[GIT PULL] selinux/selinux-pr-20241112

[Paul Moore]

Linus,

I'm expecting to have spotty network access later this week and early
into next so I'm sending my v6.13 merge window pull requests a bit
earlier than normal.  The SELinux highlights are below:

- Add support for netlink xperms

Some time ago we added the concept of "xperms" to the SELinux policy
so that we could write policy for individual ioctls, this pull request
builds upon this by using extending xperms to netlink so that we can
write SELinux policy for individual netlnk message types and not rely
on the fairly coarse read/write mapping tables we currently have.
There are limitations involving generic netlink due to the multiplexing
that is done, but it's no worse that what we currently have.  As usual,
more information can be found in the commit message.

- Deprecate /sys/fs/selinux/user

We removed the only known userspace use of this back in 2020 and now
that several years have elapsed we're starting down the path of
deprecating it in the kernel.

- Cleanup the build under scripts/selinux

A couple of patches to move the genheaders tool under security/selinux
and correct our usage of kernel headers in the tools located under
scripts/selinux.  While these changes originated out of an effort to
build Linux on different systems, they are arguably the right thing to
do regardless.

- Minor code cleanups and style fixes

Not much to say here, two minor cleanup patches that came out of the
netlink xperms work.

-Paul

--
The following changes since commit 9852d85ec9d492ebef56dc5f229416c925758edc:

  Linux 6.12-rc1 (2024-09-29 15:06:19 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
    tags/selinux-pr-20241112

for you to fetch changes up to d7b6918e22c74f2b354d8dc0ef31ab17ae334b93:

  selinux: Deprecate /sys/fs/selinux/user (2024-10-07 16:39:49 -0400)

----------------------------------------------------------------
selinux/stable-6.13 PR 20241112
----------------------------------------------------------------

Masahiro Yamada (2):
      selinux: do not include <linux/*.h> headers from host programs
      selinux: move genheaders to security/selinux/

Paul Moore (2):
      selinux: streamline selinux_nlmsg_lookup()
      selinux: apply clang format to security/selinux/nlmsgtab.c

Stephen Smalley (1):
      selinux: Deprecate /sys/fs/selinux/user

Thiébaud Weksteen (1):
      selinux: Add netlink xperm support

 Documentation/ABI/obsolete/sysfs-selinux-user    |   12 
 scripts/remove-stale-files                       |    3 
 scripts/selinux/Makefile                         |    2 
 scripts/selinux/genheaders/.gitignore            |    2 
 scripts/selinux/genheaders/Makefile              |    5 
 scripts/selinux/mdp/Makefile                     |    2 
 scripts/selinux/mdp/mdp.c                        |    4 
 security/selinux/.gitignore                      |    1 
 security/selinux/Makefile                        |    7 
 security/selinux/genheaders.c                    |    3 
 security/selinux/hooks.c                         |   51 ++
 security/selinux/include/classmap.h              |   19 
 security/selinux/include/initial_sid_to_string.h |    4 
 security/selinux/include/policycap.h             |    1 
 security/selinux/include/policycap_names.h       |    1 
 security/selinux/include/security.h              |    6 
 security/selinux/nlmsgtab.c                      |  299 +++++++--------
 security/selinux/selinuxfs.c                     |    4 
 security/selinux/ss/avtab.h                      |    5 
 security/selinux/ss/services.c                   |   78 ++-
 20 files changed, 295 insertions(+), 214 deletions(-)

--
paul-moore.com