security/apparmor/procattr.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor /proc/<pid>/attr/ interface functions
0006  *
0007  * Copyright (C) 1998-2008 Novell/SUSE
0008  * Copyright 2009-2010 Canonical Ltd.
0009  */
0010
0011 #include "include/apparmor.h"
0012 #include "include/cred.h"
0013 #include "include/policy.h"
0014 #include "include/policy_ns.h"
0015 #include "include/domain.h"
0016 #include "include/procattr.h"
0017
0018
0019 /**
0020  * aa_getprocattr - Return the profile information for @profile
0021  * @profile: the profile to print profile info about  (NOT NULL)
0022  * @string: Returns - string containing the profile info (NOT NULL)
0023  *
0024  * Requires: profile != NULL
0025  *
0026  * Creates a string containing the namespace_name://profile_name for
0027  * @profile.
0028  *
0029  * Returns: size of string placed in @string else error code on failure
0030  */
0031 int aa_getprocattr(struct aa_label *label, char **string)
0032 {
0033     struct aa_ns *ns = labels_ns(label);
0034     struct aa_ns *current_ns = aa_get_current_ns();
0035     int len;
0036
0037     if (!aa_ns_visible(current_ns, ns, true)) {
0038         aa_put_ns(current_ns);
0039         return -EACCES;
0040     }
0041
0042     len = aa_label_snxprint(NULL, 0, current_ns, label,
0043                 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
0044                 FLAG_HIDDEN_UNCONFINED);
0045     AA_BUG(len < 0);
0046
0047     *string = kmalloc(len + 2, GFP_KERNEL);
0048     if (!*string) {
0049         aa_put_ns(current_ns);
0050         return -ENOMEM;
0051     }
0052
0053     len = aa_label_snxprint(*string, len + 2, current_ns, label,
0054                 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
0055                 FLAG_HIDDEN_UNCONFINED);
0056     if (len < 0) {
0057         aa_put_ns(current_ns);
0058         return len;
0059     }
0060
0061     (*string)[len] = '\n';
0062     (*string)[len + 1] = 0;
0063
0064     aa_put_ns(current_ns);
0065     return len + 1;
0066 }
0067
0068 /**
0069  * split_token_from_name - separate a string of form  <token>^<name>
0070  * @op: operation being checked
0071  * @args: string to parse  (NOT NULL)
0072  * @token: stores returned parsed token value  (NOT NULL)
0073  *
0074  * Returns: start position of name after token else NULL on failure
0075  */
0076 static char *split_token_from_name(const char *op, char *args, u64 *token)
0077 {
0078     char *name;
0079
0080     *token = simple_strtoull(args, &name, 16);
0081     if ((name == args) || *name != '^') {
0082         AA_ERROR("%s: Invalid input '%s'", op, args);
0083         return ERR_PTR(-EINVAL);
0084     }
0085
0086     name++;         /* skip ^ */
0087     if (!*name)
0088         name = NULL;
0089     return name;
0090 }
0091
0092 /**
0093  * aa_setprocattr_changehat - handle procattr interface to change_hat
0094  * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL)
0095  * @size: size of the args
0096  * @flags: set of flags governing behavior
0097  *
0098  * Returns: %0 or error code if change_hat fails
0099  */
0100 int aa_setprocattr_changehat(char *args, size_t size, int flags)
0101 {
0102     char *hat;
0103     u64 token;
0104     const char *hats[16];       /* current hard limit on # of names */
0105     int count = 0;
0106
0107     hat = split_token_from_name(OP_CHANGE_HAT, args, &token);
0108     if (IS_ERR(hat))
0109         return PTR_ERR(hat);
0110
0111     if (!hat && !token) {
0112         AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic");
0113         return -EINVAL;
0114     }
0115
0116     if (hat) {
0117         /* set up hat name vector, args guaranteed null terminated
0118          * at args[size] by setprocattr.
0119          *
0120          * If there are multiple hat names in the buffer each is
0121          * separated by a \0.  Ie. userspace writes them pre tokenized
0122          */
0123         char *end = args + size;
0124         for (count = 0; (hat < end) && count < 16; ++count) {
0125             char *next = hat + strlen(hat) + 1;
0126             hats[count] = hat;
0127             AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n"
0128                  , __func__, current->pid, token, count, hat);
0129             hat = next;
0130         }
0131     } else
0132         AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n",
0133              __func__, current->pid, token, count, "<NULL>");
0134
0135     return aa_change_hat(hats, count, token, flags);
0136 }