Re: [PATCH] crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1

Eric Biggers <[email protected]> Tue, 23 Jun 2026 09:54:16 -0700

Newsgroups	dev.linux.lists.ell,dev.linux.lists.iwd,org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-crypto,org.kernel.vger.linux-doc,org.kernel.vger.linux-hardening,org.kernel.vger.linux-kernel
Message-ID	<20260623165416.GC1793@sol>

On Tue, Jun 23, 2026 at 10:42:34AM +0200, Bastien Nocera wrote:
> Hello Eric,
> 
> On Mon, 2026-06-22 at 16:48 -0700, Eric Biggers wrote:
> > AF_ALG is a frequent source of vulnerabilities and a maintenance
> > nightmare.  It exposes far more functionality to userspace than ever
> > should have been exposed, especially to unprivileged processes. 
> > Recent
> > exploits have targeted kernel internal implementation details like
> > "authencesn" that have zero use case for userspace access.
> 
> You should also CC: [email protected] for AF_ALG related changes, as
> ell uses AF_ALG extensively for crypto and checksumming.
> 
> Cheers

The known users of libell (iwd and bluez) are already taken into
account.

- Eric