qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,368,620 Commits 4 Branches 1,113 Tags
main
Commit Graph
6303 Commits
Author SHA1 Message Date
CKI KWF Bot 8664709d12 Merge: SELinux TCP/MPTCP connect check bypass via TCP Fast Open 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3056

JIRA: https://redhat.atlassian.net/browse/RHEL-222799

Backported from tree(s): linux

```
selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 44c74d27d1b9aaa99fa8a83640c1223575262b80)

```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
[^footer]: Created 2026-08-03 08:12 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer]

Approved-by: Ondrej Mosnáček <omosnacek@gmail.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-08-11 13:38:13 +00:00
CKI KWF Bot 1ea525c43b Merge: CNB103: net: Retire DCCP socket 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2649

JIRA: https://redhat.atlassian.net/browse/RHEL-179873

Commits:
```
9aba55b1fbef ("selinux: apply clang format to security/selinux/nlmsgtab.c")
b2bdce7adc90 ("selftest: net: Remove DCCP bits.")
2a63dd0edf38 ("net: Retire DCCP socket.")
22d6c9eebf2e ("net: Unexport shared functions for DCCP.")
235bd9d21fcd ("tcp: Rename tcp_or_dccp_get_hashinfo().")
9db0163e3cad ("tcp: Remove sk_protocol test for tcp_twsk_unique().")
2d842b6c670b ("tcp: Remove timewait_sock_ops.twsk_destructor().")
8150f3a44b17 ("tcp: Remove hashinfo test for inet6?_lookup_run_sk_lookup().")
cb16f4b6c73d ("tcp: Don't pass hashinfo to socket lookup helpers.")
f1241200cd66 ("tcp: Don't pass hashinfo to inet_diag helpers.")
382a4d9cb6dc ("tcp: Move TCP-specific diag functions to tcp_diag.c.")
425e080a1c34 ("dccp Remove inet_hashinfo2_init_mod().")
e7a614c008efb ("selinux: suppress warning flood for retired DCCP netlink messages")
```

Signed-off-by: Ivan Vecera <ivecera@redhat.com>

Approved-by: Ondrej Mosnáček <omosnacek@gmail.com>
Approved-by: Felix Maurer <fmaurer@redhat.com>
Approved-by: Ivan Vecera <ivecera@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-08-06 11:46:37 +00:00
CKI Backport Bot c62dff7d61 selinux: check connect-related permissions on TCP Fast Open 
JIRA: https://redhat.atlassian.net/browse/RHEL-222799
Backported from tree(s): linux

selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 44c74d27d1b9aaa99fa8a83640c1223575262b80)
Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
 2026-08-03 08:12:15 +00:00
CKI KWF Bot c3d8f86ad3 Merge: Proper upstream fix for CVE-2026-46054 execmem regression 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2922

```
JIRA: https://redhat.atlassian.net/browse/RHEL-189741

This MR reverts the temporary fix for a regression caused by the fix for
CVE-2026-46054 with the final fix that was accepted upstream.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
```

Approved-by: Richard Guy Briggs <rgb@redhat.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Approved-by: Vladislav Dronov <vdronov@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-07-25 01:08:03 +00:00
CKI KWF Bot 5dabec8f8f Merge: CVE-2025-71147: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2885

JIRA: https://redhat.atlassian.net/browse/RHEL-189607
CVE: CVE-2025-71147

Backported from tree(s): linux

```
KEYS: trusted: Fix a memory leak in tpm2_load_cmd

'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode'
but it is not freed in the failure paths. Address this by wrapping the blob
into with a cleanup helper.

Cc: stable@vger.kernel.org # v5.13+
Fixes: f221974525 ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
(cherry picked from commit 62cd5d480b9762ce70d720a81fa5b373052ae05f)

```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
[^footer]: Created 2026-07-07 14:40 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer]

Approved-by: Thomas Huth <thuth@redhat.com>
Approved-by: Štěpán Horáček <shoracek@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-07-25 01:07:58 +00:00
Ondrej Mosnacek 18928b91c9 selinux: fix incorrect execmem checks on overlayfs 
JIRA: https://redhat.atlassian.net/browse/RHEL-189741
Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git

commit 9fe595fad54d4ac6a402edb3f60bec859d52cea6
Author: Ondrej Mosnacek <omosnace@redhat.com>
Date:   Tue Jul 14 14:57:59 2026 +0200

    selinux: fix incorrect execmem checks on overlayfs

    The commit fixing the overlayfs mmap() and mprotect() access checks
    failed to skip the execmem check in __file_map_prot_check() for the case
    where the "mounter check" is being performed. This check should be
    performed only against the credentials of the task that is calling
    mmap()/mprotect(), since it doesn't pertain to the file itself, but
    rather just gates the ability of the calling task to get an executable
    memory mapping in general.

    The purpose of the "mounter check" is to guard against using an
    overlayfs mount to gain file access that would otherwise be denied to
    the mounter. For execmem this is not relevant, as there is no further
    file access granted based on it (notice that the file's context is not
    used as the target in the check), so checking it also against the
    mounter credentials would be incorrect.

    Fix this by passing a boolean to [__]file_map_prot_check() and
    selinux_mmap_file_common() that indicates if we are doing the "mounter
    check" and skiping the execmem check in that case. Since this boolean
    also indicates if we use current_cred() or the mounter cred as the
    subject, also remove the "cred" argument from these functions and
    determine it based on the boolean and the file struct.

    Cc: stable@vger.kernel.org
    Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks")
    Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
    Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-07-15 15:17:43 +02:00
Ondrej Mosnacek 86194a9eda Revert "selinux: RHEL-only hotfix for execmem regression" 
JIRA: https://redhat.atlassian.net/browse/RHEL-189741
Upstream Status: RHEL10-only

This reverts commit 7afc16c3e0. It will be
subsequently replaced by its upstream equivalent.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-07-15 15:17:36 +02:00
Ivan Vecera 3ed3df0d12 selinux: suppress warning flood for retired DCCP netlink messages 
JIRA: https://redhat.atlassian.net/browse/RHEL-179873

commit e7a614c008efb2f4a5db980be3a4b13b6a170a50
Author: Yafang Shao <laoar.shao@gmail.com>
Date:   Thu Jul 9 14:31:28 2026 +0800

    selinux: suppress warning flood for retired DCCP netlink messages

    When deploying linux-6.18.y stable kernel to production servers, we
    observed kernel dmesg being flooded with SELinux warnings when running
    `ss -l`:

      SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 \
        sclass=netlink_tcpdiag_socket pid=188945 comm=ss

    The root cause is that DCCP support was retired in
    commit 2a63dd0edf38 ("net: Retire DCCP socket."). Consequently,
    DCCPDIAG_GETSOCK was removed from nlmsg_tcpdiag_perms. This causes
    nlmsg_perm() to return -EINVAL, triggering the SELinux warning for every
    `ss -l` invocation [0].

    Use pr_warn_once() for the retired DCCPDIAG_GETSOCK to prevent message
    flooding.

    Link: https://github.com/iproute2/iproute2/blob/main/misc/ss.c#L3901 [0]
    Fixes: 2a63dd0edf38 ("net: Retire DCCP socket.")
    Suggested-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
    Cc: Kuniyuki Iwashima <kuniyu@google.com>
    Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
    Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Conflicts:
- security/selinux/hooks.c:
  small context conflict in header inclusion area

(cherry picked from commit e7a614c008efb2f4a5db980be3a4b13b6a170a50)
Assisted-by: Patchpal
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
 2026-07-15 10:04:59 +02:00
Alexandra Hájková 28d428edb5 Merge: [RHEL-10] Update MM-core codebase and its dependencies to upstream v6.16 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2267

JIRA: https://redhat.atlassian.net/browse/RHEL-145694

Conflict resolution calls for the following dependency list:\
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2172 \
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2188 \
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2218 \
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2225 \
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2227

CVE: CVE-2024-53219 \
CVE: CVE-2024-57952 \
CVE: CVE-2025-21709 \
CVE: CVE-2025-21896 \
CVE: CVE-2025-21881 \
CVE: CVE-2025-21984 \
CVE: CVE-2025-22034 \
CVE: CVE-2025-38071 \
CVE: CVE-2025-37834 \
CVE: CVE-2025-22030 \
CVE: CVE-2025-37779 \
CVE: CVE-2025-37760 \
CVE: CVE-2025-37908 \
CVE: CVE-2025-37964 \
CVE: CVE-2025-38008 \
CVE: CVE-2025-38029 \
CVE: CVE-2025-38050 \
CVE: CVE-2025-38276 \
CVE: CVE-2025-38359 \
CVE: CVE-2025-38207 \
CVE: CVE-2025-38241 \
CVE: CVE-2025-38242 \
CVE: CVE-2025-38258 \
CVE: CVE-2025-38357 \
CVE: CVE-2025-38518 \
CVE: CVE-2025-38447 \
CVE: CVE-2025-38510 \
CVE: CVE-2025-38519 \
CVE: CVE-2025-39753 \
CVE: CVE-2025-39725 \
CVE: CVE-2025-39879 \
CVE: CVE-2025-39878 \
CVE: CVE-2025-39868 \
CVE: CVE-2025-39941 \
CVE: CVE-2025-40228 \
CVE: CVE-2025-40270 \
CVE: CVE-2026-23109 \
CVE: CVE-2026-43188 \
CVE: CVE-2026-43286 \
CVE: CVE-2026-46121 \
CVE: CVE-2026-46042 \
CVE: CVE-2026-46020 \
CVE: CVE-2026-53162 \
CVE: CVE-2026-53342 \
CVE: CVE-2026-31397 \
CVE: CVE-2026-46284 \
CVE: CVE-2026-31589 \
CVE: CVE-2025-40174

Set of changes to level the RHEL-10 MM-core and dependencies codebase up to upstream's v6.16,\
plus relevant follow-up fixes. To reduce the number of conflicts for the commits in the series,\
this work starts with eight reverts, which are reintroduced later in proper topological order.

This changeset is backporting the upstream series that removes the ZBUD compressed page allocator.\
Customers utilizing the ZSWAP feature, however, will not be affected, as the same changeset makes\
ZSMALLOC the default zpool allocator for the compressed swap feature.

Only the most relevant and non-conflicting follow-up fixes are being backported out-of-order in\
this series. All other follow-up fixes that would require conflict resolution are deferred,\
and their changesets will be picked up by the work being done for the next incremental update (v6.17 and v6.18).

Omitted-fix: b765d69a1adf ("um: Remove outdated comment about STUB_DATA_PAGES")\
Omitted-fix: 44126343d58c ("x86/mm: Disable broadcast TLB flush when PCID is disabled")\
Omitted-fix: 1219e0feaefc ("fs: move initializing f_mode before file_ref_init()")\
Omitted-fix: 711f9b8fbe4f ("fsnotify: disable pre-content and permission events by default")\
Omitted-fix: 2a42754b3104 ("fsnotify: disable notification by default for all pseudo files")\
Omitted-fix: 76f9377cd2ab ("writeback: don't block sync for filesystems with no data integrity guarantees")\
Omitted-fix: 08d9a4580f71 ("tee: shm: Remove refcounting of kernel pages")\
Omitted-fix: b570f37a2ce4 ("mm: Fix a hmm_range_fault() livelock / starvation problem")\
Omitted-fix: 29f40594a281 ("mm/rmap: fix incorrect pte restoration for lazyfree folios")\
Omitted-fix: 9bbffee67ffd ("mm: fix a UAF when vma-\>mm is freed after vma-\>vm_refcnt got dropped")\
Omitted-fix: 743758ccf8be ("Revert "mm/hugetlb: deal with multiple calls to hugetlb_bootmem_alloc"")\
Omitted-fix: a5cdbe9f376f ("mm: shmem: only remove inode from swaplist when it's swapped page count is 0")\
Omitted-fix: 3b617fd3d317 ("mm/vma: enforce VMA fork limit on unfaulted, faulted mremap merge too")\
Omitted-fix: 61f67c230a5e ("mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge")\
Omitted-fix: 1aceed565ff1 ("mm/vmscan: fix demotion targets checks in reclaim/demotion")\
Omitted-fix: 4c0ed883e051 ("mm/page_alloc: fix defrag_mode for non-reclaimable allocations")\
Omitted-fix: 396f57b57200 ("mm, swap: speed up hibernation allocation and writeout")\
Omitted-fix: 939080834fef ("mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP")\
Omitted-fix: 577a1f495fd7 ("mm/huge_memory: fix a folio_split() race condition with folio_try_get()")\
Omitted-fix: f183663901f2 ("mm: consider non-anon swap cache folios in folio_expected_ref_count()")\
Omitted-fix: 878f41243c0d ("mm: page_isolation: avoid unsafe folio reads while scanning compound pages")\
Omitted-fix: a69d1ab971a6 ("mm: Fix a hmm_range_fault() livelock / starvation problem")\
Omitted-fix: d210fdcac9c0 ("mm/damon/core: clear walk_control on inactive context in damos_walk()")\
Omitted-fix: 7071537159be ("mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme")\
Omitted-fix: 33c3f6c2b48c ("mm/damon/core: fix damos_walk() vs kdamond_fn() exit race")\
Omitted-fix: 55da81663b96 ("mm/damon/core: fix damon_call() vs kdamond_fn() exit race")\
Omitted-fix: 26f775a054c3 ("mm/damon/core: avoid use of half-online-committed context")\
Omitted-fix: 139e7a572af0 ("mm/damon/sysfs: dealloc commit test ctx always")\
Omitted-fix: 7fe000eb3290 ("mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure")\
Omitted-fix: eb1074ece72f ("mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure")\
Omitted-fix: d200cfc81c06 ("mm/damon/sysfs-schemes: fix double increment of nr_regions")\
Omitted-fix: fb39444732f0 ("tools/testing/selftests: add forked (un)/faulted VMA merge tests")\
Omitted-fix: 0ace8f2db6b3 ("tools/testing/selftests: add tests for !tgt, src mremap() merges")\
Omitted-fix: f3bd00507f22 ("selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero")\
Omitted-fix: e5d3e1422e92 ("selftests/mm: free dynamically allocated PMD-sized buffers in split_huge_page_test")\
Omitted-fix: a99d34e5ecb9 ("Revert "drm/pagemap: Disable device-to-device migration"")\
Omitted-fix: 1a3c0049b3f5 ("Revert "drm/pagemap: Disable device-to-device migration"")\
Omitted-fix: 546e42c8c6d9 ("riscv: Use an atomic xchg in pudp_huge_get_and_clear()")\
Omitted-fix: b7a2b49bba4e ("apparmor: Fix return in ns_mkdir_op")\
Omitted-fix: f171b55f1441 ("mips: fix HIGHMEM initialization")

The following list of "omitted fixes" is only to placate the greediness of the bot and reduce the noise it causes\
with its "Upstream patches that reference commits in your MR" list:

Omitted-fix: 3de705a43a46 ("mm/vmscan: avoid false-positive -Wuninitialized warning")\
Omitted-fix: 20c098928356 ("kbuild: Bump minimum version of LLVM for building the kernel to 15.0.0")\
Omitted-fix: 200b0d25084d ("arm64: mm: Move KPTI helpers to mmu.c")\
Omitted-fix: 2b81082ad37c ("lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC")\
Omitted-fix: 494d2f508883 ("fuse: use default writeback accounting")\
Omitted-fix: 3efb9800557b ("mm: do not map the shadow stack as THP")\
Omitted-fix: 8fedac321fb0 ("mm/mempolicy: fix weighted interleave auto sysfs name")\
Omitted-fix: 6cbdd9726fb5 ("mm/mglru: use folio_mark_accessed to replace folio_set_active")\
Omitted-fix: 337927d9895a ("x86/build: Remove cc-option from -mskip-rax-setup")\
Omitted-fix: b013ed403197 ("fs: consistently use can_mmap_file() helper")\
Omitted-fix: 6528d29b46d8 ("fs/xfs: transition from deprecated .mmap hook to .mmap_prepare")\
Omitted-fix: 29d69273fefd ("media: remove STA2x11 media pci driver")\
Omitted-fix: a48bd961fb20 ("kbuild: Remove unnecessary 'T' modifier in cmd_ar_builtin_fixup")\
Omitted-fix: e7e1a26b8ddf ("mm/damon/core: set quota-score histogram with core filters")\
Omitted-fix: a089461a5994 ("Documentation/mm: drop pxx_mkdevmap() descriptions from page table helpers")\
Omitted-fix: a55bc4ffc06d ("staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()")\
Omitted-fix: 98cf2d503910 ("mfd: Remove STA2x11 core driver")\
Omitted-fix: 13b6b6209104 ("mm: vmscan: fix dirty folios throttling on cgroup v1 for MGLRU")\
Omitted-fix: ea693aaa5ce5 ("mm/shmem: hold shmem_swaplist spinlock (not mutex) much less")\
Omitted-fix: f2a48f8fb564 ("mm: update outdated comments for removed scan_swap_map_slots()")\
Omitted-fix: cf49b4ebd2ae ("mm/bootmem_info: remove call to kmemleak_free_part_phys()")\
Omitted-fix: a0d9555bf9ea ("ceph: fix num_ops off-by-one when crypto allocation fails")\
Omitted-fix: 0279bed34c22 ("Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()"")\
Omitted-fix: cac190c7674f ("ceph: fix write storm on fscrypted files")\
Omitted-fix: 5dba5cc2e0ff ("mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps")\
Omitted-fix: 8356a5a3b078 ("mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter")\
Omitted-fix: 2c4c3e29897d ("mm/page_alloc: simplify __alloc_pages_slowpath() flow")\
Omitted-fix: 2e3b37a7e48f ("fs: replace mmap hook with .mmap_prepare for simple mappings")\
Omitted-fix: 951ea2f4844c ("fs: convert simple use of generic_file_*_mmap() to .mmap_prepare()")\
Omitted-fix: 0a42d732c136 ("x86/build: Remove cc-option from -mno-fp-ret-in-387")\
Omitted-fix: 237dc6a054f6 ("x86/headers: Replace __ASSEMBLY__ stragglers with __ASSEMBLER__")\
Omitted-fix: 2c6a28f3ef72 ("x86/Kconfig: Clean up LLVM version checks in IBT configurations")\
Omitted-fix: cdea4acce026 ("mm: delete stale comment about cachelines")\
Omitted-fix: 2704ad556cf2 ("x86/Kconfig: Fix lists in X86_EXTENDED_PLATFORM help text")\
Omitted-fix: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older")\
Omitted-fix: 5b44297bcfa4 ("mm/filemap: introduce generic_file_*_mmap_prepare() helpers")\
Omitted-fix: 340b59816bc4 ("mm: kill mm_wr_locked from unmap_vmas() and unmap_single_vma()")\
Omitted-fix: ab3c8e7b8687 ("mm/shmem: update shmem to use mmap_prepare")\
Omitted-fix: 8c90ae8fe5e3 ("fs/ext4: transition from deprecated .mmap hook to .mmap_prepare")\
Omitted-fix: 5e0deb0a6b4e ("arm64: mm: Use generic enum pgtable_level")\
Omitted-fix: c6900f227f89 ("mm/nommu: use file_has_valid_mmap_hooks() helper")\
Omitted-fix: f7a741c53b71 ("mm: do not assume file == vma->vm_file in compat_vma_mmap_prepare()")\
Omitted-fix: 7e6cc9f954aa ("Docs/admin-guide/mm/damon/usage: mark scheme filters sysfs dir as deprecated")\
Omitted-fix: 738a6cf8fc51 ("Merge patch series "convert the majority of file systems to mmap_prepare"")

Additional changes that aren't relevant here:
Omitted-fix: 6d5fbecd0213 ("MIPS: mm: Add check for highmem before removing memory block")
Omitted-fix: 6c6c1fc09de35f409f6971cb9e881103afe5dbe0 ("modpost: require a MODULE_DESCRIPTION()")

Signed-off-by: Rafael Aquini <raquini@redhat.com>

Approved-by: Andrea Arcangeli <aarcange@redhat.com>
Approved-by: Jan Stancek <jstancek@redhat.com>
Approved-by: Luiz Capitulino <luizcap@redhat.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: David Arcari <darcari@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: Jocelyn Falempe <jfalempe@redhat.com>
Approved-by: Felix Maurer <fmaurer@redhat.com>
Approved-by: Michal Schmidt <mschmidt@redhat.com>
Approved-by: ashelat <ashelat@redhat.com>
Approved-by: Petr Oros <poros@redhat.com>
Approved-by: Michael Petlan <mpetlan@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Alexandra Hájková <ahajkova@redhat.com>
 2026-07-14 19:41:14 +02:00
CKI KWF Bot e5290f0ad3 Merge: Update crypto subsystem to upstream kernel 6.14 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2784

JIRA: https://redhat.atlassian.net/browse/RHEL-186630

We need to update the crypto subsysten in the kernel to a newer upstream level to be able to implement requested PQC-related features (and other crypto-related features) in RHEL 10. To break the huge amount of required patches in more digestible chunks, let’s update the crypto subsystem to upstream kernel level 6.14 first.

Omitted-fix: 2f8839e6c5f8e200629fd730aac5dd874c1d2544 ("crypto: ahash - make hash walk functions from ahash.c public")
             - not a real fix, will be backported later

Signed-off-by: Thomas Huth <thuth@redhat.com>

Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Bruno Meneguele <bmeneg@redhat.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: Rafael Aquini <raquini@redhat.com>
Approved-by: Lenny Szubowicz <lszubowi@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-07-10 19:53:11 +00:00
Ivan Vecera f7addd5869 net: Retire DCCP socket. 
JIRA: https://redhat.atlassian.net/browse/RHEL-179873

Conflicts:
- context conflict due to existing backport of 165573e41f2f6 ("tcp:
  secure_seq: add back ports to TS offset")
- some removed DCCP files have in upstream updates that are missing in RHEL
- removed RHEL config for CONFIG_IP_DCCP

commit 2a63dd0edf388802074f1d4d6b588a3b4c380688
Author: Kuniyuki Iwashima <kuniyu@amazon.com>
Date:   Wed Apr 9 19:36:45 2025 -0700

    net: Retire DCCP socket.

    DCCP was orphaned in 2021 by commit 054c4610bd ("MAINTAINERS: dccp:
    move Gerrit Renker to CREDITS"), which noted that the last maintainer
    had been inactive for five years.

    In recent years, it has become a playground for syzbot, and most changes
    to DCCP have been odd bug fixes triggered by syzbot.  Apart from that,
    the only changes have been driven by treewide or networking API updates
    or adjustments related to TCP.

    Thus, in 2023, we announced we would remove DCCP in 2025 via commit
    b144fcaf46 ("dccp: Print deprecation notice.").

    Since then, only one individual has contacted the netdev mailing list. [0]

    There is ongoing research for Multipath DCCP.  The repository is hosted
    on GitHub [1], and development is not taking place through the upstream
    community.  While the repository is published under the GPLv2 license,
    the scheduling part remains proprietary, with a LICENSE file [2] stating:

      "This is not Open Source software."

    The researcher mentioned a plan to address the licensing issue, upstream
    the patches, and step up as a maintainer, but there has been no further
    communication since then.

    Maintaining DCCP for a decade without any real users has become a burden.

    Therefore, it's time to remove it.

    Removing DCCP will also provide significant benefits to TCP.  It allows
    us to freely reorganize the layout of struct inet_connection_sock, which
    is currently shared with DCCP, and optimize it to reduce the number of
    cachelines accessed in the TCP fast path.

    Note that we keep DCCP netfilter modules as requested.  [3]

    Link: https://lore.kernel.org/netdev/20230710182253.81446-1-kuniyu@amazon.com/T/#u #[0]
    Link: https://github.com/telekom/mp-dccp #[1]
    Link: https://github.com/telekom/mp-dccp/blob/mpdccp_v03_k5.10/net/dccp/non_gpl_scheduler/LICENSE #[2]
    Link: https://lore.kernel.org/netdev/Z_VQ0KlCRkqYWXa-@calendula/ #[3]
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Acked-by: Paul Moore <paul@paul-moore.com> (LSM and SELinux)
    Acked-by: Casey Schaufler <casey@schaufler-ca.com>
    Link: https://patch.msgid.link/20250410023921.11307-3-kuniyu@amazon.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>
 2026-07-09 12:32:57 +02:00
Ivan Vecera 9783570d49 selinux: apply clang format to security/selinux/nlmsgtab.c 
JIRA: https://redhat.atlassian.net/browse/RHEL-179873

commit 9aba55b1fbefcbba48333db3f2b77b086172a1cb
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Sep 25 16:11:08 2024 -0400

    selinux: apply clang format to security/selinux/nlmsgtab.c

    Update nlmsgtab.c to better adhere to the kernel coding style guidelines.

