kernel/git/stable/linux.git/security/apparmor/label.c, branch master

apparmor: constify aa_label parameters on read-only query helpers

2026-08-11T05:49:43+00:00

Several label helpers only read from their struct aa_label * arguments: they compare labels, test subset relationships, or check the mediation bitmask, all via direct field/index access. Mark those parameters const struct aa_label * to document intent and let the compiler enforce that the label is not modified. The converted functions are: - label_mediates(), label_mediates_safe() - aa_label_cmp() (and its vec_cmp() helper) - __aa_label_next_not_in_set(), aa_label_is_subset(), aa_label_is_unconfined_subset() - __aa_subj_label_is_cached() - aa_label_next_confined(), aa_label_next_in_merge() These all access the label through direct indexing or manual iterators rather than the label_for_each()/fn_for_each() macros, which are not const-correct and so gate the majority of the remaining label consumers (the print, match, and permission-check paths) from being constified. No functional change. Signed-off-by: John Johansen Assisted-by: Claude:claude-opus-4.8

apparmor: constify aa_profile parameters on read-only compute paths

2026-08-11T05:49:43+00:00

A number of functions take a struct aa_profile * argument that is only ever read from: they compute DFA matches or apply the profile's mode flags without modifying the profile, taking a reference on it, or touching its embedded label. Mark those parameters const struct aa_profile * to document intent and let the compiler enforce it. The converted functions are the permission "compute" path plus a few pure readers: - aa_apply_modes_to_perms(), aa_profile_match_label() - AUDIT_MODE() - aa_label_match() and its match_component()/label_compound_match()/ label_components_match() helpers (label.c) - match_component()/label_compound_match()/label_components_match()/ label_match()/change_profile_perms()/aa_xattrs_match() (domain.c) - match_iface()/match_addr_iface()/match_addr_iface_label()/ skb_match_to_sk()/skb_match_to_cmd() (af_inet.c) - aa_profile_capget(), path_flags(), profile_query_cb() The remaining aa_profile * parameters cannot be made const: the audit path stores &profile->label into the owned, refcounted apparmor_audit_data.subj_label/peer fields, and the domain/lifecycle paths take references on the profile's embedded label (aa_get_label()/aa_get_newest_label()/aa_get_profile()) or write profile fields. No functional change. Signed-off-by: John Johansen Assisted-by: Claude:claude-opus-4.8

apparmor: fix race condition in label replacement

2026-08-11T05:49:42+00:00

label replacement can result in the need for locking on two separate trees. Currently this is done by locking the tree to remove and then the tree to add to. For compound labels the race can result in the old label proxy pointing to the the new label that lost the race and that was not inserted in to the new tree. This does not break mediation, but it does result in a task that will not update its profile correctly on future mediation, and that will leak its refcount due to a circular reference in its proxy, resulting in a memory leak. Signed-off-by: John Johansen

apparmor: leverage audit_log_n_untrustedstring() when possible

2026-07-21T02:07:03+00:00

Make use of the audit_log_n_untrustedstring() function to simplify the code in aa_label_xaudit(). Signed-off-by: Paul Moore Signed-off-by: John Johansen

apparmor: use __label_make_stale in __aa_proxy_redirect

2026-06-14T03:14:06+00:00

The macro is equivalent to OR-ing in the bitflag manually, but using the macro consistently makes grepping for these occurrences easier. Reviewed-by: Georgia Garcia Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: aa_label_alloc use aa_label_free on alloc failure

2026-06-14T03:14:06+00:00

aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label memory, leaking any resources initialized by aa_label_init(). Use aa_label_free() on the failure path so partially initialized labels release their secid and other label resources before the backing memory is freed. Fixes: f1bd904175e81 ("apparmor: add the base fns() for domain labels") Signed-off-by: Zygmunt Krynicki Signed-off-by: John Johansen

apparmor: add a conditional version of get_newest_label

2026-06-14T03:14:06+00:00

get_newest_label() will always return a refcount, on the profile it returns. However there are cases where we only need the refcount if the label is stale and get_newest_label() will return a different label. Optimize this by making the get/put happen conditionally, by keeping a flag indicating if the get was performed and a put is needed. Signed-off-by: John Johansen

apparmor: fix race between freeing data and fs accessing it

2026-03-09T23:05:44+00:00

AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction. Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files") Reported-by: Qualys Security Advisory Reviewed-by: Georgia Garcia Reviewed-by: Maxime Bélair Reviewed-by: Cengiz Can Signed-off-by: John Johansen

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

apparmor: fix aa_label to return state from compount and component match

2026-02-02T12:16:26+00:00

aa-label_match is not correctly returning the state in all cases. The only reason this didn't cause a error is that all callers currently ignore the return value. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202602020631.wXgZosyU-lkp@intel.com/ Fixes: a4c9efa4dbad6 ("apparmor: make label_match return a consistent value") Signed-off-by: John Johansen