From 5dd97a8acaf41266d17eb2aa743f9e6dc6f5ffaf Mon Sep 17 00:00:00 2001 From: Chenbo Feng Date: Wed, 18 Oct 2017 13:00:25 -0700 Subject: UPSTREAM: selinux: bpf: Add selinux check for eBPF syscall operations Implement the actual checks introduced to eBPF related syscalls. This implementation use the security field inside bpf object to store a sid that identify the bpf object. And when processes try to access the object, selinux will check if processes have the right privileges. The creation of eBPF object are also checked at the general bpf check hook and new cmd introduced to eBPF domain can also be checked there. Signed-off-by: Chenbo Feng Acked-by: Alexei Starovoitov Reviewed-by: James Morris Signed-off-by: David S. Miller (cherry-pick from net-next: ec27c3568a34c7fe5fcf4ac0a354eda77687f7eb) Bug: 30950746 Change-Id: Ifb0cdd4b7d470223b143646b339ba511ac77c156 Signed-off-by: Chatur27 Change-Id: I073b5ebe76a280267289357af2b5d8f3afcaffa4 --- security/selinux/include/objsec.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'security/selinux/include/objsec.h') diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index f6027d67a0e6..4c31ec14dd2c 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -124,6 +124,10 @@ struct key_security_struct { u32 sid; /* SID of key */ }; +struct bpf_security_struct { + u32 sid; /*SID of bpf obj creater*/ +}; + extern unsigned int selinux_checkreqprot; #endif /* _SELINUX_OBJSEC_H_ */ -- cgit v1.2.3