apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled

Browse source

commit
17b5758bf3 ("apparmor: Initial support for compressed policies")

added the ability for apparmor to load compressed policy, unfortunately
it did not add a config option or select CONFIG_ZSTD_DECOMPRESS
which it depends on, leading to the following build failure

apparmorfs.c makes calls into zstd_*() even when
CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is not set, causing
build errors:

/usr/bin/ld.bfd: security/apparmor/apparmorfs.o: in function `policy_update':
apparmorfs.c:(.text+0x1307): undefined reference to `zstd_get_frame_header'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1359): undefined reference to `zstd_dctx_workspace_bound'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x13f7): undefined reference to `zstd_init_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x140c): undefined reference to `zstd_decompress_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1411): undefined reference to `zstd_is_error'

Add a new config option to enable compress policy loading as using
the existing CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is in appropriate
as that is about retaining loaded policy so that it can be introspected
at a later date.

Fixes: 17b5758bf3 ("apparmor: Initial support for compressed policies")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

John Johansen 2026-07-30 02:30:58 -07:00

parent 9e4c1ef73b

commit 1c5f27e845

2 changed files with 26 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

security/apparmor/Kconfig

View file

15

security/apparmor/apparmorfs.c

View file