~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/lsm.c

Version: ~ [ linux-5.2-rc5 ] ~ [ linux-5.1.12 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.53 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.128 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.182 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.182 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.68 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * AppArmor security module
  3  *
  4  * This file contains AppArmor LSM hooks.
  5  *
  6  * Copyright (C) 1998-2008 Novell/SUSE
  7  * Copyright 2009-2010 Canonical Ltd.
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  */
 14 
 15 #include <linux/lsm_hooks.h>
 16 #include <linux/moduleparam.h>
 17 #include <linux/mm.h>
 18 #include <linux/mman.h>
 19 #include <linux/mount.h>
 20 #include <linux/namei.h>
 21 #include <linux/ptrace.h>
 22 #include <linux/ctype.h>
 23 #include <linux/sysctl.h>
 24 #include <linux/audit.h>
 25 #include <linux/user_namespace.h>
 26 #include <linux/kmemleak.h>
 27 #include <net/sock.h>
 28 
 29 #include "include/apparmor.h"
 30 #include "include/apparmorfs.h"
 31 #include "include/audit.h"
 32 #include "include/capability.h"
 33 #include "include/context.h"
 34 #include "include/file.h"
 35 #include "include/ipc.h"
 36 #include "include/path.h"
 37 #include "include/policy.h"
 38 #include "include/policy_ns.h"
 39 #include "include/procattr.h"
 40 
 41 /* Flag indicating whether initialization completed */
 42 int apparmor_initialized __initdata;
 43 
 44 DEFINE_PER_CPU(struct aa_buffers, aa_buffers);
 45 
 46 
 47 /*
 48  * LSM hook functions
 49  */
 50 
 51 /*
 52  * free the associated aa_task_ctx and put its profiles
 53  */
 54 static void apparmor_cred_free(struct cred *cred)
 55 {
 56         aa_free_task_context(cred_ctx(cred));
 57         cred_ctx(cred) = NULL;
 58 }
 59 
 60 /*
 61  * allocate the apparmor part of blank credentials
 62  */
 63 static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 64 {
 65         /* freed by apparmor_cred_free */
 66         struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
 67 
 68         if (!ctx)
 69                 return -ENOMEM;
 70 
 71         cred_ctx(cred) = ctx;
 72         return 0;
 73 }
 74 
 75 /*
 76  * prepare new aa_task_ctx for modification by prepare_cred block
 77  */
 78 static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
 79                                  gfp_t gfp)
 80 {
 81         /* freed by apparmor_cred_free */
 82         struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
 83 
 84         if (!ctx)
 85                 return -ENOMEM;
 86 
 87         aa_dup_task_context(ctx, cred_ctx(old));
 88         cred_ctx(new) = ctx;
 89         return 0;
 90 }
 91 
 92 /*
 93  * transfer the apparmor data to a blank set of creds
 94  */
 95 static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
 96 {
 97         const struct aa_task_ctx *old_ctx = cred_ctx(old);
 98         struct aa_task_ctx *new_ctx = cred_ctx(new);
 99 
100         aa_dup_task_context(new_ctx, old_ctx);
101 }
102 
103 static int apparmor_ptrace_access_check(struct task_struct *child,
104                                         unsigned int mode)
105 {
106         return aa_ptrace(current, child, mode);
107 }
108 
109 static int apparmor_ptrace_traceme(struct task_struct *parent)
110 {
111         return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
112 }
113 
114 /* Derived from security/commoncap.c:cap_capget */
115 static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
116                            kernel_cap_t *inheritable, kernel_cap_t *permitted)
117 {
118         struct aa_profile *profile;
119         const struct cred *cred;
120 
121         rcu_read_lock();
122         cred = __task_cred(target);
123         profile = aa_cred_profile(cred);
124 
125         /*
126          * cap_capget is stacked ahead of this and will
127          * initialize effective and permitted.
128          */
129         if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
130                 *effective = cap_intersect(*effective, profile->caps.allow);
131                 *permitted = cap_intersect(*permitted, profile->caps.allow);
132         }
133         rcu_read_unlock();
134 
135         return 0;
136 }
137 
138 static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
139                             int cap, int audit)
140 {
141         struct aa_profile *profile;
142         int error = 0;
143 
144         profile = aa_cred_profile(cred);
145         if (!unconfined(profile))
146                 error = aa_capable(profile, cap, audit);
147         return error;
148 }
149 
150 /**
151  * common_perm - basic common permission check wrapper fn for paths
152  * @op: operation being checked
153  * @path: path to check permission of  (NOT NULL)
154  * @mask: requested permissions mask
155  * @cond: conditional info for the permission request  (NOT NULL)
156  *
157  * Returns: %0 else error code if error or permission denied
158  */
159 static int common_perm(const char *op, const struct path *path, u32 mask,
160                        struct path_cond *cond)
161 {
162         struct aa_profile *profile;
163         int error = 0;
164 
165         profile = __aa_current_profile();
166         if (!unconfined(profile))
167                 error = aa_path_perm(op, profile, path, 0, mask, cond);
168 
169         return error;
170 }
171 
172 /**
173  * common_perm_cond - common permission wrapper around inode cond
174  * @op: operation being checked
175  * @path: location to check (NOT NULL)
176  * @mask: requested permissions mask
177  *
178  * Returns: %0 else error code if error or permission denied
179  */
180 static int common_perm_cond(const char *op, const struct path *path, u32 mask)
181 {
182         struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
183                                   d_backing_inode(path->dentry)->i_mode
184         };
185 
186         if (!path_mediated_fs(path->dentry))
187                 return 0;
188 
189         return common_perm(op, path, mask, &cond);
190 }
191 
192 /**
193  * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
194  * @op: operation being checked
195  * @dir: directory of the dentry  (NOT NULL)
196  * @dentry: dentry to check  (NOT NULL)
197  * @mask: requested permissions mask
198  * @cond: conditional info for the permission request  (NOT NULL)
199  *
200  * Returns: %0 else error code if error or permission denied
201  */
202 static int common_perm_dir_dentry(const char *op, const struct path *dir,
203                                   struct dentry *dentry, u32 mask,
204                                   struct path_cond *cond)
205 {
206         struct path path = { .mnt = dir->mnt, .dentry = dentry };
207 
208         return common_perm(op, &path, mask, cond);
209 }
210 
211 /**
212  * common_perm_rm - common permission wrapper for operations doing rm
213  * @op: operation being checked
214  * @dir: directory that the dentry is in  (NOT NULL)
215  * @dentry: dentry being rm'd  (NOT NULL)
216  * @mask: requested permission mask
217  *
218  * Returns: %0 else error code if error or permission denied
219  */
220 static int common_perm_rm(const char *op, const struct path *dir,
221                           struct dentry *dentry, u32 mask)
222 {
223         struct inode *inode = d_backing_inode(dentry);
224         struct path_cond cond = { };
225 
226         if (!inode || !path_mediated_fs(dentry))
227                 return 0;
228 
229         cond.uid = inode->i_uid;
230         cond.mode = inode->i_mode;
231 
232         return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
233 }
234 
235 /**
236  * common_perm_create - common permission wrapper for operations doing create
237  * @op: operation being checked
238  * @dir: directory that dentry will be created in  (NOT NULL)
239  * @dentry: dentry to create   (NOT NULL)
240  * @mask: request permission mask
241  * @mode: created file mode
242  *
243  * Returns: %0 else error code if error or permission denied
244  */
245 static int common_perm_create(const char *op, const struct path *dir,
246                               struct dentry *dentry, u32 mask, umode_t mode)
247 {
248         struct path_cond cond = { current_fsuid(), mode };
249 
250         if (!path_mediated_fs(dir->dentry))
251                 return 0;
252 
253         return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
254 }
255 
256 static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
257 {
258         return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
259 }
260 
261 static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
262                                umode_t mode)
263 {
264         return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
265                                   S_IFDIR);
266 }
267 
268 static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
269 {
270         return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
271 }
272 
273 static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
274                                umode_t mode, unsigned int dev)
275 {
276         return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
277 }
278 
279 static int apparmor_path_truncate(const struct path *path)
280 {
281         return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_META_WRITE);
282 }
283 
284 static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
285                                  const char *old_name)
286 {
287         return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
288                                   S_IFLNK);
289 }
290 
291 static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
292                               struct dentry *new_dentry)
293 {
294         struct aa_profile *profile;
295         int error = 0;
296 
297         if (!path_mediated_fs(old_dentry))
298                 return 0;
299 
300         profile = aa_current_profile();
301         if (!unconfined(profile))
302                 error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
303         return error;
304 }
305 
306 static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
307                                 const struct path *new_dir, struct dentry *new_dentry)
308 {
309         struct aa_profile *profile;
310         int error = 0;
311 
312         if (!path_mediated_fs(old_dentry))
313                 return 0;
314 
315         profile = aa_current_profile();
316         if (!unconfined(profile)) {
317                 struct path old_path = { .mnt = old_dir->mnt,
318                                          .dentry = old_dentry };
319                 struct path new_path = { .mnt = new_dir->mnt,
320                                          .dentry = new_dentry };
321                 struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
322                                           d_backing_inode(old_dentry)->i_mode
323                 };
324 
325                 error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0,
326                                      MAY_READ | AA_MAY_META_READ | MAY_WRITE |
327                                      AA_MAY_META_WRITE | AA_MAY_DELETE,
328                                      &cond);
329                 if (!error)
330                         error = aa_path_perm(OP_RENAME_DEST, profile, &new_path,
331                                              0, MAY_WRITE | AA_MAY_META_WRITE |
332                                              AA_MAY_CREATE, &cond);
333 
334         }
335         return error;
336 }
337 
338 static int apparmor_path_chmod(const struct path *path, umode_t mode)
339 {
340         return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD);
341 }
342 
343 static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
344 {
345         return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN);
346 }
347 
348 static int apparmor_inode_getattr(const struct path *path)
349 {
350         return common_perm_cond(OP_GETATTR, path, AA_MAY_META_READ);
351 }
352 
353 static int apparmor_file_open(struct file *file, const struct cred *cred)
354 {
355         struct aa_file_ctx *fctx = file->f_security;
356         struct aa_profile *profile;
357         int error = 0;
358 
359         if (!path_mediated_fs(file->f_path.dentry))
360                 return 0;
361 
362         /* If in exec, permission is handled by bprm hooks.
363          * Cache permissions granted by the previous exec check, with
364          * implicit read and executable mmap which are required to
365          * actually execute the image.
366          */
367         if (current->in_execve) {
368                 fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
369                 return 0;
370         }
371 
372         profile = aa_cred_profile(cred);
373         if (!unconfined(profile)) {
374                 struct inode *inode = file_inode(file);
375                 struct path_cond cond = { inode->i_uid, inode->i_mode };
376 
377                 error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0,
378                                      aa_map_file_to_perms(file), &cond);
379                 /* todo cache full allowed permissions set and state */
380                 fctx->allow = aa_map_file_to_perms(file);
381         }
382 
383         return error;
384 }
385 
386 static int apparmor_file_alloc_security(struct file *file)
387 {
388         /* freed by apparmor_file_free_security */
389         file->f_security = aa_alloc_file_context(GFP_KERNEL);
390         if (!file->f_security)
391                 return -ENOMEM;
392         return 0;
393 
394 }
395 
396 static void apparmor_file_free_security(struct file *file)
397 {
398         struct aa_file_ctx *ctx = file->f_security;
399 
400         aa_free_file_context(ctx);
401 }
402 
403 static int common_file_perm(const char *op, struct file *file, u32 mask)
404 {
405         struct aa_file_ctx *fctx = file->f_security;
406         struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred);
407         int error = 0;
408 
409         AA_BUG(!fprofile);
410 
411         if (!file->f_path.mnt ||
412             !path_mediated_fs(file->f_path.dentry))
413                 return 0;
414 
415         profile = __aa_current_profile();
416 
417         /* revalidate access, if task is unconfined, or the cached cred
418          * doesn't match or if the request is for more permissions than
419          * was granted.
420          *
421          * Note: the test for !unconfined(fprofile) is to handle file
422          *       delegation from unconfined tasks
423          */
424         if (!unconfined(profile) && !unconfined(fprofile) &&
425             ((fprofile != profile) || (mask & ~fctx->allow)))
426                 error = aa_file_perm(op, profile, file, mask);
427 
428         return error;
429 }
430 
431 static int apparmor_file_permission(struct file *file, int mask)
432 {
433         return common_file_perm(OP_FPERM, file, mask);
434 }
435 
436 static int apparmor_file_lock(struct file *file, unsigned int cmd)
437 {
438         u32 mask = AA_MAY_LOCK;
439 
440         if (cmd == F_WRLCK)
441                 mask |= MAY_WRITE;
442 
443         return common_file_perm(OP_FLOCK, file, mask);
444 }
445 
446 static int common_mmap(const char *op, struct file *file, unsigned long prot,
447                        unsigned long flags)
448 {
449         int mask = 0;
450 
451         if (!file || !file->f_security)
452                 return 0;
453 
454         if (prot & PROT_READ)
455                 mask |= MAY_READ;
456         /*
457          * Private mappings don't require write perms since they don't
458          * write back to the files
459          */
460         if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
461                 mask |= MAY_WRITE;
462         if (prot & PROT_EXEC)
463                 mask |= AA_EXEC_MMAP;
464 
465         return common_file_perm(op, file, mask);
466 }
467 
468 static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
469                               unsigned long prot, unsigned long flags)
470 {
471         return common_mmap(OP_FMMAP, file, prot, flags);
472 }
473 
474 static int apparmor_file_mprotect(struct vm_area_struct *vma,
475                                   unsigned long reqprot, unsigned long prot)
476 {
477         return common_mmap(OP_FMPROT, vma->vm_file, prot,
478                            !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
479 }
480 
481 static int apparmor_getprocattr(struct task_struct *task, char *name,
482                                 char **value)
483 {
484         int error = -ENOENT;
485         /* released below */
486         const struct cred *cred = get_task_cred(task);
487         struct aa_task_ctx *ctx = cred_ctx(cred);
488         struct aa_profile *profile = NULL;
489 
490         if (strcmp(name, "current") == 0)
491                 profile = aa_get_newest_profile(ctx->profile);
492         else if (strcmp(name, "prev") == 0  && ctx->previous)
493                 profile = aa_get_newest_profile(ctx->previous);
494         else if (strcmp(name, "exec") == 0 && ctx->onexec)
495                 profile = aa_get_newest_profile(ctx->onexec);
496         else
497                 error = -EINVAL;
498 
499         if (profile)
500                 error = aa_getprocattr(profile, value);
501 
502         aa_put_profile(profile);
503         put_cred(cred);
504 
505         return error;
506 }
507 
508 static int apparmor_setprocattr(const char *name, void *value,
509                                 size_t size)
510 {
511         char *command, *largs = NULL, *args = value;
512         size_t arg_size;
513         int error;
514         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR);
515 
516         if (size == 0)
517                 return -EINVAL;
518 
519         /* AppArmor requires that the buffer must be null terminated atm */
520         if (args[size - 1] != '\0') {
521                 /* null terminate */
522                 largs = args = kmalloc(size + 1, GFP_KERNEL);
523                 if (!args)
524                         return -ENOMEM;
525                 memcpy(args, value, size);
526                 args[size] = '\0';
527         }
528 
529         error = -EINVAL;
530         args = strim(args);
531         command = strsep(&args, " ");
532         if (!args)
533                 goto out;
534         args = skip_spaces(args);
535         if (!*args)
536                 goto out;
537 
538         arg_size = size - (args - (largs ? largs : (char *) value));
539         if (strcmp(name, "current") == 0) {
540                 if (strcmp(command, "changehat") == 0) {
541                         error = aa_setprocattr_changehat(args, arg_size,
542                                                          !AA_DO_TEST);
543                 } else if (strcmp(command, "permhat") == 0) {
544                         error = aa_setprocattr_changehat(args, arg_size,
545                                                          AA_DO_TEST);
546                 } else if (strcmp(command, "changeprofile") == 0) {
547                         error = aa_change_profile(args, !AA_ONEXEC,
548                                                   !AA_DO_TEST, false);
549                 } else if (strcmp(command, "permprofile") == 0) {
550                         error = aa_change_profile(args, !AA_ONEXEC, AA_DO_TEST,
551                                                   false);
552                 } else
553                         goto fail;
554         } else if (strcmp(name, "exec") == 0) {
555                 if (strcmp(command, "exec") == 0)
556                         error = aa_change_profile(args, AA_ONEXEC, !AA_DO_TEST,
557                                                   false);
558                 else
559                         goto fail;
560         } else
561                 /* only support the "current" and "exec" process attributes */
562                 goto fail;
563 
564         if (!error)
565                 error = size;
566 out:
567         kfree(largs);
568         return error;
569 
570 fail:
571         aad(&sa)->profile = aa_current_profile();
572         aad(&sa)->info = name;
573         aad(&sa)->error = error = -EINVAL;
574         aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
575         goto out;
576 }
577 
578 static int apparmor_task_setrlimit(struct task_struct *task,
579                 unsigned int resource, struct rlimit *new_rlim)
580 {
581         struct aa_profile *profile = __aa_current_profile();
582         int error = 0;
583 
584         if (!unconfined(profile))
585                 error = aa_task_setrlimit(profile, task, resource, new_rlim);
586 
587         return error;
588 }
589 
590 static struct security_hook_list apparmor_hooks[] = {
591         LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
592         LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
593         LSM_HOOK_INIT(capget, apparmor_capget),
594         LSM_HOOK_INIT(capable, apparmor_capable),
595 
596         LSM_HOOK_INIT(path_link, apparmor_path_link),
597         LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
598         LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
599         LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
600         LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
601         LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
602         LSM_HOOK_INIT(path_rename, apparmor_path_rename),
603         LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
604         LSM_HOOK_INIT(path_chown, apparmor_path_chown),
605         LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
606         LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
607 
608         LSM_HOOK_INIT(file_open, apparmor_file_open),
609         LSM_HOOK_INIT(file_permission, apparmor_file_permission),
610         LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
611         LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
612         LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
613         LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
614         LSM_HOOK_INIT(file_lock, apparmor_file_lock),
615 
616         LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
617         LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
618 
619         LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
620         LSM_HOOK_INIT(cred_free, apparmor_cred_free),
621         LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
622         LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
623 
624         LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
625         LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
626         LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
627         LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
628 
629         LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
630 };
631 
632 /*
633  * AppArmor sysfs module parameters
634  */
635 
636 static int param_set_aabool(const char *val, const struct kernel_param *kp);
637 static int param_get_aabool(char *buffer, const struct kernel_param *kp);
638 #define param_check_aabool param_check_bool
639 static const struct kernel_param_ops param_ops_aabool = {
640         .flags = KERNEL_PARAM_OPS_FL_NOARG,
641         .set = param_set_aabool,
642         .get = param_get_aabool
643 };
644 
645 static int param_set_aauint(const char *val, const struct kernel_param *kp);
646 static int param_get_aauint(char *buffer, const struct kernel_param *kp);
647 #define param_check_aauint param_check_uint
648 static const struct kernel_param_ops param_ops_aauint = {
649         .set = param_set_aauint,
650         .get = param_get_aauint
651 };
652 
653 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
654 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
655 #define param_check_aalockpolicy param_check_bool
656 static const struct kernel_param_ops param_ops_aalockpolicy = {
657         .flags = KERNEL_PARAM_OPS_FL_NOARG,
658         .set = param_set_aalockpolicy,
659         .get = param_get_aalockpolicy
660 };
661 
662 static int param_set_audit(const char *val, struct kernel_param *kp);
663 static int param_get_audit(char *buffer, struct kernel_param *kp);
664 
665 static int param_set_mode(const char *val, struct kernel_param *kp);
666 static int param_get_mode(char *buffer, struct kernel_param *kp);
667 
668 /* Flag values, also controllable via /sys/module/apparmor/parameters
669  * We define special types as we want to do additional mediation.
670  */
671 
672 /* AppArmor global enforcement switch - complain, enforce, kill */
673 enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
674 module_param_call(mode, param_set_mode, param_get_mode,
675                   &aa_g_profile_mode, S_IRUSR | S_IWUSR);
676 
677 /* whether policy verification hashing is enabled */
678 bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
679 #ifdef CONFIG_SECURITY_APPARMOR_HASH
680 module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
681 #endif
682 
683 /* Debug mode */
684 bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_DEBUG_MESSAGES);
685 module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
686 
687 /* Audit mode */
688 enum audit_mode aa_g_audit;
689 module_param_call(audit, param_set_audit, param_get_audit,
690                   &aa_g_audit, S_IRUSR | S_IWUSR);
691 
692 /* Determines if audit header is included in audited messages.  This
693  * provides more context if the audit daemon is not running
694  */
695 bool aa_g_audit_header = 1;
696 module_param_named(audit_header, aa_g_audit_header, aabool,
697                    S_IRUSR | S_IWUSR);
698 
699 /* lock out loading/removal of policy
700  * TODO: add in at boot loading of policy, which is the only way to
701  *       load policy, if lock_policy is set
702  */
703 bool aa_g_lock_policy;
704 module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
705                    S_IRUSR | S_IWUSR);
706 
707 /* Syscall logging mode */
708 bool aa_g_logsyscall;
709 module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
710 
711 /* Maximum pathname length before accesses will start getting rejected */
712 unsigned int aa_g_path_max = 2 * PATH_MAX;
713 module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
714 
715 /* Determines how paranoid loading of policy is and how much verification
716  * on the loaded policy is done.
717  * DEPRECATED: read only as strict checking of load is always done now
718  * that none root users (user namespaces) can load policy.
719  */
720 bool aa_g_paranoid_load = 1;
721 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
722 
723 /* Boot time disable flag */
724 static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
725 module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
726 
727 static int __init apparmor_enabled_setup(char *str)
728 {
729         unsigned long enabled;
730         int error = kstrtoul(str, 0, &enabled);
731         if (!error)
732                 apparmor_enabled = enabled ? 1 : 0;
733         return 1;
734 }
735 
736 __setup("apparmor=", apparmor_enabled_setup);
737 
738 /* set global flag turning off the ability to load policy */
739 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
740 {
741         if (!policy_admin_capable(NULL))
742                 return -EPERM;
743         return param_set_bool(val, kp);
744 }
745 
746 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
747 {
748         if (!policy_view_capable(NULL))
749                 return -EPERM;
750         if (!apparmor_enabled)
751                 return -EINVAL;
752         return param_get_bool(buffer, kp);
753 }
754 
755 static int param_set_aabool(const char *val, const struct kernel_param *kp)
756 {
757         if (!policy_admin_capable(NULL))
758                 return -EPERM;
759         if (!apparmor_enabled)
760                 return -EINVAL;
761         return param_set_bool(val, kp);
762 }
763 
764 static int param_get_aabool(char *buffer, const struct kernel_param *kp)
765 {
766         if (!policy_view_capable(NULL))
767                 return -EPERM;
768         if (!apparmor_enabled)
769                 return -EINVAL;
770         return param_get_bool(buffer, kp);
771 }
772 
773 static int param_set_aauint(const char *val, const struct kernel_param *kp)
774 {
775         if (!policy_admin_capable(NULL))
776                 return -EPERM;
777         if (!apparmor_enabled)
778                 return -EINVAL;
779         return param_set_uint(val, kp);
780 }
781 
782 static int param_get_aauint(char *buffer, const struct kernel_param *kp)
783 {
784         if (!policy_view_capable(NULL))
785                 return -EPERM;
786         if (!apparmor_enabled)
787                 return -EINVAL;
788         return param_get_uint(buffer, kp);
789 }
790 
791 static int param_get_audit(char *buffer, struct kernel_param *kp)
792 {
793         if (!policy_view_capable(NULL))
794                 return -EPERM;
795 
796         if (!apparmor_enabled)
797                 return -EINVAL;
798 
799         return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
800 }
801 
802 static int param_set_audit(const char *val, struct kernel_param *kp)
803 {
804         int i;
805         if (!policy_admin_capable(NULL))
806                 return -EPERM;
807 
808         if (!apparmor_enabled)
809                 return -EINVAL;
810 
811         if (!val)
812                 return -EINVAL;
813 
814         for (i = 0; i < AUDIT_MAX_INDEX; i++) {
815                 if (strcmp(val, audit_mode_names[i]) == 0) {
816                         aa_g_audit = i;
817                         return 0;
818                 }
819         }
820 
821         return -EINVAL;
822 }
823 
824 static int param_get_mode(char *buffer, struct kernel_param *kp)
825 {
826         if (!policy_view_capable(NULL))
827                 return -EPERM;
828 
829         if (!apparmor_enabled)
830                 return -EINVAL;
831 
832         return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
833 }
834 
835 static int param_set_mode(const char *val, struct kernel_param *kp)
836 {
837         int i;
838         if (!policy_admin_capable(NULL))
839                 return -EPERM;
840 
841         if (!apparmor_enabled)
842                 return -EINVAL;
843 
844         if (!val)
845                 return -EINVAL;
846 
847         for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) {
848                 if (strcmp(val, aa_profile_mode_names[i]) == 0) {
849                         aa_g_profile_mode = i;
850                         return 0;
851                 }
852         }
853 
854         return -EINVAL;
855 }
856 
857 /*
858  * AppArmor init functions
859  */
860 
861 /**
862  * set_init_ctx - set a task context and profile on the first task.
863  *
864  * TODO: allow setting an alternate profile than unconfined
865  */
866 static int __init set_init_ctx(void)
867 {
868         struct cred *cred = (struct cred *)current->real_cred;
869         struct aa_task_ctx *ctx;
870 
871         ctx = aa_alloc_task_context(GFP_KERNEL);
872         if (!ctx)
873                 return -ENOMEM;
874 
875         ctx->profile = aa_get_profile(root_ns->unconfined);
876         cred_ctx(cred) = ctx;
877 
878         return 0;
879 }
880 
881 static void destroy_buffers(void)
882 {
883         u32 i, j;
884 
885         for_each_possible_cpu(i) {
886                 for_each_cpu_buffer(j) {
887                         kfree(per_cpu(aa_buffers, i).buf[j]);
888                         per_cpu(aa_buffers, i).buf[j] = NULL;
889                 }
890         }
891 }
892 
893 static int __init alloc_buffers(void)
894 {
895         u32 i, j;
896 
897         for_each_possible_cpu(i) {
898                 for_each_cpu_buffer(j) {
899                         char *buffer;
900 
901                         if (cpu_to_node(i) > num_online_nodes())
902                                 /* fallback to kmalloc for offline nodes */
903                                 buffer = kmalloc(aa_g_path_max, GFP_KERNEL);
904                         else
905                                 buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL,
906                                                       cpu_to_node(i));
907                         if (!buffer) {
908                                 destroy_buffers();
909                                 return -ENOMEM;
910                         }
911                         per_cpu(aa_buffers, i).buf[j] = buffer;
912                 }
913         }
914 
915         return 0;
916 }
917 
918 #ifdef CONFIG_SYSCTL
919 static int apparmor_dointvec(struct ctl_table *table, int write,
920                              void __user *buffer, size_t *lenp, loff_t *ppos)
921 {
922         if (!policy_admin_capable(NULL))
923                 return -EPERM;
924         if (!apparmor_enabled)
925                 return -EINVAL;
926 
927         return proc_dointvec(table, write, buffer, lenp, ppos);
928 }
929 
930 static struct ctl_path apparmor_sysctl_path[] = {
931         { .procname = "kernel", },
932         { }
933 };
934 
935 static struct ctl_table apparmor_sysctl_table[] = {
936         {
937                 .procname       = "unprivileged_userns_apparmor_policy",
938                 .data           = &unprivileged_userns_apparmor_policy,
939                 .maxlen         = sizeof(int),
940                 .mode           = 0600,
941                 .proc_handler   = apparmor_dointvec,
942         },
943         { }
944 };
945 
946 static int __init apparmor_init_sysctl(void)
947 {
948         return register_sysctl_paths(apparmor_sysctl_path,
949                                      apparmor_sysctl_table) ? 0 : -ENOMEM;
950 }
951 #else
952 static inline int apparmor_init_sysctl(void)
953 {
954         return 0;
955 }
956 #endif /* CONFIG_SYSCTL */
957 
958 static int __init apparmor_init(void)
959 {
960         int error;
961 
962         if (!apparmor_enabled || !security_module_enable("apparmor")) {
963                 aa_info_message("AppArmor disabled by boot time parameter");
964                 apparmor_enabled = 0;
965                 return 0;
966         }
967 
968         error = aa_setup_dfa_engine();
969         if (error) {
970                 AA_ERROR("Unable to setup dfa engine\n");
971                 goto alloc_out;
972         }
973 
974         error = aa_alloc_root_ns();
975         if (error) {
976                 AA_ERROR("Unable to allocate default profile namespace\n");
977                 goto alloc_out;
978         }
979 
980         error = apparmor_init_sysctl();
981         if (error) {
982                 AA_ERROR("Unable to register sysctls\n");
983                 goto alloc_out;
984 
985         }
986 
987         error = alloc_buffers();
988         if (error) {
989                 AA_ERROR("Unable to allocate work buffers\n");
990                 goto buffers_out;
991         }
992 
993         error = set_init_ctx();
994         if (error) {
995                 AA_ERROR("Failed to set context on init task\n");
996                 aa_free_root_ns();
997                 goto buffers_out;
998         }
999         security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
1000                                 "apparmor");
1001 
1002         /* Report that AppArmor successfully initialized */
1003         apparmor_initialized = 1;
1004         if (aa_g_profile_mode == APPARMOR_COMPLAIN)
1005                 aa_info_message("AppArmor initialized: complain mode enabled");
1006         else if (aa_g_profile_mode == APPARMOR_KILL)
1007                 aa_info_message("AppArmor initialized: kill mode enabled");
1008         else
1009                 aa_info_message("AppArmor initialized");
1010 
1011         return error;
1012 
1013 buffers_out:
1014         destroy_buffers();
1015 
1016 alloc_out:
1017         aa_destroy_aafs();
1018         aa_teardown_dfa_engine();
1019 
1020         apparmor_enabled = 0;
1021         return error;
1022 }
1023 
1024 security_initcall(apparmor_init);
1025 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp