Re: [v6 04/10] lsm: framework for BPF integrity verification

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added LSM hooks `bpf_prog_load_integrity` and `bpf_prog_load_post_integrity` are missing from the `sleepable_lsm_hooks` BTF set.
--

commit 8148d31126f70fa43314056c3dc696e4fcd7470d
Author: Paul Moore <paul@paul-moore.com>

lsm: framework for BPF integrity verification

This commit adds a new LSM hook and two new callbacks to support BPF program
integrity verification. It allows administrators to select additional
integrity verification mechanisms through the LSM framework.

Link: https://lore.kernel.org/linux-security-module/CAHC9VhTQ_DR=ANzoDBjcCtrimV7XcCZVUsANPt=TjcvM4d-vjg@mail.gmail.com/

> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> index 8c42b4bde09c..4971d3c36d5b 100644
> --- a/include/linux/lsm_hook_defs.h
> +++ b/include/linux/lsm_hook_defs.h
> @@ -434,6 +434,11 @@ LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)
>  LSM_HOOK(int, 0, bpf_map_create, struct bpf_map *map, union bpf_attr *attr,
>  	 struct bpf_token *token, bool kernel)
>  LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map)
> +LSM_HOOK(int, 0, bpf_prog_load_post_integrity, struct bpf_prog *prog,
> +	 union bpf_attr *attr, struct bpf_token *token, bool kernel,
> +	 const struct lsm_id *lsmid, enum lsm_integrity_verdict verdict)
> +LSM_HOOK(int, 0, bpf_prog_load_integrity, struct bpf_prog *prog,
> +	 union bpf_attr *attr, struct bpf_token *token, bool kernel)

Should these two new hooks be added to the sleepable_lsm_hooks BTF set in
kernel/bpf/bpf_lsm.c?

Since they execute in the same context as the existing bpf_prog_load hook
(which is a known sleepable context), omitting them restricts any BPF LSM
program attaching to them to a non-sleepable context.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260429191431.2345448-1-bboscaccy@linux.microsoft.com?part=4