Linus, I'm expecting to have spotty network access later this week and early into next so I'm sending my v6.13 merge window pull requests a bit earlier than normal. The SELinux highlights are below: - Add support for netlink xperms Some time ago we added the concept of "xperms" to the SELinux policy so that we could write policy for individual ioctls, this pull request builds upon this by using extending xperms to netlink so that we can write SELinux policy for individual netlnk message types and not rely on the fairly coarse read/write mapping tables we currently have. There are limitations involving generic netlink due to the multiplexing that is done, but it's no worse that what we currently have. As usual, more information can be found in the commit message. - Deprecate /sys/fs/selinux/user We removed the only known userspace use of this back in 2020 and now that several years have elapsed we're starting down the path of deprecating it in the kernel. - Cleanup the build under scripts/selinux A couple of patches to move the genheaders tool under security/selinux and correct our usage of kernel headers in the tools located under scripts/selinux. While these changes originated out of an effort to build Linux on different systems, they are arguably the right thing to do regardless. - Minor code cleanups and style fixes Not much to say here, two minor cleanup patches that came out of the netlink xperms work. -Paul -- The following changes since commit 9852d85ec9d492ebef56dc5f229416c925758edc: Linux 6.12-rc1 (2024-09-29 15:06:19 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git tags/selinux-pr-20241112 for you to fetch changes up to d7b6918e22c74f2b354d8dc0ef31ab17ae334b93: selinux: Deprecate /sys/fs/selinux/user (2024-10-07 16:39:49 -0400) ---------------------------------------------------------------- selinux/stable-6.13 PR 20241112 ---------------------------------------------------------------- Masahiro Yamada (2): selinux: do not include <linux/*.h> headers from host programs selinux: move genheaders to security/selinux/ Paul Moore (2): selinux: streamline selinux_nlmsg_lookup() selinux: apply clang format to security/selinux/nlmsgtab.c Stephen Smalley (1): selinux: Deprecate /sys/fs/selinux/user Thiébaud Weksteen (1): selinux: Add netlink xperm support Documentation/ABI/obsolete/sysfs-selinux-user | 12 scripts/remove-stale-files | 3 scripts/selinux/Makefile | 2 scripts/selinux/genheaders/.gitignore | 2 scripts/selinux/genheaders/Makefile | 5 scripts/selinux/mdp/Makefile | 2 scripts/selinux/mdp/mdp.c | 4 security/selinux/.gitignore | 1 security/selinux/Makefile | 7 security/selinux/genheaders.c | 3 security/selinux/hooks.c | 51 ++ security/selinux/include/classmap.h | 19 security/selinux/include/initial_sid_to_string.h | 4 security/selinux/include/policycap.h | 1 security/selinux/include/policycap_names.h | 1 security/selinux/include/security.h | 6 security/selinux/nlmsgtab.c | 299 +++++++-------- security/selinux/selinuxfs.c | 4 security/selinux/ss/avtab.h | 5 security/selinux/ss/services.c | 78 ++- 20 files changed, 295 insertions(+), 214 deletions(-) -- paul-moore.com
