linux-kernel - Re: [PATCH RESEND] apparmor: replace sprintf with snprintf in aa_new_learning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4e34cddb-2d21-4c2c-bf9d-a377ba55ddb1@canonical.com>
Date: Wed, 26 Nov 2025 17:34:04 -0800
From: John Johansen <john.johansen@...onical.com>
To: Thorsten Blum <thorsten.blum@...ux.dev>, Paul Moore
 <paul@...l-moore.com>, James Morris <jmorris@...ei.org>,
 "Serge E. Hallyn" <serge@...lyn.com>
Cc: apparmor@...ts.ubuntu.com, linux-security-module@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND] apparmor: replace sprintf with snprintf in
 aa_new_learning_profile

On 11/22/25 03:54, Thorsten Blum wrote:
> Replace unbounded sprintf() calls with snprintf() to prevent potential
> buffer overflows in aa_new_learning_profile(). While the current code
> works correctly, snprintf() is safer and follows secure coding best
> practices.  No functional changes.
> 
> Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>

I have pulled this into my tree


Acked-by: John Johansen <john.johansen@...onical.com>

> ---
>   security/apparmor/policy.c | 15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
> index 50d5345ff5cb..b09323867fea 100644
> --- a/security/apparmor/policy.c
> +++ b/security/apparmor/policy.c
> @@ -697,24 +697,27 @@ struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
>   	struct aa_profile *p, *profile;
>   	const char *bname;
>   	char *name = NULL;
> +	size_t name_sz;
>   
>   	AA_BUG(!parent);
>   
>   	if (base) {
> -		name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
> -			       gfp);
> +		name_sz = strlen(parent->base.hname) + 8 + strlen(base);
> +		name = kmalloc(name_sz, gfp);
>   		if (name) {
> -			sprintf(name, "%s//null-%s", parent->base.hname, base);
> +			snprintf(name, name_sz, "%s//null-%s",
> +				 parent->base.hname, base);
>   			goto name;
>   		}
>   		/* fall through to try shorter uniq */
>   	}
>   
> -	name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
> +	name_sz = strlen(parent->base.hname) + 2 + 7 + 8;
> +	name = kmalloc(name_sz, gfp);
>   	if (!name)
>   		return NULL;
> -	sprintf(name, "%s//null-%x", parent->base.hname,
> -		atomic_inc_return(&parent->ns->uniq_null));
> +	snprintf(name, name_sz, "%s//null-%x", parent->base.hname,
> +		 atomic_inc_return(&parent->ns->uniq_null));
>   
>   name:
>   	/* lookup to see if this is a dup creation */