[PATCH bpf-next 0/2] bpf: add bpf_init_inode_xattr kfunc for atomic inode labeling

[David Windsor <dwindsor@gmail.com>]

Many in-kernel LSMs (SELinux, Smack, IMA) store security labels in
extended attributes. For these LSMs, atomic labeling during inode
creation is critical: if the inode becomes accessible before its xattr
is set, it is briefly unlabeled, which can disrupt LSMs making policy
decisions based on file labels.

Existing LSMs solve this by setting xattrs directly in the
inode_init_security hook, which runs before the inode becomes
accessible. BPF LSM programs currently lack this capability because
the hook uses an output parameter (xattr_count) that BPF programs
cannot write to, and existing kfuncs like bpf_dentry_set_xattr
require a dentry that isn't available until after the inode is
accessible.

This series introduces the bpf_init_inode_xattr() kfunc, which takes
the hook's PTR_TO_CTX to access xattrs and xattr_count, and
internally writes to xattr_count via lsm_get_xattr_slot().

David Windsor (2):
  bpf: add bpf_init_inode_xattr kfunc for atomic inode labeling
  selftests/bpf: add tests for bpf_init_inode_xattr kfunc

 fs/bpf_fs_kfuncs.c                            | 80 ++++++++++++++++++-
 include/linux/bpf_verifier.h                  |  3 +
 kernel/bpf/fixups.c                           | 20 +++++
 kernel/bpf/verifier.c                         | 54 +++++++++++++
 security/bpf/hooks.c                          |  3 +
 tools/testing/selftests/bpf/bpf_kfuncs.h      |  3 +
 .../selftests/bpf/prog_tests/fs_kfuncs.c      | 49 ++++++++++++
 .../bpf/progs/test_init_inode_xattr.c         | 32 ++++++++
 8 files changed, 243 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/progs/test_init_inode_xattr.c


base-commit: 6c60b2dd5a7889a583389e95e79689191206f86f
-- 
2.53.0