Changes in Kconfig

8fefe68784ae1606e11a5c65c04167c3b95051a0 - Merge tag 'apparmor-pr-2026-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Wed, 26 Aug 2026 20:04:24 +0200

Merge tag 'apparmor-pr-2026-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmorPull AppArmor updates from John Johansen: "The biggest functional change is Jann Horn's fix for how aparmor is doing stale cred updates after a policy replacement. apparmor: fix cred UAF caused by begin_current_label_crit_section() It moves the update to be done during task_work at the end of the syscall. One major feature is allowing policy to be compressed in userspace instead of after the fact (in kernel) if we need to hold onto it for CRIU/introspection. The other major change is to do with network mediation. It is a lot of code churn but does not do any functional changes to mediation. It moves the code around, and refactors it to use newer patterns for consistency, and in preparation for some improvements in mediation in a future patchset. Features: - support loading compressed policies - add audit mode to provide a mechanism to silence complain messages - refactor network mediation to use new patterns, and prepare to for extended inet mediation (no functional change) Cleanups: - switch website link to https - make include headers self-contained, and fix circular include - constify aa_label, aa_dfa, aa_profile, and aa_perms paraneters - mark static tables and structs as read only - drop use of _confined variant for iteration - refactory mount to use check_perms - refactor network mediation code to be together - refactor xattr attachment, to take the file path - optimize current_label_crit_section() - leverage audit_log_n_untrustedstring() when possible Bug Fixes: - initialized policy lists heads before fail path - fix deadlock in complain-mode change_hat - auditing of mount binary data - fix error debug output in fn_label_build - fix race condition in label replacement - fix unconfined user namespace restriction forced stack - fix error handling for copy_from_user in policy_update - fix out-of-bounds write when null terminating a label vec - fix integer overflow in verify_tags() bounds check - fix cred UAF caused by begin_current_label_crit_section() - use SEND_SIG_NOINFO instead of NULL in aa_audit()"* tag 'apparmor-pr-2026-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (40 commits) apparmor: policy_int make sure list heads are initialized before fail path apparmor: fix deadlock in complain-mode change_hat apparmor: constify aa_label parameters on read-only query helpers apparmor: constify aa_dfa parameters on read-only compute paths apparmor: constify aa_profile parameters on read-only compute paths apparmor: constify aa_perms parameters that are read-only apparmor: drop use of _confined variant for iteration apparmor: refactory mount to use check_perms apparmor: fix auditing of mount binary data apparmor: add audit mode to provide a mechanism to silence complain messages apparmor: mark static tables and structs as read only apparmor: fix error debug output in fn_label_build apparmor: make table entry count last enum for static tables apparmor: fix race condition in label replacement apparmor: refactor xattr attachment, to take the file path apparmor: fix unconfined user namespace restriction forced stack apparmor: reserve mediation class for packet mediation apparmor: move sock_rcv_skb() next to inet_conn_request apparmor: move netfilter functions next to the LSM network operations apparmor: refactor network socket mediation to support compatibility ... List of files: /linux/security/apparmor/Kconfig

1c5f27e845e84f58ed6bbe3e6bc12d6a013e74b5 - apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled

Thu, 30 Jul 2026 11:30:58 +0200

apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabledcommit17b5758bf35c ("apparmor: Initial support for compressed policies")added the ability for apparmor to load compressed policy, unfortunatelyit did not add a config option or select CONFIG_ZSTD_DECOMPRESSwhich it depends on, leading to the following build failureapparmorfs.c makes calls into zstd_*() even whenCONFIG_SECURITY_APPARMOR_EXPORT_BINARY is not set, causingbuild errors:/usr/bin/ld.bfd: security/apparmor/apparmorfs.o: in function `policy_update':apparmorfs.c:(.text+0x1307): undefined reference to `zstd_get_frame_header'/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1359): undefined reference to `zstd_dctx_workspace_bound'/usr/bin/ld.bfd: apparmorfs.c:(.text+0x13f7): undefined reference to `zstd_init_dctx'/usr/bin/ld.bfd: apparmorfs.c:(.text+0x140c): undefined reference to `zstd_decompress_dctx'/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1411): undefined reference to `zstd_is_error'Add a new config option to enable compress policy loading as usingthe existing CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is in appropriateas that is about retaining loaded policy so that it can be introspectedat a later date.Fixes: 17b5758bf35c ("apparmor: Initial support for compressed policies")Reviewed-by: Georgia Garcia Signed-off-by: John Johansen List of files: /linux/security/apparmor/Kconfig

50507d6fc80117c3448029e4bd335704cd5e58ec - apparmor: switch website link to https

Thu, 23 Jul 2026 19:25:54 +0200

apparmor: switch website link to httpsShould make harder for MITM to redirect to somewhere else.Signed-off-by: Baruch Siach Signed-off-by: John Johansen List of files: /linux/security/apparmor/Kconfig

cb9f145f638d7afa633632a9290d6ad06caeb8ee - Merge remote-tracking branch 'drm/drm-next' into msm-next-robclark

Sat, 01 Nov 2025 13:47:30 +0100

Merge remote-tracking branch 'drm/drm-next' into msm-next-robclarkBack-merge drm-next to get caught up.Signed-off-by: Rob Clark List of files: /linux/security/apparmor/Kconfig

f088104d837a991c65e51fa30bb4196169b3244d - Merge drm/drm-next into drm-intel-gt-next

Tue, 16 Sep 2025 12:53:20 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerge in order to get the commit: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter")To drm-intel-gt-next as there are followup fixes to be applied.Signed-off-by: Joonas Lahtinen List of files: /linux/security/apparmor/Kconfig

a53d0cf7f1cb3182ad533ff5cacfa5fd29c419ad - Merge commit 'linus' into core/bugs, to resolve conflicts

Tue, 05 Aug 2025 11:15:34 +0200

Merge commit 'linus' into core/bugs, to resolve conflictsResolve conflicts with this commit that was developed in parallelduring the merge window: 8c8efa93db68 ("x86/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust") Conflicts: arch/riscv/include/asm/bug.h arch/x86/include/asm/bug.hSigned-off-by: Ingo Molnar List of files: /linux/security/apparmor/Kconfig

8b87f67b4c87452e21721887fa8dec1f4c6b2b7c - Merge branch 'next' into for-linus

Wed, 08 Oct 2025 06:53:13 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.18 merge window. List of files: /linux/security/apparmor/Kconfig

4b051897df2375414587a245ecb9bb1a4d26b3b8 - Merge tag 'v6.17-rc2' into HEAD

Thu, 21 Aug 2025 20:46:49 +0200

Merge tag 'v6.17-rc2' into HEADSync up with mainline to bring in changes to include/linux/sprintf.h List of files: /linux/security/apparmor/Kconfig

b4d90dbc4c1bc4bd3eb2d2989330af0eb95c98e8 - Merge drm/drm-next into drm-misc-next-fixes

Mon, 15 Sep 2025 10:23:28 +0200

Merge drm/drm-next into drm-misc-next-fixesBackmerging to drm-misc-next-fixes to get features and fixes fromv6.17-rc6.Signed-off-by: Thomas Zimmermann List of files: /linux/security/apparmor/Kconfig

702fdf3513b045f596f836d9a4b8672c76f11834 - Merge drm/drm-next into drm-intel-next

Wed, 10 Sep 2025 14:01:42 +0200

Merge drm/drm-next into drm-intel-nextCatching up with some display dependencies.Signed-off-by: Rodrigo Vivi List of files: /linux/security/apparmor/Kconfig

ca994e8922f25f7fed2075098f185cf198109eaa - Merge drm/drm-next into drm-xe-next

Tue, 12 Aug 2025 14:58:37 +0200

Merge drm/drm-next into drm-xe-nextBring v6.17-rc1 to propagate commits from other subsystems, particularlyPCI, which has some new functions needed for SR-IOV integration.Signed-off-by: Lucas De Marchi List of files: /linux/security/apparmor/Kconfig

