From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12DF223EAB3 for ; Mon, 24 Aug 2026 22:00:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787608826; cv=none; b=JcGgQoR4SQs/05PbmNWu06BI+5MGJJIZiJUAlYEpfqPCrjxaSRI1mILzp8dPozb1UPhHRLxCJOt0FZ3mGXvyZHCZe9v/1/OpR4lCJpoVOAIYplVcTv4wrt8JmLhW4hREFHv59xSgwtz4CiG6O+YvOHXkhngMKiMC8qxxRQRxZSw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787608826; c=relaxed/simple; bh=5Wu6WIK/xeZS8273HXr/xNX/vsLusPnGrlrJbw3h7bQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mVqdtSshYVOcOicRl0hHG9Q2p5o7Hmlscj7Kl8LI6UOZvZErqt/LhfxrIBnwPwOVo6LoiJyzBgAVI06iKk2UbFdPKwPxWh2fKo5kgMg/GE1zkemnfRR51JUkrYaZKmjp2BCYetUaE7yZamKNT7KD0bJbg3XxJpg5KyPCgsmW0Qc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MT0BI+no; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MT0BI+no" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC4C41F000E9; Mon, 24 Aug 2026 22:00:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787608824; bh=HydLqAWYfVjyuHwwRK1Fi11i3+7wOYPdAFpVlUvNPvI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MT0BI+no3832xXvj0/eB4edugPB+UKB82bhl0rFyQDbBlGpulSq7QDZ8UBkuhBt1n wejL5U1Ilm+9KzgVZeSpEcGQsQlmGqOilCsVMpg8m1ihP5qKRiZ6y/dSTBz3fSc9SY x//ZRZZiRDidIqsSD1SqybPuOQ3l5PYCNCq6cen90XGA32qfUnCqGhMUKKyrLyEBxk x1hss4OKr9oRNothRTZ+fuZTfOlZ2HJEfugTeIeWT7mPfqlaII0EUSWK+YGEUKXnGy Pdj5/hPccsDYsckER+Zg8uxnDEpUamLuOyw3NocLJQzVzGvF+WuapNghTzMQ+8TsAd ZJZdcTlF8W0ag== From: Sasha Levin To: stable@vger.kernel.org Cc: =?UTF-8?q?Christian=20G=C3=B6ttsche?= , Stephen Smalley , Paul Moore , Sasha Levin Subject: [PATCH 6.18.y 1/3] selinux: use u16 for security classes Date: Mon, 24 Aug 2026 18:00:20 -0400 Message-ID: <20260824220022.435960-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026082020-deputize-mosaic-579e@gregkh> References: <2026082020-deputize-mosaic-579e@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Christian Göttsche [ Upstream commit fa79a596848fe38c55ccab8832ac35dac07fb00c ] Security class identifiers are limited to 2^16, thus use the appropriate type u16 consistently. Signed-off-by: Christian Göttsche Acked-by: Stephen Smalley Signed-off-by: Paul Moore Stable-dep-of: b98a8ac50775 ("selinux: require a class's permission values to cover its permission count") Signed-off-by: Sasha Levin --- security/selinux/ss/policydb.c | 5 +++-- security/selinux/ss/policydb.h | 10 +++++----- security/selinux/ss/services.c | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index fdb8a62da04ad..37e0735b0dc8d 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -951,7 +951,7 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s) return 0; } -int policydb_class_isvalid(struct policydb *p, unsigned int class) +int policydb_class_isvalid(struct policydb *p, u16 class) { if (!class || class > p->p_classes.nprim) return 0; @@ -2042,7 +2042,8 @@ static int filename_trans_read_helper(struct policydb *p, struct policy_file *fp struct filename_trans_key *ft = NULL; struct filename_trans_datum **dst, *datum, *first = NULL; char *name = NULL; - u32 len, ttype, tclass, ndatum, i; + u32 len, ttype, ndatum, i; + u16 tclass; __le32 buf[3]; int rc; diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index 89a180b1742fb..a49275d1168d8 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -48,7 +48,7 @@ struct common_datum { /* Class attributes */ struct class_datum { - u32 value; /* class value */ + u16 value; /* class value */ char *comkey; /* common name */ struct common_datum *comdatum; /* common datum */ struct symtab permissions; /* class-specific permission symbol table */ @@ -82,7 +82,7 @@ struct role_datum { struct role_trans_key { u32 role; /* current role */ u32 type; /* program executable type, or new object type */ - u32 tclass; /* process class, or new object class */ + u16 tclass; /* process class, or new object class */ }; struct role_trans_datum { @@ -139,7 +139,7 @@ struct cat_datum { struct range_trans { u32 source_type; u32 target_type; - u32 target_class; + u16 target_class; }; /* Boolean data type */ @@ -195,7 +195,7 @@ struct ocontext { } ibendport; } u; union { - u32 sclass; /* security class for genfs */ + u16 sclass; /* security class for genfs */ u32 behavior; /* labeling behavior for fs_use */ } v; struct context context[2]; /* security context(s) */ @@ -322,7 +322,7 @@ struct policy_file { extern void policydb_destroy(struct policydb *p); extern int policydb_load_isids(struct policydb *p, struct sidtab *s); extern int policydb_context_isvalid(struct policydb *p, struct context *c); -extern int policydb_class_isvalid(struct policydb *p, unsigned int class); +extern int policydb_class_isvalid(struct policydb *p, u16 class); extern int policydb_type_isvalid(struct policydb *p, unsigned int type); extern int policydb_role_isvalid(struct policydb *p, unsigned int role); extern int policydb_read(struct policydb *p, struct policy_file *fp); diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 82608b34260fd..cbc101b095a30 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -3290,7 +3290,7 @@ static int get_classes_callback(void *k, void *d, void *args) { struct class_datum *datum = d; char *name = k, **classes = args; - u32 value = datum->value - 1; + u16 value = datum->value - 1; classes[value] = kstrdup(name, GFP_ATOMIC); if (!classes[value]) -- 2.53.0