version 4.19.325-cip132
* tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree
Update localversion-st, tree is up-to-date with 5.10.254.
x86/CPU: Fix FPDSS on Zen1
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
netfilter: nft_ct: fix use-after-free in timeout object destroy
apparmor: fix differential encoding verification
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
ext4: convert inline data to extents when truncate exceeds inline size
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: authencesn - Fix src offset when decrypting in-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
crypto: authenc - use memcpy_sglist() instead of null skcipher
crypto: algif_aead - snapshot IV for async AEAD requests
crypto: algif_aead - Revert to operating out-of-place
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
Buffer overflow in drivers/xen/sys-hypervisor.c
xen/privcmd: fix double free via VMA splitting
crypto: algif_aead - Fix minimum RX size check for decryption
crypto: scatterwalk - Backport memcpy_sglist()
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
device property: Check fwnode->secondary when finding properties
device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
device property: Retrieve fwnode from of_node via accessor
media: device property: Return true in fwnode_device_is_available for NULL ops
ext4: fix the might_sleep() warnings in kvfree()
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
net: rfkill: prevent unlimited numbers of rfkill events from being created
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
cpufreq: governor: Free dbs_data directly when gov->init() fails
xen/privcmd: unregister xenstore notifier on module exit
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
net: stmmac: fix integer underflow in chain mode
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
mmc: vub300: fix NULL-deref on disconnect
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
batman-adv: reject oversized global TT response buffers
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
wifi: brcmsmac: Fix dma_free_coherent() size
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
apparmor: fix unprivileged local user can do privileged policy management
apparmor: Fix double free of ns_name in aa_replace_profiles()
apparmor: fix side-effect bug in match_char() macro usage
apparmor: fix: limit the number of levels of policy namespaces
apparmor: replace recursive profile removal with iterative approach
apparmor: fix memory leak in verify_header
apparmor: validate DFA start states are in bounds in unpack_pdb
mm/rmap: fix two comments related to huge_pmd_unshare()
mm/hugetlb: fix two comments related to huge_pmd_unshare()
mm/hugetlb: make detecting shared pte more reliable
Input: uinput - take event lock when submitting FF request "event"
Input: uinput - fix circular locking dependency with ff-core
xfrm_user: fix info leak in build_report()
wifi: rt2x00usb: fix devres lifetime
usb: gadget: f_uac1_legacy: validate control request size
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
USB: dummy-hcd: Fix locking/synchronization error
vxlan: validate ND option lengths in vxlan_na_create
comedi: me4000: Fix potential overrun of firmware buffer
comedi: me_daq: Fix potential overrun of firmware buffer
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
comedi: Reinit dev->spinlock between attachments to low-level drivers
comedi: dt2815: add hardware detection to prevent crash
bridge: br_nd_send: validate ND option lengths
usb: ulpi: fix double free in ulpi_register_interface() error path
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
iio: gyro: mpu3050: Move iio_device_register() to correct location
iio: gyro: mpu3050: Fix irq resource leak
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Input: xpad - add support for Razer Wolverine V3 Pro
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
USB: serial: option: add support for Rolling Wireless RW135R-GL
USB: serial: io_edgeport: add support for Blackbox IC135A
drm/ast: dp501: Fix initialization of SCU2C
MIPS: Fix the GCC version check for `__multi3' workaround
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
ALSA: ctxfi: Fix missing SPDIFI1 index handling
ALSA: caiaq: fix stack out-of-bounds read in init_card
USB: serial: option: add MeiG Smart SRM825WN
drm/ioc32: stop speculation on the drm_compat_ioctl path
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
drm/vmwgfx: Add seqno waiter for sync_files
Revert "drm/vmwgfx: Add seqno waiter for sync_files"
ipv6: avoid overflows in ip6_datagram_send_ctl()
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/x25: Fix overflow when accumulating packets
net/x25: Fix potential double free of skb
net: macb: properly unregister fixed rate clocks
net: macb: fix clk handling on PCI glue driver removal
Bluetooth: MGMT: validate LTK enc_size on load
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
netfilter: nf_conntrack_helper: pass helper to expect cleanup
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
netfilter: x_tables: ensure names are nul-terminated
netfilter: nfnetlink_log: account for netlink header size
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
bpf: Fix regsafe() for pointers to packet
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
ipv6: prevent possible UaF in addrconf_permanent_addr()
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
bridge: br_nd_send: linearize skb before parsing ND options
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
tg3: Fix race for querying speed/duplex
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
crypto: af-alg - fix NULL pointer dereference in scatterwalk
HID: multitouch: Check to ensure report responses match the request
atm: lec: fix use-after-free in sock_def_readable()
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
dmaengine: xilinx_dma: Program interrupt delay timeout
btrfs: fix lost error when running device stats on multiple devices fs
btrfs: fix super block offset in error message in btrfs_validate_super()
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
ext4: reject mount if bigalloc with s_first_data_block != 0
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
ext4: make recently_deleted() properly work with lazy itable initialization
scsi: ses: Handle positive SCSI error from ses_recv_diag()
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
alarmtimer: Fix argument order in alarm_timer_forward()
cpufreq: conservative: Reset requested_freq on limits change
s390/barrier: Make array_index_mask_nospec() __always_inline
