[SRU][N][PATCH 0/2] Backport some AppArmor complain-mode profile bugfixes from Oracular to Noble

[Stefan Bader]

On 01.11.24 12:05, Ryan Lee wrote:
> BugLink: https://bugs.launchpad.net/bugs/2086210
> 
> SRU Justification:
> 
> [Impact]
> 
> Backporting two AppArmor bugfixes (2de989ae726b "apparmor: allocate xmatch for nullpdf inside aa_alloc_null" and 62bd5d5f2149 "apparmor: properly handle cx/px lookup failure for complain") from the Ubuntu Oracular kernel will fix incorrect behavior that occurs with the usage of some complain mode profiles (a kernel oops and an actual denial occurring in complain mode, respectively).
> 
> [Fix]
> 
> Apply the two patches 2de989ae726b and 62bd5d5f2149 from the Ubuntu Oracular kernel, previously applied to the Oracular kernel via LP #2028253 as #94/99 and #95/99 in the series.
> 
> [Test case]
> 
> Patch 62bd5d5f2149 can be tested by loading the following profile into the kernel:
> 
> abi <abi/4.0>,
> include <tunables/global>
> 
> profile ls_child flags=(complain) {
>    include <abstractions/base>
> 
>    /dev/tty rw,
>    /usr/bin/ls cxr,
> }
> 
> and exercising the profile's nonexistent transition with `aa-exec -p ls_child sh -c ls`. With the patch applied, the ls command will succeed instead of failing.
> 
> Patch 2de989ae726b is much harder to test, unfortunately. The reproducer I have is (deterministically) finicky but goes through a Docker indirection layer, although at least one other person has encountered the same kernel oops without using Docker. I have attached the files needed to construct a reproducer to the LP bug report.
> 
> With the patch applied, the run_reproducer.sh script will succeed instead of generating a kernel oops.
> 
> [Regression potential]
> 
> This patch set fixes bugs in the handling of complain mode profiles, and are both very small. A bug caused by patch 2de989ae726b would cause, at most, a memory leak by preventing deallocation of a reference-counted profile object. A bug introduced by patch 62bd5d5f2149 would show up in the handling of complain mode profiles and would not affect enforcement of enforce mode profiles.
> 
> [Other Info]
> 
> This patchset backports some patches from https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2028253 which were applied to Oracular but not to Noble.
> 
> Ryan Lee (2):
>    UBUNTU: SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for
>      nullpdf inside aa_alloc_null
>    UBUNTU: SAUCE: apparmor4.0.0 [95/99]: apparmor: properly handle cx/px
>      lookup failure for complain
> 
>   security/apparmor/domain.c | 9 +++++++--
>   security/apparmor/policy.c | 1 +
>   2 files changed, 8 insertions(+), 2 deletions(-)
> 

Where do those patches come from (from the oracular tree)? Assuming the 
"apparmor4.0.0 [94/99]:" is also part of the commit message there, I 
would at least update the cherry pick line by saying "<sha1> 
oracular:linux". This helps to clarify the origins.

-- 
- Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20241106/cdbbd9fd/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20241106/cdbbd9fd/attachment-0001.sig>