Re: [PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added enum variants `READING_BPF_LOADER` and `LOADING_BPF_LOADER` are not handled in the switch statements of the IPE (Integrity Policy Enforcement) LSM hooks. This will cause a kernel warning and default to an invalid policy operation.
--

--- Patch [1]: [PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant ---
commit 2c2b2df398b783718511b45e4ea8aa7251362d31
Author: Thiébaud Weksteen <[email protected]>

fs/kernel_read_file,selinux: Add BPF_LOADER constant

This commit adds a new BPF_LOADER constant for kernel_read_file_id and
kernel_load_data_id. It also updates the SELinux policy to handle the new
loading constants.

> diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
> index d613a7b4dd35a..fbcaf41c1b734 100644
> --- a/include/linux/kernel_read_file.h
> +++ b/include/linux/kernel_read_file.h
> @@ -15,6 +15,7 @@
>  	id(POLICY, security-policy)		\
>  	id(X509_CERTIFICATE, x509-certificate)	\
>  	id(MODULE_COMPRESSED, kernel-module-compressed) \
> +	id(BPF_LOADER, bpf-loader) \

[Severity: High]
Should the Integrity Policy Enforcement (IPE) LSM hooks be updated to handle
these new constants as well?

If READING_BPF_LOADER is passed to ipe_kernel_read_file(), it will fall
through to the default case since there is no matching rule setup:

security/ipe/hooks.c:ipe_kernel_read_file() {
    ...
    switch (id) {
    ...
    default:
        op = IPE_OP_INVALID;
        WARN(1, "no rule setup for kernel_read_file enum %d", id);
    }
}

This will trigger a kernel warning and default to an invalid policy operation,
which may incorrectly deny the BPF loader. The same unhandled switch case
exists for LOADING_BPF_LOADER in ipe_kernel_load_data().

>  	id(MAX_ID, )
>  
>  #define __fid_enumify(ENUM, dummy) READING_ ## ENUM,

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1