New AF_ALG Restrictions With Linux 7.3 Due To The Security & Maintenance Nightmare

The past few Linux kernel cycles have chipped away at AF_ALG functionality for that interface for user-space programs to access the kernel's internal cryptography API. Linux has been dropping AF_ALG features like zero-copy support and offloading. AF_ALG was quickly deprecated in Linux 7.2 while now for Linux 7.3 it's being further restricted.

With Linux 7.3 there is the new af_alg_restrict sysctl that is restricting AF_ALG functionality by default to provide only a limited set of algorithms. This af_alg_restrict sysctl can still be set to allow unlimited access like on older versions of the Linux kernel or if wanting to block it completely at run-time.

Due to the security vulnerabilities and maintenance nightmare that it is, the allow-list by default with af_alg_restrict=1 allows for CMAC AES, HMAC MD5, HMAC SHA1, HMAC SHA224, SHMAC SHA256, HMAC SHA384, HMAC SHA512, MD4, MD5, SHA1, SHA224, SHA256, SHA385, and SHA512 hashing. These are allowed given there is known use of them by the IWD wireless daemon, which is still dependent upon AF_ALG.

The AF_ALG skcipher code also has an allow list for Adiantum XChaCha12 AES, Adiantum XChaCha20 AES, CBC AES, CBC DES, CBC DES3_EDE, CTR AES, ECB AES, ECB DES, HCTR2 AES, and XTR AES for algorithms used by IWD, BlueZ, and cryptsetup.

More details on this new AF_ALG tunable and the default behavior change via this patch.

The change was merged as part of the crypto updates for Linux 7.3. That pull also marks the Qualcomm QCE driver as broken, drops crypto_rng from the Qualcomm / Sun8i / CAAM drivers, and brings other fixes. There is also a fix for potential suspend/resume race conditions within the hardware random number generation (HWRNG) code.