bpf: add bpf_real_inode() kfunc
authorChristian Brauner <brauner@kernel.org>
Tue, 26 May 2026 12:02:22 +0000 (14:02 +0200)
committerChristian Brauner <brauner@kernel.org>
Sat, 6 Jun 2026 13:25:46 +0000 (15:25 +0200)
commit9af8c8a54f6ef1ec8e97836e456827dd5161b355
tree80688a15e390015de9d09cccb76ca980e20aedb3
parent1a571226cb82503839c6c284d3c7a172c93f19c4
bpf: add bpf_real_inode() kfunc

Add a sleepable BPF kfunc that resolves the real inode backing a dentry
via d_real_inode(). On overlay/union filesystems the inode attached to
the dentry is the overlay inode which does not carry the underlying
device information. d_real_inode() resolves through the overlay and
returns the inode from the lower, real filesystem.

This is used in the RestrictFilesytemAccess bpf program that has been
merged into systemd a little while ago.

Link: https://github.com/systemd/systemd/pull/41340
Link: https://patch.msgid.link/20260526-work-bpf-verity-v2-1-cd0b1850d31b@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs/bpf_fs_kfuncs.c