[RFC PATCH 2/6] selinux: contify network namespace pointer

[RFC PATCH 2/6] selinux: contify network namespace pointer

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

The network namespace is not modified.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/include/objsec.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index c88cae81ee4c..b11c97c9feed 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -82,7 +82,7 @@ struct ipc_security_struct {
 };
 
 struct netif_security_struct {
-	struct net *ns; /* network namespace */
+	const struct net *ns; /* network namespace */
 	int ifindex; /* device index */
 	u32 sid; /* SID for this interface */
 };
-- 
2.49.0

[RFC PATCH 3/6] selinux: add likely hints for fast paths

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

In the network hashtable lookup code add likely() compiler hints in the
fast path, like already done in sel_netif_sid().

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/ibpkey.c  | 2 +-
 security/selinux/netnode.c | 2 +-
 security/selinux/netport.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 48f537b41c58..94f3eef22bad 100644
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -184,7 +184,7 @@ int sel_ib_pkey_sid(u64 subnet_prefix, u16 pkey_num, u32 *sid)
 
 	rcu_read_lock();
 	pkey = sel_ib_pkey_find(subnet_prefix, pkey_num);
-	if (pkey) {
+	if (likely(pkey)) {
 		*sid = pkey->psec.sid;
 		rcu_read_unlock();
 		return 0;
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index b7900d5ae557..8bb456d80dd5 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -253,7 +253,7 @@ int sel_netnode_sid(const void *addr, u16 family, u32 *sid)
 
 	rcu_read_lock();
 	node = sel_netnode_find(addr, family);
-	if (node != NULL) {
+	if (likely(node != NULL)) {
 		*sid = node->nsec.sid;
 		rcu_read_unlock();
 		return 0;
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 2e22ad9c2bd0..7d2207384d40 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -186,7 +186,7 @@ int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid)
 
 	rcu_read_lock();
 	port = sel_netport_find(protocol, pnum);
-	if (port != NULL) {
+	if (likely(port != NULL)) {
 		*sid = port->psec.sid;
 		rcu_read_unlock();
 		return 0;
-- 
2.49.0

Re: [PATCH RFC 3/6] selinux: add likely hints for fast paths

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> In the network hashtable lookup code add likely() compiler hints in the
> fast path, like already done in sel_netif_sid().
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/ibpkey.c  | 2 +-
>  security/selinux/netnode.c | 2 +-
>  security/selinux/netport.c | 2 +-
>  3 files changed, 3 insertions(+), 3 deletions(-)

Merged into selinux/dev, thanks.

--
paul-moore.com

[RFC PATCH 4/6] selinux: improve network lookup failure warnings

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

Rate limit the warnings and include additional available information.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/netif.c   | 8 ++++----
 security/selinux/netnode.c | 4 ++--
 security/selinux/netport.c | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 43a0d3594b72..38fdba1e64bf 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -141,8 +141,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
 
 	dev = dev_get_by_index(ns, ifindex);
 	if (unlikely(dev == NULL)) {
-		pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",
-			__func__, ifindex);
+		pr_warn_ratelimited("SELinux: failure in %s(), invalid network interface (%d)\n",
+				    __func__, ifindex);
 		return -ENOENT;
 	}
 
@@ -169,8 +169,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
 	spin_unlock_bh(&sel_netif_lock);
 	dev_put(dev);
 	if (unlikely(ret))
-		pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
-			__func__, ifindex);
+		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network interface label (%d):  %d\n",
+				    __func__, ifindex, ret);
 	return ret;
 }
 
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 8bb456d80dd5..76cf531af110 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -228,8 +228,8 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
 
 	spin_unlock_bh(&sel_netnode_lock);
 	if (unlikely(ret))
-		pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
-			__func__);
+		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network node label (%d):  %d\n",
+				    __func__, family, ret);
 	return ret;
 }
 
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 7d2207384d40..dadf14984fb4 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -162,8 +162,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
 out:
 	spin_unlock_bh(&sel_netport_lock);
 	if (unlikely(ret))
-		pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
-			__func__);
+		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network port label (%d:%d):  %d\n",
+				    __func__, protocol, pnum, ret);
 	return ret;
 }
 
-- 
2.49.0

Re: [PATCH RFC 4/6] selinux: improve network lookup failure warnings

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> Rate limit the warnings and include additional available information.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/netif.c   | 8 ++++----
>  security/selinux/netnode.c | 4 ++--
>  security/selinux/netport.c | 4 ++--
>  3 files changed, 8 insertions(+), 8 deletions(-)

How many of these messages were you seeing that rate limiting was a
concern?  Also, what were you doing that was causing this?

