06 Apr 2025 tags: audit lsm selinux Linux v6.14 was released two weeks ago on March 24th, with the Linux v6.15 merge window opening immediately afterwards. Below are the highlights of the LSM and SELinux pull requests which have been merged into Linus’ tree. There were no patches queued in the audit tree for Linux v6.15.
LSM
-
While only tangentially related to the LSM framework, due to a lack of a clear maintainer for the Linux kernel’s credentials code, I have volunteered to serve in that role and Serge Hallyn has volunteered to serve as a formal reviewer. Considering the relatively low volume of credential related patches, I plan to accept the patches into the LSM tree, but this could change in the future if the volume increases.
-
Minor updates to the Rust LSM and credentials bindings, fixing code comments and inlining several methods.
-
Remove an unused parameter from the security_perf_event_open() LSM hook.
SELinux
-
Add a new LSM hook and SELinux implementation to the io_uring_allowed() function. The new SELinux permission, io_uring/allowed, controls the ability of the currently running SELinux domain to use the io_uring_setup(2) syscall.
-
Add additional SELinux access controls for kernel file reads and loads from userspace. The new controls add support for firmware images via the system/firmware_load permission, kexec kernels via system/kexec_image_load, kexec initramfs images via system/kexec_initramfs_load, system policies via system/policy_load, and X.509 certificates via system/x509_certificate_load.
-
Add the file/watch_mountns permission to control access to watching for changes to the mount namespace. Changes include the addition of a new filesystem mount, removal of an existing mount, or moving a mount in a namespace.
-
Add support for network interface name wildcard matching in SELinux policy. This makes it easier for policy developers to support tools which auto generate network interfaces according to a pattern, e.g. nic0, nic1, nic2, etc. In order to enable the wildcard matching in the SELinux policy, the policy must also set the netif_wildcard policy capability.
-
Fix a potential future issue in the SELinux kernel read file controls. While this wasn’t a problem with the existing SELinux kernel module read controls, there was an issue where SELinux did not properly enforce policy on the kernel’s chunked file reads. As this was fixed at the same time we added support for kernel file read types that include chunked reads, users do not have to worry about security regressions or vulnerabilities related to this issue.
-
Fix a subshell error handling issue in the kernel’s example policy loading script. Error conditions should now be properly caught and error messages displayed to the caller.
04 Apr 2025 tags: audit lsm selinux Linux v6.14 was released on Monday, March 24th. I already wrote up a post highlighting the LSM, SELinux, and audit changes that were submitted during the merge window. However, there was one additional change that went into Linux v6.14 that I missed in my merge window highlights post.
Audit
- Add a new audit field, “nl-msgtype”, to record Netlink message types in relevant audit records.
In addition to my highlights, LWN.net provides a nice overall summary of the kernel changes made during the first and second weeks of the merge window.
22 Jan 2025 tags: audit lsm selinux Linux v6.13 was released on Sunday, with the Linux v6.14 merge window opening immediately afterwards. Below are the highlights of the LSM, SELinux, and Audit pull requests which have been merged into Linus’ tree.
LSM
-
Migrate away from the legacy LSM secctx string label interface to a new lsm_context structure. While this presents a relatively minor change to most callers within the kernel, this improvement makes it easier to support multiple simultaneous LSMs now, and in the future when new LSMs are added.
-
Modify the LSM’s kernel build configuration to only build the LSM framework’s common audit code when both the LSM and audit subsystems are enabled. This should provide a minor build time improvement for those who build kernels with the LSM enabled but without audit support.
-
Add a sanity check to the SafeSetID policy loading functions to restrict the policy size to KMALLOC_MAX_SIZE. As SafeSetID policy rules take the form of “UID:UID”, this limit is well beyond any legitimate policy rule, and should serve to limit a number of automated fuzzing reports that we have recently received against SafeSetID.
-
A number of smaller improvements to the kernel selftests, constification of some function parameters, removing redundant assignments, and local variable renames to improve readability.
SELinux
-
Add support for SELinux extended permissions, aka “xperms”, in conditional policy blocks. This allows admins to toggle the granular xperms using SELinux booleans, helping pave the way for greater use of xperms in general purpose SELinux policies. This change bumps the maximum SELinux policy version to 34.
-
Fix a SELinux/SCTP bind(2) error code inconsistency when the “extended_socket_class” policy capability is not enabled in the loaded policy.
-
Minor change to the SELinux kernel makefile to ensure that the generated SELinux header files are properly cleaned up between kernel builds.
-
A number of smaller changes to reduce code duplication, reduce pointer lookups, migrate void pointers to defined types, simplify code, constify function parameters, and correct iterator types.
Audit
- Fix a problem where pathnames were not being properly logged by audit in the audit PATH record. Symptoms would include a “name=(null)” entry instead of the valid file pathname. Users who have noticed missing pathnames are encouraged to try Linux v6.14-rc1, or later.
