Commit 4ca54d3d authored Feb 07, 2020 by Connor O'Brien Committed by Paul Moore Feb 11, 2020

security: selinux: allow per-file labeling for bpffs



Add support for genfscon per-file labeling of bpffs files. This allows
for separate permissions for different pinned bpf objects, which may
be completely unrelated to each other.

Signed-off-by: Connor O'Brien <connoro@google.com>
Signed-off-by: Steven Moreland <smoreland@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent 89d4d7c8

security/selinux/hooks.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -702,6 +702,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
		if (!strcmp(sb->s_type->name, "debugfs") \|\|
		!strcmp(sb->s_type->name, "tracefs") \|\|
		!strcmp(sb->s_type->name, "binderfs") \|\|
		!strcmp(sb->s_type->name, "bpf") \|\|
		!strcmp(sb->s_type->name, "pstore"))
		sbsec->flags \|= SE_SBGENFS;

Admin message