Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor LSM hooks.
0006  *
0007  * Copyright (C) 1998-2008 Novell/SUSE
0008  * Copyright 2009-2010 Canonical Ltd.
0009  */
0010 
0011 #include <linux/lsm_hooks.h>
0012 #include <linux/moduleparam.h>
0013 #include <linux/mm.h>
0014 #include <linux/mman.h>
0015 #include <linux/mount.h>
0016 #include <linux/namei.h>
0017 #include <linux/ptrace.h>
0018 #include <linux/ctype.h>
0019 #include <linux/sysctl.h>
0020 #include <linux/audit.h>
0021 #include <linux/user_namespace.h>
0022 #include <linux/netfilter_ipv4.h>
0023 #include <linux/netfilter_ipv6.h>
0024 #include <linux/zlib.h>
0025 #include <net/sock.h>
0026 #include <uapi/linux/mount.h>
0027 
0028 #include "include/apparmor.h"
0029 #include "include/apparmorfs.h"
0030 #include "include/audit.h"
0031 #include "include/capability.h"
0032 #include "include/cred.h"
0033 #include "include/file.h"
0034 #include "include/ipc.h"
0035 #include "include/net.h"
0036 #include "include/path.h"
0037 #include "include/label.h"
0038 #include "include/policy.h"
0039 #include "include/policy_ns.h"
0040 #include "include/procattr.h"
0041 #include "include/mount.h"
0042 #include "include/secid.h"
0043 
0044 /* Flag indicating whether initialization completed */
0045 int apparmor_initialized;
0046 
0047 union aa_buffer {
0048     struct list_head list;
0049     char buffer[1];
0050 };
0051 
0052 #define RESERVE_COUNT 2
0053 static int reserve_count = RESERVE_COUNT;
0054 static int buffer_count;
0055 
0056 static LIST_HEAD(aa_global_buffers);
0057 static DEFINE_SPINLOCK(aa_buffers_lock);
0058 
0059 /*
0060  * LSM hook functions
0061  */
0062 
0063 /*
0064  * put the associated labels
0065  */
0066 static void apparmor_cred_free(struct cred *cred)
0067 {
0068     aa_put_label(cred_label(cred));
0069     set_cred_label(cred, NULL);
0070 }
0071 
0072 /*
0073  * allocate the apparmor part of blank credentials
0074  */
0075 static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
0076 {
0077     set_cred_label(cred, NULL);
0078     return 0;
0079 }
0080 
0081 /*
0082  * prepare new cred label for modification by prepare_cred block
0083  */
0084 static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
0085                  gfp_t gfp)
0086 {
0087     set_cred_label(new, aa_get_newest_label(cred_label(old)));
0088     return 0;
0089 }
0090 
0091 /*
0092  * transfer the apparmor data to a blank set of creds
0093  */
0094 static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
0095 {
0096     set_cred_label(new, aa_get_newest_label(cred_label(old)));
0097 }
0098 
0099 static void apparmor_task_free(struct task_struct *task)
0100 {
0101 
0102     aa_free_task_ctx(task_ctx(task));
0103 }
0104 
0105 static int apparmor_task_alloc(struct task_struct *task,
0106                    unsigned long clone_flags)
0107 {
0108     struct aa_task_ctx *new = task_ctx(task);
0109 
0110     aa_dup_task_ctx(new, task_ctx(current));
0111 
0112     return 0;
0113 }
0114 
0115 static int apparmor_ptrace_access_check(struct task_struct *child,
0116                     unsigned int mode)
0117 {
0118     struct aa_label *tracer, *tracee;
0119     int error;
0120 
0121     tracer = __begin_current_label_crit_section();
0122     tracee = aa_get_task_label(child);
0123     error = aa_may_ptrace(tracer, tracee,
0124             (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
0125                           : AA_PTRACE_TRACE);
0126     aa_put_label(tracee);
0127     __end_current_label_crit_section(tracer);
0128 
0129     return error;
0130 }
0131 
0132 static int apparmor_ptrace_traceme(struct task_struct *parent)
0133 {
0134     struct aa_label *tracer, *tracee;
0135     int error;
0136 
0137     tracee = __begin_current_label_crit_section();
0138     tracer = aa_get_task_label(parent);
0139     error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE);
0140     aa_put_label(tracer);
0141     __end_current_label_crit_section(tracee);
0142 
0143     return error;
0144 }
0145 
0146 /* Derived from security/commoncap.c:cap_capget */
0147 static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
0148                kernel_cap_t *inheritable, kernel_cap_t *permitted)
0149 {
0150     struct aa_label *label;
0151     const struct cred *cred;
0152 
0153     rcu_read_lock();
0154     cred = __task_cred(target);
0155     label = aa_get_newest_cred_label(cred);
0156 
0157     /*
0158      * cap_capget is stacked ahead of this and will
0159      * initialize effective and permitted.
0160      */
0161     if (!unconfined(label)) {
0162         struct aa_profile *profile;
0163         struct label_it i;
0164 
0165         label_for_each_confined(i, label, profile) {
0166             if (COMPLAIN_MODE(profile))
0167                 continue;
0168             *effective = cap_intersect(*effective,
0169                            profile->caps.allow);
0170             *permitted = cap_intersect(*permitted,
0171                            profile->caps.allow);
0172         }
0173     }
0174     rcu_read_unlock();
0175     aa_put_label(label);
0176 
0177     return 0;
0178 }
0179 
0180 static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
0181                 int cap, unsigned int opts)
0182 {
0183     struct aa_label *label;
0184     int error = 0;
0185 
0186     label = aa_get_newest_cred_label(cred);
0187     if (!unconfined(label))
0188         error = aa_capable(label, cap, opts);
0189     aa_put_label(label);
0190 
0191     return error;
0192 }
0193 
0194 /**
0195  * common_perm - basic common permission check wrapper fn for paths
0196  * @op: operation being checked
0197  * @path: path to check permission of  (NOT NULL)
0198  * @mask: requested permissions mask
0199  * @cond: conditional info for the permission request  (NOT NULL)
0200  *
0201  * Returns: %0 else error code if error or permission denied
0202  */
0203 static int common_perm(const char *op, const struct path *path, u32 mask,
0204                struct path_cond *cond)
0205 {
0206     struct aa_label *label;
0207     int error = 0;
0208 
0209     label = __begin_current_label_crit_section();
0210     if (!unconfined(label))
0211         error = aa_path_perm(op, label, path, 0, mask, cond);
0212     __end_current_label_crit_section(label);
0213 
0214     return error;
0215 }
0216 
0217 /**
0218  * common_perm_cond - common permission wrapper around inode cond
0219  * @op: operation being checked
0220  * @path: location to check (NOT NULL)
0221  * @mask: requested permissions mask
0222  *
0223  * Returns: %0 else error code if error or permission denied
0224  */
0225 static int common_perm_cond(const char *op, const struct path *path, u32 mask)
0226 {
0227     struct user_namespace *mnt_userns = mnt_user_ns(path->mnt);
0228     struct path_cond cond = {
0229         i_uid_into_mnt(mnt_userns, d_backing_inode(path->dentry)),
0230         d_backing_inode(path->dentry)->i_mode
0231     };
0232 
0233     if (!path_mediated_fs(path->dentry))
0234         return 0;
0235 
0236     return common_perm(op, path, mask, &cond);
0237 }
0238 
0239 /**
0240  * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
0241  * @op: operation being checked
0242  * @dir: directory of the dentry  (NOT NULL)
