Commit 237c31cb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'apparmor-pr-2024-01-18' of... 

Merge tag 'apparmor-pr-2024-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull AppArmor updates from John Johansen:
 "This adds a single feature, switch the hash used to check policy from
  sha1 to sha256

  There are fixes for two memory leaks, and refcount bug and a potential
  crash when a profile name is empty. Along with a couple minor code
  cleanups.

  Summary:

  Features
   - switch policy hash from sha1 to sha256

  Bug Fixes
   - Fix refcount leak in task_kill
   - Fix leak of pdb objects and trans_table
   - avoid crash when parse profie name is empty

  Cleanups
   - add static to stack_msg and nulldfa
   - more kernel-doc cleanups"

* tag 'apparmor-pr-2024-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: Fix memory leak in unpack_profile()
  apparmor: avoid crash when parsed profile name is empty
  apparmor: fix possible memory leak in unpack_trans_table
  apparmor: free the allocated pdb objects
  apparmor: Fix ref count leak in task_kill
  apparmor: cleanup network hook comments
  apparmor: add missing params to aa_may_ptrace kernel-doc comments
  apparmor: declare nulldfa as static
  apparmor: declare stack_msg as static
  apparmor: switch SECURITY_APPARMOR_HASH from sha1 to sha256
parents 556e2d17 8ead196b

security/apparmor/Kconfig

+6 −6
Original line number Diff line number Diff line
@@ -57,10 +57,10 @@ config SECURITY_APPARMOR_INTROSPECT_POLICY 
	  cpu is paramount.



config SECURITY_APPARMOR_HASH

	bool "Enable introspection of sha1 hashes for loaded profiles"

	bool "Enable introspection of sha256 hashes for loaded profiles"

	depends on SECURITY_APPARMOR_INTROSPECT_POLICY

	select CRYPTO

	select CRYPTO_SHA1

	select CRYPTO_SHA256

	default y

	help

	  This option selects whether introspection of loaded policy
@@ -74,10 +74,10 @@ config SECURITY_APPARMOR_HASH_DEFAULT 
       depends on SECURITY_APPARMOR_HASH

       default y

       help

         This option selects whether sha1 hashing of loaded policy

	 is enabled by default. The generation of sha1 hashes for

	 loaded policy provide system administrators a quick way

	 to verify that policy in the kernel matches what is expected,

	 This option selects whether sha256 hashing of loaded policy

	 is enabled by default. The generation of sha256 hashes for

	 loaded policy provide system administrators a quick way to

	 verify that policy in the kernel matches what is expected,

	 however it can slow down policy load on some devices. In

	 these cases policy hashing can be disabled by default and

	 enabled only if needed.

security/apparmor/apparmorfs.c

+8 −8
Original line number Diff line number Diff line
@@ -1474,7 +1474,7 @@ int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata) 
	rawdata->dents[AAFS_LOADDATA_REVISION] = dent;



	if (aa_g_hash_policy) {

		dent = aafs_create_file("sha1", S_IFREG | 0444, dir,

		dent = aafs_create_file("sha256", S_IFREG | 0444, dir,

					      rawdata, &seq_rawdata_hash_fops);

		if (IS_ERR(dent))

			goto fail;
@@ -1643,11 +1643,11 @@ static const char *rawdata_get_link_base(struct dentry *dentry, 
	return target;

}



static const char *rawdata_get_link_sha1(struct dentry *dentry,

static const char *rawdata_get_link_sha256(struct dentry *dentry,

					 struct inode *inode,

					 struct delayed_call *done)

{

	return rawdata_get_link_base(dentry, inode, done, "sha1");

	return rawdata_get_link_base(dentry, inode, done, "sha256");

}



static const char *rawdata_get_link_abi(struct dentry *dentry,
@@ -1664,8 +1664,8 @@ static const char *rawdata_get_link_data(struct dentry *dentry, 
	return rawdata_get_link_base(dentry, inode, done, "raw_data");

}



static const struct inode_operations rawdata_link_sha1_iops = {

	.get_link	= rawdata_get_link_sha1,

static const struct inode_operations rawdata_link_sha256_iops = {

	.get_link	= rawdata_get_link_sha256,

};



static const struct inode_operations rawdata_link_abi_iops = {
@@ -1738,7 +1738,7 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent) 
	profile->dents[AAFS_PROF_ATTACH] = dent;



	if (profile->hash) {

		dent = create_profile_file(dir, "sha1", profile,

		dent = create_profile_file(dir, "sha256", profile,

					   &seq_profile_hash_fops);

		if (IS_ERR(dent))

			goto fail;
@@ -1748,9 +1748,9 @@ int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent) 
#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY

	if (profile->rawdata) {

		if (aa_g_hash_policy) {

			dent = aafs_create("raw_sha1", S_IFLNK | 0444, dir,

			dent = aafs_create("raw_sha256", S_IFLNK | 0444, dir,

					   profile->label.proxy, NULL, NULL,

					   &rawdata_link_sha1_iops);

					   &rawdata_link_sha256_iops);

			if (IS_ERR(dent))

				goto fail;

			aa_get_proxy(profile->label.proxy);

security/apparmor/crypto.c

+3 −3
Original line number Diff line number Diff line
@@ -106,16 +106,16 @@ static int __init init_profile_hash(void) 
	if (!apparmor_initialized)

		return 0;



	tfm = crypto_alloc_shash("sha1", 0, 0);

	tfm = crypto_alloc_shash("sha256", 0, 0);

	if (IS_ERR(tfm)) {

		int error = PTR_ERR(tfm);

		AA_ERROR("failed to setup profile sha1 hashing: %d\n", error);

		AA_ERROR("failed to setup profile sha256 hashing: %d\n", error);

		return error;

	}

	apparmor_tfm = tfm;

	apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);



	aa_info_message("AppArmor sha1 policy hashing enabled");

	aa_info_message("AppArmor sha256 policy hashing enabled");



	return 0;

}

security/apparmor/domain.c

+1 −1
Original line number Diff line number Diff line
@@ -1311,7 +1311,7 @@ static int change_profile_perms_wrapper(const char *op, const char *name, 
	return error;

}



const char *stack_msg = "change_profile unprivileged unconfined converted to stacking";

static const char *stack_msg = "change_profile unprivileged unconfined converted to stacking";



/**

 * aa_change_profile - perform a one-way profile transition

security/apparmor/lib.c

+1 −0
Original line number Diff line number Diff line
@@ -41,6 +41,7 @@ void aa_free_str_table(struct aa_str_table *t) 
			kfree_sensitive(t->table[i]);

		kfree_sensitive(t->table);

		t->table = NULL;

		t->size = 0;

	}

}