On Tue, Mar 4, 2025 at 3:31 PM Blaise Boscaccy <bboscaccy@xxxxxxxxxxxxxxxxxxx> wrote: > > Certain bpf syscall subcommands are available for usage from both > userspace and the kernel. LSM modules or eBPF gatekeeper programs may > need to take a different course of action depending on whether or not > a BPF syscall originated from the kernel or userspace. > > Additionally, some of the bpf_attr struct fields contain pointers to > arbitrary memory. Currently the functionality to determine whether or > not a pointer refers to kernel memory or userspace memory is exposed > to the bpf verifier, but that information is missing from various LSM > hooks. > > Here we augment the LSM hooks to provide this data, by simply passing > a boolean flag indicating whether or not the call originated in the > kernel, in any hook that contains a bpf_attr struct that corresponds > to a subcommand that may be called from the kernel. > > Signed-off-by: Blaise Boscaccy <bboscaccy@xxxxxxxxxxxxxxxxxxx> > Acked-by: Song Liu <song@xxxxxxxxxx> > --- > include/linux/lsm_hook_defs.h | 6 +++--- > include/linux/security.h | 12 ++++++------ > kernel/bpf/syscall.c | 10 +++++----- > security/security.c | 15 +++++++++------ > security/selinux/hooks.c | 6 +++--- > 5 files changed, 26 insertions(+), 23 deletions(-) ... > diff --git a/security/security.c b/security/security.c > index 143561ebc3e89..38c977091a7fd 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -5627,6 +5627,7 @@ int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, > * @cmd: command > * @attr: bpf attribute > * @size: size > + * @is_kernel: whether or not call originated from kernel This is really nitpicky so please only make this change if you are respinning the patchset for another reason (it looks like you may need to do so for other reasons, so I mentioning it), but please change "is_kernel" to just "kernel" in all the LSM hooks you're updating so it is more consistent with the other LSM hook boolean parameter flags. Regardless of the above, this looks good to me. My ACK is below in case the BPF folks want to merge this, but I'm also happy to take this via the LSM tree once the selftest changes are resolved and ACK'd. Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> -- paul-moore.com
