Re: BPF: writable uprobe pt_regs context bypasses lockdown=integrity

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Apr 27, 2026 at 12:39:33PM +0000, Xavier Brouckaert (xabrouck) wrote:
> Suggested fix
> -------------
> Gate writable kprobe/uprobe context behind security_locked_down() at
> the point the verifier permits the store. Two reasonable shapes:
> 
> (a) In kprobe_prog_is_valid_access() (kernel/trace/bpf_trace.c),
>     when type == BPF_WRITE, call
>     security_locked_down(LOCKDOWN_BPF_WRITE_USER) and return false
>     if denied. This reuses the existing reason and matches the
>     intent ("BPF writing to user state"). One line, adjacent to the
>     kprobe_write_ctx flag set.
> 
> (b) Introduce a dedicated LOCKDOWN_BPF_WRITE_REGS reason at
>     LOCKDOWN_INTEGRITY_MAX scope, for clearer audit messages, and
>     check it in the same place.
> 
> Either way the check belongs at verify/load time rather than attach
> time, so the program is refused outright rather than attaching as a
> no-op.
> 
> Orthogonally, a CONFIG_BPF_UPROBE_OVERRIDE knob (mirroring
> CONFIG_BPF_KPROBE_OVERRIDE for bpf_override_return) would let
> distributions opt out independent of lockdown.

Please provide patches for this report if you wish to see it addressed.
LOCKDOWN is "funny" in that only a very small subset of users care about
it.

thanks,

greg k-h