There's a memory leak in the kernel when removing a profile. A simple reproducible example:
root@ubuntu:~# echo "profile foo {}" > profile root@ubuntu:~# apparmor_parser profile root@ubuntu:~# echo scan > /sys/kernel/debug/kmemleak root@ubuntu:~# cat /sys/kernel/debug/kmemleak unreferenced object 0xffff99bcf5128bb0 (size 16): comm "apparmor_parser", pid 1318, jiffies 4295139856 (age 33.196s) hex dump (first 16 bytes): 01 00 00 00 00 00 00 00 98 1f 01 fd bc 99 ff ff ................ backtrace: [<00000000b1f68969>] kmem_cache_alloc_trace+0xd8/0x1e0 [<0000000086ca7bd9>] aa_alloc_proxy+0x30/0x60 [<000000000e34f34c>] aa_alloc_profile+0xd4/0x100 [<00000000c2e34769>] unpack_profile+0x16f/0xe10 [<0000000019033e2b>] aa_unpack+0x119/0x500 [<00000000a97520b2>] aa_replace_profiles+0x94/0xca0 [<000000001833f520>] policy_update+0x124/0x1e0 [<00000000992f950e>] profile_load+0x7d/0xa0 [<00000000db7852ce>] __vfs_write+0x1b/0x40 [<000000004e709f5d>] vfs_write+0xb9/0x1a0 [<00000000280db840>] SyS_write+0x5e/0xe0 [<0000000014c5ab5d>] do_syscall_64+0x79/0x130 [<00000000e962a389>] entry_SYSCALL_64_after_hwframe+0x41/0xa6 [<000000009d368497>] 0xffffffffffffffff
This issue was already fixed upstream 3622ad25d4d6 v5.8-rc1~102^2 It still needs to be applied on xenial, bionic and focal.
There's a memory leak in the kernel when removing a profile.
A simple reproducible example:
root@ubuntu:~# echo "profile foo {}" > profile debug/kmemleak debug/kmemleak 1f68969> ] kmem_cache_ alloc_trace+ 0xd8/0x1e0 6ca7bd9> ] aa_alloc_ proxy+0x30/ 0x60 e34f34c> ] aa_alloc_ profile+ 0xd4/0x100 2e34769> ] unpack_ profile+ 0x16f/0xe10 9033e2b> ] aa_unpack+ 0x119/0x500 97520b2> ] aa_replace_ profiles+ 0x94/0xca0 833f520> ] policy_ update+ 0x124/0x1e0 92f950e> ] profile_ load+0x7d/ 0xa0 b7852ce> ] __vfs_write+ 0x1b/0x40 e709f5d> ] vfs_write+ 0xb9/0x1a0 80db840> ] SyS_write+0x5e/0xe0 4c5ab5d> ] do_syscall_ 64+0x79/ 0x130 962a389> ] entry_SYSCALL_ 64_after_ hwframe+ 0x41/0xa6 d368497> ] 0xffffffffffffffff
root@ubuntu:~# apparmor_parser profile
root@ubuntu:~# echo scan > /sys/kernel/
root@ubuntu:~# cat /sys/kernel/
unreferenced object 0xffff99bcf5128bb0 (size 16):
comm "apparmor_parser", pid 1318, jiffies 4295139856 (age 33.196s)
hex dump (first 16 bytes):
01 00 00 00 00 00 00 00 98 1f 01 fd bc 99 ff ff ................
backtrace:
[<00000000b
[<000000008
[<000000000
[<00000000c
[<000000001
[<00000000a
[<000000001
[<000000009
[<00000000d
[<000000004
[<000000002
[<000000001
[<00000000e
[<000000009
This issue was already fixed upstream 3622ad25d4d6 v5.8-rc1~102^2
It still needs to be applied on xenial, bionic and focal.