* [PATCH userspace v2] libsepol: add bpf_token_perms polcap
@ 2025-10-08 23:33 Eric Suen
2025-10-09 15:39 ` Stephen Smalley
2026-01-30 2:31 ` Jason Zaman
0 siblings, 2 replies; 4+ messages in thread
From: Eric Suen @ 2025-10-08 23:33 UTC (permalink / raw)
To: selinux
New policy capability 'bpf_token_perms' required by patch to support SELinux
for BPF token control:
https://lore.kernel.org/selinux/20250806180149.1995-1-ericsu@linux.microsoft.com/
Signed-off-by: Eric Suen <ericsu@linux.microsoft.com>
---
Changes in v2:
- Rebase to the latest changes
libsepol/include/sepol/policydb/polcaps.h | 1 +
libsepol/src/polcaps.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
index 5a3fbdb4..ef529e76 100644
--- a/libsepol/include/sepol/policydb/polcaps.h
+++ b/libsepol/include/sepol/policydb/polcaps.h
@@ -21,6 +21,7 @@ enum {
POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
POLICYDB_CAP_FUNCTIONFS_SECLABEL,
POLICYDB_CAP_MEMFD_CLASS,
+ POLICYDB_CAP_BPF_TOKEN_PERMS,
__POLICYDB_CAP_MAX
};
#define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
index 526f35ed..31b52d70 100644
--- a/libsepol/src/polcaps.c
+++ b/libsepol/src/polcaps.c
@@ -20,6 +20,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
[POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
[POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
[POLICYDB_CAP_MEMFD_CLASS] = "memfd_class",
+ [POLICYDB_CAP_BPF_TOKEN_PERMS] = "bpf_token_perms",
};
int sepol_polcap_getnum(const char *name)
--
2.50.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH userspace v2] libsepol: add bpf_token_perms polcap
2025-10-08 23:33 [PATCH userspace v2] libsepol: add bpf_token_perms polcap Eric Suen
@ 2025-10-09 15:39 ` Stephen Smalley
2026-01-30 2:31 ` Jason Zaman
1 sibling, 0 replies; 4+ messages in thread
From: Stephen Smalley @ 2025-10-09 15:39 UTC (permalink / raw)
To: Eric Suen; +Cc: selinux
On Wed, Oct 8, 2025 at 7:33 PM Eric Suen <ericsu@linux.microsoft.com> wrote:
>
> New policy capability 'bpf_token_perms' required by patch to support SELinux
> for BPF token control:
> https://lore.kernel.org/selinux/20250806180149.1995-1-ericsu@linux.microsoft.com/
>
> Signed-off-by: Eric Suen <ericsu@linux.microsoft.com>
Will wait to merge until after the kernel patch is merged.
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> Changes in v2:
> - Rebase to the latest changes
>
> libsepol/include/sepol/policydb/polcaps.h | 1 +
> libsepol/src/polcaps.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index 5a3fbdb4..ef529e76 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -21,6 +21,7 @@ enum {
> POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
> POLICYDB_CAP_FUNCTIONFS_SECLABEL,
> POLICYDB_CAP_MEMFD_CLASS,
> + POLICYDB_CAP_BPF_TOKEN_PERMS,
> __POLICYDB_CAP_MAX
> };
> #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index 526f35ed..31b52d70 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -20,6 +20,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
> [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
> [POLICYDB_CAP_MEMFD_CLASS] = "memfd_class",
> + [POLICYDB_CAP_BPF_TOKEN_PERMS] = "bpf_token_perms",
> };
>
> int sepol_polcap_getnum(const char *name)
> --
> 2.50.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH userspace v2] libsepol: add bpf_token_perms polcap
2025-10-08 23:33 [PATCH userspace v2] libsepol: add bpf_token_perms polcap Eric Suen
2025-10-09 15:39 ` Stephen Smalley
@ 2026-01-30 2:31 ` Jason Zaman
2026-02-05 3:24 ` Eric Suen
1 sibling, 1 reply; 4+ messages in thread
From: Jason Zaman @ 2026-01-30 2:31 UTC (permalink / raw)
To: Eric Suen; +Cc: selinux
On Wed, Oct 08, 2025 at 04:33:04PM -0700, Eric Suen wrote:
> New policy capability 'bpf_token_perms' required by patch to support SELinux
> for BPF token control:
> https://lore.kernel.org/selinux/20250806180149.1995-1-ericsu@linux.microsoft.com/
>
> Signed-off-by: Eric Suen <ericsu@linux.microsoft.com>
Thanks, merged.
