Re: [PATCH v7] SELinux: Add support for BPF token access control

Paul Moore
2026-01-14T21:00:08Z

On Wed, Jan 14, 2026 at 12:56 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
> On Tue, 13 Jan 2026 at 21:45, Paul Moore <paul@paul-moore.com> wrote:
> > On Dec 4, 2025 Eric Suen <ericsu@linux.microsoft.com> wrote:
> > >
> > > BPF token support was introduced to allow a privileged process to delegate
> > > limited BPF functionality—such as map creation and program loading—to
> > > an unprivileged process:

...

> > Merged into selinux/dev with some minor line length and whitespace
> > tweaks. Thanks everyone!
>
> I think there is a typo in selinux_bpf_token_capable():
>
> switch (CAP_TO_INDEX(cap)) {
> case 0:
> sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
> break;
> case 1:
> sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP2_USERNS;
> // <-- SECCLASS_CAPABILITY2 ??

Oooh, good catch, thanks! I'll work up a fix right now.

> break;
> default:
> pr_err("SELinux: out of range capability %d\n", cap);
> return -EINVAL;
> }

--
paul-moore.com