From c6ad9fdbd44b78f51fa50138247694774ab99e97 Mon Sep 17 00:00:00 2001 From: Hamza Mahfooz Date: Mon, 27 Jan 2025 10:57:18 -0500 Subject: io_uring,lsm,selinux: add LSM hooks for io_uring_setup() It is desirable to allow LSM to configure accessibility to io_uring because it is a coarse yet very simple way to restrict access to it. So, add an LSM for io_uring_allowed() to guard access to io_uring. Cc: Paul Moore Signed-off-by: Hamza Mahfooz Acked-by: Jens Axboe [PM: merge fuzz due to changes in preceding patches, subj tweak] Signed-off-by: Paul Moore --- security/selinux/include/classmap.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'security/selinux/include/classmap.h') diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 03e82477dce9..8a8f3908aac8 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -177,7 +177,7 @@ const struct security_class_mapping secclass_map[] = { { "perf_event", { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } }, { "anon_inode", { COMMON_FILE_PERMS, NULL } }, - { "io_uring", { "override_creds", "sqpoll", "cmd", NULL } }, + { "io_uring", { "override_creds", "sqpoll", "cmd", "allowed", NULL } }, { "user_namespace", { "create", NULL } }, /* last one */ { NULL, {} } }; -- cgit v1.2.3