From 060628d332421d8796c6dff779e5d33b549389f7 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Thu, 30 Jul 2026 10:32:17 +0200 Subject: [PATCH] bpf-restrict-fsaccess: use direct field access for trusted pointers The bprm_check_security and file_mprotect hooks currently fetch the file pointer with BPF_CORE_READ_INTO(), i.e. bpf_probe_read_kernel(). That hands us back a plain scalar and since 1a5c01d2508a ("bpf: Make KF_TRUSTED_ARGS the default for all kfuncs") in v7.0 such a pointer can't be passed to a kfunc at all. Dereference the fields directly instead. Both bprm->file and vma->vm_file are in the verifier's BTF_TYPE_SAFE_TRUSTED(_OR_NULL) lists so the loads give us PTR_TRUSTED registers, and vmlinux.h pushes preserve_access_index for all records so we don't lose CO-RE. No functional changes. This is just so we can hand the pointers to the bpf_real_data_inode() kfunc in the next patch. Signed-off-by: Christian Brauner (Amutable) --- src/bpf/restrict-fsaccess.bpf.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/bpf/restrict-fsaccess.bpf.c b/src/bpf/restrict-fsaccess.bpf.c index 13e11aff50..3db9c4b218 100644 --- a/src/bpf/restrict-fsaccess.bpf.c +++ b/src/bpf/restrict-fsaccess.bpf.c @@ -142,10 +142,10 @@ static __always_inline int check_trusted_file(struct file *file) SEC("lsm/bprm_check_security") int BPF_PROG(restrict_fsaccess_bprm_check, struct linux_binprm *bprm) { - struct file *file; - - BPF_CORE_READ_INTO(&file, bprm, file); - return check_trusted_file(file); + /* Direct dereference (CO-RE-relocated via vmlinux.h's + * preserve_access_index) instead of bpf_probe_read(): only direct + * loads keep the verifier's trusted-pointer tracking. */ + return check_trusted_file(bprm->file); } SEC("lsm/mmap_file") @@ -180,8 +180,9 @@ int BPF_PROG(restrict_fsaccess_file_mprotect, struct vm_area_struct *vma, if (vm_flags & VM_EXEC) return 0; - /* Anonymous executable mapping — no file backing, deny */ - BPF_CORE_READ_INTO(&file, vma, vm_file); + /* Anonymous executable mapping — no file backing, deny. Direct + * dereference, see restrict_fsaccess_bprm_check(). */ + file = vma->vm_file; if (!file) return -EPERM;