Linux 5.19 Released

Linux v5.19 was released on Sunday, July 31st; the SELinux and audit highlights are below:

SELinux

• The “/sys/fs/selinux/checkreqprot” and “/sys/fs/selinux/disable” runtime configuration files have been deprecated for some time with no active users that we could find. In an effort to move the deprecation process further along we added a five second pause when either checkreqprot is enabled or SELinux is disabled at runtime. In both cases a warning message is printed to the system console that provides a link to a GitHub wiki page describing why the legacy functionality is being disabled and how users can transition to using the new approach.

• Added the anonymous inode class name to the SELinux AVC audit records whenever anonymous inodes are involved, which should make writing and debugging SELinux policy easier. An example was provided by Christian Göttsche, the patch author:

  type=AVC msg=audit(02/16/22 22:02:50.585:216) : avc:  granted
  { create } for  pid=2136 comm=mariadbd anonclass=[io_uring]
  scontext=system_u:system_r:mysqld_t:s0
  tcontext=system_u:system_r:mysqld_iouring_t:s0 tclass=anon_inode
  

• Fixed a memory leak which could occur when mounting filesystems with SELinux mount options.

• More internal SELinux data types were marked as constant values to help prevent unexpected changes.

• A number of minor changes including documentation fixes, coding style corrections, removal of unnecessary code, and pre-processor tweaks.

Audit

• Fixed a memory leak caused when logging information related to loading a kernel module.

• A small number of changes related to audit’s use of fsnotify made necessary by changes in the fsnotify subsystem.

Libseccomp 10 Year Anniversary

Today marks the 10th anniversary of the first libseccomp release, v0.1.0, on June 8, 2012. Over these past 10 years we’ve made 23 different releases based on the work of 65 contributors, achieved 90% code coverage with our tests, met the CII/OpenSSF “Best Practices” requirements, and earned an “A+” for our code quality on LGTM.

Thank you to all of those who have contributed!

Alex Murray
Andreas Schwab
Andrew Jones
Andy Lutomirski
Ashley Lai
Bogdan Purcareata
Brian Cain
Christopher Waldon
Chris Waldon
Colin Walters
Corey Bryant
David Drysdale
Eduardo Otubo
Eric Paris
Fabrice Fontaine
Felix Abecassis
Felix Geyer
Giuseppe Scrivano
Heiko Carstens
Helge Deller
Jake Edge
James Cowgill
Jan Engelhardt
Jan Willeke
Jay Guo
Jiannan Guo
Joe MacDonald
John Paul Adrian Glaubitz
Jonah Petri
Justin Cormack
Kees Cook
Kyle R. Conway
Kenta Tada
Kir Kolyshkin
Lin, Yong Xiang
Luca Bruno
Manabu Sugimoto
Marcin Juszkiewicz
Marcus Meissner
Markos Chandras
Mathias Krause
Max Rees
Michael Forney
Michael Karcher
Mike Frysinger
Mike Strosaker
Miroslav Lichvar
Paul Moore
Rodrigo Campos
Rolf Eike Beer
Samanta Navarro
Sascha Grunert
Serge Hallyn
Stéphane Graber
Stephen Coleman
Thiago Marcos P. Santos
Tobias Klauser
Tom Hromatka
Tudor Brindus
Tycho Andersen
Tyler Hicks
Valoq
Vicente Olivert Riera
Vitaly Vi Shukela
Vladimir Rutsky

Linux 5.18 Released

Linux v5.18 was released on Sunday, May 22nd; the SELinux and audit highlights are below:

SELinux

• Add a new policy capability, “ioctl_skip_cloexec”, which allows the FIOCLEX and FIONCLEX ioctls independently of the loaded SELinux policy when enabled.

• Implement the security_sctp_assoc_established() hook in SELinux to ensure that the SCTP peer labeling behavior is consistent on both the client and server side. The kernel’s SCTP documentation provides more information on how the SCTP peer labeling behavior:

  An SCTP socket will only have one peer label assigned to it. This will be assigned during the establishment of the first association. Any further associations on this socket will have their packet peer label compared to the socket’s peer label, and only if they are different will the association permission be validated. This is validated by checking the socket peer sid against the received packets peer sid to determine whether the association should be allowed or denied.

• Reworked how SELinux processes the filesystem mount contexts in an effort to simplify the kernel code and ensure that memory allocations are not attempted when it is inappropriate, e.g. when a spinlock is held. This work did introduce a new restriction in that the new mount API requires that the SELinux policy is loaded before passing filesystem contexts to the mount API.

• Add SELinux netlink message mappings for RTM_NEWTUNNEL, RTM_DELTUNNEL, RTM_GETTUNNEL, and RTM_SETSTATS. The new tunnel, delete tunnel, and hardware offload stat commands map to the “netlink_route_socket:nlmsg_write” permission while the get tunnel command maps to the “netlink_route_socket:nlmsg_read” permission.

• Fixed problems in the error handling of the kernel’s SELinux policy loading code.

• Fixed a problem with stacked LSMs when accessing a filesystem’s superblock.

• More kernel internal variables and function parameters were marked as constant values to help prevent unintended modification in the SELinux kernel code.

• Fixed a number of RCU variable marking mismatches.

• Minor internal style, type casting, and dead code fixes.

Audit

• Change how the “AUDIT_TIME_*” records are generated such that the time related records are only generated when they are associated with a corresponding syscall. This should help reduce the time related noise in the audit logs.

• Fixed a problem where a task’s audit context might not be properly reset when using io_uring.