From: "Thiébaud Weksteen" <tweek@google.com>
To: Paul Moore <paul@paul-moore.com>,
Stephen Smalley <stephen.smalley.work@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Jeffrey Vander Stoep <jeffv@google.com>
Cc: "Thiébaud Weksteen" <tweek@google.com>,
"Ondrej Mosnacek" <omosnace@redhat.com>,
"Eric Suen" <ericsu@linux.microsoft.com>,
"Blaise Boscaccy" <bboscaccy@linux.microsoft.com>,
"Sid Nayyar" <sidnayyar@google.com>,
"Neill Kapron" <nkapron@google.com>,
"Eric Biggers" <ebiggers@google.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"KP Singh" <kpsingh@kernel.org>,
bpf@vger.kernel.org, selinux@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant
Date: Thu, 13 Aug 2026 10:26:14 +1000 [thread overview]
Message-ID: <20260813002618.3755631-2-tweek@google.com> (raw)
In-Reply-To: <20260813002618.3755631-1-tweek@google.com>
Add a new constant for kernel_read_file when loading a BPF loader. Add
the matching SELinux policy for that constant.
Signed-off-by: Thiébaud Weksteen <tweek@google.com>
---
include/linux/kernel_read_file.h | 1 +
security/selinux/hooks.c | 12 ++++++++++--
security/selinux/include/classmap.h | 2 +-
3 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
index d613a7b4dd35..fbcaf41c1b73 100644
--- a/include/linux/kernel_read_file.h
+++ b/include/linux/kernel_read_file.h
@@ -15,6 +15,7 @@
id(POLICY, security-policy) \
id(X509_CERTIFICATE, x509-certificate) \
id(MODULE_COMPRESSED, kernel-module-compressed) \
+ id(BPF_LOADER, bpf-loader) \
id(MAX_ID, )
#define __fid_enumify(ENUM, dummy) READING_ ## ENUM,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 18dd28b2bb13..f197cf476190 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4411,7 +4411,7 @@ static int selinux_kernel_read_file(struct file *file,
{
int rc = 0;
- BUILD_BUG_ON_MSG(READING_MAX_ID > 8,
+ BUILD_BUG_ON_MSG(READING_MAX_ID > 9,
"New kernel_read_file_id introduced; update SELinux!");
switch (id) {
@@ -4437,6 +4437,10 @@ static int selinux_kernel_read_file(struct file *file,
rc = selinux_kernel_load_from_file(file,
SYSTEM__X509_CERTIFICATE_LOAD);
break;
+ case READING_BPF_LOADER:
+ rc = selinux_kernel_load_from_file(file,
+ SYSTEM__BPF_LOAD);
+ break;
default:
break;
}
@@ -4448,7 +4452,7 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
{
int rc = 0;
- BUILD_BUG_ON_MSG(LOADING_MAX_ID > 8,
+ BUILD_BUG_ON_MSG(LOADING_MAX_ID > 9,
"New kernel_load_data_id introduced; update SELinux!");
switch (id) {
@@ -4474,6 +4478,10 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
rc = selinux_kernel_load_from_file(NULL,
SYSTEM__X509_CERTIFICATE_LOAD);
break;
+ case LOADING_BPF_LOADER:
+ rc = selinux_kernel_load_from_file(NULL,
+ SYSTEM__BPF_LOAD);
+ break;
default:
break;
}
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 90cb61b16425..453522ca87df 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -65,7 +65,7 @@ const struct security_class_mapping secclass_map[] = {
{ "ipc_info", "syslog_read", "syslog_mod", "syslog_console",
"module_request", "module_load", "firmware_load",
"kexec_image_load", "kexec_initramfs_load", "policy_load",
- "x509_certificate_load", NULL } },
+ "x509_certificate_load", "bpf_load", NULL } },
{ "capability", { COMMON_CAP_PERMS, NULL } },
{ "filesystem",
{ "mount", "remount", "unmount", "getattr", "relabelfrom",
--
2.55.0.691.gc56d675ccc-goog
next prev parent reply other threads:[~2026-08-13 0:26 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 0:26 [PATCH bpf-next 0/5] bpf: Introduce LOADER_LOAD_FD Thiébaud Weksteen
2026-08-13 0:26 ` Thiébaud Weksteen [this message]
2026-08-13 1:25 ` [PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant bot+bpf-ci
2026-08-13 0:26 ` [PATCH bpf-next 2/5] bpf: Introduce BPF_LOADER_LOAD_FD command Thiébaud Weksteen
2026-08-13 1:40 ` bot+bpf-ci
2026-08-13 0:26 ` [PATCH bpf-next 3/5] selinux: use kernel sid in security_bpf_* Thiébaud Weksteen
2026-08-13 1:25 ` bot+bpf-ci
2026-08-13 0:26 ` [PATCH bpf-next 4/5] selinux: Add BPF_LOADER_LOAD_FD syscall permission Thiébaud Weksteen
2026-08-13 0:26 ` [PATCH bpf-next 5/5] selftests/bpf: add loader_load_fd tests Thiébaud Weksteen
2026-08-13 1:25 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260813002618.3755631-2-tweek@google.com \
--to=tweek@google.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bboscaccy@linux.microsoft.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=ebiggers@google.com \
--cc=ericsu@linux.microsoft.com \
--cc=gregkh@linuxfoundation.org \
--cc=jeffv@google.com \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nkapron@google.com \
--cc=omosnace@redhat.com \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=sidnayyar@google.com \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox