Re: [PATCH v7] SELinux: Add support for BPF token access control

Eric Suen
2026-01-21T20:40:57Z

On 1/14/2026 12:59 PM, Paul Moore wrote:
> On Wed, Jan 14, 2026 at 12:56 PM Christian Göttsche
> <cgzones@googlemail.com> wrote:
>> On Tue, 13 Jan 2026 at 21:45, Paul Moore <paul@paul-moore.com> wrote:
>>> On Dec 4, 2025 Eric Suen <ericsu@linux.microsoft.com> wrote:
>>>> BPF token support was introduced to allow a privileged process to delegate
>>>> limited BPF functionality—such as map creation and program loading—to
>>>> an unprivileged process:
> ...
>
>>> Merged into selinux/dev with some minor line length and whitespace
>>> tweaks. Thanks everyone!
>> I think there is a typo in selinux_bpf_token_capable():
>>
>> switch (CAP_TO_INDEX(cap)) {
>> case 0:
>> sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
>> break;
>> case 1:
>> sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP2_USERNS;
>> // <-- SECCLASS_CAPABILITY2 ??
> Oooh, good catch, thanks! I'll work up a fix right now.
>
>> break;
>> default:
>> pr_err("SELinux: out of range capability %d\n", cap);
>> return -EINVAL;
>> }

Thanks a lot, Paul, for the help. Should have checked my email more often :(