Linux 6.16 Merge Window

Linux v6.15 was released on Sunday,
May 25th, with the Linux v6.16 merge window opening immediately afterwards.
Below are the highlights of the
LSM,
SELinux, and
audit
pull requests which have been merged into Linus’ tree.

LSM

• Move the security_netlink_send() LSM hook under the
  Kconfig CONFIG_SECURITY_NETWORK
  tunable.

SELinux

• 
  

  Reduce the SELinux impact on path walks through the addition of a small
  directory access cache to the per-task SELinux state. This cache allows
  SELinux to cache the most recently used directory access decisions in order to
  avoid repeatedly querying the Access Vector Cache (AVC) on path walks where the
  majority of the directories have similar security contexts/labels. Crude
  performance measurements taken prior to this patch indicated that time spent in
  the SELinux code on a make allmodconfig run was 103% that of
  __d_lookup_rcu(), and with this patch the time spent in the SELinux code
  dropped to 63% of __d_lookup_rcu(), a ~40% improvement.

  
  


• 
  

  Add support for wildcards in genfscon policy statements as opposed to the
  current prefix matching approach. Adding wilcard support allows for more
  expressive and efficient path matching in the policy which is especially
  helpful for filesystems such as
  sysfs. Early work has
  shown a ~15% boot time reduction on Android. SELinux policies can opt into
  wilcard matching by enabling the genfs_seclabel_wildcard policy capability.

  
  


• 
  

  Unify the out of memory error handling of the SELinux network and InfiniBand
  object caches to ensure that cache allocation failures still return the object
  label and do not fail the operation. While the object label may not be cached
  in this case, future object lookups will continue to attempt to cache the
  object’s label.

  
  


• 
  

  Minor improvements around constification, ‘likely’ annotations, and removal
  of bogus code comments.

  
  

Audit

• 
  

  Always record AUDIT_ANOM events when auditing is enabled. Prior to this
  change AUDIT_ANOM events were only recorded if auditing was enabled and the
  admin/distro had explicitly configured audit beyond the defaults.

  
  


• 
  

  Annotate the audit_log_vformat() function with the __printf() attribute
  to quiet warnings on modern GCC compilers.