From: Justin Suess <utilityemal77@gmail.com>
To: sashiko-reviews@lists.linux.dev
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 12/13] landlock: Document the BPF kfunc interface
Date: Fri, 31 Jul 2026 15:25:01 -0400 [thread overview]
Message-ID: <amzzYACkhCpraJLO@zenbox> (raw)
In-Reply-To: <20260731024550.A713C1F000E9@smtp.kernel.org>
On Fri, Jul 31, 2026 at 02:45:50AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The kfunc filter excessively restricts `bpf_landlock_put_ruleset`, contradicting the documented intent and severely limiting ruleset lifecycle management.
>
> [...]
>
> [Severity: Medium]
> Does the kfunc filter excessively restrict bpf_landlock_put_ruleset,
> contradicting the documented intent?
>
> Looking at bpf_landlock_kfunc_filter() in kernel/bpf/bpf_lsm.c, it appears
> to apply -EACCES to bpf_landlock_put_ruleset for most program types and hooks:
>
> kernel/bpf/bpf_lsm.c:bpf_landlock_kfunc_filter() {
> if (!btf_id_set8_contains(&bpf_landlock_kfunc_ids, kfunc_id))
> return 0;
>
> switch (prog->type) {
> // ...
> case BPF_PROG_TYPE_LSM:
> // ...
> if (!btf_id_set_contains(&bpf_landlock_kfunc_hooks,
> prog->aux->attach_btf_id))
> return -EACCES;
>
> return 0;
> default:
> return -EACCES;
> }
> }
>
> This prevents BPF programs of types other than SYSCALL or two specific
> sleepable LSM hooks from legitimately dropping a reference to a
> bpf_landlock_ruleset they acquire from a map via bpf_kptr_xchg().
>
> The verifier forces the program to drop the acquired reference, but rejects
> the call to bpf_landlock_put_ruleset().
>
> Additionally, looking at bpf_landlock_kfunc_ids:
>
> kernel/bpf/bpf_lsm.c:
> BTF_ID_FLAGS(func, bpf_landlock_put_ruleset, KF_RELEASE | KF_SLEEPABLE)
>
> The KF_SLEEPABLE flag seems to prevent calling the release kfunc from
> non-sleepable programs, even though the underlying release mechanism
> (security_policy_kptr_put) is designed to support non-sleepable contexts.
>
> Could this severely limit ruleset lifecycle management by making the kptr
> functionally unusable across most BPF program types?
>
Sashiko repeated this same feedback a few times.
It seems reasonable.
I don't see why the bpf_landlock_put_ruleset's allowed calling context
can't be broadened out.
It's probably ok to allow it for all BPF_PROG_TYPE_LSM programs
(including non-sleepable ones) in addition to BPF_PROG_TYPE_SYSCALL, and
drop KF_SLEEPABLE in accordance with the security_policy_kptr_put docs
stating that the hook consumer cannot sleep.
Same goes for the bpf_landlock_ruleset dtor.
Justin
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260731022047.189137-1-utilityemal77@gmail.com?part=12
next prev parent reply other threads:[~2026-07-31 19:25 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-31 2:20 [PATCH bpf-next 00/13] BPF interface for applying Landlock rulesets Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 01/13] lsm: Add LSM hook security_policy_kptr_from_fd Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 02/13] lsm: Add LSM hook security_policy_kptr_put Justin Suess
2026-07-31 2:44 ` sashiko-bot
2026-07-31 2:20 ` [PATCH bpf-next 03/13] lsm: Add LSM hook security_bprm_enforce_policy_kptr Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 04/13] landlock: Expose the ruleset fd lookup to the rest of Landlock Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 05/13] landlock: Factor the credential restriction out of landlock_restrict_self() Justin Suess
2026-07-31 22:24 ` bot+bpf-ci
2026-07-31 2:20 ` [PATCH bpf-next 06/13] landlock: Implement the LSM policy kptr hooks Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 07/13] bpf: Add the LSM policy kfunc infrastructure Justin Suess
2026-07-31 22:24 ` bot+bpf-ci
2026-07-31 2:20 ` [PATCH bpf-next 08/13] bpf: Add the bpf_landlock_put_ruleset kfunc and ruleset destructor Justin Suess
2026-07-31 2:46 ` sashiko-bot
2026-07-31 2:20 ` [PATCH bpf-next 09/13] bpf: Add the bpf_landlock_get_ruleset_from_fd kfunc Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 10/13] bpf: Add the bpf_landlock_restrict_binprm kfunc Justin Suess
2026-07-31 2:46 ` sashiko-bot
2026-07-31 19:40 ` Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 11/13] selftests/bpf: Add tests for the Landlock policy kfuncs Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 12/13] landlock: Document the BPF kfunc interface Justin Suess
2026-07-31 2:45 ` sashiko-bot
2026-07-31 19:25 ` Justin Suess [this message]
2026-07-31 2:20 ` [PATCH bpf-next 13/13] lsm: Document the LSM policy kptr hooks Justin Suess
2026-07-31 20:30 ` [PATCH bpf-next 00/13] BPF interface for applying Landlock rulesets Paul Moore
2026-07-31 21:15 ` Justin Suess
2026-07-31 21:28 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amzzYACkhCpraJLO@zenbox \
--to=utilityemal77@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox