Re: [PATCH bpf-next v8 0/8] MAC and Audit policy using eBPF (KRSI)

On Sat, Mar 28, 2020 at 10:50 PM Kees Cook [off-list ref] wrote:

On Sat, Mar 28, 2020 at 08:56:36PM +0100, KP Singh wrote:

quoted

Since the attachment succeeds and the hook does not get called, it
seems like "bpf" LSM is not being initialized and the hook, although
present, does not get called.

This indicates that "bpf" is not in CONFIG_LSM. It should, however, be
there by default as we added it to default value of CONFIG_LSM and
also for other DEFAULT_SECURITY_* options.

Let me know if that's the case and it fixes it.

Is the selftest expected to at least fail cleanly (i.e. not segfault)

I am not sure where the crash comes from, it does not look like it's test_lsm,
it seems to happen in test_overhead. Both seem to run fine for me.

- KP

when the BPF LSF is not built into the kernel?

--
Kees Cook