projects/linux·blob master · refs

2981 lines · 73.5 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor /sys/kernel/security/apparmor interface functions
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11#include <linux/ctype.h>
12#include <linux/slab.h>
13#include <linux/security.h>
14#include <linux/vmalloc.h>
15#include <linux/init.h>
16#include <linux/seq_file.h>
17#include <linux/uaccess.h>
18#include <linux/mount.h>
19#include <linux/namei.h>
20#include <linux/capability.h>
21#include <linux/rcupdate.h>
22#include <linux/fs.h>
23#include <linux/fs_context.h>
24#include <linux/poll.h>
25#include <linux/zstd.h>
26#include <linux/string.h>
27#include <uapi/linux/major.h>
28#include <uapi/linux/magic.h>
29
30#include "include/apparmor.h"
31#include "include/apparmorfs.h"
32#include "include/audit.h"
33#include "include/cred.h"
34#include "include/crypto.h"
35#include "include/ipc.h"
36#include "include/label.h"
37#include "include/net.h"
38#include "include/lib.h"
39#include "include/policy.h"
40#include "include/policy_ns.h"
41#include "include/resource.h"
42#include "include/policy_unpack.h"
43#include "include/task.h"
44
45/*
46 * The apparmor filesystem interface used for policy load and introspection
47 * The interface is split into two main components based on their function
48 * a securityfs component:
49 * used for static files that are always available, and which allows
50 * userspace to specify the location of the security filesystem.
51 *
52 * fns and data are prefixed with
53 * aa_sfs_
54 *
55 * an apparmorfs component:
56 * used loaded policy content and introspection. It is not part of a
57 * regular mounted filesystem and is available only through the magic
58 * policy symlink in the root of the securityfs apparmor/ directory.
59 * Tasks queries will be magically redirected to the correct portion
60 * of the policy tree based on their confinement.
61 *
62 * fns and data are prefixed with
63 * aafs_
64 *
65 * The aa_fs_ prefix is used to indicate the fn is used by both the
66 * securityfs and apparmorfs filesystems.
67 */
68
69#define IREF_POISON 101
70
71/*
72 * support fns
73 */
74
75struct rawdata_f_data {
76 struct aa_loaddata *loaddata;
77 DECLARE_FLEX_ARRAY(char, data);
78};
79
80#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
81
82static void rawdata_f_data_free(struct rawdata_f_data *private)
83{
84 if (!private)
85 return;
86
87 aa_put_i_loaddata(private->loaddata);
88 kvfree(private);
89}
90
91static struct rawdata_f_data *rawdata_f_data_alloc(size_t size)
92{
93 struct rawdata_f_data *ret;
94
95 if (size > SIZE_MAX - sizeof(*ret))
96 return ERR_PTR(-EINVAL);
97
98 ret = kvzalloc(sizeof(*ret) + size, GFP_KERNEL);
99 if (!ret)
100 return ERR_PTR(-ENOMEM);
101
102 return ret;
103}
104#endif
105
106/**
107 * mangle_name - mangle a profile name to std profile layout form
108 * @name: profile name to mangle (NOT NULL)
109 * @target: buffer to store mangled name, same length as @name (MAYBE NULL)
110 *
111 * Returns: length of mangled name
112 */
113static int mangle_name(const char *name, char *target)
114{
115 char *t = target;
116
117 while (*name == '/' || *name == '.')
118 name++;
119
120 if (target) {
121 for (; *name; name++) {
122 if (*name == '/')
123 *(t)++ = '.';
124 else if (isspace(*name))
125 *(t)++ = '_';
126 else if (isalnum(*name) || strchr("._-", *name))
127 *(t)++ = *name;
128 }
129
130 *t = 0;
131 } else {
132 int len = 0;
133 for (; *name; name++) {
134 if (isalnum(*name) || isspace(*name) ||
135 strchr("/._-", *name))
136 len++;
137 }
138
139 return len;
140 }
141
142 return t - target;
143}
144
145
146/*
147 * aafs - core fns and data for the policy tree
148 */
149
150#define AAFS_NAME "apparmorfs"
151static struct vfsmount *aafs_mnt;
152static int aafs_count;
153
154
155static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
156{
157 seq_printf(seq, "%s:[%llu]", AAFS_NAME, d_inode(dentry)->i_ino);
158 return 0;
159}
160
161static struct aa_ns *get_ns_common_ref(struct aa_common_ref *ref)
162{
163 if (ref) {
164 struct aa_label *reflabel = container_of(ref, struct aa_label,
165 count);
166 return aa_get_ns(labels_ns(reflabel));
167 }
168
169 return NULL;
170}
171
172static struct aa_proxy *get_proxy_common_ref(struct aa_common_ref *ref)
173{
174 if (ref)
175 return aa_get_proxy(container_of(ref, struct aa_proxy, count));
176
177 return NULL;
178}
179
180#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
181static struct aa_loaddata *get_loaddata_common_ref(struct aa_common_ref *ref)
182{
183 if (ref)
184 return aa_get_i_loaddata(container_of(ref, struct aa_loaddata,
185 count));
186 return NULL;
187}
188#endif
189
190static void aa_put_common_ref(struct aa_common_ref *ref)
191{
192 if (!ref)
193 return;
194
195 switch (ref->reftype) {
196 case REF_RAWDATA:
197 aa_put_i_loaddata(container_of(ref, struct aa_loaddata,
198 count));
199 break;
200 case REF_PROXY:
201 aa_put_proxy(container_of(ref, struct aa_proxy,
202 count));
203 break;
204 case REF_NS:
205 /* ns count is held on its unconfined label */
206 aa_put_ns(labels_ns(container_of(ref, struct aa_label, count)));
207 break;
208 default:
209 AA_BUG(true, "unknown refcount type");
210 break;
211 }
212}
213
214static void aa_get_common_ref(struct aa_common_ref *ref)
215{
216 kref_get(&ref->count);
217}
218
219static void aafs_evict(struct inode *inode)
220{
221 struct aa_common_ref *ref = inode->i_private;
222
223 clear_inode(inode);
224 aa_put_common_ref(ref);
225 inode->i_private = (void *) IREF_POISON;
226}
227
228static void aafs_free_inode(struct inode *inode)
229{
230 if (S_ISLNK(inode->i_mode))
231 kfree(inode->i_link);
232 free_inode_nonrcu(inode);
233}
234
235static const struct super_operations aafs_super_ops = {
236 .statfs = simple_statfs,
237 .evict_inode = aafs_evict,
238 .free_inode = aafs_free_inode,
239 .show_path = aafs_show_path,
240};
241
242static int apparmorfs_fill_super(struct super_block *sb, struct fs_context *fc)
243{
244 static struct tree_descr files[] = { {""} };
245 int error;
246
247 error = simple_fill_super(sb, AAFS_MAGIC, files);
248 if (error)
249 return error;
250 sb->s_op = &aafs_super_ops;
251
252 return 0;
253}
254
255static int apparmorfs_get_tree(struct fs_context *fc)
256{
257 return get_tree_single(fc, apparmorfs_fill_super);
258}
259
260static const struct fs_context_operations apparmorfs_context_ops = {
261 .get_tree = apparmorfs_get_tree,
262};
263
264static int apparmorfs_init_fs_context(struct fs_context *fc)
265{
266 fc->ops = &apparmorfs_context_ops;
267 return 0;
268}
269
270static struct file_system_type aafs_ops = {
271 .owner = THIS_MODULE,
272 .name = AAFS_NAME,
273 .init_fs_context = apparmorfs_init_fs_context,
274 .kill_sb = kill_anon_super,
275};
276
277/**
278 * __aafs_setup_d_inode - basic inode setup for apparmorfs
279 * @dir: parent directory for the dentry
280 * @dentry: dentry we are setting the inode up for
281 * @mode: permissions the file should have
282 * @data: data to store on inode.i_private, available in open()
283 * @link: if symlink, symlink target string
284 * @fops: struct file_operations that should be used
285 * @iops: struct of inode_operations that should be used
286 */
287static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
288 umode_t mode, void *data, char *link,
289 const struct file_operations *fops,
290 const struct inode_operations *iops)
291{
292 struct inode *inode = new_inode(dir->i_sb);
293
294 AA_BUG(!dir);
295 AA_BUG(!dentry);
296
297 if (!inode)
298 return -ENOMEM;
299
300 inode->i_ino = get_next_ino();
301 inode->i_mode = mode;
302 simple_inode_init_ts(inode);
303 inode->i_private = data;
304 if (S_ISDIR(mode)) {
305 inode->i_op = iops ? iops : &simple_dir_inode_operations;
306 inode->i_fop = &simple_dir_operations;
307 inc_nlink(inode);
308 inc_nlink(dir);
309 } else if (S_ISLNK(mode)) {
310 inode->i_op = iops ? iops : &simple_symlink_inode_operations;
311 inode->i_link = link;
312 } else {
313 inode->i_fop = fops;
314 }
315 d_instantiate(dentry, inode);
316 dget(dentry);
317
318 return 0;
319}
320
321/**
322 * aafs_create - create a dentry in the apparmorfs filesystem
323 *
324 * @name: name of dentry to create
325 * @mode: permissions the file should have
326 * @parent: parent directory for this dentry
327 * @data: data to store on inode.i_private, available in open()
328 * @link: if symlink, symlink target string
329 * @fops: struct file_operations that should be used for
330 * @iops: struct of inode_operations that should be used
331 *
332 * This is the basic "create a xxx" function for apparmorfs.
333 *
334 * Returns a pointer to a dentry if it succeeds, that must be free with
335 * aafs_remove(). Will return ERR_PTR on failure.
336 */
337static struct dentry *aafs_create(const char *name, umode_t mode,
338 struct dentry *parent,
339 struct aa_common_ref *data, void *link,
340 const struct file_operations *fops,
341 const struct inode_operations *iops)
342{
343 struct dentry *dentry;
344 struct inode *dir;
345 int error;
346
347 AA_BUG(!name);
348 AA_BUG(!parent);
349
350 if (!(mode & S_IFMT))
351 mode = (mode & S_IALLUGO) | S_IFREG;
352
353 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
354 if (error)
355 return ERR_PTR(error);
356
357 dir = d_inode(parent);
358
359 dentry = simple_start_creating(parent, name);
360 if (IS_ERR(dentry)) {
361 error = PTR_ERR(dentry);
362 goto fail;
363 }
364
365 error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
366 simple_done_creating(dentry);
367 if (error)
368 goto fail;
369
370 if (data)
371 aa_get_common_ref(data);
372
373 return dentry;
374
375fail:
376 simple_release_fs(&aafs_mnt, &aafs_count);
377 return ERR_PTR(error);
378}
379
380/**
381 * aafs_create_file - create a file in the apparmorfs filesystem
382 *
383 * @name: name of dentry to create
384 * @mode: permissions the file should have
385 * @parent: parent directory for this dentry
386 * @data: data to store on inode.i_private, available in open()
387 * @fops: struct file_operations that should be used for
388 *
389 * see aafs_create
390 */
391static struct dentry *aafs_create_file(const char *name, umode_t mode,
392 struct dentry *parent,
393 struct aa_common_ref *data,
394 const struct file_operations *fops)
395{
396 return aafs_create(name, mode, parent, data, NULL, fops, NULL);
397}
398
399/**
400 * aafs_create_dir - create a directory in the apparmorfs filesystem
401 *
402 * @name: name of dentry to create
403 * @parent: parent directory for this dentry
404 *
405 * see aafs_create
406 */
407static struct dentry *aafs_create_dir(const char *name, struct dentry *parent)
408{
409 return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL,
410 NULL);
411}
412
413/**
414 * aafs_remove - removes a file or directory from the apparmorfs filesystem
415 *
416 * @dentry: dentry of the file/directory/symlink to removed.
