linux.git/security/apparmor/mount.c, branch v7.3-rc2

apparmor: constify aa_dfa parameters on read-only compute paths

2026-08-11T05:49:43+00:00

Most uses of aa_dfa a read-only walking of the dfa. Have the compiler
enforce this.

Signed-off-by: John Johansen

apparmor: constify aa_profile parameters on read-only compute paths

2026-08-11T05:49:43+00:00

A number of functions take a struct aa_profile * argument that is only
ever read from: they compute DFA matches or apply the profile's mode
flags without modifying the profile, taking a reference on it, or
touching its embedded label. Mark those parameters const struct
aa_profile * to document intent and let the compiler enforce it.

The converted functions are the permission "compute" path plus a few
pure readers:
  - aa_apply_modes_to_perms(), aa_profile_match_label()
  - AUDIT_MODE()
  - aa_label_match() and its match_component()/label_compound_match()/
    label_components_match() helpers (label.c)
  - match_component()/label_compound_match()/label_components_match()/
    label_match()/change_profile_perms()/aa_xattrs_match() (domain.c)
  - match_iface()/match_addr_iface()/match_addr_iface_label()/
    skb_match_to_sk()/skb_match_to_cmd() (af_inet.c)
  - aa_profile_capget(), path_flags(), profile_query_cb()

The remaining aa_profile * parameters cannot be made const: the audit
path stores &profile->label into the owned, refcounted
apparmor_audit_data.subj_label/peer fields, and the domain/lifecycle
paths take references on the profile's embedded label
(aa_get_label()/aa_get_newest_label()/aa_get_profile()) or write
profile fields.

No functional change.

Signed-off-by: John Johansen 
Assisted-by: Claude:claude-opus-4.8

apparmor: drop use of _confined variant for iteration

2026-08-11T05:49:42+00:00

In preparation for allowing unconfined to be replaced and mediate
select rules drop use of the _confined variant for iteration in
the mount code.

The RULE_MEDIATES() check will continue to allow unconfined profile
mediation to be skipped unless it is replaced and is given mount
rules.

Signed-off-by: John Johansen

apparmor: refactory mount to use check_perms

2026-08-11T05:49:42+00:00

Move the mount permissions check to use the common backend
aa_check_perms() to check permissions. This will make it so caching,
audit, complain, logic can be handled consistently in a single place.

Signed-off-by: John Johansen

apparmor: fix auditing of mount binary data

2026-08-11T05:49:42+00:00

AppArmor only mediates non-binary mount data, and should only
audit the mount data if it is non-binary.

Signed-off-by: John Johansen

apparmor: mark static tables and structs as read only

2026-08-11T05:49:42+00:00

static tables, and structs that are initialized as part of their
data section or during init should be read only to protect against
accidental or malicous changes.

Signed-off-by: John Johansen

apparmor: change fn_label_build() call to not return NULL

2026-06-14T03:14:07+00:00

Previously fn_label_build() was accepting a NULL which represented
ENOMEM return and ERR_PTR for errors.

Clean this up by requiring the cb fn to return an ERR_PTR or valid
value.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: transition from a list of rules to a vector of rules

2025-07-20T09:31:06+00:00

The set of rules on a profile is not dynamically extended, instead
if a new ruleset is needed a new version of the profile is created.
This allows us to use a vector of rules instead of a list, slightly
reducing memory usage and simplifying the code.

Signed-off-by: John Johansen

apparmor: take nosymfollow flag into account

2024-07-24T17:33:58+00:00

A "nosymfollow" flag was added in commit
dab741e0e02b ("Add a "nosymfollow" mount option.")

While we don't need to implement any special logic on
the AppArmor kernel side to handle it, we should provide
user with a correct list of mount flags in audit logs.

Signed-off-by: Alexander Mikhalitsyn 
Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: Fix move_mount mediation by detecting if source is detached

2024-01-03T20:10:29+00:00

Prevent move_mount from applying the attach_disconnected flag
to move_mount(). This prevents detached mounts from appearing
as / when applying mount mediation, which is not only incorrect
but could result in bad policy being generated.

Basic mount rules like
  allow mount,
  allow mount options=(move) -> /target/,

will allow detached mounts, allowing older policy to continue
to function. New policy gains the ability to specify `detached` as
a source option
  allow mount detached -> /target/,

In addition make sure support of move_mount is advertised as
a feature to userspace so that applications that generate policy
can respond to the addition.

Note: this fixes mediation of move_mount when a detached mount is used,
      it does not fix the broader regression of apparmor mediation of
      mounts under the new mount api.

Link: https://lore.kernel.org/all/68c166b8-5b4d-4612-8042-1dee3334385b@leemhuis.info/T/#mb35fdde37f999f08f0b02d58dc1bf4e6b65b8da2
Fixes: 157a3537d6bc ("apparmor: Fix regression in mount mediation")
Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen