Linux 7.2 Released

Linux v7.2 was released this past Sunday, August 16th. I previously wrote about the LSM, SELinux, and audit changes that were submitted this release, and LWN.net did their usual good job of covering the first and second weeks of the merge window. However, there were additional changes that went into Linux v7.2 during the release candidate phase that are described below.

SELinux

• Fixed a problem where the connect permissions were not properly checked on sockets using TCP Fast Open (TFO).

• Fixed a problem where an incorrect process { execmem } check was performed on overlayfs filesystems using the mounter credentials. For the process { execmem } permission, only the process credentials need to be considered.

• Fixed a problem where a change to bpffs could cause SELinux to mark an inode as initialized before checking if it was possible to initialize the inode, potentially leaving the inode in an awkward state.

• Fixed a problem where certain SCTP ASCONF operations could resolve a socket improperly.

• Added support for the new XFRM_MSG_MIGRATE_STATE netlink command as a netlink_xfrm_socket { nlmsg_write } operation.

• Added a number of additional policy checks at policy load time to help ensure that the new policy is correctly formed.

• Stopped attempting to cancel an old policy conversion operation on a failed initial policy load, as there is no old policy to convert in this case.

Audit

• Fixed a number of potential races when adding and removing audit records from the main audit queue.

• Fixed a couple of potential integer overflows when logging extremely large audit records.

• Fixed a potential use-after-free when deleting audit filter rules.