From: Jiri Pirko <[email protected]> Document that SELinux ibendport labels use a global (device name, port) key, so same-named RDMA devices in different net namespaces share a label.
Signed-off-by: Jiri Pirko <[email protected]> --- drivers/infiniband/core/security.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c index 9af31d1d9d70..a82c46965416 100644 --- a/drivers/infiniband/core/security.c +++ b/drivers/infiniband/core/security.c @@ -700,6 +700,12 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent, if (qp_type != IB_QPT_SMI) return 0; + /* + * SELinux labels an endport by (device name, port) from a global + * policy. If devices in different net namespaces share a name, they get + * the same label; distinguishing them would need net namespace support + * in the policy language and tooling. + */ spin_lock(&mad_agent_list_lock); ret = security_ib_endport_manage_subnet(agent->security, dev_name(&agent->device->dev), -- 2.54.0
