Re: [PATCH v3 4/8] security: dma-buf: Add dma_buf_charge_cgroup LSM hook

[sashiko-bot@kernel.org]

> Similar to how security_dma_buf_charge_task adds an
> access-control point for pidfd for the charge_fd of a
> DMA_HEAP_IOCTL_ALLOC ioctl, we need a new access-control
> point for the case where charge_fd represents a cgroupfd.
> 
> Add security_dma_buf_charge_cgroup(), called in
> mem_cgroup_get_from_fd() when charge_fd refers to a cgroup.
> The hook receives the credentials of the requesting process (cred)
> and the target cgroup to charge (cgrp), giving security modules
> a controlled enforcement point for cross-cgroup dma-buf attribution
> policy.
> 
> When CONFIG_SECURITY is not set the hook compiles to an inline
> returning 0, adding no overhead to the fast path.
> 
> Signed-off-by: Albert Esteve <aesteve@redhat.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-v2_20230123_tjmercier_google_com-v3-0-78d2c4cb8647@redhat.com?part=4