[PATCH bpf-next 4/5] selinux: Add BPF_LOADER_LOAD_FD syscall permission
"Thiébaud Weksteen" <[email protected]>
| Newsgroups | org.kernel.vger.selinux,org.kernel.vger.bpf,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
Add the BPF_LOADER_LOAD_FD permission to gate the bpf syscall command of the same name. Signed-off-by: Thiébaud Weksteen <[email protected]> --- security/selinux/hooks.c | 4 ++++ security/selinux/include/classmap.h | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e7c5993f6954..b4ff5ea5306d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -7196,6 +7196,10 @@ static int selinux_bpf(int cmd, union bpf_attr *attr, ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD, NULL); break; + case BPF_LOADER_LOAD_FD: + ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__LOADER_LOAD_FD, + NULL); + break; default: ret = 0; break; diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 453522ca87df..4c6cc71b233c 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -171,7 +171,7 @@ const struct security_class_mapping secclass_map[] = { { "infiniband_endport", { "manage_subnet", NULL } }, { "bpf", { "map_create", "map_read", "map_write", "prog_load", "prog_run", - "map_create_as", "prog_load_as", NULL } }, + "map_create_as", "prog_load_as", "loader_load_fd", NULL } }, { "xdp_socket", { COMMON_SOCK_PERMS, NULL } }, { "mctp_socket", { COMMON_SOCK_PERMS, NULL } }, { "perf_event", -- 2.55.0.691.gc56d675ccc-goog