[PATCH bpf-next v3 07/15] lsm: Add the bpf_lsm_policy_apply_bprm kfunc

[Alexei Starovoitov]

On Wed Sep 9, 2026 at 12:37 PM PDT, Justin Suess wrote:
> Add the kfunc applying a policy object to an execution:
>
>   bpf_lsm_policy_apply_bprm(object, bprm, flags)        KF_SLEEPABLE
>
> It asks the LSM owning @object, through the bprm_apply_policy_object
> hook, to restrict the credentials prepared in @bprm, so that the
> executed task starts confined by the policy.  The meaning of @flags
> and the composition with restrictions the credentials already carry
> are the owning LSM's; an LSM without execution policy support makes
> the call fail with -EOPNOTSUPP.
>
> The kfunc runs the hook in a root memcg charging scope: the policy
> restricts the execution on behalf of the BPF program, not of the
> mediated task, so what the owning LSM allocates to compute it, e.g.
> Landlock's merged domain, is not charged to the task the program
> supervises.
>
> The filter makes the kfunc exclusive to the sleepable LSM programs
> attached to the bprm_creds_for_exec() or bprm_creds_from_file()
> hooks, the only contexts where the bprm's credentials are prepared
> but not yet committed.  The verifier's argument typing does not draw
> this boundary on its own: a trusted struct linux_binprm pointer is
> also available at the other bprm hooks -- bprm_check_security(),
> which runs per binfmt while an interpreter may still rewrite the
> execution, and bprm_committing_creds()/bprm_committed_creds(), which
> run at or past the point of no return, where the prepared
> credentials are frozen or installed -- and to tp_btf programs via
> the sched_prepare_exec and sched_process_exec tracepoints, which
> resolve kfuncs from the same registration bucket as LSM programs.
> The attach-point filter, not the argument type, is the authorization
> boundary.
>
> No filter case is needed for BPF_LSM_CGROUP programs: since
> commit 5b038319be44 ("bpf: Reject sleepable BPF_LSM_CGROUP programs
> at load time") they cannot be sleepable, so KF_SLEEPABLE already
> excludes them.
>
> Cc: Paul Moore <paul at paul-moore.com>
> Cc: KP Singh <kpsingh at kernel.org>
> Signed-off-by: Justin Suess <utilityemal77 at gmail.com>
> ---
>
> Notes:
>     v2->v3:
>         - Drop the BPF_LSM_CGROUP case from the kfunc filter: since
>           commit 5b038319be44 ("bpf: Reject sleepable BPF_LSM_CGROUP
>           programs at load time") such programs cannot be sleepable, so
>           KF_SLEEPABLE already excludes them from the apply kfunc.
>         - Document, in the commit message and the filter comment, why the
>           attach-point filter rather than the verifier's argument typing
>           is the authorization boundary.
>
>  security/bpf_lsm_kfuncs.c | 68 +++++++++++++++++++++++++++++++++++++++
>  1 file changed, 68 insertions(+)
>
> diff --git a/security/bpf_lsm_kfuncs.c b/security/bpf_lsm_kfuncs.c
> index 43a4bf57fd31..857e9a316d1c 100644
> --- a/security/bpf_lsm_kfuncs.c
> +++ b/security/bpf_lsm_kfuncs.c
> @@ -2,16 +2,25 @@
>  
>  /* BPF kfuncs exposing LSM policy objects. */
>  
> +#include <linux/binfmts.h>
>  #include <linux/bpf.h>
>  #include <linux/btf.h>
>  #include <linux/btf_ids.h>
>  #include <linux/cfi.h>
>  #include <linux/init.h>
>  #include <linux/lsm_hooks.h>
> +#include <linux/memcontrol.h>
> +#include <linux/sched/mm.h>
>  #include <linux/security.h>
>  
>  #include "lsm.h"
>  
> +/* The sleepable LSM hooks bpf_lsm_policy_apply_bprm() may be called from. */
> +BTF_SET_START(bpf_lsm_policy_bprm_hooks)
> +BTF_ID(func, bpf_lsm_bprm_creds_for_exec)
> +BTF_ID(func, bpf_lsm_bprm_creds_from_file)
> +BTF_SET_END(bpf_lsm_policy_bprm_hooks)
> +
>  __bpf_kfunc_start_defs();
>  
>  /**
> @@ -44,6 +53,49 @@ bpf_lsm_policy_acquire(struct lsm_policy_object *object)
>  	return NULL;
>  }
>  
> +/**
> + * bpf_lsm_policy_apply_bprm - Apply a policy object to exec credentials
> + * @object: policy object to apply
> + * @bprm: execution context providing the prepared credentials to
> + *        restrict
> + * @flags: flags defined by the LSM owning @object
> + *
> + * Ask the LSM owning @object to restrict the credentials prepared in
> + * @bprm with it, so that the executed task starts confined by the
> + * policy.  How the policy composes with restrictions the credentials
> + * already carry, and the meaning of @flags, are defined by the owning
> + * LSM.  @object is only borrowed: the caller keeps its reference.
> + * The hook runs in a root memcg charging scope: policy the LSM
> + * computes on behalf of the program is not charged to the mediated
> + * task.
> + *
> + * Return: 0 on success, -EOPNOTSUPP if the LSM owning @object does
> + * not support applying policy to an execution, -EINVAL on unsupported
> + * @flags, other negative values on LSM-specific failures.
> + */
> +__bpf_kfunc int bpf_lsm_policy_apply_bprm(struct lsm_policy_object *object,
> +					  struct linux_binprm *bprm, u32 flags)
> +{
> +	struct lsm_static_call *scall;
> +	struct mem_cgroup *old_memcg;
> +	int err;
> +
> +	lsm_for_each_hook(scall, bprm_apply_policy_object) {
> +		if (scall->hl->lsmid->id != object->lsmid)
> +			continue;
> +		/*
> +		 * The hook runs on behalf of the BPF program, not of the
> +		 * mediated task: charge its allocations to the root memcg.
> +		 */
> +		old_memcg = set_active_memcg(root_mem_cgroup);
> +		err = scall->hl->hook.bprm_apply_policy_object(bprm, object,
> +							       flags);
> +		set_active_memcg(old_memcg);
> +		return err;
> +	}
> +	return -EOPNOTSUPP;

Nack.