Re: [PATCH v5 10/10] ipe: Add BPF program load policy enforcement via Hornet integration

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Low] Compilation failure in `evaluate_property()` when `CONFIG_IPE_PROP_BPF_SIGNATURE` is disabled due to unconditional access to `ctx->bpf_kernel`.
--

commit f674a6cd60a4a820baf0e01920f42c00f9ad8225
Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>

ipe: Add BPF program load policy enforcement via Hornet integration

Add support for the bpf_prog_load_post_integrity LSM hook, enabling IPE
to make policy decisions about BPF program loading based on integrity
verdicts provided by the Hornet LSM.

> diff --git a/security/ipe/eval.c b/security/ipe/eval.c
> index 21439c5be3364..9a6d583fea125 100644
> --- a/security/ipe/eval.c
> +++ b/security/ipe/eval.c

[ ... ]

> @@ -297,6 +342,32 @@ static bool evaluate_property(const struct ipe_eval_ctx *const ctx,
>  		return evaluate_fsv_sig_false(ctx);
>  	case IPE_PROP_FSV_SIG_TRUE:
>  		return evaluate_fsv_sig_true(ctx);
> +	case IPE_PROP_BPF_SIG_NONE:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_NONE);
> +	case IPE_PROP_BPF_SIG_OK:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_OK);
> +	case IPE_PROP_BPF_SIG_UNSIGNED:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_UNSIGNED);
> +	case IPE_PROP_BPF_SIG_PARTIALSIG:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_PARTIALSIG);
> +	case IPE_PROP_BPF_SIG_UNKNOWNKEY:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_UNKNOWNKEY);
> +	case IPE_PROP_BPF_SIG_UNEXPECTED:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_UNEXPECTED);
> +	case IPE_PROP_BPF_SIG_FAULT:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_FAULT);
> +	case IPE_PROP_BPF_SIG_BADSIG:
> +		return evaluate_bpf_sig(ctx, LSM_INT_VERDICT_BADSIG);
> +	case IPE_PROP_BPF_KEYRING_BUILTIN:
> +		return evaluate_bpf_keyring(ctx, 0);
> +	case IPE_PROP_BPF_KEYRING_SECONDARY:
> +		return evaluate_bpf_keyring(ctx, (s32)(unsigned long)VERIFY_USE_SECONDARY_KEYRING);
> +	case IPE_PROP_BPF_KEYRING_PLATFORM:
> +		return evaluate_bpf_keyring(ctx, (s32)(unsigned long)VERIFY_USE_PLATFORM_KEYRING);
> +	case IPE_PROP_BPF_KERNEL_FALSE:
> +		return !ctx->bpf_kernel;
> +	case IPE_PROP_BPF_KERNEL_TRUE:
> +		return ctx->bpf_kernel;

Will this cause a build failure when CONFIG_IPE_PROP_BPF_SIGNATURE is disabled?

In security/ipe/eval.h, the bpf_kernel field in struct ipe_eval_ctx is
protected by #ifdef CONFIG_IPE_PROP_BPF_SIGNATURE:

struct ipe_eval_ctx {
...
#ifdef CONFIG_IPE_PROP_BPF_SIGNATURE
	enum lsm_integrity_verdict bpf_verdict;
	s32 bpf_keyring_id;
	bool bpf_kernel;
#endif /* CONFIG_IPE_PROP_BPF_SIGNATURE */
};

However, evaluate_property() unconditionally accesses ctx->bpf_kernel for
IPE_PROP_BPF_KERNEL_FALSE and IPE_PROP_BPF_KERNEL_TRUE. If the kernel is
configured without CONFIG_IPE_PROP_BPF_SIGNATURE (for example, if
CONFIG_SECURITY_HORNET is disabled), it appears the build will fail due to
the missing struct member.

>  	default:
>  		return false;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260420212653.438685-1-bboscaccy@linux.microsoft.com?part=10