linux-kernel - [GIT PULL] SELinux patches for v5.12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Feb 2021 16:57:38 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org, selinux@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: [GIT PULL] SELinux patches for v5.12

Hi Linus,

We've got a good handful of patches for SELinux this time around; with
everything passing the selinux-testsuite and applying cleanly to your
tree as of a few minutes ago.  The highlights are below:

- Add support for labeling anonymous inodes, and extend this new
support to userfaultfd.

- Fallback to SELinux genfs file labeling if the filesystem does not
have xattr support.  This is useful for virtiofs which can vary in its
xattr support depending on the backing filesystem.

- Classify and handle MPTCP the same as TCP in SELinux.

- Ensure consistent behavior between inode_getxattr and
inode_listsecurity when the SELinux policy is not loaded.  This fixes
a known problem with overlayfs.

- A couple of patches to prune some unused variables from the SELinux
code, mark private variables as static, and mark other variables as
__ro_after_init or __read_mostly.

Thanks,
-Paul

--
The following changes since commit e71ba9452f0b5b2e8dc8aa5445198cd9214a6a62:

 Linux 5.11-rc2 (2021-01-03 15:55:30 -0800)

are available in the Git repository at:

 git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
   tags/selinux-pr-20210215

for you to fetch changes up to 365982aba1f264dba26f0908700d62bfa046918c:

 fs: anon_inodes: rephrase to appropriate kernel-doc
   (2021-01-15 12:17:25 -0500)

----------------------------------------------------------------
selinux/stable-5.12 PR 20210215

----------------------------------------------------------------
Amir Goldstein (1):
     selinux: fix inconsistency between inode_getxattr and inode_listsecurity

Daniel Colascione (3):
     fs: add LSM-supporting anon-inode interface
     selinux: teach SELinux about anonymous inodes
     userfaultfd: use secure anon inodes for userfaultfd

Lokesh Gidra (1):
     security: add inode_init_security_anon() LSM hook

Lukas Bulwahn (1):
     fs: anon_inodes: rephrase to appropriate kernel-doc

Ondrej Mosnacek (6):
     selinux: remove unused global variables
     selinux: drop the unnecessary aurule_callback variable
     selinux: make selinuxfs_mount static
     selinux: mark some global variables __ro_after_init
     selinux: mark selinux_xfrm_refcount as __read_mostly
     selinux: fall back to SECURITY_FS_USE_GENFS if no xattr support

Paolo Abeni (1):
     selinux: handle MPTCP consistently with TCP

fs/anon_inodes.c                    | 157 +++++++++++++++++++++++++--------
fs/libfs.c                          |   5 --
fs/userfaultfd.c                    |  19 ++---
include/linux/anon_inodes.h         |   5 ++
include/linux/lsm_hook_defs.h       |   2 +
include/linux/lsm_hooks.h           |   9 +++
include/linux/security.h            |  10 +++
security/security.c                 |   8 ++
security/selinux/avc.c              |  10 +--
security/selinux/hooks.c            | 141 ++++++++++++++++++++++++-----
security/selinux/ibpkey.c           |   1 -
security/selinux/include/classmap.h |   2 +
security/selinux/include/security.h |   1 -
security/selinux/netif.c            |   1 -
security/selinux/netlink.c          |   2 +-
security/selinux/netnode.c          |   1 -
security/selinux/netport.c          |   1 -
security/selinux/selinuxfs.c        |   4 +-
security/selinux/ss/avtab.c         |   4 +-
security/selinux/ss/ebitmap.c       |   2 +-
security/selinux/ss/hashtab.c       |   2 +-
security/selinux/ss/services.c      |  10 +--
security/selinux/xfrm.c             |   2 +-
23 files changed, 294 insertions(+), 105 deletions(-)

-- 
paul moore
www.paul-moore.com