~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/lsm.c

Version: ~ [ linux-5.14-rc3 ] ~ [ linux-5.13.5 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.53 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.135 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.198 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.240 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.276 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.276 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * AppArmor security module
  3  *
  4  * This file contains AppArmor LSM hooks.
  5  *
  6  * Copyright (C) 1998-2008 Novell/SUSE
  7  * Copyright 2009-2010 Canonical Ltd.
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  */
 14 
 15 #include <linux/lsm_hooks.h>
 16 #include <linux/moduleparam.h>
 17 #include <linux/mm.h>
 18 #include <linux/mman.h>
 19 #include <linux/mount.h>
 20 #include <linux/namei.h>
 21 #include <linux/ptrace.h>
 22 #include <linux/ctype.h>
 23 #include <linux/sysctl.h>
 24 #include <linux/audit.h>
 25 #include <linux/user_namespace.h>
 26 #include <net/sock.h>
 27 
 28 #include "include/apparmor.h"
 29 #include "include/apparmorfs.h"
 30 #include "include/audit.h"
 31 #include "include/capability.h"
 32 #include "include/context.h"
 33 #include "include/file.h"
 34 #include "include/ipc.h"
 35 #include "include/path.h"
 36 #include "include/policy.h"
 37 #include "include/procattr.h"
 38 
 39 /* Flag indicating whether initialization completed */
 40 int apparmor_initialized __initdata;
 41 
 42 /*
 43  * LSM hook functions
 44  */
 45 
 46 /*
 47  * free the associated aa_task_cxt and put its profiles
 48  */
 49 static void apparmor_cred_free(struct cred *cred)
 50 {
 51         aa_free_task_context(cred_cxt(cred));
 52         cred_cxt(cred) = NULL;
 53 }
 54 
 55 /*
 56  * allocate the apparmor part of blank credentials
 57  */
 58 static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 59 {
 60         /* freed by apparmor_cred_free */
 61         struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
 62         if (!cxt)
 63                 return -ENOMEM;
 64 
 65         cred_cxt(cred) = cxt;
 66         return 0;
 67 }
 68 
 69 /*
 70  * prepare new aa_task_cxt for modification by prepare_cred block
 71  */
 72 static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
 73                                  gfp_t gfp)
 74 {
 75         /* freed by apparmor_cred_free */
 76         struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
 77         if (!cxt)
 78                 return -ENOMEM;
 79 
 80         aa_dup_task_context(cxt, cred_cxt(old));
 81         cred_cxt(new) = cxt;
 82         return 0;
 83 }
 84 
 85 /*
 86  * transfer the apparmor data to a blank set of creds
 87  */
 88 static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
 89 {
 90         const struct aa_task_cxt *old_cxt = cred_cxt(old);
 91         struct aa_task_cxt *new_cxt = cred_cxt(new);
 92 
 93         aa_dup_task_context(new_cxt, old_cxt);
 94 }
 95 
 96 static int apparmor_ptrace_access_check(struct task_struct *child,
 97                                         unsigned int mode)
 98 {
 99         return aa_ptrace(current, child, mode);
100 }
101 
102 static int apparmor_ptrace_traceme(struct task_struct *parent)
103 {
104         return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
105 }
106 
107 /* Derived from security/commoncap.c:cap_capget */
108 static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
109                            kernel_cap_t *inheritable, kernel_cap_t *permitted)
110 {
111         struct aa_profile *profile;
112         const struct cred *cred;
113 
114         rcu_read_lock();
115         cred = __task_cred(target);
116         profile = aa_cred_profile(cred);
117 
118         /*
119          * cap_capget is stacked ahead of this and will
120          * initialize effective and permitted.
121          */
122         if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
123                 *effective = cap_intersect(*effective, profile->caps.allow);
124                 *permitted = cap_intersect(*permitted, profile->caps.allow);
125         }
126         rcu_read_unlock();
127 
128         return 0;
129 }
130 
131 static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
132                             int cap, int audit)
133 {
134         struct aa_profile *profile;
135         int error = 0;
136 
137         profile = aa_cred_profile(cred);
138         if (!unconfined(profile))
139                 error = aa_capable(profile, cap, audit);
140         return error;
141 }
142 
143 /**
144  * common_perm - basic common permission check wrapper fn for paths
145  * @op: operation being checked
146  * @path: path to check permission of  (NOT NULL)
147  * @mask: requested permissions mask
148  * @cond: conditional info for the permission request  (NOT NULL)
149  *
150  * Returns: %0 else error code if error or permission denied
151  */
152 static int common_perm(int op, const struct path *path, u32 mask,
153                        struct path_cond *cond)
154 {
155         struct aa_profile *profile;
156         int error = 0;
157 
158         profile = __aa_current_profile();
159         if (!unconfined(profile))
160                 error = aa_path_perm(op, profile, path, 0, mask, cond);
161 
162         return error;
163 }
164 
165 /**
166  * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
167  * @op: operation being checked
168  * @dir: directory of the dentry  (NOT NULL)
169  * @dentry: dentry to check  (NOT NULL)
170  * @mask: requested permissions mask
171  * @cond: conditional info for the permission request  (NOT NULL)
172  *
173  * Returns: %0 else error code if error or permission denied
174  */
175 static int common_perm_dir_dentry(int op, const struct path *dir,
176                                   struct dentry *dentry, u32 mask,
177                                   struct path_cond *cond)
178 {
179         struct path path = { dir->mnt, dentry };
180 
181         return common_perm(op, &path, mask, cond);
182 }
183 
184 /**
185  * common_perm_path - common permission wrapper when mnt, dentry
186  * @op: operation being checked
187  * @path: location to check (NOT NULL)
188  * @mask: requested permissions mask
189  *
190  * Returns: %0 else error code if error or permission denied
191  */
192 static inline int common_perm_path(int op, const struct path *path, u32 mask)
193 {
194         struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
195                                   d_backing_inode(path->dentry)->i_mode
196         };
197         if (!mediated_filesystem(path->dentry))
198                 return 0;
199 
200         return common_perm(op, path, mask, &cond);
201 }
202 
203 /**
204  * common_perm_rm - common permission wrapper for operations doing rm
205  * @op: operation being checked
206  * @dir: directory that the dentry is in  (NOT NULL)
207  * @dentry: dentry being rm'd  (NOT NULL)
208  * @mask: requested permission mask
209  *
210  * Returns: %0 else error code if error or permission denied
211  */
212 static int common_perm_rm(int op, const struct path *dir,
213                           struct dentry *dentry, u32 mask)
214 {
215         struct inode *inode = d_backing_inode(dentry);
216         struct path_cond cond = { };
217 
218         if (!inode || !mediated_filesystem(dentry))
219                 return 0;
220 
221         cond.uid = inode->i_uid;
222         cond.mode = inode->i_mode;
223 
224         return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
225 }
226 
227 /**
228  * common_perm_create - common permission wrapper for operations doing create
229  * @op: operation being checked
230  * @dir: directory that dentry will be created in  (NOT NULL)
231  * @dentry: dentry to create   (NOT NULL)
232  * @mask: request permission mask
233  * @mode: created file mode
234  *
235  * Returns: %0 else error code if error or permission denied
236  */
237 static int common_perm_create(int op, const struct path *dir,
238                               struct dentry *dentry, u32 mask, umode_t mode)
239 {
240         struct path_cond cond = { current_fsuid(), mode };
241 
242         if (!mediated_filesystem(dir->dentry))
243                 return 0;
244 
245         return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
246 }
247 
248 static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
249 {
250         return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
251 }
252 
253 static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
254                                umode_t mode)
255 {
256         return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
257                                   S_IFDIR);
258 }
259 
260 static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
261 {
262         return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
263 }
264 
265 static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
266                                umode_t mode, unsigned int dev)
267 {
268         return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
269 }
270 
271 static int apparmor_path_truncate(const struct path *path)
272 {
273         return common_perm_path(OP_TRUNC, path, MAY_WRITE | AA_MAY_META_WRITE);
274 }
275 
276 static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
277                                  const char *old_name)
278 {
279         return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
280                                   S_IFLNK);
281 }
282 
283 static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
284                               struct dentry *new_dentry)
285 {
286         struct aa_profile *profile;
287         int error = 0;
288 
289         if (!mediated_filesystem(old_dentry))
290                 return 0;
291 
292         profile = aa_current_profile();
293         if (!unconfined(profile))
294                 error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
295         return error;
296 }
297 
298 static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
299                                 const struct path *new_dir, struct dentry *new_dentry)
300 {
301         struct aa_profile *profile;
302         int error = 0;
303 
304         if (!mediated_filesystem(old_dentry))
305                 return 0;
306 
307         profile = aa_current_profile();
308         if (!unconfined(profile)) {
309                 struct path old_path = { old_dir->mnt, old_dentry };
310                 struct path new_path = { new_dir->mnt, new_dentry };
311                 struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
312                                           d_backing_inode(old_dentry)->i_mode
313                 };
314 
315                 error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0,
316                                      MAY_READ | AA_MAY_META_READ | MAY_WRITE |
317                                      AA_MAY_META_WRITE | AA_MAY_DELETE,
318                                      &cond);
319                 if (!error)
320                         error = aa_path_perm(OP_RENAME_DEST, profile, &new_path,
321                                              0, MAY_WRITE | AA_MAY_META_WRITE |
322                                              AA_MAY_CREATE, &cond);
323 
324         }
325         return error;
326 }
327 
328 static int apparmor_path_chmod(const struct path *path, umode_t mode)
329 {
330         return common_perm_path(OP_CHMOD, path, AA_MAY_CHMOD);
331 }
332 
333 static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
334 {
335         return common_perm_path(OP_CHOWN, path, AA_MAY_CHOWN);
336 }
337 
338 static int apparmor_inode_getattr(const struct path *path)
339 {
340         return common_perm_path(OP_GETATTR, path, AA_MAY_META_READ);
341 }
342 
343 static int apparmor_file_open(struct file *file, const struct cred *cred)
344 {
345         struct aa_file_cxt *fcxt = file->f_security;
346         struct aa_profile *profile;
347         int error = 0;
348 
349         if (!mediated_filesystem(file->f_path.dentry))
350                 return 0;
351 
352         /* If in exec, permission is handled by bprm hooks.
353          * Cache permissions granted by the previous exec check, with
354          * implicit read and executable mmap which are required to
355          * actually execute the image.
356          */
357         if (current->in_execve) {
358                 fcxt->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
359                 return 0;
360         }
361 
362         profile = aa_cred_profile(cred);
363         if (!unconfined(profile)) {
364                 struct inode *inode = file_inode(file);
365                 struct path_cond cond = { inode->i_uid, inode->i_mode };
366 
367                 error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0,
368                                      aa_map_file_to_perms(file), &cond);
369                 /* todo cache full allowed permissions set and state */
370                 fcxt->allow = aa_map_file_to_perms(file);
371         }
372 
373         return error;
374 }
375 
376 static int apparmor_file_alloc_security(struct file *file)
377 {
378         /* freed by apparmor_file_free_security */
379         file->f_security = aa_alloc_file_context(GFP_KERNEL);
380         if (!file->f_security)
381                 return -ENOMEM;
382         return 0;
383 
384 }
385 
386 static void apparmor_file_free_security(struct file *file)
387 {
388         struct aa_file_cxt *cxt = file->f_security;
389 
390         aa_free_file_context(cxt);
391 }
392 
393 static int common_file_perm(int op, struct file *file, u32 mask)
394 {
395         struct aa_file_cxt *fcxt = file->f_security;
396         struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred);
397         int error = 0;
398 
399         BUG_ON(!fprofile);
400 
401         if (!file->f_path.mnt ||
402             !mediated_filesystem(file->f_path.dentry))
403                 return 0;
404 
405         profile = __aa_current_profile();
406 
407         /* revalidate access, if task is unconfined, or the cached cred
408          * doesn't match or if the request is for more permissions than
409          * was granted.
410          *
411          * Note: the test for !unconfined(fprofile) is to handle file
412          *       delegation from unconfined tasks
413          */
414         if (!unconfined(profile) && !unconfined(fprofile) &&
415             ((fprofile != profile) || (mask & ~fcxt->allow)))
416                 error = aa_file_perm(op, profile, file, mask);
417 
418         return error;
419 }
420 
421 static int apparmor_file_permission(struct file *file, int mask)
422 {
423         return common_file_perm(OP_FPERM, file, mask);
424 }
425 
426 static int apparmor_file_lock(struct file *file, unsigned int cmd)
427 {
428         u32 mask = AA_MAY_LOCK;
429 
430         if (cmd == F_WRLCK)
431                 mask |= MAY_WRITE;
432 
433         return common_file_perm(OP_FLOCK, file, mask);
434 }
435 
436 static int common_mmap(int op, struct file *file, unsigned long prot,
437                        unsigned long flags)
438 {
439         int mask = 0;
440 
441         if (!file || !file->f_security)
442                 return 0;
443 
444         if (prot & PROT_READ)
445                 mask |= MAY_READ;
446         /*
447          * Private mappings don't require write perms since they don't
448          * write back to the files
449          */
450         if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
451                 mask |= MAY_WRITE;
452         if (prot & PROT_EXEC)
453                 mask |= AA_EXEC_MMAP;
454 
455         return common_file_perm(op, file, mask);
456 }
457 
458 static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
459                               unsigned long prot, unsigned long flags)
460 {
461         return common_mmap(OP_FMMAP, file, prot, flags);
462 }
463 
464 static int apparmor_file_mprotect(struct vm_area_struct *vma,
465                                   unsigned long reqprot, unsigned long prot)
466 {
467         return common_mmap(OP_FMPROT, vma->vm_file, prot,
468                            !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
469 }
470 
471 static int apparmor_getprocattr(struct task_struct *task, char *name,
472                                 char **value)
473 {
474         int error = -ENOENT;
475         /* released below */
476         const struct cred *cred = get_task_cred(task);
477         struct aa_task_cxt *cxt = cred_cxt(cred);
478         struct aa_profile *profile = NULL;
479 
480         if (strcmp(name, "current") == 0)
481                 profile = aa_get_newest_profile(cxt->profile);
482         else if (strcmp(name, "prev") == 0  && cxt->previous)
483                 profile = aa_get_newest_profile(cxt->previous);
484         else if (strcmp(name, "exec") == 0 && cxt->onexec)
485                 profile = aa_get_newest_profile(cxt->onexec);
486         else
487                 error = -EINVAL;
488 
489         if (profile)
490                 error = aa_getprocattr(profile, value);
491 
492         aa_put_profile(profile);
493         put_cred(cred);
494 
495         return error;
496 }
497 
498 static int apparmor_setprocattr(struct task_struct *task, char *name,
499                                 void *value, size_t size)
500 {
501         struct common_audit_data sa;
502         struct apparmor_audit_data aad = {0,};
503         char *command, *largs = NULL, *args = value;
504         size_t arg_size;
505         int error;
506 
507         if (size == 0)
508                 return -EINVAL;
509         /* task can only write its own attributes */
510         if (current != task)
511                 return -EACCES;
512 
513         /* AppArmor requires that the buffer must be null terminated atm */
514         if (args[size - 1] != '\0') {
515                 /* null terminate */
516                 largs = args = kmalloc(size + 1, GFP_KERNEL);
517                 if (!args)
518                         return -ENOMEM;
519                 memcpy(args, value, size);
520                 args[size] = '\0';
521         }
522 
523         error = -EINVAL;
524         args = strim(args);
525         command = strsep(&args, " ");
526         if (!args)
527                 goto out;
528         args = skip_spaces(args);
529         if (!*args)
530                 goto out;
531 
532         arg_size = size - (args - (char *) value);
533         if (strcmp(name, "current") == 0) {
534                 if (strcmp(command, "changehat") == 0) {
535                         error = aa_setprocattr_changehat(args, arg_size,
536                                                          !AA_DO_TEST);
537                 } else if (strcmp(command, "permhat") == 0) {
538                         error = aa_setprocattr_changehat(args, arg_size,
539                                                          AA_DO_TEST);
540                 } else if (strcmp(command, "changeprofile") == 0) {
541                         error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
542                                                              !AA_DO_TEST);
543                 } else if (strcmp(command, "permprofile") == 0) {
544                         error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
545                                                              AA_DO_TEST);
