[PATCH bpf-next 1/5] fs/kernel_read_file,selinux: Add BPF_LOADER constant

[Thiébaud Weksteen]

Add a new constant for kernel_read_file when loading a BPF loader. Add
the matching SELinux policy for that constant.

Signed-off-by: Thiébaud Weksteen <tweek@xxxxxxxxxx>
---
 include/linux/kernel_read_file.h    |  1 +
 security/selinux/hooks.c            | 12 ++++++++++--
 security/selinux/include/classmap.h |  2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
index d613a7b4dd35..fbcaf41c1b73 100644
--- a/include/linux/kernel_read_file.h
+++ b/include/linux/kernel_read_file.h
@@ -15,6 +15,7 @@
 	id(POLICY, security-policy)		\
 	id(X509_CERTIFICATE, x509-certificate)	\
 	id(MODULE_COMPRESSED, kernel-module-compressed) \
+	id(BPF_LOADER, bpf-loader) \
 	id(MAX_ID, )
 
 #define __fid_enumify(ENUM, dummy) READING_ ## ENUM,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 18dd28b2bb13..f197cf476190 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4411,7 +4411,7 @@ static int selinux_kernel_read_file(struct file *file,
 {
 	int rc = 0;
 
-	BUILD_BUG_ON_MSG(READING_MAX_ID > 8,
+	BUILD_BUG_ON_MSG(READING_MAX_ID > 9,
 			 "New kernel_read_file_id introduced; update SELinux!");
 
 	switch (id) {
@@ -4437,6 +4437,10 @@ static int selinux_kernel_read_file(struct file *file,
 		rc = selinux_kernel_load_from_file(file,
 						SYSTEM__X509_CERTIFICATE_LOAD);
 		break;
+	case READING_BPF_LOADER:
+		rc = selinux_kernel_load_from_file(file,
+						SYSTEM__BPF_LOAD);
+		break;
 	default:
 		break;
 	}
@@ -4448,7 +4452,7 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
 {
 	int rc = 0;
 
-	BUILD_BUG_ON_MSG(LOADING_MAX_ID > 8,
+	BUILD_BUG_ON_MSG(LOADING_MAX_ID > 9,
 			 "New kernel_load_data_id introduced; update SELinux!");
 
 	switch (id) {
@@ -4474,6 +4478,10 @@ static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
 		rc = selinux_kernel_load_from_file(NULL,
 						SYSTEM__X509_CERTIFICATE_LOAD);
 		break;
+	case LOADING_BPF_LOADER:
+		rc = selinux_kernel_load_from_file(NULL,
+						SYSTEM__BPF_LOAD);
+		break;
 	default:
 		break;
 	}
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 90cb61b16425..453522ca87df 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -65,7 +65,7 @@ const struct security_class_mapping secclass_map[] = {
 	  { "ipc_info", "syslog_read", "syslog_mod", "syslog_console",
 	    "module_request", "module_load", "firmware_load",
 	    "kexec_image_load", "kexec_initramfs_load", "policy_load",
-	    "x509_certificate_load", NULL } },
+	    "x509_certificate_load", "bpf_load", NULL } },
 	{ "capability", { COMMON_CAP_PERMS, NULL } },
 	{ "filesystem",
 	  { "mount", "remount", "unmount", "getattr", "relabelfrom",
-- 
2.55.0.691.gc56d675ccc-goog