From 4e4748c09d6e133782455e3a3534866f8c008373 Mon Sep 17 00:00:00 2001 From: Georgia Garcia Date: Tue, 28 May 2024 20:40:11 +0800 Subject: [PATCH 1/3] apparmor: fix invalid reference on profile->disconnected mainline inclusion from mainline-v6.7-rc1 commit 8884ba07786c718771cf7b78cb3024924b27ec2b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9SY02 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8884ba07786c718771cf7b78cb3024924b27ec2b -------------------------------- profile->disconnected was storing an invalid reference to the disconnected path. Fix it by duplicating the string using aa_unpack_strdup and freeing accordingly. Fixes: 72c8a768641d ("apparmor: allow profiles to provide info to disconnected paths") Signed-off-by: Georgia Garcia Signed-off-by: John Johansen Conflicts: security/apparmor/policy_unpack.c security/apparmor/policy.c [Because b11e51dd7 not merged, so change aa_unpack_str_dup to unpack_str_dup, it just has been renamed] Signed-off-by: Felix Fu --- security/apparmor/policy.c | 1 + security/apparmor/policy_unpack.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 3a4293c46ad5..bc377284945c 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -224,6 +224,7 @@ void aa_free_profile(struct aa_profile *profile) aa_put_ns(profile->ns); kzfree(profile->rename); + kzfree(profile->disconnected); aa_free_file_rules(&profile->file); aa_free_cap_rules(&profile->caps); aa_free_rlimit_rules(&profile->rlimits); diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 36bf9534acf0..6013972f9fa4 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -617,7 +617,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) const char *info = "failed to unpack profile"; size_t ns_len; struct rhashtable_params params = { 0 }; - char *key = NULL; + char *key = NULL, *disconnected = NULL; struct aa_data *data; int i, error = -EPROTO; kernel_cap_t tmpcap; @@ -675,7 +675,8 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) } /* disconnected attachment string is optional */ - (void) unpack_str(e, &profile->disconnected, "disconnected"); + (void) unpack_strdup(e, &disconnected, "disconnected"); + profile->disconnected = disconnected; /* per profile debug flags (complain, audit) */ if (!unpack_nameX(e, AA_STRUCT, "flags")) { -- Gitee From fbf88333665596a832c6faa82f428fbefba1fc33 Mon Sep 17 00:00:00 2001 From: Xiu Jianfeng Date: Tue, 28 May 2024 20:40:12 +0800 Subject: [PATCH 2/3] audit: correct audit_filter_inodes() definition mainline inclusion from mainline-v6.6-rc1 commit bf98354280bff22bc9e57c698d485c9e1c0b04f3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9SY02 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bf98354280bff22bc9e57c698d485c9e1c0b04f3 -------------------------------- After changes in commit 0590b9335a1c ("fixing audit rule ordering mess, part 1"), audit_filter_inodes() returns void, so if CONFIG_AUDITSYSCALL not defined, it should be do {} while(0). Signed-off-by: Xiu Jianfeng Signed-off-by: Paul Moore Conflicts: kernel/audit.h [Fix context conflicts] Signed-off-by: Felix Fu --- kernel/audit.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/audit.h b/kernel/audit.h index 99badd7ba56f..400e2a0896e3 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -338,7 +338,7 @@ extern void audit_filter_inodes(struct task_struct *tsk, struct audit_context *c extern struct list_head *audit_killed_trees(void); #else #define audit_signal_info(s,t) AUDIT_DISABLED -#define audit_filter_inodes(t,c) AUDIT_DISABLED +#define audit_filter_inodes(t, c) do { } while (0) #endif extern void audit_ctl_lock(void); -- Gitee From 97777f7553754c78394d232dfc23f47a381716b1 Mon Sep 17 00:00:00 2001 From: Eric Snowberg Date: Tue, 28 May 2024 20:40:13 +0800 Subject: [PATCH 3/3] KEYS: Create static version of public_key_verify_signature mainline inclusion from mainline-v6.4-rc1 commit 7f8da9915fcc6386edf86471bf31e162845930a4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9SY02 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7f8da9915fcc6386edf86471bf31e162845930a4 -------------------------------- The kernel test robot reports undefined reference to public_key_verify_signature when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined. Create a static version in this case and return -EINVAL. Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Petr Vorel Reviewed-by: Jarkko Sakkinen gested-by: Mimi Zohar Signed-off-by: Jarkko Sakkinen Signed-off-by: Felix Fu --- include/crypto/public_key.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 052e26fda2e6..074e4589909d 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -68,7 +68,16 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, extern int verify_signature(const struct key *key, const struct public_key_signature *sig); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) int public_key_verify_signature(const struct public_key *pkey, const struct public_key_signature *sig); +#else +static inline +int public_key_verify_signature(const struct public_key *pkey, + const struct public_key_signature *sig) +{ + return -EINVAL; +} +#endif #endif /* _LINUX_PUBLIC_KEY_H */ -- Gitee