• Linus Torvalds's avatar
    Merge tag 'selinux-pr-20220321' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · c269497d
    Linus Torvalds authored
    Pull selinux updates from Paul Moore:
     "We've got a number of SELinux patches queued up, the highlights are:
    
       - Fixup the security_fs_context_parse_param() LSM hook so it executes
         all of the LSM hook implementations unless a serious error occurs.
    
         We also correct the SELinux hook implementation so that it returns
         zero on success.
    
       - In addition to a few SELinux mount option parsing fixes, we
         simplified the parsing by moving it earlier in the process.
    
         The logic was that it was unlikely an admin/user would use the new
         mount API and not have the policy loaded before passing the SELinux
         options.
    
       - Properly fixed the LSM/SELinux/SCTP hooks with the addition of the
         security_sctp_assoc_established() hook.
    
         This work was done in conjunction with the netdev folks and should
         complete the move of the SCTP labeling from the endpoints to the
         associations.
    
       - Fixed a variety of sparse warnings caused by changes in the "__rcu"
         markings of some core kernel structures.
    
       - Ensure we access the superblock's LSM security blob using the
         stacking-safe accessors.
    
       - Added the ability for the kernel to always allow FIOCLEX and
         FIONCLEX if the "ioctl_skip_cloexec" policy capability is
         specified.
    
       - Various constifications improvements, type casting improvements,
         additional return value checks, and dead code/parameter removal.
    
       - Documentation fixes"
    
    * tag 'selinux-pr-20220321' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: (23 commits)
      selinux: shorten the policy capability enum names
      docs: fix 'make htmldocs' warning in SCTP.rst
      selinux: allow FIOCLEX and FIONCLEX with policy capability
      selinux: use correct type for context length
      selinux: drop return statement at end of void functions
      security: implement sctp_assoc_established hook in selinux
      security: add sctp_assoc_established hook
      selinux: parse contexts for mount options early
      selinux: various sparse fixes
      selinux: try to use preparsed sid before calling parse_sid()
      selinux: Fix selinux_sb_mnt_opts_compat()
      LSM: general protection fault in legacy_parse_param
      selinux: fix a type cast problem in cred_init_security()
      selinux: drop unused macro
      selinux: simplify cred_init_security
      selinux: do not discard const qualifier in cast
      selinux: drop unused parameter of avtab_insert_node
      selinux: drop cast to same type
      selinux: enclose macro arguments in parenthesis
      selinux: declare name parameter of hash_eval const
      ...
    c269497d
conditional.c 16.6 KB