projects/linux·blob master · refs

754 lines · 20.8 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor mediation of files
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11#include <linux/tty.h>
12#include <linux/fdtable.h>
13#include <linux/file.h>
14#include <linux/fs.h>
15#include <linux/mount.h>
16
17#include "include/af_unix.h"
18#include "include/apparmor.h"
19#include "include/audit.h"
20#include "include/cred.h"
21#include "include/file.h"
22#include "include/match.h"
23#include "include/net.h"
24#include "include/path.h"
25#include "include/policy.h"
26#include "include/label.h"
27
28static u32 map_mask_to_chr_mask(u32 mask)
29{
30 u32 m = mask & PERMS_CHRS_MASK;
31
32 if (mask & AA_MAY_GETATTR)
33 m |= MAY_READ;
34 if (mask & (AA_MAY_SETATTR | AA_MAY_CHMOD | AA_MAY_CHOWN))
35 m |= MAY_WRITE;
36
37 return m;
38}
39
40/**
41 * file_audit_cb - call back for file specific audit fields
42 * @ab: audit_buffer (NOT NULL)
43 * @va: audit struct to audit values of (NOT NULL)
44 */
45static void file_audit_cb(struct audit_buffer *ab, void *va)
46{
47 struct common_audit_data *sa = va;
48 struct apparmor_audit_data *ad = aad(sa);
49 kuid_t fsuid = ad->subj_cred ? ad->subj_cred->fsuid : current_fsuid();
50 char str[10];
51
52 if (ad->request & AA_AUDIT_FILE_MASK) {
53 aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,
54 map_mask_to_chr_mask(ad->request));
55 audit_log_format(ab, " requested_mask=\"%s\"", str);
56 }
57 if (ad->denied & AA_AUDIT_FILE_MASK) {
58 aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,
59 map_mask_to_chr_mask(ad->denied));
60 audit_log_format(ab, " denied_mask=\"%s\"", str);
61 }
62 if (ad->request & AA_AUDIT_FILE_MASK) {
63 audit_log_format(ab, " fsuid=%d",
64 from_kuid(&init_user_ns, fsuid));
65 audit_log_format(ab, " ouid=%d",
66 from_kuid(&init_user_ns, ad->fs.ouid));
67 }
68
69 if (ad->peer) {
70 audit_log_format(ab, " target=");
71 aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
72 FLAG_VIEW_SUBNS, GFP_KERNEL);
73 } else if (ad->fs.target) {
74 audit_log_format(ab, " target=");
75 audit_log_untrustedstring(ab, ad->fs.target);
76 }
77}
78
79/**
80 * aa_audit_file - handle the auditing of file operations
81 * @subj_cred: cred of the subject
82 * @profile: the profile being enforced (NOT NULL)
83 * @perms: the permissions computed for the request (NOT NULL)
84 * @op: operation being mediated
85 * @request: permissions requested
86 * @name: name of object being mediated (MAYBE NULL)
87 * @target: name of target (MAYBE NULL)
88 * @tlabel: target label (MAY BE NULL)
89 * @ouid: object uid
90 * @info: extra information message (MAYBE NULL)
91 * @error: 0 if operation allowed else failure error code
92 *
93 * Returns: %0 or error on failure
94 */
95int aa_audit_file(const struct cred *subj_cred,
96 struct aa_profile *profile, const struct aa_perms *perms,
97 const char *op, u32 request, const char *name,
98 const char *target, struct aa_label *tlabel,
99 kuid_t ouid, const char *info, int error)
100{
101 u32 quiet = perms->quiet;
102 u32 complain = perms->complain;
103 int type = AUDIT_APPARMOR_AUTO;
104 DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);
105
106 ad.subj_cred = subj_cred;
107 ad.request = request;
108 ad.tags = perms->tag;
109 ad.name = name;
110 ad.fs.target = target;
111 ad.peer = tlabel;
112 ad.fs.ouid = ouid;
113 ad.info = info;
114 ad.error = error;
115 ad.common.u.tsk = NULL;
116
117 if (COMPLAIN_MODE(profile))
118 complain |= ~(perms->allow | perms->deny);
119 if (likely(!ad.error)) {
120 u32 mask = perms->audit;
121
122 if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
123 mask = 0xffff;
124
125 /* mask off perms that are not being force audited */
126 ad.request &= mask;
127
128 if (likely(!ad.request))
129 return 0;