546                 } else
547                         goto fail;
548         } else if (strcmp(name, "exec") == 0) {
549                 if (strcmp(command, "exec") == 0)
550                         error = aa_setprocattr_changeprofile(args, AA_ONEXEC,
551                                                              !AA_DO_TEST);
552                 else
553                         goto fail;
554         } else
555                 /* only support the "current" and "exec" process attributes */
556                 goto fail;
557 
558         if (!error)
559                 error = size;
560 out:
561         kfree(largs);
562         return error;
563 
564 fail:
565         sa.type = LSM_AUDIT_DATA_NONE;
566         sa.aad = &aad;
567         aad.profile = aa_current_profile();
568         aad.op = OP_SETPROCATTR;
569         aad.info = name;
570         aad.error = error = -EINVAL;
571         aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
572         goto out;
573 }
574 
575 static int apparmor_task_setrlimit(struct task_struct *task,
576                 unsigned int resource, struct rlimit *new_rlim)
577 {
578         struct aa_profile *profile = __aa_current_profile();
579         int error = 0;
580 
581         if (!unconfined(profile))
582                 error = aa_task_setrlimit(profile, task, resource, new_rlim);
583 
584         return error;
585 }
586 
587 static struct security_hook_list apparmor_hooks[] = {
588         LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
589         LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
590         LSM_HOOK_INIT(capget, apparmor_capget),
591         LSM_HOOK_INIT(capable, apparmor_capable),
592 
593         LSM_HOOK_INIT(path_link, apparmor_path_link),
594         LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
595         LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
596         LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
597         LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
598         LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
599         LSM_HOOK_INIT(path_rename, apparmor_path_rename),
600         LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
601         LSM_HOOK_INIT(path_chown, apparmor_path_chown),
602         LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
603         LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
604 
605         LSM_HOOK_INIT(file_open, apparmor_file_open),
606         LSM_HOOK_INIT(file_permission, apparmor_file_permission),
607         LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
608         LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
609         LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
610         LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
611         LSM_HOOK_INIT(file_lock, apparmor_file_lock),
612 
613         LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
614         LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
615 
616         LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
617         LSM_HOOK_INIT(cred_free, apparmor_cred_free),
618         LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
619         LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
620 
621         LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
622         LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
623         LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
624         LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
625 
626         LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
627 };
628 
629 /*
630  * AppArmor sysfs module parameters
631  */
632 
633 static int param_set_aabool(const char *val, const struct kernel_param *kp);
634 static int param_get_aabool(char *buffer, const struct kernel_param *kp);
635 #define param_check_aabool param_check_bool
636 static const struct kernel_param_ops param_ops_aabool = {
637         .flags = KERNEL_PARAM_OPS_FL_NOARG,
638         .set = param_set_aabool,
639         .get = param_get_aabool
640 };
641 
642 static int param_set_aauint(const char *val, const struct kernel_param *kp);
643 static int param_get_aauint(char *buffer, const struct kernel_param *kp);
644 #define param_check_aauint param_check_uint
645 static const struct kernel_param_ops param_ops_aauint = {
646         .set = param_set_aauint,
647         .get = param_get_aauint
648 };
649 
650 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
651 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
652 #define param_check_aalockpolicy param_check_bool
653 static const struct kernel_param_ops param_ops_aalockpolicy = {
654         .flags = KERNEL_PARAM_OPS_FL_NOARG,
655         .set = param_set_aalockpolicy,
656         .get = param_get_aalockpolicy
657 };
658 
659 static int param_set_audit(const char *val, struct kernel_param *kp);
660 static int param_get_audit(char *buffer, struct kernel_param *kp);
661 
662 static int param_set_mode(const char *val, struct kernel_param *kp);
663 static int param_get_mode(char *buffer, struct kernel_param *kp);
664 
665 /* Flag values, also controllable via /sys/module/apparmor/parameters
666  * We define special types as we want to do additional mediation.
667  */
668 
669 /* AppArmor global enforcement switch - complain, enforce, kill */
670 enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
671 module_param_call(mode, param_set_mode, param_get_mode,
672                   &aa_g_profile_mode, S_IRUSR | S_IWUSR);
673 
674 /* Debug mode */
675 bool aa_g_debug;
676 module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
677 
678 /* Audit mode */
679 enum audit_mode aa_g_audit;
680 module_param_call(audit, param_set_audit, param_get_audit,
681                   &aa_g_audit, S_IRUSR | S_IWUSR);
682 
683 /* Determines if audit header is included in audited messages.  This
684  * provides more context if the audit daemon is not running
685  */
686 bool aa_g_audit_header = 1;
687 module_param_named(audit_header, aa_g_audit_header, aabool,
688                    S_IRUSR | S_IWUSR);
689 
690 /* lock out loading/removal of policy
691  * TODO: add in at boot loading of policy, which is the only way to
692  *       load policy, if lock_policy is set
693  */
694 bool aa_g_lock_policy;
695 module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
696                    S_IRUSR | S_IWUSR);
697 
698 /* Syscall logging mode */
699 bool aa_g_logsyscall;
700 module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
701 
702 /* Maximum pathname length before accesses will start getting rejected */
703 unsigned int aa_g_path_max = 2 * PATH_MAX;
704 module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
705 
706 /* Determines how paranoid loading of policy is and how much verification
707  * on the loaded policy is done.
708  */
709 bool aa_g_paranoid_load = 1;
710 module_param_named(paranoid_load, aa_g_paranoid_load, aabool,
711                    S_IRUSR | S_IWUSR);
712 
713 /* Boot time disable flag */
714 static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
715 module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
716 
717 static int __init apparmor_enabled_setup(char *str)
718 {
719         unsigned long enabled;
720         int error = kstrtoul(str, 0, &enabled);
721         if (!error)
722                 apparmor_enabled = enabled ? 1 : 0;
723         return 1;
724 }
725 
726 __setup("apparmor=", apparmor_enabled_setup);
727 
728 /* set global flag turning off the ability to load policy */
729 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
730 {
731         if (!capable(CAP_MAC_ADMIN))
732                 return -EPERM;
733         if (aa_g_lock_policy)
734                 return -EACCES;
735         return param_set_bool(val, kp);
736 }
737 
738 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
739 {
740         if (!capable(CAP_MAC_ADMIN))
741                 return -EPERM;
742         return param_get_bool(buffer, kp);
743 }
744 
745 static int param_set_aabool(const char *val, const struct kernel_param *kp)
746 {
747         if (!capable(CAP_MAC_ADMIN))
748                 return -EPERM;
749         return param_set_bool(val, kp);
750 }
751 
752 static int param_get_aabool(char *buffer, const struct kernel_param *kp)
753 {
754         if (!capable(CAP_MAC_ADMIN))
755                 return -EPERM;
756         return param_get_bool(buffer, kp);
757 }
758 
759 static int param_set_aauint(const char *val, const struct kernel_param *kp)
760 {
761         if (!capable(CAP_MAC_ADMIN))
762                 return -EPERM;
763         return param_set_uint(val, kp);
764 }
765 
766 static int param_get_aauint(char *buffer, const struct kernel_param *kp)
767 {
768         if (!capable(CAP_MAC_ADMIN))
769                 return -EPERM;
770         return param_get_uint(buffer, kp);
771 }
772 
773 static int param_get_audit(char *buffer, struct kernel_param *kp)
774 {
775         if (!capable(CAP_MAC_ADMIN))
776                 return -EPERM;
777 
778         if (!apparmor_enabled)
779                 return -EINVAL;
780 
781         return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
782 }
783 
784 static int param_set_audit(const char *val, struct kernel_param *kp)
785 {
786         int i;
787         if (!capable(CAP_MAC_ADMIN))
788                 return -EPERM;
789 
790         if (!apparmor_enabled)
791                 return -EINVAL;
792 
793         if (!val)
794                 return -EINVAL;
795 
796         for (i = 0; i < AUDIT_MAX_INDEX; i++) {
797                 if (strcmp(val, audit_mode_names[i]) == 0) {
798                         aa_g_audit = i;
799                         return 0;
800                 }
801         }
802 
803         return -EINVAL;
804 }
805 
806 static int param_get_mode(char *buffer, struct kernel_param *kp)
807 {
808         if (!capable(CAP_MAC_ADMIN))
809                 return -EPERM;
810 
811         if (!apparmor_enabled)
812                 return -EINVAL;
813 
814         return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
815 }
816 
817 static int param_set_mode(const char *val, struct kernel_param *kp)
818 {
819         int i;
820         if (!capable(CAP_MAC_ADMIN))
821                 return -EPERM;
822 
823         if (!apparmor_enabled)
824                 return -EINVAL;
825 
826         if (!val)
827                 return -EINVAL;
828 
829         for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) {
830                 if (strcmp(val, aa_profile_mode_names[i]) == 0) {
831                         aa_g_profile_mode = i;
832                         return 0;
833                 }
834         }
835 
836         return -EINVAL;
837 }
838 
839 /*
840  * AppArmor init functions
841  */
842 
843 /**
844  * set_init_cxt - set a task context and profile on the first task.
845  *
846  * TODO: allow setting an alternate profile than unconfined
847  */
848 static int __init set_init_cxt(void)
849 {
850         struct cred *cred = (struct cred *)current->real_cred;
851         struct aa_task_cxt *cxt;
852 
853         cxt = aa_alloc_task_context(GFP_KERNEL);
854         if (!cxt)
855                 return -ENOMEM;
856 
857         cxt->profile = aa_get_profile(root_ns->unconfined);
858         cred_cxt(cred) = cxt;
859 
860         return 0;
861 }
862 
863 static int __init apparmor_init(void)
864 {
865         int error;
866 
867         if (!apparmor_enabled || !security_module_enable("apparmor")) {
868                 aa_info_message("AppArmor disabled by boot time parameter");
869                 apparmor_enabled = 0;
870                 return 0;
871         }
872 
873         error = aa_alloc_root_ns();
874         if (error) {
875                 AA_ERROR("Unable to allocate default profile namespace\n");
876                 goto alloc_out;
877         }
878 
879         error = set_init_cxt();
880         if (error) {
881                 AA_ERROR("Failed to set context on init task\n");
882                 aa_free_root_ns();
883                 goto alloc_out;
884         }
885         security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
886 
887         /* Report that AppArmor successfully initialized */
888         apparmor_initialized = 1;
889         if (aa_g_profile_mode == APPARMOR_COMPLAIN)
890                 aa_info_message("AppArmor initialized: complain mode enabled");
891         else if (aa_g_profile_mode == APPARMOR_KILL)
892                 aa_info_message("AppArmor initialized: kill mode enabled");
893         else
894                 aa_info_message("AppArmor initialized");
895 
896         return error;
897 
898 alloc_out:
899         aa_destroy_aafs();
900 
901         apparmor_enabled = 0;
902         return error;
903 }
904 
905 security_initcall(apparmor_init);
906 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp