[PATCH net-next v7 5/5] selinux: bpf: Add addtional check for bpf object file receive

[James Morris]

On Wed, 18 Oct 2017, Chenbo Feng wrote:

> From: Chenbo Feng <fengc at google.com>
> 
> Introduce a bpf object related check when sending and receiving files
> through unix domain socket as well as binder. It checks if the receiving
> process have privilege to read/write the bpf map or use the bpf program.
> This check is necessary because the bpf maps and programs are using a
> anonymous inode as their shared inode so the normal way of checking the
> files and sockets when passing between processes cannot work properly on
> eBPF object. This check only works when the BPF_SYSCALL is configured.
> 
> Signed-off-by: Chenbo Feng <fengc at google.com>
> Acked-by: Stephen Smalley <sds at tycho.nsa.gov>



Reviewed-by: James Morris <james.l.morris at oracle.com>


-- 
James Morris
<james.l.morris at oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html