[PATCH v6 bpf-next 0/2] security: Propagate caller information in bpf hooks

[PATCH v6 bpf-next 0/2] security: Propagate caller information in bpf hooks

[Blaise Boscaccy]

Hello,

While trying to implement an eBPF gatekeeper program, we ran into an
issue whereas the LSM hooks are missing some relevant data.

Certain subcommands passed to the bpf() syscall can be invoked from
either the kernel or userspace. Additionally, some fields in the
bpf_attr struct contain pointers, and depending on where the
subcommand was invoked, they could point to either user or kernel
memory. One example of this is the bpf_prog_load subcommand and its
fd_array. This data is made available and used by the verifier but not
made available to the LSM subsystem. This patchset simply exposes that
information to applicable LSM hooks.

Change list:
- v5 -> v6
  - fix regression caused by is_kernel renaming
  - simplify test logic
- v4 -> v5
  - merge v4 selftest breakout patch back into a single patch
  - change "is_kernel" to "kernel"
  - add selftest using new kernel flag
- v3 -> v4
  - split out selftest changes into a separate patch
- v2 -> v3
  - reorder params so that the new boolean flag is the last param
  - fixup function signatures in bpf selftests
- v1 -> v2
  - Pass a boolean flag in lieu of bpfptr_t

Revisions:
- v5
  https://lore.kernel.org/bpf/20250307213651.3065714-1-bboscaccy@linux.microsoft.com/
- v4
  https://lore.kernel.org/bpf/20250304203123.3935371-1-bboscaccy@linux.microsoft.com/
- v3
  https://lore.kernel.org/bpf/20250303222416.3909228-1-bboscaccy@linux.microsoft.com/
- v2
  https://lore.kernel.org/bpf/20250228165322.3121535-1-bboscaccy@linux.microsoft.com/
- v1
  https://lore.kernel.org/bpf/20250226003055.1654837-1-bboscaccy@linux.microsoft.com/


Blaise Boscaccy (2):
  security: Propagate caller information in bpf hooks
  selftests/bpf: Add a kernel flag test for LSM bpf hook

 include/linux/lsm_hook_defs.h                 |  6 +--
 include/linux/security.h                      | 12 +++---
 kernel/bpf/syscall.c                          | 10 ++---
 security/security.c                           | 15 ++++---
 security/selinux/hooks.c                      |  6 +--
 .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
 .../selftests/bpf/progs/rcu_read_lock.c       |  3 +-
 .../bpf/progs/test_cgroup1_hierarchy.c        |  4 +-
 .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
 .../bpf/progs/test_kfunc_dynptr_param.c       |  6 +--
 .../selftests/bpf/progs/test_lookup_key.c     |  2 +-
 .../selftests/bpf/progs/test_ptr_untrusted.c  |  2 +-
 .../bpf/progs/test_task_under_cgroup.c        |  2 +-
 .../bpf/progs/test_verify_pkcs7_sig.c         |  2 +-
 14 files changed, 108 insertions(+), 33 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c

-- 
2.48.1

[PATCH v6 bpf-next 1/2] security: Propagate caller information in bpf hooks

[Blaise Boscaccy]

Certain bpf syscall subcommands are available for usage from both
userspace and the kernel. LSM modules or eBPF gatekeeper programs may
need to take a different course of action depending on whether or not
a BPF syscall originated from the kernel or userspace.

Additionally, some of the bpf_attr struct fields contain pointers to
arbitrary memory. Currently the functionality to determine whether or
not a pointer refers to kernel memory or userspace memory is exposed
to the bpf verifier, but that information is missing from various LSM
hooks.

Here we augment the LSM hooks to provide this data, by simply passing
a boolean flag indicating whether or not the call originated in the
kernel, in any hook that contains a bpf_attr struct that corresponds
to a subcommand that may be called from the kernel.

Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Paul Moore <paul@paul-moore.com>
---
 include/linux/lsm_hook_defs.h                     |  6 +++---
 include/linux/security.h                          | 12 ++++++------
 kernel/bpf/syscall.c                              | 10 +++++-----
 security/security.c                               | 15 +++++++++------
 security/selinux/hooks.c                          |  6 +++---
 tools/testing/selftests/bpf/progs/rcu_read_lock.c |  3 ++-
 .../selftests/bpf/progs/test_cgroup1_hierarchy.c  |  4 ++--
 .../selftests/bpf/progs/test_kfunc_dynptr_param.c |  6 +++---
 .../testing/selftests/bpf/progs/test_lookup_key.c |  2 +-
 .../selftests/bpf/progs/test_ptr_untrusted.c      |  2 +-
 .../selftests/bpf/progs/test_task_under_cgroup.c  |  2 +-
 .../selftests/bpf/progs/test_verify_pkcs7_sig.c   |  2 +-
 12 files changed, 37 insertions(+), 33 deletions(-)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index e2f1ce37c41ef..f5aafd3ba5d4d 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -426,14 +426,14 @@ LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)
 #endif /* CONFIG_AUDIT */
 
 #ifdef CONFIG_BPF_SYSCALL
-LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size)
+LSM_HOOK(int, 0, bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 LSM_HOOK(int, 0, bpf_map, struct bpf_map *map, fmode_t fmode)
 LSM_HOOK(int, 0, bpf_prog, struct bpf_prog *prog)
 LSM_HOOK(int, 0, bpf_map_create, struct bpf_map *map, union bpf_attr *attr,
-	 struct bpf_token *token)
+	 struct bpf_token *token, bool kernel)
 LSM_HOOK(void, LSM_RET_VOID, bpf_map_free, struct bpf_map *map)
 LSM_HOOK(int, 0, bpf_prog_load, struct bpf_prog *prog, union bpf_attr *attr,
-	 struct bpf_token *token)
+	 struct bpf_token *token, bool kernel)
 LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free, struct bpf_prog *prog)
 LSM_HOOK(int, 0, bpf_token_create, struct bpf_token *token, union bpf_attr *attr,
 	 const struct path *path)
diff --git a/include/linux/security.h b/include/linux/security.h
index 980b6c207cade..b2010034f82bc 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2249,14 +2249,14 @@ struct bpf_map;
 struct bpf_prog;
 struct bpf_token;
 #ifdef CONFIG_SECURITY
-extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
+extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel);
 extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
 extern int security_bpf_prog(struct bpf_prog *prog);
 extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
-				   struct bpf_token *token);
+				   struct bpf_token *token, bool kernel);
 extern void security_bpf_map_free(struct bpf_map *map);
 extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
-				  struct bpf_token *token);
+				  struct bpf_token *token, bool kernel);
 extern void security_bpf_prog_free(struct bpf_prog *prog);
 extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
 				     const struct path *path);
@@ -2265,7 +2265,7 @@ extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cm
 extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
 #else
 static inline int security_bpf(int cmd, union bpf_attr *attr,
-					     unsigned int size)
+			       unsigned int size, bool kernel)
 {
 	return 0;
 }
@@ -2281,7 +2281,7 @@ static inline int security_bpf_prog(struct bpf_prog *prog)
 }
 
 static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
-					  struct bpf_token *token)
+					  struct bpf_token *token, bool kernel)
 {
 	return 0;
 }
@@ -2290,7 +2290,7 @@ static inline void security_bpf_map_free(struct bpf_map *map)
 { }
 
 static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
-					 struct bpf_token *token)
+					 struct bpf_token *token, bool kernel)
 {
 	return 0;
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 694a675769a60..ea43cf6be586a 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1306,7 +1306,7 @@ static bool bpf_net_capable(void)
 
 #define BPF_MAP_CREATE_LAST_FIELD map_token_fd
 /* called via syscall */
-static int map_create(union bpf_attr *attr)
+static int map_create(union bpf_attr *attr, bool kernel)
 {
 	const struct bpf_map_ops *ops;
 	struct bpf_token *token = NULL;
@@ -1498,7 +1498,7 @@ static int map_create(union bpf_attr *attr)
 			attr->btf_vmlinux_value_type_id;
 	}
 
-	err = security_bpf_map_create(map, attr, token);
+	err = security_bpf_map_create(map, attr, token, kernel);
 	if (err)
 		goto free_map_sec;
 
@@ -2947,7 +2947,7 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
 	if (err < 0)
 		goto free_prog;
 
-	err = security_bpf_prog_load(prog, attr, token);
+	err = security_bpf_prog_load(prog, attr, token, uattr.is_kernel);
 	if (err)
 		goto free_prog_sec;
 
@@ -5776,13 +5776,13 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size)
 	if (copy_from_bpfptr(&attr, uattr, size) != 0)
 		return -EFAULT;
 
-	err = security_bpf(cmd, &attr, size);
+	err = security_bpf(cmd, &attr, size, uattr.is_kernel);
 	if (err < 0)
 		return err;
 
 	switch (cmd) {
 	case BPF_MAP_CREATE:
-		err = map_create(&attr);
+		err = map_create(&attr, uattr.is_kernel);
 		break;
 	case BPF_MAP_LOOKUP_ELEM:
 		err = map_lookup_elem(&attr);
diff --git a/security/security.c b/security/security.c
index 143561ebc3e89..c369481232585 100644
--- a/security/security.c
+++ b/security/security.c
@@ -5627,6 +5627,7 @@ int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
  * @cmd: command
  * @attr: bpf attribute
  * @size: size
+ * @kernel: whether or not call originated from kernel
  *
  * Do a initial check for all bpf syscalls after the attribute is copied into
  * the kernel. The actual security module can implement their own rules to
@@ -5634,9 +5635,9 @@ int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
+int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
-	return call_int_hook(bpf, cmd, attr, size);
+	return call_int_hook(bpf, cmd, attr, size, kernel);
 }
 
