# Re: \[PATCH v3 4/8\] security: dma-buf: Add dma\_buf\_charge\_cgroup LSM hook

- From: sashiko-bot@kernel.org
- Date: 2026-10-28 15:04:36 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2026/10/17817733
- Thread: https://ratatoskr.run/linux-security-module/2026/10/17811493/t.md

```text
> Similar to how security_dma_buf_charge_task adds an
> access-control point for pidfd for the charge_fd of a
> DMA_HEAP_IOCTL_ALLOC ioctl, we need a new access-control
> point for the case where charge_fd represents a cgroupfd.
> 
> Add security_dma_buf_charge_cgroup(), called in
> mem_cgroup_get_from_fd() when charge_fd refers to a cgroup.
> The hook receives the credentials of the requesting process (cred)
> and the target cgroup to charge (cgrp), giving security modules
> a controlled enforcement point for cross-cgroup dma-buf attribution
> policy.
> 
> When CONFIG_SECURITY is not set the hook compiles to an inline
> returning 0, adding no overhead to the fast path.
> 
> Signed-off-by: Albert Esteve <redacted>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-v2_20230123_tjmercier_google_com-v3-0-78d2c4cb8647@redhat.com?part=4

```