bpf-restrict-fsaccess: use direct field access for trusted pointers

The bprm_check_security and file_mprotect hooks currently fetch the file
pointer with BPF_CORE_READ_INTO(), i.e. bpf_probe_read_kernel(). That
hands us back a plain scalar and since 1a5c01d2508a ("bpf: Make
KF_TRUSTED_ARGS the default for all kfuncs") in v7.0 such a pointer can't
be passed to a kfunc at all.

Dereference the fields directly instead. Both bprm->file and vma->vm_file
are in the verifier's BTF_TYPE_SAFE_TRUSTED(_OR_NULL) lists so the loads
give us PTR_TRUSTED registers, and vmlinux.h pushes preserve_access_index
for all records so we don't lose CO-RE.

No functional changes. This is just so we can hand the pointers to the
bpf_real_data_inode() kfunc in the next patch.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

src/bpf/restrict-fsaccess.bpf.c

@@ -142,10 +142,10 @@ static __always_inline int check_trusted_file(struct file *file)
 SEC("lsm/bprm_check_security")
 int BPF_PROG(restrict_fsaccess_bprm_check, struct linux_binprm *bprm)
 {
-        struct file *file;
-
-        BPF_CORE_READ_INTO(&file, bprm, file);
-        return check_trusted_file(file);
+        /* Direct dereference (CO-RE-relocated via vmlinux.h's
+         * preserve_access_index) instead of bpf_probe_read(): only direct
+         * loads keep the verifier's trusted-pointer tracking. */
+        return check_trusted_file(bprm->file);
 }
 
 SEC("lsm/mmap_file")
@@ -180,8 +180,9 @@ int BPF_PROG(restrict_fsaccess_file_mprotect, struct vm_area_struct *vma,
         if (vm_flags & VM_EXEC)
                 return 0;
 
-        /* Anonymous executable mapping — no file backing, deny */
-        BPF_CORE_READ_INTO(&file, vma, vm_file);
+        /* Anonymous executable mapping — no file backing, deny. Direct
+         * dereference, see restrict_fsaccess_bprm_check(). */
+        file = vma->vm_file;
         if (!file)
                 return -EPERM;