From 1f5428b9f9bfb9dab6828015a5254dcd7c582a01 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Tue, 20 Oct 2026 12:23:13 -0700 Subject: [PATCH] apparmor: remove unconfined_profile() check in inet socket mediation When a stacked label is used the early bailout !unconfined(label) fails, and the individual profile components of the label are checked. This can lead to aa_profile_af_perm() being called which results in WARNING: security/apparmor/net.c:263 at aa_profile_af_perm+0x228/0x3b0 on any inet socket using basic socket mediation. Remove the AA_BUG(profile_unconfined(profile)) check, it is not needed as the code already handles the unconfined_profile() case. In addition also a comment to indicate that this case is covered. Fixes: 89ac6aa752ec ("apparmor: push inet mediation into profile callbacks, and improve auditing") Reported-by: Georgia Garcia Signed-off-by: John Johansen --- security/apparmor/net.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/security/apparmor/net.c b/security/apparmor/net.c index a333e6aff926..641d181544ac 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -260,7 +260,6 @@ int aa_profile_af_perm(struct aa_profile *profile, AA_BUG(family >= AF_MAX); AA_BUG(type < 0 || type >= SOCK_MAX); - AA_BUG(profile_unconfined(profile)); state = RULE_MEDIATES_NET(rules); if (state) { @@ -268,7 +267,7 @@ int aa_profile_af_perm(struct aa_profile *profile, type, protocol, &p, &ad->info); return aa_do_perms(profile, rules->policy, state, request, p, ad); - } /* else */ + } /* else - not mediated this covers the profile_unconfined() case */ return 0; }