08c51f5bddc81c8c97c1eb11861b0dc009e5ccd8 - Merge drm/drm-next into drm-misc-n

Mon, 11 Aug 2025 14:37:45 +0200

Merge drm/drm-next into drm-misc-nUpdating drm-misc-next to the state of v6.17-rc1. Begins a new releasecycle.Signed-off-by: Thomas Zimmermann List of files: /linux/security/apparmor/Kconfig

8d2b0853add1d7534dc0794e3c8e0b9e8c4ec640 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 11 Aug 2025 16:49:06 +0200

Merge drm/drm-fixes into drm-misc-fixesUpdating drm-misc-fixes to the state of v6.17-rc1. Begins a new releasecycle.Signed-off-by: Thomas Zimmermann List of files: /linux/security/apparmor/Kconfig

37a3741d27b64012ab6a5d9c92b514b977349dbb - Revert "apparmor: use SHA-256 library API instead of crypto_shash API"

Mon, 30 Jun 2025 09:06:22 +0200

Revert "apparmor: use SHA-256 library API instead of crypto_shash API"This reverts commit e9ed1eb8f6217e53843d82ecf2d50f8d1a93e77c.Eric has requested that this patch be taken through the libcrypto-nexttree, instead.Signed-off-by: John Johansen List of files: /linux/security/apparmor/Kconfig

e9ed1eb8f6217e53843d82ecf2d50f8d1a93e77c - apparmor: use SHA-256 library API instead of crypto_shash API

Mon, 28 Apr 2025 21:04:30 +0200

apparmor: use SHA-256 library API instead of crypto_shash APIThis user of SHA-256 does not support any other algorithm, so thecrypto_shash abstraction provides no value. Just use the SHA-256library API instead, which is much simpler and easier to use.Signed-off-by: Eric Biggers Signed-off-by: John Johansen List of files: /linux/security/apparmor/Kconfig

4b65b859f55b036649a4525f09fa7c5bbbab384e - Merge tag 'libcrypto-conversions-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Tue, 29 Jul 2025 03:05:46 +0200

Merge tag 'libcrypto-conversions-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linuxPull crypto library conversions from Eric Biggers: "Convert fsverity and apparmor to use the SHA-2 library functions instead of crypto_shash. This is simpler and also slightly faster"* tag 'libcrypto-conversions-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: fsverity: Switch from crypto_shash to SHA-2 library fsverity: Explicitly include apparmor: use SHA-256 library API instead of crypto_shash API List of files: /linux/security/apparmor/Kconfig

f93c27092a5b61b2ac1a29f1d063a15eb09512f2 - apparmor: use SHA-256 library API instead of crypto_shash API

Mon, 30 Jun 2025 19:48:05 +0200

apparmor: use SHA-256 library API instead of crypto_shash APIThis user of SHA-256 does not support any other algorithm, so thecrypto_shash abstraction provides no value. Just use the SHA-256library API instead, which is much simpler and easier to use.Acked-by: John Johansen Link: https://lore.kernel.org/r/20250630174805.59010-1-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/security/apparmor/Kconfig

a23e1966932464e1c5226cb9ac4ce1d5fc10ba22 - Merge branch 'next' into for-linus

Mon, 15 Jul 2024 23:03:44 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.11 merge window. List of files: /linux/security/apparmor/Kconfig

6f47c7ae8c7afaf9ad291d39f0d3974f191a7946 - Merge tag 'v6.9' into next

Tue, 28 May 2024 06:37:18 +0200

Merge tag 'v6.9' into nextSync up with the mainline to bring in the new cleanup API. List of files: /linux/security/apparmor/Kconfig

60a2f25de7b8b785baee2932db932ae9a5b8c86d - Merge drm/drm-next into drm-intel-gt-next

Thu, 16 May 2024 09:33:01 +0200

Merge drm/drm-next into drm-intel-gt-nextSome display refactoring patches are needed in order to allow conflict-less merging.Signed-off-by: Tvrtko Ursulin List of files: /linux/security/apparmor/Kconfig