Merge tag 'apparmor-pr-2026-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor updates from John Johansen:
"Cleanups
- Use sysfs_emit in param_get_{audit,mode}
- Remove redundant if check in sk_peer_get_label
- Replace memcpy + NUL termination with kmemdup_nul in do_setattr

Bug Fixes:
- Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine
- Fix string overrun due to missing termination
- Fix wrong dentry in RENAME_EXCHANGE uid check
- fix unpack_tags to properly return error in failure cases
- fix dfa size check
- return error on namespace mismatch in verify_header
- use target task's context in apparmor_getprocattr()"

* tag 'apparmor-pr-2026-04-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
apparmor/lsm: Fix aa_dfa_unpack's error handling in aa_setup_dfa_engine
apparmor: Fix string overrun due to missing termination
apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check
apparmor: fix unpack_tags to properly return error in failure cases
apparmor: fix dfa size check
apparmor: Use sysfs_emit in param_get_{audit,mode}
apparmor: Remove redundant if check in sk_peer_get_label
apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr
apparmor: return error on namespace mismatch in verify_header
apparmor: use target task's context in apparmor_getprocattr()

Linus Torvalds 2 weeks ago eefe0b9d dd6c438c

+22 -26

4 changed files

expand all

security

apparmor

lsm.c

match.c

path.c

policy_unpack.c

+14 -22

security/apparmor/lsm.c

··· 17 17 #include <linux/ptrace.h> 18 18 #include <linux/ctype.h> 19 19 #include <linux/sysctl.h> 20 + #include <linux/sysfs.h> 20 21 #include <linux/audit.h> 21 22 #include <linux/user_namespace.h> 22 23 #include <linux/netfilter_ipv4.h> ··· 410 409 struct path_cond cond_exchange = { 411 410 .mode = d_backing_inode(new_dentry)->i_mode, 412 411 }; 413 - vfsuid = i_uid_into_vfsuid(idmap, d_backing_inode(old_dentry)); 412 + vfsuid = i_uid_into_vfsuid(idmap, d_backing_inode(new_dentry)); 414 413 cond_exchange.uid = vfsuid_into_kuid(vfsuid); 415 414 416 415 error = aa_path_perm(OP_RENAME_SRC, current_cred(), ··· 823 822 char **value) 824 823 { 825 824 int error = -ENOENT; 826 - /* released below */ 827 - const struct cred *cred = get_task_cred(task); 828 - struct aa_task_ctx *ctx = task_ctx(current); 829 825 struct aa_label *label = NULL; 830 826 827 + rcu_read_lock(); 831 828 if (strcmp(name, "current") == 0) 832 - label = aa_get_newest_label(cred_label(cred)); 833 - else if (strcmp(name, "prev") == 0 && ctx->previous) 834 - label = aa_get_newest_label(ctx->previous); 835 - else if (strcmp(name, "exec") == 0 && ctx->onexec) 836 - label = aa_get_newest_label(ctx->onexec); 829 + label = aa_get_newest_cred_label(__task_cred(task)); 830 + else if (strcmp(name, "prev") == 0 && task_ctx(task)->previous) 831 + label = aa_get_newest_label(task_ctx(task)->previous); 832 + else if (strcmp(name, "exec") == 0 && task_ctx(task)->onexec) 833 + label = aa_get_newest_label(task_ctx(task)->onexec); 837 834 else 838 835 error = -EINVAL; 836 + rcu_read_unlock(); 839 837 840 838 if (label) 841 839 error = aa_getprocattr(label, value, true); 842 840 843 841 aa_put_label(label); 844 - put_cred(cred); 845 842 846 843 return error; 847 844 } ··· 857 858 858 859 /* AppArmor requires that the buffer must be null terminated atm */ 859 860 if (args[size - 1] != '\0') { 860 - /* null terminate */ 861 - largs = args = kmalloc(size + 1, GFP_KERNEL); 861 + largs = args = kmemdup_nul(value, size, GFP_KERNEL); 862 862 if (!args) 863 863 return -ENOMEM; 864 - memcpy(args, value, size); 865 - args[size] = '\0'; 866 864 } 867 865 868 866 error = -EINVAL; ··· 1524 1528 static struct aa_label *sk_peer_get_label(struct sock *sk) 1525 1529 { 1526 1530 struct aa_sk_ctx *ctx = aa_sock(sk); 1527 - struct aa_label *label = ERR_PTR(-ENOPROTOOPT); 1528 1531 1529 1532 if (rcu_access_pointer(ctx->peer)) 1530 1533 return aa_get_label_rcu(&ctx->peer); 1531 1534 1532 - if (sk->sk_family != PF_UNIX) 1533 - return ERR_PTR(-ENOPROTOOPT); 1534 - 1535 - return label; 1535 + return ERR_PTR(-ENOPROTOOPT); 1536 1536 } 1537 1537 1538 1538 /** ··· 2065 2073 return -EINVAL; 2066 2074 if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 2067 2075 return -EPERM; 2068 - return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 2076 + return sysfs_emit(buffer, "%s\n", audit_mode_names[aa_g_audit]); 2069 2077 } 2070 2078 2071 2079 static int param_set_audit(const char *val, const struct kernel_param *kp) ··· 2093 2101 return -EINVAL; 2094 2102 if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 2095 2103 return -EPERM; 2096 - 2097 - return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 2104 + return sysfs_emit(buffer, "%s\n", aa_profile_mode_names[aa_g_profile_mode]); 2098 2105 } 2099 2106 2100 2107 static int param_set_mode(const char *val, const struct kernel_param *kp) ··· 2456 2465 TO_ACCEPT2_FLAG(YYTD_DATA32)); 2457 2466 if (IS_ERR(nulldfa)) { 2458 2467 error = PTR_ERR(nulldfa); 2468 + nulldfa = NULL; 2459 2469 goto fail; 2460 2470 } 2461 2471 nullpdb->dfa = aa_get_dfa(nulldfa);

+1 -1

security/apparmor/match.c

··· 157 157 158 158 state_count = dfa->tables[YYTD_ID_BASE]->td_lolen; 159 159 trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen; 160 - if (state_count == 0) 160 + if (state_count < 2) 161 161 goto out; 162 162 for (i = 0; i < state_count; i++) { 163 163 if (DEFAULT_TABLE(dfa)[i] >= state_count) {

+5 -3

security/apparmor/path.c

··· 164 164 } 165 165 166 166 out: 167 - /* Append "/" to directory paths, except for root "/" which 168 - * already ends in a slash. 167 + /* Append "/" to directory paths and reterminate string, except for 168 + * root "/" which already ends in a slash. 169 169 */ 170 170 if (!error && isdir) { 171 171 bool is_root = (*name)[0] == '/' && (*name)[1] == '\0'; 172 172 173 - if (!is_root) 173 + if (!is_root) { 174 174 buf[aa_g_path_max - 2] = '/'; 175 + buf[aa_g_path_max - 1] = '\0'; 176 + } 175 177 } 176 178 177 179 return error;

security/apparmor/policy_unpack.c

··· 879 879 *info = "failed to unpack profile tag.sets"; 880 880 goto fail; 881 881 } 882 + error = -EPROTO; 882 883 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) 883 884 goto fail; 884 885 ··· 1466 1465 if (*ns && strcmp(*ns, name)) { 1467 1466 audit_iface(NULL, NULL, NULL, "invalid ns change", e, 1468 1467 error); 1468 + return error; 1469 1469 } else if (!*ns) { 1470 1470 *ns = kstrdup(name, GFP_KERNEL); 1471 1471 if (!*ns)

Configure Feed

Configure Feed