0243  * @dentry: dentry to check  (NOT NULL)
0244  * @mask: requested permissions mask
0245  * @cond: conditional info for the permission request  (NOT NULL)
0246  *
0247  * Returns: %0 else error code if error or permission denied
0248  */
0249 static int common_perm_dir_dentry(const char *op, const struct path *dir,
0250                   struct dentry *dentry, u32 mask,
0251                   struct path_cond *cond)
0252 {
0253     struct path path = { .mnt = dir->mnt, .dentry = dentry };
0254 
0255     return common_perm(op, &path, mask, cond);
0256 }
0257 
0258 /**
0259  * common_perm_rm - common permission wrapper for operations doing rm
0260  * @op: operation being checked
0261  * @dir: directory that the dentry is in  (NOT NULL)
0262  * @dentry: dentry being rm'd  (NOT NULL)
0263  * @mask: requested permission mask
0264  *
0265  * Returns: %0 else error code if error or permission denied
0266  */
0267 static int common_perm_rm(const char *op, const struct path *dir,
0268               struct dentry *dentry, u32 mask)
0269 {
0270     struct inode *inode = d_backing_inode(dentry);
0271     struct user_namespace *mnt_userns = mnt_user_ns(dir->mnt);
0272     struct path_cond cond = { };
0273 
0274     if (!inode || !path_mediated_fs(dentry))
0275         return 0;
0276 
0277     cond.uid = i_uid_into_mnt(mnt_userns, inode);
0278     cond.mode = inode->i_mode;
0279 
0280     return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
0281 }
0282 
0283 /**
0284  * common_perm_create - common permission wrapper for operations doing create
0285  * @op: operation being checked
0286  * @dir: directory that dentry will be created in  (NOT NULL)
0287  * @dentry: dentry to create   (NOT NULL)
0288  * @mask: request permission mask
0289  * @mode: created file mode
0290  *
0291  * Returns: %0 else error code if error or permission denied
0292  */
0293 static int common_perm_create(const char *op, const struct path *dir,
0294                   struct dentry *dentry, u32 mask, umode_t mode)
0295 {
0296     struct path_cond cond = { current_fsuid(), mode };
0297 
0298     if (!path_mediated_fs(dir->dentry))
0299         return 0;
0300 
0301     return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
0302 }
0303 
0304 static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
0305 {
0306     return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
0307 }
0308 
0309 static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
0310                    umode_t mode)
0311 {
0312     return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
0313                   S_IFDIR);
0314 }
0315 
0316 static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
0317 {
0318     return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
0319 }
0320 
0321 static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
0322                    umode_t mode, unsigned int dev)
0323 {
0324     return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
0325 }
0326 
0327 static int apparmor_path_truncate(const struct path *path)
0328 {
0329     return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR);
0330 }
0331 
0332 static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
0333                  const char *old_name)
0334 {
0335     return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
0336                   S_IFLNK);
0337 }
0338 
0339 static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
0340                   struct dentry *new_dentry)
0341 {
0342     struct aa_label *label;
0343     int error = 0;
0344 
0345     if (!path_mediated_fs(old_dentry))
0346         return 0;
0347 
0348     label = begin_current_label_crit_section();
0349     if (!unconfined(label))
0350         error = aa_path_link(label, old_dentry, new_dir, new_dentry);
0351     end_current_label_crit_section(label);
0352 
0353     return error;
0354 }
0355 
0356 static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
0357                 const struct path *new_dir, struct dentry *new_dentry,
0358                 const unsigned int flags)
0359 {
0360     struct aa_label *label;
0361     int error = 0;
0362 
0363     if (!path_mediated_fs(old_dentry))
0364         return 0;
0365     if ((flags & RENAME_EXCHANGE) && !path_mediated_fs(new_dentry))
0366         return 0;
0367 
0368     label = begin_current_label_crit_section();
0369     if (!unconfined(label)) {
0370         struct user_namespace *mnt_userns = mnt_user_ns(old_dir->mnt);
0371         struct path old_path = { .mnt = old_dir->mnt,
0372                      .dentry = old_dentry };
0373         struct path new_path = { .mnt = new_dir->mnt,
0374                      .dentry = new_dentry };
0375         struct path_cond cond = {
0376             i_uid_into_mnt(mnt_userns, d_backing_inode(old_dentry)),
0377             d_backing_inode(old_dentry)->i_mode
0378         };
0379 
0380         if (flags & RENAME_EXCHANGE) {
0381             struct path_cond cond_exchange = {
0382                 i_uid_into_mnt(mnt_userns, d_backing_inode(new_dentry)),
0383                 d_backing_inode(new_dentry)->i_mode
0384             };
0385 
0386             error = aa_path_perm(OP_RENAME_SRC, label, &new_path, 0,
0387                          MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
0388                          AA_MAY_SETATTR | AA_MAY_DELETE,
0389                          &cond_exchange);
0390             if (!error)
0391                 error = aa_path_perm(OP_RENAME_DEST, label, &old_path,
0392                              0, MAY_WRITE | AA_MAY_SETATTR |
0393                              AA_MAY_CREATE, &cond_exchange);
0394         }
0395 
0396         if (!error)
0397             error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0,
0398                          MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
0399                          AA_MAY_SETATTR | AA_MAY_DELETE,
0400                          &cond);
0401         if (!error)
0402             error = aa_path_perm(OP_RENAME_DEST, label, &new_path,
0403                          0, MAY_WRITE | AA_MAY_SETATTR |
0404                          AA_MAY_CREATE, &cond);
0405 
0406     }
0407     end_current_label_crit_section(label);
0408 
0409     return error;
0410 }
0411 
0412 static int apparmor_path_chmod(const struct path *path, umode_t mode)
0413 {
0414     return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD);
0415 }
0416 
0417 static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
0418 {
0419     return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN);
0420 }
0421 
0422 static int apparmor_inode_getattr(const struct path *path)
0423 {
0424     return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR);
0425 }
0426 
0427 static int apparmor_file_open(struct file *file)
0428 {
0429     struct aa_file_ctx *fctx = file_ctx(file);
0430     struct aa_label *label;
0431     int error = 0;
0432 
0433     if (!path_mediated_fs(file->f_path.dentry))
0434         return 0;
0435 
0436     /* If in exec, permission is handled by bprm hooks.
0437      * Cache permissions granted by the previous exec check, with
0438      * implicit read and executable mmap which are required to
0439      * actually execute the image.
