h]hmy_prog__attach}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh for attachment and }(hjhhhNhNubj)}(h``my_prog__destroy``h]hmy_prog__destroy}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh for cleaning up.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjUhhubeh}(h]attachment-to-lsm-hooksah ]h"]attachment to lsm hooksah$]h&]uh1hhhhhhhhKvubh)}(hhh](h)}(hExamplesh]hExamples}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1hhjPhhhhhKubh)}(hAn example eBPF program can be found in `tools/testing/selftests/bpf/progs/lsm.c`_ and the corresponding userspace code in `tools/testing/selftests/bpf/prog_tests/test_lsm.c`_h](h(An example eBPF program can be found in }(hjahhhNhNubj)}(h*`tools/testing/selftests/bpf/progs/lsm.c`_h]h'tools/testing/selftests/bpf/progs/lsm.c}(hjihhhNhNubah}(h]h ]h"]h$]h&]name'tools/testing/selftests/bpf/progs/lsm.cjmhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/bpf/progs/lsm.cuh1jhjajKubh) and the corresponding userspace code in }(hjahhhNhNubj)}(h4`tools/testing/selftests/bpf/prog_tests/test_lsm.c`_h]h1tools/testing/selftests/bpf/prog_tests/test_lsm.c}(hj~hhhNhNubah}(h]h ]h"]h$]h&]name1tools/testing/selftests/bpf/prog_tests/test_lsm.cjwhttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/bpf/prog_tests/test_lsm.cuh1jhjajKubeh}(h]h ]h"]h$]h&]uh1hhhhKhjPhhubh)}(hLinksh]hLinks}hjsbah}(h]h ]h"]h$]h&]hhuh1hhjPhhhhhKubhtarget)}(h.. _tools/lib/bpf/bpf_tracing.h: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/lib/bpf/bpf_tracing.hh]h}(h]tools-lib-bpf-bpf-tracing-hah ]h"]tools/lib/bpf/bpf_tracing.hah$]h&]jjuh1jhKhjPhhhh referencedKubj)}(h.. _tools/testing/selftests/bpf/progs/lsm.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/bpf/progs/lsm.ch]h}(h]'tools-testing-selftests-bpf-progs-lsm-cah ]h"]'tools/testing/selftests/bpf/progs/lsm.cah$]h&]jjyuh1jhKhjPhhhhjKubj)}(h.. _tools/testing/selftests/bpf/prog_tests/test_lsm.c: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/testing/selftests/bpf/prog_tests/test_lsm.ch]h}(h]1tools-testing-selftests-bpf-prog-tests-test-lsm-cah ]h"]1tools/testing/selftests/bpf/prog_tests/test_lsm.cah$]h&]jjuh1jhKhjPhhhhjKubeh}(h]examplesah ]h"]examplesah$]h&]uh1hhhhhhhhKubeh}(h]lsm-bpf-programsah ]h"]lsm bpf programsah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(tools/lib/bpf/bpf_tracing.h]ja'tools/testing/selftests/bpf/progs/lsm.c]jia1tools/testing/selftests/bpf/prog_tests/test_lsm.c]j~aurefids}nameids}(jjjjjRjOjMjJjjjjjjjju nametypes}(jjjRjMjjjjuh}(jhjhj)j2jOjjJjUjjPjjjjjju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.