[PATCH net-next v7 5/5] selinux: bpf: Add addtional check for bpf object file receive
From: James Morris <hidden>
Date: 2017-10-20 01:28:50
Also in:
netdev, selinux
On Wed, 18 Oct 2017, Chenbo Feng wrote:
From: Chenbo Feng <redacted> Introduce a bpf object related check when sending and receiving files through unix domain socket as well as binder. It checks if the receiving process have privilege to read/write the bpf map or use the bpf program. This check is necessary because the bpf maps and programs are using a anonymous inode as their shared inode so the normal way of checking the files and sockets when passing between processes cannot work properly on eBPF object. This check only works when the BPF_SYSCALL is configured. Signed-off-by: Chenbo Feng <redacted> Acked-by: Stephen Smalley <redacted>
Reviewed-by: James Morris <redacted> -- James Morris [off-list ref] -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html