forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
525 lines
13 KiB
525 lines
13 KiB
// SPDX-License-Identifier: GPL-2.0-only |
|
/* |
|
* AppArmor security module |
|
* |
|
* This file contains basic common functions used in AppArmor |
|
* |
|
* Copyright (C) 1998-2008 Novell/SUSE |
|
* Copyright 2009-2010 Canonical Ltd. |
|
*/ |
|
|
|
#include <linux/ctype.h> |
|
#include <linux/mm.h> |
|
#include <linux/slab.h> |
|
#include <linux/string.h> |
|
#include <linux/vmalloc.h> |
|
|
|
#include "include/audit.h" |
|
#include "include/apparmor.h" |
|
#include "include/lib.h" |
|
#include "include/perms.h" |
|
#include "include/policy.h" |
|
|
|
struct aa_perms nullperms; |
|
struct aa_perms allperms = { .allow = ALL_PERMS_MASK, |
|
.quiet = ALL_PERMS_MASK, |
|
.hide = ALL_PERMS_MASK }; |
|
|
|
/** |
|
* aa_split_fqname - split a fqname into a profile and namespace name |
|
* @fqname: a full qualified name in namespace profile format (NOT NULL) |
|
* @ns_name: pointer to portion of the string containing the ns name (NOT NULL) |
|
* |
|
* Returns: profile name or NULL if one is not specified |
|
* |
|
* Split a namespace name from a profile name (see policy.c for naming |
|
* description). If a portion of the name is missing it returns NULL for |
|
* that portion. |
|
* |
|
* NOTE: may modify the @fqname string. The pointers returned point |
|
* into the @fqname string. |
|
*/ |
|
char *aa_split_fqname(char *fqname, char **ns_name) |
|
{ |
|
char *name = strim(fqname); |
|
|
|
*ns_name = NULL; |
|
if (name[0] == ':') { |
|
char *split = strchr(&name[1], ':'); |
|
*ns_name = skip_spaces(&name[1]); |
|
if (split) { |
|
/* overwrite ':' with \0 */ |
|
*split++ = 0; |
|
if (strncmp(split, "//", 2) == 0) |
|
split += 2; |
|
name = skip_spaces(split); |
|
} else |
|
/* a ns name without a following profile is allowed */ |
|
name = NULL; |
|
} |
|
if (name && *name == 0) |
|
name = NULL; |
|
|
|
return name; |
|
} |
|
|
|
/** |
|
* skipn_spaces - Removes leading whitespace from @str. |
|
* @str: The string to be stripped. |
|
* |
|
* Returns a pointer to the first non-whitespace character in @str. |
|
* if all whitespace will return NULL |
|
*/ |
|
|
|
const char *skipn_spaces(const char *str, size_t n) |
|
{ |
|
for (; n && isspace(*str); --n) |
|
++str; |
|
if (n) |
|
return (char *)str; |
|
return NULL; |
|
} |
|
|
|
const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name, |
|
size_t *ns_len) |
|
{ |
|
const char *end = fqname + n; |
|
const char *name = skipn_spaces(fqname, n); |
|
|
|
*ns_name = NULL; |
|
*ns_len = 0; |
|
|
|
if (!name) |
|
return NULL; |
|
|
|
if (name[0] == ':') { |
|
char *split = strnchr(&name[1], end - &name[1], ':'); |
|
*ns_name = skipn_spaces(&name[1], end - &name[1]); |
|
if (!*ns_name) |
|
return NULL; |
|
if (split) { |
|
*ns_len = split - *ns_name; |
|
if (*ns_len == 0) |
|
*ns_name = NULL; |
|
split++; |
|
if (end - split > 1 && strncmp(split, "//", 2) == 0) |
|
split += 2; |
|
name = skipn_spaces(split, end - split); |
|
} else { |
|
/* a ns name without a following profile is allowed */ |
|
name = NULL; |
|
*ns_len = end - *ns_name; |
|
} |
|
} |
|
if (name && *name == 0) |
|
name = NULL; |
|
|
|
return name; |
|
} |
|
|
|
/** |
|
* aa_info_message - log a none profile related status message |
|
* @str: message to log |
|
*/ |
|
void aa_info_message(const char *str) |
|
{ |
|
if (audit_enabled) { |
|
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL); |
|
|
|
aad(&sa)->info = str; |
|
aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL); |
|
} |
|
printk(KERN_INFO "AppArmor: %s\n", str); |
|
} |
|
|
|
