apparmor: use SHA-256 library API instead of crypto_shash API

This user of SHA-256 does not support any other algorithm, so the
crypto_shash abstraction provides no value.  Just use the SHA-256
library API instead, which is much simpler and easier to use.

Acked-by: John Johansen <john.johansen@canonical.com>
Link: https://lore.kernel.org/r/20250630174805.59010-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>

diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
index 64cc3044a42cedce62a745a9d19e0e2e9fab64e2..1e3bd44643daccae0cf40db73a3fa988225fefba 100644 (file)
--- a/security/apparmor/Kconfig
+++ b/security/apparmor/Kconfig
@@ -59,8 +59,7 @@ config SECURITY_APPARMOR_INTROSPECT_POLICY
 config SECURITY_APPARMOR_HASH
        bool "Enable introspection of sha256 hashes for loaded profiles"
        depends on SECURITY_APPARMOR_INTROSPECT_POLICY
-       select CRYPTO
-       select CRYPTO_SHA256
+       select CRYPTO_LIB_SHA256
        default y
        help
          This option selects whether introspection of loaded policy

diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index aad486b2fca65482981ffbf47d11d4c448481c5e..227d47c14907410b6374a0016669fcc9cc6254be 100644 (file)
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -11,113 +11,52 @@
  * it should be.
  */
 
-#include <crypto/hash.h>
+#include <crypto/sha2.h>
 
 #include "include/apparmor.h"
 #include "include/crypto.h"
 
-static unsigned int apparmor_hash_size;
-
-static struct crypto_shash *apparmor_tfm;
-
 unsigned int aa_hash_size(void)
 {
-       return apparmor_hash_size;
+       return SHA256_DIGEST_SIZE;
 }
 
 char *aa_calc_hash(void *data, size_t len)
 {
-       SHASH_DESC_ON_STACK(desc, apparmor_tfm);
        char *hash;
-       int error;
-
-       if (!apparmor_tfm)
-               return NULL;
 
-       hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
+       hash = kzalloc(SHA256_DIGEST_SIZE, GFP_KERNEL);
        if (!hash)
                return ERR_PTR(-ENOMEM);
 
-       desc->tfm = apparmor_tfm;
-
-       error = crypto_shash_init(desc);
-       if (error)
-               goto fail;
-       error = crypto_shash_update(desc, (u8 *) data, len);
-       if (error)
-               goto fail;
-       error = crypto_shash_final(desc, hash);
-       if (error)
-               goto fail;
-
+       sha256(data, len, hash);
        return hash;
-
-fail:
-       kfree(hash);
-
-       return ERR_PTR(error);
 }
 
 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
                         size_t len)
 {
-       SHASH_DESC_ON_STACK(desc, apparmor_tfm);
-       int error;
+       struct sha256_ctx sctx;
        __le32 le32_version = cpu_to_le32(version);
 
        if (!aa_g_hash_policy)
                return 0;
 
-       if (!apparmor_tfm)
-               return 0;
-
-       profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);
+       profile->hash = kzalloc(SHA256_DIGEST_SIZE, GFP_KERNEL);
        if (!profile->hash)
                return -ENOMEM;
 
-       desc->tfm = apparmor_tfm;
-
-       error = crypto_shash_init(desc);
-       if (error)
-               goto fail;
-       error = crypto_shash_update(desc, (u8 *) &le32_version, 4);
-       if (error)
-               goto fail;
-       error = crypto_shash_update(desc, (u8 *) start, len);
-       if (error)
-               goto fail;
-       error = crypto_shash_final(desc, profile->hash);
-       if (error)
-               goto fail;
-
+       sha256_init(&sctx);
+       sha256_update(&sctx, (u8 *)&le32_version, 4);
+       sha256_update(&sctx, (u8 *)start, len);
+       sha256_final(&sctx, profile->hash);
        return 0;
-
-fail:
-       kfree(profile->hash);
-       profile->hash = NULL;
-
-       return error;
 }
 
 static int __init init_profile_hash(void)
 {
-       struct crypto_shash *tfm;
-
-       if (!apparmor_initialized)
-               return 0;
-
-       tfm = crypto_alloc_shash("sha256", 0, 0);
-       if (IS_ERR(tfm)) {
-               int error = PTR_ERR(tfm);
-               AA_ERROR("failed to setup profile sha256 hashing: %d\n", error);
-               return error;
-       }
-       apparmor_tfm = tfm;
-       apparmor_hash_size = crypto_shash_digestsize(apparmor_tfm);
-
-       aa_info_message("AppArmor sha256 policy hashing enabled");
-
+       if (apparmor_initialized)
+               aa_info_message("AppArmor sha256 policy hashing enabled");
        return 0;
 }
-
 late_initcall(init_profile_hash);