Merge tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux updates from Paul Moore:

 - Reduce the SELinux impact on path walks.

   Add a small directory access cache to the per-task SELinux state.
   This cache allows SELinux to cache the most recently used directory
   access decisions in order to avoid repeatedly querying the AVC on
   path walks where the majority of the directories have similar
   security contexts/labels.

   My performance measurements are crude, but prior to this patch the
   time spent in SELinux code on a 'make allmodconfig' run was 103% that
   of __d_lookup_rcu(), and with this patch the time spent in SELinux
   code dropped to 63% of __d_lookup_rcu(), a ~40% improvement.

   Additional improvments can be expected in the future, but those will
   require additional SELinux policy/toolchain support.

 - Add support for wildcards in genfscon policy statements.

   This patch allows for wildcards in the genfscon patch matching logic
   as opposed to the prefix matching that was used prior to this change.
   Adding wilcard support allows for more expressive and efficient path
   matching in the policy which is especially helpful for sysfs, and has
   resulted in a ~15% boot time reduction in Android.

   SELinux policies can opt into wilcard matching by using the
   "genfs_seclabel_wildcard" policy capability.

 - Unify the error/OOM handling of the SELinux network caches.

   A failure to allocate memory for the SELinux network caches isn't
   fatal as the object label can still be safely returned to the caller,
   it simply means that we cannot add the new data to the cache, at
   least temporarily. This patch corrects this behavior for the
   InfiniBand cache and does some minor cleanup.

 - Minor improvements around constification, 'likely' annotations, and
   removal of bogus comments.

* tag 'selinux-pr-20250527' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix the kdoc header for task_avdcache_update
  selinux: remove a duplicated include
  selinux: reduce path walk overhead
  selinux: support wildcard match in genfscon
  selinux: drop copy-paste comment
  selinux: unify OOM handling in network hashtables
  selinux: add likely hints for fast paths
  selinux: contify network namespace pointer
  selinux: constify network address pointer

1 files changed, 15 insertions, 1 deletions

diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index c88cae81ee4c..6ee7dc4dfd6e 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -29,6 +29,13 @@
 #include "flask.h"
 #include "avc.h"
 
+struct avdc_entry {
+	u32 isid; /* inode SID */
+	u32 allowed; /* allowed permission bitmask */
+	u32 audited; /* audited permission bitmask */
+	bool permissive; /* AVC permissive flag */
+};
+
 struct task_security_struct {
 	u32 osid; /* SID prior to last execve */
 	u32 sid; /* current SID */
@@ -36,6 +43,13 @@ struct task_security_struct {
 	u32 create_sid; /* fscreate SID */
 	u32 keycreate_sid; /* keycreate SID */
 	u32 sockcreate_sid; /* fscreate SID */
+#define TSEC_AVDC_DIR_SIZE (1 << 2)
+	struct {
+		u32 sid; /* current SID for cached entries */
+		u32 seqno; /* AVC sequence number */
+		unsigned int dir_spot; /* dir cache index to check first */
+		struct avdc_entry dir[TSEC_AVDC_DIR_SIZE]; /* dir entries */
+	} avdcache;
 } __randomize_layout;
 
 enum label_initialized {
@@ -82,7 +96,7 @@ struct ipc_security_struct {
 };
 
 struct netif_security_struct {
-	struct net *ns; /* network namespace */
+	const struct net *ns; /* network namespace */
 	int ifindex; /* device index */
 	u32 sid; /* SID for this interface */
 };