[GIT PULL] lsm/lsm-pr-20250926

[Paul Moore]

Linus,

Here are the LSM framework patches for the upcoming Linux v6.18 merge
window:

- Move the management of the LSM BPF security blobs into the framework

  In order to enable multiple LSMs we need to allocate and free the
  various security blobs in the LSM framework and not the individual
  LSMs as they would end up stepping all over each other.

- Leverage the lsm_bdev_alloc() helper in lsm_bdev_alloc()

  Make better use of our existing helper functions to reduce some code
  duplication.

- Update the Rust cred code to use 'sync::aref'

  Part of a larger effort to move the Rust code over to the 'sync'
  module.

- Make CONFIG_LSM dependent on CONFIG_SECURITY

  As the CONFIG_LSM Kconfig setting is an ordered list of the LSMs to
  enable a boot, it obviously doesn't make much sense to enable this
  when CONFIG_SECURITY is disabled.

- Update the LSM and CREDENTIALS sections in MAINTAINERS with Rusty bits

  Add the Rust helper files to the associated LSM and CREDENTIALS entries
  int the MAINTAINERS file.  We're trying to improve the communication
  between the two groups and making sure we're all aware of what is
  going on via cross-posting to the relevant lists is a good way to
  start.

Paul

--
The following changes since commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585:

  Linux 6.17-rc1 (2025-08-10 19:41:16 +0300)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git
    tags/lsm-pr-20250926

for you to fetch changes up to 54d94c422fed9575b74167333c1757847a4e6899:

  lsm: CONFIG_LSM can depend on CONFIG_SECURITY
    (2025-09-11 16:32:04 -0400)

----------------------------------------------------------------
lsm/stable-6.18 PR 20250926
----------------------------------------------------------------

Blaise Boscaccy (1):
      lsm,selinux: Add LSM blob support for BPF objects

Paul Moore (3):
      lsm: use lsm_blob_alloc() in lsm_bdev_alloc()
      MAINTAINERS: add the associated Rust helper to the LSM section
      MAINTAINERS: add the associated Rust helper to the CREDENTIALS
         section

Qianfeng Rong (1):
      security: use umax() to improve code

Randy Dunlap (1):
      lsm: CONFIG_LSM can depend on CONFIG_SECURITY

Shankari Anand (1):
      rust,cred: update AlwaysRefCounted import to sync::aref

 MAINTAINERS                       |    2 
 include/linux/lsm_hooks.h         |    3 
 rust/kernel/cred.rs               |    6 -
 security/Kconfig                  |    1 
 security/min_addr.c               |    6 -
 security/security.c               |   98 ++++++++++++++++++++++++++----
 security/selinux/hooks.c          |   56 +++--------------
 security/selinux/include/objsec.h |   20 ++++++
 8 files changed, 124 insertions(+), 68 deletions(-)

--
paul-moore.com