From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 3 Dec 2025 18:45:47 +0000 (-0800)
Subject: Merge tag 'selinux-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git... 
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=51e3b98d737aa3e76e077db77b9aa749436c93ac;p=thirdparty%2Flinux.git

Merge tag 'selinux-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux updates from Paul Moore:

 - Improve the granularity of SELinux labeling for memfd files

   Currently when creating a memfd file, SELinux treats it the same as
   any other tmpfs, or hugetlbfs, file. While simple, the drawback is
   that it is not possible to differentiate between memfd and tmpfs
   files.

   This adds a call to the security_inode_init_security_anon() LSM hook
   and wires up SELinux to provide a set of memfd specific access
   controls, including the ability to control the execution of memfds.

   As usual, the commit message has more information.

 - Improve the SELinux AVC lookup performance

   Adopt MurmurHash3 for the SELinux AVC hash function instead of the
   custom hash function currently used. MurmurHash3 is already used for
   the SELinux access vector table so the impact to the code is minimal,
   and performance tests have shown improvements in both hash
   distribution and latency.

   See the commit message for the performance measurments.

 - Introduce a Kconfig option for the SELinux AVC bucket/slot size

   While we have the ability to grow the number of AVC hash buckets
   today, the size of the buckets (slot size) is fixed at 512. This pull
   request makes that slot size configurable at build time through a new
   Kconfig knob, CONFIG_SECURITY_SELINUX_AVC_HASH_BITS.

* tag 'selinux-pr-20251201' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: improve bucket distribution uniformity of avc_hash()
  selinux: Move avtab_hash() to a shared location for future reuse
  selinux: Introduce a new config to make avc cache slot size adjustable
  memfd,selinux: call security_inode_init_security_anon()
---

51e3b98d737aa3e76e077db77b9aa749436c93ac
diff --cc security/selinux/hooks.c
index 139df920f582e,a22b1920242f2..712d0b18a30c9
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -93,8 -93,8 +93,9 @@@
  #include <linux/fanotify.h>
  #include <linux/io_uring/cmd.h>
  #include <uapi/linux/lsm.h>
+ #include <linux/memfd.h>
  
 +#include "initcalls.h"
  #include "avc.h"
  #include "objsec.h"
  #include "netif.h"
@@@ -2316,18 -2316,22 +2317,22 @@@ static int selinux_bprm_creds_for_exec(
  	/* SELinux context only depends on initial program or script and not
  	 * the script interpreter */
  
 -	old_tsec = selinux_cred(current_cred());
 -	new_tsec = selinux_cred(bprm->cred);
 +	old_crsec = selinux_cred(current_cred());
 +	new_crsec = selinux_cred(bprm->cred);
  	isec = inode_security(inode);
  
+ 	if (WARN_ON(isec->sclass != SECCLASS_FILE &&
+ 		    isec->sclass != SECCLASS_MEMFD_FILE))
+ 		return -EACCES;
+ 
  	/* Default to the current task SID. */
 -	new_tsec->sid = old_tsec->sid;
 -	new_tsec->osid = old_tsec->sid;
 +	new_crsec->sid = old_crsec->sid;
 +	new_crsec->osid = old_crsec->sid;
  
  	/* Reset fs, key, and sock SIDs on execve. */
 -	new_tsec->create_sid = 0;
 -	new_tsec->keycreate_sid = 0;
 -	new_tsec->sockcreate_sid = 0;
 +	new_crsec->create_sid = 0;
 +	new_crsec->keycreate_sid = 0;
 +	new_crsec->sockcreate_sid = 0;
  
  	/*
  	 * Before policy is loaded, label any task outside kernel space
@@@ -2371,9 -2375,9 +2376,9 @@@
  	ad.type = LSM_AUDIT_DATA_FILE;
  	ad.u.file = bprm->file;
  
 -	if (new_tsec->sid == old_tsec->sid) {
 -		rc = avc_has_perm(old_tsec->sid, isec->sid, isec->sclass,
 +	if (new_crsec->sid == old_crsec->sid) {
- 		rc = avc_has_perm(old_crsec->sid, isec->sid,
- 				  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
++		rc = avc_has_perm(old_crsec->sid, isec->sid, isec->sclass,
+ 				  FILE__EXECUTE_NO_TRANS, &ad);
  		if (rc)
  			return rc;
  	} else {
@@@ -2383,8 -2387,8 +2388,8 @@@
  		if (rc)
  			return rc;
  
- 		rc = avc_has_perm(new_crsec->sid, isec->sid,
- 				  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
 -		rc = avc_has_perm(new_tsec->sid, isec->sid, isec->sclass,
++		rc = avc_has_perm(new_crsec->sid, isec->sid, isec->sclass,
+ 				  FILE__ENTRYPOINT, &ad);
  		if (rc)
  			return rc;