Re: [PATCH 3/7] io_uring/bpf_filter: allow filtering on contents of struct open_how

[Christian Brauner <brauner@kernel.org>]

On Mon, Jan 19, 2026 at 04:54:26PM -0700, Jens Axboe wrote:
> This adds custom filtering for IORING_OP_OPENAT and IORING_OP_OPENAT2,
> where the open_how flags, mode, and resolve can be checked by filters.
> 
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> ---
>  include/uapi/linux/io_uring/bpf_filter.h | 5 +++++
>  io_uring/bpf_filter.c                    | 5 +++++
>  io_uring/openclose.c                     | 9 +++++++++
>  io_uring/openclose.h                     | 3 +++
>  4 files changed, 22 insertions(+)
> 
> diff --git a/include/uapi/linux/io_uring/bpf_filter.h b/include/uapi/linux/io_uring/bpf_filter.h
> index ad6961be5efa..7f468628c491 100644
> --- a/include/uapi/linux/io_uring/bpf_filter.h
> +++ b/include/uapi/linux/io_uring/bpf_filter.h
> @@ -22,6 +22,11 @@ struct io_uring_bpf_ctx {
>  			__u32	type;
>  			__u32	protocol;
>  		} socket;
> +		struct {
> +			__u64	flags;
> +			__u64	mode;
> +			__u64	resolve;
> +		} open;

So openat2()'s struct is extensible and there are plans to extend it to
include e.g., upgrade masks to restrict how a file descriptor can be
reopened. And in general there's the potential that this gets extended
with additional fields. So if it's workable I would add a size argument
in here to communicate to the bpf program what io_uring currently knows
about/is able to filter on. That should be fairly simple and doesn't
require you to change a whole lot?