[GIT PULL] AppArmor updates for 7.1

[John Johansen]

Hi Linus,

We ran into some issue with what was going to go in this cycles PR,
and I am still not happy with the revisions.  So I am just going with
some bug fixes and 3 cleanups that have been queued most of the cycle.

This has been merge, built and regression tested, against your tree
from a couple of days ago.

There isn't any thing all that exciting in here, separating out the
changes.

+ Cleanups
   - Use sysfs_emit in param_get_{audit,mode}
   - Remove redundant if check in sk_peer_get_label
   - Replace memcpy + NUL termination with kmemdup_nul in do_setattr

+ Bug Fixes
   - Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine
   - Fix string overrun due to missing termination
   - Fix wrong dentry in RENAME_EXCHANGE uid check
   - fix unpack_tags to properly return error in failure cases
   - fix dfa size check
   - return error on namespace mismatch in verify_header
   - use target task's context in apparmor_getprocattr()


Pull at your convenience -rc2 even later is fine, and if you want I
can just send the bug fixes up during the -rc2 window.


thanks
- john




The following changes since commit 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f:

   Linux 7.0-rc1 (2026-02-22 13:18:59 -0800)

are available in the Git repository at:

   git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2026-04-23

for you to fetch changes up to 11b7df0952663f20ce72c9a22a3cf9278cf84db7:

   apparmor/lsm: Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine (2026-04-22 20:11:08 -0700)

----------------------------------------------------------------
+ Cleanups
   - Use sysfs_emit in param_get_{audit,mode}
   - Remove redundant if check in sk_peer_get_label
   - Replace memcpy + NUL termination with kmemdup_nul in do_setattr

+ Bug Fixes
   - Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine
   - Fix string overrun due to missing termination
   - Fix wrong dentry in RENAME_EXCHANGE uid check
   - fix unpack_tags to properly return error in failure cases
   - fix dfa size check
   - return error on namespace mismatch in verify_header
   - use target task's context in apparmor_getprocattr()

----------------------------------------------------------------
Cengiz Can (1):
       apparmor: use target task's context in apparmor_getprocattr()

Daniel J Blueman (1):
       apparmor: Fix string overrun due to missing termination

Dudu Lu (1):
       apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check

GONG Ruiqi (1):
       apparmor/lsm: Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine

John Johansen (2):
       apparmor: fix dfa size check
       apparmor: fix unpack_tags to properly return error in failure cases

Massimiliano Pellizzer (1):
       apparmor: return error on namespace mismatch in verify_header

Thorsten Blum (3):
       apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr
       apparmor: Remove redundant if check in sk_peer_get_label
       apparmor: Use sysfs_emit in param_get_{audit,mode}

  security/apparmor/lsm.c           | 36 ++++++++++++++----------------------
  security/apparmor/match.c         |  2 +-
  security/apparmor/path.c          |  8 +++++---
  security/apparmor/policy_unpack.c |  2 ++
  4 files changed, 22 insertions(+), 26 deletions(-)