[GIT PULL] selinux/selinux-pr-20260814

[GIT PULL] selinux/selinux-pr-20260814

[Paul Moore]

Linus,

Nine SELinux patches for the Linux v7.3 merge window, the highlights are
below:

- Convert a __get_free_page() call into a kmalloc() call

We had some very old code that called out to __get_free_page() for
allocating a pathname.  There is no reason this couldn't be done with
a call to kmalloc() so we've done the conversion and now there is one
less __get_free_page() caller in the kernel.

- Limit the number of retired/unknown DCCP netlink messages

While DCCP is gone from the kernel, there are still userspace tools which
try to talk to the kernel about DCCP sockets which were generating SELinux
related log noise (unrecognized netlink message).  This pull request both
limits the log messages to just the first instance and also explains to
the user that DCCP support has been removed.

- Convert the SELinux strlcat() calls to seq_buf_XXX() calls

As part of the effort to drop the strlcat() API from the kernel, the
SELinux/IMA code was converted over to using seq_buf_XXX() calls.

- Only calculate the SELinux IMA configuration string length once

Previously each call to generate a SELinux configuration string for IMA
would have to calculate the length of the string.  While the contents of
the string will likely change over the lifetime of the system, the length
of the string will not.  Calculate the string length once at boot and
reuse the length value throughout the lifetime of the system.

- Further validation of the SELinux policy at policy load time

Perform additional sanity checks on the policy constraints and types.

- Proper cleanup and error handling for selinuxfs init failures

We were not properly cleaning up some state in the case where selinuxfs
fails to initialize properly.  It's somewhat of an academic exercise as
a failure to initialize selinuxfs will cause the system to fail on boot,
but it's arguably better to make sure we do things the proper way.

- Various code cleanups

Convert integer flags to boolean types and drop an uncessary goto from
the SELinux code.

Paul

--
The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482:

  Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
    tags/selinux-pr-20260814

for you to fetch changes up to fd6e2388a3ea55e58cbbbef840c1d8aa2067dbb3:

  selinux: validate constraint expression attr and op at load time
    (2026-07-27 17:17:33 -0400)

----------------------------------------------------------------
selinux/stable-7.3 PR 20260814
----------------------------------------------------------------

Haoxiang Li (1):
      selinux: clean up selinuxfs resources on init failure

Ian Bridges (2):
      selinux: replace strlcat() with seq_buf in
         selinux_ima_collect_state()
      selinux: compute the IMA configuration settings string length once
         at boot

Kalevi Kolttonen (2):
      selinux: convert int flags to bool flags in ss/services.c
      selinux: drop unnecessary goto and label from avc_alloc_node()

Mike Rapoport (Microsoft) (1):
      selinux: hooks: use kmalloc() to allocate path buffer

Stephen Smalley (2):
      selinux: tighten type validation during policy load
      selinux: validate constraint expression attr and op at load time

Yafang Shao (1):
      selinux: suppress warning flood for retired DCCP netlink messages

 security/selinux/avc.c         |    3 -
 security/selinux/hooks.c       |   27 +++++++++----
 security/selinux/ima.c         |   65 ++++++++++++++++-----------------
 security/selinux/include/ima.h |    4 ++
 security/selinux/selinuxfs.c   |   19 ++++++---
 security/selinux/ss/policydb.c |   46 +++++++++++++++++++++--
 security/selinux/ss/services.c |   18 ++++-----
 7 files changed, 121 insertions(+), 61 deletions(-)

--
paul-moore.com