linux.git/security/apparmor/include/lib.h, branch v7.3-rc2

apparmor: constify aa_dfa parameters on read-only compute paths

2026-08-11T05:49:43+00:00

Most uses of aa_dfa a read-only walking of the dfa. Have the compiler
enforce this.

Signed-off-by: John Johansen

apparmor: fix error debug output in fn_label_build

2026-08-11T05:49:42+00:00

checking PTR_ERROR() is not correct to just determine if any error
occured, instead use the IS_ERR macro and also output the PTR_ERR
as part of the debug message.

Signed-off-by: John Johansen

apparmor: make fn_label_build() capable of handling not supported

2026-06-14T03:14:07+00:00

Currently fn_label_build() callback fns must provide a transition or
failure. Change this so that a callback can indicate it should be
skipped/not be involved in the label being built.

This will be useful when building object labels based on mediation
flags, as to whether the label should be set.

Existing callers can keep treating NULL return as an error because
none of those callback fns support skipping, but instead of the old
error handling replace with AA_BUG.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: change fn_label_build() call to not return NULL

2026-06-14T03:14:07+00:00

Previously fn_label_build() was accepting a NULL which represented
ENOMEM return and ERR_PTR for errors.

Clean this up by requiring the cb fn to return an ERR_PTR or valid
value.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: fix race between freeing data and fs accessing it

2026-03-09T23:05:44+00:00

AppArmor was putting the reference to i_private data on its end after
removing the original entry from the file system. However the inode
can aand does live beyond that point and it is possible that some of
the fs call back functions will be invoked after the reference has
been put, which results in a race between freeing the data and
accessing it through the fs.

While the rawdata/loaddata is the most likely candidate to fail the
race, as it has the fewest references. If properly crafted it might be
possible to trigger a race for the other types stored in i_private.

Fix this by moving the put of i_private referenced data to the correct
place which is during inode eviction.

Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files")
Reported-by: Qualys Security Advisory 
Reviewed-by: Georgia Garcia 
Reviewed-by: Maxime Bélair 
Reviewed-by: Cengiz Can 
Signed-off-by: John Johansen

apparmor: split xxx_in_ns into its two separate semantic use cases

2026-01-29T09:27:55+00:00

This patch doesn't change current functionality, it switches the two
uses of the in_ns fns and macros into the two semantically different
cases they are used for.

xxx_in_scope for checking mediation interaction between profiles
xxx_in_view to determine which profiles are visible.The scope will
always be a subset of the view as profiles that can not see each
other can not interact.

The split can not be completely done for label_match because it has to
distinct uses matching permission against label in scope, and checking
if a transition to a profile is allowed. The transition to a profile
can include profiles that are in view but not in scope, so retain this
distinction as a parameter.

While at the moment the two uses are very similar, in the future there
will be additional differences. So make sure the semantics differences
are present in the code.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: fix label and profile debug macros

2026-01-29T09:27:54+00:00

The label and profile debug macros were not correctly pasting their
var args.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: add support loading per permission tagging

2026-01-29T09:27:47+00:00

Add support for the per permission tag index for a given permission
set. This will be used by both meta-data tagging, to allow annotating
accept states with context and debug information. As well as by rule
tainting and triggers to specify the taint or trigger to be applied.

Since these are low frequency ancillary data items they are stored
in a tighter packed format to that allows for sharing and reuse of the
strings between permissions and accept states. Reducing the amount of
kernel memory use at the cost of having to go through a couple if
index based indirections.

The tags are just strings that has no meaning with out context. When
used as meta-data for auditing and debugging its entirely information
for userspace, but triggers, and tainting can be used to affect the
domain. However they all exist in the same packed data set and can
be shared between different uses.

Signed-off-by: John Johansen

apparmor: make str table more generic and be able to have multiple entries

2026-01-22T12:56:39+00:00

The strtable is currently limited to a single entry string on unpack
even though domain has the concept of multiple entries within it. Make
this a reality as it will be used for tags and more advanced domain
transitions.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: fix AA_DEBUG_LABEL()

2025-07-16T05:39:43+00:00

AA_DEBUG_LABEL() was not specifying it vargs, which is needed so it can
output debug parameters.

Fixes: 71e6cff3e0dd ("apparmor: Improve debug print infrastructure")
Signed-off-by: John Johansen