Some kernels builds might inline vfs_getattr call within fstat syscall code path, so fentry/vfs_getattr trampoline is not called. Add security_inode_getattr to allowlist and switch the d_path test stat trampoline to security_inode_getattr. Keeping dentry_open and filp_close, because they are in their own files, so unlikely to be inlined, but in case they are, adding security_file_open. Adding flags that indicate trampolines were called and failing the test if any of them got missed, so it's easier to identify the issue next time.
Showing the changes to kernel (1 of 3 files). Show all
Unified · Split
| @@ -1114,6 +1114,14 @@ BPF_CALL_3(bpf_d_path, struct path *, path, char *, buf, u32, sz) · 1113 unmodified lines | |||
| 1114 | } | 1114 | } |
| 1115 | 1115 | ||
| 1116 | BTF_SET_START(btf_allowlist_d_path) | 1116 | BTF_SET_START(btf_allowlist_d_path) |
| 1117 | #ifdef CONFIG_SECURITY | ||
| 1118 | BTF_ID(func, security_file_permission) | ||
| 1119 | BTF_ID(func, security_inode_getattr) | ||
| 1120 | BTF_ID(func, security_file_open) | ||
| 1121 | #endif | ||
| 1122 | #ifdef CONFIG_SECURITY_PATH | ||
| 1123 | BTF_ID(func, security_path_truncate) | ||
| 1124 | #endif | ||
| 1117 | BTF_ID(func, vfs_truncate) | 1125 | BTF_ID(func, vfs_truncate) |
| 1118 | BTF_ID(func, vfs_fallocate) | 1126 | BTF_ID(func, vfs_fallocate) |
| 1119 | BTF_ID(func, dentry_open) | 1127 | BTF_ID(func, dentry_open) |