mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-10 12:19:08 -04:00
4253eb09d2
Pull selinux updates from Paul Moore: - Convert a __get_free_page() call into a kmalloc() call We had some very old code that called out to __get_free_page() for allocating a pathname. There is no reason this couldn't be done with a call to kmalloc() so we've done the conversion and now there is one less __get_free_page() caller in the kernel. - Limit the number of retired/unknown DCCP netlink messages While DCCP is gone from the kernel, there are still userspace tools which try to talk to the kernel about DCCP sockets which were generating SELinux related log noise (unrecognized netlink message). This pull request both limits the log messages to just the first instance and also explains to the user that DCCP support has been removed. - Convert the SELinux strlcat() calls to seq_buf_XXX() calls As part of the effort to drop the strlcat() API from the kernel, the SELinux/IMA code was converted over to using seq_buf_XXX() calls. - Only calculate the SELinux IMA configuration string length once Previously each call to generate a SELinux configuration string for IMA would have to calculate the length of the string. While the contents of the string will likely change over the lifetime of the system, the length of the string will not. Calculate the string length once at boot and reuse the length value throughout the lifetime of the system. - Further validation of the SELinux policy at policy load time Perform additional sanity checks on the policy constraints and types. - Proper cleanup and error handling for selinuxfs init failures We were not properly cleaning up some state in the case where selinuxfs fails to initialize properly. It's somewhat of an academic exercise as a failure to initialize selinuxfs will cause the system to fail on boot, but it's arguably better to make sure we do things the proper way. - Various code cleanups Convert integer flags to boolean types and drop an uncessary goto from the SELinux code. * tag 'selinux-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: validate constraint expression attr and op at load time selinux: compute the IMA configuration settings string length once at boot selinux: replace strlcat() with seq_buf in selinux_ima_collect_state() selinux: suppress warning flood for retired DCCP netlink messages selinux: tighten type validation during policy load selinux: drop unnecessary goto and label from avc_alloc_node() selinux: convert int flags to bool flags in ss/services.c selinux: clean up selinuxfs resources on init failure selinux: hooks: use kmalloc() to allocate path buffer