AppArmor Adds IO_uring Mediation & Some Performance Optimizations

The AppArmor Linux security system has picked up a few improvements and new features with the in-development Linux 6.7 kernel.

John Johansen of Canonical sent out today the AppArmor updates for the new kernel and summed it up as:

"This PR adds initial support for mediating io_uring and userns creation. Adds a new restriction that tightens the use of
change_profile, and a couple of optimizations to reduce performance bottle necks that have been found when retrieving the current task's secid and allocating work buffers.

The majority of the patch set continues cleaning up and simplifying the code (fixing comments, removing now dead functions, and macros etc). Finally there are 4 bug fixes, with the regression fix having had a couple months of testing."

Performance optimizations are always welcome especially in areas like AppArmor overhead. The IO_uring mediation is interesting although with Linux 6.7 is limited to sqpoll and override_creds interfaces.

Historically IO_uring has been the source of some security vulnerabilities while since Linux 6.6 it's been made easier to disable IO_uring system wide. The IO_uring security woes have mostly been with older kernels but in any event for those using AppArmor there is now IO_uring mediation available for those interested. This IO_uring support was added by Canonical engineers.

More details on the IO_uring updates for Linux 6.7 via the pull request.