Linux 4.9 Released

Linux 4.9 was released the past weekend, on December 11th. Here is a quick summary of the SELinux and audit changes.

SELinux

• Provide proper SELinux support for overlayfs, a filesystem very important for container workloads.

• Remove the SECURITY_SELINUX_POLICYDB_VERSION_MAX Kconfig option, its last meaningful use was in the Fedora Core 3 and 4 timeframe.

• Additional security policy sanity and bounds checking.

Audit

• Add AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND to the audit kernel feature bitmap to indicate the expanded exclude filters merged in Linux 4.8.

• Fix a number of problems in the code to ensure that the PIDs recorded in various audit records always match userspace’s view of the process/PID.

• Prefix the “ioctlcmd” field data with a “0x” to indicate the value is represented in hexadecimal.