aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2026-08-03selinux: require every boolean value to be definedBryam Vargas1-0/+19
p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected. Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-08-03selinux: reject an unclaimed class value in security_get_classes()Bryam Vargas1-5/+19
security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-08-03selinux: require a class's permission values to cover its permission countBryam Vargas1-5/+46
security_get_permissions() sizes an array by the class's permissions.nprim and fills it at value - 1, from the inherited common's permission table and then the class's own. A value no permission defines leaves a NULL that sel_make_perm_files() passes to d_alloc_name(), an oops inside sel_write_load() that strands selinux_state.policy_mutex and leaves every later load in uninterruptible sleep; two permissions sharing a value overwrite the first kstrdup(). Bounding each value by nprim catches neither, and neither would a count: the symbol table is keyed on the permission name, so duplicates pass. Track the values each permission table claims and require them to cover exactly what its count declares, rejecting a count no value can reach. Conforming policies are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-08-03selinux: do not cancel a policy conversion that never startedBryam Vargas1-1/+3
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load. Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts. Cc: stable@vger.kernel.org Fixes: 02a52c5c8c3b ("selinux: move policy commit after updating selinuxfs") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-08-02apparmor: Fix warning: 'decompress_zstd' defined but not usedJohn Johansen1-10/+6
decompress_zstd() is used in two cases: - CONFIG SECURITY_APPARMOR_COMPRESSED_POLICY: which allows for compressed policy to be loaded - CONFIG_SECURITY_APPARMOR_EXPORT_BINARY: which allows introspecting loaded policy, that is stored in compressed form until it is needed. When neither of these are selected there is no need for decpress_zstd(), which results in the decompressed_zstd defined but not used message. Only define decmpress_zstd() if either of those config options are enabled. The stub routine is not needed because all calling code is gated by one of those config options. Fixes: 1c5f27e845e84 ("apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled") Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-08-01apparmor: fix implicit declaration of function 'decompress_zstd'John Johansen1-6/+15
When CONFIG_ZSTD_DECOMPRESS is not enabled, and neither CONFIG_SECURITY_APPARMOR_EXPORT_BINARY nor CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY are enabled. The build will fail with implicit declaration of function 'decompress_zstd' because there is not an appropriate stub function, for when the zstd decompression isn't enabled. In addition fix compress_min, and compress_max to be conditional on CONFIG_SECURITY_APPARMOR_EXPORT_BINARY, as they are used with the exported policy. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608010834.9yIVzhG2-lkp@intel.com/ Fixes: 1c5f27e845e84 ("apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled") Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-31selinux: bpf: check SBLABEL_MNT before isec initCarlos Llamas1-4/+4
selinux_inode_init_security() marks the isec as initialized before checking if mount labeling is supported (SBLABEL_MNT). This was fine until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"), where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no xattrs) and yet leave the isec->initialized. This breaks subsequent calls to inode_doinit_with_dentry(). Do the SBLABEL_MNT check before the inode security is initialized. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@google.com/ Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs") Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-30selinux: reject a class permission count below its inherited commonBryam Vargas1-0/+12
security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write. Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-30selinux: reject a permission value exceeding the class permission countBryam Vargas1-0/+3
perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. Cc: stable@vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> [PM: tweak comment for line length] Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-30apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabledJohn Johansen2-1/+26
commit 17b5758bf35c ("apparmor: Initial support for compressed policies") added the ability for apparmor to load compressed policy, unfortunately it did not add a config option or select CONFIG_ZSTD_DECOMPRESS which it depends on, leading to the following build failure apparmorfs.c makes calls into zstd_*() even when CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is not set, causing build errors: /usr/bin/ld.bfd: security/apparmor/apparmorfs.o: in function `policy_update': apparmorfs.c:(.text+0x1307): undefined reference to `zstd_get_frame_header' /usr/bin/ld.bfd: apparmorfs.c:(.text+0x1359): undefined reference to `zstd_dctx_workspace_bound' /usr/bin/ld.bfd: apparmorfs.c:(.text+0x13f7): undefined reference to `zstd_init_dctx' /usr/bin/ld.bfd: apparmorfs.c:(.text+0x140c): undefined reference to `zstd_decompress_dctx' /usr/bin/ld.bfd: apparmorfs.c:(.text+0x1411): undefined reference to `zstd_is_error' Add a new config option to enable compress policy loading as using the existing CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is in appropriate as that is about retaining loaded policy so that it can be introspected at a later date. Fixes: 17b5758bf35c ("apparmor: Initial support for compressed policies") Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-29apparmor: compressed_data not described in aa_get_data_from_compressedJohn Johansen1-1/+1
Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Warning: security/apparmor/apparmorfs.c:501 function parameter 'compressed_data' not described in 'aa_get_data_from_compressed' Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607240144.4iqulDF1-lkp@intel.com/ Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-27selinux: validate constraint expression attr and op at load timeStephen Smalley1-0/+35
read_cons_helper() validates the expression type and stack depth of each constraint node but leaves e->attr and e->op unchecked, so a policy with an invalid operator or attribute value is accepted at load and only detected when the constraint is evaluated. constraint_expr_eval() handles such unrecognized cases with BUG() so the first permission check that reaches such a node oopses in the context of the checking process or panics with panic_on_oops. Reject these expresssions when the policy is loaded, matching what the libsepol validator already does. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-23apparmor: switch website link to httpsBaruch Siach1-1/+1
Should make harder for MITM to redirect to somewhere else. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-23keys: make keyring key-chunk byte order agree with keyring_diff_objects()Michael Bommarito1-2/+3
keyring_get_key_chunk() loads description bytes into the index chunk low address first, while keyring_diff_objects() numbers the first differing bit from the low end and folds the absolute byte index into the level without removing the inline-prefix offset the level already carries. The two disagree on byte order and bit position, so the array can be told two keys first differ at a bit that does not differ in the chunk the walker uses, letting crafted descriptions collide into one node. Load the chunk in the order keyring_diff_objects() assumes and drop the inline-prefix length when folding the byte index into the level. This only changes the in-memory ordering used to place keys within a keyring; add, search and read of non-colliding keys are unaffected. Fixes: f771fde82051 ("keys: Simplify key description management") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20260719161505.2423935-3-michael.bommarito@gmail.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-07-23keys: fix out-of-bounds read in keyring_get_key_chunk()Michael Bommarito1-4/+5
For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read. Fixes: f771fde82051 ("keys: Simplify key description management") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20260719161505.2423935-2-michael.bommarito@gmail.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-07-23KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return typeFabrice Derepas1-4/+11
Two correctness and type-hygiene issues exist in the DCP trusted keys implementation. First, trusted_dcp_unseal() reads p->key_len from a user-supplied blob without checking if it exceeds MAX_KEY_SIZE. If a crafted blob provides a payload_len larger than 128, the subsequent do_aead_crypto() call writes past the end of the p->key array into the adjacent p->blob buffer within the same struct trusted_key_payload -- the caller's own input, not unrelated kernel memory. While not exploitable, this violates strict array bounds and triggers static analyzers. Fix this by adding a validation check against MIN_KEY_SIZE and MAX_KEY_SIZE immediately after reading the length, matching the checks already done in trusted_core.c. Second, calc_blob_len() calculates a sum in size_t that truncates to unsigned int on 64-bit platforms. Because the DCP hardware is only present on 32-bit i.MX SoC platforms, size_t and unsigned int are functionally equivalent in production, making this truncation harmless in practice. Nevertheless, updating the return type to size_t (and subsequently updating 'blen' in the seal/unseal paths) resolves type-narrowing warnings and improves overall code hygiene. Fixes: 2e8a0f40a39c ("KEYS: trusted: Introduce NXP DCP-backed trusted keys") Signed-off-by: Fabrice Derepas <fabrice.derepas@canonical.com> Reviewed-by: David Gstir <david@sigma-star.at> Reviewed-by: Richard Weinberger <richard@nod.at> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20260719163939.3624767-1-fabrice.derepas@canonical.com Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-07-20apparmor: leverage audit_log_n_untrustedstring() when possiblePaul Moore1-4/+1
Make use of the audit_log_n_untrustedstring() function to simplify the code in aa_label_xaudit(). Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-17Merge tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinuxLinus Torvalds1-18/+24
Pull selinux fix from Paul Moore: "A single SELinux patch to correct a problem with the overlayfs mmap() and mprotect() fixes from earlier this year where we inadvertenly included an additional SELinux execmem permission check on some operations" * tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix incorrect execmem checks on overlayfs
2026-07-16Merge tag 'landlock-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxLinus Torvalds3-8/+13
Pull landlock fix from Mickaël Salaün: "This fixes TCP Fast Open support, specific test environments, and doc warnings" * tag 'landlock-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available selftests/landlock: Fix screwed up pointers in the scoped_signal_test landlock: Update formatting landlock: Fix kernel-doc for the nested quiet layer flag selftests/landlock: Add test for TCP fast open landlock: Fix TCP Fast Open connection bypass
2026-07-15selinux: compute the IMA configuration settings string length once at bootIan Bridges3-8/+30
selinux_ima_collect_state() builds a string of the current SELinux configuration settings. The string lists each setting as a name and one digit. The length of the string therefore never changes, but is still recomputed on every call. Add selinux_ima_config_len_init() to compute the length once during selinux_init(). Update selinux_ima_collect_state() to use the stored length. Suggested-by: Paul Moore <paul@paul-moore.com> Link: https://lore.kernel.org/r/df755e0282dab3b932d19aceab71b7d7@paul-moore.com Signed-off-by: Ian Bridges <icb@fastmail.org> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-15apparmor: replace decompress_zstd() prototype with its entityTetsuo Handa1-36/+36
Fix "undefined symbol: decompress_zstd" error caused by decompress_zstd() being guarded by CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y. Reported-by: syzbot+1f14a35d0c73d31555e4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1f14a35d0c73d31555e4 Fixes: 17b5758bf35c ("apparmor: Initial support for compressed policies") Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Acked-by: Georgia Garcia <georgia.garcia@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-07-14selinux: fix incorrect execmem checks on overlayfsOndrej Mosnacek1-18/+24
The commit fixing the overlayfs mmap() and mprotect() access checks failed to skip the execmem check in __file_map_prot_check() for the case where the "mounter check" is being performed. This check should be performed only against the credentials of the task that is calling mmap()/mprotect(), since it doesn't pertain to the file itself, but rather just gates the ability of the calling task to get an executable memory mapping in general. The purpose of the "mounter check" is to guard against using an overlayfs mount to gain file access that would otherwise be denied to the mounter. For execmem this is not relevant, as there is no further file access granted based on it (notice that the file's context is not used as the target in the check), so checking it also against the mounter credentials would be incorrect. Fix this by passing a boolean to [__]file_map_prot_check() and selinux_mmap_file_common() that indicates if we are doing the "mounter check" and skiping the execmem check in that case. Since this boolean also indicates if we use current_cred() or the mounter cred as the subject, also remove the "cred" argument from these functions and determine it based on the boolean and the file struct. Cc: stable@vger.kernel.org Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-13selinux: replace strlcat() with seq_buf in selinux_ima_collect_state()Ian Bridges1-27/+13
In preparation for removing the deprecated strlcat() API[1], replace the strscpy()/strlcat() chain in selinux_ima_collect_state() with a struct seq_buf, which tracks the write position and remaining space internally. Each field is written with seq_buf_printf() using a "=%d;" format, which removes the open-coded "=1;"/"=0;" constants. The seven per-append WARN_ON(rc >= buf_len) truncation checks are replaced by a single seq_buf_has_overflowed() check after the string is built. Link: https://github.com/KSPP/linux/issues/370 [1] Signed-off-by: Ian Bridges <icb@fastmail.org> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-13selinux: suppress warning flood for retired DCCP netlink messagesYafang Shao1-6/+12
When deploying linux-6.18.y stable kernel to production servers, we observed kernel dmesg being flooded with SELinux warnings when running `ss -l`: SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 \ sclass=netlink_tcpdiag_socket pid=188945 comm=ss The root cause is that DCCP support was retired in commit 2a63dd0edf38 ("net: Retire DCCP socket."). Consequently, DCCPDIAG_GETSOCK was removed from nlmsg_tcpdiag_perms. This causes nlmsg_perm() to return -EINVAL, triggering the SELinux warning for every `ss -l` invocation [0]. Use pr_warn_once() for the retired DCCPDIAG_GETSOCK to prevent message flooding. Link: https://github.com/iproute2/iproute2/blob/main/misc/ss.c#L3901 [0] Fixes: 2a63dd0edf38 ("net: Retire DCCP socket.") Suggested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Yafang Shao <laoar.shao@gmail.com> Cc: Kuniyuki Iwashima <kuniyu@google.com> Cc: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-10Merge tag 'selinux-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinuxLinus Torvalds1-10/+28
Pull selinux fixes from Paul Moore: "Two small SELinux patches to fix a missing permission check for TCP Fast Open operations and fix a socket lookup issue with SCTP ASCONF operations" * tag 'selinux-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() selinux: check connect-related permissions on TCP Fast Open
2026-07-10landlock: Update formattingMickaël Salaün1-6/+3
Following commit 99df2a8eba34 ("clang-format: fix formatting of guard() and scoped_guard() statements"), update scoped_guard() formatting. Also, see the related fix [1]. Cc: Günther Noack <gnoack@google.com> Cc: Miguel Ojeda <ojeda@kernel.org> Link: https://lore.kernel.org/r/20260708105713.2073335-1-mic@digikod.net [1] Link: https://patch.msgid.link/20260708110635.2083515-1-mic@digikod.net Reviewed-by: Günther Noack <gnoack@google.com> Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-07-10landlock: Fix kernel-doc for the nested quiet layer flagMickaël Salaün1-2/+2
kernel-doc emits "Excess struct member 'quiet' description in 'landlock_layer'" because "quiet" is a bitfield inside the named nested struct "flags", but its inline comment used the bare member name "@quiet:", which kernel-doc attributes to the enclosing landlock_layer. Use the canonical dotted notation "@flags.quiet:" so kernel-doc resolves the nested member, and include it in the generated documentation. Cc: Justin Suess <utilityemal77@gmail.com> Cc: Tingmao Wang <m@maowtm.org> Fixes: a260c0055665 ("landlock: Add a place for flags to layer rules") Link: https://patch.msgid.link/20260703141711.2016964-1-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-07-10landlock: Fix TCP Fast Open connection bypassMatthieu Buffet1-0/+8
The documentation of the socket_connect() LSM hook states that it controls connecting a socket to a remote address. It has not been the case since the addition of TCP Fast Open (RFC 7413) support, which allows opening a TCP connection (thus, setting a socket's destination address) via the MSG_FASTOPEN flag passed to sendto()/sendmsg()/sendmmsg(). The problem then got duplicated into MPTCP. Landlock did not take it into account when its TCP support was added, leaving a bypass of TCP connect policy. Ideally a call to the LSM hook would be added in the fastopen code path, in order to fix this generically. But connect() hooks are designed to run with the socket locked, unlike sendmsg() hooks. Closes: https://github.com/landlock-lsm/linux/issues/41 Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect") Signed-off-by: Matthieu Buffet <matthieu@buffet.re> Link: https://patch.msgid.link/20260701214628.33319-1-matthieu@buffet.re Cc: stable@vger.kernel.org [mic: Wrap commit message] Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-07-02lsm: clarify security_task_prctl() hook documentationBill Roberts1-3/+2
The task_prctl hook comment incorrectly described the hook as checking whether a prctl operation is allowed. In reality, the hook exists for LSMs to handle LSM-specific prctl operations. Update the function description and kernel-doc comment to reflect the actual behavior. The old wording appears to have been copied from other permission-check hooks despite differing semantics. Signed-off-by: Bill Roberts <bill.roberts@arm.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> [PM: subj tweak, comment tweak -> "prctl to prctl()" ] Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-02selinux: tighten type validation during policy loadStephen Smalley1-3/+8
Tighten type validation during policy load to improve robustness in the face of ill-formed policies. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-01selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()Tristan Madani1-9/+10
selinux_sctp_bind_connect() dereferences sk->sk_socket to pass a struct socket * to selinux_socket_bind() and selinux_socket_connect_helper(). However, when the hook is invoked from the ASCONF softirq path (sctp_process_asconf), there is no file reference guaranteeing that sk->sk_socket is non-NULL. The setsockopt callers (bindx, connectx, set_primary, sendmsg connect) hold a file reference and are not affected. Both selinux_socket_bind() and selinux_socket_connect_helper() immediately resolve sock->sk, never using the struct socket * for anything else. Refactor the inner logic into helpers that take a struct sock * directly so that selinux_sctp_bind_connect() never needs to touch sk->sk_socket at all. Cc: stable@vger.kernel.org Fixes: d452930fd3b9 ("selinux: Add SCTP support") Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-01selinux: drop unnecessary goto and label from avc_alloc_node()Kalevi Kolttonen1-2/+1
Since avc_alloc_node() doesn't need to perform any cleanup on its exit paths, there is no benefit to keeping the out label and goto statement. Drop it. Signed-off-by: Kalevi Kolttonen <kalevi@kolttonen.fi> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-01selinux: convert int flags to bool flags in ss/services.cKalevi Kolttonen1-9/+9
Update security_sid_to_context_core(), security_context_to_sid_core(), and their callers to pass boolean flags via bool rather than int. No functional change. Signed-off-by: Kalevi Kolttonen <kalevi@kolttonen.fi> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> [PM: minor subject and description tweaks] Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-01selinux: clean up selinuxfs resources on init failureHaoxiang Li1-6/+13
init_sel_fs() creates the selinuxfs mount point and registers the filesystem before mounting selinuxfs internally. If kern_mount() or the subsequent lookup of the null file fails, the function returns without undoing the resources that were already registered. Add the missing error unwinding so the internal mount, filesystem registration, and sysfs mount point are released as appropriate. Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-01selinux: check connect-related permissions on TCP Fast OpenStephen Smalley1-1/+18
Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/ Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/ Reported-by: Bryam Vargas <hexlabsecurity@proton.me> Reported-by: Matthieu Buffet <matthieu@buffet.re> Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Tested-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-06-30selinux: hooks: use kmalloc() to allocate path bufferMike Rapoport (Microsoft)1-3/+3
selinux_genfs_get_sid() allocates memory for a path with __get_free_page(). Such usage does not require a "page" and the size of the buffer should actually be PATH_MAX which may be less than PAGE_SIZE on some architectures. Replace __get_free_page() for allocation of a path buffer with kmalloc() and make it explicit that the buffer size is PATH_MAX. Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-06-30bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitializedMatt Bobrowski1-0/+3
When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the "lsm=" boot parameter), lsm_prepare() is never executed for the BPF LSM. Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more). When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates inode->i_security + 8. This erroneously aliases the struct rcu_head.func callback pointer at the beginning of the inode->i_security blob. During subsequent map element cleanup or inode destruction, writing NULL to owner_storage clears the queued RCU callback pointer. When rcu_do_batch() later executes the queued callback, it attempts an instruction fetch at address 0x0, triggering an immediate kernel panic. Fix this by introducing a global bpf_lsm_initialized boolean flag marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() when the LSM framework successfully registers the BPF LSM. Gate map allocation in inode_storage_map_alloc() on this flag, returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized. This fail-fast approach prevents userspace from allocating inode storage maps when the supporting BPF LSM infrastructure is absent, avoiding zombie map states. Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes") Reported-by: oxsignal <awo@kakao.com> Signed-off-by: Matt Bobrowski <mattbobrowski@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Reviewed-by: Amery Hung <ameryhung@gmail.com> Link: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com
2026-06-29apparmor: fix alternate loaders ability to load compressed policyJohn Johansen1-3/+34
When policy is compressed it is given a header in userspace. The parser knows to strip this header, but alternate profile loaders like aa-load and systemd have not been updated so that they know to strip the header. This allows those loaders to just load the binary file without having to be updated. Fixes: 17b5758bf35c7 ("apparmor: Initial support for compressed policies") Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-29apparmor: Initial support for compressed policiesMaxime Bélair5-10/+123
This patch allows policies to be compressed in userspace and be sent to the kernel through the existing ".load" and ".replace" kernel interfaces. The benefits of this approach are: - Save kernel time when loading policies - Allow userspace to provide a higher level of compression than the one provided by the kernel (ZSTD_CLEVEL_DEFAULT), thus saving space. - Allow small embedded systems to only store the compressed version of policies in userspace, saving memory. Userspace-compressed policies improve system time by up to ~30% for big profiles. Signed-off-by: Maxime Bélair <maxime.belair@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-29apparmor: make include headers self-containedRyan Lee7-0/+16
Besides of resolving clangd IDE warnings, self-contained headers will be less likely to break if the surrounding includes in .c files using them change. Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-29apparmor: fix net.h and policy.h circular include patternRyan Lee5-1/+4
While the #ifdef guards prevent the circular include from blowing up, policy.h does not actually need anything from net.h. Remove, that include and instead include net.h in the other files that need it. Signed-off-by: Ryan Lee <ryan.lee@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-24Merge tag 'apparmor-pr-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmorLinus Torvalds17-150/+364
Pull apparmor updates from John Johansen: "Another round of bug fixing and some code cleanups, there are no new features. The biggest thing to note is Georgia is being added to help co-maintain apparmor. Cleanups: - replace get_zeroed_page() with kzalloc() - remove unnecessary goto and associated label - change fn_label_build() to return err on failure instead of NULL or err - free rawdata as soon as possible - use explicit instead of implicit flex array in rawdata_f_data - use __label_make_stale in __aa_proxy_redirect - return correct error by propagate -ENOMEM correctly in unpack_table - aa_label_alloc use aa_label_free on alloc failure - add a conditional version of get_newest_label Bug Fixes: - mediate the implicit connect of TCP fast open sendmsg - fix C23ism of label immediately before a declaration - fix kernel-doc warnings - fix spelling mistakes - fix use-after-free in rawdata dedup loop - Fix inverted comparison in cache_hold_inc() - fix uninitialized pointer passed to audit_log_untrustedstring() - don't audit files pointing to aa_null.dentry - put secmark label after secid lookup - fix aa_getprocattr free procattr leak on format failure - release exe file resources on path failure - fail policy unpack on accept2 allocation failure - Fix return in ns_mkdir_op - remove or add symlinks to rawdata according to export_binary - fix NULL pointer dereference in unpack_pdb - fix potential UAF in aa_replace_profiles - grab ns lock and refresh when looking up changehat child profiles - enable differential encoding - check label build before no_new_privs test - conditionally compile get_loaddata_common_ref() - fix unix socket mediation cache update, and leak" * tag 'apparmor-pr-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (35 commits) apparmor: advertise the tcp fast open fix is applied apparmor: mediate the implicit connect of TCP fast open sendmsg apparmor: fix label can not be immediately before a declaration apparmor: fix kernel-doc warnings apparmor: replace get_zeroed_page() with kzalloc() security: apparmor: fix two spelling mistakes apparmor: fix use-after-free in rawdata dedup loop apparmor: Fix inverted comparison in cache_hold_inc() apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() apparmor: don't audit files pointing to aa_null.dentry apparmor: put secmark label after secid lookup apparmor: aa_getprocattr free procattr leak on format failure apparmor: remove unnecessary goto and associated label apparmor: release exe file resources on path failure apparmor: fail policy unpack on accept2 allocation failure apparmor: Fix return in ns_mkdir_op apparmor: remove or add symlinks to rawdata according to export_binary apparmor: fix NULL pointer dereference in unpack_pdb apparmor: make fn_label_build() capable of handling not supported apparmor: change fn_label_build() call to not return NULL ...
2026-06-23apparmor: advertise the tcp fast open fix is appliedJohn Johansen1-0/+2
The fix for tcp-fast-open ensures that the connect permission is being mediated correctly but it didn't add an artifact to the feature set to advertise the fix is available. Add an artifact so that the test suite can identify if the fix has not been properly applied or a new unexpected regression has occurred. Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg") Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-23apparmor: mediate the implicit connect of TCP fast open sendmsgBryam Vargas1-1/+15
sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP connection that connect(2) would have refused, bypassing connect mediation. Mediate the implicit connect when MSG_FASTOPEN is set and a destination is supplied. Add it to apparmor_socket_sendmsg() (not the shared aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm() directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit. Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: John Johansen <john.johansen@canonical.com>
2026-06-22smack: restrict smackfs/{direct,mapped} values to 0-255Konstantin Andreev2-13/+15
Both smackfs/direct and smackfs/mapped incorrectly accept the full range of integer values. For example: # cd /sys/fs/smackfs/ # cat direct ; echo 250 # cat cipso2 @ 250/2 _ 250/2,4,5,6,7,8 * 250/3,5,7 ^ 250/2,4,5,6,7 ? 250/3,4,5,6,7,8 # echo -1234 >direct ; cat direct ; echo -1234 # cat cipso2 @ -1234/2 _ -1234/2,4,5,6,7,8 * -1234/3,5,7 ^ -1234/2,4,5,6,7 ? -1234/3,4,5,6,7,8 # I noticed two things regarding this: 1) sensitivity levels are truncated to 8 bits when labeling outgoing packets (0x2e = 46 for the -1234 example above) 2) the reverse process fails: incoming packets with sensitivity level 46 do not match these smackfs/cipso2 entries. Even observation (1) on its own warrants a fix. This patch restricts smackfs/direct and smackfs/mapped accepted values to the 0-255 range. Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2026-06-22smack: deduplicate smackfs/{direct,mapped} file_operationsKonstantin Andreev2-96/+42
The file_operations for smackfs/direct and smackfs/mapped are identical up to a textual replacement of "direct" with "mapped" This patch combines two instances of file_operations into one, handling both files. Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4") Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2026-06-22smack: show msgrcv() subject task in auditKonstantin Andreev3-0/+12
When a task msgrcv()'es some message the SMACK audit log message looks like: fn=smk_tskacc_msq action=denied subject="bar" object="foo" requested=rw pid=456 comm="mrcv" ipc_key=2 fn=smk_tskacc_msq action=granted subject="bar" object="foo" requested=rw pid=519 comm="mrcv" ipc_key=2 where pid= is a pid of a “current” task which calls smk_tskacc_msq(). Usually, the caller of smk_tskacc_msq() is also a subject task which determines its own permission. In the example above the 'mrcv' process has label 'bar' and wants "rw" for label "foo". However, when sender task delivers message using ipc/msg.c`pipelined_send(): ` security_msg_queue_msgrcv(,, msr->r_tsk,,) ` smp_store_release(&msr->r_msg, msg) “current” task and “subject” task differ, and the “subject” task is missed from the audit message. This patch adds two fields, subj_pid and subj_comm, into the audit message: fn=smk_tskacc_msq action=granted subject="bar" object="foo" requested=rw subj_pid=564 subj_comm="mrcv" pid=577 comm="msnd" ipc_key=2 Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2026-06-22smack: fix incorrect task context in smack_msg_queue_msgrcvKonstantin Andreev1-18/+47
The smack_msg_queue_msgrcv() function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd() syscall path, if a receiver is already waiting, the pipelined_send() optimization is used to push the message directly to the receiver task: ipc/msg.c`pipelined_send(): ` smp_store_release(&msr->r_msg, msg) In this case, the 'sender' (current) task performs the check on behalf of the 'receiver' task (msr->r_tsk, passed as the 'target' parameter): ipc/msg.c`pipelined_send(): ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,) However, smack_msg_queue_msgrcv() ignores the 'target' and checks 'current': smack_msg_queue_msgrcv(…) ` smk_curacc_msq(isp, MAY_READWRITE); // current task 'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement, but 'target' (the receiver task) might NOT; as a result, an unauthorized receiver gets the message, violating MAC policy. Test: 1) create a sysv message queue with label “foo” 2) echo "bar foo r" >/smack/load2 3) msgrcv(,,,0,MSG_NOERROR) in "bar"-labeled task. The task is waiting for the messages ... 4) msgsnd() from a "foo"-labeled task: "bar"-labeled task gets the message. This patch fixes the issue by checking permission on the 'target' task instead of 'current'. (2008-02-04, Casey Schaufler) Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2026-06-22security: smack: fix spelling mistakeQingshuang Fu1-1/+1
Fix misspelling: overriden → overridden Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn> Changes since v1: - Split original single patch into two standalone patches, separate AppArmor and Smack changes for different maintainer trees. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2026-06-19Merge tag 'landlock-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linuxLinus Torvalds14-190/+788
Pull landlock updates from Mickaël Salaün: "This adds new Landlock access rights to control UDP bind and connect/send operations, and a new "quiet" feature to mute specific specific audit logs (and other future observability events). A few commits also fix Landlock issues" * tag 'landlock-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (24 commits) selftests/landlock: Add tests for invalid use of quiet flag selftests/landlock: Add tests for quiet flag with scope selftests/landlock: Add tests for quiet flag with net rules selftests/landlock: Add tests for quiet flag with fs rules selftests/landlock: Replace hard-coded 16 with a constant samples/landlock: Add quiet flag support to sandboxer landlock: Suppress logging when quiet flag is present landlock: Add API support and docs for the quiet flags landlock: Add a place for flags to layer rules landlock: Add documentation for UDP support samples/landlock: Add sandboxer UDP access control selftests/landlock: Add tests for UDP send selftests/landlock: Add tests for UDP bind/connect landlock: Add UDP send+connect access control landlock: Add UDP bind() access control landlock: Fix unmarked concurrent access to socket family selftests/landlock: Explicitly disable audit in teardowns selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path landlock: Demonstrate best-effort allowed_access filtering ...
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.