[PATCH rdma-next v3 10/14] RDMA/core: Document the SELinux ibendport net namespace limitation
From: Jiri Pirko <jiri@resnulli.us>
Date: 2026-07-16 13:24:01
Also in:
cgroups, linux-kselftest, linux-rdma, linux-s390
Subsystem:
infiniband subsystem, the rest · Maintainers:
Jason Gunthorpe, Leon Romanovsky, Linus Torvalds
From: Jiri Pirko <redacted> Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label. Signed-off-by: Jiri Pirko <redacted> --- drivers/infiniband/core/security.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 9af31d1d9d70..a82c46965416 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c@@ -700,6 +700,12 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent, if (qp_type != IB_QPT_SMI) return 0; + /* + * SELinux labels an endport by (device name, port) from a global + * policy. If devices in different net namespaces share a name, they get + * the same label; distinguishing them would need net namespace support + * in the policy language and tooling. + */ spin_lock(&mad_agent_list_lock); ret = security_ib_endport_manage_subnet(agent->security, dev_name(&agent->device->dev),
--
2.54.0