mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-24 19:10:26 +00:00
b5628b81bd
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmg17c0UHHBhdWxAcGF1 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPLZhAAoEOtbcgImq6Qn8vH0rPcA0y5n2as Seg7lfz3HFFo1R8aV8d3PIHbmbhpW2EnLJnDQS3lhgzRCzM9/seXOkX47P7hyu7L IJvZ9RU1JFhLU/7y4p3KsGJGowNoVVaJLRlD/IpwzX3osBOImZBTCy28lfD608g3 RSC1CMIsTuKnWPD+7CFy62pZDixRP/MhxCleTnN7qH/65N6UnqT0rolEgqJUlfZ4 Gji5GVXLIWjEnz2fkCearxqjA6STz8SAYgYoysgWSZoyhbGMetCTaVQj6iXcwqJO yX39jxoI4XymcxCwa/aypeCB1PllkO86qPJ7coJA+v5EHnuRXzQ/XANiNtTRZUlg itGr8/H4CABVMKsuEqw4lU587b42kVnrS6JIETdqzRievtBoNmp6RTXTQvd8w7GV zvAyWgl1gSBWRWCZN9UVA9w76sL6NL4alaFhAUQ352oMiSODwfS7ooiki5V8GAe7 SvCl1WgrBmhUS87MFnXk9p2YzWcrUdOdsqHCm3JFGqepE5czWtDZ8fAzW5STrkYL eJiIbOM6qxDW8uiFXtenp8FXg31iWmR4/N1fjK3vQ5jVIYQDjWAlKG/WYxGK84Nf IS/MvKQgJU0+j3LoZX/Fr5hz3uZSFHUV+ZjpniF8y6x/MAbg1Q4IYuDDJpNP96rP fG2k78KSx8q3ckk= =6ljO -----END PGP SIGNATURE----- Merge tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Reduce the SELinux impact on path walks. Add a small directory access cache to the per-task SELinux state. This cache allows SELinux to cache the most recently used directory access decisions in order to avoid repeatedly querying the AVC on path walks where the majority of the directories have similar security contexts/labels. My performance measurements are crude, but prior to this patch the time spent in SELinux code on a 'make allmodconfig' run was 103% that of __d_lookup_rcu(), and with this patch the time spent in SELinux code dropped to 63% of __d_lookup_rcu(), a ~40% improvement. Additional improvments can be expected in the future, but those will require additional SELinux policy/toolchain support. - Add support for wildcards in genfscon policy statements. This patch allows for wildcards in the genfscon patch matching logic as opposed to the prefix matching that was used prior to this change. Adding wilcard support allows for more expressive and efficient path matching in the policy which is especially helpful for sysfs, and has resulted in a ~15% boot time reduction in Android. SELinux policies can opt into wilcard matching by using the "genfs_seclabel_wildcard" policy capability. - Unify the error/OOM handling of the SELinux network caches. A failure to allocate memory for the SELinux network caches isn't fatal as the object label can still be safely returned to the caller, it simply means that we cannot add the new data to the cache, at least temporarily. This patch corrects this behavior for the InfiniBand cache and does some minor cleanup. - Minor improvements around constification, 'likely' annotations, and removal of bogus comments. * tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix the kdoc header for task_avdcache_update selinux: remove a duplicated include selinux: reduce path walk overhead selinux: support wildcard match in genfscon selinux: drop copy-paste comment selinux: unify OOM handling in network hashtables selinux: add likely hints for fast paths selinux: contify network namespace pointer selinux: constify network address pointer |
History
|
|
|---|---|---|
| .. | ||
| apparmor | ||
| bpf | ||
| integrity | ||
| ipe | ||
| keys | ||
| landlock | ||
| loadpin | ||
| lockdown | ||
| safesetid | ||
| selinux | ||
| smack | ||
| tomoyo | ||
| yama | ||
| commoncap.c | ||
| device_cgroup.c | ||
| inode.c | ||
| Kconfig | ||
| Kconfig.hardening | ||
| lsm_audit.c | ||
| lsm_syscalls.c | ||
| Makefile | ||
| min_addr.c | ||
| security.c | ||