From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 29878390613; Tue, 25 Aug 2026 13:50:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787665823; cv=none; b=AbiR9OwT5XXaU2rj0yrHf3CbCK+a9q0qnr6Q/cF/BJORg/JPxyRpXjdaVa9qT380j54sButKEM5dwIiotKdNzld6ZJz/A+yYwTp5WC2a+wyctf3J8Ug11xthJlN5WD+acxgvsINlWfW9fD69Td97ZxyiIH3vvZ6OhzSIov0Fozs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787665823; c=relaxed/simple; bh=8cVYDsAqhuThaNnLiO8nUIHCA0p5PLB9+KhS6Hr3QOM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=V1XQIZqyTH/J5HKYcpyT0y3xDvU/QE4oPbKVBxpAzab8cmcmRJgrA0MUSR/+7Z3zV9cQLaND2ooFRH2Lqhc798hVuvas+SoA9CPVpvpNbFMNy568MbhaWzEIcLYv8KBlXomC4T3V74TSUykEzxVPT2wbh+erNyfwurk+loIo6/A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PnmoN93R; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PnmoN93R" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 820051F000E9; Tue, 25 Aug 2026 13:50:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787665822; bh=zCku6cMwIeEtK61zM9F16GY+JvIZ0h2hjIKz8KQ+QE0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=PnmoN93RBA3iGrX54ZhcJwzaZPf4fTJKP4SsHgcHJA3fybHlvd4xeeEs1lia9yIV8 aKCuH8pAsiHvlc2I9jURmTLkw5vBKHKYya318NmiYqhyHPnkspLHj4l0iYQpbaxAfS jBPRplQPUxHN2e0FdAXJZtKqbmEbkDtCzl8YGBGQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Christian=20G=C3=B6ttsche?= , Stephen Smalley , Paul Moore , Sasha Levin Subject: [PATCH 6.6 78/87] selinux: use u16 for security classes Date: Tue, 25 Aug 2026 15:26:41 +0200 Message-ID: <20260825132544.891223976@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825132541.813800447@linuxfoundation.org> References: <20260825132541.813800447@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Christian Göttsche [ Upstream commit fa79a596848fe38c55ccab8832ac35dac07fb00c ] Security class identifiers are limited to 2^16, thus use the appropriate type u16 consistently. Signed-off-by: Christian Göttsche Acked-by: Stephen Smalley Signed-off-by: Paul Moore Stable-dep-of: b98a8ac50775 ("selinux: require a class's permission values to cover its permission count") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- security/selinux/ss/policydb.c | 5 +++-- security/selinux/ss/policydb.h | 10 +++++----- security/selinux/ss/services.c | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -911,7 +911,7 @@ int policydb_load_isids(struct policydb return 0; } -int policydb_class_isvalid(struct policydb *p, unsigned int class) +int policydb_class_isvalid(struct policydb *p, u16 class) { if (!class || class > p->p_classes.nprim) return 0; @@ -1994,7 +1994,8 @@ static int filename_trans_read_helper(st struct filename_trans_key *ft = NULL; struct filename_trans_datum **dst, *datum, *first = NULL; char *name = NULL; - u32 len, ttype, tclass, ndatum, i; + u32 len, ttype, ndatum, i; + u16 tclass; __le32 buf[3]; int rc; --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -48,7 +48,7 @@ struct common_datum { /* Class attributes */ struct class_datum { - u32 value; /* class value */ + u16 value; /* class value */ char *comkey; /* common name */ struct common_datum *comdatum; /* common datum */ struct symtab permissions; /* class-specific permission symbol table */ @@ -82,7 +82,7 @@ struct role_datum { struct role_trans_key { u32 role; /* current role */ u32 type; /* program executable type, or new object type */ - u32 tclass; /* process class, or new object class */ + u16 tclass; /* process class, or new object class */ }; struct role_trans_datum { @@ -139,7 +139,7 @@ struct cat_datum { struct range_trans { u32 source_type; u32 target_type; - u32 target_class; + u16 target_class; }; /* Boolean data type */ @@ -195,7 +195,7 @@ struct ocontext { } ibendport; } u; union { - u32 sclass; /* security class for genfs */ + u16 sclass; /* security class for genfs */ u32 behavior; /* labeling behavior for fs_use */ } v; struct context context[2]; /* security context(s) */ @@ -320,7 +320,7 @@ struct policy_file { extern void policydb_destroy(struct policydb *p); extern int policydb_load_isids(struct policydb *p, struct sidtab *s); extern int policydb_context_isvalid(struct policydb *p, struct context *c); -extern int policydb_class_isvalid(struct policydb *p, unsigned int class); +extern int policydb_class_isvalid(struct policydb *p, u16 class); extern int policydb_type_isvalid(struct policydb *p, unsigned int type); extern int policydb_role_isvalid(struct policydb *p, unsigned int role); extern int policydb_read(struct policydb *p, struct policy_file *fp); --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -3336,7 +3336,7 @@ static int get_classes_callback(void *k, { struct class_datum *datum = d; char *name = k, **classes = args; - u32 value = datum->value - 1; + u16 value = datum->value - 1; classes[value] = kstrdup(name, GFP_ATOMIC); if (!classes[value])