sysctl: fix uninitialized variable in proc_do_large_bitmap
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
ACPICA: include/acpi/acpixf.h: Fix indentation
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
net: macb: use the current queue number for stats
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
net: fix fanout UAF in packet_release() via NETDEV_UP race
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
openvswitch: validate MPLS set/set_masked payload length
net: openvswitch: Avoid releasing netdev before teardown completes
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Bluetooth: hci_ll: Fix firmware leak on error path
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
af_key: validate families in pfkey_send_migrate()
xfrm: call xdo_dev_state_delete during state update
dma-buf: Include ioctl.h in UAPI header
xen/privcmd: restrict usage in unprivileged domU
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
icmp: fix NULL pointer dereference in icmp_tag_validation()
nfnetlink_osf: validate individual option lengths in fingerprints
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
net: macb: fix uninitialized rx_fs_lock
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
wifi: mac80211: fix NULL deref in mesh_matches_local()
PM: runtime: Fix a race condition related to device removal
net: bcmgenet: increase WoL poll timeout
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
netfilter: xt_time: use unsigned int for monthday bit shift
netfilter: xt_CT: drop pending enqueued packets on template removal
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
netfilter: ctnetlink: remove refcounting in expectation dumpers
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Bluetooth: HIDP: Fix possible UAF
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
staging: rtl8723bs: fix null dereference in find_network
net/tcp-md5: Fix MAC comparison to be constant-time
ALSA: pcm: fix wait_time calculations
can: gs_usb: gs_can_open(): always configure bitrates before starting device
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
smb: client: fix iface port assignment in parse_server_interfaces
iio: light: bh1780: fix PM runtime leak on error path
tracing: Fix syscall events activation by ensuring refcount hits zero
s390/xor: Fix xor_xc_2() inline assembly constraints
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
wifi: libertas: fix use-after-free in lbs_free_adapter()
ext4: fix dirtyclusters double decrement on fs shutdown
ext4: drop extent cache when splitting extent fails
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
net: Handle napi_schedule() calls from non-interrupt
drm/radeon: apply state adjust rules to some additional HAINAN vairants
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
net: macb: fix use-after-free access to PTP clock
nvdimm/bus: Fix potential use after free in asynchronous initialization
iio: chemical: bme680: Fix measurement wait duration calculation
iio: potentiometer: mcp4131: fix double application of wiper shift
iio: dac: ds4424: reject -128 RAW value
btrfs: abort transaction on failure to update root in the received subvol ioctl
x86/apic: Disable x2apic on resume if the kernel expects so
drm/amdgpu: Fix use-after-free race in VM acquire
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
net: ncsi: fix skb leak in error paths
parisc: Fix initial page table creation for boot
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
parisc: Increase initial mapping to 64 MB with KALLSYMS
batman-adv: Avoid double-rtnl_lock ELP metric worker
media: dvb-net: fix OOB access in ULE extension header tables
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
usb: image: mdc800: kill download URB on timeout
usb: mdc800: handle signal and read racing
usb: class: cdc-wdm: fix reordering issue in read code path
USB: usbcore: Introduce usb_bulk_msg_killable()
usb: misc: uss720: properly clean up reference in uss720_probe()
usb: yurex: fix race in probe
usb: xhci: Fix memory leak in xhci_disable_slot()
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
net: usb: lan78xx: skip LTM configuration for LAN7850
net: usb: lan78xx: fix silent drop of packets with checksum errors
cgroup: fix race between task migration and iteration
e1000/e1000e: Fix leak in DMA error cleanup
i40e: fix src IP mask checks and memcpy argument names in cloud filter
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
sched: idle: Make skipping governor callbacks more consistent
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
netfilter: x_tables: guard option walkers against 1-byte tail reads
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
serial: caif: hold tty->link reference in ldisc_open and ser_release
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
powerpc: 83xx: km83xx: Fix keymile vendor prefix
remoteproc: sysmon: Correct subsys_name_len type in QMI request
powerpc/uaccess: Fix inline assembly for clang build on PPC32
scsi: ses: Fix devices attaching to different hosts
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
unshare: fix unshare_fs() handling
ACPI: PM: Save NVS memory on Lenovo G70-35
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
nfc: rawsock: cancel tx_work before socket teardown
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
nfc: nci: free skb on nci_transceive early error paths
net: nfc: nci: Fix zero-length proprietary notifications
amd-xgbe: fix sleep while atomic on suspend/resume
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
wifi: wlcore: Fix a locking bug
can: bcm: fix locking for bcm_op runtime updates
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Squashfs: check metadata block offset is within range
wifi: radiotap: reject radiotap with unknown bits
ALSA: usb-audio: Use correct version for UAC3 header validation
can: ucan: Fix infinite loop from zero-length messages
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
net: usb: pegasus: validate USB endpoints
net: usb: kalmia: validate USB endpoints
net: usb: kaweth: validate USB endpoints
nfc: pn533: properly drop the usb interface reference on disconnect
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
clk: tegra: tegra124-emc: fix device leak on set_rate()
drm/tegra: dsi: fix device leak on probe
ARM: omap2: Fix reference count leaks in omap_control_init()
ARM: OMAP2+: add missing of_node_put before break and return
ARM: clean up the memset64() C wrapper
Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f
commit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.
Differential encoding allows loops to be created if it is abused. To
prevent this the unpack should verify that a diff-encode chain
terminates.
Unfortunately the differential encode verification had two bugs.
1. it conflated states that had gone through check and already been
marked, with states that were currently being checked and marked.
This means that loops in the current chain being verified are treated
as a chain that has already been verified.
2. the order bailout on already checked states compared current chain
check iterators j,k instead of using the outer loop iterator i.
Meaning a step backwards in states in the current chain verification
was being mistaken for moving to an already verified state.
Move to a double mark scheme where already verified states get a
different mark, than the current chain being kept. This enables us
to also drop the backwards verification check that was the cause of
the second error as any already verified state is already marked.
Fixes: 031dcc8f4e ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[uli: backport to 4.19]
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Reviewed-by: Pavel Machek <pavel@nabladev.com>
commit 6601e13e82841879406bf9f369032656f441a425 upstream.
Backport for api changes introduced in
- 90c436a64a6e ("apparmor: pass cred through to audit info.")
- 92de220a7f33 ("apparmor: update policy capable checks to use a label")
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.
The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.
Fixes: b7fd2c0340 ("apparmor: add per policy ns .load, .replace, .remove interface files")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit 5df0c44e8f5f619d3beb871207aded7c78414502 upstream.
if ns_name is NULL after
1071 error = aa_unpack(udata, &lh, &ns_name);
and if ent->ns_name contains an ns_name in
1089 } else if (ent->ns_name) {
then ns_name is assigned the ent->ns_name
1095 ns_name = ent->ns_name;
however ent->ns_name is freed at
1262 aa_load_ent_free(ent);
and then again when freeing ns_name at
1270 kfree(ns_name);
Fix this by NULLing out ent->ns_name after it is transferred to ns_name
Fixes: 145a0ef21c8e9 ("apparmor: fix blob compression when ns is forced on a policy load
")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.
Hard cap policy namespaces to the same depth as user namespaces.
Fixes: c88d4c7b04 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream.
The profile removal code uses recursion when removing nested profiles,
which can lead to kernel stack exhaustion and system crashes.
Reproducer:
$ pf='a'; for ((i=0; i<1024; i++)); do
echo -e "profile $pf { \n }" | apparmor_parser -K -a;
pf="$pf//x";
done
$ echo -n a > /sys/kernel/security/apparmor/.remove
Replace the recursive __aa_profile_list_release() approach with an
iterative approach in __remove_profile(). The function repeatedly
finds and removes leaf profiles until the entire subtree is removed,
maintaining the same removal semantic without recursion.
Fixes: c88d4c7b04 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit e38c55d9f834e5b848bfed0f5c586aaf45acb825 upstream.
The function sets `*ns = NULL` on every call, leaking the namespace
string allocated in previous iterations when multiple profiles are
unpacked. This also breaks namespace consistency checking since *ns
is always NULL when the comparison is made.
Remove the incorrect assignment.
The caller (aa_unpack) initializes *ns to NULL once before the loop,
which is sufficient.
Fixes: dd51c84857 ("apparmor: provide base for multiple profiles to be replaced at once")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit 9063d7e2615f4a7ab321de6b520e23d370e58816 upstream.
Backport for conflicts caused by
ad596ea74e74 ("apparmor: group dfa policydb unpacking")
- rearrange and consolidated the unpack.
b11e51dd7094 ("apparmor: test: make static symbols visible during kunit testing")
- rename function and make it visible to kunit tests
Start states are read from untrusted data and used as indexes into the
DFA state tables. The aa_dfa_next() function call in unpack_pdb() will
access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds
the number of states in the DFA, this results in an out-of-bound read.
==================================================================
BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360
Read of size 4 at addr ffff88811956fb90 by task su/1097
...
