~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/file.c

Version: ~ [ linux-5.2-rc5 ] ~ [ linux-5.1.12 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.53 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.128 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.182 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.182 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.68 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * AppArmor security module
  3  *
  4  * This file contains AppArmor mediation of files
  5  *
  6  * Copyright (C) 1998-2008 Novell/SUSE
  7  * Copyright 2009-2010 Canonical Ltd.
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  */
 14 
 15 #include "include/apparmor.h"
 16 #include "include/audit.h"
 17 #include "include/file.h"
 18 #include "include/match.h"
 19 #include "include/path.h"
 20 #include "include/policy.h"
 21 
 22 struct file_perms nullperms;
 23 
 24 
 25 /**
 26  * audit_file_mask - convert mask to permission string
 27  * @buffer: buffer to write string to (NOT NULL)
 28  * @mask: permission mask to convert
 29  */
 30 static void audit_file_mask(struct audit_buffer *ab, u32 mask)
 31 {
 32         char str[10];
 33 
 34         char *m = str;
 35 
 36         if (mask & AA_EXEC_MMAP)
 37                 *m++ = 'm';
 38         if (mask & (MAY_READ | AA_MAY_META_READ))
 39                 *m++ = 'r';
 40         if (mask & (MAY_WRITE | AA_MAY_META_WRITE | AA_MAY_CHMOD |
 41                     AA_MAY_CHOWN))
 42                 *m++ = 'w';
 43         else if (mask & MAY_APPEND)
 44                 *m++ = 'a';
 45         if (mask & AA_MAY_CREATE)
 46                 *m++ = 'c';
 47         if (mask & AA_MAY_DELETE)
 48                 *m++ = 'd';
 49         if (mask & AA_MAY_LINK)
 50                 *m++ = 'l';
 51         if (mask & AA_MAY_LOCK)
 52                 *m++ = 'k';
 53         if (mask & MAY_EXEC)
 54                 *m++ = 'x';
 55         *m = '\0';
 56 
 57         audit_log_string(ab, str);
 58 }
 59 
 60 /**
 61  * file_audit_cb - call back for file specific audit fields
 62  * @ab: audit_buffer  (NOT NULL)
 63  * @va: audit struct to audit values of  (NOT NULL)
 64  */
 65 static void file_audit_cb(struct audit_buffer *ab, void *va)
 66 {
 67         struct common_audit_data *sa = va;
 68         kuid_t fsuid = current_fsuid();
 69 
 70         if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) {
 71                 audit_log_format(ab, " requested_mask=");
 72                 audit_file_mask(ab, aad(sa)->fs.request);
 73         }
 74         if (aad(sa)->fs.denied & AA_AUDIT_FILE_MASK) {
 75                 audit_log_format(ab, " denied_mask=");
 76                 audit_file_mask(ab, aad(sa)->fs.denied);
 77         }
 78         if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) {
 79                 audit_log_format(ab, " fsuid=%d",
 80                                  from_kuid(&init_user_ns, fsuid));
 81                 audit_log_format(ab, " ouid=%d",
 82                                  from_kuid(&init_user_ns, aad(sa)->fs.ouid));
 83         }
 84 
 85         if (aad(sa)->fs.target) {
 86                 audit_log_format(ab, " target=");
 87                 audit_log_untrustedstring(ab, aad(sa)->fs.target);
 88         }
 89 }
 90 
 91 /**
 92  * aa_audit_file - handle the auditing of file operations
 93  * @profile: the profile being enforced  (NOT NULL)
 94  * @perms: the permissions computed for the request (NOT NULL)
 95  * @gfp: allocation flags
 96  * @op: operation being mediated
 97  * @request: permissions requested
 98  * @name: name of object being mediated (MAYBE NULL)
 99  * @target: name of target (MAYBE NULL)
100  * @ouid: object uid
101  * @info: extra information message (MAYBE NULL)
102  * @error: 0 if operation allowed else failure error code
103  *
104  * Returns: %0 or error on failure
105  */
106 int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
107                   const char *op, u32 request, const char *name,
108                   const char *target, kuid_t ouid, const char *info, int error)
109 {
110         int type = AUDIT_APPARMOR_AUTO;
111         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, op);
112 
113         sa.u.tsk = NULL;
114         aad(&sa)->fs.request = request;
115         aad(&sa)->name = name;
116         aad(&sa)->fs.target = target;
117         aad(&sa)->fs.ouid = ouid;
118         aad(&sa)->info = info;
119         aad(&sa)->error = error;
120         sa.u.tsk = NULL;
121 
122         if (likely(!aad(&sa)->error)) {
123                 u32 mask = perms->audit;
124 
125                 if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
126                         mask = 0xffff;
127 
128                 /* mask off perms that are not being force audited */
129                 aad(&sa)->fs.request &= mask;
130 
131                 if (likely(!aad(&sa)->fs.request))
132                         return 0;
133                 type = AUDIT_APPARMOR_AUDIT;
134         } else {
135                 /* only report permissions that were denied */
136                 aad(&sa)->fs.request = aad(&sa)->fs.request & ~perms->allow;
137                 AA_BUG(!aad(&sa)->fs.request);
138 
139                 if (aad(&sa)->fs.request & perms->kill)
140                         type = AUDIT_APPARMOR_KILL;
141 
142                 /* quiet known rejects, assumes quiet and kill do not overlap */
143                 if ((aad(&sa)->fs.request & perms->quiet) &&
144                     AUDIT_MODE(profile) != AUDIT_NOQUIET &&
145                     AUDIT_MODE(profile) != AUDIT_ALL)
146                         aad(&sa)->fs.request &= ~perms->quiet;
147 
148                 if (!aad(&sa)->fs.request)
149                         return COMPLAIN_MODE(profile) ? 0 : aad(&sa)->error;
150         }
151 
152         aad(&sa)->fs.denied = aad(&sa)->fs.request & ~perms->allow;
153         return aa_audit(type, profile, &sa, file_audit_cb);
154 }
155 
156 /**
157  * map_old_perms - map old file perms layout to the new layout
158  * @old: permission set in old mapping
159  *
160  * Returns: new permission mapping
161  */
162 static u32 map_old_perms(u32 old)
163 {
164         u32 new = old & 0xf;
165         if (old & MAY_READ)
166                 new |= AA_MAY_META_READ;
167         if (old & MAY_WRITE)
168                 new |= AA_MAY_META_WRITE | AA_MAY_CREATE | AA_MAY_DELETE |
169                         AA_MAY_CHMOD | AA_MAY_CHOWN;
170         if (old & 0x10)
171                 new |= AA_MAY_LINK;
172         /* the old mapping lock and link_subset flags where overlaid
173          * and use was determined by part of a pair that they were in
174          */
175         if (old & 0x20)
176                 new |= AA_MAY_LOCK | AA_LINK_SUBSET;
177         if (old & 0x40) /* AA_EXEC_MMAP */
178                 new |= AA_EXEC_MMAP;
179 
180         return new;
181 }
182 
183 /**
184  * compute_perms - convert dfa compressed perms to internal perms
185  * @dfa: dfa to compute perms for   (NOT NULL)
186  * @state: state in dfa
187  * @cond:  conditions to consider  (NOT NULL)
188  *
189  * TODO: convert from dfa + state to permission entry, do computation conversion
190  *       at load time.
