[PATCH 0/3] crypto: af_alg_restrict cleanups

[PATCH 0/3] crypto: af_alg_restrict cleanups

[Eric Biggers]

- Make cbc(paes) privileged-only for now, as previously discussed
- Make it more explicit when unprivileged use is allowed
- Avoid some redundant work during allowlist checking

Eric Biggers (3):
  crypto: af_alg - Make cbc(paes) privileged-only
  crypto: af_alg - Replace 'bool privileged' with flags
  crypto: af_alg - Stop after finding name in allowlist

 crypto/af_alg.c         | 10 +++++++---
 crypto/algif_aead.c     |  2 +-
 crypto/algif_hash.c     | 28 ++++++++++++++--------------
 crypto/algif_skcipher.c | 28 ++++++++++++++--------------
 include/crypto/if_alg.h |  6 +++++-
 5 files changed, 41 insertions(+), 33 deletions(-)


base-commit: 947d62c094367ef6064907d570b47612cd579df6
-- 
2.55.0

[PATCH 1/3] crypto: af_alg - Make cbc(paes) privileged-only

[Eric Biggers]

So far the only reported use cases for cbc(paes) have involved processes
running as root.  Therefore, make af_alg_restrict=1 allow only
privileged use of this algorithm for now.

Fixes: 947d62c09436 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/algif_skcipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 4c86b1993bde..68b48d805e92 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -41,7 +41,7 @@ static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
 	{ "cbc(aes)", true }, /* iwd */
 	{ "cbc(des)", true }, /* iwd */
 	{ "cbc(des3_ede)", true }, /* iwd */
-	{ "cbc(paes)", false }, /* caam and others */
+	{ "cbc(paes)", true }, /* caam and others */
 	{ "ctr(aes)", true }, /* iwd */
 	{ "ecb(aes)", true }, /* iwd, bluez */
 	{ "ecb(des)", true }, /* iwd */
-- 
2.55.0

Re: [PATCH 1/3] crypto: af_alg - Make cbc(paes) privileged-only

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Von: "Eric Biggers" <ebiggers@kernel.org>
> An: "Linux Crypto Mailing List" <linux-crypto@vger.kernel.org>, "Herbert Xu" <herbert@gondor.apana.org.au>
> CC: "richard" <richard@nod.at>, "linux-kernel" <linux-kernel@vger.kernel.org>, "Eric Biggers" <ebiggers@kernel.org>
> Gesendet: Montag, 3. August 2026 01:00:53
> Betreff: [PATCH 1/3] crypto: af_alg - Make cbc(paes) privileged-only

> So far the only reported use cases for cbc(paes) have involved processes
> running as root.  Therefore, make af_alg_restrict=1 allow only
> privileged use of this algorithm for now.
> 
> Fixes: 947d62c09436 ("Merge
> git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6")
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Good catch, my intention was making it privileged only. :-S

Reviewed-by: Richard Weinberger <richard@nod.at>

Thanks,
//richard

[PATCH 2/3] crypto: af_alg - Replace 'bool privileged' with flags

[Eric Biggers]

It isn't obvious what false/true mean at the definition sites, so let's
replace it with flags instead.  Also flip the polarity to make the
default zero-initialized value be the secure (privileged-only) value.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/af_alg.c         |  3 ++-
 crypto/algif_aead.c     |  2 +-
 crypto/algif_hash.c     | 28 ++++++++++++++--------------
 crypto/algif_skcipher.c | 28 ++++++++++++++--------------
 include/crypto/if_alg.h |  6 +++++-
 5 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 34b801568fba..1e5da61b315c 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -146,7 +146,8 @@ int af_alg_check_restriction(const char *name,
 		for (const struct af_alg_allowlist_entry *ent = allowlist;
 		     ent->name; ent++) {
 			if (strcmp(name, ent->name) == 0 &&
-			    (!ent->privileged || af_alg_capable()))
+			    ((ent->flags & AF_ALG_UNPRIVILEGED) ||
+			     af_alg_capable()))
 				return 0;
 		}
 	}
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index b9217f9086aa..5574e2d70539 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -35,7 +35,7 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry aead_allowlist[] = {
-	{ "ccm(aes)", true }, /* bluez */
+	{ "ccm(aes)" }, /* bluez */
 	{},
 };
 
