]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
apparmor: return error on namespace mismatch in verify_header
authorMassimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Tue, 20 Jan 2026 14:24:05 +0000 (15:24 +0100)
committerJohn Johansen <john.johansen@canonical.com>
Tue, 24 Feb 2026 04:58:07 +0000 (20:58 -0800)
commit8813837aa7f5f5a262a5ebc1a1a2a3a5ec818c70
treeaaf0ce6ac05a16e07a72bea9de4e791fcfce5f11
parent4afc61702bdcc3b9b519749ef966cf762a6e7051
apparmor: return error on namespace mismatch in verify_header

When profiles in a multi-profile load specify different namesapaces,
the audit record is generated but execution continues, causing the
function to return success. This violates the load requirement that
all profiles must target the same namespace.

Add the missing return statement after auditing the error.

Reported-by: Qualys Security Advisory <qsa@qualys.com>
Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once")
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
security/apparmor/policy_unpack.c