Linux 6.14 Merge Window

22 Jan 2025 tags: audit lsm selinux

Linux v6.13 was released on Sunday, with the Linux v6.14 merge window opening immediately afterwards. Below are the highlights of the LSM, SELinux, and Audit pull requests which have been merged into Linus’ tree.

LSM

• Migrate away from the legacy LSM secctx string label interface to a new lsm_context structure. While this presents a relatively minor change to most callers within the kernel, this improvement makes it easier to support multiple simultaneous LSMs now, and in the future when new LSMs are added.

• Modify the LSM’s kernel build configuration to only build the LSM framework’s common audit code when both the LSM and audit subsystems are enabled. This should provide a minor build time improvement for those who build kernels with the LSM enabled but without audit support.

• Add a sanity check to the SafeSetID policy loading functions to restrict the policy size to KMALLOC_MAX_SIZE. As SafeSetID policy rules take the form of “UID:UID”, this limit is well beyond any legitimate policy rule, and should serve to limit a number of automated fuzzing reports that we have recently received against SafeSetID.

• A number of smaller improvements to the kernel selftests, constification of some function parameters, removing redundant assignments, and local variable renames to improve readability.

SELinux

• Add support for SELinux extended permissions, aka “xperms”, in conditional policy blocks. This allows admins to toggle the granular xperms using SELinux booleans, helping pave the way for greater use of xperms in general purpose SELinux policies. This change bumps the maximum SELinux policy version to 34.

• Fix a SELinux/SCTP bind(2) error code inconsistency when the “extended_socket_class” policy capability is not enabled in the loaded policy.

• Minor change to the SELinux kernel makefile to ensure that the generated SELinux header files are properly cleaned up between kernel builds.

• A number of smaller changes to reduce code duplication, reduce pointer lookups, migrate void pointers to defined types, simplify code, constify function parameters, and correct iterator types.

Audit

• Fix a problem where pathnames were not being properly logged by audit in the audit PATH record. Symptoms would include a “name=(null)” entry instead of the valid file pathname. Users who have noticed missing pathnames are encouraged to try Linux v6.14-rc1, or later.