2d470c77 | 23-Oct-2024 |
Casey Schaufler <casey@schaufler-ca.com> |
lsm: replace context+len with lsm_context
Replace the (secctx,seclen) pointer pair with a single lsm_context pointer to allow return of the LSM identifier along with the context and context length.
lsm: replace context+len with lsm_context
Replace the (secctx,seclen) pointer pair with a single lsm_context pointer to allow return of the LSM identifier along with the context and context length. This allows security_release_secctx() to know how to release the context. Callers have been modified to use or save the returned data from the new structure.
security_secid_to_secctx() and security_lsmproc_to_secctx() will now return the length value on success instead of 0.
Cc: netdev@vger.kernel.org Cc: audit@vger.kernel.org Cc: netfilter-devel@vger.kernel.org Cc: Todd Kjos <tkjos@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [PM: subject tweak, kdoc fix, signedness fix from Dan Carpenter] Signed-off-by: Paul Moore <paul@paul-moore.com>
show more ...
|
04b5f0a5 | 10-Nov-2024 |
John Johansen <john.johansen@canonical.com> |
apparmor: lift new_profile declaration to remove C23 extension warning
the kernel test robot reports a C23 extension warning: label followed by a declaration is a C23 extension [-Wc23-extensions]
apparmor: lift new_profile declaration to remove C23 extension warning
the kernel test robot reports a C23 extension warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 696 | struct aa_profile *new_profile = NULL;
Instead of adding a null statement creating a C99 style inline var declaration lift the label declaration out of the block so that it no longer immediatedly follows the label.
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202411101808.AI8YG6cs-lkp@intel.com/ Fixes: ee650b3820f3 ("apparmor: properly handle cx/px lookup failure for complain") Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
8acf7ad0 | 29-Aug-2024 |
Ryan Lee <ryan.lee@canonical.com> |
apparmor: replace misleading 'scrubbing environment' phrase in debug print
The wording of 'scrubbing environment' implied that all environment variables would be removed, when instead secure-executi
apparmor: replace misleading 'scrubbing environment' phrase in debug print
The wording of 'scrubbing environment' implied that all environment variables would be removed, when instead secure-execution mode only removes a small number of environment variables. This patch updates the wording to describe what actually occurs instead: setting AT_SECURE for ld.so's secure-execution mode.
Link: https://gitlab.com/apparmor/apparmor/-/merge_requests/1315 is a merge request that does similar updating for apparmor userspace.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
9133493a | 09-Nov-2024 |
John Johansen <john.johansen@canonical.com> |
parser: drop dead code for XXX_comb macros
The macros for label combination XXX_comb are no longer used and there are no plans to use them so remove the dead code.
Signed-off-by: John Johansen <joh
parser: drop dead code for XXX_comb macros
The macros for label combination XXX_comb are no longer used and there are no plans to use them so remove the dead code.
Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
21155176 | 02-Sep-2024 |
Jinjie Ruan <ruanjinjie@huawei.com> |
apparmor: Remove unused parameter L1 in macro next_comb
In the macro definition of next_comb(), a parameter L1 is accepted, but it is not used. Hence, it should be removed.
Signed-off-by: Jinjie Ru
apparmor: Remove unused parameter L1 in macro next_comb
In the macro definition of next_comb(), a parameter L1 is accepted, but it is not used. Hence, it should be removed.
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
74a96bbe | 25-Sep-2024 |
Ryan Lee <ryan.lee@canonical.com> |
apparmor: audit_cap dedup based on subj_cred instead of profile
The previous audit_cap cache deduping was based on the profile that was being audited. This could cause confusion due to the deduplica
apparmor: audit_cap dedup based on subj_cred instead of profile
The previous audit_cap cache deduping was based on the profile that was being audited. This could cause confusion due to the deduplication then occurring across multiple processes, which could happen if multiple instances of binaries matched the same profile attachment (and thus ran under the same profile) or a profile was attached to a container and its processes.