417 */
418static void aafs_remove(struct dentry *dentry)
419{
420 struct inode *dir;
421
422 if (!dentry || IS_ERR(dentry))
423 return;
424
425 /* ->d_parent is stable as rename is not supported */
426 dir = d_inode(dentry->d_parent);
427 dentry = start_removing_dentry(dentry->d_parent, dentry);
428 if (!IS_ERR(dentry) && simple_positive(dentry)) {
429 if (d_is_dir(dentry)) {
430 if (!WARN_ON(!simple_empty(dentry))) {
431 __simple_rmdir(dir, dentry);
432 dput(dentry);
433 }
434 } else {
435 __simple_unlink(dir, dentry);
436 dput(dentry);
437 }
438 d_delete(dentry);
439 }
440 end_removing(dentry);
441 simple_release_fs(&aafs_mnt, &aafs_count);
442}
443
444
445/*
446 * aa_fs - policy load/replace/remove
447 */
448
449/**
450 * aa_simple_write_to_buffer - common routine for getting policy from user
451 * @userbuf: user buffer to copy data from (NOT NULL)
452 * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size)
453 * @copy_size: size of data to copy from user buffer
454 * @pos: position write is at in the file (NOT NULL)
455 *
456 * Returns: kernel buffer containing copy of user buffer data or an
457 * ERR_PTR on failure.
458 */
459static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
460 size_t alloc_size,
461 size_t copy_size,
462 loff_t *pos)
463{
464 struct aa_loaddata *data;
465
466 AA_BUG(copy_size > alloc_size);
467
468 if (*pos != 0)
469 /* only writes from pos 0, that is complete writes */
470 return ERR_PTR(-ESPIPE);
471
472 /* freed by caller to simple_write_to_buffer */
473 data = aa_loaddata_alloc(alloc_size);
474 if (IS_ERR(data))
475 return data;
476
477 data->size = copy_size;
478 if (copy_from_user(data->data, userbuf, copy_size)) {
479 /* trigger free - don't need to put pcount */
480 aa_put_i_loaddata(data);
481 return ERR_PTR(-EFAULT);
482 }
483
484 return data;
485}
486
487#if defined(CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY) || \
488 defined(CONFIG_SECURITY_APPARMOR_EXPORT_BINARY)
489static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen)
490{
491 if (slen < dlen) {
492 const size_t wksp_len = zstd_dctx_workspace_bound();
493 zstd_dctx *ctx;
494 void *wksp;
495 size_t out_len;
496 int ret = 0;
497
498 wksp = kvzalloc(wksp_len, GFP_KERNEL);
499 if (!wksp) {
500 ret = -ENOMEM;
501 goto cleanup;
502 }
503 ctx = zstd_init_dctx(wksp, wksp_len);
504 if (ctx == NULL) {
505 ret = -ENOMEM;
506 goto cleanup;
507 }
508 out_len = zstd_decompress_dctx(ctx, dst, dlen, src, slen);
509 if (zstd_is_error(out_len)) {
510 ret = -EINVAL;
511 goto cleanup;
512 }
513cleanup:
514 kvfree(wksp);
515 return ret;
516 }
517
518 if (dlen < slen)
519 return -EINVAL;
520 memcpy(dst, src, slen);
521 return 0;
522}
523#endif
524
525
526#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
527/**
528 * aa_get_data_from_compressed - common routine for getting compressed policy
529 * from user and get both compressed and uncompressed version.
530 * @userbuf: user buffer to copy data from (NOT NULL)
531 * @buffer_size: size of user buffer
532 * @pos: position write is at in the file (NOT NULL)
533 * @compressed_data: Ptr on compressed data. *compressed_data is allocated there
534 *
535 * Returns: kernel buffer containing copy of user buffer data or an
536 * ERR_PTR on failure.
537 */
538static struct aa_loaddata *aa_get_data_from_compressed(const char __user *userbuf,
539 size_t buffer_size,
540 loff_t *pos,
541 char **compressed_data)
542{
543 struct aa_loaddata *data;
544 zstd_frame_header header;
545 int error;
546
547 if (!userbuf || !pos)
548 return ERR_PTR(-EINVAL);
549 if (*pos)
550 return ERR_PTR(-ESPIPE);
551
552 *compressed_data = kvmalloc(buffer_size, GFP_KERNEL);
553 if (!*compressed_data)
554 return ERR_PTR(-ENOMEM);
555 if (copy_from_user(*compressed_data, userbuf, buffer_size)) {
556 error = -EFAULT;
557 goto fail;
558 }
559 error = zstd_get_frame_header(&header, *compressed_data, buffer_size);
560 if (error || header.frameContentSize == ZSTD_CONTENTSIZE_UNKNOWN ||
561 header.frameContentSize == ZSTD_CONTENTSIZE_ERROR) {
562 error = -EINVAL;
563 goto fail;
564 }
565
566 data = aa_loaddata_alloc(header.frameContentSize);
567 if (IS_ERR(data)) {
568 error = PTR_ERR(data);
569 goto fail;
570 }
571
572 // We then decompress the data
573 error = decompress_zstd(*compressed_data, buffer_size, data->data,
574 header.frameContentSize);
575 if (error)
576 goto fail_decompress;
577
578 data->size = header.frameContentSize;
579 return data;
580
581fail_decompress:
582 aa_put_i_loaddata(data);
583fail:
584 kvfree(*compressed_data);
585 return ERR_PTR(error);
586
587}
588#else
589static struct aa_loaddata *aa_get_data_from_compressed(const char __user *userbuf __always_unused,
590 size_t buffer_size __always_unused,
591 loff_t *pos __always_unused,
592 char **compressed_data __always_unused)
593{
594 return ERR_PTR(-EINVAL);
595}
596#endif /* CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY */
597
598struct aa_user_hdr {
599 uint8_t version;
600 uint8_t compress_level;
601 uint8_t padding[6]; /* force 8-byte alignment */
602} __packed __aligned(8);
603
604#define aa_hdr_magic "\x04\x08\x00\x76\x65\x72\x73\x69\x6f\x6e\x00\x02"
605#define aa_hdr_magic_size 12
606
607static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
608 loff_t *pos, struct aa_ns *ns,
609 const struct cred *ocred)
610{
611 struct aa_loaddata *data;
612 struct aa_label *label;
613 ssize_t error;
614 char *compressed_data = NULL;
615 __le32 magic_le;
616 bool is_compressed;
617 u8 aahdr[aa_hdr_magic_size];
618 bool needput;
619
620 label = begin_current_label_crit_section(&needput);
621
622 /* high level check about policy management - fine grained in
623 * below after unpack
624 */
625 error = aa_may_manage_policy(current_cred(), label, ns, ocred, mask);
626 if (error)
627 goto end_section;
628
629 /* If the policy is userspace compressed we start by decompressing it
630 * to make the required checks (computing hash, verifying profile, ...)
631 *
632 * Getting a userspace-compressed version then decompressing it in the
633 * kernel actually makes sense since zstd decompression is ~3.5x faster
634 * than compression. This also allow to increase the compression level.
635 */
636
637 if (size >= sizeof(__le32) &&
638 !copy_from_user(&magic_le, buf, sizeof(magic_le)) &&
639 le32_to_cpu(magic_le) == ZSTD_MAGICNUMBER) {
640 is_compressed = true;
641 } else if (size >= sizeof(struct aa_user_hdr) + sizeof(__le32) &&
642 !copy_from_user(&magic_le,
643 buf + sizeof(struct aa_user_hdr),
644 sizeof(magic_le)) &&
645 le32_to_cpu(magic_le) == ZSTD_MAGICNUMBER) {
646 is_compressed = true;
647 /* skip the userspace header if present */
648 buf += sizeof(struct aa_user_hdr);
649 size -= sizeof(struct aa_user_hdr);
650 } else if (size >= sizeof(struct aa_user_hdr) +
651 aa_hdr_magic_size &&
652 !copy_from_user(&aahdr,
653 buf + sizeof(struct aa_user_hdr),
654 aa_hdr_magic_size) &&
655 memcmp(&aahdr, aa_hdr_magic, aa_hdr_magic_size) == 0) {
656 /* uncompressed blob with user hdr */
657 buf += sizeof(struct aa_user_hdr);
658 size -= sizeof(struct aa_user_hdr);
659 is_compressed = false;
660 } else {
661 is_compressed = false;
662 }
663 if (is_compressed) {
664
665 data = aa_get_data_from_compressed(buf, size, pos, &compressed_data);
666 error = PTR_ERR(data);
667 } else {
668 data = aa_simple_write_to_buffer(buf, size, size, pos);
669 error = PTR_ERR(data);
670 }
671
672 if (!IS_ERR(data)) {
673 error = aa_replace_profiles(ns, label, mask, data,
674 compressed_data, size);
675 /* put pcount, which will put count and free if no
676 * profiles referencing it.
677 */
678 aa_put_profile_loaddata(data);
679 }
680end_section:
681 end_current_label_crit_section(label, needput);
682
683 return error;
684}
685
686/* .load file hook fn to load policy */
687static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
688 loff_t *pos)
689{
690 struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
691 int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns,
692 f->f_cred);
693
694 aa_put_ns(ns);
695
696 return error;
697}
698
699static const struct file_operations aa_fs_profile_load = {
700 .write = profile_load,
701 .llseek = default_llseek,
702};
703
704/* .replace file hook fn to load and/or replace policy */
705static ssize_t profile_replace(struct file *f, const char __user *buf,
706 size_t size, loff_t *pos)
707{
708 struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
709 int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
710 buf, size, pos, ns, f->f_cred);
711 aa_put_ns(ns);
712
713 return error;
714}
715
716static const struct file_operations aa_fs_profile_replace = {
717 .write = profile_replace,
718 .llseek = default_llseek,
719};
720
721
722/* .remove file hook fn to remove loaded policy */
723static ssize_t profile_remove(struct file *f, const char __user *buf,
724 size_t size, loff_t *pos)
725{
726 struct aa_loaddata *data;
727 struct aa_label *label;
728 ssize_t error;
729 struct aa_ns *ns = get_ns_common_ref(f->f_inode->i_private);
730 bool needput;
731
732 label = begin_current_label_crit_section(&needput);
733 /* high level check about policy management - fine grained in
734 * below after unpack
735 */
736 error = aa_may_manage_policy(current_cred(), label, ns,
737 f->f_cred, AA_MAY_REMOVE_POLICY);
738 if (error)
739 goto out;
740
741 /*
742 * aa_remove_profile needs a null terminated string so 1 extra
743 * byte is allocated and the copied data is null terminated.
744 */
745 data = aa_simple_write_to_buffer(buf, size + 1, size, pos);
746
747 error = PTR_ERR(data);
748 if (!IS_ERR(data)) {
749 data->data[size] = 0;
750 error = aa_remove_profiles(ns, label, data->data, size);
751 aa_put_profile_loaddata(data);
752 }
753 out:
754 end_current_label_crit_section(label, needput);
755 aa_put_ns(ns);
756 return error;
757}
758
759static const struct file_operations aa_fs_profile_remove = {
760 .write = profile_remove,
761 .llseek = default_llseek,
762};
763
764struct aa_revision {
765 struct aa_ns *ns;
766 long last_read;
767};
768
769/* revision file hook fn for policy loads */
770static int ns_revision_release(struct inode *inode, struct file *file)
771{
772 struct aa_revision *rev = file->private_data;
773
774 if (rev) {
775 aa_put_ns(rev->ns);
776 kfree(rev);
777 }
778
779 return 0;
780}
781
782static ssize_t ns_revision_read(struct file *file, char __user *buf,
783 size_t size, loff_t *ppos)
784{
785 struct aa_revision *rev = file->private_data;
786 char buffer[32];
787 long last_read;
788 int avail;
789
790 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
791 last_read = rev->last_read;
792 if (last_read == rev->ns->revision) {
793 mutex_unlock(&rev->ns->lock);
794 if (file->f_flags & O_NONBLOCK)
795 return -EAGAIN;
796 if (wait_event_interruptible(rev->ns->wait,
797 last_read !=
798 READ_ONCE(rev->ns->revision)))
799 return -ERESTARTSYS;
800 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
801 }
802
803 avail = sprintf(buffer, "%ld\n", rev->ns->revision);
804 if (*ppos + size > avail) {
805 rev->last_read = rev->ns->revision;
806 *ppos = 0;
807 }
808 mutex_unlock(&rev->ns->lock);
809
810 return simple_read_from_buffer(buf, size, ppos, buffer, avail);
811}
812
813static int ns_revision_open(struct inode *inode, struct file *file)
814{
815 struct aa_revision *rev = kzalloc_obj(*rev);
816
817 if (!rev)
818 return -ENOMEM;
819
820 rev->ns = get_ns_common_ref(inode->i_private);
821 if (!rev->ns)
822 rev->ns = aa_get_current_ns();
823 file->private_data = rev;
824
825 return 0;
826}
827
828static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
829{
830 struct aa_revision *rev = file->private_data;
831 __poll_t mask = 0;
832
833 if (rev) {
834 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
835 poll_wait(file, &rev->ns->wait, pt);
836 if (rev->last_read < rev->ns->revision)
837 mask |= EPOLLIN | EPOLLRDNORM;
838 mutex_unlock(&rev->ns->lock);
839 }
840
841 return mask;
842}
843
844void __aa_bump_ns_revision(struct aa_ns *ns)
845{
846 WRITE_ONCE(ns->revision, READ_ONCE(ns->revision) + 1);
847 wake_up_interruptible(&ns->wait);
848}
849
850static const struct file_operations aa_fs_ns_revision_fops = {
851 .owner = THIS_MODULE,
852 .open = ns_revision_open,
853 .poll = ns_revision_poll,
854 .read = ns_revision_read,
855 .llseek = generic_file_llseek,
856 .release = ns_revision_release,
857};
858
859static void profile_query_cb(const struct aa_profile *profile,
860 struct aa_perms *perms,
861 const char *match_str, size_t match_len)
862{
863 struct aa_ruleset *rules = profile->label.rules[0];
864 struct aa_perms tmp = { };
865 aa_state_t state = DFA_NOMATCH;
866
867 if (profile_unconfined(profile))
868 return;
869 if (rules->file->dfa && *match_str == AA_CLASS_FILE) {
870 state = aa_dfa_match_len(rules->file->dfa,
871 rules->file->start[AA_CLASS_FILE],
872 match_str + 1, match_len - 1);
873 if (state) {
874 struct path_cond cond = { };
875
876 tmp = *(aa_lookup_condperms(current_fsuid(),
877 rules->file, state, &cond));
878 }
879 } else if (rules->policy->dfa) {
880 if (!RULE_MEDIATES(rules, *match_str))
881 return; /* no change to current perms */
882 /* old user space does not correctly detect dbus mediation
883 * support so we may get dbus policy and requests when
884 * the abi doesn't support it. This can cause mediation
885 * regressions, so explicitly test for this situation.
886 */
887 if (*match_str == AA_CLASS_DBUS &&
888 !RULE_MEDIATES_v9NET(rules))
889 return; /* no change to current perms */
890 state = aa_dfa_match_len(rules->policy->dfa,
891 rules->policy->start[0],
892 match_str, match_len);
893 if (state)
894 tmp = *aa_lookup_perms(rules->policy, state);
895 }
896 aa_apply_modes_to_perms(profile, &tmp);
897 aa_perms_accum_raw(perms, &tmp);
898}
899
900
901/**
902 * query_data - queries a policy and writes its data to buf
903 * @buf: the resulting data is stored here (NOT NULL)
904 * @buf_len: size of buf
905 * @query: query string used to retrieve data
906 * @query_len: size of query including second NUL byte
907 *
908 * The buffers pointed to by buf and query may overlap. The query buffer is
909 * parsed before buf is written to.
910 *
911 * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of
912 * the security confinement context and <KEY> is the name of the data to
913 * retrieve. <LABEL> and <KEY> must not be NUL-terminated.
914 *
915 * Don't expect the contents of buf to be preserved on failure.
916 *
917 * Returns: number of characters written to buf or -errno on failure
918 */
919static ssize_t query_data(char *buf, size_t buf_len,
920 char *query, size_t query_len)
921{
922 char *out;
923 const char *key;
924 struct label_it i;
925 struct aa_label *label, *curr;
926 struct aa_profile *profile;
927 struct aa_data *data;
928 u32 bytes, blocks;
929 __le32 outle32;
930 bool needput;
931
932 if (!query_len)
933 return -EINVAL; /* need a query */
934
935 key = query + strnlen(query, query_len) + 1;
936 if (key + 1 >= query + query_len)
937 return -EINVAL; /* not enough space for a non-empty key */
938 if (key + strnlen(key, query + query_len - key) >= query + query_len)
939 return -EINVAL; /* must end with NUL */
940
941 if (buf_len < sizeof(bytes) + sizeof(blocks))
942 return -EINVAL; /* not enough space */
943
944 curr = begin_current_label_crit_section(&needput);
945 label = aa_label_parse(curr, query, GFP_KERNEL, false, false);
946 end_current_label_crit_section(curr, needput);
947 if (IS_ERR(label))
948 return PTR_ERR(label);
949
950 /* We are going to leave space for two numbers. The first is the total
951 * number of bytes we are writing after the first number. This is so
952 * users can read the full output without reallocation.
953 *
954 * The second number is the number of data blocks we're writing. An
955 * application might be confined by multiple policies having data in
956 * the same key.
957 */
958 memset(buf, 0, sizeof(bytes) + sizeof(blocks));
959 out = buf + sizeof(bytes) + sizeof(blocks);
960
961 blocks = 0;
962 label_for_each_confined(i, label, profile) {
963 if (!profile->data)
964 continue;
965
966 data = rhashtable_lookup_fast(profile->data, &key,
967 profile->data->p);
968
969 if (data) {
970 if (out + sizeof(outle32) + data->size > buf +
971 buf_len) {
972 aa_put_label(label);
973 return -EINVAL; /* not enough space */
974 }
975 outle32 = __cpu_to_le32(data->size);
976 memcpy(out, &outle32, sizeof(outle32));
977 out += sizeof(outle32);
978 memcpy(out, data->data, data->size);
979 out += data->size;
980 blocks++;
981 }
982 }
983 aa_put_label(label);
984
985 outle32 = __cpu_to_le32(out - buf - sizeof(bytes));
986 memcpy(buf, &outle32, sizeof(outle32));
987 outle32 = __cpu_to_le32(blocks);
988 memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32));
989
990 return out - buf;
991}
992
993/**
994 * query_label - queries a label and writes permissions to buf
995 * @buf: the resulting permissions string is stored here (NOT NULL)
996 * @buf_len: size of buf
997 * @query: binary query string to match against the dfa
998 * @query_len: size of query
999 * @view_only: only compute for querier's view
1000 *
1001 * The buffers pointed to by buf and query may overlap. The query buffer is
1002 * parsed before buf is written to.
1003 *
1004 * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is
1005 * the name of the label, in the current namespace, that is to be queried and
1006 * DFA_STRING is a binary string to match against the label(s)'s DFA.
1007 *
1008 * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters
1009 * but must *not* be NUL terminated.
1010 *
1011 * Returns: number of characters written to buf or -errno on failure
1012 */
1013static ssize_t query_label(char *buf, size_t buf_len,
1014 char *query, size_t query_len, bool view_only)
1015{
1016 struct aa_profile *profile;
1017 struct aa_label *label, *curr;
1018 char *label_name, *match_str;
1019 size_t label_name_len, match_len;
1020 struct aa_perms perms;
1021 struct label_it i;
1022 bool needput;
1023
1024 if (!query_len)
1025 return -EINVAL;
1026
1027 label_name = query;
1028 label_name_len = strnlen(query, query_len);
1029 if (!label_name_len || label_name_len == query_len)
1030 return -EINVAL;
1031
1032 /**
1033 * The extra byte is to account for the null byte between the
1034 * profile name and dfa string. profile_name_len is greater
1035 * than zero and less than query_len, so a byte can be safely
1036 * added or subtracted.
1037 */
1038 match_str = label_name + label_name_len + 1;
1039 match_len = query_len - label_name_len - 1;
1040
1041 curr = begin_current_label_crit_section(&needput);
1042 label = aa_label_parse(curr, label_name, GFP_KERNEL, false, false);
1043 end_current_label_crit_section(curr, needput);
1044 if (IS_ERR(label))
1045 return PTR_ERR(label);
1046
1047 perms = allperms;
1048 if (view_only) {
1049 label_for_each_in_scope(i, labels_ns(label), label, profile) {
1050 profile_query_cb(profile, &perms, match_str, match_len);
1051 }
1052 } else {
1053 label_for_each(i, label, profile) {
1054 profile_query_cb(profile, &perms, match_str, match_len);
1055 }
1056 }
1057 aa_put_label(label);
1058
1059 return scnprintf(buf, buf_len,
1060 "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n",
1061 perms.allow, perms.deny, perms.audit, perms.quiet);
1062}
1063
1064/*
1065 * Transaction based IO.
1066 * The file expects a write which triggers the transaction, and then
1067 * possibly a read(s) which collects the result - which is stored in a
1068 * file-local buffer. Once a new write is performed, a new set of results
1069 * are stored in the file-local buffer.
1070 */
1071struct multi_transaction {
1072 struct kref count;
1073 ssize_t size;
1074 char data[];
1075};
1076
1077#define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction))
1078
1079static void multi_transaction_kref(struct kref *kref)
1080{
1081 struct multi_transaction *t;
1082
1083 t = container_of(kref, struct multi_transaction, count);
1084 kfree(t);
1085}
1086
1087static struct multi_transaction *
1088get_multi_transaction(struct multi_transaction *t)
1089{
1090 if (t)
1091 kref_get(&(t->count));
1092
1093 return t;
1094}
1095
1096static void put_multi_transaction(struct multi_transaction *t)
1097{
1098 if (t)
1099 kref_put(&(t->count), multi_transaction_kref);
1100}
1101
1102/* does not increment @new's count */
1103static void multi_transaction_set(struct file *file,
1104 struct multi_transaction *new, size_t n)
1105{
1106 struct multi_transaction *old;
1107
1108 AA_BUG(n > MULTI_TRANSACTION_LIMIT);
1109
1110 new->size = n;
1111 spin_lock(&file->f_lock);
1112 old = (struct multi_transaction *) file->private_data;
1113 file->private_data = new;
1114 spin_unlock(&file->f_lock);
1115 put_multi_transaction(old);
1116}
1117
1118static struct multi_transaction *multi_transaction_new(struct file *file,
1119 const char __user *buf,
1120 size_t size)
1121{
1122 struct multi_transaction *t;
1123
1124 if (size > MULTI_TRANSACTION_LIMIT - 1)
1125 return ERR_PTR(-EFBIG);
1126
1127 t = kzalloc(PAGE_SIZE, GFP_KERNEL);
1128 if (!t)
1129 return ERR_PTR(-ENOMEM);
1130 kref_init(&t->count);
1131 if (copy_from_user(t->data, buf, size)) {
1132 put_multi_transaction(t);
1133 return ERR_PTR(-EFAULT);
1134 }
1135
1136 return t;
1137}
1138
1139static ssize_t multi_transaction_read(struct file *file, char __user *buf,
1140 size_t size, loff_t *pos)
1141{
1142 struct multi_transaction *t;
1143 ssize_t ret;
1144
1145 spin_lock(&file->f_lock);
1146 t = get_multi_transaction(file->private_data);
1147 spin_unlock(&file->f_lock);
1148
1149 if (!t)
1150 return 0;
1151
1152 ret = simple_read_from_buffer(buf, size, pos, t->data, t->size);
1153 put_multi_transaction(t);
1154
1155 return ret;
1156}
1157
1158static int multi_transaction_release(struct inode *inode, struct file *file)
1159{
1160 put_multi_transaction(file->private_data);
1161
1162 return 0;
1163}
1164
1165#define QUERY_CMD_LABEL "label\0"
1166#define QUERY_CMD_LABEL_LEN 6
1167#define QUERY_CMD_PROFILE "profile\0"
1168#define QUERY_CMD_PROFILE_LEN 8
1169#define QUERY_CMD_LABELALL "labelall\0"
1170#define QUERY_CMD_LABELALL_LEN 9
1171#define QUERY_CMD_DATA "data\0"
1172#define QUERY_CMD_DATA_LEN 5
1173
1174/**
1175 * aa_write_access - generic permissions and data query
1176 * @file: pointer to open apparmorfs/access file
1177 * @ubuf: user buffer containing the complete query string (NOT NULL)
1178 * @count: size of ubuf
1179 * @ppos: position in the file (MUST BE ZERO)
1180 *
1181 * Allows for one permissions or data query per open(), write(), and read()
1182 * sequence. The only queries currently supported are label-based queries for
1183 * permissions or data.
1184 *
1185 * For permissions queries, ubuf must begin with "label\0", followed by the
1186 * profile query specific format described in the query_label() function
1187 * documentation.
1188 *
1189 * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where
1190 * <LABEL> is the name of the security confinement context and <KEY> is the
1191 * name of the data to retrieve.
1192 *
1193 * Returns: number of bytes written or -errno on failure
1194 */
1195static ssize_t aa_write_access(struct file *file, const char __user *ubuf,
1196 size_t count, loff_t *ppos)
1197{
1198 struct multi_transaction *t;
1199 ssize_t len;
1200
1201 if (*ppos)
1202 return -ESPIPE;
1203
1204 t = multi_transaction_new(file, ubuf, count);
1205 if (IS_ERR(t))
1206 return PTR_ERR(t);
1207
1208 if (count > QUERY_CMD_PROFILE_LEN &&
1209 !memcmp(t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) {
1210 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
1211 t->data + QUERY_CMD_PROFILE_LEN,
1212 count - QUERY_CMD_PROFILE_LEN, true);
1213 } else if (count > QUERY_CMD_LABEL_LEN &&
1214 !memcmp(t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) {
1215 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
1216 t->data + QUERY_CMD_LABEL_LEN,
1217 count - QUERY_CMD_LABEL_LEN, true);
1218 } else if (count > QUERY_CMD_LABELALL_LEN &&
1219 !memcmp(t->data, QUERY_CMD_LABELALL,
1220 QUERY_CMD_LABELALL_LEN)) {
1221 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
1222 t->data + QUERY_CMD_LABELALL_LEN,
1223 count - QUERY_CMD_LABELALL_LEN, false);
1224 } else if (count > QUERY_CMD_DATA_LEN &&
1225 !memcmp(t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) {
1226 len = query_data(t->data, MULTI_TRANSACTION_LIMIT,
1227 t->data + QUERY_CMD_DATA_LEN,
1228 count - QUERY_CMD_DATA_LEN);
1229 } else
1230 len = -EINVAL;
1231
1232 if (len < 0) {
1233 put_multi_transaction(t);
1234 return len;
1235 }
1236
1237 multi_transaction_set(file, t, len);
1238
1239 return count;
1240}
1241
1242static const struct file_operations aa_sfs_access = {
1243 .write = aa_write_access,
1244 .read = multi_transaction_read,
1245 .release = multi_transaction_release,
1246 .llseek = generic_file_llseek,
1247};
1248
1249static int aa_sfs_seq_show(struct seq_file *seq, void *v)
1250{
1251 struct aa_sfs_entry *fs_file = seq->private;
1252
1253 if (!fs_file)
1254 return 0;
1255
1256 switch (fs_file->v_type) {
1257 case AA_SFS_TYPE_BOOLEAN:
1258 seq_printf(seq, "%s\n", str_yes_no(fs_file->v.boolean));
1259 break;
1260 case AA_SFS_TYPE_STRING:
1261 seq_printf(seq, "%s\n", fs_file->v.string);
1262 break;
1263 case AA_SFS_TYPE_U64:
1264 seq_printf(seq, "%#08lx\n", fs_file->v.u64);
1265 break;
1266 default:
1267 /* Ignore unprintable entry types. */
1268 break;
1269 }
1270
1271 return 0;
1272}
1273
1274static int aa_sfs_seq_open(struct inode *inode, struct file *file)
1275{
1276 return single_open(file, aa_sfs_seq_show, inode->i_private);
1277}
1278
1279const struct file_operations aa_sfs_seq_file_ops = {
1280 .owner = THIS_MODULE,
1281 .open = aa_sfs_seq_open,
1282 .read = seq_read,
1283 .llseek = seq_lseek,
1284 .release = single_release,
1285};
1286
1287/*
1288 * profile based file operations
1289 * policy/profiles/XXXX/profiles/ *
1290 */
1291
1292#define SEQ_PROFILE_FOPS(NAME) \
1293static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\
1294{ \
1295 return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show); \
1296} \
1297 \
1298static const struct file_operations seq_profile_ ##NAME ##_fops = { \
1299 .owner = THIS_MODULE, \
1300 .open = seq_profile_ ##NAME ##_open, \
1301 .read = seq_read, \
1302 .llseek = seq_lseek, \
1303 .release = seq_profile_release, \
1304} \
1305
1306static int seq_profile_open(struct inode *inode, struct file *file,
1307 int (*show)(struct seq_file *, void *))
1308{
1309 struct aa_proxy *proxy = get_proxy_common_ref(inode->i_private);
1310 int error = single_open(file, show, proxy);
1311
1312 if (error) {
1313 file->private_data = NULL;
1314 aa_put_proxy(proxy);
1315 }
1316
1317 return error;
1318}
1319
1320static int seq_profile_release(struct inode *inode, struct file *file)
1321{
1322 struct seq_file *seq = (struct seq_file *) file->private_data;
1323 if (seq)
1324 aa_put_proxy(seq->private);
1325 return single_release(inode, file);
1326}
1327
1328static int seq_profile_name_show(struct seq_file *seq, void *v)
1329{
1330 struct aa_proxy *proxy = seq->private;
1331 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1332 struct aa_profile *profile = labels_profile(label);
1333 seq_printf(seq, "%s\n", profile->base.name);
1334 aa_put_label(label);
1335
1336 return 0;
1337}
1338
1339static int seq_profile_mode_show(struct seq_file *seq, void *v)
1340{
1341 struct aa_proxy *proxy = seq->private;
1342 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1343 struct aa_profile *profile = labels_profile(label);
1344 seq_printf(seq, "%s\n", aa_profile_mode_names[profile->mode]);
1345 aa_put_label(label);
1346
1347 return 0;
1348}
1349
1350static int seq_profile_attach_show(struct seq_file *seq, void *v)
1351{
1352 struct aa_proxy *proxy = seq->private;
1353 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1354 struct aa_profile *profile = labels_profile(label);
1355 if (profile->attach.xmatch_str)
1356 seq_printf(seq, "%s\n", profile->attach.xmatch_str);
1357 else if (profile->attach.xmatch->dfa)
1358 seq_puts(seq, "<unknown>\n");
1359 else
1360 seq_printf(seq, "%s\n", profile->base.name);
1361 aa_put_label(label);
1362
1363 return 0;
1364}
1365
1366static int seq_profile_hash_show(struct seq_file *seq, void *v)
1367{
1368 struct aa_proxy *proxy = seq->private;
1369 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1370 struct aa_profile *profile = labels_profile(label);
1371 unsigned int i, size = aa_hash_size();
1372
1373 if (profile->hash) {
1374 for (i = 0; i < size; i++)
1375 seq_printf(seq, "%.2x", profile->hash[i]);
1376 seq_putc(seq, '\n');
1377 }
1378 aa_put_label(label);
1379
1380 return 0;
1381}
1382
1383SEQ_PROFILE_FOPS(name);
1384SEQ_PROFILE_FOPS(mode);
1385SEQ_PROFILE_FOPS(attach);
1386SEQ_PROFILE_FOPS(hash);
1387
1388/*
1389 * namespace based files
1390 * several root files and
1391 * policy/ *
1392 */
1393
1394#define SEQ_NS_FOPS(NAME) \
1395static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file) \
1396{ \
1397 return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private); \
1398} \
1399 \
1400static const struct file_operations seq_ns_ ##NAME ##_fops = { \
1401 .owner = THIS_MODULE, \
1402 .open = seq_ns_ ##NAME ##_open, \
1403 .read = seq_read, \
1404 .llseek = seq_lseek, \
1405 .release = single_release, \
1406} \
1407
1408static int seq_ns_stacked_show(struct seq_file *seq, void *v)
1409{
1410 struct aa_label *label;
1411 bool needput;
1412
1413 label = begin_current_label_crit_section(&needput);
1414 seq_printf(seq, "%s\n", str_yes_no(label->size > 1));
1415 end_current_label_crit_section(label, needput);
1416
1417 return 0;
1418}
1419
1420static int seq_ns_nsstacked_show(struct seq_file *seq, void *v)
1421{
1422 struct aa_label *label;
1423 struct aa_profile *profile;
1424 struct label_it it;
1425 int count = 1;
1426 bool needput;
1427
1428 label = begin_current_label_crit_section(&needput);
1429
1430 if (label->size > 1) {
1431 label_for_each(it, label, profile)
1432 if (profile->ns != labels_ns(label)) {
1433 count++;
1434 break;
1435 }
1436 }
1437
1438 seq_printf(seq, "%s\n", str_yes_no(count > 1));
1439 end_current_label_crit_section(label, needput);
1440
1441 return 0;
1442}
1443
1444static int seq_ns_level_show(struct seq_file *seq, void *v)
1445{
1446 struct aa_label *label;
1447 bool needput;
1448
1449 label = begin_current_label_crit_section(&needput);
1450 seq_printf(seq, "%d\n", labels_ns(label)->level);
1451 end_current_label_crit_section(label, needput);
1452
1453 return 0;
1454}
1455
1456static int seq_ns_name_show(struct seq_file *seq, void *v)
1457{
1458 bool needput;
1459 struct aa_label *label = begin_current_label_crit_section(&needput);
1460
1461 seq_printf(seq, "%s\n", labels_ns(label)->base.name);
1462 end_current_label_crit_section(label, needput);
1463
1464 return 0;
1465}
1466
1467SEQ_NS_FOPS(stacked);
1468SEQ_NS_FOPS(nsstacked);
1469SEQ_NS_FOPS(level);
1470SEQ_NS_FOPS(name);
1471
1472#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1473static int seq_ns_compress_min_show(struct seq_file *seq, void *v)
1474{
1475 seq_printf(seq, "%d\n", AA_MIN_CLEVEL);
1476 return 0;
1477}
1478
1479static int seq_ns_compress_max_show(struct seq_file *seq, void *v)
1480{
1481 seq_printf(seq, "%d\n", AA_MAX_CLEVEL);
1482 return 0;
1483}
1484
1485SEQ_NS_FOPS(compress_min);
1486SEQ_NS_FOPS(compress_max);
1487
1488
1489/* policy/raw_data/ * file ops */
1490#define SEQ_RAWDATA_FOPS(NAME) \
1491static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\
1492{ \
1493 return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show); \
1494} \
1495 \
1496static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
1497 .owner = THIS_MODULE, \
1498 .open = seq_rawdata_ ##NAME ##_open, \
1499 .read = seq_read, \
1500 .llseek = seq_lseek, \
1501 .release = seq_rawdata_release, \
1502} \
1503
1504static int seq_rawdata_open(struct inode *inode, struct file *file,
1505 int (*show)(struct seq_file *, void *))
1506{
1507 struct aa_loaddata *data = get_loaddata_common_ref(inode->i_private);
1508 int error;
1509
1510 if (!data)
1511 return -ENOENT;
1512
1513 error = single_open(file, show, data);
1514 if (error) {
1515 AA_BUG(file->private_data &&
1516 ((struct seq_file *)file->private_data)->private);
1517 aa_put_i_loaddata(data);
1518 }
1519
1520 return error;
1521}
1522
1523static int seq_rawdata_release(struct inode *inode, struct file *file)
1524{
1525 struct seq_file *seq = (struct seq_file *) file->private_data;
1526
1527 if (seq)
1528 aa_put_i_loaddata(seq->private);
1529
1530 return single_release(inode, file);
1531}
1532
1533static int seq_rawdata_abi_show(struct seq_file *seq, void *v)
1534{
1535 struct aa_loaddata *data = seq->private;
1536
1537 seq_printf(seq, "v%d\n", data->abi);
1538
1539 return 0;
1540}
1541
1542static int seq_rawdata_revision_show(struct seq_file *seq, void *v)
1543{
1544 struct aa_loaddata *data = seq->private;
1545
1546 seq_printf(seq, "%ld\n", data->revision);
1547
1548 return 0;
1549}
1550
1551static int seq_rawdata_hash_show(struct seq_file *seq, void *v)
1552{
1553 struct aa_loaddata *data = seq->private;
1554 unsigned int i, size = aa_hash_size();
1555
1556 if (data->hash) {
1557 for (i = 0; i < size; i++)
1558 seq_printf(seq, "%.2x", data->hash[i]);
1559 seq_putc(seq, '\n');
1560 }
1561
1562 return 0;
1563}
1564
1565static int seq_rawdata_compressed_size_show(struct seq_file *seq, void *v)
1566{
1567 struct aa_loaddata *data = seq->private;
1568
1569 seq_printf(seq, "%zu\n", data->compressed_size);
1570
1571 return 0;
1572}
1573
1574SEQ_RAWDATA_FOPS(abi);
1575SEQ_RAWDATA_FOPS(revision);
1576SEQ_RAWDATA_FOPS(hash);
1577SEQ_RAWDATA_FOPS(compressed_size);
1578
1579static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
1580 loff_t *ppos)
1581{
1582 struct rawdata_f_data *private = file->private_data;
1583
1584 return simple_read_from_buffer(buf, size, ppos,
1585 private->data,
1586 private->loaddata->size);
1587}
1588
1589static int rawdata_release(struct inode *inode, struct file *file)
1590{
1591 rawdata_f_data_free(file->private_data);
1592
1593 return 0;
1594}
1595
1596static int rawdata_open(struct inode *inode, struct file *file)
1597{
1598 int error;
1599 struct aa_loaddata *loaddata;
1600 struct rawdata_f_data *private;
1601
1602 if (!aa_current_policy_view_capable(NULL))
1603 return -EACCES;
1604
1605 loaddata = get_loaddata_common_ref(inode->i_private);
1606 if (!loaddata)
1607 return -ENOENT;
1608
1609 private = rawdata_f_data_alloc(loaddata->size);
1610 if (IS_ERR(private)) {
1611 error = PTR_ERR(private);
1612 goto fail_private_alloc;
1613 }
1614
1615 private->loaddata = loaddata;
1616
1617 error = decompress_zstd(loaddata->data, loaddata->compressed_size,
1618 private->data, loaddata->size);
1619 if (error)
1620 goto fail_decompress;
1621
1622 file->private_data = private;
1623 return 0;
1624
1625fail_decompress:
1626 rawdata_f_data_free(private);
1627 return error;
1628
1629fail_private_alloc:
1630 aa_put_i_loaddata(loaddata);
1631 return error;
1632}
1633
1634static const struct file_operations rawdata_fops = {
1635 .open = rawdata_open,
1636 .read = rawdata_read,
1637 .llseek = generic_file_llseek,
1638 .release = rawdata_release,
1639};
1640
1641static void remove_rawdata_dents(struct aa_loaddata *rawdata)
1642{
1643 int i;
1644
1645 for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
1646 if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
1647 aafs_remove(rawdata->dents[i]);
1648 rawdata->dents[i] = NULL;
1649 }
1650 }
1651}
1652
1653void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata)
1654{
1655 AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock));
1656
1657 if (rawdata->ns) {
1658 remove_rawdata_dents(rawdata);
1659 list_del_init(&rawdata->list);
1660 aa_put_ns(rawdata->ns);
1661 rawdata->ns = NULL;
1662 }
1663}
1664
1665int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
1666{
1667 struct dentry *dent, *dir;
1668
1669 AA_BUG(!ns);
1670 AA_BUG(!rawdata);
1671 AA_BUG(!mutex_is_locked(&ns->lock));
1672 AA_BUG(!ns_subdata_dir(ns));
1673
1674 /*
1675 * just use ns revision dir was originally created at. This is
1676 * under ns->lock and if load is successful revision will be
1677 * bumped and is guaranteed to be unique
1678 */
1679 rawdata->name = kasprintf(GFP_KERNEL, "%ld", ns->revision);
1680 if (!rawdata->name)
1681 return -ENOMEM;
1682
1683 dir = aafs_create_dir(rawdata->name, ns_subdata_dir(ns));
1684 if (IS_ERR(dir))
1685 /* ->name freed when rawdata freed */
1686 return PTR_ERR(dir);
1687 rawdata->dents[AAFS_LOADDATA_DIR] = dir;
1688
1689 dent = aafs_create_file("abi", S_IFREG | 0444, dir, &rawdata->count,
1690 &seq_rawdata_abi_fops);
1691 if (IS_ERR(dent))
1692 goto fail;
1693 rawdata->dents[AAFS_LOADDATA_ABI] = dent;
1694
1695 dent = aafs_create_file("revision", S_IFREG | 0444, dir,
1696 &rawdata->count,
1697 &seq_rawdata_revision_fops);
1698 if (IS_ERR(dent))
1699 goto fail;
1700 rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
1701
1702 if (aa_g_hash_policy) {
1703 dent = aafs_create_file("sha256", S_IFREG | 0444, dir,
1704 &rawdata->count,
1705 &seq_rawdata_hash_fops);
1706 if (IS_ERR(dent))
1707 goto fail;
1708 rawdata->dents[AAFS_LOADDATA_HASH] = dent;
1709 }
1710
1711 dent = aafs_create_file("compressed_size", S_IFREG | 0444, dir,
1712 &rawdata->count,
1713 &seq_rawdata_compressed_size_fops);
1714 if (IS_ERR(dent))
1715 goto fail;
1716 rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
1717
1718 dent = aafs_create_file("raw_data", S_IFREG | 0444, dir,
1719 &rawdata->count, &rawdata_fops);
1720 if (IS_ERR(dent))
1721 goto fail;
1722 rawdata->dents[AAFS_LOADDATA_DATA] = dent;
1723 d_inode(dent)->i_size = rawdata->size;
1724
1725 rawdata->ns = aa_get_ns(ns);
1726 list_add(&rawdata->list, &ns->rawdata_list);
1727
1728 return 0;
1729
1730fail:
1731 remove_rawdata_dents(rawdata);
1732 return PTR_ERR(dent);
1733}
1734#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
1735
1736
1737/** fns to setup dynamic per profile/namespace files **/
1738
1739/*
1740 *
1741 * Requires: @profile->ns->lock held
1742 */
1743void __aafs_profile_rmdir(struct aa_profile *profile)
1744{
1745 struct aa_profile *child;
1746 int i;
1747
1748 if (!profile)
1749 return;
1750
1751 list_for_each_entry(child, &profile->base.profiles, base.list)
1752 __aafs_profile_rmdir(child);
1753
1754 for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
1755 if (!profile->dents[i])
1756 continue;
1757
1758 aafs_remove(profile->dents[i]);
1759 profile->dents[i] = NULL;
1760 }
1761}
1762
1763/*
1764 *
1765 * Requires: @old->ns->lock held
1766 */
1767void __aafs_profile_migrate_dents(struct aa_profile *old,
1768 struct aa_profile *new)
1769{
1770 int i;
1771
1772 AA_BUG(!old);
1773 AA_BUG(!new);
1774 AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
1775
1776 for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
1777 new->dents[i] = old->dents[i];
1778 if (new->dents[i]) {
1779 struct inode *inode = d_inode(new->dents[i]);
1780
1781 inode_set_mtime_to_ts(inode,
1782 inode_set_ctime_current(inode));
1783 }
1784 old->dents[i] = NULL;
1785 }
1786}
1787
1788static struct dentry *create_profile_file(struct dentry *dir, const char *name,
1789 struct aa_profile *profile,
1790 const struct file_operations *fops)
1791{
1792 return aafs_create_file(name, S_IFREG | 0444, dir, &profile->label.proxy->count, fops);
1793}
1794
1795#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1796static int profile_depth(struct aa_profile *profile)
1797{
1798 int depth = 0;
1799
1800 rcu_read_lock();
1801 for (depth = 0; profile; profile = rcu_access_pointer(profile->parent))
1802 depth++;
1803 rcu_read_unlock();
1804
1805 return depth;
1806}
1807
1808static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
1809{
1810 char *buffer, *s;
1811 int error;
1812 const char *path = "../../";
1813 size_t path_len = strlen(path);
1814 int size;
1815
1816 /* Extra 11 bytes: "raw_data" (9) + two slashes "//" (2) */
1817 size = depth * path_len + strlen(dirname) + strlen(fname) + 11;
1818 s = buffer = kmalloc(size, GFP_KERNEL);
1819 if (!buffer)
1820 return ERR_PTR(-ENOMEM);
1821
1822 for (; depth > 0; depth--) {
1823 memcpy(s, path, path_len);
1824 s += path_len;
1825 size -= path_len;
1826 }
1827
1828 error = snprintf(s, size, "raw_data/%s/%s", dirname, fname);
1829 if (error >= size || error < 0) {
1830 kfree(buffer);
1831 return ERR_PTR(-ENAMETOOLONG);
1832 }
1833
1834 return buffer;
1835}
1836
1837static const char *rawdata_get_link_base(struct dentry *dentry,
1838 struct inode *inode,
1839 struct delayed_call *done,
1840 const char *name)
1841{
1842 struct aa_common_ref *ref = inode->i_private;
1843 struct aa_proxy *proxy = container_of(ref, struct aa_proxy, count);
1844 struct aa_label *label;
1845 struct aa_profile *profile;
1846 char *target;
1847 int depth;
1848
1849 if (!dentry)
1850 return ERR_PTR(-ECHILD);
1851
1852 label = aa_get_label_rcu(&proxy->label);
1853 profile = labels_profile(label);
1854
1855 /* rawdata can be null when aa_g_export_binary is unset during
1856 * runtime and a profile is replaced
1857 */
1858 if (!profile->rawdata) {
1859 aa_put_label(label);
1860 return ERR_PTR(-ENOENT);
1861 }
1862
1863 depth = profile_depth(profile);
1864 target = gen_symlink_name(depth, profile->rawdata->name, name);
1865 aa_put_label(label);
1866
1867 if (IS_ERR(target))
1868 return target;
1869
1870 set_delayed_call(done, kfree_link, target);
1871
1872 return target;
1873}
1874
1875static const char *rawdata_get_link_sha256(struct dentry *dentry,
1876 struct inode *inode,
1877 struct delayed_call *done)
1878{
1879 return rawdata_get_link_base(dentry, inode, done, "sha256");
1880}
1881
1882static const char *rawdata_get_link_abi(struct dentry *dentry,
1883 struct inode *inode,
1884 struct delayed_call *done)
1885{
1886 return rawdata_get_link_base(dentry, inode, done, "abi");
1887}
1888
1889static const char *rawdata_get_link_data(struct dentry *dentry,
1890 struct inode *inode,
1891 struct delayed_call *done)
1892{
1893 return rawdata_get_link_base(dentry, inode, done, "raw_data");
1894}
1895
1896static const struct inode_operations rawdata_link_sha256_iops = {
1897 .get_link = rawdata_get_link_sha256,
1898};
1899
1900static const struct inode_operations rawdata_link_abi_iops = {
1901 .get_link = rawdata_get_link_abi,
1902};
1903static const struct inode_operations rawdata_link_data_iops = {
1904 .get_link = rawdata_get_link_data,
1905};
1906
1907/*
1908 * Requires: @profile->ns->lock held
1909 */
1910void __aa_remove_rawdata_symlink_dents(struct aa_profile *profile)
1911{
1912 aafs_remove(profile->dents[AAFS_PROF_RAW_HASH]);
1913 profile->dents[AAFS_PROF_RAW_HASH] = NULL;
1914 aafs_remove(profile->dents[AAFS_PROF_RAW_ABI]);
1915 profile->dents[AAFS_PROF_RAW_ABI] = NULL;
1916 aafs_remove(profile->dents[AAFS_PROF_RAW_DATA]);
1917 profile->dents[AAFS_PROF_RAW_DATA] = NULL;
1918}
1919
1920static inline int create_symlink_dent(struct aa_profile *profile,
1921 const char *name,
1922 enum aafs_prof_type type,
1923 const struct inode_operations *iops)
1924{
1925 struct dentry *dent = NULL;
1926 struct dentry *dir = prof_dir(profile);
1927
1928 if (profile->dents[type])
1929 return 0;
1930
1931 dent = aafs_create(name, S_IFLNK | 0444, dir,
1932 &profile->label.proxy->count, NULL, NULL, iops);
1933 if (IS_ERR(dent))
1934 return PTR_ERR(dent);
1935
1936 profile->dents[type] = dent;
1937 return 0;
1938}
1939
1940/*
1941 * Requires: @profile->ns->lock held
1942 */
1943int __aa_create_rawdata_symlink_dents(struct aa_profile *profile)
1944{
1945 int error;
1946
1947 if (!profile ||
1948 (profile->dents[AAFS_PROF_RAW_HASH] &&
1949 profile->dents[AAFS_PROF_RAW_ABI] &&
1950 profile->dents[AAFS_PROF_RAW_DATA]))
1951 return 0;
1952
1953 if (!profile->rawdata)
1954 return 0;
1955
1956 if (aa_g_hash_policy) {
1957 error = create_symlink_dent(profile, "raw_sha256",
1958 AAFS_PROF_RAW_HASH,
1959 &rawdata_link_sha256_iops);
1960 if (error)
1961 return error;
1962 }
1963
1964 error = create_symlink_dent(profile, "raw_abi",
1965 AAFS_PROF_RAW_ABI,
1966 &rawdata_link_abi_iops);
1967 if (error)
1968 return error;
1969
1970
1971 error = create_symlink_dent(profile, "raw_data",
1972 AAFS_PROF_RAW_DATA,
1973 &rawdata_link_data_iops);
1974 if (error)
1975 return error;
1976
1977 return 0;
1978}
1979
1980#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
1981
1982/*
1983 * Requires: @profile->ns->lock held
1984 */
1985int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
1986{
1987 struct aa_profile *child;
1988 struct dentry *dent = NULL, *dir;
1989 int error;
1990
1991 AA_BUG(!profile);
1992 AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
1993
1994 if (!parent) {
1995 struct aa_profile *p;
1996 p = aa_deref_parent(profile);
1997 dent = prof_dir(p);
1998 if (!dent) {
1999 error = -ENOENT;
2000 goto fail2;
2001 }
2002 /* adding to parent that previously didn't have children */
2003 dent = aafs_create_dir("profiles", dent);
2004 if (IS_ERR(dent))
2005 goto fail;
2006 prof_child_dir(p) = parent = dent;
2007 }
2008
2009 if (!profile->dirname) {
2010 int len, id_len;
2011 len = mangle_name(profile->base.name, NULL);
2012 id_len = snprintf(NULL, 0, ".%ld", profile->ns->uniq_id);
2013
2014 profile->dirname = kmalloc(len + id_len + 1, GFP_KERNEL);
2015 if (!profile->dirname) {
2016 error = -ENOMEM;
2017 goto fail2;
2018 }
2019
2020 mangle_name(profile->base.name, profile->dirname);
2021 sprintf(profile->dirname + len, ".%ld", profile->ns->uniq_id++);
2022 }
2023
2024 dent = aafs_create_dir(profile->dirname, parent);
2025 if (IS_ERR(dent))
2026 goto fail;
2027 prof_dir(profile) = dir = dent;
2028
2029 dent = create_profile_file(dir, "name", profile,
2030 &seq_profile_name_fops);
2031 if (IS_ERR(dent))
2032 goto fail;
2033 profile->dents[AAFS_PROF_NAME] = dent;
2034
2035 dent = create_profile_file(dir, "mode", profile,
2036 &seq_profile_mode_fops);
2037 if (IS_ERR(dent))
2038 goto fail;
2039 profile->dents[AAFS_PROF_MODE] = dent;
2040
2041 dent = create_profile_file(dir, "attach", profile,
2042 &seq_profile_attach_fops);
2043 if (IS_ERR(dent))
2044 goto fail;
2045 profile->dents[AAFS_PROF_ATTACH] = dent;
2046
2047 if (profile->hash) {
2048 dent = create_profile_file(dir, "sha256", profile,
2049 &seq_profile_hash_fops);
2050 if (IS_ERR(dent))
2051 goto fail;
2052 profile->dents[AAFS_PROF_HASH] = dent;
2053 }
2054
2055 error = __aa_create_rawdata_symlink_dents(profile);
2056 if (error)
2057 goto fail2;
2058
2059 list_for_each_entry(child, &profile->base.profiles, base.list) {
2060 error = __aafs_profile_mkdir(child, prof_child_dir(profile));
2061 if (error)
2062 goto fail2;
2063 }
2064
2065 return 0;
2066
2067fail:
2068 error = PTR_ERR(dent);
2069
2070fail2:
2071 __aafs_profile_rmdir(profile);
2072
2073 return error;
2074}
2075
2076static struct dentry *ns_mkdir_op(const struct mnt_idmap *idmap, struct inode *dir,
2077 struct dentry *dentry, umode_t mode)
2078{
2079 struct aa_ns *ns, *parent;
2080 /* TODO: improve permission check */
2081 struct aa_label *label;
2082 int error;
2083 bool needput;
2084
2085 label = begin_current_label_crit_section(&needput);
2086 error = aa_may_manage_policy(current_cred(), label, NULL, NULL,
2087 AA_MAY_LOAD_POLICY);
2088 end_current_label_crit_section(label, needput);
2089 if (error)
2090 return ERR_PTR(error);
2091
2092 parent = get_ns_common_ref(dir->i_private);
2093 AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
2094
2095 /* we have to unlock and then relock to get locking order right
2096 * for pin_fs
2097 */
2098 inode_unlock(dir);
2099 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
2100 mutex_lock_nested(&parent->lock, parent->level);
2101 inode_lock_nested(dir, I_MUTEX_PARENT);
2102 if (error)
2103 goto out;
2104
2105 error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR, NULL,
2106 NULL, NULL, NULL);
2107 if (error)
2108 goto out_pin;
2109
2110 ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name),
2111 dentry);
2112 if (IS_ERR(ns)) {
2113 error = PTR_ERR(ns);
2114 ns = NULL;
2115 }
2116
2117 aa_put_ns(ns); /* list ref remains */
2118out_pin:
2119 if (error)
2120 simple_release_fs(&aafs_mnt, &aafs_count);
2121out:
2122 mutex_unlock(&parent->lock);
2123 aa_put_ns(parent);
2124
2125 return error ? ERR_PTR(error) : NULL;
2126}
2127
2128static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
2129{
2130 struct aa_ns *ns, *parent;
2131 /* TODO: improve permission check */
2132 struct aa_label *label;
2133 bool needput;
2134 int error;
2135
2136 label = begin_current_label_crit_section(&needput);
2137 error = aa_may_manage_policy(current_cred(), label, NULL, NULL,
2138 AA_MAY_LOAD_POLICY);
2139 end_current_label_crit_section(label, needput);
2140 if (error)
2141 return error;
2142
2143 parent = get_ns_common_ref(dir->i_private);
2144 /* rmdir calls the generic securityfs functions to remove files
2145 * from the apparmor dir. It is up to the apparmor ns locking
2146 * to avoid races.
2147 */
2148 inode_unlock(dir);
2149 inode_unlock(dentry->d_inode);
2150
2151 mutex_lock_nested(&parent->lock, parent->level);
2152 ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name,
2153 dentry->d_name.len));
2154 if (!ns) {
2155 error = -ENOENT;
2156 goto out;
2157 }
2158 AA_BUG(ns_dir(ns) != dentry);
2159
2160 __aa_remove_ns(ns);
2161 aa_put_ns(ns);
2162
2163out:
2164 mutex_unlock(&parent->lock);
2165 inode_lock_nested(dir, I_MUTEX_PARENT);
2166 inode_lock(dentry->d_inode);
2167 aa_put_ns(parent);
2168
2169 return error;
2170}
2171
2172static const struct inode_operations ns_dir_inode_operations = {
2173 .lookup = simple_lookup,
2174 .mkdir = ns_mkdir_op,
2175 .rmdir = ns_rmdir_op,
2176};
2177
2178static void __aa_fs_list_remove_rawdata(struct aa_ns *ns)
2179{
2180 struct aa_loaddata *ent, *tmp;
2181
2182 AA_BUG(!mutex_is_locked(&ns->lock));
2183
2184 list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list)
2185 __aa_fs_remove_rawdata(ent);
2186}
2187
2188/*
2189 *
2190 * Requires: @ns->lock held
2191 */
2192void __aafs_ns_rmdir(struct aa_ns *ns)
2193{
2194 struct aa_ns *sub;
2195 struct aa_profile *child;
2196 int i;
2197
2198 if (!ns)
2199 return;
2200 AA_BUG(!mutex_is_locked(&ns->lock));
2201
2202 list_for_each_entry(child, &ns->base.profiles, base.list)
2203 __aafs_profile_rmdir(child);
2204
2205 list_for_each_entry(sub, &ns->sub_ns, base.list) {
2206 mutex_lock_nested(&sub->lock, sub->level);
2207 __aafs_ns_rmdir(sub);
2208 mutex_unlock(&sub->lock);
2209 }
2210
2211 __aa_fs_list_remove_rawdata(ns);
2212
2213 for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
2214 aafs_remove(ns->dents[i]);
2215 ns->dents[i] = NULL;
2216 }
2217}
2218
2219/* assumes cleanup in caller */
2220static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
2221{
2222 struct dentry *dent;
2223
2224 AA_BUG(!ns);
2225 AA_BUG(!dir);
2226
2227 dent = aafs_create_dir("profiles", dir);
2228 if (IS_ERR(dent))
2229 return PTR_ERR(dent);
2230 ns_subprofs_dir(ns) = dent;
2231
2232 dent = aafs_create_dir("raw_data", dir);
2233 if (IS_ERR(dent))
2234 return PTR_ERR(dent);
2235 ns_subdata_dir(ns) = dent;
2236
2237 dent = aafs_create_file("revision", 0444, dir,
2238 &ns->unconfined->label.count,
2239 &aa_fs_ns_revision_fops);
2240 if (IS_ERR(dent))
2241 return PTR_ERR(dent);
2242 ns_subrevision(ns) = dent;
2243
2244 dent = aafs_create_file(".load", 0640, dir,
2245 &ns->unconfined->label.count,
2246 &aa_fs_profile_load);
2247 if (IS_ERR(dent))
2248 return PTR_ERR(dent);
2249 ns_subload(ns) = dent;
2250
2251 dent = aafs_create_file(".replace", 0640, dir,
2252 &ns->unconfined->label.count,
2253 &aa_fs_profile_replace);
2254 if (IS_ERR(dent))
2255 return PTR_ERR(dent);
2256 ns_subreplace(ns) = dent;
2257
2258 dent = aafs_create_file(".remove", 0640, dir,
2259 &ns->unconfined->label.count,
2260 &aa_fs_profile_remove);
2261 if (IS_ERR(dent))
2262 return PTR_ERR(dent);
2263 ns_subremove(ns) = dent;
2264
2265 /* use create_dentry so we can supply private data */
2266 dent = aafs_create("namespaces", S_IFDIR | 0755, dir,
2267 &ns->unconfined->label.count,
2268 NULL, NULL, &ns_dir_inode_operations);
2269 if (IS_ERR(dent))
2270 return PTR_ERR(dent);
2271 ns_subns_dir(ns) = dent;
2272
2273 return 0;
2274}
2275
2276/*
2277 * Requires: @ns->lock held
2278 */
2279int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
2280 struct dentry *dent)
2281{
2282 struct aa_ns *sub;
2283 struct aa_profile *child;
2284 struct dentry *dir;
2285 int error;
2286
2287 AA_BUG(!ns);
2288 AA_BUG(!parent);
2289 AA_BUG(!mutex_is_locked(&ns->lock));
2290
2291 if (!name)
2292 name = ns->base.name;
2293
2294 if (!dent) {
2295 /* create ns dir if it doesn't already exist */
2296 dent = aafs_create_dir(name, parent);
2297 if (IS_ERR(dent))
2298 goto fail;
2299 } else
2300 dget(dent);
2301 ns_dir(ns) = dir = dent;
2302 error = __aafs_ns_mkdir_entries(ns, dir);
2303 if (error)
2304 goto fail2;
2305
2306 /* profiles */
2307 list_for_each_entry(child, &ns->base.profiles, base.list) {
2308 error = __aafs_profile_mkdir(child, ns_subprofs_dir(ns));
2309 if (error)
2310 goto fail2;
2311 }
2312
2313 /* subnamespaces */
2314 list_for_each_entry(sub, &ns->sub_ns, base.list) {
2315 mutex_lock_nested(&sub->lock, sub->level);
2316 error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL);
2317 mutex_unlock(&sub->lock);
2318 if (error)
2319 goto fail2;
2320 }
2321
2322 return 0;
2323
2324fail:
2325 error = PTR_ERR(dent);
2326
2327fail2:
2328 __aafs_ns_rmdir(ns);
2329
2330 return error;
2331}
2332
2333/**
2334 * __next_ns - find the next namespace to list
2335 * @root: root namespace to stop search at (NOT NULL)
2336 * @ns: current ns position (NOT NULL)
2337 *
2338 * Find the next namespace from @ns under @root and handle all locking needed
2339 * while switching current namespace.
2340 *
2341 * Returns: next namespace or NULL if at last namespace under @root
2342 * Requires: ns->parent->lock to be held
2343 * NOTE: will not unlock root->lock
2344 */
2345static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
2346{
2347 struct aa_ns *parent, *next;
2348
2349 AA_BUG(!root);
2350 AA_BUG(!ns);
2351 AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
2352
2353 /* is next namespace a child */
2354 if (!list_empty(&ns->sub_ns)) {
2355 next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
2356 mutex_lock_nested(&next->lock, next->level);
2357 return next;
2358 }
2359
2360 /* check if the next ns is a sibling, parent, gp, .. */
2361 parent = ns->parent;
2362 while (ns != root) {
2363 mutex_unlock(&ns->lock);
2364 next = list_next_entry(ns, base.list);
2365 if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
2366 mutex_lock_nested(&next->lock, next->level);
2367 return next;
2368 }
2369 ns = parent;
2370 parent = parent->parent;
2371 }
2372
2373 return NULL;
2374}
2375
2376/**
2377 * __first_profile - find the first profile in a namespace
2378 * @root: namespace that is root of profiles being displayed (NOT NULL)
2379 * @ns: namespace to start in (NOT NULL)
2380 *
2381 * Returns: unrefcounted profile or NULL if no profile
2382 * Requires: profile->ns.lock to be held
2383 */
2384static struct aa_profile *__first_profile(struct aa_ns *root,
2385 struct aa_ns *ns)
2386{
2387 AA_BUG(!root);
2388 AA_BUG(ns && !mutex_is_locked(&ns->lock));
2389
2390 for (; ns; ns = __next_ns(root, ns)) {
2391 if (!list_empty(&ns->base.profiles))
2392 return list_first_entry(&ns->base.profiles,
2393 struct aa_profile, base.list);
2394 }
2395 return NULL;
2396}
2397
2398/**
2399 * __next_profile - step to the next profile in a profile tree
2400 * @p: current profile in tree (NOT NULL)
2401 *
2402 * Perform a depth first traversal on the profile tree in a namespace
2403 *
2404 * Returns: next profile or NULL if done
2405 * Requires: profile->ns.lock to be held
2406 */
2407static struct aa_profile *__next_profile(struct aa_profile *p)
2408{
2409 struct aa_profile *parent;
2410 struct aa_ns *ns = p->ns;
2411
2412 AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
2413
2414 /* is next profile a child */
2415 if (!list_empty(&p->base.profiles))
2416 return list_first_entry(&p->base.profiles, typeof(*p),
2417 base.list);
2418
2419 /* is next profile a sibling, parent sibling, gp, sibling, .. */
2420 parent = rcu_dereference_protected(p->parent,
2421 mutex_is_locked(&p->ns->lock));
2422 while (parent) {
2423 p = list_next_entry(p, base.list);
2424 if (!list_entry_is_head(p, &parent->base.profiles, base.list))
2425 return p;
2426 p = parent;
2427 parent = rcu_dereference_protected(parent->parent,
2428 mutex_is_locked(&parent->ns->lock));
2429 }
2430
2431 /* is next another profile in the namespace */
2432 p = list_next_entry(p, base.list);
2433 if (!list_entry_is_head(p, &ns->base.profiles, base.list))
2434 return p;
2435
2436 return NULL;
2437}
2438
2439/**
2440 * next_profile - step to the next profile in where ever it may be
2441 * @root: root namespace (NOT NULL)
2442 * @profile: current profile (NOT NULL)
2443 *
2444 * Returns: next profile or NULL if there isn't one
2445 */
2446static struct aa_profile *next_profile(struct aa_ns *root,
2447 struct aa_profile *profile)
2448{
2449 struct aa_profile *next = __next_profile(profile);
2450 if (next)
2451 return next;
2452
2453 /* finished all profiles in namespace move to next namespace */
2454 return __first_profile(root, __next_ns(root, profile->ns));
2455}
2456
2457/**
2458 * p_start - start a depth first traversal of profile tree
2459 * @f: seq_file to fill
2460 * @pos: current position
2461 *
2462 * Returns: first profile under current namespace or NULL if none found
2463 *
2464 * acquires first ns->lock
2465 */
2466static void *p_start(struct seq_file *f, loff_t *pos)
2467{
2468 struct aa_profile *profile = NULL;
2469 struct aa_ns *root = aa_get_current_ns();
2470 loff_t l = *pos;
2471 f->private = root;
2472
2473 /* find the first profile */
2474 mutex_lock_nested(&root->lock, root->level);
2475 profile = __first_profile(root, root);
2476
2477 /* skip to position */
2478 for (; profile && l > 0; l--)
2479 profile = next_profile(root, profile);
2480
2481 return profile;
2482}
2483
2484/**
2485 * p_next - read the next profile entry
2486 * @f: seq_file to fill
2487 * @p: profile previously returned
2488 * @pos: current position
2489 *
2490 * Returns: next profile after @p or NULL if none
2491 *
2492 * may acquire/release locks in namespace tree as necessary
2493 */
2494static void *p_next(struct seq_file *f, void *p, loff_t *pos)
2495{
2496 struct aa_profile *profile = p;
2497 struct aa_ns *ns = f->private;
2498 (*pos)++;
2499
2500 return next_profile(ns, profile);
2501}
2502
2503/**
2504 * p_stop - stop depth first traversal
2505 * @f: seq_file we are filling
2506 * @p: the last profile written
2507 *
2508 * Release all locking done by p_start/p_next on namespace tree
2509 */
2510static void p_stop(struct seq_file *f, void *p)
2511{
2512 struct aa_profile *profile = p;
2513 struct aa_ns *root = f->private, *ns;
2514
2515 if (profile) {
2516 for (ns = profile->ns; ns && ns != root; ns = ns->parent)
2517 mutex_unlock(&ns->lock);
2518 }
2519 mutex_unlock(&root->lock);
2520 aa_put_ns(root);
2521}
2522
2523/**
2524 * seq_show_profile - show a profile entry
2525 * @f: seq_file to file
2526 * @p: current position (profile) (NOT NULL)
2527 *
2528 * Returns: error on failure
2529 */
2530static int seq_show_profile(struct seq_file *f, void *p)
2531{
2532 struct aa_profile *profile = (struct aa_profile *)p;
2533 struct aa_ns *root = f->private;
2534
2535 aa_label_seq_xprint(f, root, &profile->label,
2536 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL);
2537 seq_putc(f, '\n');
2538
2539 return 0;
2540}
2541
2542static const struct seq_operations aa_sfs_profiles_op = {
2543 .start = p_start,
2544 .next = p_next,
2545 .stop = p_stop,
2546 .show = seq_show_profile,
2547};
2548
2549static int profiles_open(struct inode *inode, struct file *file)
2550{
2551 if (!aa_current_policy_view_capable(NULL))
2552 return -EACCES;
2553
2554 return seq_open(file, &aa_sfs_profiles_op);
2555}
2556
2557static int profiles_release(struct inode *inode, struct file *file)
2558{
2559 return seq_release(inode, file);
2560}
2561
2562static const struct file_operations aa_sfs_profiles_fops = {
2563 .open = profiles_open,
2564 .read = seq_read,
2565 .llseek = seq_lseek,
2566 .release = profiles_release,
2567};
2568
2569
2570/** Base file system setup **/
2571static struct aa_sfs_entry aa_sfs_entry_file[] = {
2572 AA_SFS_FILE_STRING("mask",
2573 "create read write exec append mmap_exec link lock"),
2574 { }
2575};
2576
2577static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
2578 AA_SFS_FILE_STRING("mask", "read trace"),
2579 { }
2580};
2581
2582static struct aa_sfs_entry aa_sfs_entry_signal[] = {
2583 AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
2584 { }
2585};
2586
2587static struct aa_sfs_entry aa_sfs_entry_attach[] = {
2588 AA_SFS_FILE_BOOLEAN("xattr", 1),
2589 { }
2590};
2591static struct aa_sfs_entry aa_sfs_entry_domain[] = {
2592 AA_SFS_FILE_BOOLEAN("change_hat", 1),
2593 AA_SFS_FILE_BOOLEAN("change_hatv", 1),
2594 AA_SFS_FILE_BOOLEAN("unconfined_allowed_children", 1),
2595 AA_SFS_FILE_BOOLEAN("change_onexec", 1),
2596 AA_SFS_FILE_BOOLEAN("change_profile", 1),
2597 AA_SFS_FILE_BOOLEAN("stack", 1),
2598 AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap", 1),
2599 AA_SFS_FILE_BOOLEAN("post_nnp_subset", 1),
2600 AA_SFS_FILE_BOOLEAN("computed_longest_left", 1),
2601 AA_SFS_DIR("attach_conditions", aa_sfs_entry_attach),
2602 AA_SFS_FILE_BOOLEAN("disconnected.path", 1),
2603 AA_SFS_FILE_BOOLEAN("kill.signal", 1),
2604 AA_SFS_FILE_STRING("version", "1.2"),
2605 { }
2606};
2607
2608static struct aa_sfs_entry aa_sfs_entry_unconfined[] = {
2609 AA_SFS_FILE_BOOLEAN("change_profile", 1),
2610 { }
2611};
2612
2613static struct aa_sfs_entry aa_sfs_entry_versions[] = {
2614 AA_SFS_FILE_BOOLEAN("v5", 1),
2615 AA_SFS_FILE_BOOLEAN("v6", 1),
2616 AA_SFS_FILE_BOOLEAN("v7", 1),
2617 AA_SFS_FILE_BOOLEAN("v8", 1),
2618 AA_SFS_FILE_BOOLEAN("v9", 1),
2619 { }
2620};
2621
2622#define PERMS32STR "allow deny subtree cond kill complain prompt audit quiet hide xindex tag label"
2623static struct aa_sfs_entry aa_sfs_entry_policy[] = {
2624 AA_SFS_DIR("versions", aa_sfs_entry_versions),
2625 AA_SFS_FILE_BOOLEAN("set_load", 1),
2626 AA_SFS_FILE_BOOLEAN("diff-encode", 1),
2627 /* number of out of band transitions supported */
2628 AA_SFS_FILE_U64("outofband", MAX_OOB_SUPPORTED),
2629 AA_SFS_FILE_U64("permstable32_version", 3),
2630 AA_SFS_FILE_STRING("permstable32", PERMS32STR),
2631 AA_SFS_FILE_U64("state32", 1),
2632 AA_SFS_DIR("unconfined_restrictions", aa_sfs_entry_unconfined),
2633#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
2634 AA_SFS_FILE_BOOLEAN("compressed_load", 1),
2635 AA_SFS_FILE_BOOLEAN("extended_policy_header", 1),
2636#endif
2637 { }
2638};
2639
2640static struct aa_sfs_entry aa_sfs_entry_mount[] = {
2641 AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
2642 AA_SFS_FILE_STRING("move_mount", "detached"),
2643 { }
2644};
2645
2646static struct aa_sfs_entry aa_sfs_entry_ns[] = {
2647 AA_SFS_FILE_BOOLEAN("profile", 1),
2648 AA_SFS_FILE_BOOLEAN("pivot_root", 0),
2649 AA_SFS_FILE_STRING("mask", "userns_create"),
2650 { }
2651};
2652
2653static struct aa_sfs_entry aa_sfs_entry_dbus[] = {
2654 AA_SFS_FILE_STRING("mask", "acquire send receive"),
2655 { }
2656};
2657
2658static struct aa_sfs_entry aa_sfs_entry_query_label[] = {
2659 AA_SFS_FILE_STRING("perms", "allow deny audit quiet"),
2660 AA_SFS_FILE_BOOLEAN("data", 1),
2661 AA_SFS_FILE_BOOLEAN("multi_transaction", 1),
2662 { }
2663};
2664
2665static struct aa_sfs_entry aa_sfs_entry_query[] = {
2666 AA_SFS_DIR("label", aa_sfs_entry_query_label),
2667 { }
2668};
2669
2670static struct aa_sfs_entry aa_sfs_entry_io_uring[] = {
2671 AA_SFS_FILE_STRING("mask", "sqpoll override_creds"),
2672 { }
2673};
2674
2675static struct aa_sfs_entry aa_sfs_entry_features[] = {
2676 AA_SFS_DIR("policy", aa_sfs_entry_policy),
2677 AA_SFS_DIR("domain", aa_sfs_entry_domain),
2678 AA_SFS_DIR("file", aa_sfs_entry_file),
2679 AA_SFS_DIR("network_v8", aa_sfs_entry_network),
2680 AA_SFS_DIR("network_v9", aa_sfs_entry_networkv9),
2681 AA_SFS_DIR("mount", aa_sfs_entry_mount),
2682 AA_SFS_DIR("namespaces", aa_sfs_entry_ns),
2683 AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
2684 AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit),
2685 AA_SFS_DIR("caps", aa_sfs_entry_caps),
2686 AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace),
2687 AA_SFS_DIR("signal", aa_sfs_entry_signal),
2688 AA_SFS_DIR("dbus", aa_sfs_entry_dbus),
2689 AA_SFS_DIR("query", aa_sfs_entry_query),
2690 AA_SFS_DIR("io_uring", aa_sfs_entry_io_uring),
2691 { }
2692};
2693
2694static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
2695 AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
2696 AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
2697 AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
2698 AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
2699 AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
2700 AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
2701#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
2702 AA_SFS_FILE_FOPS("raw_data_compression_level_min", 0444, &seq_ns_compress_min_fops),
2703 AA_SFS_FILE_FOPS("raw_data_compression_level_max", 0444, &seq_ns_compress_max_fops),
2704#endif
2705 AA_SFS_DIR("features", aa_sfs_entry_features),
2706 { }
2707};
2708
2709static struct aa_sfs_entry aa_sfs_entry =
2710 AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor);
2711
2712/**
2713 * entry_create_file - create a file entry in the apparmor securityfs
2714 * @fs_file: aa_sfs_entry to build an entry for (NOT NULL)
2715 * @parent: the parent dentry in the securityfs
2716 *
2717 * Use entry_remove_file to remove entries created with this fn.
2718 */
2719static int __init entry_create_file(struct aa_sfs_entry *fs_file,
2720 struct dentry *parent)
2721{
2722 int error = 0;
2723
2724 fs_file->dentry = securityfs_create_file(fs_file->name,
2725 S_IFREG | fs_file->mode,
2726 parent, fs_file,
2727 fs_file->file_ops);
2728 if (IS_ERR(fs_file->dentry)) {
2729 error = PTR_ERR(fs_file->dentry);
2730 fs_file->dentry = NULL;
2731 }
2732 return error;
2733}
2734
2735static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir);
2736/**
2737 * entry_create_dir - recursively create a directory entry in the securityfs
2738 * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL)
2739 * @parent: the parent dentry in the securityfs
2740 *
2741 * Use entry_remove_dir to remove entries created with this fn.
2742 */
2743static int __init entry_create_dir(struct aa_sfs_entry *fs_dir,
2744 struct dentry *parent)
2745{
2746 struct aa_sfs_entry *fs_file;
2747 struct dentry *dir;
2748 int error;
2749
2750 dir = securityfs_create_dir(fs_dir->name, parent);
2751 if (IS_ERR(dir))
2752 return PTR_ERR(dir);
2753 fs_dir->dentry = dir;
2754
2755 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2756 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2757 error = entry_create_dir(fs_file, fs_dir->dentry);
2758 else
2759 error = entry_create_file(fs_file, fs_dir->dentry);
2760 if (error)
2761 goto failed;
2762 }
2763
2764 return 0;
2765
2766failed:
2767 entry_remove_dir(fs_dir);
2768
2769 return error;
2770}
2771
2772/**
2773 * entry_remove_file - drop a single file entry in the apparmor securityfs
2774 * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL)
2775 */
2776static void __init entry_remove_file(struct aa_sfs_entry *fs_file)
2777{
2778 if (!fs_file->dentry)
2779 return;
2780
2781 securityfs_remove(fs_file->dentry);
2782 fs_file->dentry = NULL;
2783}
2784
2785/**
2786 * entry_remove_dir - recursively drop a directory entry from the securityfs
2787 * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL)
2788 */
2789static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir)
2790{
2791 struct aa_sfs_entry *fs_file;
2792
2793 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2794 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2795 entry_remove_dir(fs_file);
2796 else
2797 entry_remove_file(fs_file);
2798 }
2799
2800 entry_remove_file(fs_dir);
2801}
2802
2803/**
2804 * aa_destroy_aafs - cleanup and free aafs
2805 *
2806 * releases dentries allocated by aa_create_aafs
2807 */
2808void __init aa_destroy_aafs(void)
2809{
2810 entry_remove_dir(&aa_sfs_entry);
2811}
2812
2813
2814#define NULL_FILE_NAME ".null"
2815struct path aa_null;
2816
2817static int aa_mk_null_file(struct dentry *parent)
2818{
2819 struct vfsmount *mount = NULL;
2820 struct dentry *dentry;
2821 struct inode *inode;
2822 int count = 0;
2823 int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count);
2824
2825 if (error)
2826 return error;
2827
2828 dentry = simple_start_creating(parent, NULL_FILE_NAME);
2829 if (IS_ERR(dentry)) {
2830 error = PTR_ERR(dentry);
2831 goto out;
2832 }
2833 inode = new_inode(parent->d_inode->i_sb);
2834 if (!inode) {
2835 error = -ENOMEM;
2836 goto out;
2837 }
2838
2839 inode->i_ino = get_next_ino();
2840 inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO;
2841 simple_inode_init_ts(inode);
2842 init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO,
2843 MKDEV(MEM_MAJOR, 3));
2844 d_instantiate(dentry, inode);
2845 aa_null.dentry = dget(dentry);
2846 aa_null.mnt = mntget(mount);
2847
2848out:
2849 simple_done_creating(dentry);
2850 simple_release_fs(&mount, &count);
2851 return error;
2852}
2853
2854static const char *policy_get_link(struct dentry *dentry,
2855 struct inode *inode,
2856 struct delayed_call *done)
2857{
2858 struct aa_ns *ns;
2859 struct path path;
2860 int error;
2861
2862 if (!dentry)
2863 return ERR_PTR(-ECHILD);
2864
2865 ns = aa_get_current_ns();
2866 path.mnt = mntget(aafs_mnt);
2867 path.dentry = dget(ns_dir(ns));
2868 error = nd_jump_link(&path);
2869 aa_put_ns(ns);
2870
2871 return ERR_PTR(error);
2872}
2873
2874static int policy_readlink(struct dentry *dentry, char __user *buffer,
2875 int buflen)
2876{
2877 char name[32];
2878 int res;
2879
2880 res = snprintf(name, sizeof(name), "%s:[%llu]", AAFS_NAME,
2881 d_inode(dentry)->i_ino);
2882 if (res > 0 && res < sizeof(name))
2883 res = readlink_copy(buffer, buflen, name, strlen(name));
2884 else
2885 res = -ENOENT;
2886
2887 return res;
2888}
2889
2890static const struct inode_operations policy_link_iops = {
2891 .readlink = policy_readlink,
2892 .get_link = policy_get_link,
2893};
2894
2895
2896/**
2897 * aa_create_aafs - create the apparmor security filesystem
2898 *
2899 * dentries created here are released by aa_destroy_aafs
2900 *
2901 * Returns: error on failure
2902 */
2903int __init aa_create_aafs(void)
2904{
2905 struct dentry *dent;
2906 int error;
2907
2908 if (!apparmor_initialized)
2909 return 0;
2910
2911 if (aa_sfs_entry.dentry) {
2912 AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
2913 return -EEXIST;
2914 }
2915
2916 /* setup apparmorfs used to virtualize policy/ */
2917 aafs_mnt = kern_mount(&aafs_ops);
2918 if (IS_ERR(aafs_mnt))
2919 panic("can't set apparmorfs up\n");
2920 aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
2921
2922 /* Populate fs tree. */
2923 error = entry_create_dir(&aa_sfs_entry, NULL);
2924 if (error)
2925 goto error;
2926
2927 dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry,
2928 NULL, &aa_fs_profile_load);
2929 if (IS_ERR(dent))
2930 goto dent_error;
2931 ns_subload(root_ns) = dent;
2932
2933 dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry,
2934 NULL, &aa_fs_profile_replace);
2935 if (IS_ERR(dent))
2936 goto dent_error;
2937 ns_subreplace(root_ns) = dent;
2938
2939 dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry,
2940 NULL, &aa_fs_profile_remove);
2941 if (IS_ERR(dent))
2942 goto dent_error;
2943 ns_subremove(root_ns) = dent;
2944
2945 dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry,
2946 NULL, &aa_fs_ns_revision_fops);
2947 if (IS_ERR(dent))
2948 goto dent_error;
2949 ns_subrevision(root_ns) = dent;
2950
2951 /* policy tree referenced by magic policy symlink */
2952 mutex_lock_nested(&root_ns->lock, root_ns->level);
2953 error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy",
2954 aafs_mnt->mnt_root);
2955 mutex_unlock(&root_ns->lock);
2956 if (error)
2957 goto error;
2958
2959 /* magic symlink similar to nsfs redirects based on task policy */
2960 dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry,
2961 NULL, &policy_link_iops);
2962 if (IS_ERR(dent))
2963 goto dent_error;
2964
2965 error = aa_mk_null_file(aa_sfs_entry.dentry);
2966 if (error)
2967 goto error;
2968
2969 /* TODO: add default profile to apparmorfs */
2970
2971 /* Report that AppArmor fs is enabled */
2972 aa_info_message("AppArmor Filesystem Enabled");
2973 return 0;
2974
2975dent_error:
2976 error = PTR_ERR(dent);
2977error:
2978 aa_destroy_aafs();
2979 AA_ERROR("Error creating AppArmor securityfs\n");
2980 return error;
2981}