[PATCH bpf-next 4/5] selinux: Add BPF_LOADER_LOAD_FD syscall permission
From: Thiébaud Weksteen
Date: Wed Aug 12 2026 - 20:27:35 EST
Add the BPF_LOADER_LOAD_FD permission to gate the bpf syscall command of
the same name.
Signed-off-by: Thiébaud Weksteen <tweek@xxxxxxxxxx>
---
security/selinux/hooks.c | 4 ++++
security/selinux/include/classmap.h | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e7c5993f6954..b4ff5ea5306d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7196,6 +7196,10 @@ static int selinux_bpf(int cmd, union bpf_attr *attr,
ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
NULL);
break;
+ case BPF_LOADER_LOAD_FD:
+ ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__LOADER_LOAD_FD,
+ NULL);
+ break;
default:
ret = 0;
break;
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 453522ca87df..4c6cc71b233c 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -171,7 +171,7 @@ const struct security_class_mapping secclass_map[] = {
{ "infiniband_endport", { "manage_subnet", NULL } },
{ "bpf",
{ "map_create", "map_read", "map_write", "prog_load", "prog_run",
- "map_create_as", "prog_load_as", NULL } },
+ "map_create_as", "prog_load_as", "loader_load_fd", NULL } },
{ "xdp_socket", { COMMON_SOCK_PERMS, NULL } },
{ "mctp_socket", { COMMON_SOCK_PERMS, NULL } },
{ "perf_event",
--
2.55.0.691.gc56d675ccc-goog