Instead, perform audit_cap deduping over ad->subj_cred, which ensures the deduping only occurs across a single process, instead of across all processes that match the current one's profile.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
fee7a234 | 20-Sep-2024 |
Ryan Lee <ryan.lee@canonical.com> |
apparmor: add a cache entry expiration time aging out capability audit cache
When auditing capabilities, AppArmor uses a per-CPU, per-profile cache such that the same capability for the same profile
apparmor: add a cache entry expiration time aging out capability audit cache
When auditing capabilities, AppArmor uses a per-CPU, per-profile cache such that the same capability for the same profile doesn't get repeatedly audited, with the original goal of reducing audit logspam. However, this cache does not have an expiration time, resulting in confusion when a profile is shared across binaries (for example) and an expected DENIED audit entry doesn't appear, despite the cache entry having been populated much longer ago. This confusion was exacerbated by the per-CPU nature of the cache resulting in the expected entries sporadically appearing when the later denial+audit occurred on a different CPU.
To resolve this, record the last time a capability was audited for a profile and add a timestamp expiration check before doing the audit.
v1 -> v2: - Hardcode a longer timeout and drop the patches making it a sysctl, after discussion with John Johansen. - Cache the expiration time instead of the last-audited time. This value can never be zero, which lets us drop the kernel_cap_t caps field from the cache struct.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
8532503e | 25-Sep-2024 |
Ryan Lee <ryan.lee@canonical.com> |
apparmor: document capability.c:profile_capable ad ptr not being NULL
The profile_capabile function takes a struct apparmor_audit_data *ad, which is documented as possibly being NULL. However, the s
apparmor: document capability.c:profile_capable ad ptr not being NULL
The profile_capabile function takes a struct apparmor_audit_data *ad, which is documented as possibly being NULL. However, the single place that calls this function never passes it a NULL ad. If we were ever to call profile_capable with a NULL ad elsewhere, we would need to rework the function, as its very first use of ad is to dereference ad->class without checking if ad is NULL.
Thus, document profile_capable's ad parameter as not accepting NULL.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
9b897132 | 27-Jun-2023 |
chao liu <liuzgyid@outlook.com> |
apparmor: fix 'Do simple duplicate message elimination'
Multiple profiles shared 'ent->caps', so some logs missed.
Fixes: 0ed3b28ab8bf ("AppArmor: mediation of non file objects") Signed-off-by: cha
apparmor: fix 'Do simple duplicate message elimination'
Multiple profiles shared 'ent->caps', so some logs missed.
Fixes: 0ed3b28ab8bf ("AppArmor: mediation of non file objects") Signed-off-by: chao liu <liuzgyid@outlook.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
a2081b78 | 09-Nov-2024 |
John Johansen <john.johansen@canonical.com> |
apparmor: document first entry is in packed perms struct is reserved
Add a comment to unpack_perm to document the first entry in the packed perms struct is reserved, and make a non-functional change
apparmor: document first entry is in packed perms struct is reserved
Add a comment to unpack_perm to document the first entry in the packed perms struct is reserved, and make a non-functional change of unpacking to a temporary stack variable named "reserved" to help suppor the documentation of which value is reserved.
Suggested-by: Serge E. Hallyn <serge@hallyn.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
7290f592 | 11-Oct-2024 |
Jinjie Ruan <ruanjinjie@huawei.com> |
apparmor: test: Fix memory leak for aa_unpack_strdup()
The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it.
unreferenced obje
apparmor: test: Fix memory leak for aa_unpack_strdup()
The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it.
unreferenced object 0xffffff80c6af8a50 (size 8): comm "kunit_try_catch", pid 225, jiffies 4294894407 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20 unreferenced object 0xffffff80c2a29090 (size 8): comm "kunit_try_catch", pid 227, jiffies 4294894409 hex dump (first 8 bytes): 74 65 73 74 69 6e 67 00 testing. backtrace (crc 5eab668b): [<0000000001e3714d>] kmemleak_alloc+0x34/0x40 [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0 [<000000006870467c>] kmemdup_noprof+0x34/0x60 [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4 [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec [<00000000adf936cf>] kthread+0x2e8/0x374 [<0000000041bb1628>] ret_from_fork+0x10/0x20
Cc: stable@vger.kernel.org Fixes: 4d944bcd4e73 ("apparmor: add AppArmor KUnit tests for policy unpack") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
75535669 | 21-Sep-2024 |
Dr. David Alan Gilbert <linux@treblig.org> |
apparmor: Remove deadcode
aa_label_audit, aa_label_find, aa_label_seq_print and aa_update_label_name were added by commit f1bd904175e8 ("apparmor: add the base fns() for domain labels") but never us
apparmor: Remove deadcode
aa_label_audit, aa_label_find, aa_label_seq_print and aa_update_label_name were added by commit f1bd904175e8 ("apparmor: add the base fns() for domain labels") but never used.
aa_profile_label_perm was added by commit 637f688dc3dc ("apparmor: switch from profiles to using labels on contexts") but never used.
aa_secid_update was added by commit c092921219d2 ("apparmor: add support for mapping secids and using secctxes") but never used.
aa_split_fqname has been unused since commit 3664268f19ea ("apparmor: add namespace lookup fns()")
aa_lookup_profile has been unused since commit 93c98a484c49 ("apparmor: move exec domain mediation to using labels")
aa_audit_perms_cb was only used by aa_profile_label_perm (see above).
All of these commits are from around 2017.
Remove them.
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
648e45d7 | 07-Nov-2024 |
Thorsten Blum <thorsten.blum@linux.dev> |
apparmor: Remove unnecessary NULL check before kvfree()
Since kvfree() already checks if its argument is NULL, an additional check before calling kvfree() is unnecessary and can be removed.
Remove
apparmor: Remove unnecessary NULL check before kvfree()
Since kvfree() already checks if its argument is NULL, an additional check before calling kvfree() is unnecessary and can be removed.
Remove it and the following Coccinelle/coccicheck warning reported by ifnullfree.cocci:
WARNING: NULL check before some freeing functions is not needed
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
ab6875fb | 09-Jul-2024 |
Leesoo Ahn <lsahn@ooseel.net> |
apparmor: domain: clean up duplicated parts of handle_onexec()
Regression test of AppArmor finished without any failures.
PASSED: aa_exec access attach_disconnected at_secure introspect capabilitie
apparmor: domain: clean up duplicated parts of handle_onexec()
Regression test of AppArmor finished without any failures.
PASSED: aa_exec access attach_disconnected at_secure introspect capabilities changeprofile onexec changehat changehat_fork changehat_misc chdir clone coredump deleted e2e environ exec exec_qual fchdir fd_inheritance fork i18n link link_subset mkdir mmap mount mult_mount named_pipe namespaces net_raw open openat pipe pivot_root posix_ipc ptrace pwrite query_label regex rename readdir rw socketpair swap sd_flags setattr symlink syscall sysv_ipc tcp unix_fd_server unix_socket_pathname unix_socket_abstract unix_socket_unnamed unix_socket_autobind unlink userns xattrs xattrs_profile longpath nfs exec_stack aa_policy_cache nnp stackonexec stackprofile FAILED: make: Leaving directory '/apparmor/tests/regression/apparmor'
Signed-off-by: Leesoo Ahn <lsahn@ooseel.net> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
c0309373 | 28-Aug-2024 |
Hongbo Li <lihongbo22@huawei.com> |
apparmor: Use IS_ERR_OR_NULL() helper function
Use the IS_ERR_OR_NULL() helper instead of open-coding a NULL and an error pointer checks to simplify the code and improve readability.
Signed-off-by:
apparmor: Use IS_ERR_OR_NULL() helper function
Use the IS_ERR_OR_NULL() helper instead of open-coding a NULL and an error pointer checks to simplify the code and improve readability.
Signed-off-by: Hongbo Li <lihongbo22@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
9208c05f | 24-Aug-2024 |
John Johansen <john.johansen@canonical.com> |
apparmor: add support for 2^24 states to the dfa state machine.
Currently the dfa state machine is limited by its default, next, and check tables using u16. Allow loading of u32 tables, and if u16 t
apparmor: add support for 2^24 states to the dfa state machine.
Currently the dfa state machine is limited by its default, next, and check tables using u16. Allow loading of u32 tables, and if u16 tables are loaded map them to u32.
The number of states allowed does not increase to 2^32 because the base table uses the top 8 bits of its u32 for flags. Moving the flags into a separate table allowing a full 2^32 bit range wil be done in a separate patch.
Link: https://gitlab.com/apparmor/apparmor/-/issues/419 Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|
db93ca15 | 23-Aug-2024 |
Ryan Lee <ryan.lee@canonical.com> |
apparmor: properly handle cx/px lookup failure for complain
mode profiles
When a cx/px lookup fails, apparmor would deny execution of the binary even in complain mode (where it would audit as allow
apparmor: properly handle cx/px lookup failure for complain
mode profiles
When a cx/px lookup fails, apparmor would deny execution of the binary even in complain mode (where it would audit as allowing execution while actually denying it). Instead, in complain mode, create a new learning profile, just as would have been done if the cx/px line wasn't there.
Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
show more ...
|