[GIT PULL] selinux/selinux-pr-20261015

Linus,

Thirteen SELinux patches for the Linux v7.4 merge window:

- Continue to improve the load time validation of SELinux policies

While SELinux policy loading remains a privileged operation, we continue
the recent trend of hardening the policy parsing and validation code in
the kernel to ensure that invalid, or poorly formatted policies are
rejected at load time.

- Correctly incorporate "neveraudit" into the xperms code

This change aligns the xperms neveraudit handling with the conventional
permission handling code, exiting early from the SELinux auditing
code when neveraudit is enabled for the domain.

- Mark the selinuxfs "status" and "policy" files immutable

These are read-only kernel/userspace interfaces that could successfully
be opened at the VFS layer through the use of CAP_DAC_OVERRIDE.  With
this pull request we are marking these two files as immutable so that
the requests to open these file with write permissions now fail at the
VFS layer.  This also allows us to drop some of our mmap() checks around
write permissions as the VFS will now also handle this for us.

The existing SELinux permissions checks remain untouched.

- Convert the selinuxfs inode numbers to u64

Bring selinuxfs current with other filesystems in using u64 for inode
numbering as opposed to the architecture dependent unsigned long.

- Constify a number of the SELinux AVC function parameters

- Remove a SELinux MLS function that was no longer used

Paul

--
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

  Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
    tags/selinux-pr-20261015

for you to fetch changes up to b73b967b0fc44707f39faa4f298f1f9d9b7bfac5:

  selinux: validate permissive and neveraudit map types at load
    (2026-09-30 16:59:44 -0400)

----------------------------------------------------------------
selinux/stable-7.4 PR 20261015
----------------------------------------------------------------

Christian G��ttsche (8):
      selinux: constify avc function parameters
      selinux: reject a policy that both rejects and allows unknown
         classes
      selinux: reject duplicate symbol values during policy load
      selinux: bounds-check filename transition source types at load
      selinux: check neveraudit in avc_xperms_audit_required()
      selinux: bounds-check role and user membership bitmaps at load
      selinux: validate user MLS range and default level at load
      selinux: validate permissive and neveraudit map types at load

Paul Moore (2):
      selinux: convert selinuxfs inode numbers from unsigned long to u64
      selinux: avoid 64-bit division of inode numbers

Stephen Smalley (3):
      selinux: tighten policydb_context_isvalid() checks
      selinux: remove unused mls_setup_user_range()
      selinux: mark status and policy inodes as immutable, drop status
         mmap write checks

 security/selinux/avc.c          |   37 ++++----
 security/selinux/include/avc.h  |    7 -
 security/selinux/selinuxfs.c    |   59 +++++++------
 security/selinux/ss/mls.c       |   38 --------
 security/selinux/ss/mls.h       |    3 
 security/selinux/ss/mls_types.h |    3 
 security/selinux/ss/policydb.c  |  137 ++++++++++++++++++++++++++++----
 7 files changed, 183 insertions(+), 101 deletions(-)

--
paul-moore.com