Linus, Three SELinux fixes for v6.11-rcX: - Fix a xperms counting problem where we adding to the xperms count even if we failed to add the xperm. - Propogate errors from avc_add_xperms_decision() back to the caller so that we can trigger the proper cleanup and error handling. - Revert our use of vma_is_initial_heap() in favor of our older logic as vma_is_initial_heap() doesn't correctly handle the no-heap case and it is causing issues with the SELinux process/execheap access control. While the older SELinux logic may not be perfect, it restores the expected user visible behavior. Hopefully we will be able to resolve the problem with the vma_is_initial_heap() macro with the mm folks, but we need to fix this in the meantime. -Paul -- The following changes since commit 8400291e289ee6b2bf9779ff1c83a291501f017b: Linux 6.11-rc1 (2024-07-28 14:19:55 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git tags/selinux-pr-20240814 for you to fetch changes up to 05a3d6e9307250a5911d75308e4363466794ab21: selinux: revert our use of vma_is_initial_heap() (2024-08-08 16:22:47 -0400) ---------------------------------------------------------------- selinux/stable-6.11 PR 20240814 ---------------------------------------------------------------- Paul Moore (1): selinux: revert our use of vma_is_initial_heap() Zhen Lei (2): selinux: fix potential counting error in avc_add_xperms_decision() selinux: add the processing of the failure of avc_add_xperms_decision() security/selinux/avc.c | 8 ++++++-- security/selinux/hooks.c | 12 +++++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) -- paul-moore.com
