From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACE0E3FE348 for ; Tue, 25 Aug 2026 11:24:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787657087; cv=none; b=Wc035iuD9ZWfR2ugUPy3bXDY8Cg13+AfP8my1QvaPS6cTE2vli3+Ky9cVbIBWL+RoGjs7c0hY9qbd6EuXlUJyaIryd+6goC64gBI2qk9TX0iLzoSW401s61Z0uxryGiBvLJQhS7OiC9PB+kUaITLxLaspLYMmwxl50r1nyXvMPI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787657087; c=relaxed/simple; bh=6/25TQm9rY7dxSrD2qmWOHwcNKT/+3gKUMWA9i5iqLE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cBow3i7RqXy9qMR6EYIi7fQJco5Azyca9TQfOpQMPcSeX8Ivn0G84uNJeIBQuW7CrTfAjTjVPs2lk2YvhYZFK7YIRK1oNMU364fx7KfbQqNtYYaymNo4ZIpROXv5I/437Y78MJ4454QWpVzixPJe4nQuxoC8yamp057MmnwkBIg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=crq2pbP0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="crq2pbP0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00DD41F00AC4; Tue, 25 Aug 2026 11:24:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787657086; bh=aQ52+ANxlian4Tas0bxUuqSfd9LbxsjExutmYN+ejtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=crq2pbP0xsx1NYJgSdlIr8kqN4ztj8ofcPqw7un4ht54aqzwThQlmbBqScTtv23Ff /PJSEfKIZRVaWNBGo2HTijbt78d/ZUnI9G/PWoNzu3+NMk7TbnPEhG/OT2nhdMlMo4 b8ZQh4B8G75bYYQ8ZOaFMRhtWEuQQlL+5u8a/GhQNTTU1l73Gq2ZH9qsuTBgQVKYkt 3FBpZzTA6zI4d08lte74LDDrMWt6YuEAe9njLgc367bPo83FcTqVYSUhkVvAlYRRSx KMGq4WZrc8D+ATRjp/NiSQBpP3jxPSGBwji1dt+uCil9fhoSH7nGWbPB/yT+xJDJUS fw46LXoVWk7PA== From: Sasha Levin To: stable@vger.kernel.org Cc: =?UTF-8?q?Christian=20G=C3=B6ttsche?= , Stephen Smalley , Paul Moore , Sasha Levin Subject: [PATCH 6.6.y 6/9] selinux: use u16 for security classes Date: Tue, 25 Aug 2026 07:24:37 -0400 Message-ID: <20260825112440.3543785-6-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260825112440.3543785-1-sashal@kernel.org> References: <2026082022-circle-gooey-f888@gregkh> <20260825112440.3543785-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Christian Göttsche [ Upstream commit fa79a596848fe38c55ccab8832ac35dac07fb00c ] Security class identifiers are limited to 2^16, thus use the appropriate type u16 consistently. Signed-off-by: Christian Göttsche Acked-by: Stephen Smalley Signed-off-by: Paul Moore Stable-dep-of: b98a8ac50775 ("selinux: require a class's permission values to cover its permission count") Signed-off-by: Sasha Levin --- security/selinux/ss/policydb.c | 5 +++-- security/selinux/ss/policydb.h | 10 +++++----- security/selinux/ss/services.c | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 6cc865e3fdfcc..ef1c38efafa5a 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -911,7 +911,7 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s) return 0; } -int policydb_class_isvalid(struct policydb *p, unsigned int class) +int policydb_class_isvalid(struct policydb *p, u16 class) { if (!class || class > p->p_classes.nprim) return 0; @@ -1994,7 +1994,8 @@ static int filename_trans_read_helper(struct policydb *p, struct policy_file *fp struct filename_trans_key *ft = NULL; struct filename_trans_datum **dst, *datum, *first = NULL; char *name = NULL; - u32 len, ttype, tclass, ndatum, i; + u32 len, ttype, ndatum, i; + u16 tclass; __le32 buf[3]; int rc; diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index d95a3941f327c..06df7da747791 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -48,7 +48,7 @@ struct common_datum { /* Class attributes */ struct class_datum { - u32 value; /* class value */ + u16 value; /* class value */ char *comkey; /* common name */ struct common_datum *comdatum; /* common datum */ struct symtab permissions; /* class-specific permission symbol table */ @@ -82,7 +82,7 @@ struct role_datum { struct role_trans_key { u32 role; /* current role */ u32 type; /* program executable type, or new object type */ - u32 tclass; /* process class, or new object class */ + u16 tclass; /* process class, or new object class */ }; struct role_trans_datum { @@ -139,7 +139,7 @@ struct cat_datum { struct range_trans { u32 source_type; u32 target_type; - u32 target_class; + u16 target_class; }; /* Boolean data type */ @@ -195,7 +195,7 @@ struct ocontext { } ibendport; } u; union { - u32 sclass; /* security class for genfs */ + u16 sclass; /* security class for genfs */ u32 behavior; /* labeling behavior for fs_use */ } v; struct context context[2]; /* security context(s) */ @@ -320,7 +320,7 @@ struct policy_file { extern void policydb_destroy(struct policydb *p); extern int policydb_load_isids(struct policydb *p, struct sidtab *s); extern int policydb_context_isvalid(struct policydb *p, struct context *c); -extern int policydb_class_isvalid(struct policydb *p, unsigned int class); +extern int policydb_class_isvalid(struct policydb *p, u16 class); extern int policydb_type_isvalid(struct policydb *p, unsigned int type); extern int policydb_role_isvalid(struct policydb *p, unsigned int role); extern int policydb_read(struct policydb *p, struct policy_file *fp); diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 3d29f2a9b43a3..9811251a6c21c 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -3336,7 +3336,7 @@ static int get_classes_callback(void *k, void *d, void *args) { struct class_datum *datum = d; char *name = k, **classes = args; - u32 value = datum->value - 1; + u16 value = datum->value - 1; classes[value] = kstrdup(name, GFP_ATOMIC); if (!classes[value]) -- 2.53.0