[PATCH bpf-next 4/5] selinux: Add BPF_LOADER_LOAD_FD syscall permission

["Thiébaud Weksteen" <tweek@google.com>]

Add the BPF_LOADER_LOAD_FD permission to gate the bpf syscall command of
the same name.

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
---
 security/selinux/hooks.c            | 4 ++++
 security/selinux/include/classmap.h | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e7c5993f6954..b4ff5ea5306d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7196,6 +7196,10 @@ static int selinux_bpf(int cmd, union bpf_attr *attr,
 		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
 				   NULL);
 		break;
+	case BPF_LOADER_LOAD_FD:
+		ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__LOADER_LOAD_FD,
+				   NULL);
+		break;
 	default:
 		ret = 0;
 		break;
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 453522ca87df..4c6cc71b233c 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -171,7 +171,7 @@ const struct security_class_mapping secclass_map[] = {
 	{ "infiniband_endport", { "manage_subnet", NULL } },
 	{ "bpf",
 	  { "map_create", "map_read", "map_write", "prog_load", "prog_run",
-	    "map_create_as", "prog_load_as", NULL } },
+	    "map_create_as", "prog_load_as", "loader_load_fd", NULL } },
 	{ "xdp_socket", { COMMON_SOCK_PERMS, NULL } },
 	{ "mctp_socket", { COMMON_SOCK_PERMS, NULL } },
 	{ "perf_event",
-- 
2.55.0.691.gc56d675ccc-goog