> diff --git a/security/selinux/netif.c b/security/selinux/netif.c
> index 43a0d3594b72..38fdba1e64bf 100644
> --- a/security/selinux/netif.c
> +++ b/security/selinux/netif.c
> @@ -141,8 +141,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
>  
>  	dev = dev_get_by_index(ns, ifindex);
>  	if (unlikely(dev == NULL)) {
> -		pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",
> -			__func__, ifindex);
> +		pr_warn_ratelimited("SELinux: failure in %s(), invalid network interface (%d)\n",
> +				    __func__, ifindex);
>  		return -ENOENT;
>  	}
>  
> @@ -169,8 +169,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
>  	spin_unlock_bh(&sel_netif_lock);
>  	dev_put(dev);
>  	if (unlikely(ret))
> -		pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
> -			__func__, ifindex);
> +		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network interface label (%d):  %d\n",
> +				    __func__, ifindex, ret);
>  	return ret;
>  }
>  
> diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> index 8bb456d80dd5..76cf531af110 100644
> --- a/security/selinux/netnode.c
> +++ b/security/selinux/netnode.c
> @@ -228,8 +228,8 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
>  
>  	spin_unlock_bh(&sel_netnode_lock);
>  	if (unlikely(ret))
> -		pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
> -			__func__);
> +		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network node label (%d):  %d\n",
> +				    __func__, family, ret);
>  	return ret;
>  }
>  
> diff --git a/security/selinux/netport.c b/security/selinux/netport.c
> index 7d2207384d40..dadf14984fb4 100644
> --- a/security/selinux/netport.c
> +++ b/security/selinux/netport.c
> @@ -162,8 +162,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
>  out:
>  	spin_unlock_bh(&sel_netport_lock);
>  	if (unlikely(ret))
> -		pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
> -			__func__);
> +		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network port label (%d:%d):  %d\n",
> +				    __func__, protocol, pnum, ret);
>  	return ret;
>  }
>  
> -- 
> 2.49.0

--
paul-moore.com

Re: [PATCH RFC 4/6] selinux: improve network lookup failure warnings

[Christian Göttsche]

On Fri, 11 Apr 2025 at 22:29, Paul Moore <paul@paul-moore.com> wrote:
>
> On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> >
> > Rate limit the warnings and include additional available information.
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> > ---
> >  security/selinux/netif.c   | 8 ++++----
> >  security/selinux/netnode.c | 4 ++--
> >  security/selinux/netport.c | 4 ++--
> >  3 files changed, 8 insertions(+), 8 deletions(-)
>
> How many of these messages were you seeing that rate limiting was a
> concern?  Also, what were you doing that was causing this?

I did not actually encounter any of these warnings, it just seemed
likely if they would ever get hit they would so repeatedly and clutter
the logs.

> > diff --git a/security/selinux/netif.c b/security/selinux/netif.c
> > index 43a0d3594b72..38fdba1e64bf 100644
> > --- a/security/selinux/netif.c
> > +++ b/security/selinux/netif.c
> > @@ -141,8 +141,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
> >
> >       dev = dev_get_by_index(ns, ifindex);
> >       if (unlikely(dev == NULL)) {
> > -             pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",
> > -                     __func__, ifindex);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), invalid network interface (%d)\n",
> > +                                 __func__, ifindex);
> >               return -ENOENT;
> >       }
> >
> > @@ -169,8 +169,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
> >       spin_unlock_bh(&sel_netif_lock);
> >       dev_put(dev);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
> > -                     __func__, ifindex);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network interface label (%d):  %d\n",
> > +                                 __func__, ifindex, ret);
> >       return ret;
> >  }
> >
> > diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> > index 8bb456d80dd5..76cf531af110 100644
> > --- a/security/selinux/netnode.c
> > +++ b/security/selinux/netnode.c
> > @@ -228,8 +228,8 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
> >
> >       spin_unlock_bh(&sel_netnode_lock);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
> > -                     __func__);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network node label (%d):  %d\n",
> > +                                 __func__, family, ret);
> >       return ret;
> >  }
> >
> > diff --git a/security/selinux/netport.c b/security/selinux/netport.c
> > index 7d2207384d40..dadf14984fb4 100644
> > --- a/security/selinux/netport.c
> > +++ b/security/selinux/netport.c
> > @@ -162,8 +162,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
> >  out:
> >       spin_unlock_bh(&sel_netport_lock);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
> > -                     __func__);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network port label (%d:%d):  %d\n",
> > +                                 __func__, protocol, pnum, ret);
> >       return ret;
> >  }
> >
> > --
> > 2.49.0
>
> --
> paul-moore.com