0440      */
0441     if (current->in_execve) {
0442         fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
0443         return 0;
0444     }
0445 
0446     label = aa_get_newest_cred_label(file->f_cred);
0447     if (!unconfined(label)) {
0448         struct user_namespace *mnt_userns = file_mnt_user_ns(file);
0449         struct inode *inode = file_inode(file);
0450         struct path_cond cond = {
0451             i_uid_into_mnt(mnt_userns, inode),
0452             inode->i_mode
0453         };
0454 
0455         error = aa_path_perm(OP_OPEN, label, &file->f_path, 0,
0456                      aa_map_file_to_perms(file), &cond);
0457         /* todo cache full allowed permissions set and state */
0458         fctx->allow = aa_map_file_to_perms(file);
0459     }
0460     aa_put_label(label);
0461 
0462     return error;
0463 }
0464 
0465 static int apparmor_file_alloc_security(struct file *file)
0466 {
0467     struct aa_file_ctx *ctx = file_ctx(file);
0468     struct aa_label *label = begin_current_label_crit_section();
0469 
0470     spin_lock_init(&ctx->lock);
0471     rcu_assign_pointer(ctx->label, aa_get_label(label));
0472     end_current_label_crit_section(label);
0473     return 0;
0474 }
0475 
0476 static void apparmor_file_free_security(struct file *file)
0477 {
0478     struct aa_file_ctx *ctx = file_ctx(file);
0479 
0480     if (ctx)
0481         aa_put_label(rcu_access_pointer(ctx->label));
0482 }
0483 
0484 static int common_file_perm(const char *op, struct file *file, u32 mask,
0485                 bool in_atomic)
0486 {
0487     struct aa_label *label;
0488     int error = 0;
0489 
0490     /* don't reaudit files closed during inheritance */
0491     if (file->f_path.dentry == aa_null.dentry)
0492         return -EACCES;
0493 
0494     label = __begin_current_label_crit_section();
0495     error = aa_file_perm(op, label, file, mask, in_atomic);
0496     __end_current_label_crit_section(label);
0497 
0498     return error;
0499 }
0500 
0501 static int apparmor_file_receive(struct file *file)
0502 {
0503     return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file),
0504                 false);
0505 }
0506 
0507 static int apparmor_file_permission(struct file *file, int mask)
0508 {
0509     return common_file_perm(OP_FPERM, file, mask, false);
0510 }
0511 
0512 static int apparmor_file_lock(struct file *file, unsigned int cmd)
0513 {
0514     u32 mask = AA_MAY_LOCK;
0515 
0516     if (cmd == F_WRLCK)
0517         mask |= MAY_WRITE;
0518 
0519     return common_file_perm(OP_FLOCK, file, mask, false);
0520 }
0521 
0522 static int common_mmap(const char *op, struct file *file, unsigned long prot,
0523                unsigned long flags, bool in_atomic)
0524 {
0525     int mask = 0;
0526 
0527     if (!file || !file_ctx(file))
0528         return 0;
0529 
0530     if (prot & PROT_READ)
0531         mask |= MAY_READ;
0532     /*
0533      * Private mappings don't require write perms since they don't
0534      * write back to the files
0535      */
0536     if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
0537         mask |= MAY_WRITE;
0538     if (prot & PROT_EXEC)
0539         mask |= AA_EXEC_MMAP;
0540 
0541     return common_file_perm(op, file, mask, in_atomic);
0542 }
0543 
0544 static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
0545                   unsigned long prot, unsigned long flags)
0546 {
0547     return common_mmap(OP_FMMAP, file, prot, flags, GFP_ATOMIC);
0548 }
0549 
0550 static int apparmor_file_mprotect(struct vm_area_struct *vma,
0551                   unsigned long reqprot, unsigned long prot)
0552 {
0553     return common_mmap(OP_FMPROT, vma->vm_file, prot,
0554                !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0,
0555                false);
0556 }
0557 
0558 static int apparmor_sb_mount(const char *dev_name, const struct path *path,
0559                  const char *type, unsigned long flags, void *data)
0560 {
0561     struct aa_label *label;
0562     int error = 0;
0563 
0564     /* Discard magic */
0565     if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
0566         flags &= ~MS_MGC_MSK;
0567 
0568     flags &= ~AA_MS_IGNORE_MASK;
0569 
0570     label = __begin_current_label_crit_section();
0571     if (!unconfined(label)) {
0572         if (flags & MS_REMOUNT)
0573             error = aa_remount(label, path, flags, data);
0574         else if (flags & MS_BIND)
0575             error = aa_bind_mount(label, path, dev_name, flags);
0576         else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE |
0577                   MS_UNBINDABLE))
0578             error = aa_mount_change_type(label, path, flags);
0579         else if (flags & MS_MOVE)
0580             error = aa_move_mount(label, path, dev_name);
0581         else
0582             error = aa_new_mount(label, dev_name, path, type,
0583                          flags, data);
0584     }
0585     __end_current_label_crit_section(label);
0586 
0587     return error;
0588 }
0589 
0590 static int apparmor_sb_umount(struct vfsmount *mnt, int flags)
0591 {
0592     struct aa_label *label;
0593     int error = 0;
0594 
0595     label = __begin_current_label_crit_section();
0596     if (!unconfined(label))
0597         error = aa_umount(label, mnt, flags);
0598     __end_current_label_crit_section(label);
0599 
0600     return error;
0601 }
0602 
0603 static int apparmor_sb_pivotroot(const struct path *old_path,
0604                  const struct path *new_path)
0605 {
0606     struct aa_label *label;
0607     int error = 0;
0608 
0609     label = aa_get_current_label();
0610     if (!unconfined(label))
0611         error = aa_pivotroot(label, old_path, new_path);
0612     aa_put_label(label);
0613 
0614     return error;
0615 }
0616 
0617 static int apparmor_getprocattr(struct task_struct *task, char *name,
0618                 char **value)
0619 {
0620     int error = -ENOENT;
0621     /* released below */
0622     const struct cred *cred = get_task_cred(task);
0623     struct aa_task_ctx *ctx = task_ctx(current);
0624     struct aa_label *label = NULL;
0625 
0626     if (strcmp(name, "current") == 0)
0627         label = aa_get_newest_label(cred_label(cred));
0628     else if (strcmp(name, "prev") == 0  && ctx->previous)
0629         label = aa_get_newest_label(ctx->previous);
0630     else if (strcmp(name, "exec") == 0 && ctx->onexec)
0631         label = aa_get_newest_label(ctx->onexec);
0632     else
0633         error = -EINVAL;
0634 
0635     if (label)
0636         error = aa_getprocattr(label, value);
0637 
0638     aa_put_label(label);
0639     put_cred(cred);
0640 
0641     return error;
0642 }
0643 
0644 static int apparmor_setprocattr(const char *name, void *value,
0645                 size_t size)
0646 {
0647     char *command, *largs = NULL, *args = value;
0648     size_t arg_size;
0649     int error;
0650     DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR);
0651 
0652     if (size == 0)
0653         return -EINVAL;
0654 
0655     /* AppArmor requires that the buffer must be null terminated atm */
0656     if (args[size - 1] != '\0') {
0657         /* null terminate */
0658         largs = args = kmalloc(size + 1, GFP_KERNEL);
0659         if (!args)
0660             return -ENOMEM;
0661         memcpy(args, value, size);
0662         args[size] = '\0';
0663     }
0664 
0665     error = -EINVAL;
0666     args = strim(args);
0667     command = strsep(&args, " ");
0668     if (!args)
0669         goto out;
0670     args = skip_spaces(args);
0671     if (!*args)
0672         goto out;
0673 
0674     arg_size = size - (args - (largs ? largs : (char *) value));
0675     if (strcmp(name, "current") == 0) {
0676         if (strcmp(command, "changehat") == 0) {
0677             error = aa_setprocattr_changehat(args, arg_size,
0678                              AA_CHANGE_NOFLAGS);
0679         } else if (strcmp(command, "permhat") == 0) {
0680             error = aa_setprocattr_changehat(args, arg_size,
0681                              AA_CHANGE_TEST);
0682         } else if (strcmp(command, "changeprofile") == 0) {
0683             error = aa_change_profile(args, AA_CHANGE_NOFLAGS);
0684         } else if (strcmp(command, "permprofile") == 0) {
0685             error = aa_change_profile(args, AA_CHANGE_TEST);
0686         } else if (strcmp(command, "stack") == 0) {
0687             error = aa_change_profile(args, AA_CHANGE_STACK);
0688         } else
0689             goto fail;
0690     } else if (strcmp(name, "exec") == 0) {
0691         if (strcmp(command, "exec") == 0)
0692             error = aa_change_profile(args, AA_CHANGE_ONEXEC);
0693         else if (strcmp(command, "stack") == 0)
0694             error = aa_change_profile(args, (AA_CHANGE_ONEXEC |
0695                              AA_CHANGE_STACK));
0696         else
0697             goto fail;
0698     } else
0699         /* only support the "current" and "exec" process attributes */
0700         goto fail;
0701 
0702     if (!error)
0703         error = size;
0704 out:
0705     kfree(largs);
0706     return error;
0707 
0708 fail:
0709     aad(&sa)->label = begin_current_label_crit_section();
0710     aad(&sa)->info = name;
0711     aad(&sa)->error = error = -EINVAL;
0712     aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
0713     end_current_label_crit_section(aad(&sa)->label);
0714     goto out;
0715 }
0716 
0717 /**
0718  * apparmor_bprm_committing_creds - do task cleanup on committing new creds
0719  * @bprm: binprm for the exec  (NOT NULL)
0720  */
0721 static void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
0722 {
0723     struct aa_label *label = aa_current_raw_label();
0724     struct aa_label *new_label = cred_label(bprm->cred);
0725 
0726     /* bail out if unconfined or not changing profile */
0727     if ((new_label->proxy == label->proxy) ||
0728         (unconfined(new_label)))
0729         return;
0730 
0731     aa_inherit_files(bprm->cred, current->files);
0732 
0733     current->pdeath_signal = 0;
0734 
0735     /* reset soft limits and set hard limits for the new label */
0736     __aa_transition_rlimits(label, new_label);
0737 }
0738 
0739 /**
0740  * apparmor_bprm_committed_cred - do cleanup after new creds committed
0741  * @bprm: binprm for the exec  (NOT NULL)
0742  */
0743 static void apparmor_bprm_committed_creds(struct linux_binprm *bprm)
0744 {
0745     /* clear out temporary/transitional state from the context */
0746     aa_clear_task_ctx_trans(task_ctx(current));
0747 
0748     return;
0749 }
0750 
0751 static void apparmor_current_getsecid_subj(u32 *secid)
0752 {
0753     struct aa_label *label = aa_get_current_label();
0754     *secid = label->secid;
0755     aa_put_label(label);
0756 }
0757 
0758 static void apparmor_task_getsecid_obj(struct task_struct *p, u32 *secid)
0759 {
0760     struct aa_label *label = aa_get_task_label(p);
0761     *secid = label->secid;
0762     aa_put_label(label);
0763 }
0764 
0765 static int apparmor_task_setrlimit(struct task_struct *task,
0766         unsigned int resource, struct rlimit *new_rlim)
0767 {
0768     struct aa_label *label = __begin_current_label_crit_section();
0769     int error = 0;
0770 
0771     if (!unconfined(label))
0772         error = aa_task_setrlimit(label, task, resource, new_rlim);
0773     __end_current_label_crit_section(label);
0774 
0775     return error;
0776 }
0777 
0778 static int apparmor_task_kill(struct task_struct *target, struct kernel_siginfo *info,
0779                   int sig, const struct cred *cred)
0780 {
0781     struct aa_label *cl, *tl;
0782     int error;
0783 
0784     if (cred) {
0785         /*
0786          * Dealing with USB IO specific behavior
0787          */
0788         cl = aa_get_newest_cred_label(cred);
0789         tl = aa_get_task_label(target);
0790         error = aa_may_signal(cl, tl, sig);
0791         aa_put_label(cl);
0792         aa_put_label(tl);
0793         return error;
0794     }
0795 
0796     cl = __begin_current_label_crit_section();
0797     tl = aa_get_task_label(target);
0798     error = aa_may_signal(cl, tl, sig);
0799     aa_put_label(tl);
0800     __end_current_label_crit_section(cl);
0801 
0802     return error;
0803 }
0804 
0805 /**
0806  * apparmor_sk_alloc_security - allocate and attach the sk_security field
0807  */
0808 static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
0809 {
0810     struct aa_sk_ctx *ctx;
0811 
0812     ctx = kzalloc(sizeof(*ctx), flags);
0813     if (!ctx)
0814         return -ENOMEM;
0815 
0816     SK_CTX(sk) = ctx;
0817 
0818     return 0;
0819 }
0820 
0821 /**
0822  * apparmor_sk_free_security - free the sk_security field
0823  */
0824 static void apparmor_sk_free_security(struct sock *sk)
0825 {
0826     struct aa_sk_ctx *ctx = SK_CTX(sk);
0827 
0828     SK_CTX(sk) = NULL;
0829     aa_put_label(ctx->label);
0830     aa_put_label(ctx->peer);
0831     kfree(ctx);
0832 }
0833 
0834 /**
0835  * apparmor_sk_clone_security - clone the sk_security field
0836  */
0837 static void apparmor_sk_clone_security(const struct sock *sk,
0838                        struct sock *newsk)
0839 {
0840     struct aa_sk_ctx *ctx = SK_CTX(sk);
0841     struct aa_sk_ctx *new = SK_CTX(newsk);
0842 
0843     if (new->label)
0844         aa_put_label(new->label);
0845     new->label = aa_get_label(ctx->label);
0846 
0847     if (new->peer)
0848         aa_put_label(new->peer);
0849     new->peer = aa_get_label(ctx->peer);
0850 }
0851 
0852 /**
0853  * apparmor_socket_create - check perms before creating a new socket
0854  */
0855 static int apparmor_socket_create(int family, int type, int protocol, int kern)
0856 {
0857     struct aa_label *label;
0858     int error = 0;
0859 
0860     AA_BUG(in_interrupt());
0861 
0862     label = begin_current_label_crit_section();
0863     if (!(kern || unconfined(label)))
0864         error = af_select(family,
0865                   create_perm(label, family, type, protocol),
0866                   aa_af_perm(label, OP_CREATE, AA_MAY_CREATE,
0867                          family, type, protocol));
0868     end_current_label_crit_section(label);
0869 
0870     return error;
0871 }
0872 
0873 /**
0874  * apparmor_socket_post_create - setup the per-socket security struct
0875  *
0876  * Note:
0877  * -   kernel sockets currently labeled unconfined but we may want to
0878  *     move to a special kernel label
0879  * -   socket may not have sk here if created with sock_create_lite or
0880  *     sock_alloc. These should be accept cases which will be handled in
0881  *     sock_graft.
0882  */
0883 static int apparmor_socket_post_create(struct socket *sock, int family,
0884                        int type, int protocol, int kern)
0885 {
0886     struct aa_label *label;
0887 
0888     if (kern) {
0889         label = aa_get_label(kernel_t);
0890     } else
0891         label = aa_get_current_label();
0892 
0893     if (sock->sk) {
0894         struct aa_sk_ctx *ctx = SK_CTX(sock->sk);
0895 
0896         aa_put_label(ctx->label);
0897         ctx->label = aa_get_label(label);
0898     }
0899     aa_put_label(label);
0900 
0901     return 0;
0902 }
0903 
0904 /**
0905  * apparmor_socket_bind - check perms before bind addr to socket
0906  */
0907 static int apparmor_socket_bind(struct socket *sock,
0908                 struct sockaddr *address, int addrlen)
0909 {
0910     AA_BUG(!sock);
0911     AA_BUG(!sock->sk);
0912     AA_BUG(!address);
0913     AA_BUG(in_interrupt());
0914 
0915     return af_select(sock->sk->sk_family,
0916              bind_perm(sock, address, addrlen),
0917              aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk));
0918 }
0919 
0920 /**
0921  * apparmor_socket_connect - check perms before connecting @sock to @address
0922  */
0923 static int apparmor_socket_connect(struct socket *sock,
0924                    struct sockaddr *address, int addrlen)
0925 {
0926     AA_BUG(!sock);
0927     AA_BUG(!sock->sk);
0928     AA_BUG(!address);
0929     AA_BUG(in_interrupt());
0930 
0931     return af_select(sock->sk->sk_family,
0932              connect_perm(sock, address, addrlen),
0933              aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk));
0934 }
0935 
0936 /**
0937  * apparmor_socket_listen - check perms before allowing listen
0938  */
0939 static int apparmor_socket_listen(struct socket *sock, int backlog)
0940 {
0941     AA_BUG(!sock);
0942     AA_BUG(!sock->sk);
0943     AA_BUG(in_interrupt());
0944 
0945     return af_select(sock->sk->sk_family,
0946              listen_perm(sock, backlog),
0947              aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk));
0948 }
0949 
0950 /**
0951  * apparmor_socket_accept - check perms before accepting a new connection.
0952  *
0953  * Note: while @newsock is created and has some information, the accept
0954  *       has not been done.
