JIRA: https://issues.redhat.com/browse/RHEL-23649
Conflicts: Context change due to missing commits e261301c851a ("lsm:
move the remaining LSM hook comments to security/security.c") and
e1ca7129db2c ("LSM: Helpers for attribute names and filling lsm_ctx")
commit f568a3d49af9aed813a184353592efe29b0e3d16
Author: Andrii Nakryiko <andrii@kernel.org>
Date: Tue Jan 23 18:21:08 2024 -0800
bpf,lsm: Add BPF token LSM hooks
Wire up bpf_token_create and bpf_token_free LSM hooks, which allow to
allocate LSM security blob (we add `void *security` field to struct
bpf_token for that), but also control who can instantiate BPF token.
This follows existing pattern for BPF map and BPF prog.
Also add security_bpf_token_allow_cmd() and security_bpf_token_capable()
LSM hooks that allow LSM implementation to control and negate (if
necessary) BPF token's delegation of a specific bpf_cmd and capability,
respectively.
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/bpf/20240124022127.2379740-12-andrii@kernel.org
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
