Merge tag 'selinux-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull selinux updates from Paul Moore:

 - Extended permissions supported in conditional policy

   The SELinux extended permissions, aka "xperms", allow security admins
   to target individuals ioctls, and recently netlink messages, with
   their SELinux policy. Adding support for conditional policies allows
   admins to toggle the granular xperms using SELinux booleans, helping
   pave the way for greater use of xperms in general purpose SELinux
   policies. This change bumps the maximum SELinux policy version to 34.

 - Fix a SCTP/SELinux error return code inconsistency

   Depending on the loaded SELinux policy, specifically it's
   EXTSOCKCLASS support, the bind(2) LSM/SELinux hook could return
   different error codes due to the SELinux code checking the socket's
   SELinux object class (which can vary depending on EXTSOCKCLASS) and
   not the socket's sk_protocol field. We fix this by doing the obvious,
   and looking at the sock->sk_protocol field instead of the object
   class.

 - Makefile fixes to properly cleanup av_permissions.h

   Add av_permissions.h to "targets" so that it is properly cleaned up
   using the kbuild infrastructure.

 - A number of smaller improvements by Christian Göttsche

   A variety of straightforward changes to reduce code duplication,
   reduce pointer lookups, migrate void pointers to defined types,
   simplify code, constify function parameters, and correct iterator
   types.

* tag 'selinux-pr-20250121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: make more use of str_read() when loading the policy
  selinux: avoid unnecessary indirection in struct level_datum
  selinux: use known type instead of void pointer
  selinux: rename comparison functions for clarity
  selinux: rework match_ipv6_addrmask()
  selinux: constify and reconcile function parameter names
  selinux: avoid using types indicating user space interaction
  selinux: supply missing field initializers
  selinux: add netlink nlmsg_type audit message
  selinux: add support for xperms in conditional policies
  selinux: Fix SCTP error inconsistency in selinux_socket_bind()
  selinux: use native iterator types
  selinux: add generated av_permissions.h to targets

diff --cc include/linux/lsm_audit.h
Simple merge

diff --cc security/lsm_audit.c
Simple merge

diff --cc security/selinux/hooks.c
Simple merge

diff --cc security/selinux/include/security.h
Simple merge

diff --cc security/selinux/ss/services.c
index d9f58b5d0f49f04e7ff52921634a2d9f66f61550,e5c9b62e59c174d1c07eec6f44dfeff86701e2c1..8478842fbf9ef919cff9457c082c7bf0f77e26ab
--- 1/security/selinux/ss/services.c
--- 2/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@@ -973,10 -967,12 +973,12 @@@ static void update_xperms_extended_data
  void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
                                        struct avtab_node *node)
  {
+       u16 specified;
+ 
        switch (node->datum.u.xperms->specified) {
        case AVTAB_XPERMS_IOCTLFUNCTION:
 -      case AVTAB_XPERMS_NLMSG:
 -              if (xpermd->driver != node->datum.u.xperms->driver)
 +              if (xpermd->base_perm != AVC_EXT_IOCTL ||
 +                  xpermd->driver != node->datum.u.xperms->driver)
                        return;
                break;
        case AVTAB_XPERMS_IOCTLDRIVER:
@@@ -991,13 -981,12 +993,15 @@@
                        return;
                break;
        default:
 -              BUG();
 +              pr_warn_once(
 +                      "SELinux: unknown extended permission (%u) will be ignored\n",
 +                      node->datum.u.xperms->specified);
 +              return;
        }
  
-       if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
+       specified = node->key.specified & ~(AVTAB_ENABLED | AVTAB_ENABLED_OLD);
+ 
+       if (specified == AVTAB_XPERMS_ALLOWED) {
                xpermd->used |= XPERMS_ALLOWED;
                update_xperms_extended_data(node->datum.u.xperms->specified,
                                            &node->datum.u.xperms->perms,