Reject policies with out-of-bounds start states during unpacking
to prevent the issue.
Fixes: ad5ff3db53 ("AppArmor: Add ability to load extended policy")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
version 4.19.325-cip131
* tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
CIP: Bump version suffix to -cip131 after merge from cip/linux-4.19.y-st tree
Update localversion-st, tree is up-to-date with 5.10.252.
nfsd: fix return error code for nfsd_map_name_to_[ug]id
net: usb: pegasus: enable basic endpoint checking
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
Bluetooth: Enforce key size of 16 bytes on FIPS level
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
netfilter: nf_conntrack: Add allow_clash to generic protocol handler
ext4: don't cache extent during splitting extent
NTB: ntb_transport: Fix too small buffer for debugfs_name
net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
fbdev: ffb: fix corrupted video output on Sun FFB1
fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
atm: fore200e: fix use-after-free in tasklets during device removal
net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
ceph: supply snapshot context in ceph_zero_partial_object()
MIPS: rb532: Fix MMIO UART resource registration
parisc: kernel: replace kfree() with put_device() in create_tree_node()
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
usb: dwc2: fix resume failure if dr_mode is host
btrfs: continue trimming remaining devices on failure
kexec: derive purgatory entry from symbol
ocfs2: fix reflink preserve cleanup issue
ocfs2: fix xattr array entry __counted_by error
rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
iio: gyro: itg3200: Fix unchecked return value in read_raw
dm mpath: make pg_init_delay_msecs settable
bus: fsl-mc: fix an error handling in fsl_mc_device_add()
md/bitmap: fix GPF in write_page caused by resize race
xfs: fix remote xattr valuelblk check
xfs: fix freemap adjustments when adding xattrs to leaf blocks
xfs: delete attr leaf freemap entries when empty
xfs: mark data structures corrupt on EIO and ENODATA
mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
drm: of: drm_of_panel_bridge_remove(): fix device_node leak
dm-unstripe: fix mapping bug when there are multiple targets in a table
clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc()
dm: clear cloned request bio pointer when last clone bio completes
media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
media: cx25821: Add missing unmap in snd_cx25821_hw_params()
media: cx23885: Add missing unmap in snd_cx23885_hw_params()
media: cx88: Add missing unmap in snd_cx88_hw_params()
media: radio-keene: fix memory leak in error path
HID: prodikeys: Check presence of pm->input_ep82
HID: magicmouse: Do not crash on missing msc->input
HID: hid-pl: handle probe errors
media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
dm-verity: correctly handle dm_bufio_client_create() failure
fpga: dfl: use subsys_initcall to allow built-in drivers to be added
rpmsg: core: fix race in driver_override_show() and use core helper
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
net: consume xmit errors of GSO frames
Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
Bluetooth: l2cap: Check encryption key size on incoming connection
wifi: cfg80211: wext: fix IGTK key ID off-by-one
net: usb: lan78xx: scan all MDIO addresses on LAN7801
lan78xx: Fix memory allocation bug
lan78xx: Fix race condition in disconnect handling
lan78xx: Remove unused pause frame queue
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
drm/radeon: Add HAINAN clock adjustment
drm/amdgpu: Add HAINAN clock adjustment
ARM: 9467/1: mm: Don't use %pK through printk
include: uapi: netfilter_bridge.h: Cover for musl libc
iio: magnetometer: Remove IRQF_ONESHOT
Revert "mfd: da9052-spi: Change read-mask to write-mask"
binder: don't use %pK through printk
serial: 8250_dw: handle clock enable errors in runtime_resume
m68k: nommu: fix memmove() with differently aligned src and dest for 68000
clk: microchip: core: correct return value on *_get_parent()
nfc: nxp-nci: remove interrupt trigger type
myri10ge: avoid uninitialized variable use
PCI: Mark Nvidia GB10 to avoid bus reset
PCI: Fix pci_slot_lock () device locking
PCI: Mark ASM1164 SATA controller to avoid bus reset
net/rds: Clear reconnect pending bit
vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
net: usb: sr9700: remove code to drive nonexistent multicast filter
Bluetooth: btusb: Add device ID for Realtek RTL8761BU
Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
ipv4: fib: Annotate access to struct fib_alias.fa_state.
wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
net/rds: No shortcut out of RDS_CONN_ERROR
net: usb: r8152: fix transmit queue timeout
openrisc: define arch-specific version of nop()
netfilter: xt_tcpmss: check remaining length before reading optlen
wifi: libertas: fix WARNING in usb_tx_block
jfs: nlink overflow in jfs_rename
jfs: Add missing set_freezable() for freezable kthread
modpost: Amend ppc64 save/restfpr symnames for -Os build
ASoC: es8328: Add error unwind in resume
HID: multitouch: add eGalaxTouch EXC3188 support
drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
virt: vbox: uapi: Mark inner unions in packed structs as packed
hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
drm: Account property blob allocations to memcg
media: cx25821: Fix a resource leak in cx25821_dev_setup()
media: solo6x10: Check for out of bounds chip_id
media: pvrusb2: fix URB leak in pvr2_send_request_ex
media: adv7180: fix frame interval in progressive mode
ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
media: omap3isp: set initial format
media: omap3isp: isppreview: always clamp in preview_try_format()
media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
media: dvb-core: dmxdevfilter must always flush bufs
parisc: Prevent interrupts during reboot
arm64: tegra: smaug: Add usb-role-switch support
pstore: ram_core: fix incorrect success return when vmap() fails
mailbox: bcm-ferxrm-mailbox: Use default primary handler
clocksource/drivers/sh_tmu: Always leave device running after probe
sparc: don't reference obsolete termio struct for TC* constants
xenbus: Use .freeze/.thaw to handle xenbus devices
ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
EFI/CPER: don't go past the ARM processor CPER record buffer
x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set
s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
tools/power cpupower: Reset errno before strtoull()
minix: Add required sanity checking to minix_check_superblock()
hfsplus: pretend special inodes as regular files
audit: add missing syscalls to read class
hfsplus: fix volume corruption issue for generic/498
audit: add fchmodat2() to change attributes class
rtc: interface: Alarm race handling should not discard preceding error
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
ata: pata_ftide010: Fix some DMA timings
ext4: fix memory leak in ext4_ext_shift_extents()
MIPS: Work around LLVM bug when gp is used as global register variable
apparmor: fix invalid deref of rawdata when export_binary is unset
apparmor: fix rlimit for posix cpu timers
apparmor: fix NULL sock in aa_sock_file_perm
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
macvlan: observe an RCU grace period in macvlan_common_newlink() error path
netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
net/rds: rds_sendmsg should not discard payload_len
xen-netback: reject zero-queue configuration from guest
net: usb: catc: enable basic endpoint checking
usbb: catc: use correct API for MAC addresses
cpuidle: Skip governor when only one idle state is available
pinctrl: single: fix refcount leak in pcs_add_gpio_func()
iio: sca3000: Fix a resource leak in sca3000_probe()
ovl: Fix uninit-value in ovl_fill_real
drivers: iio: mpu3050: use dev_err_probe for regulator request
mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure
Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
mmc: core: Initial support for SD express card/host
serial: SH_SCI: improve "DMA support" prompt
staging: greybus: lights: avoid NULL deref
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
scsi: csiostor: Fix dereference of null pointer rn
pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
svcrdma: Remove queue-shortening warnings
RDMA/core: Fix a couple of obvious typos in comments
power: supply: wm97xx_battery: Convert to GPIO descriptor
power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
power: supply: rt9455: Fix use-after-free in power_supply_changed()
power: supply: act8945a: Fix use-after-free in power_supply_changed()
serial: caif: fix use-after-free in caif_serial ldisc_close()
net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
netfilter: nft_set_hash: fix get operation on big endian
bonding: only set speed/duplex to unknown, if getting speed failed
ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
tcp: tcp_tx_timestamp() must look at the rtx queue
fat: avoid parent link count underflow in rmdir
PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
netfilter: nf_conncount: fix tracking of connections from localhost
netfilter: nf_conncount: increase the connection clean up limit to 64
netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
wifi: cfg80211: stop NAN and P2P in cfg80211_leave
PCI/portdrv: Fix potential resource leak
PCI: Do not attempt to set ExtTag for VFs
PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
spi: tools: Add include folder to .gitignore
regulator: Flag uncontrollable regulators as always_on
regulator: core: Respect off_on_delay at startup
smack: /smack/doi: accept previously used values
smack: /smack/doi must be > 0
arm64: dts: amlogic: gx: assign the MMC signal clocks
ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
pstore/ram: fix buffer overflow in persistent_ram_save_old()
sched/rt: Skip currently executing CPU in rto_next_cpu()
mfd: wm8350-core: Use IRQF_ONESHOT
EDAC/altera: Remove IRQF_ONESHOT
hrtimer: Fix trace oddity
crypto: cavium - fix dma_free_coherent() size
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
md/raid10: fix any_working flag handling in raid10_sync_request
tpm: st33zp24: Fix missing cleanup on get_burstcount() error
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
gfs2: Add metapath_dibh helper
gfs2: Add wrapper for iomap_file_buffered_write
fs: add <linux/init_task.h> for 'init_fs'
hfsplus: return error when node already exists in hfs_bnode_create
auxdisplay: arm-charlcd: fix release_mem_region() size
RDMA/umad: Reject negative data_len in ib_umad_write
Change-Id: Ice1efa8b2faaaab14d1d1563e5aa6ae36549682b
[ Upstream commit 6ca56813f4a589f536adceb42882855d91fb1125 ]
Posix cpu timers requires an additional step beyond setting the rlimit.
Refactor the code so its clear when what code is setting the
limit and conditionally update the posix cpu timers when appropriate.
Fixes: baa73d9e47 ("posix-timers: Make them configurable")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[uli: backport to 4.19]
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Reviewed-by: Pavel Machek <pavel@nabladev.com>
[ Upstream commit 00b67657535dfea56e84d11492f5c0f61d0af297 ]
Deal with the potential that sock and sock-sk can be NULL during
socket setup or teardown. This could lead to an oops. The fix for NULL
pointer dereference in __unix_needs_revalidation shows this is at
least possible for af_unix sockets. While the fix for af_unix sockets
applies for newer mediation this is still the fall back path for older
af_unix mediation and other sockets, so ensure it is covered.
Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
According to the implementations of cred_label() and set_cred_label(),
we should use pointer to struct aa_label for lbs_cred instead of struct
aa_task_ctx, this patch fixes it.
Fixes: bbd3662a8348 ("Infrastructure management of the cred security blob")
Change-Id: Id7db45371a2f178de6b4d071c5a3a6d35d839ff0
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Commit 4ff09db1b79b ("bpf: net: Change sk_getsockopt() to take the
sockptr_t argument") made it possible to call sk_getsockopt()
with both user and kernel address space buffers through the use of
the sockptr_t type. Unfortunately at the time of conversion the
security_socket_getpeersec_stream() LSM hook was written to only
accept userspace buffers, and in a desire to avoid having to change
the LSM hook the commit author simply passed the sockptr_t's
userspace buffer pointer. Since the only sk_getsockopt() callers
at the time of conversion which used kernel sockptr_t buffers did
not allow SO_PEERSEC, and hence the
security_socket_getpeersec_stream() hook, this was acceptable but
also very fragile as future changes presented the possibility of
silently passing kernel space pointers to the LSM hook.
There are several ways to protect against this, including careful
code review of future commits, but since relying on code review to
catch bugs is a recipe for disaster and the upstream eBPF maintainer
is "strongly against defensive programming", this patch updates the
LSM hook, and all of the implementations to support sockptr_t and
safely handle both user and kernel space buffers.
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Change-Id: I413b02d059894f7846143bae7f78f9550f4dc983
Signed-off-by: Paul Moore <paul@paul-moore.com>
Convert the apparmorfs filesystem to the new internal mount API as the old
one will be obsoleted and removed. This allows greater flexibility in
communication of mount parameters between userspace, the VFS and the
filesystem.
See Documentation/filesystems/mount_api.txt for more information.
Change-Id: I364006cf7ead14d41f7385e6afb416fcb368671e
Signed-off-by: David Howells <dhowells@redhat.com>
cc: John Johansen <john.johansen@canonical.com>
cc: apparmor@lists.ubuntu.com
cc: linux-security-module@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Reserve a secid value that we can use as a wildcard, allowing us to
define policy that's expected to match against all secids.
Change-Id: I103f0970c94cfcb14678f648613568714b5b6ddf
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Add support for parsing secmark policy provided by userspace, and
store that in the overall policy.
Change-Id: I8cc6c232e685042ad517896b17610bbd9733f977
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Since current->cred == current->real_cred when ordered_lsm_init()
is called, and lsm_early_cred()/lsm_early_task() need to be called
between the amount of required bytes is determined and module specific
initialization function is called, we can move these calls from
individual modules to ordered_lsm_init().
Change-Id: I61b65ce4f4991aa0c9e437cd1febdd1eceaa3469
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Move management of the task_struct->security blob out
of the individual security modules and into the security
infrastructure. Instead of allocating the blobs from within
the modules the modules tell the infrastructure how much
space is required, and the space is allocated there.
The only user of this blob is AppArmor. The AppArmor use
is abstracted to avoid future conflict.
Change-Id: Ic315d4b73ad2e62ab53515f3e1c8085a0151596b
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Move management of the file->f_security blob out of the
individual security modules and into the infrastructure.
The modules no longer allocate or free the data, instead
they tell the infrastructure how much space they require.
Change-Id: I43c6b69dbc7745217c6e0a0283aae7fa1eca568c
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Move management of the cred security blob out of the
security modules and into the security infrastructre.
Instead of allocating and freeing space the security
modules tell the infrastructure how much space they
require.
Change-Id: I6c6093e9d15efb9c89ecb347d2931e662c0232bb
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Add support for dropping or accepting packets based on their secmark
tags.
Change-Id: Icbce3ee6f24f9566ebeca3632a840ddb9652a191
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Don't use the cred->security pointer directly.
Provide a helper function that provides the security blob pointer.
Change-Id: If3f4a508e221c26a099ecd3d18b9e57fc64ecd1e
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
In preparation for removing CONFIG_DEFAULT_SECURITY, this removes the
soon-to-be redundant SECURITY_APPARMOR_BOOTPARAM_VALUE. Since explicit
ordering via CONFIG_LSM or "lsm=" will define whether an LSM is enabled or
not, this CONFIG will become effectively ignored, so remove it. However,
in order to stay backward-compatible with "security=apparmor", the enable
variable defaults to true.
Change-Id: I8ae4213344272477578c359de6616b42e48f2897
Signed-off-by: Kees Cook <keescook@chromium.org>
In order to both support old "security=" Legacy Major LSM selection, and
handling real exclusivity, this creates LSM_FLAG_EXCLUSIVE and updates
the selection logic to handle them.
Change-Id: I859110fd530ae9dce3adbcaa22efb9f23c04b910
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
As a prerequisite to adjusting LSM selection logic in the future, this
moves the selection logic up out of the individual major LSMs, making
their init functions only run when actually enabled. This considers all
LSMs enabled by default unless they specified an external "enable"
variable.
Change-Id: If1f82111f1612ee1d43067c97f25664091b4a759
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
In preparation for lifting the "is this LSM enabled?" logic out of the
individual LSMs, pass in any special enabled state tracking (as needed
for SELinux, AppArmor, and LoadPin). This should be an "int" to include
handling any future cases where "enabled" is exposed via sysctl which
has no "bool" type.
Change-Id: I9b09ced67902875d1aebe9435b59672d1b882e41
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
This adds a flag for the current "major" LSMs to distinguish them when
we have a universal method for ordering all LSMs. It's called "legacy"
since the distinction of "major" will go away in the blob-sharing world.
Change-Id: Ie5636e4425bcbdad37da78ec7c045404f5b2ccda
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Historically a lot of these existed because we did not have
a distinction between what was modular code and what was providing
support to modules via EXPORT_SYMBOL and friends. That changed
when we forked out support for the latter into the export.h file.
This means we should be able to reduce the usage of module.h
in code that is obj-y Makefile or bool Kconfig.
The advantage in removing such instances is that module.h itself
sources about 15 other headers; adding significantly to what we feed
cpp, and it can obscure what headers we are effectively using.
Since module.h might have been the implicit source for init.h
(for __init) and for export.h (for EXPORT_SYMBOL) we consider each
instance for the presence of either and replace as needed.
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: David Howells <dhowells@redhat.com>
Cc: linux-security-module@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: keyrings@vger.kernel.org
Change-Id: I8eb855bb26ccd8b262845ecbe5f4020a8d3ed6f5
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
In preparation for making LSM selections outside of the LSMs, include
the name of LSMs in struct lsm_info.
Change-Id: I129da3575cd955862cd00e139ee04d94a79bd1b4
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Instead of using argument-based initializers, switch to defining the
contents of struct lsm_info on a per-LSM basis. This also drops
the final use of the now inaccurate "initcall" naming.
Change-Id: Ief67d348af36e2d33d4e9e72a3b328c1ec00af67
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: James Morris <james.morris@microsoft.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Instead of having all the sysctl handlers deal with user pointers, which
is rather hairy in terms of the BPF interaction, copy the input to and
from userspace in common code. This also means that the strings are
always NUL-terminated by the common code, making the API a little bit
safer.
As most handler just pass through the data to one of the common handlers
a lot of the changes are mechnical.
Change-Id: Ic71fd778e4cea58adc51d634d9e53c1f9f90cdf2
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ]
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then
passed to aa_splitn_fqname().
aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace.
Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later
aa_alloc_profile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:strlen+0x1e/0xa0
Call Trace:
<TASK>
? strlen+0x1e/0xa0
aa_policy_init+0x1bb/0x230
aa_alloc_profile+0xb1/0x480
unpack_profile+0x3bc/0x4960
aa_unpack+0x309/0x15e0
aa_replace_profiles+0x213/0x33c0
policy_update+0x261/0x370
profile_replace+0x20e/0x2a0
vfs_write+0x2af/0xe00
ksys_write+0x126/0x250
do_syscall_64+0x46/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
</TASK>
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aa_splitn_fqname() is expected and checked in
other places where it is called (e.g. aa_remove_profiles). Well, there
is an explicit comment "a ns name without a following profile is allowed"
inside.
AFAICS, nothing can prevent unpacked "name" to be in form like
":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with
EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 04dc715e24 ("apparmor: audit policy ns specified in policy load")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1b5a6198f5a9d0aa5497da0dc4bcd4fc166ee516 ]
The v8 abi is supported by the kernel but the userspace supported
version check does not allow for it. This was missed when v8 was added
due to a bug in the userspace compiler which was setting an older abi
version for v8 encoding (which is forward compatible except on the
network encoding). However it is possible to detect the network
encoding by checking the policydb network support which the code
does. The end result was that missing the abi flag worked until
userspace was fixed and began correctly checking for the v8 abi
version.
Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c73275cf6834787ca090317f1d20dbfa3b7f05aa ]
In multi_transaction_new(), the variable t is not freed or passed out
on the failure of copy_from_user(t->data, buf, size), which could lead
to a memleak.
Fix this bug by adding a put_multi_transaction(t) in the error path.
Fixes: 1dea3b41e8 ("apparmor: speed up transactional queries")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 417ea9fe972d2654a268ad66e89c8fcae67017c3 upstream.
When copy_from_user failed, the memory is freed by kvfree. however the
management struct and data blob are allocated independently, so only
kvfree(data) cause a memleak issue here. Use aa_put_loaddata(data) to
fix this issue.
Fixes: a6a52579e5 ("apparmor: split load data into management struct and data blob")
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 11c3627ec6b56c1525013f336f41b79a983b4d46 upstream.
The aa_pivotroot() function has a reference counting bug in a specific
path. When aa_replace_current_label() returns on success, the function
forgets to decrement the reference count of “target”, which is
increased earlier by build_pivotroot(), causing a reference leak.
Fix it by decreasing the refcount of “target” in that path.
Fixes: 2ea3ffb778 ("apparmor: add mount mediation")
Co-developed-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Co-developed-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2504db207146543736e877241f3b3de005cbe056 upstream.
When finding the profile via patterned attachments, the longest left
match is being set to the static compile time value and not using the
runtime computed value.
Fix this by setting the candidate value to the greater of the
precomputed value or runtime computed value.
Fixes: 21f6066105 ("apparmor: improve overlapping domain attachment resolution")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3e2a3a0830a2090e766d0d887d52c67de2a6f323 upstream.
Clang static analysis reports this issue
label.c:1802:3: warning: 2nd function call argument
is an uninitialized value
pr_info("%s", str);
^~~~~~~~~~~~~~~~~~
str is set from a successful call to aa_label_asxprint(&str, ...)
On failure a negative value is returned, not a -1. So change
the check.
Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ec240b5905bbb09a03dccffee03062cf39e38dc2 upstream.
When the mount check fails due to a permission check failure instead
of explicitly at one of the subcomponent checks, AppArmor is reporting
a failure in the flags match. However this is not true and AppArmor
can not attribute the error at this point to any particular component,
and should only indicate the mount failed due to missing permissions.
Fixes: 2ea3ffb778 ("apparmor: add mount mediation")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 511f7b5b835726e844a5fc7444c18e4b8672edfd upstream.
AppArmor is prefixing secids that are converted to secctx with the =
to indicate the secctx should only be parsed from an absolute root
POV. This allows catching errors where secctx are reparsed back into
internal labels.
Unfortunately because audit is using secid to secctx conversion this
means that subject and object labels can result in a very unfortunate
== that can break audit parsing.
eg. the subj==unconfined term in the below audit message
type=USER_LOGIN msg=audit(1639443365.233:160): pid=1633 uid=0 auid=1000
ses=3 subj==unconfined msg='op=login id=1000 exe="/usr/sbin/sshd"
hostname=192.168.122.1 addr=192.168.122.1 terminal=/dev/pts/1 res=success'
Fix this by switch the prepending of = to a _. This still works as a
special character to flag this case without breaking audit. Also move
this check behind debug as it should not be needed during normal
operqation.
Fixes: 26b7899510 ("apparmor: add support for absolute root view based labels")
Reported-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 68ff8540cc9e4ab557065b3f635c1ff4c96e1f1c upstream.
Global quieting of denied AppArmor generated file events is not
handled correctly. Unfortunately the is checking if quieting of all
audit events is set instead of just denied events.
Fixes: 67012e8209 ("AppArmor: basic auditing infrastructure.")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit d108370c644b153382632b3e5511ade575c91c86 ]
clang static analysis reports this representative problem:
label.c:1463:16: warning: Assigned value is garbage or undefined
label->hname = name;
^ ~~~~
In aa_update_label_name(), this the problem block of code
if (aa_label_acntsxprint(&name, ...) == -1)
return res;
On failure, aa_label_acntsxprint() has a more complicated return
that just -1. So check for a negative return.
It was also noted that the aa_label_acntsxprint() main comment refers
to a nonexistent parameter, so clean up the comment.
Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream.
Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.
Fixes: d901d6a298 ("apparmor: dfa split verification of table headers")
Reported-by: Mike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
