feat(bpf): gate exec with bprm_check_security, completing M3's hooks

[nikicat]

The last hook in M3. execute compiled but never fired; it does now.

What's new mechanically

bprm_check_security, whose linux_binprm -> file is the first offset any hook has needed beyond the dentry chain the others already reach through.

That offset is applied to the hook's trusted context pointer, so it joins file_f_* and dentry_d_* as one that must stay real under maybe_poison_offsets — the verifier range-checks trusted-pointer math against .rodata at load, so poisoning it would abort the load and turn the failure-path test into a load failure rather than the self-test abort it exists to exercise.

execute is not implied by read

An exec opens the file (FMODE_EXEC | FMODE_READ), so file_open already refuses to run the contents of an object that denies reads. What this hook adds is the converse: an object may be readable and not runnable. The subject is the process performing the exec, since at this hook the caller is still its old image.

Interaction with copy-down, worth knowing before writing policy: expressing "readable but not runnable" needs an explicit deny, not a narrower allow. Copy-down puts the parent's rules in the child's bucket too, so a child rule that doesn't match the requested action falls through to them — an allow read on a child does not withdraw an execute the parent granted. The smoke scenario is built on that shape, and also pins that the denied binary stays readable, which is the point of the hook.

The self-test needed a second object

Under the deny-all probe rule the exec open is refused by file_open and the verdict never reaches the bprm hook — so the probe would pass with the hook detached, which is exactly the silent no-op the self-test exists to catch. The exec probe therefore gets its own object that allows read and denies the rest, and its file carries the x bit, without which may_open(MAY_EXEC) fails EACCES first.

Verification

VM smoke green, exit 0, zero FAILs. The execute scenario passes all three assertions (granted exec runs, denied exec refused, denied binary still readable). The startup self-test is fail-closed, so the daemon booting at all in every scenario is itself proof the hook mediates.

cargo test 131 passed / 0 failed.

M3 after this

All hooks ship. What remains is the listdir coarseness note — documentation, not a hook; a finer one would need the hot file_permission.

🤖 Generated with Claude Code