 /**
@@ -5673,6 +5674,7 @@ int security_bpf_prog(struct bpf_prog *prog)
  * @map: BPF map object
  * @attr: BPF syscall attributes used to create BPF map
  * @token: BPF token used to grant user access
+ * @kernel: whether or not call originated from kernel
  *
  * Do a check when the kernel creates a new BPF map. This is also the
  * point where LSM blob is allocated for LSMs that need them.
@@ -5680,9 +5682,9 @@ int security_bpf_prog(struct bpf_prog *prog)
  * Return: Returns 0 on success, error on failure.
  */
 int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
-			    struct bpf_token *token)
+			    struct bpf_token *token, bool kernel)
 {
-	return call_int_hook(bpf_map_create, map, attr, token);
+	return call_int_hook(bpf_map_create, map, attr, token, kernel);
 }
 
 /**
@@ -5690,6 +5692,7 @@ int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
  * @prog: BPF program object
  * @attr: BPF syscall attributes used to create BPF program
  * @token: BPF token used to grant user access to BPF subsystem
+ * @kernel: whether or not call originated from kernel
  *
  * Perform an access control check when the kernel loads a BPF program and
  * allocates associated BPF program object. This hook is also responsible for
@@ -5698,9 +5701,9 @@ int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
  * Return: Returns 0 on success, error on failure.
  */
 int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
-			   struct bpf_token *token)
+			   struct bpf_token *token, bool kernel)
 {
-	return call_int_hook(bpf_prog_load, prog, attr, token);
+	return call_int_hook(bpf_prog_load, prog, attr, token, kernel);
 }
 
 /**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7b867dfec88ba..71199d86fc97f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6866,7 +6866,7 @@ static int selinux_ib_alloc_security(void *ib_sec)
 
 #ifdef CONFIG_BPF_SYSCALL
 static int selinux_bpf(int cmd, union bpf_attr *attr,
-				     unsigned int size)
+		       unsigned int size, bool kernel)
 {
 	u32 sid = current_sid();
 	int ret;
@@ -6953,7 +6953,7 @@ static int selinux_bpf_prog(struct bpf_prog *prog)
 }
 
 static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
-				  struct bpf_token *token)
+				  struct bpf_token *token, bool kernel)
 {
 	struct bpf_security_struct *bpfsec;
 
@@ -6976,7 +6976,7 @@ static void selinux_bpf_map_free(struct bpf_map *map)
 }
 
 static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
-				 struct bpf_token *token)
+				 struct bpf_token *token, bool kernel)
 {
 	struct bpf_security_struct *bpfsec;
 
diff --git a/tools/testing/selftests/bpf/progs/rcu_read_lock.c b/tools/testing/selftests/bpf/progs/rcu_read_lock.c
index ab3a532b7dd6d..582c245467c3a 100644
--- a/tools/testing/selftests/bpf/progs/rcu_read_lock.c
+++ b/tools/testing/selftests/bpf/progs/rcu_read_lock.c
@@ -242,7 +242,8 @@ int inproper_sleepable_helper(void *ctx)
 }
 
 SEC("?lsm.s/bpf")
-int BPF_PROG(inproper_sleepable_kfunc, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(inproper_sleepable_kfunc, int cmd, union bpf_attr *attr, unsigned int size,
+	     bool kernel)
 {
 	struct bpf_key *bkey;
 
diff --git a/tools/testing/selftests/bpf/progs/test_cgroup1_hierarchy.c b/tools/testing/selftests/bpf/progs/test_cgroup1_hierarchy.c
index 44628865fe1d4..4fee0fdc76076 100644
--- a/tools/testing/selftests/bpf/progs/test_cgroup1_hierarchy.c
+++ b/tools/testing/selftests/bpf/progs/test_cgroup1_hierarchy.c
@@ -51,13 +51,13 @@ static int bpf_link_create_verify(int cmd)
 }
 
 SEC("lsm/bpf")
-int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	return bpf_link_create_verify(cmd);
 }
 
 SEC("lsm.s/bpf")
-int BPF_PROG(lsm_s_run, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(lsm_s_run, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	return bpf_link_create_verify(cmd);
 }
diff --git a/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c b/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c
index cd4d752bd089c..061befb004c24 100644
--- a/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c
+++ b/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c
@@ -36,7 +36,7 @@ char _license[] SEC("license") = "GPL";
 
 SEC("?lsm.s/bpf")
 __failure __msg("cannot pass in dynptr at an offset=-8")
-int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	unsigned long val;
 
@@ -46,7 +46,7 @@ int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size)
 
 SEC("?lsm.s/bpf")
 __failure __msg("arg#0 expected pointer to stack or const struct bpf_dynptr")
-int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	unsigned long val = 0;
 
@@ -55,7 +55,7 @@ int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size)
 }
 
 SEC("lsm.s/bpf")
-int BPF_PROG(dynptr_data_null, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(dynptr_data_null, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	struct bpf_key *trusted_keyring;
 	struct bpf_dynptr ptr;
diff --git a/tools/testing/selftests/bpf/progs/test_lookup_key.c b/tools/testing/selftests/bpf/progs/test_lookup_key.c
index c73776990ae30..cdbbb12f1491a 100644
--- a/tools/testing/selftests/bpf/progs/test_lookup_key.c
+++ b/tools/testing/selftests/bpf/progs/test_lookup_key.c
@@ -23,7 +23,7 @@ extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
 extern void bpf_key_put(struct bpf_key *key) __ksym;
 
 SEC("lsm.s/bpf")
-int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	struct bpf_key *bkey;
 	__u32 pid;
diff --git a/tools/testing/selftests/bpf/progs/test_ptr_untrusted.c b/tools/testing/selftests/bpf/progs/test_ptr_untrusted.c
index 2fdc44e766248..89b0cd5a3e06e 100644
--- a/tools/testing/selftests/bpf/progs/test_ptr_untrusted.c
+++ b/tools/testing/selftests/bpf/progs/test_ptr_untrusted.c
@@ -7,7 +7,7 @@
 char tp_name[128];
 
 SEC("lsm.s/bpf")
-int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	switch (cmd) {
 	case BPF_RAW_TRACEPOINT_OPEN:
diff --git a/tools/testing/selftests/bpf/progs/test_task_under_cgroup.c b/tools/testing/selftests/bpf/progs/test_task_under_cgroup.c
index 7e750309ce274..0b74b8bd22e87 100644
--- a/tools/testing/selftests/bpf/progs/test_task_under_cgroup.c
+++ b/tools/testing/selftests/bpf/progs/test_task_under_cgroup.c
@@ -49,7 +49,7 @@ int BPF_PROG(tp_btf_run, struct task_struct *task, u64 clone_flags)
 }
 
 SEC("lsm.s/bpf")
-int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	struct cgroup *cgrp = NULL;
 	struct task_struct *task;
diff --git a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
index 12034a73ee2d2..e96d09e111155 100644
--- a/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
+++ b/tools/testing/selftests/bpf/progs/test_verify_pkcs7_sig.c
@@ -37,7 +37,7 @@ struct {
 char _license[] SEC("license") = "GPL";
 
 SEC("lsm.s/bpf")
-int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size)
+int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
 {
 	struct bpf_dynptr data_ptr, sig_ptr;
 	struct data *data_val;
-- 
2.48.1

Re: [PATCH v6 1/2] security: Propagate caller information in bpf hooks

[Paul Moore]

On Mar  7, 2025 Blaise Boscaccy <bboscaccy@linux.microsoft.com> wrote:
> 
> Certain bpf syscall subcommands are available for usage from both
> userspace and the kernel. LSM modules or eBPF gatekeeper programs may
> need to take a different course of action depending on whether or not
> a BPF syscall originated from the kernel or userspace.
> 
> Additionally, some of the bpf_attr struct fields contain pointers to
> arbitrary memory. Currently the functionality to determine whether or
> not a pointer refers to kernel memory or userspace memory is exposed
> to the bpf verifier, but that information is missing from various LSM
> hooks.
> 
> Here we augment the LSM hooks to provide this data, by simply passing
> a boolean flag indicating whether or not the call originated in the
> kernel, in any hook that contains a bpf_attr struct that corresponds
> to a subcommand that may be called from the kernel.
> 
> Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
> Acked-by: Song Liu <song@kernel.org>
> Acked-by: Paul Moore <paul@paul-moore.com>
> ---
>  include/linux/lsm_hook_defs.h                     |  6 +++---
>  include/linux/security.h                          | 12 ++++++------
>  kernel/bpf/syscall.c                              | 10 +++++-----
>  security/security.c                               | 15 +++++++++------
>  security/selinux/hooks.c                          |  6 +++---
>  tools/testing/selftests/bpf/progs/rcu_read_lock.c |  3 ++-
>  .../selftests/bpf/progs/test_cgroup1_hierarchy.c  |  4 ++--
>  .../selftests/bpf/progs/test_kfunc_dynptr_param.c |  6 +++---
>  .../testing/selftests/bpf/progs/test_lookup_key.c |  2 +-
>  .../selftests/bpf/progs/test_ptr_untrusted.c      |  2 +-
>  .../selftests/bpf/progs/test_task_under_cgroup.c  |  2 +-
>  .../selftests/bpf/progs/test_verify_pkcs7_sig.c   |  2 +-
>  12 files changed, 37 insertions(+), 33 deletions(-)

This still looks good to me (ACK already present), are the BPF folks
still on track to merge this into their tree?  It would be good to get
this into linux-next sooner rather than later if we want to send this
up to Linus during the next merge window.

--
paul-moore.com

[PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Blaise Boscaccy]

This test exercises the kernel flag added to security_bpf by
effectively blocking light-skeletons from loading while allowing
normal skeletons to function as-is. Since this should work with any
arbitrary BPF program, an existing program from LSKELS_EXTRA was
used as a test payload.

Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
---
 .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
 .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c

diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
new file mode 100644
index 0000000000000..479ad5de3737e
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2025 Microsoft */
+#include <test_progs.h>
+#include "kfunc_call_test.skel.h"
+#include "kfunc_call_test.lskel.h"
+#include "test_kernel_flag.skel.h"
+
+void test_kernel_flag(void)
+{
+	struct test_kernel_flag *lsm_skel;
+	struct kfunc_call_test *skel = NULL;
+	struct kfunc_call_test_lskel *lskel = NULL;
+	int ret;
+
+	lsm_skel = test_kernel_flag__open_and_load();
+	if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
+		return;
+
+	ret = test_kernel_flag__attach(lsm_skel);
+	if (!ASSERT_OK(ret, "test_kernel_flag__attach"))
+		goto close_prog;
+
+	lsm_skel->bss->monitored_pid = getpid();
+
+	/* Test with skel. This should pass the gatekeeper */
+	skel = kfunc_call_test__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel"))
+		goto close_prog;
+
+	/* Test with lskel. This should fail due to blocking kernel-based bpf() invocations */
+	lskel = kfunc_call_test_lskel__open_and_load();
+	if (!ASSERT_ERR_PTR(lskel, "lskel"))
+		goto close_prog;
+
+close_prog:
+	if (skel)
+		kfunc_call_test__destroy(skel);
+	if (lskel)
+		kfunc_call_test_lskel__destroy(lskel);
+
+	lsm_skel->bss->monitored_pid = 0;
+	test_kernel_flag__destroy(lsm_skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_kernel_flag.c b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
new file mode 100644
index 0000000000000..9ca01aadb6656
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Copyright (C) 2025 Microsoft Corporation
+ *
+ * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
+ */
+
+#include "vmlinux.h"
+#include <errno.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+__u32 monitored_pid;
+
+SEC("lsm.s/bpf")
+int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
+{
+	__u32 pid;
+
+	pid = bpf_get_current_pid_tgid() >> 32;
+	if (!kernel || pid != monitored_pid)
+		return 0;
+	else
+		return -EINVAL;
+}
-- 
2.48.1

Re: [PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Song Liu]

On Fri, Mar 7, 2025 at 5:33 PM Blaise Boscaccy
<bboscaccy@linux.microsoft.com> wrote:
>
> This test exercises the kernel flag added to security_bpf by
> effectively blocking light-skeletons from loading while allowing
> normal skeletons to function as-is. Since this should work with any
> arbitrary BPF program, an existing program from LSKELS_EXTRA was
> used as a test payload.
>
> Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
> ---
>  .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
>  .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
>  2 files changed, 71 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>  create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
> new file mode 100644
> index 0000000000000..479ad5de3737e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 Microsoft */
> +#include <test_progs.h>
> +#include "kfunc_call_test.skel.h"
> +#include "kfunc_call_test.lskel.h"
> +#include "test_kernel_flag.skel.h"
> +
> +void test_kernel_flag(void)
> +{
> +       struct test_kernel_flag *lsm_skel;
> +       struct kfunc_call_test *skel = NULL;
> +       struct kfunc_call_test_lskel *lskel = NULL;
> +       int ret;
> +
> +       lsm_skel = test_kernel_flag__open_and_load();
> +       if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
> +               return;
> +
> +       ret = test_kernel_flag__attach(lsm_skel);
> +       if (!ASSERT_OK(ret, "test_kernel_flag__attach"))
> +               goto close_prog;
> +
> +       lsm_skel->bss->monitored_pid = getpid();

We usually set monitored_pid before attaching the program.

> +
> +       /* Test with skel. This should pass the gatekeeper */
> +       skel = kfunc_call_test__open_and_load();
> +       if (!ASSERT_OK_PTR(skel, "skel"))
> +               goto close_prog;
> +
> +       /* Test with lskel. This should fail due to blocking kernel-based bpf() invocations */
> +       lskel = kfunc_call_test_lskel__open_and_load();
> +       if (!ASSERT_ERR_PTR(lskel, "lskel"))
> +               goto close_prog;
> +
> +close_prog:
> +       if (skel)
> +               kfunc_call_test__destroy(skel);
> +       if (lskel)
> +               kfunc_call_test_lskel__destroy(lskel);
> +
> +       lsm_skel->bss->monitored_pid = 0;
> +       test_kernel_flag__destroy(lsm_skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_kernel_flag.c b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
> new file mode 100644
> index 0000000000000..9ca01aadb6656
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
> @@ -0,0 +1,28 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +/*
> + * Copyright (C) 2025 Microsoft Corporation
> + *
> + * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
> + */
> +
> +#include "vmlinux.h"
> +#include <errno.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +
> +char _license[] SEC("license") = "GPL";
> +
> +__u32 monitored_pid;
> +
> +SEC("lsm.s/bpf")
> +int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
> +{
> +       __u32 pid;
> +
> +       pid = bpf_get_current_pid_tgid() >> 32;
> +       if (!kernel || pid != monitored_pid)
> +               return 0;

We are blocking lskel load for the pid. This could make
parallel testing (test_progs -j) flaky. We should probably
change the logic to filtering on monitored_tiid.

Thanks,
Song

> +       else
> +               return -EINVAL;
> +}
> --
> 2.48.1
>
>

Re: [PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Blaise Boscaccy]

Song Liu <song@kernel.org> writes:

> On Fri, Mar 7, 2025 at 5:33 PM Blaise Boscaccy
> <bboscaccy@linux.microsoft.com> wrote:
>>
>> This test exercises the kernel flag added to security_bpf by
>> effectively blocking light-skeletons from loading while allowing
>> normal skeletons to function as-is. Since this should work with any
>> arbitrary BPF program, an existing program from LSKELS_EXTRA was
>> used as a test payload.
>>
>> Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
>> ---
>>  .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
>>  .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
>>  2 files changed, 71 insertions(+)
>>  create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>>  create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c
>>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>> new file mode 100644
>> index 0000000000000..479ad5de3737e
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>> @@ -0,0 +1,43 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +/* Copyright (c) 2025 Microsoft */
>> +#include <test_progs.h>
>> +#include "kfunc_call_test.skel.h"
>> +#include "kfunc_call_test.lskel.h"
>> +#include "test_kernel_flag.skel.h"
>> +
>> +void test_kernel_flag(void)
>> +{
>> +       struct test_kernel_flag *lsm_skel;
>> +       struct kfunc_call_test *skel = NULL;
>> +       struct kfunc_call_test_lskel *lskel = NULL;
>> +       int ret;
>> +
>> +       lsm_skel = test_kernel_flag__open_and_load();
>> +       if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
>> +               return;
>> +
>> +       ret = test_kernel_flag__attach(lsm_skel);
>> +       if (!ASSERT_OK(ret, "test_kernel_flag__attach"))
>> +               goto close_prog;
>> +
>> +       lsm_skel->bss->monitored_pid = getpid();
>
> We usually set monitored_pid before attaching the program.
>

Okay, copy that. 

>> +
>> +       /* Test with skel. This should pass the gatekeeper */
>> +       skel = kfunc_call_test__open_and_load();
>> +       if (!ASSERT_OK_PTR(skel, "skel"))
>> +               goto close_prog;
>> +
>> +       /* Test with lskel. This should fail due to blocking kernel-based bpf() invocations */
>> +       lskel = kfunc_call_test_lskel__open_and_load();
>> +       if (!ASSERT_ERR_PTR(lskel, "lskel"))
>> +               goto close_prog;
>> +
>> +close_prog:
>> +       if (skel)
>> +               kfunc_call_test__destroy(skel);
>> +       if (lskel)
>> +               kfunc_call_test_lskel__destroy(lskel);
>> +
>> +       lsm_skel->bss->monitored_pid = 0;
>> +       test_kernel_flag__destroy(lsm_skel);
>> +}
>> diff --git a/tools/testing/selftests/bpf/progs/test_kernel_flag.c b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
>> new file mode 100644
>> index 0000000000000..9ca01aadb6656
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
>> @@ -0,0 +1,28 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +
>> +/*
>> + * Copyright (C) 2025 Microsoft Corporation
>> + *
>> + * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
>> + */
>> +
>> +#include "vmlinux.h"
>> +#include <errno.h>
>> +#include <bpf/bpf_helpers.h>
>> +#include <bpf/bpf_tracing.h>
>> +
>> +char _license[] SEC("license") = "GPL";
>> +
>> +__u32 monitored_pid;
>> +
>> +SEC("lsm.s/bpf")
>> +int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
>> +{
>> +       __u32 pid;
>> +
>> +       pid = bpf_get_current_pid_tgid() >> 32;
>> +       if (!kernel || pid != monitored_pid)
>> +               return 0;
>
> We are blocking lskel load for the pid. This could make
> parallel testing (test_progs -j) flaky. We should probably
> change the logic to filtering on monitored_tiid.
>

Curious on this for my own edification. The

pid = bpf_get_current_pid_tgid() >> 32;

is used extensively in the current test suite in a bunch of other
tests. Why does that not cause an issue with the other tests during
parallel testing? 

> Thanks,
> Song
>
>> +       else
>> +               return -EINVAL;
>> +}
>> --
>> 2.48.1
>>
>>

Re: [PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Song Liu]

