On Tue, Mar 24, 2020 at 02:21:30PM -0400, Stephen Smalley wrote:

On Tue, Mar 24, 2020 at 2:06 PM KP Singh [off-list ref] wrote:

quoted

On 24-Mär 11:01, Kees Cook wrote:

quoted

Doesn't the existing int (*bpf_prog)(struct bpf_prog *prog); cover
SELinux's need here? I.e. it can already examine that a hook is being
created for the LSM (since it has a distinct type, etc)?

I was about to say the same, specifically for the BPF use-case, we do
have the "bpf_prog" i.e. :

"Do a check when the kernel generate and return a file descriptor for
eBPF programs."

SELinux can implement its policy logic for BPF_PROG_TYPE_LSM by
providing a callback for this hook.

Ok.  In that case do we really need the capable() check here at all?

IMO, this is for systems without SELinux, where they're using the
capabilities as the basic policy for MAC management.

-- 
Kees Cook