kernel/git/stable/linux.git/security/apparmor/net.c, branch master

apparmor: constify aa_dfa parameters on read-only compute paths

2026-08-11T05:49:43+00:00

Most uses of aa_dfa a read-only walking of the dfa. Have the compiler enforce this. Signed-off-by: John Johansen

apparmor: constify aa_perms parameters that are read-only

2026-08-11T05:49:42+00:00

Several functions take a struct aa_perms * argument that is only ever read from and never modified through the pointer. Mark those parameters const struct aa_perms * to document intent and let the compiler enforce that the permission set is not mutated. The converted functions are: - aa_check_perms() - aa_do_perms() - do_perms() (af_inet) - match_label() (af_unix) - verify_perm() - aa_perms_accum() / aa_perms_accum_raw() (@addend only) No functional change. Signed-off-by: John Johansen Assisted-by: Claude:claude-opus-4.8

apparmor: refactor network socket mediation to support compatibility

2026-08-11T05:49:41+00:00

Make it easier for distros to support the network backwards compat patch by refactoring the code to minimize the changes needed. Signed-off-by: John Johansen

apparmor: refactor network sock mediation in preparation for inet mediation

2026-08-11T05:49:41+00:00

Refactor network mediation, introducing the stub code for the fine grained inet mediation. This is a preparatory step and does not change mediation. Signed-off-by: John Johansen

apparmor: optimize current_label_crit_section() with needput

2026-08-08T02:15:31+00:00

The {begin,end}_current_label_crit_section() has the same issue as the {__begin,__end} version. That is the check to see if the label has been updated in the end check forces an unnecessary memory barrier. We can optimize this the same way we do with the {__begin,__end} variant by passing in a local variable that carries the state information from the begin check into the end check. No functional change. Signed-off-by: John Johansen

apparmor: advertise the tcp fast open fix is applied

2026-06-24T05:15:15+00:00

The fix for tcp-fast-open ensures that the connect permission is being mediated correctly but it didn't add an artifact to the feature set to advertise the fix is available. Add an artifact so that the test suite can identify if the fix has not been properly applied or a new unexpected regression has occurred. Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg") Signed-off-by: John Johansen

apparmor: put secmark label after secid lookup

2026-06-14T03:18:30+00:00

apparmor_secmark_init() parses a configured secmark label to obtain its secid. aa_label_strn_parse() returns a refcounted label, but the success path kept that reference after copying the secid. Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy") Signed-off-by: Zygmunt Krynicki Signed-off-by: John Johansen

apparmor: fix NULL sock in aa_sock_file_perm

2026-01-22T12:51:55+00:00

Deal with the potential that sock and sock-sk can be NULL during socket setup or teardown. This could lead to an oops. The fix for NULL pointer dereference in __unix_needs_revalidation shows this is at least possible for af_unix sockets. While the fix for af_unix sockets applies for newer mediation this is still the fall back path for older af_unix mediation and other sockets, so ensure it is covered. Fixes: 56974a6fcfef6 ("apparmor: add base infastructure for socket mediation") Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: transition from a list of rules to a vector of rules

2025-07-20T09:31:06+00:00

The set of rules on a profile is not dynamically extended, instead if a new ruleset is needed a new version of the profile is created. This allows us to use a vector of rules instead of a list, slightly reducing memory usage and simplifying the code. Signed-off-by: John Johansen

apparmor: make sure unix socket labeling is correctly updated.

2025-07-20T09:19:27+00:00

When a unix socket is passed into a different confinement domain make sure its cached mediation labeling is updated to correctly reflect which domains are using the socket. Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Signed-off-by: John Johansen