* [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
@ 2026-07-17 21:52 Paul Moore
2026-07-17 21:54 ` Paul Moore
2026-07-21 1:41 ` John Johansen
0 siblings, 2 replies; 6+ messages in thread
From: Paul Moore @ 2026-07-17 21:52 UTC (permalink / raw)
To: linux-security-module; +Cc: John Johansen
Make use of the audit_log_n_untrustedstring() function to simplify the
code in aa_label_xaudit().
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/apparmor/label.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 3fd384d8c41a..a165cadf8249 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
str = (char *) label->hname;
len = strlen(str);
}
- if (audit_string_contains_control(str, len))
- audit_log_n_hex(ab, str, len);
- else
- audit_log_n_string(ab, str, len);
+ audit_log_n_untrustedstring(ab, str, len);
kfree(name);
}
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
2026-07-17 21:52 [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible Paul Moore
@ 2026-07-17 21:54 ` Paul Moore
2026-07-17 21:57 ` Paul Moore
2026-07-21 1:41 ` John Johansen
1 sibling, 1 reply; 6+ messages in thread
From: Paul Moore @ 2026-07-17 21:54 UTC (permalink / raw)
To: linux-security-module; +Cc: John Johansen
On Fri, Jul 17, 2026 at 5:52 PM Paul Moore <paul@paul-moore.com> wrote:
>
> Make use of the audit_log_n_untrustedstring() function to simplify the
> code in aa_label_xaudit().
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
> security/apparmor/label.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
Untested beyond a basic compile, but I noticed this while looking at
something else (unrelated) and wanted to send it to the list before I
forgot about it ...
> diff --git a/security/apparmor/label.c b/security/apparmor/label.c
> index 3fd384d8c41a..a165cadf8249 100644
> --- a/security/apparmor/label.c
> +++ b/security/apparmor/label.c
> @@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
> str = (char *) label->hname;
> len = strlen(str);
> }
> - if (audit_string_contains_control(str, len))
> - audit_log_n_hex(ab, str, len);
> - else
> - audit_log_n_string(ab, str, len);
> + audit_log_n_untrustedstring(ab, str, len);
>
> kfree(name);
> }
> --
> 2.55.0
--
paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
2026-07-17 21:54 ` Paul Moore
@ 2026-07-17 21:57 ` Paul Moore
2026-07-17 23:52 ` Ryan Lee
0 siblings, 1 reply; 6+ messages in thread
From: Paul Moore @ 2026-07-17 21:57 UTC (permalink / raw)
To: Georgia Garcia; +Cc: John Johansen, linux-security-module
On Fri, Jul 17, 2026 at 5:54 PM Paul Moore <paul@paul-moore.com> wrote:
> On Fri, Jul 17, 2026 at 5:52 PM Paul Moore <paul@paul-moore.com> wrote:
> >
> > Make use of the audit_log_n_untrustedstring() function to simplify the
> > code in aa_label_xaudit().
> >
> > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > ---
> > security/apparmor/label.c | 5 +----
> > 1 file changed, 1 insertion(+), 4 deletions(-)
>
> Untested beyond a basic compile, but I noticed this while looking at
> something else (unrelated) and wanted to send it to the list before I
> forgot about it ...
My apologies Georgia, I thought I had copied your email into the
original posting but it appears I copied John's email twice into my
posting script (which helpfully de-duped it).
Sorry about that.
> > diff --git a/security/apparmor/label.c b/security/apparmor/label.c
> > index 3fd384d8c41a..a165cadf8249 100644
> > --- a/security/apparmor/label.c
> > +++ b/security/apparmor/label.c
> > @@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
> > str = (char *) label->hname;
> > len = strlen(str);
> > }
> > - if (audit_string_contains_control(str, len))
> > - audit_log_n_hex(ab, str, len);
> > - else
> > - audit_log_n_string(ab, str, len);
> > + audit_log_n_untrustedstring(ab, str, len);
> >
> > kfree(name);
> > }
> > --
> > 2.55.0
--
paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
2026-07-17 21:57 ` Paul Moore
@ 2026-07-17 23:52 ` Ryan Lee
0 siblings, 0 replies; 6+ messages in thread
From: Ryan Lee @ 2026-07-17 23:52 UTC (permalink / raw)
To: Paul Moore; +Cc: Georgia Garcia, John Johansen, linux-security-module, apparmor
On Fri, Jul 17, 2026 at 2:58 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Fri, Jul 17, 2026 at 5:54 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Fri, Jul 17, 2026 at 5:52 PM Paul Moore <paul@paul-moore.com> wrote:
> > >
> > > Make use of the audit_log_n_untrustedstring() function to simplify the
> > > code in aa_label_xaudit().