    Signed-off-by: Paul Moore <paul@paul-moore.com>

(cherry picked from commit 9aba55b1fbefcbba48333db3f2b77b086172a1cb)
Assisted-by: Patchpal
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
 2026-07-09 11:23:47 +02:00
CKI Backport Bot f2b4c61b2d KEYS: trusted: Fix a memory leak in tpm2_load_cmd 
JIRA: https://redhat.atlassian.net/browse/RHEL-189607
CVE: CVE-2025-71147
Backported from tree(s): linux

KEYS: trusted: Fix a memory leak in tpm2_load_cmd

'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode'
but it is not freed in the failure paths. Address this by wrapping the blob
into with a cleanup helper.

Cc: stable@vger.kernel.org # v5.13+
Fixes: f221974525 ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
(cherry picked from commit 62cd5d480b9762ce70d720a81fa5b373052ae05f)
Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
 2026-07-07 14:40:43 +00:00
Rafael Aquini c4e349d9b4 mseal sysmap: kernel config and header change 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694

commit 5796d3967c0956734bd1249f76989ca80da0225b
Author: Jeff Xu <jeffxu@chromium.org>
Date:   Wed Mar 5 02:17:05 2025 +0000

    mseal sysmap: kernel config and header change

    Patch series "mseal system mappings", v9.

    As discussed during mseal() upstream process [1], mseal() protects the
    VMAs of a given virtual memory range against modifications, such as the
    read/write (RW) and no-execute (NX) bits.  For complete descriptions of
    memory sealing, please see mseal.rst [2].

    The mseal() is useful to mitigate memory corruption issues where a
    corrupted pointer is passed to a memory management system.  For example,
    such an attacker primitive can break control-flow integrity guarantees
    since read-only memory that is supposed to be trusted can become writable
    or .text pages can get remapped.

    The system mappings are readonly only, memory sealing can protect them
    from ever changing to writable or unmmap/remapped as different attributes.

    System mappings such as vdso, vvar, vvar_vclock, vectors (arm
    compat-mode), sigpage (arm compat-mode), are created by the kernel during
    program initialization, and could be sealed after creation.

    Unlike the aforementioned mappings, the uprobe mapping is not established
    during program startup.  However, its lifetime is the same as the
    process's lifetime [3].  It could be sealed from creation.

    The vsyscall on x86-64 uses a special address (0xffffffffff600000), which
    is outside the mm managed range.  This means mprotect, munmap, and mremap
    won't work on the vsyscall.  Since sealing doesn't enhance the vsyscall's
    security, it is skipped in this patch.  If we ever seal the vsyscall, it
    is probably only for decorative purpose, i.e.  showing the 'sl' flag in
    the /proc/pid/smaps.  For this patch, it is ignored.

    It is important to note that the CHECKPOINT_RESTORE feature (CRIU) may
    alter the system mappings during restore operations.  UML(User Mode Linux)
    and gVisor, rr are also known to change the vdso/vvar mappings.
    Consequently, this feature cannot be universally enabled across all
    systems.  As such, CONFIG_MSEAL_SYSTEM_MAPPINGS is disabled by default.

    To support mseal of system mappings, architectures must define
    CONFIG_ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS and update their special
    mappings calls to pass mseal flag.  Additionally, architectures must
    confirm they do not unmap/remap system mappings during the process
    lifetime.  The existence of this flag for an architecture implies that it
    does not require the remapping of thest system mappings during process
    lifetime, so sealing these mappings is safe from a kernel perspective.

    This version covers x86-64 and arm64 archiecture as minimum viable feature.

    While no specific CPU hardware features are required for enable this
    feature on an archiecture, memory sealing requires a 64-bit kernel.  Other
    architectures can choose whether or not to adopt this feature.  Currently,
    I'm not aware of any instances in the kernel code that actively
    munmap/mremap a system mapping without a request from userspace.  The PPC
    does call munmap when _install_special_mapping fails for vdso; however,
    it's uncertain if this will ever fail for PPC - this needs to be
    investigated by PPC in the future [4].  The UML kernel can add this
    support when KUnit tests require it [5].

    In this version, we've improved the handling of system mapping sealing
    from previous versions, instead of modifying the _install_special_mapping
    function itself, which would affect all architectures, we now call
    _install_special_mapping with a sealing flag only within the specific
    architecture that requires it.  This targeted approach offers two key
    advantages: 1) It limits the code change's impact to the necessary
    architectures, and 2) It aligns with the software architecture by keeping
    the core memory management within the mm layer, while delegating the
    decision of sealing system mappings to the individual architecture, which
    is particularly relevant since 32-bit architectures never require sealing.

    Prior to this patch series, we explored sealing special mappings from
    userspace using glibc's dynamic linker.  This approach revealed several
    issues:

    - The PT_LOAD header may report an incorrect length for vdso, (smaller
      than its actual size).  The dynamic linker, which relies on PT_LOAD
      information to determine mapping size, would then split and partially
      seal the vdso mapping.  Since each architecture has its own vdso/vvar
      code, fixing this in the kernel would require going through each
      archiecture.  Our initial goal was to enable sealing readonly mappings,
      e.g.  .text, across all architectures, sealing vdso from kernel since
      creation appears to be simpler than sealing vdso at glibc.

    - The [vvar] mapping header only contains address information, not
      length information.  Similar issues might exist for other special
      mappings.

    - Mappings like uprobe are not covered by the dynamic linker, and there
      is no effective solution for them.

    This feature's security enhancements will benefit ChromeOS, Android, and
    other high security systems.

    Testing:
    This feature was tested on ChromeOS and Android for both x86-64 and ARM64.
    - Enable sealing and verify vdso/vvar, sigpage, vector are sealed properly,
      i.e. "sl" shown in the smaps for those mappings, and mremap is blocked.
    - Passing various automation tests (e.g. pre-checkin) on ChromeOS and
      Android to ensure the sealing doesn't affect the functionality of
      Chromebook and Android phone.

    I also tested the feature on Ubuntu on x86-64:
    - With config disabled, vdso/vvar is not sealed,
    - with config enabled, vdso/vvar is sealed, and booting up Ubuntu is OK,
      normal operations such as browsing the web, open/edit doc are OK.

    Link: https://lore.kernel.org/all/20240415163527.626541-1-jeffxu@chromium.org/ [1]
    Link: Documentation/userspace-api/mseal.rst [2]
    Link: https://lore.kernel.org/all/CABi2SkU9BRUnqf70-nksuMCQ+yyiWjo3fM4XkRkL-NrCZxYAyg@mail.gmail.com/ [3]
    Link: https://lore.kernel.org/all/CABi2SkV6JJwJeviDLsq9N4ONvQ=EFANsiWkgiEOjyT9TQSt+HA@mail.gmail.com/ [4]
    Link: https://lore.kernel.org/all/202502251035.239B85A93@keescook/ [5]

    This patch (of 7):

    Provide infrastructure to mseal system mappings.  Establish two kernel
    configs (CONFIG_MSEAL_SYSTEM_MAPPINGS,
    ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS) and VM_SEALED_SYSMAP macro for future
    patches.

