Linux 7.1 Released

17 Jun 2026 tags: audit lsm selinux

Linux v7.1 was released this past Sunday, June 14th. I previously wrote about the LSM, SELinux, and audit changes that were submitted this release, and LWN.net did their usual good job of covering the first and second weeks of the merge window. However, there were additional changes that went into Linux v7.1 during the release candidate phase that are described below.

LSM

• Added a new LSM hook, security_unix_find(), to allow pathname based LSMs such as AppArmor and Landlock, to enforce access controls on named UNIX socket connections using the socket’s pathname.

• Fixed a problem where we were not taking the credential mutex when updating the current task’s LSM attributes using the lsm_set_self_attr(2) syscall.

SELinux

• Finished the deprecation and removal of the “/sys/fs/selinux/user” API which was used to list the SELinux security contexts that were reachable for a given user and starting context. The last known user, libselinux, stopped using this API in 2020 and the removal was scheduled for December 2025 or later. While the “/sys/fs/selinux/user” file still exists, writing to it has no effect other than to write a single error message to the system’s console.

• While the “/sys/fs/selinux/checkreqprot” and “/sys/fs/selinux/disable” APIs have been deprecated and made ineffective for some time, writing to those files would still trigger some kernel code. Starting with Linux v7.1 that code has been removed and writing to those files will only trigger a single error message on the system’s console.

• Fixed a problem where the per-task directory access cache introduced in Linux v6.16 was incorrectly caching information that controlled the generation of AVC audit records, leading to potentially missing audit records in some circumstances.

• Fixed a problem where SELinux was not properly accessing the SELinux state associated with a socket object in the kernel, leading to potential conflicts with other LSM simultaneously running on the system.

• Fixed a problem where SELinux would always reserve an extended attribute slot even if wasn’t going to be used. As the kernel stops parsing the list of extended attributes when it encounters an empty slot, depending on the system’s configuration there was a possibility that SELinux could obscure the extended attributes of other LSMs.

• Enabled multiple opens of “/sys/fs/selinux/policy” whereas previously only a single open was allowed across the entire system. The related code quality was also improved by shrinking locked sections and removing unnecessary BUG() macros.

• Improved the code quality in the SELinux policy loading code by shrinking the locked section.

Audit

• Fixed a problem where the inheritable capability set was incorrectly logged in the audit CAPSET records. The effective capability set was mistakenly recorded as the inheritable set.

• Fixed a problem where the audit configuration lock was not properly enforced on the AUDIT_TRIM and AUDIT_MAKE_EQUIV operations.

Linux 7.1 Merge Window

14 Apr 2026 tags: audit lsm selinux

Linux v7.0 was released on Sunday, April 12th, with the Linux v7.1 merge window opening immediately afterwards. Below are the highlights of the LSM, SELinux, and audit pull requests which have been merged into Linus’ tree.

LSM

• A LSM security blob was added to the backing_file structure, along with the associated LSM management hooks, as well as a new hook for controlling the memory mapping of an overlayfs backing file to resolve problems with the mmap(2) and mprotect(2) operations on overlayfs files. Those LSMs which enforce memory mapping access controls on overlayfs files will likely need to be use these new additions to ensure proper security policy enforcement.

• Minor changes to leverage kstrdup_const() and kfree_const() in securityfs.

• A number of small kernel-doc warnings were fixed.

SELinux

• Updated the existing SELinux mmap(2) and mprotect(2) access control implementations to leverage the new LSM additions and ensure that security policies involving overlayfs files are properly enforced. Unlike traditional filesystems where only the process acting on the file must have the necessary permissions for an action to succeed, on overlayfs files not only must the process acting on the user visible file have the necessary permissions, but the filesystem’s mounting process must also have the necessary permissions on the underlying backing file.

• A known, and harmless, race condition was annotated to quiet a KCSAN warning.

Audit

• Additional input checking was added to catch unknown AUDIT_SET requests sent from userspace. Current kernels silently ignore any AUDIT_SET requests that were not understood and only returned an error if any of the known requests failed. This makes it difficult for userspace tools to determine what a given kernel supports in an AUDIT_SET request. Starting with Linux v7.1 if an AUDIT_SET request is made where at least one portion of the request is unknown, an -EINVAL error code will be returned to the user.

• A number of small style and formatting cleanups to the audit kernel code.

Linux 7.0 Released

12 Apr 2026 tags: audit lsm selinux

Linux v7.0 was released a few hours ago on Sunday, April 12th. Unfortunately, due to my personal schedule and some other challenges, I never had a chance to write up my usual summary of the LSM, SELinux, and audit highlights from the v7.0 merge window; thankfully LWN.net did their usual good job of summarizing both the first and second weeks of the merge window.

Below is a list of the LSM, SELinux, and audit highlights from the Linux v7.0 merge window through to the tagged release from Linus.

LSM

• Unified the security_inode_listsecurity() calls in NFSv4. While looking at the security_inode_listsecurity() LSM hook with the goal of improving the API, we realized that the NFSv4 code was making multiple calls to the LSM hook that could be consolidated into one. While this change improves the quality of the NFSv4 code, it will also enable additional future work to improve the LSM API.

• Move from kmalloc() to kmalloc_obj() and kmalloc_flex() as part of a tree-wide conversion that is described in this article from LWN.net.

• Resolved a number of Sparse warnings caused by the LSM static branch keys not being marked as static.

• Added __rust_helper annotations to the LSM and credential Rust wrapper functions.

• Removed the unsused set_security_override_from_ctx() function.

• Minor improvements to the LSM hook kdoc comment blocks.

SELinux

• Added support for applying SELinux policy to BPF tokens. This involves the addition of two new permissions to the bpf object class, map_create_as and prog_load_as, as well as a new policy capability, bpf_token_perms, to enable the new functionality. The patch author, Eric Suen, describes the change in his patch description:

  This patch adds SELinux support for controlling BPF token access. With this change, SELinux policies can now enforce constraints on BPF token usage based on both the delegating (privileged) process and the recipient (unprivileged) process.

  Supported operations currently include:

  • map_create
  • prog_load

  High-level workflow:

  1. An unprivileged process creates a VFS context via fsopen() and obtains a file descriptor.
  2. This descriptor is passed to a privileged process, which configures BPF token delegation options and mounts a BPF filesystem.
  3. SELinux records the creator_sid of the privileged process during mount setup.
  4. The unprivileged process then uses this BPF fs mount to create a token and attach it to subsequent BPF syscalls.
  5. During verification of map_create and prog_load, SELinux uses creator_sid and the current SID to check policy permissions via:

     avc_has_perm(creator_sid, current_sid, SECCLASS_BPF,
             BPF__MAP_CREATE, NULL);
     

  The implementation introduces two new permissions:

  • map_create_as
  • prog_load_as

  At token creation time, SELinux verifies that the current process has the appropriate *_as permission (depending on the allowed_cmds value in the bpf_token) to act on behalf of the creator_sid.

  Example SELinux policy:

  allow test_bpf_t self:bpf {
    map_create map_read map_write prog_load prog_run
    map_create_as prog_load_as
  };
  

  Additionally, a new policy capability bpf_token_perms is added to ensure backward compatibility. If disabled, previous behavior (checks based on current process SID) is preserved.

• As described earlier in this post, convert a number of kmalloc() calls to kmalloc_obj() and kmalloc_flex() as part of a larger tree-wide conversion.

• Removed a BUG() macro call that was no longer necessary as the error condition is now checked at kernel build time.

Audit

• Add source and destination port information to the NETFILTER_PKT audit records while consolidating much of the netfilter packet audit code into a new function which can be easily disabled when audit is not enabled at kernel build time. These changes should not only improve the usefulness of the audit logs through network port information, it should also provide a minor performance boost for systems built without audit.

• Update the audit syscall classifier code to include the listxattrat(), getxattrat(), and fchmodat2() syscalls.

• As described earlier in this post, convert a number of kmalloc() calls to kmalloc_obj() and kmalloc_flex() as part of a larger tree-wide conversion.

• A number of small, internal changes to how audit tracks and records pathnames brought about by some related work in the VFS subsystem. There should be no user visible changes.

• Move a handful of declarations in the code to resolve a number of Sparse warnings.