[GIT PULL] selinux/selinux-pr-20260805

[Paul Moore]

Linus,

Eight SELinux patches for the next v7.2-rcX release, a quick summary
below:

- Continue to improve the validation of SELinux policies during load

- Fix a SELinux regression caused by bpffs changes in v7.2-rc1

- Fix a SELinux preformance regression caused by SELinux changes in v7.2-rc1

Paul

--
The following changes since commit f5098b6bae761e346ebcd9da7f95622c04733cff:

  Linux 7.2-rc5 (2026-07-26 14:45:48 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
    tags/selinux-pr-20260805

for you to fetch changes up to 9c1cc4a7f79275ef93746f6247685763b475bfb0:

  selinux: check level category sets once at load time
    (2026-08-04 10:57:46 -0400)

----------------------------------------------------------------
selinux/stable-7.2 PR 20260805
----------------------------------------------------------------

Bryam Vargas (6):
      selinux: reject a permission value exceeding the class permission
         count
      selinux: reject a class permission count below its inherited
         common
      selinux: do not cancel a policy conversion that never started
      selinux: require a class's permission values to cover its
         permission count
      selinux: reject an unclaimed class value in security_get_classes()
      selinux: require every boolean value to be defined

Carlos Llamas (1):
      selinux: bpf: check SBLABEL_MNT before isec init

Stephen Smalley (1):
      selinux: check level category sets once at load time

 security/selinux/hooks.c       |    8 +-
 security/selinux/ss/mls.c      |   24 ++-----
 security/selinux/ss/policydb.c |  108 +++++++++++++++++++++++++++++++--
 security/selinux/ss/services.c |   28 ++++++--
 4 files changed, 136 insertions(+), 32 deletions(-)

--
paul-moore.com