-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmg17c0UHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPLZhAAoEOtbcgImq6Qn8vH0rPcA0y5n2as
Seg7lfz3HFFo1R8aV8d3PIHbmbhpW2EnLJnDQS3lhgzRCzM9/seXOkX47P7hyu7L
IJvZ9RU1JFhLU/7y4p3KsGJGowNoVVaJLRlD/IpwzX3osBOImZBTCy28lfD608g3
RSC1CMIsTuKnWPD+7CFy62pZDixRP/MhxCleTnN7qH/65N6UnqT0rolEgqJUlfZ4
Gji5GVXLIWjEnz2fkCearxqjA6STz8SAYgYoysgWSZoyhbGMetCTaVQj6iXcwqJO
yX39jxoI4XymcxCwa/aypeCB1PllkO86qPJ7coJA+v5EHnuRXzQ/XANiNtTRZUlg
itGr8/H4CABVMKsuEqw4lU587b42kVnrS6JIETdqzRievtBoNmp6RTXTQvd8w7GV
zvAyWgl1gSBWRWCZN9UVA9w76sL6NL4alaFhAUQ352oMiSODwfS7ooiki5V8GAe7
SvCl1WgrBmhUS87MFnXk9p2YzWcrUdOdsqHCm3JFGqepE5czWtDZ8fAzW5STrkYL
eJiIbOM6qxDW8uiFXtenp8FXg31iWmR4/N1fjK3vQ5jVIYQDjWAlKG/WYxGK84Nf
IS/MvKQgJU0+j3LoZX/Fr5hz3uZSFHUV+ZjpniF8y6x/MAbg1Q4IYuDDJpNP96rP
fG2k78KSx8q3ckk=
=6ljO
-----END PGP SIGNATURE-----
Merge tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux updates from Paul Moore:
- Reduce the SELinux impact on path walks.
Add a small directory access cache to the per-task SELinux state.
This cache allows SELinux to cache the most recently used directory
access decisions in order to avoid repeatedly querying the AVC on
path walks where the majority of the directories have similar
security contexts/labels.
My performance measurements are crude, but prior to this patch the
time spent in SELinux code on a 'make allmodconfig' run was 103% that
of __d_lookup_rcu(), and with this patch the time spent in SELinux
code dropped to 63% of __d_lookup_rcu(), a ~40% improvement.
Additional improvments can be expected in the future, but those will
require additional SELinux policy/toolchain support.
- Add support for wildcards in genfscon policy statements.
This patch allows for wildcards in the genfscon patch matching logic
as opposed to the prefix matching that was used prior to this change.
Adding wilcard support allows for more expressive and efficient path
matching in the policy which is especially helpful for sysfs, and has
resulted in a ~15% boot time reduction in Android.
SELinux policies can opt into wilcard matching by using the
"genfs_seclabel_wildcard" policy capability.
- Unify the error/OOM handling of the SELinux network caches.
A failure to allocate memory for the SELinux network caches isn't
fatal as the object label can still be safely returned to the caller,
it simply means that we cannot add the new data to the cache, at
least temporarily. This patch corrects this behavior for the
InfiniBand cache and does some minor cleanup.
- Minor improvements around constification, 'likely' annotations, and
removal of bogus comments.
* tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: fix the kdoc header for task_avdcache_update
selinux: remove a duplicated include
selinux: reduce path walk overhead
selinux: support wildcard match in genfscon
selinux: drop copy-paste comment
selinux: unify OOM handling in network hashtables
selinux: add likely hints for fast paths
selinux: contify network namespace pointer
selinux: constify network address pointer
b5628b81bd