Re: [PATCH RFC 4/6] selinux: improve network lookup failure warnings

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> Rate limit the warnings and include additional available information.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/netif.c   | 8 ++++----
>  security/selinux/netnode.c | 4 ++--
>  security/selinux/netport.c | 4 ++--
>  3 files changed, 8 insertions(+), 8 deletions(-)

My apologies that it took so long to get back to this, comments below ...
 
> diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> index 8bb456d80dd5..76cf531af110 100644
> --- a/security/selinux/netnode.c
> +++ b/security/selinux/netnode.c
> @@ -228,8 +228,8 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
>  
>  	spin_unlock_bh(&sel_netnode_lock);
>  	if (unlikely(ret))
> -		pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
> -			__func__);
> +		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network node label (%d):  %d\n",
> +				    __func__, family, ret);

Let's leave the message as it is currently written.  I don't believe the
address family is going to be very helpful, and @ret will likely always
be -EINVAL in the error case.

If you wanted to add something to the error message, you could consider
displaying the offending IP address, so long as we can use the pI4/pI6
printk format specifiers to do it; I don't want to have to have a lot of
code in the error path simply to properly format IP addresses.

>  	return ret;
>  }
>  
> diff --git a/security/selinux/netport.c b/security/selinux/netport.c
> index 7d2207384d40..dadf14984fb4 100644
> --- a/security/selinux/netport.c
> +++ b/security/selinux/netport.c
> @@ -162,8 +162,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
>  out:
>  	spin_unlock_bh(&sel_netport_lock);
>  	if (unlikely(ret))
> -		pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
> -			__func__);
> +		pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network port label (%d:%d):  %d\n",
> +				    __func__, protocol, pnum, ret);

Let's drop @ret from here too as really the only thing an admin can do is
ensure the policy has a definition for the port, the reason for the
lookup failure likely isn't very helpful (and looks to be mostly
transient, e.g. ENOMEM and similar).

--
paul-moore.com

[RFC PATCH 5/6] selinux: unify OOM handling in network hashtables

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

For network objects, like interfaces, nodes, port and InfiniBands, the
object to SID lookup is cached in hashtables.  OOM during such hashtable
additions of new objects is considered non-fatal and the computed SID is
simply returned without adding the compute result into the hash table.

Actually ignore OOM in the InfiniBand code, despite the comment already
suggesting to do so.  This reverts commit c350f8bea271 ("selinux: Fix
error return code in sel_ib_pkey_sid_slow()").

Add comments in the other places.

Use kmalloc() instead of kzalloc(), since all members are initialized on
success and the data is only used in internbal hash tables, so no risk
of information leakage to userspace.

Fixes: c350f8bea271 ("selinux: Fix error return code in sel_ib_pkey_sid_slow()")
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/ibpkey.c  | 11 +++++------
 security/selinux/netif.c   |  6 +++++-
 security/selinux/netnode.c |  5 ++++-
 security/selinux/netport.c |  6 +++++-
 4 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 94f3eef22bad..470481cfe0e8 100644
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -130,7 +130,7 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
 {
 	int ret;
 	struct sel_ib_pkey *pkey;
-	struct sel_ib_pkey *new = NULL;
+	struct sel_ib_pkey *new;
 	unsigned long flags;
 
 	spin_lock_irqsave(&sel_ib_pkey_lock, flags);
@@ -146,12 +146,11 @@ static int sel_ib_pkey_sid_slow(u64 subnet_prefix, u16 pkey_num, u32 *sid)
 	if (ret)
 		goto out;
 
-	/* If this memory allocation fails still return 0. The SID
-	 * is valid, it just won't be added to the cache.
-	 */
-	new = kzalloc(sizeof(*new), GFP_ATOMIC);
+	new = kmalloc(sizeof(*new), GFP_ATOMIC);
 	if (!new) {
-		ret = -ENOMEM;
+		/* If this memory allocation fails still return 0. The SID
+		 * is valid, it just won't be added to the cache.
+		 */
 		goto out;
 	}
 
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 38fdba1e64bf..2ab7fe9e1ea2 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -156,7 +156,11 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
 	ret = security_netif_sid(dev->name, sid);
 	if (ret != 0)
 		goto out;
-	new = kzalloc(sizeof(*new), GFP_ATOMIC);
+
+	/* If this memory allocation fails still return 0. The SID
+	 * is valid, it just won't be added to the cache.
+	 */
+	new = kmalloc(sizeof(*new), GFP_ATOMIC);
 	if (new) {
 		new->nsec.ns = ns;
 		new->nsec.ifindex = ifindex;
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 76cf531af110..15fdf385062e 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -201,7 +201,10 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
 		return 0;
 	}
 
-	new = kzalloc(sizeof(*new), GFP_ATOMIC);
+	/* If this memory allocation fails still return 0. The SID
+	 * is valid, it just won't be added to the cache.
+	 */
+	new = kmalloc(sizeof(*new), GFP_ATOMIC);
 	switch (family) {
 	case PF_INET:
 		ret = security_node_sid(PF_INET,
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index dadf14984fb4..648c2bce83a7 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -151,7 +151,11 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
 	ret = security_port_sid(protocol, pnum, sid);
 	if (ret != 0)
 		goto out;
-	new = kzalloc(sizeof(*new), GFP_ATOMIC);
+
+	/* If this memory allocation fails still return 0. The SID
+	 * is valid, it just won't be added to the cache.
+	 */
+	new = kmalloc(sizeof(*new), GFP_ATOMIC);
 	if (new) {
 		new->psec.port = pnum;
 		new->psec.protocol = protocol;
-- 
2.49.0

Re: [PATCH RFC 5/6] selinux: unify OOM handling in network hashtables

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> For network objects, like interfaces, nodes, port and InfiniBands, the
> object to SID lookup is cached in hashtables.  OOM during such hashtable
> additions of new objects is considered non-fatal and the computed SID is
> simply returned without adding the compute result into the hash table.
> 
> Actually ignore OOM in the InfiniBand code, despite the comment already
> suggesting to do so.  This reverts commit c350f8bea271 ("selinux: Fix
> error return code in sel_ib_pkey_sid_slow()").
> 
> Add comments in the other places.
> 
> Use kmalloc() instead of kzalloc(), since all members are initialized on
> success and the data is only used in internbal hash tables, so no risk
> of information leakage to userspace.
> 
> Fixes: c350f8bea271 ("selinux: Fix error return code in sel_ib_pkey_sid_slow()")
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/ibpkey.c  | 11 +++++------
>  security/selinux/netif.c   |  6 +++++-
>  security/selinux/netnode.c |  5 ++++-
>  security/selinux/netport.c |  6 +++++-
>  4 files changed, 19 insertions(+), 9 deletions(-)

Merged into selinux/dev, thanks!

--
paul-moore.com

[RFC PATCH 6/6] selinux: add cache stats for network tables

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

Export utilization statistics for network object labeling related hash
tables, similar to AVC and SID hash tables, to userspace via new
selinuxfs files under /stats/.

Guard this functionality with a new compile time option
SECURITY_SELINUX_NETTABLE_STATS.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/Kconfig           |   8 ++
 security/selinux/ibpkey.c          |  33 +++++++
 security/selinux/include/ibpkey.h  |   5 +
 security/selinux/include/netif.h   |   4 +
 security/selinux/include/netnode.h |   4 +
 security/selinux/include/netport.h |   4 +
 security/selinux/netif.c           |  39 ++++++++
 security/selinux/netnode.c         |  33 +++++++
 security/selinux/netport.c         |  33 +++++++
 security/selinux/selinuxfs.c       | 152 ++++++++++++++++++++++++++++-
 10 files changed, 313 insertions(+), 2 deletions(-)

diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
index 61abc1e094a8..cae0c7b2c994 100644
--- a/security/selinux/Kconfig
+++ b/security/selinux/Kconfig
@@ -46,6 +46,14 @@ config SECURITY_SELINUX_AVC_STATS
 	  /sys/fs/selinux/avc/cache_stats, which may be monitored via
 	  tools such as avcstat.
 
+config SECURITY_SELINUX_NETTABLE_STATS
+	bool "SELinux Network Hashtable Statistics"
+	depends on SECURITY_SELINUX
+	default y
+	help
+	  This option collects network hash table statistics to
+	  /sys/fs/selinux/stats/.
+
 config SECURITY_SELINUX_SIDTAB_HASH_BITS
 	int "SELinux sidtab hashtable size"
 	depends on SECURITY_SELINUX
diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 470481cfe0e8..c1ad58297ac4 100644
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -218,6 +218,39 @@ void sel_ib_pkey_flush(void)
 	spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+/**
+ * sel_ib_pkey_get_hash_stats - Dump pkey table statistics
+ * @page: the page sized buffer to write to
+ *
+ * Description:
+ * Make the utilization of the hash table available for userspace for
+ * introspection.
+ *
+ */
+int sel_ib_pkey_get_hash_stats(char *page)
+{
+	unsigned int idx, chain_len, max_chain_len = 0, slots_used = 0, total = 0;
+	unsigned long long chain2_len_sum = 0;
+
+	for (idx = 0; idx < SEL_PKEY_HASH_SIZE; idx++) {
+		chain_len = sel_ib_pkey_hash[idx].size;
+
+		if (chain_len > 0)
+			slots_used++;
+		if (chain_len > max_chain_len)
+			max_chain_len = chain_len;
+		total += chain_len;
+		chain2_len_sum += (unsigned long long)chain_len * chain_len;
+	}
+
+	return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
+			 "longest chain: %d\nsum of chain length^2: %llu\n",
+			 total, slots_used, SEL_PKEY_HASH_SIZE, max_chain_len,
+			 chain2_len_sum);
+}
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 static __init int sel_ib_pkey_init(void)
 {
 	int iter;
diff --git a/security/selinux/include/ibpkey.h b/security/selinux/include/ibpkey.h
index 875b055849e1..2d84877fc8c5 100644
--- a/security/selinux/include/ibpkey.h
+++ b/security/selinux/include/ibpkey.h
@@ -20,6 +20,11 @@
 #ifdef CONFIG_SECURITY_INFINIBAND
 void sel_ib_pkey_flush(void);
 int sel_ib_pkey_sid(u64 subnet_prefix, u16 pkey, u32 *sid);
+
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+int sel_ib_pkey_get_hash_stats(char *page);
+#endif
+
 #else
 static inline void sel_ib_pkey_flush(void)
 {
diff --git a/security/selinux/include/netif.h b/security/selinux/include/netif.h
index 2838bdc170dd..7246eb3ebc71 100644
--- a/security/selinux/include/netif.h
+++ b/security/selinux/include/netif.h
@@ -21,4 +21,8 @@ void sel_netif_flush(void);
 
 int sel_netif_sid(struct net *ns, int ifindex, u32 *sid);
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+int sel_netif_get_hash_stats(char *page);
+#endif
+
 #endif /* _SELINUX_NETIF_H_ */
diff --git a/security/selinux/include/netnode.h b/security/selinux/include/netnode.h
index e4dc904c3585..897c72b4b664 100644
--- a/security/selinux/include/netnode.h
+++ b/security/selinux/include/netnode.h
@@ -23,4 +23,8 @@ void sel_netnode_flush(void);
 
 int sel_netnode_sid(const void *addr, u16 family, u32 *sid);
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+int sel_netnode_get_hash_stats(char *page);
+#endif
+
 #endif
diff --git a/security/selinux/include/netport.h b/security/selinux/include/netport.h
index 9096a8289948..1b9744656616 100644
--- a/security/selinux/include/netport.h
+++ b/security/selinux/include/netport.h
@@ -22,4 +22,8 @@ void sel_netport_flush(void);
 
 int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid);
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+int sel_netport_get_hash_stats(char *page);
+#endif
+
 #endif
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 2ab7fe9e1ea2..f7bdf75f871e 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -250,6 +250,45 @@ void sel_netif_flush(void)
 	spin_unlock_bh(&sel_netif_lock);
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+/**
+ * sel_netif_get_hash_stats - Dump network interface table statistics
+ * @page: the page sized buffer to write to
+ *
+ * Description:
+ * Make the utilization of the hash table available for userspace for
+ * introspection.
+ *
+ */
+int sel_netif_get_hash_stats(char *page)
+{
+	unsigned int idx, chain_len, max_chain_len = 0, slots_used = 0, total = 0;
+	unsigned long long chain2_len_sum = 0;
+	const struct sel_netif *netif;
+
+	rcu_read_lock();
+	for (idx = 0; idx < SEL_NETIF_HASH_SIZE; idx++) {
+		chain_len = 0;
+
+		list_for_each_entry_rcu(netif, &sel_netif_hash[idx], list)
+			chain_len++;
+
+		if (chain_len > 0)
+			slots_used++;
+		if (chain_len > max_chain_len)
+			max_chain_len = chain_len;
+		total += chain_len;
+		chain2_len_sum += (unsigned long long)chain_len * chain_len;
+	}
+	rcu_read_unlock();
+
+	return scnprintf(page, PAGE_SIZE, "entries: %d/%d\nbuckets used: %d/%d\n"
+			 "longest chain: %d\nsum of chain length^2: %llu\n",
+			 total, SEL_NETIF_HASH_MAX, slots_used, SEL_NETIF_HASH_SIZE,
+			 max_chain_len, chain2_len_sum);
+}
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
 					     unsigned long event, void *ptr)
 {
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 15fdf385062e..0e380ee82eb2 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -290,6 +290,39 @@ void sel_netnode_flush(void)
 	spin_unlock_bh(&sel_netnode_lock);
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+/**
+ * sel_netnode_get_hash_stats - Dump network address table statistics
+ * @page: the page sized buffer to write to
+ *
+ * Description:
+ * Make the utilization of the hash table available for userspace for
+ * introspection.
+ *
+ */
+int sel_netnode_get_hash_stats(char *page)
+{
+	unsigned int idx, chain_len, max_chain_len = 0, slots_used = 0, total = 0;
+	unsigned long long chain2_len_sum = 0;
+
+	for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) {
+		chain_len = sel_netnode_hash[idx].size;
+
+		if (chain_len > 0)
+			slots_used++;
+		if (chain_len > max_chain_len)
+			max_chain_len = chain_len;
+		total += chain_len;
+		chain2_len_sum += (unsigned long long)chain_len * chain_len;
+	}
+
+	return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
+			 "longest chain: %d\nsum of chain length^2: %llu\n",
+			 total, slots_used, SEL_NETNODE_HASH_SIZE, max_chain_len,
+			 chain2_len_sum);
+}
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 static __init int sel_netnode_init(void)
 {
 	int iter;
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 648c2bce83a7..2a315dcc4344 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -224,6 +224,39 @@ void sel_netport_flush(void)
 	spin_unlock_bh(&sel_netport_lock);
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+/**
+ * sel_netport_get_hash_stats - Dump network port table statistics
+ * @page: the page sized buffer to write to
+ *
+ * Description:
+ * Make the utilization of the hash table available for userspace for
+ * introspection.
+ *
+ */
+int sel_netport_get_hash_stats(char *page)
+{
+	unsigned int idx, chain_len, max_chain_len = 0, slots_used = 0, total = 0;
+	unsigned long long chain2_len_sum = 0;
+
+	for (idx = 0; idx < SEL_NETPORT_HASH_SIZE; idx++) {
+		chain_len = sel_netport_hash[idx].size;
+
+		if (chain_len > 0)
+			slots_used++;
+		if (chain_len > max_chain_len)
+			max_chain_len = chain_len;
+		total += chain_len;
+		chain2_len_sum += (unsigned long long)chain_len * chain_len;
+	}
+
+	return scnprintf(page, PAGE_SIZE, "entries: %d\nbuckets used: %d/%d\n"
+			 "longest chain: %d\nsum of chain length^2: %llu\n",
+			 total, slots_used, SEL_NETPORT_HASH_SIZE, max_chain_len,
+			 chain2_len_sum);
+}
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 static __init int sel_netport_init(void)
 {
 	int iter;
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 47480eb2189b..815c509a633b 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -42,6 +42,10 @@
 #include "objsec.h"
 #include "conditional.h"
 #include "ima.h"
+#include "ibpkey.h"
+#include "netif.h"
+#include "netnode.h"
+#include "netport.h"
 
 enum sel_inos {
 	SEL_ROOT_INO = 2,
@@ -1619,6 +1623,138 @@ static int sel_make_avc_files(struct dentry *dir)
 	return 0;
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+static ssize_t sel_read_netif_stats(struct file *filp, char __user *buf,
+				    size_t count, loff_t *ppos)
+{
+	char *page;
+	ssize_t length;
+
+	page = (char *)__get_free_page(GFP_KERNEL);
+	if (!page)
+		return -ENOMEM;
+
+	length = sel_netif_get_hash_stats(page);
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos, page, length);
+	free_page((unsigned long)page);
+
+	return length;
+}
+
+static const struct file_operations sel_netif_stats_ops = {
+	.read		= sel_read_netif_stats,
+	.llseek		= generic_file_llseek,
+};
+
+static ssize_t sel_read_netnode_stats(struct file *filp, char __user *buf,
+				      size_t count, loff_t *ppos)
+{
+	char *page;
+	ssize_t length;
+
+	page = (char *)__get_free_page(GFP_KERNEL);
+	if (!page)
+		return -ENOMEM;
+
+	length = sel_netnode_get_hash_stats(page);
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos, page, length);
+	free_page((unsigned long)page);
+
+	return length;
+}
+
+static const struct file_operations sel_netnode_stats_ops = {
+	.read		= sel_read_netnode_stats,
+	.llseek		= generic_file_llseek,
+};
+
+static ssize_t sel_read_netport_stats(struct file *filp, char __user *buf,
+				      size_t count, loff_t *ppos)
+{
+	char *page;
+	ssize_t length;
+
+	page = (char *)__get_free_page(GFP_KERNEL);
+	if (!page)
+		return -ENOMEM;
+
+	length = sel_netport_get_hash_stats(page);
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos, page, length);
+	free_page((unsigned long)page);
+
+	return length;
+}
+
+static const struct file_operations sel_netport_stats_ops = {
+	.read		= sel_read_netport_stats,
+	.llseek		= generic_file_llseek,
+};
+
+#ifdef CONFIG_SECURITY_INFINIBAND
+static ssize_t sel_read_ib_pkey_stats(struct file *filp, char __user *buf,
+				      size_t count, loff_t *ppos)
+{
+	char *page;
+	ssize_t length;
+
+	page = (char *)__get_free_page(GFP_KERNEL);
+	if (!page)
+		return -ENOMEM;
+
+	length = sel_ib_pkey_get_hash_stats(page);
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos, page, length);
+	free_page((unsigned long)page);
+
+	return length;
+}
+
+static const struct file_operations sel_ib_pkey_stats_ops = {
+	.read		= sel_read_ib_pkey_stats,
+	.llseek		= generic_file_llseek,
+};
+#endif /* CONFIG_SECURITY_INFINIBAND */
+
+static int sel_make_stats_files(struct dentry *dir)
+{
+	struct super_block *sb = dir->d_sb;
+	struct selinux_fs_info *fsi = sb->s_fs_info;
+	unsigned int i;
+	static const struct tree_descr files[] = {
+		{ "netif_hash_stats", &sel_netif_stats_ops, 0444 },
+		{ "netnode_hash_stats", &sel_netnode_stats_ops, 0444 },
+		{ "netport_hash_stats", &sel_netport_stats_ops, 0444 },
+#ifdef CONFIG_SECURITY_INFINIBAND
+		{ "ibpkey_hash_stats", &sel_ib_pkey_stats_ops, 0444 },
+#endif
+	};
+
+	for (i = 0; i < ARRAY_SIZE(files); i++) {
+		struct inode *inode;
+		struct dentry *dentry;
+
+		dentry = d_alloc_name(dir, files[i].name);
+		if (!dentry)
+			return -ENOMEM;
+
+		inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
+		if (!inode) {
+			dput(dentry);
+			return -ENOMEM;
+		}
+
+		inode->i_fop = files[i].ops;
+		inode->i_ino = ++fsi->last_ino;
+		d_add(dentry, inode);
+	}
+
+	return 0;
+}
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 static int sel_make_ss_files(struct dentry *dir)
 {
 	struct super_block *sb = dir->d_sb;
@@ -2051,6 +2187,18 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
 	if (ret)
 		goto err;
 
+#ifdef CONFIG_SECURITY_SELINUX_NETTABLE_STATS
+	dentry = sel_make_dir(sb->s_root, "stats", &fsi->last_ino);
+	if (IS_ERR(dentry)) {
+		ret = PTR_ERR(dentry);
+		goto err;
+	}
+
+	ret = sel_make_stats_files(dentry);
+	if (ret)
+		goto err;
+#endif /* CONFIG_SECURITY_SELINUX_NETTABLE_STATS */
+
 	dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino);
 	if (IS_ERR(dentry)) {
 		ret = PTR_ERR(dentry);
@@ -2094,8 +2242,8 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	return 0;
 err:
-	pr_err("SELinux: %s:  failed while creating inodes\n",
-		__func__);
+	pr_err("SELinux: %s:  failed while creating inodes:  %d\n",
+		__func__, ret);
 
 	selinux_fs_info_free(sb);
 
-- 
2.49.0

[RFC PATCH 1/6] selinux: constify network address pointer

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

The network address, either an IPv4 or IPv6 one, is not modified.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/include/netnode.h  | 2 +-
 security/selinux/include/security.h | 2 +-
 security/selinux/netnode.c          | 8 ++++----
 security/selinux/ss/services.c      | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/security/selinux/include/netnode.h b/security/selinux/include/netnode.h
index 9b8b655a8cd3..e4dc904c3585 100644
--- a/security/selinux/include/netnode.h
+++ b/security/selinux/include/netnode.h
@@ -21,6 +21,6 @@
 
 void sel_netnode_flush(void);
 
-int sel_netnode_sid(void *addr, u16 family, u32 *sid);
+int sel_netnode_sid(const void *addr, u16 family, u32 *sid);
 
 #endif
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index e7827ed7be5f..278c144c22d6 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -309,7 +309,7 @@ int security_ib_endport_sid(const char *dev_name, u8 port_num, u32 *out_sid);
 
 int security_netif_sid(const char *name, u32 *if_sid);
 
-int security_node_sid(u16 domain, void *addr, u32 addrlen, u32 *out_sid);
+int security_node_sid(u16 domain, const void *addr, u32 addrlen, u32 *out_sid);
 
 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
 				 u16 tclass);
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 5c8c77e50aad..b7900d5ae557 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -187,7 +187,7 @@ static void sel_netnode_insert(struct sel_netnode *node)
  * failure.
  *
  */
-static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
+static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
 {
 	int ret;
 	struct sel_netnode *node;
@@ -207,13 +207,13 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
 		ret = security_node_sid(PF_INET,
 					addr, sizeof(struct in_addr), sid);
 		if (new)
-			new->nsec.addr.ipv4 = *(__be32 *)addr;
+			new->nsec.addr.ipv4 = *(const __be32 *)addr;
 		break;
 	case PF_INET6:
 		ret = security_node_sid(PF_INET6,
 					addr, sizeof(struct in6_addr), sid);
 		if (new)
-			new->nsec.addr.ipv6 = *(struct in6_addr *)addr;
+			new->nsec.addr.ipv6 = *(const struct in6_addr *)addr;
 		break;
 	default:
 		BUG();
@@ -247,7 +247,7 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
  * on failure.
  *
  */
-int sel_netnode_sid(void *addr, u16 family, u32 *sid)
+int sel_netnode_sid(const void *addr, u16 family, u32 *sid)
 {
 	struct sel_netnode *node;
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index e431772c6168..ec9ddfccc7ee 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2643,7 +2643,7 @@ static bool match_ipv6_addrmask(const u32 input[4], const u32 addr[4], const u32
  * @out_sid: security identifier
  */
 int security_node_sid(u16 domain,
-		      void *addrp,
+		      const void *addrp,
 		      u32 addrlen,
 		      u32 *out_sid)
 {
@@ -2672,7 +2672,7 @@ int security_node_sid(u16 domain,
 		if (addrlen != sizeof(u32))
 			goto out;
 
-		addr = *((u32 *)addrp);
+		addr = *((const u32 *)addrp);
 
 		c = policydb->ocontexts[OCON_NODE];
 		while (c) {
-- 
2.49.0

Re: [PATCH RFC 1/6] selinux: constify network address pointer

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> The network address, either an IPv4 or IPv6 one, is not modified.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/include/netnode.h  | 2 +-
>  security/selinux/include/security.h | 2 +-
>  security/selinux/netnode.c          | 8 ++++----
>  security/selinux/ss/services.c      | 4 ++--
>  4 files changed, 8 insertions(+), 8 deletions(-)

Merged into selinux/dev, thanks.

--
paul-moore.com

Re: [PATCH RFC 2/6] selinux: contify network namespace pointer

[Paul Moore]

On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> The network namespace is not modified.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  security/selinux/include/objsec.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Merged into selinux/dev, thanks.

--
paul-moore.com