As discussed in the recent maintainer call, this will be in the 3.10
release soon.
wkr,
Jason
> ---
> Changes in v2:
> - Rebase to the latest changes
>
> libsepol/include/sepol/policydb/polcaps.h | 1 +
> libsepol/src/polcaps.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index 5a3fbdb4..ef529e76 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -21,6 +21,7 @@ enum {
> POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
> POLICYDB_CAP_FUNCTIONFS_SECLABEL,
> POLICYDB_CAP_MEMFD_CLASS,
> + POLICYDB_CAP_BPF_TOKEN_PERMS,
> __POLICYDB_CAP_MAX
> };
> #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index 526f35ed..31b52d70 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -20,6 +20,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
> [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
> [POLICYDB_CAP_MEMFD_CLASS] = "memfd_class",
> + [POLICYDB_CAP_BPF_TOKEN_PERMS] = "bpf_token_perms",
> };
>
> int sepol_polcap_getnum(const char *name)
> --
> 2.50.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH userspace v2] libsepol: add bpf_token_perms polcap
2026-01-30 2:31 ` Jason Zaman
@ 2026-02-05 3:24 ` Eric Suen
0 siblings, 0 replies; 4+ messages in thread
From: Eric Suen @ 2026-02-05 3:24 UTC (permalink / raw)
To: Jason Zaman; +Cc: selinux
On 1/29/2026 6:31 PM, Jason Zaman wrote:
> On Wed, Oct 08, 2025 at 04:33:04PM -0700, Eric Suen wrote:
>> New policy capability 'bpf_token_perms' required by patch to support SELinux
>> for BPF token control:
>> https://lore.kernel.org/selinux/20250806180149.1995-1-ericsu@linux.microsoft.com/
>>
>> Signed-off-by: Eric Suen <ericsu@linux.microsoft.com>
> Thanks, merged.
> As discussed in the recent maintainer call, this will be in the 3.10
> release soon.
>
> wkr,
> Jason
Thanks a lot, Jason.
>> ---
>> Changes in v2:
>> - Rebase to the latest changes
>>
>> libsepol/include/sepol/policydb/polcaps.h | 1 +
>> libsepol/src/polcaps.c | 1 +
>> 2 files changed, 2 insertions(+)
>>
>> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
>> index 5a3fbdb4..ef529e76 100644
>> --- a/libsepol/include/sepol/policydb/polcaps.h
>> +++ b/libsepol/include/sepol/policydb/polcaps.h
>> @@ -21,6 +21,7 @@ enum {
>> POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
>> POLICYDB_CAP_FUNCTIONFS_SECLABEL,
>> POLICYDB_CAP_MEMFD_CLASS,
>> + POLICYDB_CAP_BPF_TOKEN_PERMS,
>> __POLICYDB_CAP_MAX
>> };
>> #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
>> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
>> index 526f35ed..31b52d70 100644
>> --- a/libsepol/src/polcaps.c
>> +++ b/libsepol/src/polcaps.c
>> @@ -20,6 +20,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
>> [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
>> [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
>> [POLICYDB_CAP_MEMFD_CLASS] = "memfd_class",
>> + [POLICYDB_CAP_BPF_TOKEN_PERMS] = "bpf_token_perms",
>> };
>>
>> int sepol_polcap_getnum(const char *name)
>> --
>> 2.50.1
>>
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-02-05 3:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-08 23:33 [PATCH userspace v2] libsepol: add bpf_token_perms polcap Eric Suen
2025-10-09 15:39 ` Stephen Smalley
2026-01-30 2:31 ` Jason Zaman
2026-02-05 3:24 ` Eric Suen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.