Re: BPF: writable uprobe pt_regs context bypasses lockdown=integrity

[Jiri Olsa <olsajiri@gmail.com>]

On Mon, Apr 27, 2026 at 12:39:33PM +0000, Xavier Brouckaert (xabrouck) wrote:

SNIP

> Suggested fix
> -------------
> Gate writable kprobe/uprobe context behind security_locked_down() at
> the point the verifier permits the store. Two reasonable shapes:
> 
> (a) In kprobe_prog_is_valid_access() (kernel/trace/bpf_trace.c),
>     when type == BPF_WRITE, call
>     security_locked_down(LOCKDOWN_BPF_WRITE_USER) and return false
>     if denied. This reuses the existing reason and matches the
>     intent ("BPF writing to user state"). One line, adjacent to the
>     kprobe_write_ctx flag set.
> 
> (b) Introduce a dedicated LOCKDOWN_BPF_WRITE_REGS reason at
>     LOCKDOWN_INTEGRITY_MAX scope, for clearer audit messages, and
>     check it in the same place.
> 
> Either way the check belongs at verify/load time rather than attach
> time, so the program is refused outright rather than attaching as a
> no-op.
> 
> Orthogonally, a CONFIG_BPF_UPROBE_OVERRIDE knob (mirroring
> CONFIG_BPF_KPROBE_OVERRIDE for bpf_override_return) would let
> distributions opt out independent of lockdown.

I guess I can feed this to claude and get the fix right away ;-)

makes sense to me to fix this, since we already have LOCKDOWN_BPF_WRITE_USER
and changing user space registers is on the same level

I can check and send the patch, if you don't plan to do it yourself

thanks,
jirka