New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare
Linux has been dropping AF_ALG features like zero-copy support and offloading. With Linux 7.3, AF_ALG functionality is being further restricted due to security vulnerabilities and maintenance nightmares.
Intelligence analysis by Llama
Linux 7.3 restricts AF_ALG functionality by default to provide only a limited set of algorithms. This change was made to address security vulnerabilities and maintenance issues.
Linux 7.3 is restricting a part of the kernel called AF_ALG to make it safer and easier to maintain. This change affects how user-space programs can access the kernel's internal cryptography API.
Analysis
AF_ALG Restrictions in Linux 7.3
The past few Linux kernel cycles have seen a gradual reduction in AF_ALG functionality. This interface allows user-space programs to access the kernel's internal cryptography API. However, due to security vulnerabilities and maintenance nightmares, the Linux community has been chipping away at AF_ALG features. In Linux 7.2, AF_ALG was quickly deprecated, and now in Linux 7.3, it's being further restricted.
A new sysctl, af_alg_restrict, has been introduced to restrict AF_ALG functionality by default. This sysctl can be set to allow unlimited access like on older versions of the Linux kernel or to block it completely at run-time. The default behavior with af_alg_restrict=1 allows for a limited set of algorithms, including CMAC AES, HMAC MD5, HMAC SHA1, HMAC SHA224, SHMAC SHA256, HMAC SHA384, HMAC SHA512, MD4, MD5, SHA1, SHA224, SHA256, SHA385, and SHA512 hashing. These algorithms are allowed because they are known to be used by the IWD wireless daemon, which is still dependent on AF_ALG.
The AF_ALG skcipher code also has an allow list for Adiantum XChaCha12 AES, Adiantum XChaCha20 AES, CBC AES, CBC DES, CBC DES3_EDE, CTR AES, ECB AES, ECB DES, HCTR2 AES, and XTR AES for algorithms used by IWD, BlueZ, and cryptsetup. More details on this new AF_ALG tunable and the default behavior change can be found via this patch. The change was merged as part of the crypto updates for Linux 7.3. This pull also marks the Qualcomm QCE driver as broken, drops crypto_rng from the Qualcomm/Sun8i/CAAM drivers, and brings other fixes. Additionally, there is a fix for potential suspend/resume race conditions within the hardware random number generation (HWRNG) code.
The introduction of af_alg_restrict and the default behavior change are significant for users who rely on AF_ALG for accessing the kernel's internal cryptography API. This change is expected to improve the security and maintenance of the Linux kernel.
Key points
- Linux 7.3 restricts AF_ALG functionality by default to provide only a limited set of algorithms.
- The new sysctl, af_alg_restrict, can be set to allow unlimited access or to block it completely at run-time.
- The default behavior with af_alg_restrict=1 allows for a limited set of algorithms, including CMAC AES, HMAC MD5, and others.
- The AF_ALG skcipher code also has an allow list for certain algorithms used by IWD, BlueZ, and cryptsetup.
The new AF_ALG restrictions in Linux 7.3 are expected to improve the security and maintenance of the Linux kernel. This change should make it easier for developers to work with the kernel's internal cryptography API.
The introduction of af_alg_restrict and the default behavior change may cause issues for users who rely on AF_ALG for accessing the kernel's internal cryptography API. This change may require additional configuration or workarounds to ensure compatibility.
