github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

RDMA/core: Document the SELinux ibendport net namespace limitation

Browse Source 
Document that SELinux ibendport labels use a global (device name, port)
key, so same-named RDMA devices in different net namespaces share a label.

Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260716132316.1495242-11-jiri@resnulli.us
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Jiri Pirko 2026-07-16 15:23:11 +02:00 committed by Leon Romanovsky
parent bca2c9d781
commit 4ad1fe8e25
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/infiniband/core/security.c
View File

@ -700,6 +700,12 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
if (qp_type != IB_QPT_SMI)
return 0;
/*
* SELinux labels an endport by (device name, port) from a global
* policy. If devices in different net namespaces share a name, they get
* the same label; distinguishing them would need net namespace support
* in the policy language and tooling.
*/
spin_lock(&mad_agent_list_lock);
ret = security_ib_endport_manage_subnet(agent->security,
dev_name(&agent->device->dev),