130 type = AUDIT_APPARMOR_AUDIT;
131 } else {
132 /* only report permissions that were denied */
133 ad.request = ad.request & ~perms->allow;
134 AA_BUG(!ad.request);
135
136 if (ad.request & perms->kill)
137 type = AUDIT_APPARMOR_KILL;
138
139 if (AUDIT_MODE(profile) == AUDIT_QUIET_ALLOWED)
140 quiet |= complain | perms->allow;
141
142 /* quiet known rejects, assumes quiet and kill do not overlap */
143 if ((ad.request & quiet) &&
144 AUDIT_MODE(profile) != AUDIT_NOQUIET &&
145 AUDIT_MODE(profile) != AUDIT_ALL)
146 ad.request &= ~quiet;
147
148 if (!ad.request)
149 return ad.error;
150 }
151
152 ad.denied = ad.request & ~perms->allow;
153 return aa_audit(type, profile, &ad, file_audit_cb);
154}
155
156static int path_name(const char *op, const struct cred *subj_cred,
157 struct aa_label *label,
158 const struct path *path, int flags, char *buffer,
159 const char **name, struct path_cond *cond, u32 request)
160{
161 struct aa_profile *profile;
162 const char *info = NULL;
163 int error;
164
165 /* don't reaudit files closed during inheritance */
166 if (unlikely(path->dentry == aa_null.dentry))
167 return -EACCES;
168
169 error = aa_path_name(path, flags, buffer, name, &info,
170 labels_profile(label)->disconnected);
171 if (error) {
172 fn_for_each_confined(label, profile,
173 aa_audit_file(subj_cred,
174 profile, &nullperms, op, request, *name,
175 NULL, NULL, cond->uid, info, error));
176 return error;
177 }
178
179 return 0;
180}
181
182struct aa_perms default_perms = {};
183/**
184 * aa_lookup_condperms - convert dfa compressed perms to internal perms
185 * @subj_uid: uid to use for subject owner test
186 * @rules: the aa_policydb to lookup perms for (NOT NULL)
187 * @state: state in dfa
188 * @cond: conditions to consider (NOT NULL)
189 *
190 * TODO: convert from dfa + state to permission entry
191 *
192 * Returns: a pointer to a file permission set
193 */
194struct aa_perms *aa_lookup_condperms(kuid_t subj_uid, struct aa_policydb *rules,
195 aa_state_t state, struct path_cond *cond)
196{
197 unsigned int index = ACCEPT_TABLE(rules->dfa)[state];
198
199 if (!(rules->perms))
200 return &default_perms;
201
202 if ((ACCEPT_TABLE2(rules->dfa)[state] & ACCEPT_FLAG_OWNER)) {
203 if (uid_eq(subj_uid, cond->uid))
204 return &(rules->perms[index]);
205 return &(rules->perms[index + 1]);
206 }
207
208 return &(rules->perms[index]);
209}
210
211/**
212 * aa_str_perms - find permission that match @name
213 * @file_rules: the aa_policydb to match against (NOT NULL)
214 * @start: state to start matching in
215 * @name: string to match against dfa (NOT NULL)
216 * @cond: conditions to consider for permission set computation (NOT NULL)
217 * @perms: Returns - the permissions found when matching @name
218 *
219 * Returns: the final state in @dfa when beginning @start and walking @name
220 */
221aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start,
222 const char *name, struct path_cond *cond,
223 struct aa_perms *perms)
224{
225 aa_state_t state;
226 state = aa_dfa_match(file_rules->dfa, start, name);
227 *perms = *(aa_lookup_condperms(current_fsuid(), file_rules, state,
228 cond));
229
230 return state;
231}
232
233int __aa_path_perm(const char *op, const struct cred *subj_cred,
234 struct aa_profile *profile, const char *name,
235 u32 request, struct path_cond *cond, int flags,
236 struct aa_perms *perms)
237{
238 struct aa_ruleset *rules = profile->label.rules[0];
239 int e = 0;
240
241 if (profile_unconfined(profile) ||
242 ((flags & PATH_SOCK_COND) && !RULE_MEDIATES_UNIX(rules)))
243 return 0;
244 aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],
245 name, cond, perms);
246 if (request & ~perms->allow)
247 e = -EACCES;
248 return aa_audit_file(subj_cred,
249 profile, perms, op, request, name, NULL, NULL,