0955  */
0956 static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
0957 {
0958     AA_BUG(!sock);
0959     AA_BUG(!sock->sk);
0960     AA_BUG(!newsock);
0961     AA_BUG(in_interrupt());
0962 
0963     return af_select(sock->sk->sk_family,
0964              accept_perm(sock, newsock),
0965              aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk));
0966 }
0967 
0968 static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock,
0969                 struct msghdr *msg, int size)
0970 {
0971     AA_BUG(!sock);
0972     AA_BUG(!sock->sk);
0973     AA_BUG(!msg);
0974     AA_BUG(in_interrupt());
0975 
0976     return af_select(sock->sk->sk_family,
0977              msg_perm(op, request, sock, msg, size),
0978              aa_sk_perm(op, request, sock->sk));
0979 }
0980 
0981 /**
0982  * apparmor_socket_sendmsg - check perms before sending msg to another socket
0983  */
0984 static int apparmor_socket_sendmsg(struct socket *sock,
0985                    struct msghdr *msg, int size)
0986 {
0987     return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
0988 }
0989 
0990 /**
0991  * apparmor_socket_recvmsg - check perms before receiving a message
0992  */
0993 static int apparmor_socket_recvmsg(struct socket *sock,
0994                    struct msghdr *msg, int size, int flags)
0995 {
0996     return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size);
0997 }
0998 
0999 /* revaliation, get/set attr, shutdown */
1000 static int aa_sock_perm(const char *op, u32 request, struct socket *sock)
1001 {
1002     AA_BUG(!sock);
1003     AA_BUG(!sock->sk);
1004     AA_BUG(in_interrupt());
1005 
1006     return af_select(sock->sk->sk_family,
1007              sock_perm(op, request, sock),
1008              aa_sk_perm(op, request, sock->sk));
1009 }
1010 
1011 /**
1012  * apparmor_socket_getsockname - check perms before getting the local address
1013  */
1014 static int apparmor_socket_getsockname(struct socket *sock)
1015 {
1016     return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock);
1017 }
1018 
1019 /**
1020  * apparmor_socket_getpeername - check perms before getting remote address
1021  */
1022 static int apparmor_socket_getpeername(struct socket *sock)
1023 {
1024     return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock);
1025 }
1026 
1027 /* revaliation, get/set attr, opt */
1028 static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock,
1029                 int level, int optname)
1030 {
1031     AA_BUG(!sock);
1032     AA_BUG(!sock->sk);
1033     AA_BUG(in_interrupt());
1034 
1035     return af_select(sock->sk->sk_family,
1036              opt_perm(op, request, sock, level, optname),
1037              aa_sk_perm(op, request, sock->sk));
1038 }
1039 
1040 /**
1041  * apparmor_socket_getsockopt - check perms before getting socket options
1042  */
1043 static int apparmor_socket_getsockopt(struct socket *sock, int level,
1044                       int optname)
1045 {
1046     return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock,
1047                 level, optname);
1048 }
1049 
1050 /**
1051  * apparmor_socket_setsockopt - check perms before setting socket options
1052  */
1053 static int apparmor_socket_setsockopt(struct socket *sock, int level,
1054                       int optname)
1055 {
1056     return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock,
1057                 level, optname);
1058 }
1059 
1060 /**
1061  * apparmor_socket_shutdown - check perms before shutting down @sock conn
1062  */
1063 static int apparmor_socket_shutdown(struct socket *sock, int how)
1064 {
1065     return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock);
1066 }
1067 
1068 #ifdef CONFIG_NETWORK_SECMARK
1069 /**
1070  * apparmor_socket_sock_rcv_skb - check perms before associating skb to sk
1071  *
1072  * Note: can not sleep may be called with locks held
1073  *
1074  * dont want protocol specific in __skb_recv_datagram()
1075  * to deny an incoming connection  socket_sock_rcv_skb()
1076  */
1077 static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
1078 {
1079     struct aa_sk_ctx *ctx = SK_CTX(sk);
1080 
1081     if (!skb->secmark)
1082         return 0;
1083 
1084     return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE,
1085                       skb->secmark, sk);
1086 }
1087 #endif
1088 
1089 
1090 static struct aa_label *sk_peer_label(struct sock *sk)
1091 {
1092     struct aa_sk_ctx *ctx = SK_CTX(sk);
1093 
1094     if (ctx->peer)
1095         return ctx->peer;
1096 
1097     return ERR_PTR(-ENOPROTOOPT);
1098 }
1099 
1100 /**
1101  * apparmor_socket_getpeersec_stream - get security context of peer
1102  *
1103  * Note: for tcp only valid if using ipsec or cipso on lan
1104  */
1105 static int apparmor_socket_getpeersec_stream(struct socket *sock,
1106                          char __user *optval,
1107                          int __user *optlen,
1108                          unsigned int len)
1109 {
1110     char *name;
1111     int slen, error = 0;
1112     struct aa_label *label;
1113     struct aa_label *peer;
1114 
1115     label = begin_current_label_crit_section();
1116     peer = sk_peer_label(sock->sk);
1117     if (IS_ERR(peer)) {
1118         error = PTR_ERR(peer);
1119         goto done;
1120     }
1121     slen = aa_label_asxprint(&name, labels_ns(label), peer,
1122                  FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
1123                  FLAG_HIDDEN_UNCONFINED, GFP_KERNEL);
1124     /* don't include terminating \0 in slen, it breaks some apps */
1125     if (slen < 0) {
1126         error = -ENOMEM;
1127     } else {
1128         if (slen > len) {
1129             error = -ERANGE;
1130         } else if (copy_to_user(optval, name, slen)) {
1131             error = -EFAULT;
1132             goto out;
1133         }
1134         if (put_user(slen, optlen))
1135             error = -EFAULT;
1136 out:
1137         kfree(name);
1138 
1139     }
1140 
1141 done:
1142     end_current_label_crit_section(label);
1143 
1144     return error;
1145 }
1146 
1147 /**
1148  * apparmor_socket_getpeersec_dgram - get security label of packet
1149  * @sock: the peer socket
1150  * @skb: packet data
1151  * @secid: pointer to where to put the secid of the packet
1152  *
1153  * Sets the netlabel socket state on sk from parent
1154  */
1155 static int apparmor_socket_getpeersec_dgram(struct socket *sock,
1156                         struct sk_buff *skb, u32 *secid)
1157 
1158 {
1159     /* TODO: requires secid support */
1160     return -ENOPROTOOPT;
1161 }
1162 
1163 /**
1164  * apparmor_sock_graft - Initialize newly created socket
1165  * @sk: child sock
1166  * @parent: parent socket
1167  *
1168  * Note: could set off of SOCK_CTX(parent) but need to track inode and we can
1169  *       just set sk security information off of current creating process label
1170  *       Labeling of sk for accept case - probably should be sock based
1171  *       instead of task, because of the case where an implicitly labeled
1172  *       socket is shared by different tasks.
1173  */
1174 static void apparmor_sock_graft(struct sock *sk, struct socket *parent)
1175 {
1176     struct aa_sk_ctx *ctx = SK_CTX(sk);
1177 
1178     if (!ctx->label)
1179         ctx->label = aa_get_current_label();
1180 }
1181 
1182 #ifdef CONFIG_NETWORK_SECMARK
1183 static int apparmor_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
1184                       struct request_sock *req)
1185 {
1186     struct aa_sk_ctx *ctx = SK_CTX(sk);
1187 
1188     if (!skb->secmark)
1189         return 0;
1190 
1191     return apparmor_secmark_check(ctx->label, OP_CONNECT, AA_MAY_CONNECT,
1192                       skb->secmark, sk);
1193 }
1194 #endif
1195 
1196 /*
1197  * The cred blob is a pointer to, not an instance of, an aa_task_ctx.
1198  */
1199 struct lsm_blob_sizes apparmor_blob_sizes __lsm_ro_after_init = {
1200     .lbs_cred = sizeof(struct aa_task_ctx *),
1201     .lbs_file = sizeof(struct aa_file_ctx),
1202     .lbs_task = sizeof(struct aa_task_ctx),
1203 };
1204 
1205 static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
1206     LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
1207     LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
1208     LSM_HOOK_INIT(capget, apparmor_capget),
1209     LSM_HOOK_INIT(capable, apparmor_capable),
1210 
1211     LSM_HOOK_INIT(sb_mount, apparmor_sb_mount),
1212     LSM_HOOK_INIT(sb_umount, apparmor_sb_umount),
1213     LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot),
1214 
1215     LSM_HOOK_INIT(path_link, apparmor_path_link),
1216     LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
1217     LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
1218     LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
1219     LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
1220     LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
1221     LSM_HOOK_INIT(path_rename, apparmor_path_rename),
1222     LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
1223     LSM_HOOK_INIT(path_chown, apparmor_path_chown),
1224     LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
1225     LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
1226 
1227     LSM_HOOK_INIT(file_open, apparmor_file_open),
1228     LSM_HOOK_INIT(file_receive, apparmor_file_receive),
1229     LSM_HOOK_INIT(file_permission, apparmor_file_permission),
1230     LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
1231     LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
1232     LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
1233     LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
1234     LSM_HOOK_INIT(file_lock, apparmor_file_lock),
1235 
1236     LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
1237     LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
1238 
1239     LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
1240     LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
1241     LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
1242 
1243     LSM_HOOK_INIT(socket_create, apparmor_socket_create),
1244     LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
1245     LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
1246     LSM_HOOK_INIT(socket_connect, apparmor_socket_connect),
1247     LSM_HOOK_INIT(socket_listen, apparmor_socket_listen),
1248     LSM_HOOK_INIT(socket_accept, apparmor_socket_accept),
1249     LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg),
1250     LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg),
1251     LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname),
1252     LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername),
1253     LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
1254     LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
1255     LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
1256 #ifdef CONFIG_NETWORK_SECMARK
1257     LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
1258 #endif
1259     LSM_HOOK_INIT(socket_getpeersec_stream,
1260               apparmor_socket_getpeersec_stream),
1261     LSM_HOOK_INIT(socket_getpeersec_dgram,
1262               apparmor_socket_getpeersec_dgram),
1263     LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
1264 #ifdef CONFIG_NETWORK_SECMARK
1265     LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
1266 #endif
1267 
1268     LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
1269     LSM_HOOK_INIT(cred_free, apparmor_cred_free),
1270     LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
1271     LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
1272 
1273     LSM_HOOK_INIT(bprm_creds_for_exec, apparmor_bprm_creds_for_exec),
1274     LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
1275     LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
1276 
1277     LSM_HOOK_INIT(task_free, apparmor_task_free),
1278     LSM_HOOK_INIT(task_alloc, apparmor_task_alloc),
1279     LSM_HOOK_INIT(current_getsecid_subj, apparmor_current_getsecid_subj),
1280     LSM_HOOK_INIT(task_getsecid_obj, apparmor_task_getsecid_obj),
1281     LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
1282     LSM_HOOK_INIT(task_kill, apparmor_task_kill),
1283 
1284 #ifdef CONFIG_AUDIT
1285     LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init),
1286     LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known),
1287     LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match),
1288     LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free),
1289 #endif
1290 
1291     LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),
1292     LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),
1293     LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),
1294 };
1295 
1296 /*
1297  * AppArmor sysfs module parameters
1298  */
1299 
1300 static int param_set_aabool(const char *val, const struct kernel_param *kp);
1301 static int param_get_aabool(char *buffer, const struct kernel_param *kp);
1302 #define param_check_aabool param_check_bool
1303 static const struct kernel_param_ops param_ops_aabool = {
1304     .flags = KERNEL_PARAM_OPS_FL_NOARG,
1305     .set = param_set_aabool,
1306     .get = param_get_aabool
1307 };
1308 
1309 static int param_set_aauint(const char *val, const struct kernel_param *kp);
1310 static int param_get_aauint(char *buffer, const struct kernel_param *kp);
1311 #define param_check_aauint param_check_uint
1312 static const struct kernel_param_ops param_ops_aauint = {
1313     .set = param_set_aauint,
1314     .get = param_get_aauint
1315 };
1316 
1317 static int param_set_aacompressionlevel(const char *val,
1318                     const struct kernel_param *kp);
1319 static int param_get_aacompressionlevel(char *buffer,
1320                     const struct kernel_param *kp);
1321 #define param_check_aacompressionlevel param_check_int
1322 static const struct kernel_param_ops param_ops_aacompressionlevel = {
1323     .set = param_set_aacompressionlevel,
1324     .get = param_get_aacompressionlevel
1325 };
1326 
1327 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
1328 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
1329 #define param_check_aalockpolicy param_check_bool
1330 static const struct kernel_param_ops param_ops_aalockpolicy = {
1331     .flags = KERNEL_PARAM_OPS_FL_NOARG,
1332     .set = param_set_aalockpolicy,
1333     .get = param_get_aalockpolicy
1334 };
1335 
1336 static int param_set_audit(const char *val, const struct kernel_param *kp);
1337 static int param_get_audit(char *buffer, const struct kernel_param *kp);
1338 
1339 static int param_set_mode(const char *val, const struct kernel_param *kp);
1340 static int param_get_mode(char *buffer, const struct kernel_param *kp);
1341 
1342 /* Flag values, also controllable via /sys/module/apparmor/parameters
1343  * We define special types as we want to do additional mediation.
1344  */
1345 
1346 /* AppArmor global enforcement switch - complain, enforce, kill */
1347 enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
1348 module_param_call(mode, param_set_mode, param_get_mode,
1349           &aa_g_profile_mode, S_IRUSR | S_IWUSR);
1350 
1351 /* whether policy verification hashing is enabled */
1352 bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
1353 #ifdef CONFIG_SECURITY_APPARMOR_HASH
1354 module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
1355 #endif
1356 
1357 /* whether policy exactly as loaded is retained for debug and checkpointing */
1358 bool aa_g_export_binary = IS_ENABLED(CONFIG_SECURITY_APPARMOR_EXPORT_BINARY);
1359 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1360 module_param_named(export_binary, aa_g_export_binary, aabool, 0600);
1361 #endif
1362 
1363 /* policy loaddata compression level */
1364 int aa_g_rawdata_compression_level = Z_DEFAULT_COMPRESSION;
1365 module_param_named(rawdata_compression_level, aa_g_rawdata_compression_level,
1366            aacompressionlevel, 0400);
1367 
1368 /* Debug mode */
1369 bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES);
1370 module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
1371 
1372 /* Audit mode */
1373 enum audit_mode aa_g_audit;
1374 module_param_call(audit, param_set_audit, param_get_audit,
1375           &aa_g_audit, S_IRUSR | S_IWUSR);
1376 
1377 /* Determines if audit header is included in audited messages.  This
1378  * provides more context if the audit daemon is not running
1379  */
1380 bool aa_g_audit_header = true;
1381 module_param_named(audit_header, aa_g_audit_header, aabool,
1382            S_IRUSR | S_IWUSR);
1383 
1384 /* lock out loading/removal of policy
1385  * TODO: add in at boot loading of policy, which is the only way to
1386  *       load policy, if lock_policy is set
1387  */
1388 bool aa_g_lock_policy;
1389 module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
1390            S_IRUSR | S_IWUSR);
1391 
1392 /* Syscall logging mode */
1393 bool aa_g_logsyscall;
1394 module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
1395 
1396 /* Maximum pathname length before accesses will start getting rejected */
1397 unsigned int aa_g_path_max = 2 * PATH_MAX;
1398 module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
1399 
1400 /* Determines how paranoid loading of policy is and how much verification
1401  * on the loaded policy is done.
1402  * DEPRECATED: read only as strict checking of load is always done now
1403  * that none root users (user namespaces) can load policy.