    Link: https://lkml.kernel.org/r/20250305021711.3867874-1-jeffxu@google.com
    Link: https://lkml.kernel.org/r/20250305021711.3867874-2-jeffxu@google.com
    Signed-off-by: Jeff Xu <jeffxu@chromium.org>
    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
    Cc: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Cc: Andrei Vagin <avagin@gmail.com>
    Cc: Anna-Maria Behnsen <anna-maria@linutronix.de>
    Cc: Ard Biesheuvel <ardb@kernel.org>
    Cc: Benjamin Berg <benjamin@sipsolutions.net>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Elliot Hughes <enh@google.com>
    Cc: Florian Faineli <f.fainelli@gmail.com>
    Cc: Greg Ungerer <gerg@kernel.org>
    Cc: Guenter Roeck <groeck@chromium.org>
    Cc: Heiko Carstens <hca@linux.ibm.com>
    Cc: Helge Deller <deller@gmx.de>
    Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Jann Horn <jannh@google.com>
    Cc: Jason A. Donenfeld <jason@zx2c4.com>
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Cc: Jorge Lucangeli Obes <jorgelo@chromium.org>
    Cc: Linus Waleij <linus.walleij@linaro.org>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Miguel Ojeda <ojeda@kernel.org>
    Cc: Mike Rapoport <mike.rapoport@gmail.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Pedro Falcato <pedro.falcato@gmail.com>
    Cc: Peter Xu <peterx@redhat.com>
    Cc: Randy Dunlap <rdunlap@infradead.org>
    Cc: Stephen Röttger <sroettger@google.com>
    Cc: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:17:36 -04:00
Rafael Aquini 2099975687 fortify: Move FORTIFY_SOURCE under 'Kernel hardening options' 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694

commit ca758b147e75f4b564225065d70b6526477185ce
Author: Mel Gorman <mgorman@techsingularity.net>
Date:   Thu Jan 23 22:11:15 2025 +0000

    fortify: Move FORTIFY_SOURCE under 'Kernel hardening options'

    FORTIFY_SOURCE is a hardening option both at build and runtime. Move
    it under 'Kernel hardening options'.

    Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Link: https://lore.kernel.org/r/20250123221115.19722-5-mgorman@techsingularity.net
    Signed-off-by: Kees Cook <kees@kernel.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:16:12 -04:00
Rafael Aquini 34680126d5 mm: security: Allow default HARDENED_USERCOPY to be set at compile time 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694
Conflicts:
  * redhat/configs/common/generic/CONFIG_HARDENED_USERCOPY_DEFAULT_ON:
    include the hunk to explicitly set the config option following kernel-ark.

commit d2132f453e3308adc82ab7c101bd5220a9a34167
Author: Mel Gorman <mgorman@techsingularity.net>
Date:   Thu Jan 23 22:11:13 2025 +0000

    mm: security: Allow default HARDENED_USERCOPY to be set at compile time

    HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
    hardened_usercopy= default to be set at compile time similar to
    init_on_alloc= and init_on_free=. The intent is that hardening
    options that can be disabled at runtime can set their default at
    build time.

    Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
    Link: https://lore.kernel.org/r/20250123221115.19722-3-mgorman@techsingularity.net
    Signed-off-by: Kees Cook <kees@kernel.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:16:12 -04:00
Rafael Aquini 090b99d25f mm: security: Move hardened usercopy under 'Kernel hardening options' 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694

commit f4d4e8b9d6afe880a855e919c4ba4139455e11db
Author: Mel Gorman <mgorman@techsingularity.net>
Date:   Thu Jan 23 22:11:12 2025 +0000

    mm: security: Move hardened usercopy under 'Kernel hardening options'

    There is a submenu for 'Kernel hardening options' under "Security".
    Move HARDENED_USERCOPY under the hardening options as it is clearly
    related.

    Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Link: https://lore.kernel.org/r/20250123221115.19722-2-mgorman@techsingularity.net
    Signed-off-by: Kees Cook <kees@kernel.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:16:11 -04:00
Rafael Aquini c68e37cd85 Change inode_operations.mkdir to return struct dentry * 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694
Conflicts:
  * fs/smb/client/inode.c: minor difference in the 2nd hunk due to out-of-order
    backport of upstream commit f80ac7eda1cf ("cifs: Add a tracepoint to log EIO errors")

commit 88d5baf69082e5b410296435008329676b687549
Author: NeilBrown <neilb@suse.de>
Date:   Thu Feb 27 12:32:53 2025 +1100

    Change inode_operations.mkdir to return struct dentry *

    Some filesystems, such as NFS, cifs, ceph, and fuse, do not have
    complete control of sequencing on the actual filesystem (e.g.  on a
    different server) and may find that the inode created for a mkdir
    request already exists in the icache and dcache by the time the mkdir
    request returns.  For example, if the filesystem is mounted twice the
    directory could be visible on the other mount before it is on the
    original mount, and a pair of name_to_handle_at(), open_by_handle_at()
    calls could instantiate the directory inode with an IS_ROOT() dentry
    before the first mkdir returns.

    This means that the dentry passed to ->mkdir() may not be the one that
    is associated with the inode after the ->mkdir() completes.  Some
    callers need to interact with the inode after the ->mkdir completes and
    they currently need to perform a lookup in the (rare) case that the
    dentry is no longer hashed.

    This lookup-after-mkdir requires that the directory remains locked to
    avoid races.  Planned future patches to lock the dentry rather than the
    directory will mean that this lookup cannot be performed atomically with
    the mkdir.

    To remove this barrier, this patch changes ->mkdir to return the
    resulting dentry if it is different from the one passed in.
    Possible returns are:
      NULL - the directory was created and no other dentry was used
      ERR_PTR() - an error occurred
      non-NULL - this other dentry was spliced in

    This patch only changes file-systems to return "ERR_PTR(err)" instead of
    "err" or equivalent transformations.  Subsequent patches will make
    further changes to some file-systems to return a correct dentry.

    Not all filesystems reliably result in a positive hashed dentry:

    - NFS, cifs, hostfs will sometimes need to perform a lookup of
      the name to get inode information.  Races could result in this
      returning something different. Note that this lookup is
      non-atomic which is what we are trying to avoid.  Placing the
      lookup in filesystem code means it only happens when the filesystem
      has no other option.
    - kernfs and tracefs leave the dentry negative and the ->revalidate
      operation ensures that lookup will be called to correctly populate
      the dentry.  This could be fixed but I don't think it is important
      to any of the users of vfs_mkdir() which look at the dentry.

    The recommendation to use
        d_drop();d_splice_alias()
    is ugly but fits with current practice.  A planned future patch will
    change this.

    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Signed-off-by: NeilBrown <neilb@suse.de>
    Link: https://lore.kernel.org/r/20250227013949.536172-2-neilb@suse.de
    Signed-off-by: Christian Brauner <brauner@kernel.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:16:07 -04:00
Rafael Aquini 668e3734e8 security: min_addr: move sysctl to security/min_addr.c 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694

commit b121dd4d557212067275e988137f2e2c5b2c0077
Author: Kaixiong Yu <yukaixiong@huawei.com>
Date:   Sat Jan 11 15:07:42 2025 +0800

    security: min_addr: move sysctl to security/min_addr.c

    The dac_mmap_min_addr belongs to min_addr.c, move it to
    min_addr.c from /kernel/sysctl.c. In the previous Linux kernel
    boot process, sysctl_init_bases needs to be executed before
    init_mmap_min_addr, So, register_sysctl_init should be executed
    before update_mmap_min_addr in init_mmap_min_addr. And according
    to the compilation condition in security/Makefile:

          obj-$(CONFIG_MMU)            += min_addr.o

    if CONFIG_MMU is not defined, min_addr.c would not be included in the
    compilation process. So, drop the CONFIG_MMU check.

    Signed-off-by: Kaixiong Yu <yukaixiong@huawei.com>
    Reviewed-by: Kees Cook <kees@kernel.org>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Joel Granados <joel.granados@kernel.org>

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:15:57 -04:00
Rafael Aquini 2abbcd5dab fsnotify, lsm: Decouple fsnotify from lsm 
JIRA: https://redhat.atlassian.net/browse/RHEL-145694

commit 1cda52f1b4611f4daa9d89e69d9428fb4137dc3f
Author: Song Liu <song@kernel.org>
Date:   Sat Oct 12 17:22:48 2024 -0700

    fsnotify, lsm: Decouple fsnotify from lsm

    Currently, fsnotify_open_perm() is called from security_file_open().
    This is a a bit unexpected and creates otherwise unnecessary dependency
    of CONFIG_FANOTIFY_ACCESS_PERMISSIONS on CONFIG_SECURITY. Fix this by
    calling fsnotify_open_perm() directly.

    Signed-off-by: Song Liu <song@kernel.org>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Link: https://patch.msgid.link/20241013002248.3984442-1-song@kernel.org

Signed-off-by: Rafael Aquini <raquini@redhat.com>
 2026-07-01 16:14:44 -04:00
Thomas Huth 87974b0bcc crypto: rsassa-pkcs1 - Migrate to sig_alg backend 
JIRA: https://redhat.atlassian.net/browse/RHEL-186630

commit 1e562deacecca1f1bec7d23da526904a1e87525e
Author: Lukas Wunner <lukas@wunner.de>
Date:   Tue Sep 10 16:30:16 2024 +0200

    crypto: rsassa-pkcs1 - Migrate to sig_alg backend

    A sig_alg backend has just been introduced with the intent of moving all
    asymmetric sign/verify algorithms to it one by one.

    Migrate the sign/verify operations from rsa-pkcs1pad.c to a separate
    rsassa-pkcs1.c which uses the new backend.

    Consequently there are now two templates which build on the "rsa"
    akcipher_alg:

    * The existing "pkcs1pad" template, which is instantiated as an
      akcipher_instance and retains the encrypt/decrypt operations of
      RSAES-PKCS1-v1_5 (RFC 8017 sec 7.2).

    * The new "pkcs1" template, which is instantiated as a sig_instance
      and contains the sign/verify operations of RSASSA-PKCS1-v1_5
      (RFC 8017 sec 8.2).

    In a separate step, rsa-pkcs1pad.c could optionally be renamed to
    rsaes-pkcs1.c for clarity.  Additional "oaep" and "pss" templates
    could be added for RSAES-OAEP and RSASSA-PSS.

    Note that it's currently allowed to allocate a "pkcs1pad(rsa)" transform
    without specifying a hash algorithm.  That makes sense if the transform
    is only used for encrypt/decrypt and continues to be supported.  But for
    sign/verify, such transforms previously did not insert the Full Hash
    Prefix into the padding.  The resulting message encoding was incompliant
    with EMSA-PKCS1-v1_5 (RFC 8017 sec 9.2) and therefore nonsensical.

    From here on in, it is no longer allowed to allocate a transform without
    specifying a hash algorithm if the transform is used for sign/verify
    operations.  This simplifies the code because the insertion of the Full
    Hash Prefix is no longer optional, so various "if (digest_info)" clauses
    can be removed.

    There has been a previous attempt to forbid transform allocation without
    specifying a hash algorithm, namely by commit c0d20d22e0 ("crypto:
    rsa-pkcs1pad - Require hash to be present").  It had to be rolled back
    with commit b3a8c8a5eb ("crypto: rsa-pkcs1pad: Allow hash to be
    optional [ver #2]"), presumably because it broke allocation of a
    transform which was solely used for encrypt/decrypt, not sign/verify.
    Avoid such breakage by allowing transform allocation for encrypt/decrypt
    with and without specifying a hash algorithm (and simply ignoring the
    hash algorithm in the former case).

    So again, specifying a hash algorithm is now mandatory for sign/verify,
    but optional and ignored for encrypt/decrypt.

    The new sig_alg API uses kernel buffers instead of sglists, which
    avoids the overhead of copying signature and digest from sglists back
    into kernel buffers.  rsassa-pkcs1.c is thus simplified quite a bit.

    sig_alg is always synchronous, whereas the underlying "rsa" akcipher_alg
    may be asynchronous.  So await the result of the akcipher_alg, similar
    to crypto_akcipher_sync_{en,de}crypt().

    As part of the migration, rename "rsa_digest_info" to "hash_prefix" to
    adhere to the spec language in RFC 9580.  Otherwise keep the code
    unmodified wherever possible to ease reviewing and bisecting.  Leave
    several simplification and hardening opportunities to separate commits.

    rsassa-pkcs1.c uses modern __free() syntax for allocation of buffers
    which need to be freed by kfree_sensitive(), hence a DEFINE_FREE()
    clause for kfree_sensitive() is introduced herein as a byproduct.

    Signed-off-by: Lukas Wunner <lukas@wunner.de>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Signed-off-by: Thomas Huth <thuth@redhat.com>
 2026-06-30 16:01:00 +02:00
CKI KWF Bot 627d66590a Merge: evm: fix security.evm for a file with IMA signature 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2750

JIRA: https://redhat.atlassian.net/browse/RHEL-104343

When both IMA and EVM fix modes are enabled, accessing a file with IMA
signature but missing EVM HMAC won't cause security.evm to be fixed.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>

Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: Jerry Snitselaar <jsnitsel@redhat.com>
Approved-by: Vladislav Dronov <vdronov@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-06-30 11:18:21 +00:00
CKI KWF Bot 4d463cb6cc Merge: Update NFS/NFSD/LOCKD/SUNRPC RHEL10.3 to 7.1 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2625

Update NFS/NFSD/LOCKD/SUNRPC RHEL10.3 to 7.1

JIRA: https://issues.redhat.com/browse/RHEL-171581
Omitted-fix: 8c6cccefb33e ("ARM: shmobile: defconfig: Refresh for v7.0-rc1")
Omitted-fix: 48db892356d6 ("NFSD: Defer sub-object cleanup in export put callbacks")

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>

Approved-by: Scott Mayhew <smayhew@redhat.com>
Approved-by: Andrea Arcangeli <aarcange@redhat.com>
Approved-by: Roberto Bergantinos Corpas <rbergant@redhat.com>
Approved-by: Xin Long <lxin@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
 2026-06-23 14:31:59 +00:00
Ondrej Mosnacek 7afc16c3e0 selinux: RHEL-only hotfix for execmem regression 
JIRA: https://redhat.atlassian.net/browse/RHEL-185115
Upstream Status: RHEL10-only

As discovered by image-mode/CoreOS testing, the fixes for CVE-2026-46054
caused a regression that results in unexpected execmem denials in
specific scenarios involving overlayfs (or another stacked filesystem).

Specifically in case of image mode / CoreOS there is often (always?) an
overlayfs filesystem mounted during early boot (before SELinux policy is
loaded), which means that overlayfs captures the kernel’s SELinux
context as part of the mounter credentials, which are later used by
overlayfs+SELinux to verify that file accesses through the overlay mount
don’t give the mounter a way to access underlying files it otherwise
wouldn’t have access to. This verification would normally pass, as the
policy grants the kernel context almost unrestricted access to the
filesystem. However, the new checks added to fix CVE-2026-46054
erroneously include the execmem check for the mounter and in the policy
kernel_t doesn’t have the execmem permission, so mmapping an overlay
file with MAP_PRIVATE and PROT_WRITE|PROT_EXEC would now result in a
SELinux denial.

Fix this by passing a boolean through the helper functions that allows
to distinguish the direct permission check from the mounter check and
skipping the execmem check in the mounter case.

This is a transient RHEL-only fix to allow the CVE fix to go through
without breaking image mode/CoreOS deployments. Once an optimal solution
is figured out and applied upstream, this commit will be reverted and
replaced with the upstream fix (at least in Y-streams). I expect the
upstream solution to be functionally equivalent, though probably
cosmetically different.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-16 13:34:43 +02:00
Bruno Meneguele bfda1c2bcf ima: Add code comments to explain IMA iint cache atomic_flags 
JIRA: https://redhat.atlassian.net/browse/RHEL-104343

commit 5d05360d748d477acfe1f0d05593c12beb507387
Author: Coiby Xu <coxu@redhat.com>
Date:   Tue Sep 30 10:26:57 2025 +0800

    ima: Add code comments to explain IMA iint cache atomic_flags

    Explain these atomic flags to improve code readability. For example, the
    flag IMA_DIGSIG is to indicate we mustn't update a file's security.ima
    on close because the file already has IMA signature. The code comments
    for the first three flags come from commit 0d73a55208 ("ima:
    re-introduce own integrity cache lock") with a minor tweak.

    Signed-off-by: Coiby Xu <coxu@redhat.com>
    [zohar@linux.ibm.com: remove duplicate "integrity violation", unnecessary commas]
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
 2026-06-15 13:43:43 -03:00
Bruno Meneguele 9e423fa983 evm: fix security.evm for a file with IMA signature 
JIRA: https://redhat.atlassian.net/browse/RHEL-104343

commit 0ec959cf4b5a609d7f27bf84064ef5372e30ab80
Author: Coiby Xu <coxu@redhat.com>
Date:   Tue Sep 30 10:26:56 2025 +0800

    evm: fix security.evm for a file with IMA signature

    When both IMA and EVM fix modes are enabled, accessing a file with IMA
    signature but missing EVM HMAC won't cause security.evm to be fixed.

    Add a function evm_fix_hmac which will be explicitly called to fix EVM
    HMAC for this case.

    Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Coiby Xu <coxu@redhat.com>
    Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
 2026-06-15 13:43:43 -03:00
Olga Kornievskaia 6deef8c0ca lsm: lsm_context in security_dentry_init_security 
JIRA: https://issues.redhat.com/browse/RHEL-171581

commit b530104f50e86db6f187d39fed5821b3cca755ee
Author: Casey Schaufler <casey@schaufler-ca.com>
Date:   Wed Oct 23 14:21:57 2024 -0700

    lsm: lsm_context in security_dentry_init_security

    Replace the (secctx,seclen) pointer pair with a single lsm_context
    pointer to allow return of the LSM identifier along with the context
    and context length. This allows security_release_secctx() to know how
    to release the context. Callers have been modified to use or save the
    returned data from the new structure.

    Cc: ceph-devel@vger.kernel.org
    Cc: linux-nfs@vger.kernel.org
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    [PM: subject tweak]
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
 2026-06-11 15:17:50 -04:00
Olga Kornievskaia 5d2b2365d2 lsm: use lsm_context in security_inode_getsecctx 
JIRA: https://issues.redhat.com/browse/RHEL-171581
Conflicts: context difference due to out-of-order backport of
531503054e8f ("nfsd: fix handling of delegated change attr in
CB_GETATTR")

commit 76ecf306ae5da84ef8f48c7a2608736e6866440c
Author: Casey Schaufler <casey@schaufler-ca.com>
Date:   Wed Oct 23 14:21:56 2024 -0700

    lsm: use lsm_context in security_inode_getsecctx

    Change the security_inode_getsecctx() interface to fill a lsm_context
    structure instead of data and length pointers.  This provides
    the information about which LSM created the context so that
    security_release_secctx() can use the correct hook.

    Cc: linux-nfs@vger.kernel.org
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    [PM: subject tweak]
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
 2026-06-11 15:17:50 -04:00
Ondrej Mosnacek d3989d6fe6 selinux: fix overlayfs mmap() and mprotect() access checks 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - security/selinux/hooks.c: trivial context fuzz

commit 82544d36b1729153c8aeb179e84750f0c085d3b1
Author: Paul Moore <paul@paul-moore.com>
Date:   Thu Jan 1 17:19:18 2026 -0500

    selinux: fix overlayfs mmap() and mprotect() access checks

    The existing SELinux security model for overlayfs is to allow access if
    the current task is able to access the top level file (the "user" file)
    and the mounter's credentials are sufficient to access the lower
    level file (the "backing" file).  Unfortunately, the current code does
    not properly enforce these access controls for both mmap() and mprotect()
    operations on overlayfs filesystems.

    This patch makes use of the newly created security_mmap_backing_file()
    LSM hook to provide the missing backing file enforcement for mmap()
    operations, and leverages the backing file API and new LSM blob to
    provide the necessary information to properly enforce the mprotect()
    access controls.

    Cc: stable@vger.kernel.org
    Acked-by: Amir Goldstein <amir73il@gmail.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:21 +02:00
Ondrej Mosnacek c2685f8b7b lsm: add backing_file LSM hooks 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - fs/backing-file.c: adjust backing_file_mmap() to downstream state (missing
    scoped guards)
  - fs/erofs/ishare.c: hunk dropped, files not in RHEL10
  - fs/overlayfs/dir.c: adjust to different indentation
  - fs/overlayfs/file.c: adjust to different indentation

commit 6af36aeb147a06dea47c49859cd6ca5659aeb987
Author: Paul Moore <paul@paul-moore.com>
Date:   Fri Dec 19 13:18:22 2025 -0500

    lsm: add backing_file LSM hooks

    Stacked filesystems such as overlayfs do not currently provide the
    necessary mechanisms for LSMs to properly enforce access controls on the
    mmap() and mprotect() operations.  In order to resolve this gap, a LSM
    security blob is being added to the backing_file struct and the following
    new LSM hooks are being created:

     security_backing_file_alloc()
     security_backing_file_free()
     security_mmap_backing_file()

    The first two hooks are to manage the lifecycle of the LSM security blob
    in the backing_file struct, while the third provides a new mmap() access
    control point for the underlying backing file.  It is also expected that
    LSMs will likely want to update their security_file_mprotect() callback
    to address issues with their mprotect() controls, but that does not
    require a change to the security_file_mprotect() LSM hook.

    There are a three other small changes to support these new LSM hooks:
    * Pass the user file associated with a backing file down to
    alloc_empty_backing_file() so it can be included in the
    security_backing_file_alloc() hook.
    * Add getter and setter functions for the backing_file struct LSM blob
    as the backing_file struct remains private to fs/file_table.c.
    * Constify the file struct field in the LSM common_audit_data struct to
    better support LSMs that need to pass a const file struct pointer into
    the common LSM audit code.

    Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL()
    and supplying a fixup.

    Cc: stable@vger.kernel.org
    Cc: linux-fsdevel@vger.kernel.org
    Cc: linux-unionfs@vger.kernel.org
    Cc: linux-erofs@lists.ozlabs.org
    Reviewed-by: Amir Goldstein <amir73il@gmail.com>
    Reviewed-by: Serge Hallyn <serge@hallyn.com>
    Reviewed-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:21 +02:00
Ondrej Mosnacek 455eabf0b6 lsm: cleanup the debug and console output in lsm_init.c 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for
    BPF objects"), which is not backported

commit 5137e583ba2635b82667dc63cb35305750420411
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Feb 12 18:20:01 2025 -0500

    lsm: cleanup the debug and console output in lsm_init.c

    Move away from an init specific init_debug() macro to a more general
    lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available
    both before and after init.  In the process we do a number of minor
    changes to improve the LSM initialization output and cleanup the code
    somewhat.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:21 +02:00
Ondrej Mosnacek 5a8181960a lsm: add/tweak function header comment blocks in lsm_init.c 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 450705334f698990804b470437f3014cee979486
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Feb 12 18:17:03 2025 -0500

    lsm: add/tweak function header comment blocks in lsm_init.c

    Add function header comments for lsm_static_call_init() and
    early_security_init(), tweak the existing comment block for
    security_add_hooks().

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:20 +02:00
Ondrej Mosnacek 4b0683928d lsm: fold lsm_init_ordered() into security_init() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for
    BPF objects"), which is not backported

commit 45a41d1394aa2ed0305f0560f93bb87be7192481
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Feb 12 18:10:37 2025 -0500

    lsm: fold lsm_init_ordered() into security_init()

    With only security_init() calling lsm_init_ordered, it makes little
    sense to keep lsm_init_ordered() as a standalone function.  Fold
    lsm_init_ordered() into security_init().

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:20 +02:00
Ondrej Mosnacek 800c1228fa lsm: cleanup initialize_lsm() and rename to lsm_init_single() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 27be5600fe852c52d5b70f4ac9406879b39c864e
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Feb 11 18:24:04 2025 -0500

    lsm: cleanup initialize_lsm() and rename to lsm_init_single()

    Rename initialize_lsm() to be more consistent with the rest of the LSM
    initialization changes and rework the function itself to better fit
    with the "exit on fail" coding pattern.

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:20 +02:00
Ondrej Mosnacek 7cbba38d94 lsm: cleanup the LSM blob size code 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for
    BPF objects"), which is not backported

commit 291271e691740003021cf5b48fa7cf7e3371eaa7
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Feb 11 17:49:11 2025 -0500

    lsm: cleanup the LSM blob size code

    Convert the lsm_blob_size fields to unsigned integers as there is no
    current need for them to be negative, change "lsm_set_blob_size()" to
    "lsm_blob_size_update()" to better reflect reality, and perform some
    other minor cleanups to the associated code.

