bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 14:53:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

lsm,selinux: Add LSM blob support for BPF objects

Browse Source 
This patch introduces LSM blob support for BPF maps, programs, and
tokens to enable LSM stacking and multiplexing of LSM modules that
govern BPF objects. Additionally, the existing BPF hooks used by
SELinux have been updated to utilize the new blob infrastructure,
removing the assumption of exclusive ownership of the security
pointer.

Signed-off-by: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
[PM: dropped local variable init, style fixes]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Blaise Boscaccy
2025-07-22 14:21:34 -07:00
committed by Paul Moore
parent e5bc887413
commit 5816bf4273
4 changed files with 116 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
security/selinux/include/objsec.h
View File

@@ -26,6 +26,7 @@
#include <linux/lsm_hooks.h>
#include <linux/msg.h>
#include <net/net_namespace.h>
#include <linux/bpf.h>
#include "flask.h"
#include "avc.h"
@@ -245,4 +246,23 @@ selinux_perf_event(void *perf_event)
return perf_event + selinux_blob_sizes.lbs_perf_event;
}
#ifdef CONFIG_BPF_SYSCALL
static inline struct bpf_security_struct *
selinux_bpf_map_security(struct bpf_map *map)
{
return map->security + selinux_blob_sizes.lbs_bpf_map;
}
static inline struct bpf_security_struct *
selinux_bpf_prog_security(struct bpf_prog *prog)
{
return prog->aux->security + selinux_blob_sizes.lbs_bpf_prog;
}
static inline struct bpf_security_struct *
selinux_bpf_token_security(struct bpf_token *token)
{
return token->security + selinux_blob_sizes.lbs_bpf_token;
}
#endif /* CONFIG_BPF_SYSCALL */
#endif /* _SELINUX_OBJSEC_H_ */