[PATCH RFC v2 5/8] selinux: Restrict cross-cgroup dma-buf charging

[sashiko-bot at kernel.org]

> The security_dma_buf_charge_task() hook allows security modules
> to control which processes may charge dma-buf allocations
> to another process's cgroup via the charge_fd field of
> DMA_HEAP_IOCTL_ALLOC. Without a policy implementation, the
> hook is a no-op and the restriction is not enforced.
> 
> On SELinux-managed systems any domain with access to a
> dma-heap device node can therefore exhaust another cgroup's
> memory budget without restriction.
> 
> Implement selinux_dma_buf_charge_task() using avc_has_perm() with
> a new dma_buf object class and a charge_task permission. Policy
> authors can then grant cross-cgroup charging selectively,
> for example:
> 
>   allow allocator_app_t client_app_t:dma_buf charge_task;
> 
> Signed-off-by: Albert Esteve <aesteve at redhat.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261021-v2_20230123_tjmercier_google_com-v2-0-ef6ee2dd8c5c@redhat.com?part=5