Re: [PATCH] selinux: implement bpf_token_cmd and bpf_token_capable hooks

[Eric Suen <ericsu@linux.microsoft.com>]

On 8/5/2025 7:17 AM, Daniel Durning wrote:
> On Mon, Aug 4, 2025 at 4:13 PM Paul Moore<paul@paul-moore.com> wrote:
>> On Mon, Aug 4, 2025 at 8:18 AM Stephen Smalley
>> <stephen.smalley.work@gmail.com> wrote:
>>> Eric - note that Daniel also posted a patch for the selinux-testsuite
>>> to exercise these hooks and checks based on the Linux kernel self-test
>>> for bpf tokens, see
>>> https://lore.kernel.org/selinux/CAEjxPJ7DBDnZEFvgpe58K4B+4kZdOqUGMHvGC2vKt-4Zget=Hg@mail.gmail.com/T/#t
>> FWIW, I believe Eric has some basic tests too, although I will admit
>> to losing track of that aspect, as we have had several months of
>> setbacks lately due to package building, email, etc.
>>
>>> Paul - it would be good to avoid such duplication of effort in the
>>> future, maybe we should be tracking such things in the GitHub project?
>> Yes, it's unfortunate when we see duplicated work, but thankfully it
>> happens very rarely in our case.  We can track things on GitHub, but
>> with development happening largely on the mailing list I'm skeptical
>> about how successful that will end up being.  Our GH related efforts
>> have been very mixed thus far.  Another option might simply be to tell
>> people to announce a development effort on the mailing list, although
>> I can see that having problems too.
>>
>> If there are some positives, it may be that both Daniel and Eric's
>> work are still in the early stages, so there is likely room for the
>> two of them to cooperate together on a solution.  Daniel, Eric, what
>> do you think about that?
> I would be happy to work with Eric on a solution. Looking forward to
> seeing his patch once it gets posted.

Thanks a lot, Daniel. I was actually hesitant to send out my changes 
since you

already have test changes prepared, and I didn’t want to step on your toes.

Really appreciate your openness to collaborate.

I'll send out my patch soon and make sure to reference your test work in the

description.