[GIT PULL] AppArmor updates for v7.3
John Johansen
john.johansen at canonical.com
Wed Aug 26 15:58:20 UTC 2026
Hi Linus,
I know this is running late, I have an alternate PR with just the bug
fixes if you prefer. I ended up having to drop a couple of patch sets,
and pulled in a couple of the simpler bug fixes late. I have a few
more bug fixes coming but they will have to wait a week or two.
These patches have all been merge, build, and regression tested
against your tree as of yesterday. The majority of the code has had
several weeks of testing, both in linux-next and the Ubuntu kernels.
The biggest functional change is Jann Horn's fix for how aparmor is
doing stale cred updates after a policy replacement.
apparmor: fix cred UAF caused by begin_current_label_crit_section()
It moves the update to be done during task_work at the end of the
syscall.
The current patch set has one major feature which is allowing policy
to be compressed in userspace instead of after the fact (in kernel) if
we need to hold onto it for CRIU/introspection. This is responsible
for the majority of the diffstat in apparmorfs.c
The other major change is to do with network mediation. It is a lot of
code churn but does not do any functional changes to mediation. It
moves the code around, and refactors it to use newer patterns for
consistency, and in preparation for some improvements in mediation in
a future patchset. This change is responsible for the majority of the
diffstat in lsm.c and af_inet.c
The cleanup of the mount mediation to the newer patterns and macros is
responsible for the majority of the mount.c diffstat.
With the constification of code being the next largest contributor to
the diffstat.
thanks
- john
The following changes since commit dc59e4fea9d83f03bad6bddf3fa2e52491777482:
Linux 7.2-rc1 (2026-06-28 12:01:31 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2026-08-26
for you to fetch changes up to 3daad923a8685adb66087e0d819559b7eb6ba975:
apparmor: policy_int make sure list heads are initialized before fail path (2026-08-26 00:03:13 -0700)
----------------------------------------------------------------
+ Features
- support loading compressed policies
- add audit mode to provide a mechanism to silence complain messages
- refactor network mediation to use new patterns, and prepare
to for extended inet mediation (no functional change)
+ Cleanups
- switch website link to https
- make include headers self-contained, and fix circular include
- constify aa_label, aa_dfa, aa_profile, and aa_perms paraneters
- mark static tables and structs as read only
- drop use of _confined variant for iteration
- refactory mount to use check_perms
- refactor network mediation code to be together
- refactor xattr attachment, to take the file path
- optimize current_label_crit_section()
- leverage audit_log_n_untrustedstring() when possible
+ Bug Fies
- initialized policy lists heads before fail path
- fix deadlock in complain-mode change_hat
- auditing of mount binary data
- fix error debug output in fn_label_build
- fix race condition in label replacement
- fix unconfined user namespace restriction forced stack
- fix error handling for copy_from_user in policy_update
- fix out-of-bounds write when null terminating a label vec
- fix integer overflow in verify_tags() bounds check
- fix cred UAF caused by begin_current_label_crit_section()
- use SEND_SIG_NOINFO instead of NULL in aa_audit()
----------------------------------------------------------------
Baruch Siach (1):
apparmor: switch website link to https
Fabrice Derepas (1):
apparmor: fix integer overflow in verify_tags() bounds check
Hyunwoo Kim (1):
apparmor: fix out-of-bounds write when null terminating a label vec
Jann Horn (1):
apparmor: fix cred UAF caused by begin_current_label_crit_section()
John Johansen (30):
apparmor: fix alternate loaders ability to load compressed policy
apparmor: compressed_data not described in aa_get_data_from_compressed
apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled
apparmor: fix implicit declaration of function 'decompress_zstd'
apparmor: Fix warning: 'decompress_zstd' defined but not used
apparmor: optimize current_label_crit_section() with needput
apparmor: fix error handling for copy_from_user in policy_update
apparmor: make MEDIATES_AF_UNIX its own fn
apparmor: refactor network sock mediation in preparation for inet mediation
apparmor: push inet mediation into profile callbacks, and improve auditing
apparmor: refactor network socket mediation to support compatibility
apparmor: move netfilter functions next to the LSM network operations
apparmor: move sock_rcv_skb() next to inet_conn_request
apparmor: reserve mediation class for packet mediation
apparmor: fix unconfined user namespace restriction forced stack
apparmor: refactor xattr attachment, to take the file path
apparmor: fix race condition in label replacement
apparmor: make table entry count last enum for static tables
apparmor: fix error debug output in fn_label_build
apparmor: mark static tables and structs as read only
apparmor: add audit mode to provide a mechanism to silence complain messages
apparmor: fix auditing of mount binary data
apparmor: refactory mount to use check_perms
apparmor: drop use of _confined variant for iteration
apparmor: constify aa_perms parameters that are read-only
apparmor: constify aa_profile parameters on read-only compute paths
apparmor: constify aa_dfa parameters on read-only compute paths
apparmor: constify aa_label parameters on read-only query helpers
apparmor: fix deadlock in complain-mode change_hat
apparmor: policy_int make sure list heads are initialized before fail path
Maxime Bélair (1):
apparmor: Initial support for compressed policies
Oleg Nesterov (1):
apparmor: use SEND_SIG_NOINFO instead of NULL in aa_audit()
Paul Moore (1):
apparmor: leverage audit_log_n_untrustedstring() when possible
Ryan Lee (2):
apparmor: fix net.h and policy.h circular include pattern
apparmor: make include headers self-contained
Tetsuo Handa (1):
apparmor: replace decompress_zstd() prototype with its entity
security/apparmor/Kconfig | 14 +-
security/apparmor/Makefile | 2 +-
security/apparmor/af_inet.c | 565 ++++++++++++++++++++++++++++++
security/apparmor/af_unix.c | 44 ++-
security/apparmor/apparmorfs.c | 281 +++++++++++----
security/apparmor/audit.c | 40 ++-
security/apparmor/capability.c | 2 +-
security/apparmor/domain.c | 157 ++++++---
security/apparmor/file.c | 15 +-
security/apparmor/include/af_inet.h | 36 ++
security/apparmor/include/apparmor.h | 1 +
security/apparmor/include/apparmorfs.h | 3 +
security/apparmor/include/audit.h | 10 +-
security/apparmor/include/capability.h | 3 +-
security/apparmor/include/cred.h | 22 +-
security/apparmor/include/file.h | 2 +-
security/apparmor/include/label.h | 31 +-
security/apparmor/include/lib.h | 6 +-
security/apparmor/include/match.h | 18 +-
security/apparmor/include/net.h | 9 +-
security/apparmor/include/path.h | 3 +
security/apparmor/include/perms.h | 19 +-
security/apparmor/include/policy.h | 17 +-
security/apparmor/include/policy_unpack.h | 4 +-
security/apparmor/include/procattr.h | 2 +
security/apparmor/include/task.h | 20 +-
security/apparmor/label.c | 95 +++--
security/apparmor/lib.c | 57 ++-
security/apparmor/lsm.c | 282 +++++++++------
security/apparmor/match.c | 35 +-
security/apparmor/mount.c | 279 ++++++---------
security/apparmor/net.c | 47 +--
security/apparmor/policy.c | 30 +-
security/apparmor/policy_compat.c | 14 +-
security/apparmor/policy_unpack.c | 30 +-
security/apparmor/task.c | 27 ++
36 files changed, 1609 insertions(+), 613 deletions(-)
create mode 100644 security/apparmor/af_inet.c
create mode 100644 security/apparmor/include/af_inet.h
More information about the Linux-security-module-archive
mailing list