apparmor security module · Supported

Maintainers

• M John Johansen <john.johansen@canonical.com>
• M John Johansen <john@apparmor.net>
• M Georgia Garcia <georgia.garcia@canonical.com>

Paths

• F Documentation/admin-guide/LSM/apparmor.rst
• F security/apparmor/

Last 30 days

Most active threads (last 7 days)

• HOTtoday [PATCH security v1] apparmor: fix a use-after-free in aa_lookupn_ns()
  2026-09-23 05:47 · 0 replies in 7d · Binbin Deng <hidden>
• DORMANTno replies [PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()
  2026-09-17 16:43 · 0 replies in 7d · Wentao Liang <hidden>
• COOLING5d [PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()
  2026-09-17 16:41 · 0 replies in 7d · Wentao Liang <hidden>
• COOLING4d [PATCH 5.15.y 1/2] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
  2026-09-17 14:55 · 0 replies in 7d · Mickaël Salaün <mic@digikod.net>
• DORMANTno replies [PATCH] apparmor: handle NULL peer label in AF_UNIX context updates
  2026-09-17 07:15 · 0 replies in 7d · Maciek Borzecki <hidden>
• DORMANTno replies [PATCH] apparmor: lift path_name lookup in umount
  2026-09-16 17:03 · 0 replies in 7d · Murilo Duarte M de Almeida <hidden>
• DORMANTno replies [PATCH] apparmor: check accept index + 1 is in bounds
  2026-09-16 11:53 · 0 replies in 7d · Guanglei Zhu <hidden>

Active reviewers (last 30 days)

• Christian Brauner <brauner@kernel.org>
  1 attestation (1 Suggested-by) · last on 2026-09-17
• Mickaël Salaün <mic@digikod.net>
  1 attestation (1 Suggested-by) · last on 2026-09-17
• Georgia Garcia <georgia.garcia@canonical.com>
  1 attestation (1 Reviewed-by) · last on 2026-08-31

Recent patches

Most-recent 30 patches in this subsystem on linux-security-module (capped at 30), ordered by date desc.

• HOTtoday [PATCH security v1] apparmor: fix a use-after-free in aa_lookupn_ns()
  2026-09-23 · Binbin Deng <hidden>
• DORMANTno replies [PATCH] apparmor: Fix namespace reference leak in __aa_find_or_create_ns()
  2026-09-17 · Wentao Liang <hidden>
• COOLING5d [PATCH] apparmor: Fix label reference leak in aa_unix_file_perm()
  2026-09-17 · Wentao Liang <hidden>
• COOLING4d [PATCH 5.15.y 1/2] landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
  2026-09-17 · Mickaël Salaün <mic@digikod.net>
• DORMANTno replies [PATCH] apparmor: handle NULL peer label in AF_UNIX context updates
  2026-09-17 · Maciek Borzecki <hidden>
• DORMANTno replies [PATCH] apparmor: lift path_name lookup in umount
  2026-09-16 · Murilo Duarte M de Almeida <hidden>
• DORMANTno replies [PATCH] apparmor: check accept index + 1 is in bounds
  2026-09-16 · Guanglei Zhu <hidden>
• DORMANTno replies [PATCH] apparmor: Fix the return value in split_token_from_name() kernel-doc
  2026-09-12 · Karl Mehltretter <hidden>
• DORMANTno replies [PATCH] apparmor: dedup perms entries when mapping older policy
  2026-09-09 · Maxime Bélair <hidden>
• COLD17d [PATCH v6 4/4] tree-wide: purge verified remaining legacy ghost options
  2026-09-05 · Breno Rodrigues Alves <hidden>
• COLD18d [PATCH v2] Kconfig: purge twenty-eight legacy ghost options (v2)
  2026-09-04 · Breno Rodrigues Alves <hidden>
• COLD17d [PATCH] Kconfig: purge twenty-nine legacy ghost options
  2026-09-04 · Breno Rodrigues Alves <hidden>
• DORMANTno replies [PATCH] apparmor: fix table_size() integer overflow on 32 bit
  2026-09-03 · Maxime Bélair <hidden>
• COLD20d [PATCH v2 7/7] net, lsm: Change skb secmarks to x-array indexes
  2026-09-02 · Casey Schaufler <casey@schaufler-ca.com>
• COLD20d [PATCH v2 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop
  2026-09-02 · Casey Schaufler <casey@schaufler-ca.com>
• DORMANTno replies [PATCH] apparmor: convert duplicated dfa transitions to match_char()
  2026-09-01 · Maxime Bélair <hidden>
• COOLING14d [PATCH 26/27] fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
  2026-09-01 · Christian Brauner <brauner@kernel.org>
• COOLING14d [PATCH 20/27] fs: port ->mkdir() to pass const mnt_idmap
  2026-09-01 · Christian Brauner <brauner@kernel.org>
• COLD20d [PATCH 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop
  2026-08-31 · Casey Schaufler <casey@schaufler-ca.com>
• COLD20d [PATCH 7/7] net, lsm: Change skb secmarks to x-array indexes
  2026-08-31 · Casey Schaufler <casey@schaufler-ca.com>
• COOLING5d REVIEWED: 1 (1M) [PATCH AUTOSEL 6.18-6.12] apparmor: propagate -ENOMEM correctly in unpack_table
  2026-08-31 · Sasha Levin <sashal@kernel.org>
• HOTtoday [PATCH v2 1/3] fs: Introduce task path helpers
  2026-08-31 · Chen Linxuan <hidden>
• COLD22d [PATCH] apparmor: fix NULL ctx->peer derefs in unix socket ctx updates
  2026-08-24 · Maxime Bélair <hidden>
• DORMANTno replies [PATCH RFC 1/3] fs: Introduce task path helpers
  2026-08-20 · Chen Linxuan via B4 Relay <devnull+me.black-desk.cn@kernel.org>
• COLD40d [PATCH 6/7] Apparmor: hooks for secctx_to_lsmprop and update_lsmprop
  2026-08-13 · Casey Schaufler <casey@schaufler-ca.com>
• COLD40d [PATCH 7/7] net, lsm: Change skb secmarks to x-array indexes
  2026-08-13 · Casey Schaufler <casey@schaufler-ca.com>
• COLD43d [PATCH] apparmor: fix out-of-bounds write when null terminating a label vec
  2026-08-10 · Hyunwoo Kim <hidden>
• COLD44d [PATCH] apparmor: fix integer overflow in verify_tags() bounds check
  2026-08-09 · Fabrice Derepas <hidden>
• COLD47d [PATCH v2] apparmor: fix cred UAF caused by begin_current_label_crit_section()
  2026-08-06 · Jann Horn <jannh@google.com>
• STALE61d [PATCH] apparmor: switch website link to https
  2026-07-23 · Baruch Siach <baruch@tkos.co.il>

Needs attention (review trailers in, no pickup)

Patches with review trailers that haven't landed in mainline and haven't been Acked by a maintainer. Oldest first.

• STALE174d REVIEWED: 3 (1M) [PATCH v6.1] apparmor: fix unprivileged local user can do privileged policy management
  2026-04-02 · Keerthana K <hidden> · 2 Reviewed-by, 1 Tested-by
• DORMANTno replies REVIEWED: 3 (1M) [PATCH v5.10-v5.15] apparmor: fix unprivileged local user can do privileged policy management
  2026-04-02 · Keerthana K <hidden> · 2 Reviewed-by, 1 Tested-by
• DORMANTno replies REVIEWED: 3 (1M) [PATCH 5.15.y] apparmor: fix memory leak in verify_header
  2026-04-13 · Li hongliang <hidden> · 2 Reviewed-by, 1 Tested-by
• DORMANTno replies REVIEWED: 3 (1M) [PATCH 5.10.y] apparmor: fix memory leak in verify_header
  2026-04-13 · Li hongliang <hidden> · 2 Reviewed-by, 1 Tested-by
• DORMANTno replies REVIEWED: 3 (1M) [PATCH 6.1.y] apparmor: fix memory leak in verify_header
  2026-04-13 · Li hongliang <hidden> · 2 Reviewed-by, 1 Tested-by
• COOLING5d REVIEWED: 1 (1M) [PATCH AUTOSEL 6.18-6.12] apparmor: propagate -ENOMEM correctly in unpack_table
  2026-08-31 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by

Quiet for 30+ days

Patches with no review trailers and no replies. Either the author is heads-down elsewhere or these slipped through. Oldest first.

• STALE159d [PATCH 20/61] apparmor: Prefer IS_ERR_OR_NULL over manual NULL check
  2026-03-10 · Philipp Hahn <hidden>
• STALE162d [PATCH 2/7] apparmor: Remove redundant MS_MGC_MSK stripping in apparmor_sb_mount
  2026-03-18 · Song Liu <song@kernel.org>
• STALE162d [PATCH 3/7] apparmor: Convert from sb_mount to granular mount hooks
  2026-03-18 · Song Liu <song@kernel.org>
• STALE137d [PATCH v2 2/7] apparmor: Remove redundant MS_MGC_MSK stripping in apparmor_sb_mount
  2026-04-30 · Song Liu <song@kernel.org>
• STALE137d [PATCH v2 3/7] apparmor: Convert from sb_mount to granular mount hooks
  2026-04-30 · Song Liu <song@kernel.org>
• DORMANTno replies [PATCH] apparmor: hold peer path references in aa_unix_file_perm()
  2026-05-15 · Zhang Cen <hidden>
• STALE118d [PATCH v4 2/7] apparmor: Remove redundant MS_MGC_MSK stripping in apparmor_sb_mount
  2026-05-15 · Song Liu <song@kernel.org>
• STALE118d [PATCH v4 3/7] apparmor: Convert from sb_mount to granular mount hooks
  2026-05-15 · Song Liu <song@kernel.org>
• DORMANTno replies [PATCH] apparmor: Fix inverted comparison in cache_hold_inc()
  2026-05-21 · Eduardo Vasconcelos <hidden>
• DORMANTno replies [PATCH v2] apparmor: Fix inverted comparison in cache_hold_inc()
  2026-05-21 · Eduardo Vasconcelos <hidden>