Re: [apparmor] [PATCH RESEND] apparmor: replace sprintf with snprintf in aa_new_learning_profile

[John Johansen]

On 11/22/25 03:54, Thorsten Blum wrote:

Replace unbounded sprintf() calls with snprintf() to prevent potential
buffer overflows in aa_new_learning_profile(). While the current code
works correctly, snprintf() is safer and follows secure coding best
practices.  No functional changes.

Signed-off-by: Thorsten Blum <thorsten.b...@linux.dev>

I have pulled this into my tree


Acked-by: John Johansen <john.johan...@canonical.com>

---
  security/apparmor/policy.c | 15 +++++++++------
  1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 50d5345ff5cb..b09323867fea 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -697,24 +697,27 @@ struct aa_profile *aa_new_learning_profile(struct 
aa_profile *parent, bool hat,
        struct aa_profile *p, *profile;
        const char *bname;
        char *name = NULL;
+       size_t name_sz;

AA_BUG(!parent); if (base) {

-               name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
-                              gfp);
+               name_sz = strlen(parent->base.hname) + 8 + strlen(base);
+               name = kmalloc(name_sz, gfp);
                if (name) {
-                       sprintf(name, "%s//null-%s", parent->base.hname, base);
+                       snprintf(name, name_sz, "%s//null-%s",
+                                parent->base.hname, base);
                        goto name;
                }
                /* fall through to try shorter uniq */
        }

- name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);

+       name_sz = strlen(parent->base.hname) + 2 + 7 + 8;
+       name = kmalloc(name_sz, gfp);
        if (!name)
                return NULL;
-       sprintf(name, "%s//null-%x", parent->base.hname,
-               atomic_inc_return(&parent->ns->uniq_null));
+       snprintf(name, name_sz, "%s//null-%x", parent->base.hname,
+                atomic_inc_return(&parent->ns->uniq_null));

name:

        /* lookup to see if this is a dup creation */