Re: [PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant

> diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
> index d613a7b4dd35a..fbcaf41c1b734 100644
> --- a/include/linux/kernel_read_file.h
> +++ b/include/linux/kernel_read_file.h
> @@ -15,6 +15,7 @@
>  	id(POLICY, security-policy)		\
>  	id(X509_CERTIFICATE, x509-certificate)	\
>  	id(MODULE_COMPRESSED, kernel-module-compressed) \
> +	id(BPF_LOADER, bpf-loader) \
>  	id(MAX_ID, )

[ ... ]

> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index 90cb61b164256..453522ca87df8 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -65,7 +65,7 @@ const struct security_class_mapping secclass_map[] = {
>  	  { "ipc_info", "syslog_read", "syslog_mod", "syslog_console",
>  	    "module_request", "module_load", "firmware_load",
>  	    "kexec_image_load", "kexec_initramfs_load", "policy_load",
> -	    "x509_certificate_load", NULL } },
> +	    "x509_certificate_load", "bpf_load", NULL } },
>  	{ "capability", { COMMON_CAP_PERMS, NULL } },

Does "bpf_load" match the pattern the rest of class 'system' follows?

Every other kernel_read_file-derived permission follows the pattern
<lowercase_id>_load:

  id(MODULE, ...)           -> "module_load"
  id(FIRMWARE, ...)         -> "firmware_load"
  id(KEXEC_IMAGE, ...)      -> "kexec_image_load"
  id(KEXEC_INITRAMFS, ...)  -> "kexec_initramfs_load"
  id(POLICY, ...)           -> "policy_load"
  id(X509_CERTIFICATE, ...) -> "x509_certificate_load"
  id(BPF_LOADER, ...)       -> "bpf_load"  <-- drops "loader"

Following that pattern, wouldn't "bpf_loader_load" read more consistently
here - especially since the 'bpf' class separately gains "loader_load_fd"
later in the series (commit f0d1e716f1dc8)?

The shortened name is also ambiguous: the 'bpf' class already has
"prog_load" for loading BPF programs, and this permission specifically
gates kernel_read_file() operations on loader ELF files, not BPF in
general. SELinux permission names become policy ABI once merged.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31655295294