191  *
192  * Returns: computed permission set
193  */
194 static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
195                                        struct path_cond *cond)
196 {
197         struct file_perms perms;
198 
199         /* FIXME: change over to new dfa format
200          * currently file perms are encoded in the dfa, new format
201          * splits the permissions from the dfa.  This mapping can be
202          * done at profile load
203          */
204         perms.kill = 0;
205 
206         if (uid_eq(current_fsuid(), cond->uid)) {
207                 perms.allow = map_old_perms(dfa_user_allow(dfa, state));
208                 perms.audit = map_old_perms(dfa_user_audit(dfa, state));
209                 perms.quiet = map_old_perms(dfa_user_quiet(dfa, state));
210                 perms.xindex = dfa_user_xindex(dfa, state);
211         } else {
212                 perms.allow = map_old_perms(dfa_other_allow(dfa, state));
213                 perms.audit = map_old_perms(dfa_other_audit(dfa, state));
214                 perms.quiet = map_old_perms(dfa_other_quiet(dfa, state));
215                 perms.xindex = dfa_other_xindex(dfa, state);
216         }
217         perms.allow |= AA_MAY_META_READ;
218 
219         /* change_profile wasn't determined by ownership in old mapping */
220         if (ACCEPT_TABLE(dfa)[state] & 0x80000000)
221                 perms.allow |= AA_MAY_CHANGE_PROFILE;
222         if (ACCEPT_TABLE(dfa)[state] & 0x40000000)
223                 perms.allow |= AA_MAY_ONEXEC;
224 
225         return perms;
226 }
227 
228 /**
229  * aa_str_perms - find permission that match @name
230  * @dfa: to match against  (MAYBE NULL)
231  * @state: state to start matching in
232  * @name: string to match against dfa  (NOT NULL)
233  * @cond: conditions to consider for permission set computation  (NOT NULL)
234  * @perms: Returns - the permissions found when matching @name
235  *
236  * Returns: the final state in @dfa when beginning @start and walking @name
237  */
238 unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start,
239                           const char *name, struct path_cond *cond,
240                           struct file_perms *perms)
241 {
242         unsigned int state;
243         if (!dfa) {
244                 *perms = nullperms;
245                 return DFA_NOMATCH;
246         }
247 
248         state = aa_dfa_match(dfa, start, name);
249         *perms = compute_perms(dfa, state, cond);
250 
251         return state;
252 }
253 
254 /**
255  * is_deleted - test if a file has been completely unlinked
256  * @dentry: dentry of file to test for deletion  (NOT NULL)
257  *
258  * Returns: %1 if deleted else %0
259  */
260 static inline bool is_deleted(struct dentry *dentry)
261 {
262         if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0)
263                 return 1;
264         return 0;
265 }
266 
267 /**
268  * aa_path_perm - do permissions check & audit for @path
269  * @op: operation being checked
270  * @profile: profile being enforced  (NOT NULL)
271  * @path: path to check permissions of  (NOT NULL)
272  * @flags: any additional path flags beyond what the profile specifies
273  * @request: requested permissions
274  * @cond: conditional info for this request  (NOT NULL)
275  *
276  * Returns: %0 else error if access denied or other error
277  */
278 int aa_path_perm(const char *op, struct aa_profile *profile,
279                  const struct path *path, int flags, u32 request,
280                  struct path_cond *cond)
281 {
282         char *buffer = NULL;
283         struct file_perms perms = {};
284         const char *name, *info = NULL;
285         int error;
286 
287         flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0);
288         error = aa_path_name(path, flags, &buffer, &name, &info);
289         if (error) {
290                 if (error == -ENOENT && is_deleted(path->dentry)) {
291                         /* Access to open files that are deleted are
292                          * give a pass (implicit delegation)
293                          */
294                         error = 0;
295                         info = NULL;
296                         perms.allow = request;
297                 }
298         } else {
299                 aa_str_perms(profile->file.dfa, profile->file.start, name, cond,
300                              &perms);
301                 if (request & ~perms.allow)
302                         error = -EACCES;
303         }
304         error = aa_audit_file(profile, &perms, op, request, name, NULL,
305                               cond->uid, info, error);
306         kfree(buffer);
307 
308         return error;
309 }
310 
311 /**
312  * xindex_is_subset - helper for aa_path_link
313  * @link: link permission set
314  * @target: target permission set
315  *
316  * test target x permissions are equal OR a subset of link x permissions
317  * this is done as part of the subset test, where a hardlink must have
318  * a subset of permissions that the target has.
319  *
320  * Returns: %1 if subset else %0
321  */
322 static inline bool xindex_is_subset(u32 link, u32 target)
323 {
324         if (((link & ~AA_X_UNSAFE) != (target & ~AA_X_UNSAFE)) ||
325             ((link & AA_X_UNSAFE) && !(target & AA_X_UNSAFE)))
326                 return 0;
327 
328         return 1;
329 }
330 
331 /**
332  * aa_path_link - Handle hard link permission check
333  * @profile: the profile being enforced  (NOT NULL)
334  * @old_dentry: the target dentry  (NOT NULL)
335  * @new_dir: directory the new link will be created in  (NOT NULL)
336  * @new_dentry: the link being created  (NOT NULL)
337  *
338  * Handle the permission test for a link & target pair.  Permission
339  * is encoded as a pair where the link permission is determined
340  * first, and if allowed, the target is tested.  The target test
341  * is done from the point of the link match (not start of DFA)
342  * making the target permission dependent on the link permission match.
343  *
344  * The subset test if required forces that permissions granted
345  * on link are a subset of the permission granted to target.
346  *
347  * Returns: %0 if allowed else error
348  */
349 int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
350                  const struct path *new_dir, struct dentry *new_dentry)
351 {
352         struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
353         struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
354         struct path_cond cond = {
355                 d_backing_inode(old_dentry)->i_uid,
356                 d_backing_inode(old_dentry)->i_mode
357         };
358         char *buffer = NULL, *buffer2 = NULL;
359         const char *lname, *tname = NULL, *info = NULL;
360         struct file_perms lperms, perms;
361         u32 request = AA_MAY_LINK;
362         unsigned int state;
363         int error;
364 
365         lperms = nullperms;
366 
367         /* buffer freed below, lname is pointer in buffer */
368         error = aa_path_name(&link, profile->path_flags, &buffer, &lname,
369                              &info);
370         if (error)
371                 goto audit;
372 
373         /* buffer2 freed below, tname is pointer in buffer2 */
374         error = aa_path_name(&target, profile->path_flags, &buffer2, &tname,
375                              &info);
376         if (error)
377                 goto audit;
378 
379         error = -EACCES;
380         /* aa_str_perms - handles the case of the dfa being NULL */
381         state = aa_str_perms(profile->file.dfa, profile->file.start, lname,
382                              &cond, &lperms);
383 
384         if (!(lperms.allow & AA_MAY_LINK))
385                 goto audit;
386 
387         /* test to see if target can be paired with link */
388         state = aa_dfa_null_transition(profile->file.dfa, state);
389         aa_str_perms(profile->file.dfa, state, tname, &cond, &perms);
390 
391         /* force audit/quiet masks for link are stored in the second entry
392          * in the link pair.
393          */
394         lperms.audit = perms.audit;
395         lperms.quiet = perms.quiet;
396         lperms.kill = perms.kill;
397 
398         if (!(perms.allow & AA_MAY_LINK)) {
399                 info = "target restricted";
400                 goto audit;
401         }
402 
403         /* done if link subset test is not required */
404         if (!(perms.allow & AA_LINK_SUBSET))
405                 goto done_tests;
406 
407         /* Do link perm subset test requiring allowed permission on link are a
408          * subset of the allowed permissions on target.
409          */
410         aa_str_perms(profile->file.dfa, profile->file.start, tname, &cond,
411                      &perms);
412 
413         /* AA_MAY_LINK is not considered in the subset test */
414         request = lperms.allow & ~AA_MAY_LINK;
415         lperms.allow &= perms.allow | AA_MAY_LINK;
416 
417         request |= AA_AUDIT_FILE_MASK & (lperms.allow & ~perms.allow);
418         if (request & ~lperms.allow) {
419                 goto audit;
420         } else if ((lperms.allow & MAY_EXEC) &&
421                    !xindex_is_subset(lperms.xindex, perms.xindex)) {
422                 lperms.allow &= ~MAY_EXEC;
423                 request |= MAY_EXEC;
424                 info = "link not subset of target";
425                 goto audit;
426         }
427 
428 done_tests:
429         error = 0;
430 
431 audit:
432         error = aa_audit_file(profile, &lperms, OP_LINK, request,
433                               lname, tname, cond.uid, info, error);
434         kfree(buffer);
435         kfree(buffer2);
436 
437         return error;
438 }
439 
440 /**
441  * aa_file_perm - do permission revalidation check & audit for @file
442  * @op: operation being checked
443  * @profile: profile being enforced   (NOT NULL)
444  * @file: file to revalidate access permissions on  (NOT NULL)
445  * @request: requested permissions
446  *
447  * Returns: %0 if access allowed else error
448  */
449 int aa_file_perm(const char *op, struct aa_profile *profile, struct file *file,
450                  u32 request)
451 {
452         struct path_cond cond = {
453                 .uid = file_inode(file)->i_uid,
454                 .mode = file_inode(file)->i_mode
455         };
456 
457         return aa_path_perm(op, profile, &file->f_path, PATH_DELEGATE_DELETED,
458                             request, &cond);
459 }
460 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp