kernel/git/next/linux-next.git/security/apparmor/domain.c, branch stable

security: apparmor: fix two spelling mistakes

2026-06-14T03:20:13+00:00

Fix two spelling errors in comment: - interated → interacted - dont → don't Signed-off-by: Qingshuang Fu Signed-off-by: John Johansen

apparmor: change fn_label_build() call to not return NULL

2026-06-14T03:14:07+00:00

Previously fn_label_build() was accepting a NULL which represented ENOMEM return and ERR_PTR for errors. Clean this up by requiring the cb fn to return an ERR_PTR or valid value. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: grab ns lock and refresh when looking up changehat child profiles

2026-06-14T03:14:07+00:00

There was a race condition involving change_hat and profile replacement in which replacement of the parent profile during a changehat operation could result in the list of children becoming empty and the changehat operation failing. To prevent this: - grab the namespace lock until we've built the hat transition, and - use aa_get_newest_profile to avoid using stale profile objects. Link: https://bugs.launchpad.net/bugs/2139664 Fixes: 89dbf1962aa63 ("apparmor: move change_hat mediation to using labels") Reviewed-by: Georgia Garcia Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: check label build before no_new_privs test

2026-06-14T03:14:06+00:00

aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL or an ERR_PTR, but the result was passed to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL() check. Reuse the existing target-label build failure handling immediately after the build. This preserves the current audit handling while preventing the subset helper from dereferencing an invalid label. Fixes: e00b02bb6ac2a ("apparmor: move change_profile mediation to using labels") Signed-off-by: Ruoyu Wang Signed-off-by: John Johansen

apparmor: split xxx_in_ns into its two separate semantic use cases

2026-01-29T09:27:55+00:00

This patch doesn't change current functionality, it switches the two uses of the in_ns fns and macros into the two semantically different cases they are used for. xxx_in_scope for checking mediation interaction between profiles xxx_in_view to determine which profiles are visible.The scope will always be a subset of the view as profiles that can not see each other can not interact. The split can not be completely done for label_match because it has to distinct uses matching permission against label in scope, and checking if a transition to a profile is allowed. The transition to a profile can include profiles that are in view but not in scope, so retain this distinction as a parameter. While at the moment the two uses are very similar, in the future there will be additional differences. So make sure the semantics differences are present in the code. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: make str table more generic and be able to have multiple entries

2026-01-22T12:56:39+00:00

The strtable is currently limited to a single entry string on unpack even though domain has the concept of multiple entries within it. Make this a reality as it will be used for tags and more advanced domain transitions. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: transition from a list of rules to a vector of rules

2025-07-20T09:31:06+00:00

The set of rules on a profile is not dynamically extended, instead if a new ruleset is needed a new version of the profile is created. This allows us to use a vector of rules instead of a list, slightly reducing memory usage and simplifying the code. Signed-off-by: John Johansen

apparmor: remove redundant perms.allow MAY_EXEC bitflag set

2025-07-20T09:19:28+00:00

This section of profile_transition that occurs after x_to_label only happens if perms.allow already has the MAY_EXEC bit set, so we don't need to set it again. Fixes: 16916b17b4f8 ("apparmor: force auditing of conflicting attachment execs from confined") Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: force auditing of conflicting attachment execs from confined

2025-05-26T03:15:01+00:00

Conflicting attachment paths are an error state that result in the binary in question executing under an unexpected ix/ux fallback. As such, it should be audited to record the occurrence of conflicting attachments. Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: include conflicting attachment info for confined ix/ux fallback

2025-05-26T03:15:01+00:00

Instead of silently overwriting the conflicting profile attachment string, include that information in the ix/ux fallback string that gets set as info instead. Also add a warning print if some other info is set that would be overwritten by the ix/ux fallback string or by the profile not found error. Signed-off-by: Ryan Lee Signed-off-by: John Johansen