linux-kernel - Re: [PATCH] lsm,selinux: Add LSM blob support for BPF objects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <878qkl4irf.fsf@microsoft.com>
Date: Fri, 18 Jul 2025 08:32:20 -0700
From: Blaise Boscaccy <bboscaccy@...ux.microsoft.com>
To: Song Liu <song@...nel.org>
Cc: Paul Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>,
 "Serge E. Hallyn" <serge@...lyn.com>, Stephen Smalley
 <stephen.smalley.work@...il.com>, Ondrej Mosnacek <omosnace@...hat.com>,
 Casey Schaufler <casey@...aufler-ca.com>, John Johansen
 <john.johansen@...onical.com>, Christian Göttsche
 <cgzones@...glemail.com>, linux-security-module@...r.kernel.org,
 linux-kernel@...r.kernel.org, selinux@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH] lsm,selinux: Add LSM blob support for BPF objects

Song Liu <song@...nel.org> writes:

> On Tue, Jul 15, 2025 at 3:27 PM Blaise Boscaccy
> <bboscaccy@...ux.microsoft.com> wrote:
> [...]
>> +/**
>> + * lsm_bpf_map_alloc - allocate a composite bpf_map blob
>> + * @map: the bpf_map that needs a blob
>> + *
>> + * Allocate the bpf_map blob for all the modules
>> + *
>> + * Returns 0, or -ENOMEM if memory can't be allocated.
>> + */
>> +static int lsm_bpf_map_alloc(struct bpf_map *map)
>> +{
>> +       if (blob_sizes.lbs_bpf_map == 0) {
>> +               map->security = NULL;
>> +               return 0;
>> +       }
>> +
>> +       map->security = kzalloc(blob_sizes.lbs_bpf_map, GFP_KERNEL);
>> +       if (!map->security)
>> +               return -ENOMEM;
>> +
>> +       return 0;
>> +}
>> +
>> +/**
>> + * lsm_bpf_prog_alloc - allocate a composite bpf_prog blob
>> + * @prog: the bpf_prog that needs a blob
>> + *
>> + * Allocate the bpf_prog blob for all the modules
>> + *
>> + * Returns 0, or -ENOMEM if memory can't be allocated.
>> + */
>> +static int lsm_bpf_prog_alloc(struct bpf_prog *prog)
>> +{
>> +       if (blob_sizes.lbs_bpf_prog == 0) {
>> +               prog->aux->security = NULL;
>> +               return 0;
>> +       }
>> +
>> +       prog->aux->security = kzalloc(blob_sizes.lbs_bpf_prog, GFP_KERNEL);
>> +       if (!prog->aux->security)
>> +               return -ENOMEM;
>> +
>> +       return 0;
>> +}
>> +
>> +/**
>> + * lsm_bpf_token_alloc - allocate a composite bpf_token blob
>> + * @token: the bpf_token that needs a blob
>> + *
>> + * Allocate the bpf_token blob for all the modules
>> + *
>> + * Returns 0, or -ENOMEM if memory can't be allocated.
>> + */
>> +static int lsm_bpf_token_alloc(struct bpf_token *token)
>> +{
>> +       if (blob_sizes.lbs_bpf_token == 0) {
>> +               token->security = NULL;
>> +               return 0;
>> +       }
>> +
>> +       token->security = kzalloc(blob_sizes.lbs_bpf_token, GFP_KERNEL);
>> +       if (!token->security)
>> +               return -ENOMEM;
>> +
>> +       return 0;
>> +}
>
> We need the above 3 functions inside #ifdef CONFIG_BPF_SYSCALL.
>
> Also, can we use lsm_blob_alloc() in these functions?
>
> Thanks,
> Song

Sure, I'll get that fixed in V2. Thanks

-blaise

>
> [...]