From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f170.google.com (mail-qk1-f170.google.com [209.85.222.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D1D23EC829 for ; Mon, 17 Aug 2026 23:16:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787008598; cv=none; b=Ujz9oyLYGTb59bbOSI8+3Yyd8d6dyysisXGUUQHTcZtPKZz98QJhlVC8zr7mJkoxK369XxnUKEsGfAHKZu3S6OMD6aS0hmVdDwMz+v0Ob6qNlvGw5Fvuy3cPdgKGtUpKVKHWwmloEPwH5+nDHmntZRDdt/4VV8KB/hPDRadlOts= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787008598; c=relaxed/simple; bh=o/2gKu8MtdvjoyhaeLVJAaxv+a83YB2/7qPJ3QHcTTc=; h=Date:Message-ID:From:To:Cc:Subject; b=gYGinuJzSJM/s//MPTTuU6avAsxQxfvdFhuGGIpFrKJpj+oJ0QYlauI/3W1suxge7wCYe6pIH545VYW84P8M4c57qbDSTUB+s1niVrZU2p4qT6DvZN2Chq07OBOJQs7TX/JrxqvkRDjeN9f1cMb5DSXiH5DEAT2v/jQH0hE11cQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com; spf=pass smtp.mailfrom=paul-moore.com; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b=TCX7UM4o; arc=none smtp.client-ip=209.85.222.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b="TCX7UM4o" Received: by mail-qk1-f170.google.com with SMTP id af79cd13be357-936cda0e3fbso332988285a.3 for ; Mon, 17 Aug 2026 16:16:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore.com; s=google; t=1787008596; x=1787613396; darn=vger.kernel.org; h=subject:cc:to:from:message-id:date:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vPaFvQ8Y9PTk8dyhUZHFKOh7qLt62XRYEihfD8ZYjc8=; b=TCX7UM4o+FKhS1kJ3j74DzVv1X5J8KCSp9XcDWVIE58H6Lt10vZ7FbRzROR5R7mt/Q g+ArtuAgJ6pklckHKNxlVrpUXo8hYwtve8CzKIIoyUkA6tKfA+PO+2hEuTSe0+sTNSTA WDRYqxp58m9bP1Pfz2LktwvLScqWYzz3E1ol7wCJO+7ZShsPGXgst5d6cQk5oDfPFall IK6HyJZTwxMlglF+rSe1oLuKiVWGs9azjqU78K5uW9HKasDgbjwa9GnEl5ZUEw6nxy28 57zAA9j972TnhATnfgSJ7S+Ez8iHgUyssiXEbwg/XeP/VjMgBO7Lb6jiRcZtoPsfmRD/ 7qpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787008596; x=1787613396; h=subject:cc:to:from:message-id:date:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=vPaFvQ8Y9PTk8dyhUZHFKOh7qLt62XRYEihfD8ZYjc8=; b=Uuc2Becr/ZtvSrBVuy7wKYu2aOqIgP4JJAg/mnfk5uoJx81i3k/reAeufVEPlkE/5u GXKi3ubJ7Su8QKb40A4cMVbAAJnIX46q3LBQO3mY+qIzk6ecGR05cuYe9jBTAVRS/R60 cfSfXdpPwZh0EH75HZsivGLuyxMb6EwvnVjRBS8rjtNNU6uLviTsJoSwU7QmKP3tiXDD +IsbUlodrRzUxlaTA1NWWIVUci+X/KoBAZEISs+ws7pMSQd6xlvSp1KqEQ80qpUT1TBg SWNomsbXG9Zt3/S4hG/CFy5YMhUVWSzn7wVV8X0jw5I08pkp7jvOxSEga5wodxS/3pHX 6SSA== X-Forwarded-Encrypted: i=1; AHgh+RpMG+Fa0So1WiLJsDU4cukHWSsa4MEk9cyYcOwYAKic9gydw5nhQx++6n7Pgjuy8nlYXfXKG2XruZIIdtQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzkIfZo8vMTrDrCZ6PYafxtsxirVcJt25R5enVqNYZsaZvhlE9A d5w5e+wrc6DbbWTI8zEAyPJTGOrjNaGkuDvqca1sRdLJ5lB9rqWn6yjD1crjkYGi8g== X-Gm-Gg: AR+sD106VdreYa17UVUx9iGWNFfuYj4RwJlSYbA0zVXfPMl8yeiD3yK1xxowtL+S1Yx Mb9moQ0URyFt2h2UUD02PaFtO+DmBuKQUOrTSSieWhGjhstqQE7ynW8t8SXWvTrOb+tiWa7lz6p l0r6wQRKVFUcQ6h7MUk/heHwy5+gtCxTRGCZuOYYgxrhbnFKj289W0dDejfve3J2kp/6L5pKTnA 8cLrq9NV3gFQtmSEbtZ3Uj3MQkzC1T3c3hkoiJFo2AT0eeKstID07aQK7zs9sKX48O54iuf7TnH D927zkPn0c8zqsfkVmEO1uj77rZW9xuw5aZNrZRJHoAKucIbWLMEPVx8jDvVmYc9SvTFpJK8WEy 5yNFfoYpTDR4Uj4Ia5U7EdPWzbEotyjczbkkQPdtfKQAd4uVuvVj77WGoR+CeXefuiQk8MQbJjR gpHXwE5wt9RjT7nHYbhfHisjIoXauiVbOYAqMsly228GZyn/LEflMyqj89MsIFu0xHOU++K5Clf rTYiPYEJf1KQoNhd+WvjW/4aq4p1BFJMVc= X-Received: by 2002:a05:620a:2b85:b0:936:e80c:e0ba with SMTP id af79cd13be357-936e80ce8dcmr2119680285a.0.1787008596135; Mon, 17 Aug 2026 16:16:36 -0700 (PDT) Received: from localhost (pool-71-126-255-178.bstnma.fios.verizon.net. [71.126.255.178]) by smtp.gmail.com with ESMTPSA id af79cd13be357-937010e7fc0sm200396885a.20.2026.08.17.16.16.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 16:16:35 -0700 (PDT) Date: Mon, 17 Aug 2026 19:16:34 -0400 Message-ID: From: Paul Moore To: Linus Torvalds Cc: selinux@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [GIT PULL] selinux/selinux-pr-20260814 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Linus, Nine SELinux patches for the Linux v7.3 merge window, the highlights are below: - Convert a __get_free_page() call into a kmalloc() call We had some very old code that called out to __get_free_page() for allocating a pathname. There is no reason this couldn't be done with a call to kmalloc() so we've done the conversion and now there is one less __get_free_page() caller in the kernel. - Limit the number of retired/unknown DCCP netlink messages While DCCP is gone from the kernel, there are still userspace tools which try to talk to the kernel about DCCP sockets which were generating SELinux related log noise (unrecognized netlink message). This pull request both limits the log messages to just the first instance and also explains to the user that DCCP support has been removed. - Convert the SELinux strlcat() calls to seq_buf_XXX() calls As part of the effort to drop the strlcat() API from the kernel, the SELinux/IMA code was converted over to using seq_buf_XXX() calls. - Only calculate the SELinux IMA configuration string length once Previously each call to generate a SELinux configuration string for IMA would have to calculate the length of the string. While the contents of the string will likely change over the lifetime of the system, the length of the string will not. Calculate the string length once at boot and reuse the length value throughout the lifetime of the system. - Further validation of the SELinux policy at policy load time Perform additional sanity checks on the policy constraints and types. - Proper cleanup and error handling for selinuxfs init failures We were not properly cleaning up some state in the case where selinuxfs fails to initialize properly. It's somewhat of an academic exercise as a failure to initialize selinuxfs will cause the system to fail on boot, but it's arguably better to make sure we do things the proper way. - Various code cleanups Convert integer flags to boolean types and drop an uncessary goto from the SELinux code. Paul -- The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482: Linux 7.2-rc1 (2026-06-28 12:01:31 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git tags/selinux-pr-20260814 for you to fetch changes up to fd6e2388a3ea55e58cbbbef840c1d8aa2067dbb3: selinux: validate constraint expression attr and op at load time (2026-07-27 17:17:33 -0400) ---------------------------------------------------------------- selinux/stable-7.3 PR 20260814 ---------------------------------------------------------------- Haoxiang Li (1): selinux: clean up selinuxfs resources on init failure Ian Bridges (2): selinux: replace strlcat() with seq_buf in selinux_ima_collect_state() selinux: compute the IMA configuration settings string length once at boot Kalevi Kolttonen (2): selinux: convert int flags to bool flags in ss/services.c selinux: drop unnecessary goto and label from avc_alloc_node() Mike Rapoport (Microsoft) (1): selinux: hooks: use kmalloc() to allocate path buffer Stephen Smalley (2): selinux: tighten type validation during policy load selinux: validate constraint expression attr and op at load time Yafang Shao (1): selinux: suppress warning flood for retired DCCP netlink messages security/selinux/avc.c | 3 - security/selinux/hooks.c | 27 +++++++++---- security/selinux/ima.c | 65 ++++++++++++++++----------------- security/selinux/include/ima.h | 4 ++ security/selinux/selinuxfs.c | 19 ++++++--- security/selinux/ss/policydb.c | 46 +++++++++++++++++++++-- security/selinux/ss/services.c | 18 ++++----- 7 files changed, 121 insertions(+), 61 deletions(-) -- paul-moore.com