AppArmor Switches To SHA256 Policy Hashes In Linux 6.8

For those making use of the AppArmor Linux kernel security module, there is a notable change coming with the Linux 6.8 kernel.

Canonical's Dimitri John Ledkov has switched over AppArmor from using SHA1 to SHA256 for the AppArmor policy hashes. He explained of the motivation for getting off SHA1 and onto SHA256 for AppArmor:

"sha1 is insecure and has colisions, thus it is not useful for even lightweight policy hash checks. Switch to sha256, which on modern hardware is fast enough.

Separately as per NIST Policy on Hash Functions, sha1 usage must be withdrawn by 2030. This config option currently is one of many that holds up sha1 usage."

The SHA1 or now SHA256 hashing is used with the "SECURITY_APPARMOR_HASH" Kconfig option for enabling the hashes as a quick way for system administrators to identify that an AppArmor policy in the kernel matches what is expected via comparing hashes. But as the policy hashing can slow down policy loading on some low-end systems, that's why this hashing introspection is left as a kernel tunable.

This pull switches AppArmor's policy hashing over to SHA256 plus also has fixes for two memory leaks and other bug fixes.