From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 718DA306768 for ; Mon, 8 Jun 2026 06:36:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780900601; cv=none; b=bIA6ceyhmK+0b1ARIlkVXeuU8SOwa0ud4S9iPEBPiRu+k3CuOKzQtNKyzndiV+wQmQYP263HCkBgEMF4NL0kgYAGkUlPfgLFfzOnIckBlQsczoUnrHGDXWwH0mrD5lFbcby0JAgBJ0hp0waSSkzHlZeieLc6AC1oqZfmhAmaZkw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780900601; c=relaxed/simple; bh=85GIeYlRtIVw5fo/uWEqa/Od5gLR3z/2GhTv8spsaU4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=K/0phe9RUDnJbRYBlkp2ItojG1vsbMemn83C83OLNV7AzYEeDrtVz0JL5DsPXsz/E5GxPOaqeLOH+3iWEvwH2DmFPla7+vFF4Jw6aF7+JOWIuXfrXlPA6kW8VS8BdrYttdvfBJNOnBG/h6DbDz/shctBlQm3Q67j+bfexCvbGKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=R28fsS5Q; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="R28fsS5Q" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2c27fc587ebso1296085ad.0 for ; Sun, 07 Jun 2026 23:36:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780900598; x=1781505398; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=XJdK+wFJTLh6vJvwVPBKkL/MaKsEcyHpUO9XLN9CTgM=; b=R28fsS5QtZc/mbhGx7l+RxrGHCvmYjMTVaAS82DxsXmJtJ3HBpD5hCw2azDGHemBkY jv3csLanNOAD+zlBwmEvD0bmF9fJEJUDi1tJish2nJ2stztrZxbbhKLRYX7ZXsy+8XQD Pqke3SRwNLiPNZ4i8ljD9LdiXrQZnjbCgkE0fs6ceuyJiwJN6T5rb7CGeYxfxxudjs64 trVsd3+NjuNd2rRmtT0ePMGAM/JyAtECrtbbRQ5r8kaLyAGYBk6aEUe/wKnjhqsLkexB S6dIBdWJ52O5yYpRp79mtgeCWSZuQi1MkWciwqQk6flUfseOoFGck8LdSEXK9vnOJD31 Z+fA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780900598; x=1781505398; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=XJdK+wFJTLh6vJvwVPBKkL/MaKsEcyHpUO9XLN9CTgM=; b=J+Wh2yDfNK0yG+mBka6LfK4YsRidmsfJkJTO8TAb+newv67dxApTszbXyFHKZuu5Zr j33GDnhTKRJ5FLjmZ9fX8DlCYZOTMFLwqIAD2Iz6rJdQONY6WyqO51ttR+61BxFeOQ0y POtWQ1sc74IM7OIxRUPTZeS2hEaflQwZbWvS+9J6oHNPZgzg6sEZNF0ke+Fyrj5frQ2e YAxWAjk2yPTKQyFwAUQO+oQL49E24ZnrVMOwO3fhhD6a/U83gI2ceZdjJsBBPahYOLg5 lf7dhwTPrs7UcEnJEcXWXpOUmMRrJHUcIBQTjK+Apj2ubgb3fAf/KWBbL5b7ptqpxRXn Bb+A== X-Forwarded-Encrypted: i=1; AFNElJ9LPkyCnzKfjzAlf38v6EQWgg4xs2fRfNnAbgP13njdweambxcYopvffZlLbf04m2YolwUkXoMbb44+Zbk=@vger.kernel.org X-Gm-Message-State: AOJu0Yy1+AEC1DVIHsKu/9zeTNRDmjtNpaAZ7RODQeOYGHzIhD5eUyKr lN9Grbx0pQ/P628drmfmb5d27dtCqJpheZ2mo6PbE+HQeCxwyCcUgeizWy2TLoPKb10= X-Gm-Gg: Acq92OERwo+g7iSSPZC+zXiC6/cUswoimBGSb6OTl+K5FO4Y0JZQxrWlYvJmDiVrUqR 1cSJ8Ett8Cc+epadrv+zyi9HESBh8BAuKbn+6SzsGKRll2HH7IHGI7ktyEXtJcsL2kjiCWJ3vrH 6d5S5rgAYx78DCA7CpQ6ND3QBm4ZSXKF96VOg0B2JUfcHnvuozJbgtyz1U6zBDWDi8khZXABCUi uGO6emgCUiZhZi1h4L5zF2x0diSaUDGgSz3fXVfGkqXPmA6EEXmV7Ui7NMESaFsCPYT1zsiTqeR sht8KYADk1Zt3ulaRH6In+wBUe84LOCf4Qk8R5huj6x21elsFHxyp6M0RS3vBXsgAcCGagGjqpk Xw5MW2c3d0U0YMhNHRja2xEvO8k/PKPtZleFJUJ7VWcQ1NxZNrG+MqmXAvUC7XaKs39CnonVn3X bU4ZxoDuD04Nf1PdxywSmJg7+HOFJFQ51elOCCakYjowsHNKxa374d X-Received: by 2002:a17:902:cf11:b0:2c1:ea95:8297 with SMTP id d9443c01a7336-2c1ea958447mr162487235ad.7.1780900597708; Sun, 07 Jun 2026 23:36:37 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:9a2:954d:67fe:d9c2]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16629d55esm171037655ad.63.2026.06.07.23.36.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Jun 2026 23:36:37 -0700 (PDT) From: Ruoyu Wang To: John Johansen Cc: Paul Moore , James Morris , "Serge E . Hallyn" , apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] apparmor: check label build before no_new_privs test Date: Mon, 8 Jun 2026 14:36:31 +0800 Message-ID: <20260608063631.9-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL or an ERR_PTR, but the result was passed to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL() check. Reuse the existing target-label build failure handling immediately after the build. This preserves the current audit handling while preventing the subset helper from dereferencing an invalid label. Signed-off-by: Ruoyu Wang --- security/apparmor/domain.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index f02bf770f6385..6748ac74b060b 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -1527,6 +1527,8 @@ int aa_change_profile(const char *fqname, int flags) new = fn_label_build_in_scope(label, profile, GFP_KERNEL, aa_get_label(target), aa_get_label(&profile->label)); + if (IS_ERR_OR_NULL(new)) + goto build_fail; /* * no new privs prevents domain transitions that would * reduce restrictions. @@ -1545,16 +1547,8 @@ int aa_change_profile(const char *fqname, int flags) /* only transition profiles in the current ns */ if (stack) new = aa_label_merge(label, target, GFP_KERNEL); - if (IS_ERR_OR_NULL(new)) { - info = "failed to build target label"; - if (!new) - error = -ENOMEM; - else - error = PTR_ERR(new); - new = NULL; - perms.allow = 0; - goto audit; - } + if (IS_ERR_OR_NULL(new)) + goto build_fail; error = aa_replace_current_label(new); } else { if (new) { @@ -1566,6 +1560,17 @@ int aa_change_profile(const char *fqname, int flags) aa_set_current_onexec(target, stack); } + goto audit; + +build_fail: + info = "failed to build target label"; + if (!new) + error = -ENOMEM; + else + error = PTR_ERR(new); + new = NULL; + perms.allow = 0; + audit: error = fn_for_each_in_scope(label, profile, aa_audit_file(subj_cred, -- 2.51.0