7.1-stable patches

added patches:
	apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch

diff --git a/queue-7.1/apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch b/queue-7.1/apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch
new file mode 100644 (file)
index 0000000..2125258
--- /dev/null
+++ b/queue-7.1/apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch
@@ -0,0 +1,39 @@
+From 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 Mon Sep 17 00:00:00 2001
+From: John Johansen <john.johansen@canonical.com>
+Date: Mon, 22 Jun 2026 16:34:13 -0700
+Subject: apparmor: advertise the tcp fast open fix is applied
+
+From: John Johansen <john.johansen@canonical.com>
+
+commit 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 upstream.
+
+The fix for tcp-fast-open ensures that the connect permission is being
+mediated correctly but it didn't add an artifact to the feature set to
+advertise the fix is available. Add an artifact so that the test suite
+can identify if the fix has not been properly applied or a new
+unexpected regression has occurred.
+
+Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/apparmor/net.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/security/apparmor/net.c
++++ b/security/apparmor/net.c
+@@ -22,12 +22,14 @@
+ 
+ struct aa_sfs_entry aa_sfs_entry_network[] = {
+       AA_SFS_FILE_STRING("af_mask",   AA_SFS_AF_MASK),
++      AA_SFS_FILE_BOOLEAN("tcp-fast-open",            1),
+       { }
+ };
+ 
+ struct aa_sfs_entry aa_sfs_entry_networkv9[] = {
+       AA_SFS_FILE_STRING("af_mask",   AA_SFS_AF_MASK),
+       AA_SFS_FILE_BOOLEAN("af_unix",  1),
++      AA_SFS_FILE_BOOLEAN("tcp-fast-open",            1),
+       { }
+ };
+ 

diff --git a/queue-7.1/series b/queue-7.1/series
index 79bb1302f15fdf2a614c27ea7ef7b03844adfcc1..ae6bad0754f0aa8ca5e5ba6314d61686e02cfb71 100644 (file)
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -117,3 +117,4 @@ nfsv4-clear-exception-state-on-successful-mkdir-retry.patch
 nfs-prevent-resource-leak-in-nfs_alloc_server.patch
 ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch
 net-tcp-ao-fix-use-after-free-of-key-in-del_async-path.patch
+apparmor-advertise-the-tcp-fast-open-fix-is-applied.patch