[GIT PULL] selinux/selinux-pr-20260507

[Paul Moore <paul@paul-moore.com>]

Linus,

We've got five more SELinux patches to fix a few problems, quick summary
below:

- Allow for multiple opens of /sys/fs/selinux/policy

Prevents a single process from blocking others from reading the
SELinux policy loaded in the kernel.  This does have the side effect
of potentially allowing userspace to trigger additional kernel memory
allocations as part of the open/read operation, but this is mitigated
by requiring the SELinux security/read_policy permission.

- Reduce the critical sections where the SELinux policy mutex is held

This includes the patch to the policy loader code where we move the
permission checks and an allocation outside the mutex as well as the
the patch to checkreqprot which drops the code/lock entirely.  While
the checkreqprot code had effectively been dropped in an earlier release,
portions of the code still remained that would have triggered the mutex
to perform an IMA measurement.  This pull request finally drops all of
that while preserving the user visible behavior.

- Eliminate potential sources of log spamming

There were a few areas where processes could flood the system logs and
hide other, more critical events.  The previously disabled checkreqprot
and runtime disable knobs in selinuxfs were two such areas that have now
been greatly simplified and a pr_err() replaced with a pr_err_once().  The
third such place is the /sys/fs/selinux/user file, which hasn't been
used by a userspace release since 2020 and was scheduled for removal
after 2025; this pull request effectively disables this functionality,
but similar to checkreqprot, it is done in a way that should not break
old userspace.

Paul

--
The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:

  Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
    tags/selinux-pr-20260507

for you to fetch changes up to 868f31e4061eca8c3cd607d79d954d5e54f204aa:

  selinux: shrink critical section in sel_write_load()
    (2026-05-05 16:02:28 -0400)

----------------------------------------------------------------
selinux/stable-7.1 PR 20260507
----------------------------------------------------------------

Stephen Smalley (5):
      selinux: prune /sys/fs/selinux/checkreqprot
      selinux: prune /sys/fs/selinux/disable
      selinux: prune /sys/fs/selinux/user
      selinux: allow multiple opens of /sys/fs/selinux/policy
      selinux: shrink critical section in sel_write_load()

 security/selinux/include/security.h |    2 
 security/selinux/selinuxfs.c        |  196 ++++------------------------
 security/selinux/ss/services.c      |  125 -----------------
 3 files changed, 31 insertions(+), 292 deletions(-)

--
paul-moore.com