[PATCH bpf-next 3/5] selinux: use kernel sid in security_bpf_*

[Thiébaud Weksteen]

The security_bpf hooks provides a boolean to indicate if the call is
coming from within the kernel or not. If true, use the kernel SID
instead of relying on the current process SID.

For the token-aware functions, the kernel sid is used to decide on the
access, but the caller remains owner of the object (program or map).

Signed-off-by: Thiébaud Weksteen <tweek@xxxxxxxxxx>
---
 security/selinux/hooks.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f197cf476190..e7c5993f6954 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7181,7 +7181,7 @@ static int selinux_ib_alloc_security(void *ib_sec)
 static int selinux_bpf(int cmd, union bpf_attr *attr,
 		       unsigned int size, bool kernel)
 {
-	u32 sid = current_sid();
+	u32 sid = kernel ? SECINITSID_KERNEL : current_sid();
 	int ret;
 
 	if (selinux_policycap_bpf_token_perms())
@@ -7296,7 +7296,7 @@ static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
 	bpfsec->sid = current_sid();
 
 	if (!token)
-		ssid = bpfsec->sid;
+		ssid = kernel ? SECINITSID_KERNEL : bpfsec->sid;
 	else
 		ssid = selinux_bpffs_creator_sid(attr->map_token_fd);
 
@@ -7314,7 +7314,7 @@ static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
 	bpfsec->sid = current_sid();
 
 	if (!token)
-		ssid = bpfsec->sid;
+		ssid = kernel ? SECINITSID_KERNEL : bpfsec->sid;
 	else
 		ssid = selinux_bpffs_creator_sid(attr->prog_token_fd);
 
-- 
2.55.0.691.gc56d675ccc-goog