On Mar 7, 2025 Blaise Boscaccy <bboscaccy@xxxxxxxxxxxxxxxxxxx> wrote: > > Certain bpf syscall subcommands are available for usage from both > userspace and the kernel. LSM modules or eBPF gatekeeper programs may > need to take a different course of action depending on whether or not > a BPF syscall originated from the kernel or userspace. > > Additionally, some of the bpf_attr struct fields contain pointers to > arbitrary memory. Currently the functionality to determine whether or > not a pointer refers to kernel memory or userspace memory is exposed > to the bpf verifier, but that information is missing from various LSM > hooks. > > Here we augment the LSM hooks to provide this data, by simply passing > a boolean flag indicating whether or not the call originated in the > kernel, in any hook that contains a bpf_attr struct that corresponds > to a subcommand that may be called from the kernel. > > Signed-off-by: Blaise Boscaccy <bboscaccy@xxxxxxxxxxxxxxxxxxx> > Acked-by: Song Liu <song@xxxxxxxxxx> > Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> > --- > include/linux/lsm_hook_defs.h | 6 +++--- > include/linux/security.h | 12 ++++++------ > kernel/bpf/syscall.c | 10 +++++----- > security/security.c | 15 +++++++++------ > security/selinux/hooks.c | 6 +++--- > tools/testing/selftests/bpf/progs/rcu_read_lock.c | 3 ++- > .../selftests/bpf/progs/test_cgroup1_hierarchy.c | 4 ++-- > .../selftests/bpf/progs/test_kfunc_dynptr_param.c | 6 +++--- > .../testing/selftests/bpf/progs/test_lookup_key.c | 2 +- > .../selftests/bpf/progs/test_ptr_untrusted.c | 2 +- > .../selftests/bpf/progs/test_task_under_cgroup.c | 2 +- > .../selftests/bpf/progs/test_verify_pkcs7_sig.c | 2 +- > 12 files changed, 37 insertions(+), 33 deletions(-) This still looks good to me (ACK already present), are the BPF folks still on track to merge this into their tree? It would be good to get this into linux-next sooner rather than later if we want to send this up to Linus during the next merge window. -- paul-moore.com
