kernel/linux.git/security, branch v6.12.108

selinux: switch two allocations to use kzalloc_objs()

2026-09-02T12:30:58+00:00

[ Upstream commit cf6a513f1937581eb012a217b29817e025a1a0ef ] These were the only two allocations in the policy loading logic that were not already using kzalloc_objs() for the policy data structures. Fix these to be consistent with the rest and to protect against ill-formed policy. Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore Signed-off-by: Sasha Levin

selinux: require a class's permission values to cover its permission count

2026-09-02T12:30:57+00:00

[ Upstream commit b98a8ac50775540f3804397ed08f61ef9910bcab ] security_get_permissions() sizes an array by the class's permissions.nprim and fills it at value - 1, from the inherited common's permission table and then the class's own. A value no permission defines leaves a NULL that sel_make_perm_files() passes to d_alloc_name(), an oops inside sel_write_load() that strands selinux_state.policy_mutex and leaves every later load in uninterruptible sleep; two permissions sharing a value overwrite the first kstrdup(). Bounding each value by nprim catches neither, and neither would a count: the symbol table is keyed on the permission name, so duplicates pass. Track the values each permission table claims and require them to cover exactly what its count declares, rejecting a count no value can reach. Conforming policies are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas Acked-by: Stephen Smalley Signed-off-by: Paul Moore (cherry picked from commit b98a8ac50775540f3804397ed08f61ef9910bcab) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: reject a permission value exceeding the class permission count

2026-09-02T12:30:57+00:00

[ Upstream commit d14b5d0e97fccd27974fedc03b903408872907fd ] perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas Acked-by: Stephen Smalley [PM: tweak comment for line length] Signed-off-by: Paul Moore (cherry picked from commit d14b5d0e97fccd27974fedc03b903408872907fd) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: more strict policy parsing

2026-09-02T12:30:57+00:00

[ Upstream commit 18fa21f10d008a0fc22565109c7d38f304295912 ] Be more strict during parsing of policies and reject invalid values. Add some error messages in the case of policy parse failures, to enhance debugging, either on a malformed policy or a too strict check. Signed-off-by: Christian Göttsche Acked-by: Stephen Smalley [PM: fixed checkpatch.pl warnings, style problems] Signed-off-by: Paul Moore (cherry picked from commit 18fa21f10d008a0fc22565109c7d38f304295912) [WG: drop the AVTAB_XPERMS_NLMSG case, netlink xperm support (d1d991efaf34 "selinux: Add netlink xperm support") is not present in this tree] Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: use u16 for security classes

2026-09-02T12:30:56+00:00

[ Upstream commit fa79a596848fe38c55ccab8832ac35dac07fb00c ] Security class identifiers are limited to 2^16, thus use the appropriate type u16 consistently. Signed-off-by: Christian Göttsche Acked-by: Stephen Smalley Signed-off-by: Paul Moore (cherry picked from commit fa79a596848fe38c55ccab8832ac35dac07fb00c) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: make more use of str_read() when loading the policy

2026-09-02T12:30:56+00:00

[ Upstream commit 01c2253a0fbdccb58cd79d4ff9ab39964bfb4474 ] Simplify the call sites, and enable future string validation in a single place. Signed-off-by: Christian Göttsche [PM: subject tweak] Signed-off-by: Paul Moore (cherry picked from commit 01c2253a0fbdccb58cd79d4ff9ab39964bfb4474) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: avoid unnecessary indirection in struct level_datum

2026-09-02T12:30:56+00:00

[ Upstream commit 749153636643aaa793f14e84e864fdaf5ed0620d ] Store the owned member of type struct mls_level directly in the parent struct instead of an extra heap allocation. Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore (cherry picked from commit 749153636643aaa793f14e84e864fdaf5ed0620d) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

selinux: use known type instead of void pointer

2026-09-02T12:30:56+00:00

[ Upstream commit f07586160fd5492f8d48e7667e7a5d8797aa5090 ] Improve type safety and readability by using the known type. Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore (cherry picked from commit f07586160fd5492f8d48e7667e7a5d8797aa5090) Signed-off-by: Wentao Guan Signed-off-by: Sasha Levin

fsnotify, lsm: Decouple fsnotify from lsm

2026-08-23T12:22:46+00:00

[ Upstream commit 1cda52f1b4611f4daa9d89e69d9428fb4137dc3f ] Currently, fsnotify_open_perm() is called from security_file_open(). This is a a bit unexpected and creates otherwise unnecessary dependency of CONFIG_FANOTIFY_ACCESS_PERMISSIONS on CONFIG_SECURITY. Fix this by calling fsnotify_open_perm() directly. Signed-off-by: Song Liu Acked-by: Paul Moore Signed-off-by: Jan Kara Link: https://patch.msgid.link/20241013002248.3984442-1-song@kernel.org Stable-dep-of: db1856ea9196 ("binfmt_misc: restore write access when removing an entry") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

selinux: reject an unclaimed class value in security_get_classes()

2026-08-23T12:22:36+00:00

commit 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd upstream. security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas Acked-by: Stephen Smalley Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman