Merge tag 'selinux-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull selinux updates from Paul Moore:
 "Two SELinux patches: one increases the sleep time on deprecated
  functionality, and one removes the indirect calls in the sidtab
  context conversion code"

* tag 'selinux-pr-20221212' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: remove the sidtab context conversion indirect calls
  selinux: increase the deprecation sleep for checkreqprot and runtime disable

diff --cc security/selinux/ss/services.c
index 64a6a37dc36d9a0bceb0f863c08cdd119a7ac043,e63c4f942fd6a11a7535b2c94ebe47fc2a6b85f3..0092b29022f5e46c2d29193c1a8d35e1941d6001
--- 1/security/selinux/ss/services.c
--- 2/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@@ -2014,18 -2008,20 +2008,22 @@@ static inline int convert_context_handl
        return 0;
  }
  
- /*
-  * Convert the values in the security context
-  * structure `oldc' from the values specified
-  * in the policy `p->oldp' to the values specified
-  * in the policy `p->newp', storing the new context
-  * in `newc'.  Verify that the context is valid
-  * under the new policy.
+ /**
+  * services_convert_context - Convert a security context across policies.
+  * @args: populated convert_context_args struct
+  * @oldc: original context
+  * @newc: converted context
++ * @gfp_flags: allocation flags
+  *
+  * Convert the values in the security context structure @oldc from the values
+  * specified in the policy @args->oldp to the values specified in the policy
+  * @args->newp, storing the new context in @newc, and verifying that the
+  * context is valid under the new policy.
   */
- static int convert_context(struct context *oldc, struct context *newc, void *p,
-                          gfp_t gfp_flags)
+ int services_convert_context(struct convert_context_args *args,
 -                           struct context *oldc, struct context *newc)
++                           struct context *oldc, struct context *newc,
++                           gfp_t gfp_flags)
  {
-       struct convert_context_args *args;
        struct ocontext *oc;
        struct role_datum *role;
        struct type_datum *typdatum;
@@@ -2034,10 -2030,8 +2032,8 @@@
        u32 len;
        int rc;
  
-       args = p;
- 
        if (oldc->str) {
 -              s = kstrdup(oldc->str, GFP_KERNEL);
 +              s = kstrdup(oldc->str, gfp_flags);
                if (!s)
                        return -ENOMEM;
  

diff --cc security/selinux/ss/services.h
index 9555ad074303c9954a6ba9a327d07be3bbdb8d05,6348c95ff0e52657267019521b54dc8b29c16b29..c4301626487fc1476828db94e1a40a14de2ae830
--- 1/security/selinux/ss/services.h
--- 2/security/selinux/ss/services.h
+++ b/security/selinux/ss/services.h
@@@ -29,10 -29,18 +29,19 @@@ struct selinux_policy 
        u32 latest_granting;
  } __randomize_layout;
  
- void services_compute_xperms_drivers(struct extended_perms *xperms,
-                               struct avtab_node *node);
+ struct convert_context_args {
+       struct selinux_state *state;
+       struct policydb *oldp;
+       struct policydb *newp;
+ };
  
+ void services_compute_xperms_drivers(struct extended_perms *xperms,
+                                    struct avtab_node *node);
  void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
-                                       struct avtab_node *node);
+                                     struct avtab_node *node);
+ 
+ int services_convert_context(struct convert_context_args *args,
 -                           struct context *oldc, struct context *newc);
++                           struct context *oldc, struct context *newc,
++                           gfp_t gfp_flags);
  
  #endif        /* _SS_SERVICES_H_ */

diff --cc security/selinux/ss/sidtab.c
index db5cce385bf863076834776d5bb954cd71f5c129,1c3d2cda6b92a974cde69126ae24c53e460156bd..38d25173aebd4553afa7510f4adbb7b6c222e6e2
--- 1/security/selinux/ss/sidtab.c
--- 2/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@@ -324,8 -327,8 +327,9 @@@ int sidtab_context_to_sid(struct sidta
                        goto out_unlock;
                }
  
-               rc = convert->func(context, &dst_convert->context,
-                                  convert->args, GFP_ATOMIC);
+               rc = services_convert_context(convert->args,
 -                                            context, &dst_convert->context);
++                                            context, &dst_convert->context,
++                                            GFP_ATOMIC);
                if (rc) {
                        context_destroy(&dst->context);
                        goto out_unlock;
@@@ -402,9 -405,9 +406,10 @@@ static int sidtab_convert_tree(union si
                }
                i = 0;
                while (i < SIDTAB_LEAF_ENTRIES && *pos < count) {
-                       rc = convert->func(&esrc->ptr_leaf->entries[i].context,
-                                          &edst->ptr_leaf->entries[i].context,
-                                          convert->args, GFP_KERNEL);
+                       rc = services_convert_context(convert->args,
+                                       &esrc->ptr_leaf->entries[i].context,
 -                                      &edst->ptr_leaf->entries[i].context);
++                                      &edst->ptr_leaf->entries[i].context,
++                                      GFP_KERNEL);
                        if (rc)
                                return rc;
                        (*pos)++;