Re: [PATCH bpf-next v3 07/15] lsm: Add the bpf_lsm_policy_apply_bprm kfunc

[Justin Suess <utilityemal77@gmail.com>]

On Wed, Sep 09, 2026 at 07:55:00PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The attach-point authorization boundary for `bpf_lsm_policy_apply_bprm` can be bypassed using BPF tail calls.
> --
> 
> commit 7b53e20161b20c35fb85beb1fba538fe85514074
> Author: Justin Suess <utilityemal77@gmail.com>
> Date:   Wed Sep 9 19:37:10 2026 +0000
> 
>     lsm: Add the bpf_lsm_policy_apply_bprm kfunc
>     
> This commit introduces the bpf_lsm_policy_apply_bprm kfunc, allowing sleepable
> LSM BPF programs to restrict credentials prepared in a linux_binprm. It
> restricts this kfunc to specific execution hooks (bprm_creds_for_exec and
> bprm_creds_from_file) to prevent policies from being applied at unsafe points.
> 
> > diff --git a/security/bpf_lsm_kfuncs.c b/security/bpf_lsm_kfuncs.c
> > index 43a4bf57fd31e..857e9a316d1cc 100644
> > --- a/security/bpf_lsm_kfuncs.c
> > +++ b/security/bpf_lsm_kfuncs.c
> 
> [ ... ]
> 
> > @@ -141,11 +202,18 @@ static int bpf_lsm_policy_kfunc_filter(const struct bpf_prog *prog,
> >  
> >  	switch (prog->type) {
> >  	case BPF_PROG_TYPE_SYSCALL:
> > +		if (kfunc_id == bpf_lsm_policy_apply_bprm_ids[0])
> > +			return -EACCES;
> >  		return 0;
> >  	case BPF_PROG_TYPE_LSM:
> >  		if (kfunc_id == bpf_lsm_policy_from_fd_ids[0])
> >  			return -EACCES;
> >  
> > +		if (kfunc_id == bpf_lsm_policy_apply_bprm_ids[0] &&
> > +		    !btf_id_set_contains(&bpf_lsm_policy_bprm_hooks,
> > +					 prog->aux->attach_btf_id))
> > +			return -EACCES;
> 
> [Severity: High]
> Can the attach-point authorization boundary be bypassed using BPF tail calls?
> 
> This verification-time check inspects the initial program's attach point,
> but does it account for runtime context switches via tail calls?
> 
> For example, if a privileged user loads Program A attached to
> bprm_creds_for_exec that calls bpf_lsm_policy_apply_bprm(), it passes this
> filter and can be inserted into a PROG_ARRAY map.
> 
> If they then load Program B attached to bprm_check_security and perform a
> bpf_tail_call() into Program A, the tail call is permitted because both
> hooks share identical BTF function prototypes (int (struct linux_binprm *)).
> 
> Does this allow bpf_lsm_policy_apply_bprm() to be executed at
> bprm_check_security, creating a TOCTOU vulnerability since the execution
> can still be rewritten by an interpreter?
>
Yes you can do this, but no it's not a vulnerability. No incorrect state
would be created here (in bprm_check_security, creds are still
uncommitted), so there's no issue in actually just letting a user apply
their policy there...

I'll probably just add bprm_check_security to the allowed hook list.
> > +
> >  		return 0;
> >  	default:
> >  		return -EACCES;
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260909193719.518517-1-utilityemal77@gmail.com?part=7