From 8222d9a1b49678e74afefd25db49327ce6bd0b03 Mon Sep 17 00:00:00 2001
From: basamaryan <basam.aryan@gmail.com>
Date: Mon, 24 Nov 2025 13:02:07 +0100
Subject: [PATCH] UPSTREAM: Revert "BACKPORT: selinux: teach SELinux about
 anonymous inodes"

This reverts commit 43067ac3a37eec868f929af7dfd4cc61d4f84ff6.

Change-Id: Ie65a703caca9b1f973d6f3354519501cf9ce76d8
---
 security/selinux/hooks.c            | 57 -----------------------------
 security/selinux/include/classmap.h |  4 +-
 2 files changed, 1 insertion(+), 60 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index bf335248d225..7356ae6b96cb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2969,62 +2969,6 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
 	return 0;
 }
 
-static int selinux_inode_init_security_anon(struct inode *inode,
-					    const struct qstr *name,
-					    const struct inode *context_inode)
-{
-	const struct task_security_struct *tsec = selinux_cred(current_cred());
-	struct common_audit_data ad;
-	struct inode_security_struct *isec;
-	int rc;
-
-	if (unlikely(!selinux_state.initialized))
-		return 0;
-
-	isec = selinux_inode(inode);
-
-	/*
-	 * We only get here once per ephemeral inode.  The inode has
-	 * been initialized via inode_alloc_security but is otherwise
-	 * untouched.
-	 */
-
-	if (context_inode) {
-		struct inode_security_struct *context_isec =
-			selinux_inode(context_inode);
-		if (context_isec->initialized != LABEL_INITIALIZED) {
-			pr_err("SELinux:  context_inode is not initialized");
-			return -EACCES;
-		}
-
-		isec->sclass = context_isec->sclass;
-		isec->sid = context_isec->sid;
-	} else {
-		isec->sclass = SECCLASS_ANON_INODE;
-		rc = security_transition_sid(
-			&selinux_state, tsec->sid, tsec->sid,
-			isec->sclass, name, &isec->sid);
-		if (rc)
-			return rc;
-	}
-
-	isec->initialized = LABEL_INITIALIZED;
-	/*
-	 * Now that we've initialized security, check whether we're
-	 * allowed to actually create this type of anonymous inode.
-	 */
-
-	ad.type = LSM_AUDIT_DATA_INODE;
-	ad.u.inode = inode;
-
-	return avc_has_perm(&selinux_state,
-			    tsec->sid,
-			    isec->sid,
-			    isec->sclass,
-			    FILE__CREATE,
-			    &ad);
-}
-
 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
 {
 	return may_create(dir, dentry, SECCLASS_FILE);
@@ -7050,7 +6994,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
 	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
 	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
-	LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
 	LSM_HOOK_INIT(inode_create, selinux_inode_create),
 	LSM_HOOK_INIT(inode_link, selinux_inode_link),
 	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 41eb1b05a53a..c222791d8a77 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -247,9 +247,7 @@ struct security_class_mapping secclass_map[] = {
 	{ "xdp_socket",
 	  { COMMON_SOCK_PERMS, NULL } },
 	{ "perf_event",
-	  { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
-	{ "anon_inode",
-	  { COMMON_FILE_PERMS, NULL } },
+	  {"open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
 	{ NULL }
   };