mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-01-22 07:53:11 -05:00
f96a974170
-----BEGIN PGP SIGNATURE----- iQJIBAABCAAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmeQFBoUHHBhdWxAcGF1 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPvcA//XCdwMz0bGtWKv58nuyP8vkQx08n6 //olz/O8te3uWK5O3kRiarzFLwH8qsHQ6A7GYalwwix34hatR4ndJE0Y/guVRWa1 +aBmJxJ7Jm/q3fvpAEfqiSgreuE6kBoztlDOWEq+hUQGu4qfnQGm2EnvbvfFrAmN VheOfIQSU2KCL/Scc3FGnF6uru4WrqN0JJ9RbvrEpfdQgmcyTGLnQsZLljutWSIq kDWkteIr7cj3O9J45zpxZsTftvYSgVn/y1iKeXbHI4DBA1eheK12vsHB9AADKI1J GwHxOrnLpZtv+ICUKqcfFTmWTl+NmfJJurAT5KXKdBjL3xM5MoJlBvK1A5qE9CMo LaHVG/TZR2MmBaoM3EN+gvWhDgWlvT02Q/0cYaafTlVLMez3HtfctxN6OnCvTXTB Y8dqYClhhlBm/mHQwYfMoeKw4MftUpzEqBd1Nj7Qe8dbP0f/62Ca3K2B3D6Rf8QV pj3ryMlSWYV9mdTerruLNQexTGoN7l66jPwzdWpTbFeL3WmNtfCako8OZGbXgPIu Iahm3P+jnSVx8ZQro2c9zwdKXI5xiI335pCBbDZ8aX+JAsfj0OofHsFx5Q5diber M7tAEhxDqRisbpz7Ei+/LOAEGg2Z619XKg8ks4z6Y4P5PF7zEgeWTkZJk2iLbxXe 6LLOjmF7LLw+G4M= =fgyr -----END PGP SIGNATURE----- Merge tag 'lsm-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Improved handling of LSM "secctx" strings through lsm_context struct The LSM secctx string interface is from an older time when only one LSM was supported, migrate over to the lsm_context struct to better support the different LSMs we now have and make it easier to support new LSMs in the future. These changes explain the Rust, VFS, and networking changes in the diffstat. - Only build lsm_audit.c if CONFIG_SECURITY and CONFIG_AUDIT are enabled Small tweak to be a bit smarter about when we build the LSM's common audit helpers. - Check for absurdly large policies from userspace in SafeSetID SafeSetID policies rules are fairly small, basically just "UID:UID", it easy to impose a limit of KMALLOC_MAX_SIZE on policy writes which helps quiet a number of syzbot related issues. While work is being done to address the syzbot issues through other mechanisms, this is a trivial and relatively safe fix that we can do now. - Various minor improvements and cleanups A collection of improvements to the kernel selftests, constification of some function parameters, removing redundant assignments, and local variable renames to improve readability. * tag 'lsm-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: lockdown: initialize local array before use to quiet static analysis safesetid: check size of policy writes net: corrections for security_secid_to_secctx returns lsm: rename variable to avoid shadowing lsm: constify function parameters security: remove redundant assignment to return variable lsm: Only build lsm_audit.c if CONFIG_SECURITY and CONFIG_AUDIT are set selftests: refactor the lsm `flags_overset_lsm_set_self_attr` test binder: initialize lsm_context structure rust: replace lsm context+len with lsm_context lsm: secctx provider check on release lsm: lsm_context in security_dentry_init_security lsm: use lsm_context in security_inode_getsecctx lsm: replace context+len with lsm_context lsm: ensure the correct LSM context releaser |
||
|---|---|---|
| .. | ||
| ipset | ||
| ipvs | ||
| core.c | ||
| Kconfig | ||
| Makefile | ||
| nf_bpf_link.c | ||
| nf_conncount.c | ||
| nf_conntrack_acct.c | ||
| nf_conntrack_amanda.c | ||
| nf_conntrack_bpf.c | ||
| nf_conntrack_broadcast.c | ||
| nf_conntrack_core.c | ||
| nf_conntrack_ecache.c | ||
| nf_conntrack_expect.c | ||
| nf_conntrack_extend.c | ||
| nf_conntrack_ftp.c | ||
| nf_conntrack_h323_asn1.c | ||
| nf_conntrack_h323_main.c | ||
| nf_conntrack_h323_types.c | ||
| nf_conntrack_helper.c | ||
| nf_conntrack_irc.c | ||
| nf_conntrack_labels.c | ||
| nf_conntrack_netbios_ns.c | ||
| nf_conntrack_netlink.c | ||
| nf_conntrack_ovs.c | ||
| nf_conntrack_pptp.c | ||
| nf_conntrack_proto.c | ||
| nf_conntrack_proto_dccp.c | ||
| nf_conntrack_proto_generic.c | ||
| nf_conntrack_proto_gre.c | ||