__counted char *aa_str_alloc(int size, gfp_t gfp) |
|
{ |
|
struct counted_str *str; |
|
|
|
str = kmalloc(sizeof(struct counted_str) + size, gfp); |
|
if (!str) |
|
return NULL; |
|
|
|
kref_init(&str->count); |
|
return str->name; |
|
} |
|
|
|
void aa_str_kref(struct kref *kref) |
|
{ |
|
kfree(container_of(kref, struct counted_str, count)); |
|
} |
|
|
|
|
|
const char aa_file_perm_chrs[] = "xwracd km l "; |
|
const char *aa_file_perm_names[] = { |
|
"exec", |
|
"write", |
|
"read", |
|
"append", |
|
|
|
"create", |
|
"delete", |
|
"open", |
|
"rename", |
|
|
|
"setattr", |
|
"getattr", |
|
"setcred", |
|
"getcred", |
|
|
|
"chmod", |
|
"chown", |
|
"chgrp", |
|
"lock", |
|
|
|
"mmap", |
|
"mprot", |
|
"link", |
|
"snapshot", |
|
|
|
"unknown", |
|
"unknown", |
|
"unknown", |
|
"unknown", |
|
|
|
"unknown", |
|
"unknown", |
|
"unknown", |
|
"unknown", |
|
|
|
"stack", |
|
"change_onexec", |
|
"change_profile", |
|
"change_hat", |
|
}; |
|
|
|
/** |
|
* aa_perm_mask_to_str - convert a perm mask to its short string |
|
* @str: character buffer to store string in (at least 10 characters) |
|
* @str_size: size of the @str buffer |
|
* @chrs: NUL-terminated character buffer of permission characters |
|
* @mask: permission mask to convert |
|
*/ |
|
void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, u32 mask) |
|
{ |
|
unsigned int i, perm = 1; |
|
size_t num_chrs = strlen(chrs); |
|
|
|
for (i = 0; i < num_chrs; perm <<= 1, i++) { |
|
if (mask & perm) { |
|
/* Ensure that one byte is left for NUL-termination */ |
|
if (WARN_ON_ONCE(str_size <= 1)) |
|
break; |
|
|
|
*str++ = chrs[i]; |
|
str_size--; |
|
} |
|
} |
|
*str = '\0'; |
|
} |
|
|
|
void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names, |
|
u32 mask) |
|
{ |
|
const char *fmt = "%s"; |
|
unsigned int i, perm = 1; |
|
bool prev = false; |
|
|
|
for (i = 0; i < 32; perm <<= 1, i++) { |
|
if (mask & perm) { |
|
audit_log_format(ab, fmt, names[i]); |
|
if (!prev) { |
|
prev = true; |
|
fmt = " %s"; |
|
} |
|
} |
|
} |
|
} |
|
|
|
void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs, |
|
u32 chrsmask, const char * const *names, u32 namesmask) |
|
{ |
|
char str[33]; |
|
|
|
audit_log_format(ab, "\""); |
|
if ((mask & chrsmask) && chrs) { |
|
aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask); |
|
mask &= ~chrsmask; |
|
audit_log_format(ab, "%s", str); |
|
if (mask & namesmask) |
|
audit_log_format(ab, " "); |
|
} |
|
if ((mask & namesmask) && names) |
|
aa_audit_perm_names(ab, names, mask & namesmask); |
|
audit_log_format(ab, "\""); |
|
} |
|
|
|
/** |
|
* aa_audit_perms_cb - generic callback fn for auditing perms |
|
* @ab: audit buffer (NOT NULL) |
|
* @va: audit struct to audit values of (NOT NULL) |
|
*/ |
|
static void aa_audit_perms_cb(struct audit_buffer *ab, void *va) |
|
{ |
|
struct common_audit_data *sa = va; |
|
|
|
if (aad(sa)->request) { |
|
audit_log_format(ab, " requested_mask="); |
|
aa_audit_perm_mask(ab, aad(sa)->request, aa_file_perm_chrs, |
|
PERMS_CHRS_MASK, aa_file_perm_names, |
|
PERMS_NAMES_MASK); |
|
} |
|
if (aad(sa)->denied) { |
|
audit_log_format(ab, "denied_mask="); |
|
aa_audit_perm_mask(ab, aad(sa)->denied, aa_file_perm_chrs, |
|
PERMS_CHRS_MASK, aa_file_perm_names, |
|
PERMS_NAMES_MASK); |
|
} |
|
audit_log_format(ab, " peer="); |
|
aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, |
|
FLAGS_NONE, GFP_ATOMIC); |
|
} |
|
|
|
/** |
|
* aa_apply_modes_to_perms - apply namespace and profile flags to perms |
|
* @profile: that perms where computed from |
|
* @perms: perms to apply mode modifiers to |
|
* |
|
* TODO: split into profile and ns based flags for when accumulating perms |
|
*/ |
|
void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms) |
|
{ |
|
switch (AUDIT_MODE(profile)) { |
|
case AUDIT_ALL: |
|
perms->audit = ALL_PERMS_MASK; |
|
fallthrough; |
|
case AUDIT_NOQUIET: |
|
perms->quiet = 0; |
|
break; |
|
case AUDIT_QUIET: |
|
perms->audit = 0; |
|
fallthrough; |
|
case AUDIT_QUIET_DENIED: |
|
perms->quiet = ALL_PERMS_MASK; |
|
break; |
|
} |
|
|
|
if (KILL_MODE(profile)) |
|
perms->kill = ALL_PERMS_MASK; |
|
else if (COMPLAIN_MODE(profile)) |
|
perms->complain = ALL_PERMS_MASK; |
|
/* |
|
* TODO: |
|
* else if (PROMPT_MODE(profile)) |
|
* perms->prompt = ALL_PERMS_MASK; |
|
*/ |
|
} |
|
|
|
static u32 map_other(u32 x) |
|
{ |
|
return ((x & 0x3) << 8) | /* SETATTR/GETATTR */ |
|
((x & 0x1c) << 18) | /* ACCEPT/BIND/LISTEN */ |
|
((x & 0x60) << 19); /* SETOPT/GETOPT */ |
|
} |
|
|
|
void aa_compute_perms(struct aa_dfa *dfa, unsigned int state, |
|
struct aa_perms *perms) |
|
{ |
|
*perms = (struct aa_perms) { |
|
.allow = dfa_user_allow(dfa, state), |
|
.audit = dfa_user_audit(dfa, state), |
|
.quiet = dfa_user_quiet(dfa, state), |
|
}; |
|
|
|
/* for v5 perm mapping in the policydb, the other set is used |
|
* to extend the general perm set |
|
*/ |
|
perms->allow |= map_other(dfa_other_allow(dfa, state)); |
|
perms->audit |= map_other(dfa_other_audit(dfa, state)); |
|
perms->quiet |= map_other(dfa_other_quiet(dfa, state)); |
|
// perms->xindex = dfa_user_xindex(dfa, state); |
|
} |
|
|
|
/** |
|
* aa_perms_accum_raw - accumulate perms with out masking off overlapping perms |
|
* @accum - perms struct to accumulate into |
|
* @addend - perms struct to add to @accum |
|
*/ |
|
void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend) |
|
{ |
|
accum->deny |= addend->deny; |
|
accum->allow &= addend->allow & ~addend->deny; |
|
accum->audit |= addend->audit & addend->allow; |
|
accum->quiet &= addend->quiet & ~addend->allow; |
|
accum->kill |= addend->kill & ~addend->allow; |
|
accum->stop |= addend->stop & ~addend->allow; |
|
accum->complain |= addend->complain & ~addend->allow & ~addend->deny; |
|
accum->cond |= addend->cond & ~addend->allow & ~addend->deny; |
|
accum->hide &= addend->hide & ~addend->allow; |
|
accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny; |
|
} |
|
|
|
/** |
|
* aa_perms_accum - accumulate perms, masking off overlapping perms |
|
* @accum - perms struct to accumulate into |
|
* @addend - perms struct to add to @accum |
|
*/ |
|
void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend) |
|
{ |
|
accum->deny |= addend->deny; |
|
accum->allow &= addend->allow & ~accum->deny; |
|
accum->audit |= addend->audit & accum->allow; |
|
accum->quiet &= addend->quiet & ~accum->allow; |
|
accum->kill |= addend->kill & ~accum->allow; |
|
accum->stop |= addend->stop & ~accum->allow; |
|
accum->complain |= addend->complain & ~accum->allow & ~accum->deny; |
|
accum->cond |= addend->cond & ~accum->allow & ~accum->deny; |
|
accum->hide &= addend->hide & ~accum->allow; |
|
accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny; |
|
} |
|
|
|
void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label, |
|
int type, u32 request, struct aa_perms *perms) |
|
{ |
|
/* TODO: doesn't yet handle extended types */ |
|
unsigned int state; |
|
|
|
state = aa_dfa_next(profile->policy.dfa, |
|
profile->policy.start[AA_CLASS_LABEL], |
|
type); |
|
aa_label_match(profile, label, state, false, request, perms); |
|
} |
|
|
|
|
|
/* currently unused */ |
|
int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target, |
|
u32 request, int type, u32 *deny, |
|
struct common_audit_data *sa) |
|
{ |
|
struct aa_perms perms; |
|
|
|
aad(sa)->label = &profile->label; |
|
aad(sa)->peer = &target->label; |
|
aad(sa)->request = request; |
|
|
|
aa_profile_match_label(profile, &target->label, type, request, &perms); |
|
aa_apply_modes_to_perms(profile, &perms); |
|
*deny |= request & perms.deny; |
|
return aa_check_perms(profile, &perms, request, sa, aa_audit_perms_cb); |
|
} |
|
|
|
/** |
|
* aa_check_perms - do audit mode selection based on perms set |
|
* @profile: profile being checked |
|
* @perms: perms computed for the request |
|
* @request: requested perms |
|
* @deny: Returns: explicit deny set |
|
* @sa: initialized audit structure (MAY BE NULL if not auditing) |
|
* @cb: callback fn for type specific fields (MAY BE NULL) |
|
* |
|
* Returns: 0 if permission else error code |
|
* |
|
* Note: profile audit modes need to be set before calling by setting the |
|
* perm masks appropriately. |
|
* |
|
* If not auditing then complain mode is not enabled and the |
|
* error code will indicate whether there was an explicit deny |
|
* with a positive value. |
|
*/ |
|
int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms, |
|
u32 request, struct common_audit_data *sa, |
|
void (*cb)(struct audit_buffer *, void *)) |
|
{ |
|
int type, error; |
|
u32 denied = request & (~perms->allow | perms->deny); |
|
|
|
if (likely(!denied)) { |
|
/* mask off perms that are not being force audited */ |
|
request &= perms->audit; |
|
if (!request || !sa) |
|
return 0; |
|
|
|
type = AUDIT_APPARMOR_AUDIT; |
|
error = 0; |
|
} else { |
|
error = -EACCES; |
|
|
|
if (denied & perms->kill) |
|
type = AUDIT_APPARMOR_KILL; |
|
else if (denied == (denied & perms->complain)) |
|
type = AUDIT_APPARMOR_ALLOWED; |
|
else |
|
type = AUDIT_APPARMOR_DENIED; |
|
|
|
if (denied == (denied & perms->hide)) |
|
error = -ENOENT; |
|
|
|
denied &= ~perms->quiet; |
|
if (!sa || !denied) |
|
return error; |
|
} |
|
|
|
if (sa) { |
|
aad(sa)->label = &profile->label; |
|
aad(sa)->request = request; |
|
aad(sa)->denied = denied; |
|
aad(sa)->error = error; |
|
aa_audit_msg(type, sa, cb); |
|
} |
|
|
|
if (type == AUDIT_APPARMOR_ALLOWED) |
|
error = 0; |
|
|
|
return error; |
|
} |
|
|
|
|
|
/** |
|
* aa_policy_init - initialize a policy structure |
|
* @policy: policy to initialize (NOT NULL) |
|
* @prefix: prefix name if any is required. (MAYBE NULL) |
|
* @name: name of the policy, init will make a copy of it (NOT NULL) |
|
* @gfp: allocation mode |
|
* |
|
* Note: this fn creates a copy of strings passed in |
|
* |
|
* Returns: true if policy init successful |
|
*/ |
|
bool aa_policy_init(struct aa_policy *policy, const char *prefix, |
|
const char *name, gfp_t gfp) |
|
{ |
|
char *hname; |
|
|
|
/* freed by policy_free */ |
|
if (prefix) { |
|
hname = aa_str_alloc(strlen(prefix) + strlen(name) + 3, gfp); |
|
if (hname) |
|
sprintf(hname, "%s//%s", prefix, name); |
|
} else { |
|
hname = aa_str_alloc(strlen(name) + 1, gfp); |
|
if (hname) |
|
strcpy(hname, name); |
|
} |
|
if (!hname) |
|
return false; |
|
policy->hname = hname; |
|
/* base.name is a substring of fqname */ |
|
policy->name = basename(policy->hname); |
|
INIT_LIST_HEAD(&policy->list); |
|
INIT_LIST_HEAD(&policy->profiles); |
|
|
|
return true; |
|
} |
|
|
|
/** |
|
* aa_policy_destroy - free the elements referenced by @policy |
|
* @policy: policy that is to have its elements freed (NOT NULL) |
|
*/ |
|
void aa_policy_destroy(struct aa_policy *policy) |
|
{ |
|
AA_BUG(on_list_rcu(&policy->profiles)); |
|
AA_BUG(on_list_rcu(&policy->list)); |
|
|
|
/* don't free name as its a subset of hname */ |
|
aa_put_str(policy->hname); |
|
}
|
|
|