On Mon, Mar 10, 2025 at 10:43 AM Blaise Boscaccy
<bboscaccy@linux.microsoft.com> wrote:
>
> Song Liu <song@kernel.org> writes:
>
> > On Fri, Mar 7, 2025 at 5:33 PM Blaise Boscaccy
> > <bboscaccy@linux.microsoft.com> wrote:
> >>
> >> This test exercises the kernel flag added to security_bpf by
> >> effectively blocking light-skeletons from loading while allowing
> >> normal skeletons to function as-is. Since this should work with any
> >> arbitrary BPF program, an existing program from LSKELS_EXTRA was
> >> used as a test payload.
> >>
> >> Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
> >> ---
> >>  .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
> >>  .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
> >>  2 files changed, 71 insertions(+)
> >>  create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
> >>  create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c
> >>
> >> diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
> >> new file mode 100644
> >> index 0000000000000..479ad5de3737e
> >> --- /dev/null
> >> +++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
> >> @@ -0,0 +1,43 @@
> >> +// SPDX-License-Identifier: GPL-2.0
> >> +/* Copyright (c) 2025 Microsoft */
> >> +#include <test_progs.h>
> >> +#include "kfunc_call_test.skel.h"
> >> +#include "kfunc_call_test.lskel.h"
> >> +#include "test_kernel_flag.skel.h"
> >> +
> >> +void test_kernel_flag(void)
> >> +{
> >> +       struct test_kernel_flag *lsm_skel;
> >> +       struct kfunc_call_test *skel = NULL;
> >> +       struct kfunc_call_test_lskel *lskel = NULL;
> >> +       int ret;
> >> +
> >> +       lsm_skel = test_kernel_flag__open_and_load();
> >> +       if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
> >> +               return;
> >> +
> >> +       ret = test_kernel_flag__attach(lsm_skel);
> >> +       if (!ASSERT_OK(ret, "test_kernel_flag__attach"))
> >> +               goto close_prog;
> >> +
> >> +       lsm_skel->bss->monitored_pid = getpid();
> >
> > We usually set monitored_pid before attaching the program.
> >
>
> Okay, copy that.
>
> >> +
> >> +       /* Test with skel. This should pass the gatekeeper */
> >> +       skel = kfunc_call_test__open_and_load();
> >> +       if (!ASSERT_OK_PTR(skel, "skel"))
> >> +               goto close_prog;
> >> +
> >> +       /* Test with lskel. This should fail due to blocking kernel-based bpf() invocations */
> >> +       lskel = kfunc_call_test_lskel__open_and_load();
> >> +       if (!ASSERT_ERR_PTR(lskel, "lskel"))
> >> +               goto close_prog;
> >> +
> >> +close_prog:
> >> +       if (skel)
> >> +               kfunc_call_test__destroy(skel);
> >> +       if (lskel)
> >> +               kfunc_call_test_lskel__destroy(lskel);
> >> +
> >> +       lsm_skel->bss->monitored_pid = 0;
> >> +       test_kernel_flag__destroy(lsm_skel);
> >> +}
> >> diff --git a/tools/testing/selftests/bpf/progs/test_kernel_flag.c b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
> >> new file mode 100644
> >> index 0000000000000..9ca01aadb6656
> >> --- /dev/null
> >> +++ b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
> >> @@ -0,0 +1,28 @@
> >> +// SPDX-License-Identifier: GPL-2.0
> >> +
> >> +/*
> >> + * Copyright (C) 2025 Microsoft Corporation
> >> + *
> >> + * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
> >> + */
> >> +
> >> +#include "vmlinux.h"
> >> +#include <errno.h>
> >> +#include <bpf/bpf_helpers.h>
> >> +#include <bpf/bpf_tracing.h>
> >> +
> >> +char _license[] SEC("license") = "GPL";
> >> +
> >> +__u32 monitored_pid;
> >> +
> >> +SEC("lsm.s/bpf")
> >> +int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
> >> +{
> >> +       __u32 pid;
> >> +
> >> +       pid = bpf_get_current_pid_tgid() >> 32;
> >> +       if (!kernel || pid != monitored_pid)
> >> +               return 0;
> >
> > We are blocking lskel load for the pid. This could make
> > parallel testing (test_progs -j) flaky. We should probably
> > change the logic to filtering on monitored_tiid.
> >
>
> Curious on this for my own edification. The
>
> pid = bpf_get_current_pid_tgid() >> 32;
>
> is used extensively in the current test suite in a bunch of other
> tests. Why does that not cause an issue with the other tests during
> parallel testing?

We are blindly blocking all security_bpf() with kernel=true here, so
any lskel load in parallel with this test may fail. On the other hand,
existing tests only block some operations under certain conditions.
For example, test_cgroup1_hierarchy.c only blocks operations for
target_ancestor_cgid.

Does this make sense?

Thanks,
Song

Re: [PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Blaise Boscaccy]

Song Liu <song@kernel.org> writes:

> On Mon, Mar 10, 2025 at 10:43 AM Blaise Boscaccy
> <bboscaccy@linux.microsoft.com> wrote:
>>
>> Song Liu <song@kernel.org> writes:
>>
>> > On Fri, Mar 7, 2025 at 5:33 PM Blaise Boscaccy
>> > <bboscaccy@linux.microsoft.com> wrote:
>> >>
>> >> This test exercises the kernel flag added to security_bpf by
>> >> effectively blocking light-skeletons from loading while allowing
>> >> normal skeletons to function as-is. Since this should work with any
>> >> arbitrary BPF program, an existing program from LSKELS_EXTRA was
>> >> used as a test payload.
>> >>
>> >> Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
>> >> ---
>> >>  .../selftests/bpf/prog_tests/kernel_flag.c    | 43 +++++++++++++++++++
>> >>  .../selftests/bpf/progs/test_kernel_flag.c    | 28 ++++++++++++
>> >>  2 files changed, 71 insertions(+)
>> >>  create mode 100644 tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>> >>  create mode 100644 tools/testing/selftests/bpf/progs/test_kernel_flag.c
>> >>
>> >> diff --git a/tools/testing/selftests/bpf/prog_tests/kernel_flag.c b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>> >> new file mode 100644
>> >> index 0000000000000..479ad5de3737e
>> >> --- /dev/null
>> >> +++ b/tools/testing/selftests/bpf/prog_tests/kernel_flag.c
>> >> @@ -0,0 +1,43 @@
>> >> +// SPDX-License-Identifier: GPL-2.0
>> >> +/* Copyright (c) 2025 Microsoft */
>> >> +#include <test_progs.h>
>> >> +#include "kfunc_call_test.skel.h"
>> >> +#include "kfunc_call_test.lskel.h"
>> >> +#include "test_kernel_flag.skel.h"
>> >> +
>> >> +void test_kernel_flag(void)
>> >> +{
>> >> +       struct test_kernel_flag *lsm_skel;
>> >> +       struct kfunc_call_test *skel = NULL;
>> >> +       struct kfunc_call_test_lskel *lskel = NULL;
>> >> +       int ret;
>> >> +
>> >> +       lsm_skel = test_kernel_flag__open_and_load();
>> >> +       if (!ASSERT_OK_PTR(lsm_skel, "lsm_skel"))
>> >> +               return;
>> >> +
>> >> +       ret = test_kernel_flag__attach(lsm_skel);
>> >> +       if (!ASSERT_OK(ret, "test_kernel_flag__attach"))
>> >> +               goto close_prog;
>> >> +
>> >> +       lsm_skel->bss->monitored_pid = getpid();
>> >
>> > We usually set monitored_pid before attaching the program.
>> >
>>
>> Okay, copy that.
>>
>> >> +
>> >> +       /* Test with skel. This should pass the gatekeeper */
>> >> +       skel = kfunc_call_test__open_and_load();
>> >> +       if (!ASSERT_OK_PTR(skel, "skel"))
>> >> +               goto close_prog;
>> >> +
>> >> +       /* Test with lskel. This should fail due to blocking kernel-based bpf() invocations */
>> >> +       lskel = kfunc_call_test_lskel__open_and_load();
>> >> +       if (!ASSERT_ERR_PTR(lskel, "lskel"))
>> >> +               goto close_prog;
>> >> +
>> >> +close_prog:
>> >> +       if (skel)
>> >> +               kfunc_call_test__destroy(skel);
>> >> +       if (lskel)
>> >> +               kfunc_call_test_lskel__destroy(lskel);
>> >> +
>> >> +       lsm_skel->bss->monitored_pid = 0;
>> >> +       test_kernel_flag__destroy(lsm_skel);
>> >> +}
>> >> diff --git a/tools/testing/selftests/bpf/progs/test_kernel_flag.c b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
>> >> new file mode 100644
>> >> index 0000000000000..9ca01aadb6656
>> >> --- /dev/null
>> >> +++ b/tools/testing/selftests/bpf/progs/test_kernel_flag.c
>> >> @@ -0,0 +1,28 @@
>> >> +// SPDX-License-Identifier: GPL-2.0
>> >> +
>> >> +/*
>> >> + * Copyright (C) 2025 Microsoft Corporation
>> >> + *
>> >> + * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
>> >> + */
>> >> +
>> >> +#include "vmlinux.h"
>> >> +#include <errno.h>
>> >> +#include <bpf/bpf_helpers.h>
>> >> +#include <bpf/bpf_tracing.h>
>> >> +
>> >> +char _license[] SEC("license") = "GPL";
>> >> +
>> >> +__u32 monitored_pid;
>> >> +
>> >> +SEC("lsm.s/bpf")
>> >> +int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
>> >> +{
>> >> +       __u32 pid;
>> >> +
>> >> +       pid = bpf_get_current_pid_tgid() >> 32;
>> >> +       if (!kernel || pid != monitored_pid)
>> >> +               return 0;
>> >
>> > We are blocking lskel load for the pid. This could make
>> > parallel testing (test_progs -j) flaky. We should probably
>> > change the logic to filtering on monitored_tiid.
>> >
>>
>> Curious on this for my own edification. The
>>
>> pid = bpf_get_current_pid_tgid() >> 32;
>>
>> is used extensively in the current test suite in a bunch of other
>> tests. Why does that not cause an issue with the other tests during
>> parallel testing?
>
> We are blindly blocking all security_bpf() with kernel=true here, so
> any lskel load in parallel with this test may fail. On the other hand,
> existing tests only block some operations under certain conditions.
> For example, test_cgroup1_hierarchy.c only blocks operations for
> target_ancestor_cgid.
>
> Does this make sense?
>

Not quite. This is only blocking security_bpf where kernel=true and
pid=monitored_pid. 


> Thanks,
> Song

Re: [PATCH v6 bpf-next 2/2] selftests/bpf: Add a kernel flag test for LSM bpf hook

[Song Liu]

On Mon, Mar 10, 2025 at 11:11 AM Blaise Boscaccy
<bboscaccy@linux.microsoft.com> wrote:
[...]
> >
> > We are blindly blocking all security_bpf() with kernel=true here, so
> > any lskel load in parallel with this test may fail. On the other hand,
> > existing tests only block some operations under certain conditions.
> > For example, test_cgroup1_hierarchy.c only blocks operations for
> > target_ancestor_cgid.
> >
> > Does this make sense?
> >
>
> Not quite. This is only blocking security_bpf where kernel=true and
> pid=monitored_pid.

"test_progs -j" runs multiple threads within the process, so all the
threads are within monotored_pid.

Thanks,
Song