1404  */
1405 bool aa_g_paranoid_load = IS_ENABLED(CONFIG_SECURITY_APPARMOR_PARANOID_LOAD);
1406 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
1407 
1408 static int param_get_aaintbool(char *buffer, const struct kernel_param *kp);
1409 static int param_set_aaintbool(const char *val, const struct kernel_param *kp);
1410 #define param_check_aaintbool param_check_int
1411 static const struct kernel_param_ops param_ops_aaintbool = {
1412     .set = param_set_aaintbool,
1413     .get = param_get_aaintbool
1414 };
1415 /* Boot time disable flag */
1416 static int apparmor_enabled __lsm_ro_after_init = 1;
1417 module_param_named(enabled, apparmor_enabled, aaintbool, 0444);
1418 
1419 static int __init apparmor_enabled_setup(char *str)
1420 {
1421     unsigned long enabled;
1422     int error = kstrtoul(str, 0, &enabled);
1423     if (!error)
1424         apparmor_enabled = enabled ? 1 : 0;
1425     return 1;
1426 }
1427 
1428 __setup("apparmor=", apparmor_enabled_setup);
1429 
1430 /* set global flag turning off the ability to load policy */
1431 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
1432 {
1433     if (!apparmor_enabled)
1434         return -EINVAL;
1435     if (apparmor_initialized && !aa_current_policy_admin_capable(NULL))
1436         return -EPERM;
1437     return param_set_bool(val, kp);
1438 }
1439 
1440 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
1441 {
1442     if (!apparmor_enabled)
1443         return -EINVAL;
1444     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1445         return -EPERM;
1446     return param_get_bool(buffer, kp);
1447 }
1448 
1449 static int param_set_aabool(const char *val, const struct kernel_param *kp)
1450 {
1451     if (!apparmor_enabled)
1452         return -EINVAL;
1453     if (apparmor_initialized && !aa_current_policy_admin_capable(NULL))
1454         return -EPERM;
1455     return param_set_bool(val, kp);
1456 }
1457 
1458 static int param_get_aabool(char *buffer, const struct kernel_param *kp)
1459 {
1460     if (!apparmor_enabled)
1461         return -EINVAL;
1462     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1463         return -EPERM;
1464     return param_get_bool(buffer, kp);
1465 }
1466 
1467 static int param_set_aauint(const char *val, const struct kernel_param *kp)
1468 {
1469     int error;
1470 
1471     if (!apparmor_enabled)
1472         return -EINVAL;
1473     /* file is ro but enforce 2nd line check */
1474     if (apparmor_initialized)
1475         return -EPERM;
1476 
1477     error = param_set_uint(val, kp);
1478     aa_g_path_max = max_t(uint32_t, aa_g_path_max, sizeof(union aa_buffer));
1479     pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max);
1480 
1481     return error;
1482 }
1483 
1484 static int param_get_aauint(char *buffer, const struct kernel_param *kp)
1485 {
1486     if (!apparmor_enabled)
1487         return -EINVAL;
1488     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1489         return -EPERM;
1490     return param_get_uint(buffer, kp);
1491 }
1492 
1493 /* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */
1494 static int param_set_aaintbool(const char *val, const struct kernel_param *kp)
1495 {
1496     struct kernel_param kp_local;
1497     bool value;
1498     int error;
1499 
1500     if (apparmor_initialized)
1501         return -EPERM;
1502 
1503     /* Create local copy, with arg pointing to bool type. */
1504     value = !!*((int *)kp->arg);
1505     memcpy(&kp_local, kp, sizeof(kp_local));
1506     kp_local.arg = &value;
1507 
1508     error = param_set_bool(val, &kp_local);
1509     if (!error)
1510         *((int *)kp->arg) = *((bool *)kp_local.arg);
1511     return error;
1512 }
1513 
1514 /*
1515  * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to
1516  * 1/0, this converts the "int that is actually bool" back to bool for
1517  * display in the /sys filesystem, while keeping it "int" for the LSM
1518  * infrastructure.
1519  */
1520 static int param_get_aaintbool(char *buffer, const struct kernel_param *kp)
1521 {
1522     struct kernel_param kp_local;
1523     bool value;
1524 
1525     /* Create local copy, with arg pointing to bool type. */
1526     value = !!*((int *)kp->arg);
1527     memcpy(&kp_local, kp, sizeof(kp_local));
1528     kp_local.arg = &value;
1529 
1530     return param_get_bool(buffer, &kp_local);
1531 }
1532 
1533 static int param_set_aacompressionlevel(const char *val,
1534                     const struct kernel_param *kp)
1535 {
1536     int error;
1537 
1538     if (!apparmor_enabled)
1539         return -EINVAL;
1540     if (apparmor_initialized)
1541         return -EPERM;
1542 
1543     error = param_set_int(val, kp);
1544 
1545     aa_g_rawdata_compression_level = clamp(aa_g_rawdata_compression_level,
1546                            Z_NO_COMPRESSION,
1547                            Z_BEST_COMPRESSION);
1548     pr_info("AppArmor: policy rawdata compression level set to %u\n",
1549         aa_g_rawdata_compression_level);
1550 
1551     return error;
1552 }
1553 
1554 static int param_get_aacompressionlevel(char *buffer,
1555                     const struct kernel_param *kp)
1556 {
1557     if (!apparmor_enabled)
1558         return -EINVAL;
1559     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1560         return -EPERM;
1561     return param_get_int(buffer, kp);
1562 }
1563 
1564 static int param_get_audit(char *buffer, const struct kernel_param *kp)
1565 {
1566     if (!apparmor_enabled)
1567         return -EINVAL;
1568     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1569         return -EPERM;
1570     return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
1571 }
1572 
1573 static int param_set_audit(const char *val, const struct kernel_param *kp)
1574 {
1575     int i;
1576 
1577     if (!apparmor_enabled)
1578         return -EINVAL;
1579     if (!val)
1580         return -EINVAL;
1581     if (apparmor_initialized && !aa_current_policy_admin_capable(NULL))
1582         return -EPERM;
1583 
1584     i = match_string(audit_mode_names, AUDIT_MAX_INDEX, val);
1585     if (i < 0)
1586         return -EINVAL;
1587 
1588     aa_g_audit = i;
1589     return 0;
1590 }
1591 
1592 static int param_get_mode(char *buffer, const struct kernel_param *kp)
1593 {
1594     if (!apparmor_enabled)
1595         return -EINVAL;
1596     if (apparmor_initialized && !aa_current_policy_view_capable(NULL))
1597         return -EPERM;
1598 
1599     return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
1600 }
1601 
1602 static int param_set_mode(const char *val, const struct kernel_param *kp)
1603 {
1604     int i;
1605 
1606     if (!apparmor_enabled)
1607         return -EINVAL;
1608     if (!val)
1609         return -EINVAL;
1610     if (apparmor_initialized && !aa_current_policy_admin_capable(NULL))
1611         return -EPERM;
1612 
1613     i = match_string(aa_profile_mode_names, APPARMOR_MODE_NAMES_MAX_INDEX,
1614              val);
1615     if (i < 0)
1616         return -EINVAL;
1617 
1618     aa_g_profile_mode = i;
1619     return 0;
1620 }
1621 
1622 char *aa_get_buffer(bool in_atomic)
1623 {
1624     union aa_buffer *aa_buf;
1625     bool try_again = true;
1626     gfp_t flags = (GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
1627 
1628 retry:
1629     spin_lock(&aa_buffers_lock);
1630     if (buffer_count > reserve_count ||
1631         (in_atomic && !list_empty(&aa_global_buffers))) {
1632         aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer,
1633                       list);
1634         list_del(&aa_buf->list);
1635         buffer_count--;
1636         spin_unlock(&aa_buffers_lock);
1637         return &aa_buf->buffer[0];
1638     }
1639     if (in_atomic) {
1640         /*
1641          * out of reserve buffers and in atomic context so increase
1642          * how many buffers to keep in reserve
1643          */
1644         reserve_count++;
1645         flags = GFP_ATOMIC;
1646     }
1647     spin_unlock(&aa_buffers_lock);
1648 
1649     if (!in_atomic)
1650         might_sleep();
1651     aa_buf = kmalloc(aa_g_path_max, flags);
1652     if (!aa_buf) {
1653         if (try_again) {
1654             try_again = false;
1655             goto retry;
1656         }
1657         pr_warn_once("AppArmor: Failed to allocate a memory buffer.\n");
1658         return NULL;
1659     }
1660     return &aa_buf->buffer[0];
1661 }
1662 
1663 void aa_put_buffer(char *buf)
1664 {
1665     union aa_buffer *aa_buf;
1666 
1667     if (!buf)
1668         return;
1669     aa_buf = container_of(buf, union aa_buffer, buffer[0]);
1670 
1671     spin_lock(&aa_buffers_lock);
1672     list_add(&aa_buf->list, &aa_global_buffers);
1673     buffer_count++;
1674     spin_unlock(&aa_buffers_lock);
1675 }
1676 
1677 /*
1678  * AppArmor init functions
1679  */
1680 
1681 /**
1682  * set_init_ctx - set a task context and profile on the first task.
