kernel/git/next/linux-next.git/security/apparmor, branch master

Merge branch 'master' of git://git.code.sf.net/p/tomoyo/tomoyo.git

2026-07-09T15:02:10+00:00

apparmor: temporarily disable in syzbot kernels.

2026-07-06T10:59:48+00:00

This change is not for upstream. This change is for linux-next only. This is a workaround until the following build failure is fixed. security/apparmor/apparmorfs.c:486:12: warning: 'decompress_zstd' used but never defined Signed-off-by: Tetsuo Handa

apparmor: fix alternate loaders ability to load compressed policy

2026-06-29T17:34:17+00:00

When policy is compressed it is given a header in userspace. The parser knows to strip this header, but alternate profile loaders like aa-load and systemd have not been updated so that they know to strip the header. This allows those loaders to just load the binary file without having to be updated. Fixes: 17b5758bf35c7 ("apparmor: Initial support for compressed policies") Signed-off-by: John Johansen

apparmor: Initial support for compressed policies

2026-06-29T17:27:02+00:00

This patch allows policies to be compressed in userspace and be sent to the kernel through the existing ".load" and ".replace" kernel interfaces. The benefits of this approach are: - Save kernel time when loading policies - Allow userspace to provide a higher level of compression than the one provided by the kernel (ZSTD_CLEVEL_DEFAULT), thus saving space. - Allow small embedded systems to only store the compressed version of policies in userspace, saving memory. Userspace-compressed policies improve system time by up to ~30% for big profiles. Signed-off-by: Maxime Bélair Signed-off-by: John Johansen

apparmor: make include headers self-contained

2026-06-29T17:26:36+00:00

Besides of resolving clangd IDE warnings, self-contained headers will be less likely to break if the surrounding includes in .c files using them change. Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: fix net.h and policy.h circular include pattern

2026-06-29T17:26:21+00:00

While the #ifdef guards prevent the circular include from blowing up, policy.h does not actually need anything from net.h. Remove, that include and instead include net.h in the other files that need it. Signed-off-by: Ryan Lee Signed-off-by: John Johansen

apparmor: advertise the tcp fast open fix is applied

2026-06-24T05:15:15+00:00

The fix for tcp-fast-open ensures that the connect permission is being mediated correctly but it didn't add an artifact to the feature set to advertise the fix is available. Add an artifact so that the test suite can identify if the fix has not been properly applied or a new unexpected regression has occurred. Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg") Signed-off-by: John Johansen

apparmor: mediate the implicit connect of TCP fast open sendmsg

2026-06-23T07:16:59+00:00

sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit. Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Signed-off-by: John Johansen

apparmor: fix label can not be immediately before a declaration

2026-06-15T01:22:35+00:00

Fix error reported by kernel test robot security/apparmor/policy.c:1381:2: error: a label can only be part of a statement and a declaration is not a statement All errors (new ones prefixed by >>): security/apparmor/policy.c: In function 'aa_replace_profiles': >> security/apparmor/policy.c:1381:2: error: a label can only be part of a statement and a declaration is not a statement ssize_t udata_sz = udata->size; ^~~~~ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202606150525.npax8WiH-lkp@intel.com/ Fixes: 7b42f95813dc9 ("apparmor: fix potential UAF in aa_replace_profiles") Signed-off-by: John Johansen

apparmor: fix kernel-doc warnings

2026-06-14T03:20:13+00:00

Fix two kernel-doc warnings: - non-kernel-doc comment marked with '/**' in af_unix.c - documented symbol name mismatch for aa_get_i_loaddata() in policy_unpack.h No functional changes. Signed-off-by: Rodrigo Zaiden Signed-off-by: John Johansen