apparmor/include/perms.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor basic permission sets definitions.
0006  *
0007  * Copyright 2017 Canonical Ltd.
0008  */
0009
0010 #ifndef __AA_PERM_H
0011 #define __AA_PERM_H
0012
0013 #include <linux/fs.h>
0014 #include "label.h"
0015
0016 #define AA_MAY_EXEC     MAY_EXEC
0017 #define AA_MAY_WRITE        MAY_WRITE
0018 #define AA_MAY_READ     MAY_READ
0019 #define AA_MAY_APPEND       MAY_APPEND
0020
0021 #define AA_MAY_CREATE       0x0010
0022 #define AA_MAY_DELETE       0x0020
0023 #define AA_MAY_OPEN     0x0040
0024 #define AA_MAY_RENAME       0x0080      /* pair */
0025
0026 #define AA_MAY_SETATTR      0x0100      /* meta write */
0027 #define AA_MAY_GETATTR      0x0200      /* meta read */
0028 #define AA_MAY_SETCRED      0x0400      /* security cred/attr */
0029 #define AA_MAY_GETCRED      0x0800
0030
0031 #define AA_MAY_CHMOD        0x1000      /* pair */
0032 #define AA_MAY_CHOWN        0x2000      /* pair */
0033 #define AA_MAY_CHGRP        0x4000      /* pair */
0034 #define AA_MAY_LOCK     0x8000      /* LINK_SUBSET overlaid */
0035
0036 #define AA_EXEC_MMAP        0x00010000
0037 #define AA_MAY_MPROT        0x00020000  /* extend conditions */
0038 #define AA_MAY_LINK     0x00040000  /* pair */
0039 #define AA_MAY_SNAPSHOT     0x00080000  /* pair */
0040
0041 #define AA_MAY_DELEGATE
0042 #define AA_CONT_MATCH       0x08000000
0043
0044 #define AA_MAY_STACK        0x10000000
0045 #define AA_MAY_ONEXEC       0x20000000 /* either stack or change_profile */
0046 #define AA_MAY_CHANGE_PROFILE   0x40000000
0047 #define AA_MAY_CHANGEHAT    0x80000000
0048
0049 #define AA_LINK_SUBSET      AA_MAY_LOCK /* overlaid */
0050
0051
0052 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |     \
0053              AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |    \
0054              AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
0055
0056 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
0057               AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
0058               AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
0059               AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
0060               AA_MAY_STACK | AA_MAY_ONEXEC |        \
0061               AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
0062
0063 extern const char aa_file_perm_chrs[];
0064 extern const char *aa_file_perm_names[];
0065
0066 struct aa_perms {
0067     u32 allow;
0068     u32 audit;  /* set only when allow is set */
0069
0070     u32 deny;   /* explicit deny, or conflict if allow also set */
0071     u32 quiet;  /* set only when ~allow | deny */
0072     u32 kill;   /* set only when ~allow | deny */
0073     u32 stop;   /* set only when ~allow | deny */
0074
0075     u32 complain;   /* accumulates only used when ~allow & ~deny */
0076     u32 cond;   /* set only when ~allow and ~deny */
0077
0078     u32 hide;   /* set only when  ~allow | deny */
0079     u32 prompt; /* accumulates only used when ~allow & ~deny */
0080
0081     /* Reserved:
0082      * u32 subtree; / * set only when allow is set * /
0083      */
0084     u16 xindex;
0085 };
0086
0087 #define ALL_PERMS_MASK 0xffffffff
0088 extern struct aa_perms nullperms;
0089 extern struct aa_perms allperms;
0090
0091
0092 #define xcheck(FN1, FN2)    \
0093 ({              \
0094     int e, error = FN1; \
0095     e = FN2;        \
0096     if (e)          \
0097         error = e;  \
0098     error;          \
0099 })
0100
0101
0102 /*
0103  * TODO: update for labels pointing to labels instead of profiles
0104  * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
0105  * gah this doesn't allow for label compound check!!!!
0106  */
0107 #define xcheck_ns_profile_profile(P1, P2, FN, args...)      \
0108 ({                              \
0109     int ____e = 0;                      \
0110     if (P1->ns == P2->ns)                   \
0111         ____e = FN((P1), (P2), args);           \
0112     (____e);                        \
0113 })
0114
0115 #define xcheck_ns_profile_label(P, L, FN, args...)      \
0116 ({                              \
0117     struct aa_profile *__p2;                \
0118     fn_for_each((L), __p2,                  \
0119             xcheck_ns_profile_profile((P), __p2, (FN), args));  \
0120 })
0121
0122 #define xcheck_ns_labels(L1, L2, FN, args...)           \
0123 ({                              \
0124     struct aa_profile *__p1;                \
0125     fn_for_each((L1), __p1, FN(__p1, (L2), args));      \
0126 })
0127
0128 /* Do the cross check but applying FN at the profiles level */
0129 #define xcheck_labels_profiles(L1, L2, FN, args...)     \
0130     xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
0131
0132 #define xcheck_labels(L1, L2, P, FN1, FN2)          \
0133     xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
0134
0135
0136 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs,
0137              u32 mask);
0138 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
0139              u32 mask);
0140 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
0141             u32 chrsmask, const char * const *names, u32 namesmask);
0142 void aa_apply_modes_to_perms(struct aa_profile *profile,
0143                  struct aa_perms *perms);
0144 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
0145               struct aa_perms *perms);
0146 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
0147 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
0148 void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
0149                 int type, u32 request, struct aa_perms *perms);
0150 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
0151               u32 request, int type, u32 *deny,
0152               struct common_audit_data *sa);
0153 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
0154            u32 request, struct common_audit_data *sa,
0155            void (*cb)(struct audit_buffer *, void *));
0156 #endif /* __AA_PERM_H */