1683  *
1684  * TODO: allow setting an alternate profile than unconfined
1685  */
1686 static int __init set_init_ctx(void)
1687 {
1688     struct cred *cred = (__force struct cred *)current->real_cred;
1689 
1690     set_cred_label(cred, aa_get_label(ns_unconfined(root_ns)));
1691 
1692     return 0;
1693 }
1694 
1695 static void destroy_buffers(void)
1696 {
1697     union aa_buffer *aa_buf;
1698 
1699     spin_lock(&aa_buffers_lock);
1700     while (!list_empty(&aa_global_buffers)) {
1701         aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer,
1702                      list);
1703         list_del(&aa_buf->list);
1704         spin_unlock(&aa_buffers_lock);
1705         kfree(aa_buf);
1706         spin_lock(&aa_buffers_lock);
1707     }
1708     spin_unlock(&aa_buffers_lock);
1709 }
1710 
1711 static int __init alloc_buffers(void)
1712 {
1713     union aa_buffer *aa_buf;
1714     int i, num;
1715 
1716     /*
1717      * A function may require two buffers at once. Usually the buffers are
1718      * used for a short period of time and are shared. On UP kernel buffers
1719      * two should be enough, with more CPUs it is possible that more
1720      * buffers will be used simultaneously. The preallocated pool may grow.
1721      * This preallocation has also the side-effect that AppArmor will be
1722      * disabled early at boot if aa_g_path_max is extremly high.
1723      */
1724     if (num_online_cpus() > 1)
1725         num = 4 + RESERVE_COUNT;
1726     else
1727         num = 2 + RESERVE_COUNT;
1728 
1729     for (i = 0; i < num; i++) {
1730 
1731         aa_buf = kmalloc(aa_g_path_max, GFP_KERNEL |
1732                  __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
1733         if (!aa_buf) {
1734             destroy_buffers();
1735             return -ENOMEM;
1736         }
1737         aa_put_buffer(&aa_buf->buffer[0]);
1738     }
1739     return 0;
1740 }
1741 
1742 #ifdef CONFIG_SYSCTL
1743 static int apparmor_dointvec(struct ctl_table *table, int write,
1744                  void *buffer, size_t *lenp, loff_t *ppos)
1745 {
1746     if (!aa_current_policy_admin_capable(NULL))
1747         return -EPERM;
1748     if (!apparmor_enabled)
1749         return -EINVAL;
1750 
1751     return proc_dointvec(table, write, buffer, lenp, ppos);
1752 }
1753 
1754 static struct ctl_path apparmor_sysctl_path[] = {
1755     { .procname = "kernel", },
1756     { }
1757 };
1758 
1759 static struct ctl_table apparmor_sysctl_table[] = {
1760     {
1761         .procname       = "unprivileged_userns_apparmor_policy",
1762         .data           = &unprivileged_userns_apparmor_policy,
1763         .maxlen         = sizeof(int),
1764         .mode           = 0600,
1765         .proc_handler   = apparmor_dointvec,
1766     },
1767     {
1768         .procname       = "apparmor_display_secid_mode",
1769         .data           = &apparmor_display_secid_mode,
1770         .maxlen         = sizeof(int),
1771         .mode           = 0600,
1772         .proc_handler   = apparmor_dointvec,
1773     },
1774 
1775     { }
1776 };
1777 
1778 static int __init apparmor_init_sysctl(void)
1779 {
1780     return register_sysctl_paths(apparmor_sysctl_path,
1781                      apparmor_sysctl_table) ? 0 : -ENOMEM;
1782 }
1783 #else
1784 static inline int apparmor_init_sysctl(void)
1785 {
1786     return 0;
1787 }
1788 #endif /* CONFIG_SYSCTL */
1789 
1790 #if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK)
1791 static unsigned int apparmor_ip_postroute(void *priv,
1792                       struct sk_buff *skb,
1793                       const struct nf_hook_state *state)
1794 {
1795     struct aa_sk_ctx *ctx;
1796     struct sock *sk;
1797 
1798     if (!skb->secmark)
1799         return NF_ACCEPT;
1800 
1801     sk = skb_to_full_sk(skb);
1802     if (sk == NULL)
1803         return NF_ACCEPT;
1804 
1805     ctx = SK_CTX(sk);
1806     if (!apparmor_secmark_check(ctx->label, OP_SENDMSG, AA_MAY_SEND,
1807                     skb->secmark, sk))
1808         return NF_ACCEPT;
1809 
1810     return NF_DROP_ERR(-ECONNREFUSED);
1811 
1812 }
1813 
1814 static const struct nf_hook_ops apparmor_nf_ops[] = {
1815     {
1816         .hook =         apparmor_ip_postroute,
1817         .pf =           NFPROTO_IPV4,
1818         .hooknum =      NF_INET_POST_ROUTING,
1819         .priority =     NF_IP_PRI_SELINUX_FIRST,
1820     },
1821 #if IS_ENABLED(CONFIG_IPV6)
1822     {
1823         .hook =         apparmor_ip_postroute,
1824         .pf =           NFPROTO_IPV6,
1825         .hooknum =      NF_INET_POST_ROUTING,
1826         .priority =     NF_IP6_PRI_SELINUX_FIRST,
1827     },
1828 #endif
1829 };
1830 
1831 static int __net_init apparmor_nf_register(struct net *net)
1832 {
1833     return nf_register_net_hooks(net, apparmor_nf_ops,
1834                     ARRAY_SIZE(apparmor_nf_ops));
1835 }
1836 
1837 static void __net_exit apparmor_nf_unregister(struct net *net)
1838 {
1839     nf_unregister_net_hooks(net, apparmor_nf_ops,
1840                 ARRAY_SIZE(apparmor_nf_ops));
1841 }
1842 
1843 static struct pernet_operations apparmor_net_ops = {
1844     .init = apparmor_nf_register,
1845     .exit = apparmor_nf_unregister,
1846 };
1847 
1848 static int __init apparmor_nf_ip_init(void)
1849 {
1850     int err;
1851 
1852     if (!apparmor_enabled)
1853         return 0;
1854 
1855     err = register_pernet_subsys(&apparmor_net_ops);
1856     if (err)
1857         panic("Apparmor: register_pernet_subsys: error %d\n", err);
1858 
1859     return 0;
1860 }
1861 __initcall(apparmor_nf_ip_init);
1862 #endif
1863 
1864 static int __init apparmor_init(void)
1865 {
1866     int error;
1867 
1868     error = aa_setup_dfa_engine();
1869     if (error) {
1870         AA_ERROR("Unable to setup dfa engine\n");
1871         goto alloc_out;
1872     }
1873 
1874     error = aa_alloc_root_ns();
1875     if (error) {
1876         AA_ERROR("Unable to allocate default profile namespace\n");
1877         goto alloc_out;
1878     }
1879 
1880     error = apparmor_init_sysctl();
1881     if (error) {
1882         AA_ERROR("Unable to register sysctls\n");
1883         goto alloc_out;
1884 
1885     }
1886 
1887     error = alloc_buffers();
1888     if (error) {
1889         AA_ERROR("Unable to allocate work buffers\n");
1890         goto alloc_out;
1891     }
1892 
1893     error = set_init_ctx();
1894     if (error) {
1895         AA_ERROR("Failed to set context on init task\n");
1896         aa_free_root_ns();
1897         goto buffers_out;
1898     }
1899     security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
1900                 "apparmor");
1901 
1902     /* Report that AppArmor successfully initialized */
1903     apparmor_initialized = 1;
1904     if (aa_g_profile_mode == APPARMOR_COMPLAIN)
1905         aa_info_message("AppArmor initialized: complain mode enabled");
1906     else if (aa_g_profile_mode == APPARMOR_KILL)
1907         aa_info_message("AppArmor initialized: kill mode enabled");
1908     else
1909         aa_info_message("AppArmor initialized");
1910 
1911     return error;
1912 
1913 buffers_out:
1914     destroy_buffers();
1915 alloc_out:
1916     aa_destroy_aafs();
1917     aa_teardown_dfa_engine();
1918 
1919     apparmor_enabled = false;
1920     return error;
1921 }
1922 
1923 DEFINE_LSM(apparmor) = {
1924     .name = "apparmor",
1925     .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
1926     .enabled = &apparmor_enabled,
1927     .blobs = &apparmor_blob_sizes,
1928     .init = apparmor_init,
1929 };
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!