[GIT,PULL] AppArmor updates for 6.13

Pull-request

git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2024-11-27

Message

John Johansen Nov. 27, 2024, 8:59 p.m. UTC

Hi Linus,

This update is largely Bug fixes and cleanups. It has two small
developments, which I can drop and push to 6.14 if you would like. The
first increases the size of the policy state machine that can be
supported. At run time this is just swap out the next/check tables to
use u32, older policy is remains supported by mapping remapping the old
u16 to the u32 during policy load. The second is an improvement to age
the capability auditing cache.

These have all been in linux-next for more than two weeks, and I finally
managed to trace down and fix a bug in the regression tests that was causing
a failure, so these have been merge and regression tested against your tree
from this last weekend.

thanks
- john




The following changes since commit aaf20f870da056752f6386693cc0d8e25421ef35:

   Merge tag 'rpmsg-v6.13' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux (2024-11-26 18:36:55 -0800)

are available in the Git repository at:

   git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2024-11-27

for you to fetch changes up to 04b5f0a5bfee5a5886dc19296c90d9a6964275e4:

   apparmor: lift new_profile declaration to remove C23 extension warning (2024-11-26 19:21:06 -0800)

----------------------------------------------------------------
* Features
   - extend next/check table to add support for 2^24 states to the
     state machine.
   - rework capability audit cache to use broader cred information
     instead of just the profile. Also add a time stamp so old
     entries can be aged out of the cache.

* Bug Fixes
   - fix 'Do simple duplicate message elimination' to clear previous
     state when updating in capability audit cache
   - Fix memory leak for aa_unpack_strdup()
   - properly handle cx/px lookup failure when in complain mode
   - allocate xmatch for nullpdb inside aa_alloc_null fixing a
     NULL ptr deref of tracking profiles in when in complain mode

* Cleanups
   - Remove everything being reported as deadcode
   - replace misleading 'scrubbing environment' phrase in debug print
   - Remove unnecessary NULL check before kvfree()
   - clean up duplicated parts of handle_onexec()
   - Use IS_ERR_OR_NULL() helper function
   - move new_profile declaration to top of block instead immediately
     after label to remove C23 extension warning

* Documentation
   - add comment to document capability.c:profile_capable ad ptr
     parameter can not be NULL
   - add comment to document first entry is in packed perms struct is
     reserved for future planned expansion.
   - Update LSM/apparmor.rst add blurb for
     CONFIG_DEFAULT_SECURITY_APPARMOR

----------------------------------------------------------------
Dr. David Alan Gilbert (1):
       apparmor: Remove deadcode

Hongbo Li (1):
       apparmor: Use IS_ERR_OR_NULL() helper function

Jinjie Ruan (2):
       apparmor: test: Fix memory leak for aa_unpack_strdup()
       apparmor: Remove unused parameter L1 in macro next_comb

John Johansen (4):
       apparmor: add support for 2^24 states to the dfa state machine.
       apparmor: document first entry is in packed perms struct is reserved
       parser: drop dead code for XXX_comb macros
       apparmor: lift new_profile declaration to remove C23 extension warning

Leesoo Ahn (1):
       apparmor: domain: clean up duplicated parts of handle_onexec()

Ryan Lee (6):
       apparmor: allocate xmatch for nullpdb inside aa_alloc_null
       apparmor: properly handle cx/px lookup failure for complain
       apparmor: document capability.c:profile_capable ad ptr not being NULL
       apparmor: add a cache entry expiration time aging out capability audit cache
       apparmor: audit_cap dedup based on subj_cred instead of profile
       apparmor: replace misleading 'scrubbing environment' phrase in debug print

Siddharth Menon (1):
       Docs: Update LSM/apparmor.rst

Thorsten Blum (1):
       apparmor: Remove unnecessary NULL check before kvfree()

chao liu (1):
       apparmor: fix 'Do simple duplicate message elimination'

  Documentation/admin-guide/LSM/apparmor.rst |  7 ++-
  security/apparmor/apparmorfs.c             |  1 +
  security/apparmor/capability.c             | 19 +++---
  security/apparmor/domain.c                 | 66 +++++++++-----------
  security/apparmor/include/label.h          | 28 ---------
  security/apparmor/include/lib.h            |  1 -
  security/apparmor/include/match.h          |  8 ++-
  security/apparmor/include/perms.h          |  3 -
  security/apparmor/include/policy.h         |  1 -
  security/apparmor/include/secid.h          |  1 -
  security/apparmor/label.c                  | 33 ----------
  security/apparmor/lib.c                    | 84 -------------------------
  security/apparmor/match.c                  | 99 +++++++++++++++++++++++-------
  security/apparmor/path.c                   |  2 +-
  security/apparmor/policy.c                 |  9 +--
  security/apparmor/policy_unpack.c          |  5 +-
  security/apparmor/policy_unpack_test.c     |  6 ++
  security/apparmor/secid.c                  | 14 -----
  18 files changed, 141 insertions(+), 246 deletions(-)