apparmor: use SHA-256 library API instead of crypto_shash API

This user of SHA-256 does not support any other algorithm, so the crypto_shash abstraction provides no value. Just use the SHA-256 library API instead, which is much simpler and easier to use.

---

This is the slightly revised version of
https://lore.kernel.org/r/[email protected]/
that I'm planning to apply to libcrypto-next for 6.17 to avoid a silent conflict with the sha256_state => sha256_ctx rename, as per the discussion in that thread.

You can also get this patch and its dependencies from:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git apparmor-sha256-lib-v2

 security/apparmor/Kconfig  |  3 +-
 security/apparmor/crypto.c | 85 ++++++--------------------------------
 2 files changed, 13 insertions(+), 75 deletions(-)

index 64cc3044a42ce..1e3bd44643dac 100644
@@ -57,12 +57,11 @@ config SECURITY_APPARMOR_INTROSPECT_POLICY
 	  cpu is paramount.
 
 config SECURITY_APPARMOR_HASH
 	bool "Enable introspection of sha256 hashes for loaded profiles"
 	depends on SECURITY_APPARMOR_INTROSPECT_POLICY
-	select CRYPTO
-	select CRYPTO_SHA256
+	select CRYPTO_LIB_SHA256
 	default y
 	help
 	  This option selects whether introspection of loaded policy
 	  hashes is available to userspace via the apparmor
 	  filesystem. This option provides a light weight means of

base-commit: 1f7eb3c393ab9e56b5746f5fd31796a73bdd4d48

2.50.0