Hi Linus,
Here are the SELinux patches for v5.8. All the patches pass our test
suite and as of about 15 minutes ago they apply cleanly to the top of
your tree. Please merge into v5.8.
The highlights:
- A number of improvements to various SELinux internal data structures
to help improve performance. We move the role transitions into a hash
table. In the content structure we shift from hashing the content
string (aka SELinux label) to the structure itself, when it is valid.
This last change not only offers a speedup, but it helps us simplify
the code some as well.
- Add a new SELinux policy version which allows for a more space
efficient way of storing the filename transitions in the binary
policy. Given the default Fedora SELinux policy with the unconfined
module enabled, this change drops the policy size from ~7.6MB to
~3.3MB. The kernel policy load time dropped as well.
- Some fixes to the error handling code in the policy parser to
properly return error codes when things go wrong.
Thanks,
-Paul
--
The following changes since commit 8f3d9f354286745c751374f5f1fcafee6b3f3136:
Linux 5.7-rc1 (2020-04-12 12:35:55 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
tags/selinux-pr-20200601
for you to fetch changes up to fe5a90b8c14914397a3bb0c214d142103c1ba3bf:
selinux: netlabel: Remove unused inline function (2020-05-12 20:16:33 -0400)
----------------------------------------------------------------
selinux/stable-5.8 PR 20200601
----------------------------------------------------------------
Ondrej Mosnacek (9):
selinux: drop unnecessary smp_load_acquire() call
selinux: store role transitions in a hash table
selinux: hash context structure directly
selinux: move context hashing under sidtab
selinux: implement new format of filename transitions
selinux: don't produce incorrect filename_trans_count
selinux: simplify range_write()
selinux: fix return value on error in policydb_read()
selinux: do not allocate hashtabs dynamically
Wei Yongjun (1):
selinux: fix error return code in policydb_read()
YueHaibing (1):
selinux: netlabel: Remove unused inline function
Zou Wei (1):
selinux: fix warning Comparison to bool
security/selinux/Makefile | 2 +-
security/selinux/include/netlabel.h | 6 -
security/selinux/include/security.h | 3 +-
security/selinux/ss/context.c | 32 +++
security/selinux/ss/context.h | 11 +-
security/selinux/ss/ebitmap.c | 14 ++
security/selinux/ss/ebitmap.h | 1 +
security/selinux/ss/hashtab.c | 51 ++--
security/selinux/ss/hashtab.h | 13 +-
security/selinux/ss/mls.c | 16 +-
security/selinux/ss/mls.h | 11 +
security/selinux/ss/policydb.c | 451 +++++++++++++++++++++++---------
security/selinux/ss/policydb.h | 15 +-
security/selinux/ss/services.c | 153 +++++-------
security/selinux/ss/services.h | 3 -
security/selinux/ss/sidtab.c | 35 +--
security/selinux/ss/sidtab.h | 1 +
security/selinux/ss/symtab.c | 5 +-
security/selinux/ss/symtab.h | 2 +-
19 files changed, 499 insertions(+), 326 deletions(-)
create mode 100644 security/selinux/ss/context.c
--
paul moore
www.paul-moore.com
