[PATCH bpf-next v3 00/15] BPF interface for applying Landlock rulesets

[Justin Suess]

Howdy,

This series lets BPF programs apply an existing, userspace-created
Landlock ruleset to a program during exec.  The goal is unchanged
from the RFC [1], v1 [2], and v2 [3]: BPF does not create, inspect,
or mutate Landlock policy, it only decides whether a ruleset that
was already created and validated through Landlock's existing
userspace API should be applied, based on runtime exec context.
The policy is in place before the first instruction of the new
program runs, closing the race a userspace supervisor cannot.

v3 is v2 rebased onto bpf-next, plus small fixes; the design is
unchanged.  The Landlock prerequisites (the ruleset/domain split,
the tracepoint series, and LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS)
went upstream in the 7.3 merge window, so the series now applies
directly to bpf-next.

The interface, for reference:

  bpf_lsm_policy_from_fd(fd, flags)         KF_ACQUIRE | KF_RET_NULL | KF_SLEEPABLE
  bpf_lsm_policy_acquire(object)            KF_ACQUIRE | KF_RCU | KF_RET_NULL
  bpf_lsm_policy_release(object)            KF_RELEASE
  bpf_lsm_policy_apply_bprm(object, bprm, flags)  KF_SLEEPABLE

The kfuncs are LSM-generic: they operate on struct
lsm_policy_object, which the owning LSM embeds in its own policy
structure, and dispatch to that LSM through four ordinary LSM hooks
(policy_object_from_fd, policy_object_get, policy_object_put,
bprm_apply_policy_object).  No kfunc argument names an LSM anywhere
in the interface, yet it is not an ioctl-like multiplexer.
Landlock is the first provider.

Rather than repeating the whole design here, see the v2
cover letter [3] for the details, as the core design and API are
identical to the previous iteration.

Changes since v2
===

- Rebased onto bpf-next; prerequisites are now met.
- The kfunc filter's BPF_LSM_CGROUP case is dropped: since
  commit 5b038319be44 ("bpf: Reject sleepable BPF_LSM_CGROUP
  programs at load time") such programs cannot be sleepable, so
  KF_SLEEPABLE already excludes them from the apply kfunc, making
  that case redundant.
- The apply_bprm patch now documents why the attach-point filter,
  not the verifier's argument typing, is the authorization boundary:
  trusted linux_binprm pointers are also available at the other bprm
  hooks and to tp_btf programs via the exec tracepoints, which share
  the LSM programs' kfunc registration bucket.
- Fixed a pipe fd leak on the fork() error path of
  test_restrict_binprm_discard() (Sashiko AI review).

Changes since v1 are summarized in the v2 cover letter [3].

The series is structured with LSM framework patches first: patches
1-2 add the hooks, 3 is trivial macro motion, 4-7 the kfuncs, 8 the
interface documentation, and 9 its LSM-independent selftests.  The
Landlock provider follows: patches 10-13 add it, 14 its selftests,
and 15 its documentation.

[1] https://lore.kernel.org/linux-security-module/20260407200157.3874806-1-utilityemal77@xxxxxxxxx/
[2] https://lore.kernel.org/bpf/20260731022047.189137-1-utilityemal77@xxxxxxxxx/
[3] https://lore.kernel.org/bpf/20260831145858.3869191-1-utilityemal77@xxxxxxxxx/

Justin Suess (15):
  lsm: Add the LSM policy object lifetime hooks
  lsm: Add the bprm_apply_policy_object LSM hook
  lsm: Move the lsm_for_each_hook() macro to security/lsm.h
  lsm: Add the bpf_lsm_policy_release kfunc and policy object destructor
  lsm: Add the bpf_lsm_policy_from_fd kfunc
  lsm: Add the bpf_lsm_policy_acquire kfunc
  lsm: Add the bpf_lsm_policy_apply_bprm kfunc
  lsm: Document the LSM policy object interface
  selftests/bpf: Add tests for the LSM policy object kfuncs
  landlock: Expose the ruleset fd lookup to the rest of Landlock
  landlock: Factor the credential restriction out of
    landlock_restrict_self()
  landlock: Free rulesets after an RCU grace period
  landlock: Implement the LSM policy object hooks
  selftests/bpf: Test the LSM policy object kfuncs with Landlock
  landlock: Document the BPF policy interface

 Documentation/security/landlock.rst           |  38 ++
 Documentation/security/lsm-development.rst    |  49 ++
 Documentation/trace/events-landlock.rst       |   5 +-
 MAINTAINERS                                   |   1 +
 include/linux/lsm_hook_defs.h                 |   6 +
 include/linux/security.h                      |  11 +
 include/trace/events/landlock.h               |  15 +-
 kernel/bpf/bpf_lsm.c                          |   4 +
 kernel/bpf/verifier.c                         |   3 +
 security/Makefile                             |   2 +-
 security/bpf_lsm_kfuncs.c                     | 247 ++++++++
 security/landlock/Makefile                    |   2 +
 security/landlock/bpf.c                       | 152 +++++
 security/landlock/bpf.h                       |  21 +
 security/landlock/cred.c                      | 148 ++++-
 security/landlock/cred.h                      |  47 ++
 security/landlock/limits.h                    |   4 +
 security/landlock/ruleset.c                   |  30 +-
 security/landlock/ruleset.h                   |  75 ++-
 security/landlock/setup.c                     |   2 +
 security/landlock/syscalls.c                  | 105 +---
 security/lsm.h                                |   6 +
 security/security.c                           |   5 -
 tools/testing/selftests/bpf/config            |   1 +
 tools/testing/selftests/bpf/config.x86_64     |   2 +-
 .../bpf/prog_tests/lsm_policy_kfuncs.c        |  54 ++
 .../bpf/prog_tests/lsm_policy_landlock.c      | 525 ++++++++++++++++++
 .../selftests/bpf/progs/lsm_policy_kfuncs.c   |  52 ++
 .../bpf/progs/lsm_policy_kfuncs_failure.c     | 154 +++++
 .../selftests/bpf/progs/lsm_policy_landlock.c | 142 +++++
 30 files changed, 1785 insertions(+), 123 deletions(-)
 create mode 100644 security/bpf_lsm_kfuncs.c
 create mode 100644 security/landlock/bpf.c
 create mode 100644 security/landlock/bpf.h
 create mode 100644 tools/testing/selftests/bpf/prog_tests/lsm_policy_kfuncs.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/lsm_policy_landlock.c
 create mode 100644 tools/testing/selftests/bpf/progs/lsm_policy_kfuncs.c
 create mode 100644 tools/testing/selftests/bpf/progs/lsm_policy_kfuncs_failure.c
 create mode 100644 tools/testing/selftests/bpf/progs/lsm_policy_landlock.c


base-commit: af0b84a9215d951d16f26b7ee34353b970cf5d4e
-- 
2.55.0