> > >
> > > Signed-off-by: Paul Moore <paul@paul-moore.com>
> > > ---
> > > security/apparmor/label.c | 5 +----
> > > 1 file changed, 1 insertion(+), 4 deletions(-)
> >
> > Untested beyond a basic compile, but I noticed this while looking at
> > something else (unrelated) and wanted to send it to the list before I
> > forgot about it ...
>
> My apologies Georgia, I thought I had copied your email into the
> original posting but it appears I copied John's email twice into my
> posting script (which helpfully de-duped it).
>
> Sorry about that.
>
> > > diff --git a/security/apparmor/label.c b/security/apparmor/label.c
> > > index 3fd384d8c41a..a165cadf8249 100644
> > > --- a/security/apparmor/label.c
> > > +++ b/security/apparmor/label.c
> > > @@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
> > > str = (char *) label->hname;
> > > len = strlen(str);
> > > }
> > > - if (audit_string_contains_control(str, len))
> > > - audit_log_n_hex(ab, str, len);
> > > - else
> > > - audit_log_n_string(ab, str, len);
> > > + audit_log_n_untrustedstring(ab, str, len);
> > >
> > > kfree(name);
> > > }
> > > --
> > > 2.55.0
>
> --
> paul-moore.com
>
Reviewed-By: Ryan Lee <ryan.lee@canonical.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
2026-07-17 21:52 [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible Paul Moore
2026-07-17 21:54 ` Paul Moore
@ 2026-07-21 1:41 ` John Johansen
2026-07-21 1:53 ` Paul Moore
1 sibling, 1 reply; 6+ messages in thread
From: John Johansen @ 2026-07-21 1:41 UTC (permalink / raw)
To: Paul Moore, linux-security-module
On 7/17/26 14:52, Paul Moore wrote:
> Make use of the audit_log_n_untrustedstring() function to simplify the
> code in aa_label_xaudit().
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: John Johansen <john.johansen@canonical.com>
unless you object I will pull this into the apparmor tree
> ---
> security/apparmor/label.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/security/apparmor/label.c b/security/apparmor/label.c
> index 3fd384d8c41a..a165cadf8249 100644
> --- a/security/apparmor/label.c
> +++ b/security/apparmor/label.c
> @@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
> str = (char *) label->hname;
> len = strlen(str);
> }
> - if (audit_string_contains_control(str, len))
> - audit_log_n_hex(ab, str, len);
> - else
> - audit_log_n_string(ab, str, len);
> + audit_log_n_untrustedstring(ab, str, len);
>
> kfree(name);
> }
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
2026-07-21 1:41 ` John Johansen
@ 2026-07-21 1:53 ` Paul Moore
0 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2026-07-21 1:53 UTC (permalink / raw)
To: John Johansen, linux-security-module
On July 20, 2026 9:41:05 PM John Johansen <john.johansen@canonical.com> wrote:
> On 7/17/26 14:52, Paul Moore wrote:
>> Make use of the audit_log_n_untrustedstring() function to simplify the
>> code in aa_label_xaudit().
>>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>
> Acked-by: John Johansen <john.johansen@canonical.com>
>
> unless you object I will pull this into the apparmor tree
Please do, that code is up to you and Georgia, not me.
Thanks.
>
>>
--
paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-07-21 1:53 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-17 21:52 [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible Paul Moore
2026-07-17 21:54 ` Paul Moore
2026-07-17 21:57 ` Paul Moore
2026-07-17 23:52 ` Ryan Lee
2026-07-21 1:41 ` John Johansen
2026-07-21 1:53 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox