Commit 8ffc7dbce2d5 for kernel

commit 8ffc7dbce2d54d2ac1fac9f79a94cb84b0cba1f5
Merge: a8220b0ca798 d7b6918e22c7
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Nov 18 17:30:52 2024 -0800

    Merge tag 'selinux-pr-20241112' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

    Pull selinux updates from Paul Moore:

     - Add support for netlink xperms

       Some time ago we added the concept of "xperms" to the SELinux policy
       so that we could write policy for individual ioctls, this builds upon
       this by using extending xperms to netlink so that we can write
       SELinux policy for individual netlnk message types and not rely on
       the fairly coarse read/write mapping tables we currently have.

       There are limitations involving generic netlink due to the
       multiplexing that is done, but it's no worse that what we currently
       have. As usual, more information can be found in the commit message.

     - Deprecate /sys/fs/selinux/user

       We removed the only known userspace use of this back in 2020 and now
       that several years have elapsed we're starting down the path of
       deprecating it in the kernel.

     - Cleanup the build under scripts/selinux

       A couple of patches to move the genheaders tool under
       security/selinux and correct our usage of kernel headers in the tools
       located under scripts/selinux. While these changes originated out of
       an effort to build Linux on different systems, they are arguably the
       right thing to do regardless.

     - Minor code cleanups and style fixes

       Not much to say here, two minor cleanup patches that came out of the
       netlink xperms work

    * tag 'selinux-pr-20241112' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
      selinux: Deprecate /sys/fs/selinux/user
      selinux: apply clang format to security/selinux/nlmsgtab.c
      selinux: streamline selinux_nlmsg_lookup()
      selinux: Add netlink xperm support
      selinux: move genheaders to security/selinux/
      selinux: do not include <linux/*.h> headers from host programs