NACK: [SRU][R][PATCH 1/1] UBUNTU: [Config] append bpf to CONFIG_LSM

[Andrei Gherzan]

Thanks for this. As mentioned by Stefan, we need this to be submitted linked as
an email thread to the cover letter.

On 26/09/04 08:34AM, Matt Bobrowski wrote:
> BugLink: https://bugs.launchpad.net/bugs/2166235
> 
> Ubuntu kernels are built with CONFIG_BPF_LSM=y but omit bpf from
> CONFIG_LSM, so the BPF LSM is compiled in and never initialized.
> Projects that use the BPF LSM detect its absence and degrade: systemd
> skips RestrictFileSystems=, disables systemd-nsresourced's user
> namespace delegation, and fails PID 1 startup if
> RestrictFileSystemAccess= is enabled; Tetragon refuses LSM-hook
> policies; KubeArmor falls back to AppArmor; bespoke BPF_PROG_TYPE_LSM
> programs attach without error and are never invoked.
> 
> When CONFIG_BPF_LSM was enabled (LP: #1905975), bpf was deliberately
> left out of CONFIG_LSM because activating it registered an empty
> callback on every LSM hook, each costing an indirect, retpoline-
> mitigated call. That bug records the intent to activate the LSM once
> upstream removed the overhead. It did in 6.12 with commit 417c5643cd67
> ("lsm: replace indirect LSM hook calls with static calls"), which
> converts hook dispatch to static calls. The cost that motivated the
> omission no longer exists.
> 
> Upstream security/Kconfig has listed bpf in every CONFIG_LSM default
> since 5.7, via commit 520b7aa00d8c ("bpf: lsm: Initialize the BPF LSM
> hooks"). RHEL, Fedora, SUSE, Debian, Arch Oracle UEK, and any other
> major distribution all initialize it by default. This brings Ubuntu into
> line with the upstream default. bpf is placed after apparmor, matching
> upstream; it carries no LSM_FLAG_EXCLUSIVE, so AppArmor remains the
> exclusive LSM and its decisions are unaffected. Systems booting with
> lsm= are unaffected, as that parameter replaces the built-in list.
> 
> Signed-off-by: Matt Bobrowski <matt at bobrowski.net>
> ---
>  debian.master/config/annotations | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/debian.master/config/annotations b/debian.master/config/annotations
> index 702fca42e937..e9f8f34d6ffa 100644
> --- a/debian.master/config/annotations
> +++ b/debian.master/config/annotations
> @@ -7507,7 +7507,7 @@ CONFIG_LRU_CACHE                                policy<{'amd64': 'm', 'arm64': '
>  CONFIG_LRU_GEN_STATS                            policy<{'amd64': 'n', 'arm64': 'n', 'ppc64el': 'n', 'riscv64': 'n', 's390x': 'n'}>
>  CONFIG_LRU_GEN_WALKS_MMU                        policy<{'amd64': 'y', 'arm64': 'y'}>
>  CONFIG_LSI_ET1011C_PHY                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 'riscv64': 'm', 's390x': 'm'}>
> -CONFIG_LSM                                      policy<{'amd64': '"landlock,lockdown,yama,integrity,apparmor"', 'arm64': '"landlock,lockdown,yama,integrity,apparmor"', 'armhf': '"landlock,lockdown,yama,integrity,apparmor"', 'ppc64el': '"landlock,lockdown,yama,integrity,apparmor"', 'riscv64': '"landlock,lockdown,yama,integrity,apparmor"', 's390x': '"landlock,lockdown,yama,integrity,apparmor"'}>
> +CONFIG_LSM                                      policy<{'amd64': 'landlock,lockdown,yama,integrity,apparmor,bpf', 'arm64': 'landlock,lockdown,yama,integrity,apparmor,bpf', 'armhf': 'landlock,lockdown,yama,integrity,apparmor,bpf', 'ppc64el': 'landlock,lockdown,yama,integrity,apparmor,bpf', 'riscv64': 'landlock,lockdown,yama,integrity,apparmor,bpf', 's390x': 'landlock,lockdown,yama,integrity,apparmor,bpf'}>
>  CONFIG_LSM_MMAP_MIN_ADDR                        policy<{'amd64': '0', 'arm64': '0', 'armhf': '0', 'ppc64el': '0', 'riscv64': '0', 's390x': '0'}>
>  CONFIG_LS_EXTIRQ                                policy<{'arm64': 'y'}>
>  CONFIG_LS_SCFG_MSI                              policy<{'arm64': 'y'}>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260904/71f75880/attachment.sig>