From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: selinux: Restrict cross-cgroup dma-heap charging Date: Sat, 16 May 2026 13:56:22 +1000 Message-ID: In-Reply-To: <20260512-v2_20230123_tjmercier_google_com-v1-4-6326701c3691@redhat.com> References: <20260512-v2_20230123_tjmercier_google_com-v1-0-6326701c3691@redhat.com> <20260512-v2_20230123_tjmercier_google_com-v1-4-6326701c3691@redhat.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Patch Review Implements the SELinux side with a new `dma_heap` class and `charge_to` permission. ```c +static int selinux_dma_heap_alloc(const struct cred *from, const struct cred *to) +{ + return avc_has_perm(cred_sid(from), cred_sid(to), + SECCLASS_DMA_HEAP, DMA_HEAP__CHARGE_TO, NULL); +} ``` This looks correct and follows established SELinux patterns. The `NULL` ad (audit data) parameter means no additional audit context is logged beyond the SIDs and permission. For debugging, it might be helpful to provide ad context (e.g., the heap name or allocation size), but this is optional. **Minor:** The new class is added at the end of `secclass_map` before the `{ NULL, {} }` sentinel, which is the correct location. --- Generated by Claude Code Patch Reviewer