On 2026/9/7 10:36, [email protected] wrote:
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index c7bc9ba9b331..b394a37eecb4 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -4481,14 +4481,9 @@ static int bpf_prog_attach_check_attach_type(const
>> struct bpf_prog *prog,
>> case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
>> case BPF_PROG_TYPE_CGROUP_SOCKOPT:
>> case BPF_PROG_TYPE_SK_LOOKUP:
>> + case BPF_PROG_TYPE_LSM:
>> return attach_type == prog->expected_attach_type ? 0 : -EINVAL;
>
> Does adding BPF_PROG_TYPE_LSM to this arm also relax the check on the
> BPF_LINK_CREATE path?
>
> Before this patch, BPF_PROG_TYPE_LSM fell into the default arm:
>
> default:
> ptype = attach_type_to_prog_type(attach_type);
> if (ptype == BPF_PROG_TYPE_UNSPEC || ptype != prog->type)
> return -EINVAL;
> return 0;
>
> Since attach_type_to_prog_type() returns BPF_PROG_TYPE_LSM only for
> BPF_LSM_MAC and BPF_LSM_CGROUP (kernel/bpf/syscall.c:4457, 4463), an LSM
> program could only ever be accepted for those two attach types.
>
> The new arm drops that constraint and accepts any attach_type as long as it
> equals prog->expected_attach_type. The other members of that arm are safe
> because bpf_prog_load_check_attach() restricts their expected_attach_type
> to a set that all maps back to the same prog type. BPF_PROG_TYPE_LSM is the
> one type in that arm with no such restriction: bpf_prog_load_check_attach()
> (kernel/bpf/syscall.c:2766 onwards) has no LSM case and falls into
> `default: return 0`, so prog->expected_attach_type is entirely
> userspace-controlled for LSM programs.
Good catch.
Since there's no expected_attach_type check for lsm prog, a lsm prog can
have BPF_TRACE_ITER expected_attach_type, and creates a lsm link via
BPF_LINK_CREATE with this patch. Such lsm prog cannot create a lsm link
via BPF_LINK_CREATE without this patch.
The new case BPF_PROG_TYPE_LSM in bpf_prog_attach_check_attach_type()
relaxes the prog->type check when adding expected_attach_type check.
I think we can add expected_attach_type check for lsm prog in
bpf_prog_load_check_attach(). See below diff. The diff will restrict a
lsm prog with these two expected_attach_type, BPF_LSM_MAC and
BPF_LSM_CGROUP.
Thanks,
Leon
---
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 6874ba1424af..4b56e82ff3b9 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2830,6 +2830,16 @@ bpf_prog_load_check_attach(enum bpf_prog_type
prog_type,
if (expected_attach_type == BPF_NETFILTER)
return 0;
return -EINVAL;
+ case BPF_PROG_TYPE_LSM:
+ switch (expected_attach_type) {
+ case BPF_LSM_MAC:
+ case BPF_LSM_CGROUP:
+ return 0;
+ default:
+ return -EINVAL;
+ }
case BPF_PROG_TYPE_SYSCALL:
case BPF_PROG_TYPE_EXT:
if (expected_attach_type)
> [...]
