mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-10 22:50:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled

Browse Source 
commit
17b5758bf3 ("apparmor: Initial support for compressed policies")

added the ability for apparmor to load compressed policy, unfortunately
it did not add a config option or select CONFIG_ZSTD_DECOMPRESS
which it depends on, leading to the following build failure

apparmorfs.c makes calls into zstd_*() even when
CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is not set, causing
build errors:

/usr/bin/ld.bfd: security/apparmor/apparmorfs.o: in function `policy_update':
apparmorfs.c:(.text+0x1307): undefined reference to `zstd_get_frame_header'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1359): undefined reference to `zstd_dctx_workspace_bound'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x13f7): undefined reference to `zstd_init_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x140c): undefined reference to `zstd_decompress_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1411): undefined reference to `zstd_is_error'

Add a new config option to enable compress policy loading as using
the existing CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is in appropriate
as that is about retaining loaded policy so that it can be introspected
at a later date.

Fixes: 17b5758bf3 ("apparmor: Initial support for compressed policies")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2026-07-30 02:30:58 -07:00
parent 9e4c1ef73b
commit 1c5f27e845
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
security/apparmor/Kconfig
View File

@@ -93,6 +93,18 @@ config SECURITY_APPARMOR_EXPORT_BINARY
also increases policy load time. This option is required for
checkpoint and restore support, and debugging of loaded policy.
config SECURITY_APPARMOR_COMPRESSED_POLICY
bool "Allow loading policy in a compressed format"
depends on SECURITY_APPARMOR
select ZSTD_DECOMPRESS
default y
help
This option allows loading policy from userspace in a
compressed format. This allows for userspace to not have to
decrompress caches before loading policy, and also allows
for less kernel memory to be used when "exporting the raw
binary policy" is enabled.
config SECURITY_APPARMOR_PARANOID_LOAD
bool "Perform full verification of loaded policy"
depends on SECURITY_APPARMOR

15
security/apparmor/apparmorfs.c
View File

@@ -484,6 +484,7 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
return data;
}
#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen)
{
if (slen < dlen) {
@@ -581,7 +582,15 @@ static struct aa_loaddata *aa_get_data_from_compressed(const char __user *userbu
return ERR_PTR(error);
}
#else
static struct aa_loaddata *aa_get_data_from_compressed(const char __user *userbuf __always_unused,
size_t buffer_size __always_unused,
loff_t *pos __always_unused,
char **compressed_data __always_unused)
{
return ERR_PTR(-EINVAL);
}
#endif /* CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY */
struct aa_user_hdr {
uint8_t version;
uint8_t compress_level;
@@ -2604,8 +2613,10 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = {
AA_SFS_FILE_STRING("permstable32", PERMS32STR),
AA_SFS_FILE_U64("state32", 1),
AA_SFS_DIR("unconfined_restrictions", aa_sfs_entry_unconfined),
#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
AA_SFS_FILE_BOOLEAN("compressed_load", 1),
AA_SFS_FILE_BOOLEAN("extended_policy_header", 1),
#endif
{ }
};
@@ -2670,8 +2681,10 @@ static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
AA_SFS_FILE_FOPS("raw_data_compression_level_min", 0444, &seq_ns_compress_min_fops),
AA_SFS_FILE_FOPS("raw_data_compression_level_max", 0444, &seq_ns_compress_max_fops),
#endif
AA_SFS_DIR("features", aa_sfs_entry_features),
{ }
};