Re: [PATCH bpf-next v3 07/15] lsm: Add the bpf_lsm_policy_apply_bprm kfunc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The attach-point authorization boundary for `bpf_lsm_policy_apply_bprm` can be bypassed using BPF tail calls.
--

commit 7b53e20161b20c35fb85beb1fba538fe85514074
Author: Justin Suess <utilityemal77@gmail.com>
Date:   Wed Sep 9 19:37:10 2026 +0000

    lsm: Add the bpf_lsm_policy_apply_bprm kfunc
    
This commit introduces the bpf_lsm_policy_apply_bprm kfunc, allowing sleepable
LSM BPF programs to restrict credentials prepared in a linux_binprm. It
restricts this kfunc to specific execution hooks (bprm_creds_for_exec and
bprm_creds_from_file) to prevent policies from being applied at unsafe points.

> diff --git a/security/bpf_lsm_kfuncs.c b/security/bpf_lsm_kfuncs.c
> index 43a4bf57fd31e..857e9a316d1cc 100644
> --- a/security/bpf_lsm_kfuncs.c
> +++ b/security/bpf_lsm_kfuncs.c

[ ... ]

> @@ -141,11 +202,18 @@ static int bpf_lsm_policy_kfunc_filter(const struct bpf_prog *prog,
>  
>  	switch (prog->type) {
>  	case BPF_PROG_TYPE_SYSCALL:
> +		if (kfunc_id == bpf_lsm_policy_apply_bprm_ids[0])
> +			return -EACCES;
>  		return 0;
>  	case BPF_PROG_TYPE_LSM:
>  		if (kfunc_id == bpf_lsm_policy_from_fd_ids[0])
>  			return -EACCES;
>  
> +		if (kfunc_id == bpf_lsm_policy_apply_bprm_ids[0] &&
> +		    !btf_id_set_contains(&bpf_lsm_policy_bprm_hooks,
> +					 prog->aux->attach_btf_id))
> +			return -EACCES;

[Severity: High]
Can the attach-point authorization boundary be bypassed using BPF tail calls?

This verification-time check inspects the initial program's attach point,
but does it account for runtime context switches via tail calls?

For example, if a privileged user loads Program A attached to
bprm_creds_for_exec that calls bpf_lsm_policy_apply_bprm(), it passes this
filter and can be inserted into a PROG_ARRAY map.

If they then load Program B attached to bprm_check_security and perform a
bpf_tail_call() into Program A, the tail call is permitted because both
hooks share identical BTF function prototypes (int (struct linux_binprm *)).

Does this allow bpf_lsm_policy_apply_bprm() to be executed at
bprm_check_security, creating a TOCTOU vulnerability since the execution
can still be rewritten by an interpreter?

> +
>  		return 0;
>  	default:
>  		return -EACCES;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909193719.518517-1-utilityemal77@gmail.com?part=7