Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Dominick Grift <dac.override@gmail.com>
To:     selinux-refpolicy@vger.kernel.org
Cc:     Dominick Grift <dac.override@gmail.com>
Subject: [PATCH] domain: unconfined access to bpf
Date:   Tue,  3 Sep 2019 18:53:15 +0200
Message-Id: <20190903165315.1043856-1-dac.override@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Signed-off-by: Dominick Grift <dac.override@gmail.com>
---
 policy/modules/kernel/domain.te | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index 1a55e3d2..a4c78af9 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -152,6 +152,9 @@ optional_policy(`
 # is handled in the interface as typeattribute cannot
 # be used on an attribute.
 
+# unconfined access to bpf
+allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };
+
 # Use/sendto/connectto sockets created by any domain.
 allow unconfined_domain_type domain:{ socket_class_set socket key_socket } { create_stream_socket_perms send_msg lock relabelto name_bind recv_msg map sendto recvfrom relabelfrom };
 allow unconfined_domain_type domain:rawip_socket node_bind;
-- 
2.23.0