250 cond->uid, NULL, e);
251}
252
253
254static int profile_path_perm(const char *op, const struct cred *subj_cred,
255 struct aa_profile *profile,
256 const struct path *path, char *buffer, u32 request,
257 struct path_cond *cond, int flags,
258 struct aa_perms *perms)
259{
260 const char *name = NULL;
261 int error;
262
263 if (profile_unconfined(profile))
264 return 0;
265
266 error = path_name(op, subj_cred, &profile->label, path,
267 flags | profile->path_flags, buffer, &name, cond,
268 request);
269 if (error)
270 return error;
271 return __aa_path_perm(op, subj_cred, profile, name, request, cond,
272 flags, perms);
273}
274
275/**
276 * aa_path_perm - do permissions check & audit for @path
277 * @op: operation being checked
278 * @subj_cred: subject cred
279 * @label: profile being enforced (NOT NULL)
280 * @path: path to check permissions of (NOT NULL)
281 * @flags: any additional path flags beyond what the profile specifies
282 * @request: requested permissions
283 * @cond: conditional info for this request (NOT NULL)
284 *
285 * Returns: %0 else error if access denied or other error
286 */
287int aa_path_perm(const char *op, const struct cred *subj_cred,
288 struct aa_label *label,
289 const struct path *path, int flags, u32 request,
290 struct path_cond *cond)
291{
292 struct aa_perms perms = {};
293 struct aa_profile *profile;
294 char *buffer = NULL;
295 int error;
296
297 flags |= PATH_DELEGATE_DELETED | (S_ISDIR(cond->mode) ? PATH_IS_DIR :
298 0);
299 buffer = aa_get_buffer(false);
300 if (!buffer)
301 return -ENOMEM;
302 error = fn_for_each_confined(label, profile,
303 profile_path_perm(op, subj_cred, profile, path, buffer,
304 request, cond, flags, &perms));
305
306 aa_put_buffer(buffer);
307
308 return error;
309}
310
311/**
312 * xindex_is_subset - helper for aa_path_link
313 * @link: link permission set
314 * @target: target permission set
315 *
316 * test target x permissions are equal OR a subset of link x permissions
317 * this is done as part of the subset test, where a hardlink must have
318 * a subset of permissions that the target has.
319 *
320 * Returns: true if subset else false
321 */
322static inline bool xindex_is_subset(u32 link, u32 target)
323{
324 if (((link & ~AA_X_UNSAFE) != (target & ~AA_X_UNSAFE)) ||
325 ((link & AA_X_UNSAFE) && !(target & AA_X_UNSAFE)))
326 return false;
327
328 return true;
329}
330
331static int profile_path_link(const struct cred *subj_cred,
332 struct aa_profile *profile,
333 const struct path *link, char *buffer,
334 const struct path *target, char *buffer2,
335 struct path_cond *cond)
336{
337 struct aa_ruleset *rules = profile->label.rules[0];
338 const char *lname = NULL, *tname = NULL;
339 struct aa_perms lperms = {}, perms;
340 const char *info = NULL;
341 u32 request = AA_MAY_LINK;
342 aa_state_t state;
343 int error;
344
345 error = path_name(OP_LINK, subj_cred, &profile->label, link,
346 profile->path_flags,
347 buffer, &lname, cond, AA_MAY_LINK);
348 if (error)
349 goto audit;
350
351 /* buffer2 freed below, tname is pointer in buffer2 */
352 error = path_name(OP_LINK, subj_cred, &profile->label, target,
353 profile->path_flags,
354 buffer2, &tname, cond, AA_MAY_LINK);
355 if (error)
356 goto audit;
357
358 error = -EACCES;
359 /* aa_str_perms - handles the case of the dfa being NULL */
360 state = aa_str_perms(rules->file,
361 rules->file->start[AA_CLASS_FILE], lname,
362 cond, &lperms);
363
364 if (!(lperms.allow & AA_MAY_LINK))
365 goto audit;
366
367 /* test to see if target can be paired with link */
368 state = aa_dfa_null_transition(rules->file->dfa, state);
369 aa_str_perms(rules->file, state, tname, cond, &perms);
370
371 /* force audit/quiet masks for link are stored in the second entry
372 * in the link pair.
373 */
374 lperms.audit = perms.audit;
375 lperms.quiet = perms.quiet;
376 lperms.kill = perms.kill;
377
378 if (!(perms.allow & AA_MAY_LINK)) {
379 info = "target restricted";
380 lperms = perms;
381 goto audit;
382 }
383
384 /* done if link subset test is not required */
385 if (!(perms.allow & AA_LINK_SUBSET))
386 goto done_tests;
387
388 /* Do link perm subset test requiring allowed permission on link are
389 * a subset of the allowed permissions on target.
390 */
391 aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],
392 tname, cond, &perms);
393
394 /* AA_MAY_LINK is not considered in the subset test */
395 request = lperms.allow & ~AA_MAY_LINK;
396 lperms.allow &= perms.allow | AA_MAY_LINK;
397
398 request |= AA_AUDIT_FILE_MASK & (lperms.allow & ~perms.allow);
399 if (request & ~lperms.allow) {
400 goto audit;
401 } else if ((lperms.allow & MAY_EXEC) &&
402 !xindex_is_subset(lperms.xindex, perms.xindex)) {
403 lperms.allow &= ~MAY_EXEC;
404 request |= MAY_EXEC;
405 info = "link not subset of target";
406 goto audit;
407 }
408
409done_tests:
410 error = 0;
411
412audit:
413 return aa_audit_file(subj_cred,
414 profile, &lperms, OP_LINK, request, lname, tname,
415 NULL, cond->uid, info, error);
416}
417
418/**
419 * aa_path_link - Handle hard link permission check
420 * @subj_cred: subject cred
421 * @label: the label being enforced (NOT NULL)
422 * @old_dentry: the target dentry (NOT NULL)
423 * @new_dir: directory the new link will be created in (NOT NULL)
424 * @new_dentry: the link being created (NOT NULL)
425 *
426 * Handle the permission test for a link & target pair. Permission
427 * is encoded as a pair where the link permission is determined
428 * first, and if allowed, the target is tested. The target test
429 * is done from the point of the link match (not start of DFA)
430 * making the target permission dependent on the link permission match.
431 *
432 * The subset test if required forces that permissions granted
433 * on link are a subset of the permission granted to target.
434 *
435 * Returns: %0 if allowed else error
436 */
437int aa_path_link(const struct cred *subj_cred,
438 struct aa_label *label, struct dentry *old_dentry,
439 const struct path *new_dir, struct dentry *new_dentry)
440{
441 struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
442 struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
443 struct inode *inode = d_backing_inode(old_dentry);
444 vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_idmap(target.mnt), inode);
445 struct path_cond cond = {
446 .uid = vfsuid_into_kuid(vfsuid),
447 .mode = inode->i_mode,
448 };
449 char *buffer = NULL, *buffer2 = NULL;
450 struct aa_profile *profile;
451 int error;
452
453 /* buffer freed below, lname is pointer in buffer */
454 buffer = aa_get_buffer(false);
455 buffer2 = aa_get_buffer(false);
456 error = -ENOMEM;
457 if (!buffer || !buffer2)
458 goto out;
459
460 error = fn_for_each_confined(label, profile,
461 profile_path_link(subj_cred, profile, &link, buffer,
462 &target, buffer2, &cond));
463out:
464 aa_put_buffer(buffer);
465 aa_put_buffer(buffer2);
466 return error;
467}
468
469static void update_file_ctx(struct aa_file_ctx *fctx, struct aa_label *label,
470 u32 request)
471{
472 struct aa_label *l, *old;
473
474 /* update caching of label on file_ctx */
475 spin_lock(&fctx->lock);
476 old = rcu_dereference_protected(fctx->label,
477 lockdep_is_held(&fctx->lock));
478 l = aa_label_merge(old, label, GFP_ATOMIC);
479 if (l) {
480 if (l != old) {
481 rcu_assign_pointer(fctx->label, l);
482 aa_put_label(old);
483 } else
484 aa_put_label(l);
485 fctx->allow |= request;
486 }
487 spin_unlock(&fctx->lock);
488}
489
490static int __file_path_perm(const char *op, const struct cred *subj_cred,
491 struct aa_label *label,
492 struct aa_label *flabel, struct file *file,
493 u32 request, u32 denied, bool in_atomic)
494{
495 struct aa_profile *profile;
496 struct aa_perms perms = {};
497 vfsuid_t vfsuid = i_uid_into_vfsuid(file_mnt_idmap(file),
498 file_inode(file));
499 struct path_cond cond = {
500 .uid = vfsuid_into_kuid(vfsuid),
501 .mode = file_inode(file)->i_mode
502 };
503 char *buffer;
504 int flags, error;
505
506 /* revalidation due to label out of date. No revocation at this time */
507 if (!denied && aa_label_is_subset(flabel, label))
508 /* TODO: check for revocation on stale profiles */
509 return 0;
510
511 flags = PATH_DELEGATE_DELETED | (S_ISDIR(cond.mode) ? PATH_IS_DIR : 0);
512 buffer = aa_get_buffer(in_atomic);
513 if (!buffer)
514 return -ENOMEM;
515
516 /* check every profile in task label not in current cache */
517 error = fn_for_each_not_in_set(flabel, label, profile,
518 profile_path_perm(op, subj_cred, profile,
519 &file->f_path, buffer,
520 request, &cond, flags, &perms));
521 if (denied && !error) {
522 /*
523 * check every profile in file label that was not tested
524 * in the initial check above.
525 *
526 * TODO: cache full perms so this only happens because of
527 * conditionals
528 * TODO: don't audit here
529 */
530 if (label == flabel)
531 error = fn_for_each(label, profile,
532 profile_path_perm(op, subj_cred,
533 profile, &file->f_path,
534 buffer, request, &cond, flags,
535 &perms));
536 else
537 error = fn_for_each_not_in_set(label, flabel, profile,
538 profile_path_perm(op, subj_cred,
539 profile, &file->f_path,
540 buffer, request, &cond, flags,
541 &perms));
542 }
543 if (!error)
544 update_file_ctx(file_ctx(file), label, request);
545
546 aa_put_buffer(buffer);
547
548 return error;
549}
550
551static int __file_sock_perm(const char *op, const struct cred *subj_cred,
552 struct aa_label *label,
553 struct aa_label *flabel, struct file *file,
554 u32 request, u32 denied)
555{
556 int error;
557
558 /* revalidation due to label out of date. No revocation at this time */
559 if (!denied && aa_label_is_subset(flabel, label))
560 return 0;
561
562 /* TODO: improve to skip profiles cached in flabel */
563 error = aa_sock_file_perm(subj_cred, label, op, request, file);
564 if (denied) {
565 /* TODO: improve to skip profiles checked above */
566 /* check every profile in file label to is cached */
567 last_error(error, aa_sock_file_perm(subj_cred, flabel, op,
568 request, file));
569 }
570 if (!error)
571 update_file_ctx(file_ctx(file), label, request);
572
573 return error;
574}
575
576/* for now separate fn to indicate semantics of the check */
577static bool __file_is_delegated(struct aa_label *obj_label)
578{
579 return unconfined(obj_label);
580}
581
582static bool __is_unix_file(struct file *file)
583{
584 struct socket *sock = (struct socket *) file->private_data;
585
586 lockdep_assert_in_rcu_read_lock();
587
588 if (!S_ISSOCK(file_inode(file)->i_mode))
589 return false;
590 /* sock and sock->sk can be NULL for sockets being set up or torn down */
591 if (!sock || !sock->sk)
592 return false;
593 if (sock->sk->sk_family == PF_UNIX)
594 return true;
595 return false;
596}
597
598static bool __unix_needs_revalidation(struct file *file, struct aa_label *label,
599 u32 request)
600{
601 struct socket *sock = (struct socket *) file->private_data;
602
603 AA_BUG(!__is_unix_file(file));
604 lockdep_assert_in_rcu_read_lock();
605
606 struct aa_sk_ctx *skctx = aa_sock(sock->sk);
607
608 if (rcu_access_pointer(skctx->peer) !=
609 rcu_access_pointer(skctx->peer_lastupdate))
610 return true;
611
612 return !__aa_subj_label_is_cached(rcu_dereference(skctx->label), label);
613}
614
615/**
616 * aa_file_perm - do permission revalidation check & audit for @file
617 * @op: operation being checked
618 * @subj_cred: subject cred
619 * @label: label being enforced (NOT NULL)
620 * @file: file to revalidate access permissions on (NOT NULL)
621 * @request: requested permissions
622 * @in_atomic: whether allocations need to be done in atomic context
623 *
624 * Returns: %0 if access allowed else error
625 */
626int aa_file_perm(const char *op, const struct cred *subj_cred,
627 struct aa_label *label, struct file *file,
628 u32 request, bool in_atomic)
629{
630 struct aa_file_ctx *fctx;
631 struct aa_label *flabel;
632 u32 denied;
633 int error = 0;
634
635 AA_BUG(!label);
636 AA_BUG(!file);
637
638 /* don't reaudit files closed during inheritance */
639 if (unlikely(file->f_path.dentry == aa_null.dentry))
640 return -EACCES;
641
642 fctx = file_ctx(file);
643
644 rcu_read_lock();
645 flabel = rcu_dereference(fctx->label);
646 AA_BUG(!flabel);
647
648 /* revalidate access, if task is unconfined, or the cached cred
649 * doesn't match or if the request is for more permissions than
650 * was granted.
651 *
652 * Note: the test for !unconfined(flabel) is to handle file
653 * delegation from unconfined tasks
654 */
655 denied = request & ~fctx->allow;
656 if (unconfined(label) || __file_is_delegated(flabel) ||
657 (!denied && __is_unix_file(file) && !__unix_needs_revalidation(file, label, request)) ||
658 (!denied && __aa_subj_label_is_cached(label, flabel))) {
659 rcu_read_unlock();
660 goto done;
661 }
662
663 /* slow path - revalidate access */
664 flabel = aa_get_newest_label(flabel);
665 rcu_read_unlock();
666
667 if (path_mediated_fs(file->f_path.dentry))
668 error = __file_path_perm(op, subj_cred, label, flabel, file,
669 request, denied, in_atomic);
670
671 else if (S_ISSOCK(file_inode(file)->i_mode))
672 error = __file_sock_perm(op, subj_cred, label, flabel, file,
673 request, denied);
674 aa_put_label(flabel);
675
676done:
677 return error;
678}
679
680static void revalidate_tty(const struct cred *subj_cred, struct aa_label *label)
681{
682 struct tty_struct *tty;
683 int drop_tty = 0;
684
685 tty = get_current_tty();
686 if (!tty)
687 return;
688
689 spin_lock(&tty->files_lock);
690 if (!list_empty(&tty->tty_files)) {
691 struct tty_file_private *file_priv;
692 struct file *file;
693 /* TODO: Revalidate access to controlling tty. */
694 file_priv = list_first_entry(&tty->tty_files,
695 struct tty_file_private, list);
696 file = file_priv->file;
697
698 if (aa_file_perm(OP_INHERIT, subj_cred, label, file,
699 MAY_READ | MAY_WRITE, IN_ATOMIC))
700 drop_tty = 1;
701 }
702 spin_unlock(&tty->files_lock);
703 tty_kref_put(tty);
704
705 if (drop_tty)
706 no_tty();
707}
708
709struct cred_label {
710 const struct cred *cred;
711 struct aa_label *label;
712};
713
714static int match_file(const void *p, struct file *file, unsigned int fd)
715{
716 struct cred_label *cl = (struct cred_label *)p;
717
718 if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,
719 aa_map_file_to_perms(file), IN_ATOMIC))
720 return fd + 1;
721 return 0;
722}
723
724
725/* based on selinux's flush_unauthorized_files */
726void aa_inherit_files(const struct cred *cred, struct files_struct *files)
727{
728 struct aa_label *label = aa_get_newest_cred_label(cred);
729 struct cred_label cl = {
730 .cred = cred,
731 .label = label,
732 };
733 struct file *devnull = NULL;
734 unsigned int n;
735
736 revalidate_tty(cred, label);
737
738 /* Revalidate access to inherited open files. */
739 n = iterate_fd(files, 0, match_file, &cl);
740 if (!n) /* none found? */
741 goto out;
742
743 devnull = dentry_open(&aa_null, O_RDWR, cred);
744 if (IS_ERR(devnull))
745 devnull = NULL;
746 /* replace all the matching ones with this */
747 do {
748 replace_fd(n - 1, devnull, 0);
749 } while ((n = iterate_fd(files, n, match_file, &cl)) != 0);
750 if (devnull)
751 fput(devnull);
752out:
753 aa_put_label(label);
754}