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:20 +02:00
Ondrej Mosnacek 9a0e65bba0 lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 752db06571816a3870b17814882425318b5ec0ef
Author: Paul Moore <paul@paul-moore.com>
Date:   Sun Jul 13 17:51:12 2025 -0400

    lsm: rename/rework ordered_lsm_parse() to lsm_order_parse()

    Rename ordered_lsm_parse() to lsm_order_parse() for the sake of
    consistency with the other LSM initialization routines, and also
    do some minor rework of the function.  Aside from some minor style
    decisions, the majority of the rework involved shuffling the order
    of the LSM_FLAG_LEGACY and LSM_ORDER_FIRST code so that the
    LSM_FLAG_LEGACY checks are handled first; it is important to note
    that this doesn't affect the order in which the LSMs are registered.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:19 +02:00
Ondrej Mosnacek 2fad39b00b lsm: rename/rework append_ordered_lsm() into lsm_order_append() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 24a9c58978ee368cbd796a03cb6e8ade6e0b6f5f
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Jul 16 15:04:10 2025 -0400

    lsm: rename/rework append_ordered_lsm() into lsm_order_append()

    Rename append_ordered_lsm() to lsm_order_append() to better match
    convention and do some rework.  The rework includes moving the
    LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append()
    in order to consolidate the individual LSM append/activation code,
    and adding logic to skip appending explicitly disabled LSMs to the
    active LSM list.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:19 +02:00
Ondrej Mosnacek f5d2029482 lsm: rename exists_ordered_lsm() to lsm_order_exists() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit a748372a282ae1e23d5d4b14a3e190c28764cfd2
Author: Paul Moore <paul@paul-moore.com>
Date:   Sun Jul 13 17:37:56 2025 -0400

    lsm: rename exists_ordered_lsm() to lsm_order_exists()

    Also add a header comment block to the function.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:19 +02:00
Ondrej Mosnacek d52cc6c688 lsm: rework the LSM enable/disable setter/getter functions 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 2d67172612fd9df2c4d08533515ef483cb526dd9
Author: Paul Moore <paul@paul-moore.com>
Date:   Thu Apr 10 22:04:26 2025 -0400

    lsm: rework the LSM enable/disable setter/getter functions

    In addition to style changes, rename set_enabled() to lsm_enabled_set()
    and is_enabled() to lsm_is_enabled() to better fit within the LSM
    initialization code.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:19 +02:00
Ondrej Mosnacek e84cf2768d lsm: get rid of the lsm_names list and do some cleanup 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 935d508d4d7ab9d19c603bd7eb2937249551d507
Author: Paul Moore <paul@paul-moore.com>
Date:   Thu Feb 13 17:34:12 2025 -0500

    lsm: get rid of the lsm_names list and do some cleanup

    The LSM currently has a lot of code to maintain a list of the currently
    active LSMs in a human readable string, with the only user being the
    "/sys/kernel/security/lsm" code.  Let's drop all of that code and
    generate the string on first use and then cache it for subsequent use.

    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:18 +02:00
Ondrej Mosnacek c4c061449d lsm: rework lsm_active_cnt and lsm_idlist[] 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 250898ca335f337bc032a9693dc0a30a1cb85825
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Feb 12 15:36:51 2025 -0500

    lsm: rework lsm_active_cnt and lsm_idlist[]

    Move the LSM active count and lsm_id list declarations out of a header
    that is visible across the kernel and into a header that is limited to
    the LSM framework.  This not only helps keep the include/linux headers
    smaller and cleaner, it helps prevent misuse of these variables.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:18 +02:00
Ondrej Mosnacek f212d5ad65 lsm: rename the lsm order variables for consistency 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 592b104f9b516b2c22cb23a2f4c34486fdb21bae
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Feb 11 17:13:26 2025 -0500

    lsm: rename the lsm order variables for consistency

    Rename the builtin_lsm_order variable to lsm_order_builtin,
    chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to
    lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive
    to lsm_exclusive.

    This patch also renames the associated kernel command line parsing
    functions and adds some basic function comment blocks.  The parsing
    function choose_major_lsm() was renamed to lsm_choose_security(),
    choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to
    lsm_debug_enable().

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:18 +02:00
Ondrej Mosnacek 369918c7a5 lsm: replace the name field with a pointer to the lsm_id struct 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 9f9dc69e06ecbc61e7a50b823b82a78daf130dc0
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Feb 12 14:45:06 2025 -0500

    lsm: replace the name field with a pointer to the lsm_id struct

    Reduce the duplication between the lsm_id struct and the DEFINE_LSM()
    definition by linking the lsm_id struct directly into the individual
    LSM's DEFINE_LSM() instance.

    Linking the lsm_id into the LSM definition also allows us to simplify
    the security_add_hooks() function by removing the code which populates
    the lsm_idlist[] array and moving it into the normal LSM startup code
    where the LSM list is parsed and the individual LSMs are enabled,
    making for a cleaner implementation with less overhead at boot.

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:18 +02:00
Ondrej Mosnacek c2e5c69d0c lsm: rename ordered_lsm_init() to lsm_init_ordered() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit faabedcd6e88ca1f65ef45d711d2e0c7288fd551
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Feb 11 12:59:30 2025 -0500

    lsm: rename ordered_lsm_init() to lsm_init_ordered()

    The new name more closely fits the rest of the naming scheme in
    security/lsm_init.c.  This patch also adds a trivial comment block to
    the top of the function.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:17 +02:00
Ondrej Mosnacek 7a7bb4c213 lsm: integrate lsm_early_cred() and lsm_early_task() into caller 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 92ed3500c9a91f43e094c9b8fb4bab9976565d74
Author: Paul Moore <paul@paul-moore.com>
Date:   Sat Jul 12 16:27:39 2025 -0400

    lsm: integrate lsm_early_cred() and lsm_early_task() into caller

    With only one caller of lsm_early_cred() and lsm_early_task(), insert
    the functions' code directly into the caller and ger rid of the two
    functions.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:17 +02:00
Ondrej Mosnacek 4190f25490 lsm: integrate report_lsm_order() code into caller 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit cb1513db7a6ed82d22853608d78bbf72ad8c67c1
Author: Paul Moore <paul@paul-moore.com>
Date:   Sat Jul 12 16:10:15 2025 -0400

    lsm: integrate report_lsm_order() code into caller

    With only one caller of report_lsm_order(), insert the function's code
    directly into the caller and ger rid of report_lsm_order().

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:17 +02:00
Ondrej Mosnacek 92ed776aa5 lsm: introduce looping macros for the initialization code 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit 37f788f65528611f4482e2135d11ca34afb25828
Author: Paul Moore <paul@paul-moore.com>
Date:   Wed Apr 9 17:59:42 2025 -0400

    lsm: introduce looping macros for the initialization code

    There are three common for loop patterns in the LSM initialization code
    to loop through the ordered LSM list and the registered "early" LSMs.
    This patch implements these loop patterns as macros to help simplify the
    code and reduce the chance for errors.

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:17 +02:00
Ondrej Mosnacek 204c54d19e lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support for
    BPF objects"), which is not backported

commit e02578561d47567be26e603c6d27c10a5aa4c2c4
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Feb 11 12:19:47 2025 -0500

    lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare()

    Simplify and consolidate the lsm_allowed() and prepare_lsm() functions
    into a new function, lsm_prepare().

    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: John Johansen <john.johhansen@canonical.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:17:17 +02:00
Ondrej Mosnacek 7aa3fb5951 lsm: split the init code out into lsm_init.c 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054
Conflicts:
  - security/security.c:
    - conflict due to 5816bf4273ed ("lsm,selinux: Add LSM blob support
      for BPF objects"), which is not backported
    - need to also carry over bits from RHEL-only commit 1e3e3bce93
      ("CVE-2025-1272: security: Re-enable lockdown LSM in some
      setup_arch()")

commit 67a4b6a89b99aff0883114e4ecba4b11aedc29a5
Author: Paul Moore <paul@paul-moore.com>
Date:   Thu Feb 6 16:44:10 2025 -0500

    lsm: split the init code out into lsm_init.c

    Continue to pull code out of security/security.c to help improve
    readability by pulling all of the LSM framework initialization
    code out into a new file.

    No code changes.

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 20:13:57 +02:00
Ondrej Mosnacek 6a5de58e11 lsm: split the notifier code out into lsm_notifier.c 
JIRA: https://issues.redhat.com/browse/RHEL-179440
CVE: CVE-2026-46054

commit a5e7c17c810052e94dae36f1a976a052f4490458
Author: Paul Moore <paul@paul-moore.com>
Date:   Mon Feb 10 19:20:58 2025 -0500

    lsm: split the notifier code out into lsm_notifier.c

    In an effort to decompose security/security.c somewhat to make it less
    twisted and unwieldy, pull out the LSM notifier code into a new file
    as it is fairly well self-contained.

    No code changes.

    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: John Johansen <john.johansen@canonical.com>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
 2026-06-02 11:09:30 +02:00