linux-stable.git/security, branch v7.1.13

selinux: switch two allocations to use kzalloc_objs()

2026-09-02T12:32:35+00:00

[ Upstream commit cf6a513f1937581eb012a217b29817e025a1a0ef ]

These were the only two allocations in the policy loading logic
that were not already using kzalloc_objs() for the policy
data structures. Fix these to be consistent with the rest and
to protect against ill-formed policy.

Signed-off-by: Stephen Smalley 
Signed-off-by: Paul Moore 
Signed-off-by: Sasha Levin

selinux: require a class's permission values to cover its permission count

2026-09-02T12:32:35+00:00

[ Upstream commit b98a8ac50775540f3804397ed08f61ef9910bcab ]

security_get_permissions() sizes an array by the class's permissions.nprim
and fills it at value - 1, from the inherited common's permission table and
then the class's own. A value no permission defines leaves a NULL that
sel_make_perm_files() passes to d_alloc_name(), an oops inside
sel_write_load() that strands selinux_state.policy_mutex and leaves every
later load in uninterruptible sleep; two permissions sharing a value
overwrite the first kstrdup(). Bounding each value by nprim catches
neither, and neither would a count: the symbol table is keyed on the
permission name, so duplicates pass.

Track the values each permission table claims and require them to cover
exactly what its count declares, rejecting a count no value can reach.
Conforming policies are unaffected.

Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore 
(cherry picked from commit b98a8ac50775540f3804397ed08f61ef9910bcab)
Signed-off-by: Wentao Guan 
Signed-off-by: Sasha Levin

selinux: reject a permission value exceeding the class permission count

2026-09-02T12:32:35+00:00

[ Upstream commit d14b5d0e97fccd27974fedc03b903408872907fd ]

perm_read() bounds a permission value by SEL_VEC_MAX but never by the
nprim of the owning class or common, which is taken verbatim from the
policy image.  security_get_permissions() then writes perms[value - 1]
into an nprim-sized kcalloc() array, so a class declaring fewer
permissions than its largest permission value drives an out-of-bounds
heap write.  The top-level symbol tables are validated this way; the
nested per-class permission table is not.

Reject a permission whose value exceeds nprim, which is already set when
perm_read() runs.  Well-formed policies are unaffected.

Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
[PM: tweak comment for line length]
Signed-off-by: Paul Moore 
(cherry picked from commit d14b5d0e97fccd27974fedc03b903408872907fd)
Signed-off-by: Wentao Guan 
Signed-off-by: Sasha Levin

selinux: more strict policy parsing

2026-09-02T12:32:35+00:00

[ Upstream commit 18fa21f10d008a0fc22565109c7d38f304295912 ]

Be more strict during parsing of policies and reject invalid values.

Add some error messages in the case of policy parse failures, to
enhance debugging, either on a malformed policy or a too strict check.

Signed-off-by: Christian Göttsche 
Acked-by: Stephen Smalley 
[PM: fixed checkpatch.pl warnings, style problems]
Signed-off-by: Paul Moore 
(cherry picked from commit 18fa21f10d008a0fc22565109c7d38f304295912)
Signed-off-by: Wentao Guan 
Signed-off-by: Sasha Levin

selinux: use u16 for security classes

2026-09-02T12:32:35+00:00

[ Upstream commit fa79a596848fe38c55ccab8832ac35dac07fb00c ]

Security class identifiers are limited to 2^16, thus use the appropriate
type u16 consistently.

Signed-off-by: Christian Göttsche 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore 
(cherry picked from commit fa79a596848fe38c55ccab8832ac35dac07fb00c)
Signed-off-by: Wentao Guan 
Signed-off-by: Sasha Levin

Revert "selinux: reject a permission value exceeding the class permission count"

2026-09-02T12:32:35+00:00

This reverts commit d81bda85d95f3a2b9eb906c7a818d88645413bb4.

The stable pick applied the nprim bound after symtab_insert() because
the upstream context (the SEL_VEC_MAX check from commit 18fa21f10d00
"selinux: more strict policy parsing") does not exist in this tree.
On that error path perm_destroy() frees a key/datum pair that is
already linked into the symtab, leading to a double free when the
failed policydb is torn down.

Drop it here; it is re-applied later in this series in its upstream
form, after its strict-parsing prerequisite.

Signed-off-by: Wentao Guan 
Signed-off-by: Sasha Levin

selinux: reject a permission value exceeding the class permission count

2026-08-23T12:29:17+00:00

commit d14b5d0e97fccd27974fedc03b903408872907fd upstream.

perm_read() bounds a permission value by SEL_VEC_MAX but never by the
nprim of the owning class or common, which is taken verbatim from the
policy image.  security_get_permissions() then writes perms[value - 1]
into an nprim-sized kcalloc() array, so a class declaring fewer
permissions than its largest permission value drives an out-of-bounds
heap write.  The top-level symbol tables are validated this way; the
nested per-class permission table is not.

Reject a permission whose value exceeds nprim, which is already set when
perm_read() runs.  Well-formed policies are unaffected.

Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
[PM: tweak comment for line length]
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

selinux: reject an unclaimed class value in security_get_classes()

2026-08-23T12:29:17+00:00

commit 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd upstream.

security_get_classes() sizes an array by p_classes.nprim and fills it at
value - 1, so a class value the policy never defines leaves a NULL.
sel_make_classes() passes every entry to sel_make_dir(), reaching the same
d_alloc_name() dereference as the permission array. The class symbol table
is allowed to be sparse (policydb_class_isvalid() exists to absorb that),
but this getter builds its own array straight from the hash table and has
no such predicate.

Fail the lookup when a value went unclaimed instead of handing out the
NULL. Conforming policies define every class they declare and are
unaffected.

Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

selinux: do not cancel a policy conversion that never started

2026-08-23T12:29:16+00:00

commit e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e upstream.

sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
fails, and that helper dereferences the outgoing policy to cancel its
sidtab conversion. On the first policy load there is no outgoing policy:
security_load_policy() returns early for that case, before it converts
anything, and state->policy is still NULL. A first load that fails while
building the selinuxfs tree therefore takes a NULL dereference in
selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.

Skip the cancel when there is no old policy, mirroring the check
security_load_policy() already makes before it converts.

Cc: stable@vger.kernel.org
Fixes: 02a52c5c8c3b ("selinux: move policy commit after updating selinuxfs")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

selinux: reject a class permission count below its inherited common

2026-08-23T12:29:16+00:00

commit 9a82dcd98b6e6e11cfd162410967951f12152528 upstream.

security_get_permissions() maps an inherited common's permissions into
an array sized by the class's own permissions.nprim, but class_read()
takes that nprim verbatim from the policy image and never checks that it
covers the common.  A class that inherits a common of N permissions while
declaring a smaller nprim is accepted, and on load the common's
permissions are written past the class-sized array -- an out-of-bounds
heap write.

Reject a class whose permission count is below its inherited common's.
Well-formed policies, where the class count already includes the
inherited permissions, are unaffected.

Cc: stable@vger.kernel.org
Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
Signed-off-by: Bryam Vargas 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman