[PATCH bpf-next 10/13] bpf: invoke security_bpf_prog_load_post_integrity from the metadata kfunc
From: KP Singh <kpsingh@kernel.org>
Date: 2026-05-22 02:32:57
Also in:
bpf
Subsystem:
bpf [general] (safe dynamic programs and tools), the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, Linus Torvalds
Call security_bpf_prog_load_post_integrity from bpf_loader_verify_metadata just before promoting prog->aux->sig.verdict from BPF_SIG_OK to BPF_SIG_METADATA_VERIFIED. This lets policy LSMs deny the metadata-verified transition. A non-zero return aborts the kfunc and leaves the verdict at BPF_SIG_OK; observers that key off METADATA_VERIFIED never see a verdict the LSM denied. Signed-off-by: KP Singh <kpsingh@kernel.org> --- kernel/bpf/helpers.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 9afa71fbcac3..52e71fb6e200 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c@@ -4300,6 +4300,14 @@ __bpf_kfunc int bpf_loader_verify_metadata(struct bpf_map *map, if (memcmp(sha, hash, SHA256_DIGEST_SIZE)) return -EBADMSG; + /* Metadata integrity is decided by the checks above; the LSM hook + * is an observer of that verdict and may apply policy (e.g. deny), + * but cannot vouch for integrity it did not verify itself. + */ + err = security_bpf_prog_load_post_integrity(aux__ign->prog); + if (err) + return err; + aux__ign->sig.verdict = BPF_SIG_METADATA_VERIFIED; return 0; }
--
2.53.0