| nf_conntrack_proto_icmp.c | ||
| nf_conntrack_proto_icmpv6.c | ||
| nf_conntrack_proto_sctp.c | ||
| nf_conntrack_proto_tcp.c | ||
| nf_conntrack_proto_udp.c | ||
| nf_conntrack_sane.c | ||
| nf_conntrack_seqadj.c | ||
| nf_conntrack_sip.c | ||
| nf_conntrack_snmp.c | ||
| nf_conntrack_standalone.c | ||
| nf_conntrack_tftp.c | ||
| nf_conntrack_timeout.c | ||
| nf_conntrack_timestamp.c | ||
| nf_dup_netdev.c | ||
| nf_flow_table_bpf.c | ||
| nf_flow_table_core.c | ||
| nf_flow_table_inet.c | ||
| nf_flow_table_ip.c | ||
| nf_flow_table_offload.c | ||
| nf_flow_table_procfs.c | ||
| nf_flow_table_xdp.c | ||
| nf_hooks_lwtunnel.c | ||
| nf_internals.h | ||
| nf_log.c | ||
| nf_log_syslog.c | ||
| nf_nat_amanda.c | ||
| nf_nat_bpf.c | ||
| nf_nat_core.c | ||
| nf_nat_ftp.c | ||
| nf_nat_helper.c | ||
| nf_nat_irc.c | ||
| nf_nat_masquerade.c | ||
| nf_nat_ovs.c | ||
| nf_nat_proto.c | ||
| nf_nat_redirect.c | ||
| nf_nat_sip.c | ||
| nf_nat_tftp.c | ||
| nf_queue.c | ||
| nf_sockopt.c | ||
| nf_synproxy_core.c | ||
| nf_tables_api.c | ||
| nf_tables_core.c | ||
| nf_tables_offload.c | ||
| nf_tables_trace.c | ||
| nfnetlink.c | ||
| nfnetlink_acct.c | ||
| nfnetlink_cthelper.c | ||
| nfnetlink_cttimeout.c | ||
| nfnetlink_hook.c | ||
| nfnetlink_log.c | ||
| nfnetlink_osf.c | ||
| nfnetlink_queue.c | ||
| nft_bitwise.c | ||
| nft_byteorder.c | ||
| nft_chain_filter.c | ||
| nft_chain_nat.c | ||
| nft_chain_route.c | ||
| nft_cmp.c | ||
| nft_compat.c | ||
| nft_connlimit.c | ||
| nft_counter.c | ||
| nft_ct.c | ||
| nft_ct_fast.c | ||
| nft_dup_netdev.c | ||
| nft_dynset.c | ||
| nft_exthdr.c | ||
| nft_fib.c | ||
| nft_fib_inet.c | ||
| nft_fib_netdev.c | ||
| nft_flow_offload.c | ||
| nft_fwd_netdev.c | ||
| nft_hash.c | ||
| nft_immediate.c | ||
| nft_inner.c | ||
| nft_last.c | ||
| nft_limit.c | ||
| nft_log.c | ||
| nft_lookup.c | ||
| nft_masq.c | ||
| nft_meta.c | ||
| nft_nat.c | ||
| nft_numgen.c | ||
| nft_objref.c | ||
| nft_osf.c | ||
| nft_payload.c | ||
| nft_queue.c | ||
| nft_quota.c | ||
| nft_range.c | ||
| nft_redir.c | ||
| nft_reject.c | ||
| nft_reject_inet.c | ||
| nft_reject_netdev.c | ||
| nft_rt.c | ||
| nft_set_bitmap.c | ||
| nft_set_hash.c | ||
| nft_set_pipapo.c | ||
| nft_set_pipapo.h | ||
| nft_set_pipapo_avx2.c | ||
| nft_set_pipapo_avx2.h | ||
| nft_set_rbtree.c | ||
| nft_socket.c | ||
| nft_synproxy.c | ||
| nft_tproxy.c | ||
| nft_tunnel.c | ||
| nft_xfrm.c | ||
| utils.c | ||
| x_tables.c | ||
| xt_addrtype.c | ||
| xt_AUDIT.c | ||
| xt_bpf.c | ||
| xt_cgroup.c | ||
| xt_CHECKSUM.c | ||
| xt_CLASSIFY.c | ||
| xt_cluster.c | ||
| xt_comment.c | ||
| xt_connbytes.c | ||
| xt_connlabel.c | ||
| xt_connlimit.c | ||
| xt_connmark.c | ||
| xt_CONNSECMARK.c | ||
| xt_conntrack.c | ||
| xt_cpu.c | ||
| xt_CT.c | ||
| xt_dccp.c | ||
| xt_devgroup.c | ||
| xt_dscp.c | ||
| xt_DSCP.c | ||
| xt_ecn.c | ||
| xt_esp.c | ||
| xt_hashlimit.c | ||
| xt_helper.c | ||
| xt_hl.c | ||
| xt_HL.c | ||
| xt_HMARK.c | ||
| xt_IDLETIMER.c | ||
| xt_ipcomp.c | ||
| xt_iprange.c | ||
| xt_ipvs.c | ||
| xt_l2tp.c | ||
| xt_LED.c | ||
| xt_length.c | ||
| xt_limit.c | ||
| xt_LOG.c | ||
| xt_mac.c | ||
| xt_mark.c | ||
| xt_MASQUERADE.c | ||
| xt_multiport.c | ||
| xt_nat.c | ||
| xt_NETMAP.c | ||
| xt_nfacct.c | ||
| xt_NFLOG.c | ||
| xt_NFQUEUE.c | ||
| xt_osf.c | ||
| xt_owner.c | ||
| xt_physdev.c | ||
| xt_pkttype.c | ||
| xt_policy.c | ||
| xt_quota.c | ||
| xt_RATEEST.c | ||
| xt_rateest.c | ||
| xt_realm.c | ||
| xt_recent.c | ||
| xt_REDIRECT.c | ||
| xt_repldata.h | ||
| xt_sctp.c | ||
| xt_SECMARK.c | ||
| xt_set.c | ||
| xt_socket.c | ||
| xt_state.c | ||
| xt_statistic.c | ||
| xt_string.c | ||
| xt_TCPMSS.c | ||
| xt_tcpmss.c | ||
| xt_TCPOPTSTRIP.c | ||
| xt_tcpudp.c | ||
| xt_TEE.c | ||
| xt_time.c | ||
| xt_TPROXY.c | ||
| xt_TRACE.c | ||
| xt_u32.c | ||