From: Linus Torvalds Date: Tue, 25 Mar 2025 22:52:32 +0000 (-0700) Subject: Merge tag 'selinux-pr-20250323' of git://git.kernel.org/pub/scm/linux/kernel/git... X-Git-Tag: io_uring-6.15-20250403~110 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=59c017ce9ec77953ca5198b41d4101f57dd4af0d;p=linux-block.git Merge tag 'selinux-pr-20250323' of git://git./linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Add additional SELinux access controls for kernel file reads/loads The SELinux kernel file read/load access controls were never updated beyond the initial kernel module support, this pull request adds support for firmware, kexec, policies, and x.509 certificates. - Add support for wildcards in network interface names There are a number of userspace tools which auto-generate network interface names using some pattern of - where is a fixed string, e.g. "podman", and is a increasing counter. Supporting wildcards in the SELinux policy for network interfaces simplifies the policy associted with these interfaces. - Fix a potential problem in the kernel read file SELinux code SELinux should always check the file label in the security_kernel_read_file() LSM hook, regardless of if the file is being read in chunks. Unfortunately, the existing code only considered the file label on the first chunk; this pull request fixes this problem. There is more detail in the individual commit, but thankfully the existing code didn't expose a bug due to multi-stage reads only taking place in one driver, and that driver loading a file type that isn't targeted by the SELinux policy. - Fix the subshell error handling in the example policy loader Minor fix to SELinux example policy loader in scripts/selinux due to an undesired interaction with subshells and errexit. * tag 'selinux-pr-20250323' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: get netif_wildcard policycap from policy instead of cache selinux: support wildcard network interface names selinux: Chain up tool resolving errors in install_policy.sh selinux: add permission checks for loading other kinds of kernel files selinux: always check the file label in selinux_kernel_read_file() selinux: fix spelling error --- 59c017ce9ec77953ca5198b41d4101f57dd4af0d