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index a8d958d51ece..6e8b5fb82a7f 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -17,20 +17,20 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry hash_allowlist[] = {
-	{ "cmac(aes)", true }, /* iwd, bluez */
-	{ "hmac(md5)", true }, /* iwd */
-	{ "hmac(sha1)", true }, /* iwd */
-	{ "hmac(sha224)", true }, /* iwd */
-	{ "hmac(sha256)", true }, /* iwd */
-	{ "hmac(sha384)", true }, /* iwd */
-	{ "hmac(sha512)", true }, /* iwd, sha512hmac */
-	{ "md4", true }, /* iwd */
-	{ "md5", true }, /* iwd */
-	{ "sha1", false }, /* iwd, iproute2 < 7.0 */
-	{ "sha224", true }, /* iwd */
-	{ "sha256", true }, /* iwd */
-	{ "sha384", true }, /* iwd */
-	{ "sha512", true }, /* iwd */
+	{ "cmac(aes)" }, /* iwd, bluez */
+	{ "hmac(md5)" }, /* iwd */
+	{ "hmac(sha1)" }, /* iwd */
+	{ "hmac(sha224)" }, /* iwd */
+	{ "hmac(sha256)" }, /* iwd */
+	{ "hmac(sha384)" }, /* iwd */
+	{ "hmac(sha512)" }, /* iwd, sha512hmac */
+	{ "md4" }, /* iwd */
+	{ "md5" }, /* iwd */
+	{ "sha1", AF_ALG_UNPRIVILEGED }, /* iwd, iproute2 < 7.0 */
+	{ "sha224" }, /* iwd */
+	{ "sha256" }, /* iwd */
+	{ "sha384" }, /* iwd */
+	{ "sha512" }, /* iwd */
 	{},
 };
 
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 68b48d805e92..1e61fe6e24b9 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -36,20 +36,20 @@
 #include <net/sock.h>
 
 static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
-	{ "adiantum(xchacha12,aes)", false }, /* cryptsetup */
-	{ "adiantum(xchacha20,aes)", false }, /* cryptsetup */
-	{ "cbc(aes)", true }, /* iwd */
-	{ "cbc(des)", true }, /* iwd */
-	{ "cbc(des3_ede)", true }, /* iwd */
-	{ "cbc(paes)", true }, /* caam and others */
-	{ "ctr(aes)", true }, /* iwd */
-	{ "ecb(aes)", true }, /* iwd, bluez */
-	{ "ecb(des)", true }, /* iwd */
-	{ "hctr2(aes)", false }, /* cryptsetup */
-	{ "xts(aes)", false }, /* cryptsetup benchmark */
-	{ "xts(camellia)", false }, /* cryptsetup */
-	{ "xts(serpent)", false }, /* cryptsetup */
-	{ "xts(twofish)", false }, /* cryptsetup */
+	{ "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "cbc(aes)" }, /* iwd */
+	{ "cbc(des)" }, /* iwd */
+	{ "cbc(des3_ede)" }, /* iwd */
+	{ "cbc(paes)" }, /* caam and others */
+	{ "ctr(aes)" }, /* iwd */
+	{ "ecb(aes)" }, /* iwd, bluez */
+	{ "ecb(des)" }, /* iwd */
+	{ "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */
+	{ "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
+	{ "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */
 	{},
 };
 
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index dbf6a97c72a2..0d51428c1da4 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -8,6 +8,7 @@
 #ifndef _CRYPTO_IF_ALG_H
 #define _CRYPTO_IF_ALG_H
 
+#include <linux/bits.h>
 #include <linux/compiler.h>
 #include <linux/completion.h>
 #include <linux/if_alg.h>
@@ -161,9 +162,12 @@ struct af_alg_ctx {
 	unsigned int inflight;
 };
 
+/* Flags for af_alg_allowlist_entry::flags: */
+#define AF_ALG_UNPRIVILEGED BIT(0) /* Unprivileged use is allowed */
+
 struct af_alg_allowlist_entry {
 	const char *name;
-	bool privileged;
+	u32 flags;
 };
 
 int af_alg_register_type(const struct af_alg_type *type);
-- 
2.55.0

[PATCH 3/3] crypto: af_alg - Stop after finding name in allowlist

[Eric Biggers]

If the algorithm name is found in the allowlist and the privilege check
doesn't pass, there's no need to consider remaining entries since the
list contains (and is intended to contain) at most one entry per name.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/af_alg.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 1e5da61b315c..ab84c4488a15 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -145,10 +145,13 @@ int af_alg_check_restriction(const char *name,
 	if (level == 1) {
 		for (const struct af_alg_allowlist_entry *ent = allowlist;
 		     ent->name; ent++) {
-			if (strcmp(name, ent->name) == 0 &&
-			    ((ent->flags & AF_ALG_UNPRIVILEGED) ||
-			     af_alg_capable()))
-				return 0;
+			if (strcmp(name, ent->name) == 0) {
+				if ((ent->flags & AF_ALG_UNPRIVILEGED) ||
+				    af_alg_capable())
+					return 0;
+				/* List contains at most one entry per name. */
+				break;
+			}
 		}
 	}
 	/*
-- 
2.55.0