| 1 | |
| 2 | |
| 3 | * AppArmor security module
|
| 4 | *
|
| 5 | * This file contains AppArmor policy manipulation functions
|
| 6 | *
|
| 7 | * Copyright (C) 1998-2008 Novell/SUSE
|
| 8 | * Copyright 2009-2010 Canonical Ltd.
|
| 9 | *
|
| 10 | * AppArmor policy is based around profiles, which contain the rules a
|
| 11 | * task is confined by. Every task in the system has a profile attached
|
| 12 | * to it determined either by matching "unconfined" tasks against the
|
| 13 | * visible set of profiles or by following a profiles attachment rules.
|
| 14 | *
|
| 15 | * Each profile exists in a profile namespace which is a container of
|
| 16 | * visible profiles. Each namespace contains a special "unconfined" profile,
|
| 17 | * which doesn't enforce any confinement on a task beyond DAC.
|
| 18 | *
|
| 19 | * Namespace and profile names can be written together in either
|
| 20 | * of two syntaxes.
|
| 21 | * :namespace:profile - used by kernel interfaces for easy detection
|
| 22 | * namespace://profile - used by policy
|
| 23 | *
|
| 24 | * Profile names can not start with : or @ or ^ and may not contain \0
|
| 25 | *
|
| 26 | * Reserved profile names
|
| 27 | * unconfined - special automatically generated unconfined profile
|
| 28 | * inherit - special name to indicate profile inheritance
|
| 29 | * null-XXXX-YYYY - special automatically generated learning profiles
|
| 30 | *
|
| 31 | * Namespace names may not start with / or @ and may not contain \0 or :
|
| 32 | * Reserved namespace names
|
| 33 | * user-XXXX - user defined profiles
|
| 34 | *
|
| 35 | * a // in a profile or namespace name indicates a hierarchical name with the
|
| 36 | * name before the // being the parent and the name after the child.
|
| 37 | *
|
| 38 | * Profile and namespace hierarchies serve two different but similar purposes.
|
| 39 | * The namespace contains the set of visible profiles that are considered
|
| 40 | * for attachment. The hierarchy of namespaces allows for virtualizing
|
| 41 | * the namespace so that for example a chroot can have its own set of profiles
|
| 42 | * which may define some local user namespaces.
|
| 43 | * The profile hierarchy severs two distinct purposes,
|
| 44 | * - it allows for sub profiles or hats, which allows an application to run
|
| 45 | * subprograms under its own profile with different restriction than it
|
| 46 | * self, and not have it use the system profile.
|
| 47 | * eg. if a mail program starts an editor, the policy might make the
|
| 48 | * restrictions tighter on the editor tighter than the mail program,
|
| 49 | * and definitely different than general editor restrictions
|
| 50 | * - it allows for binary hierarchy of profiles, so that execution history
|
| 51 | * is preserved. This feature isn't exploited by AppArmor reference policy
|
| 52 | * but is allowed. NOTE: this is currently suboptimal because profile
|
| 53 | * aliasing is not currently implemented so that a profile for each
|
| 54 | * level must be defined.
|
| 55 | * eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started
|
| 56 | * from /bin/bash
|
| 57 | *
|
| 58 | * A profile or namespace name that can contain one or more // separators
|
| 59 | * is referred to as an hname (hierarchical).
|
| 60 | * eg. /bin/bash//bin/ls
|
| 61 | *
|
| 62 | * An fqname is a name that may contain both namespace and profile hnames.
|
| 63 | * eg. :ns:/bin/bash//bin/ls
|
| 64 | *
|
| 65 | * NOTES:
|
| 66 | * - locking of profile lists is currently fairly coarse. All profile
|
| 67 | * lists within a namespace use the namespace lock.
|
| 68 | * FIXME: move profile lists to using rcu_lists
|
| 69 |
|
| 70 |
|
| 71 | #include <linux/slab.h>
|
| 72 | #include <linux/spinlock.h>
|
| 73 | #include <linux/string.h>
|
| 74 | #include <linux/cred.h>
|
| 75 | #include <linux/rculist.h>
|
| 76 | #include <linux/user_namespace.h>
|
| 77 |
|
| 78 | #include "include/apparmor.h"
|
| 79 | #include "include/capability.h"
|
| 80 | #include "include/cred.h"
|
| 81 | #include "include/file.h"
|
| 82 | #include "include/ipc.h"
|
| 83 | #include "include/match.h"
|
| 84 | #include "include/net.h"
|
| 85 | #include "include/path.h"
|
| 86 | #include "include/policy.h"
|
| 87 | #include "include/policy_ns.h"
|
| 88 | #include "include/policy_unpack.h"
|
| 89 | #include "include/resource.h"
|
| 90 |
|
| 91 | int unprivileged_userns_apparmor_policy = 1;
|
| 92 | int aa_unprivileged_unconfined_restricted;
|
| 93 |
|
| 94 | const char *const aa_profile_mode_names[] = {
|
| 95 | "enforce",
|
| 96 | "complain",
|
| 97 | "kill",
|
| 98 | "unconfined",
|
| 99 | "user",
|
| 100 | };
|
| 101 |
|
| 102 | void aa_destroy_tags(struct aa_tags_struct *tags)
|
| 103 | {
|
| 104 | kfree_sensitive(tags->hdrs.table);
|
| 105 | kfree_sensitive(tags->sets.table);
|
| 106 | aa_destroy_str_table(&tags->strs);
|
| 107 | memset(tags, 0, sizeof(*tags));
|
| 108 | }
|
| 109 |
|
| 110 | static void aa_free_pdb(struct aa_policydb *pdb)
|
| 111 | {
|
| 112 | if (pdb) {
|
| 113 | aa_put_dfa(pdb->dfa);
|
| 114 | kvfree(pdb->perms);
|
| 115 | aa_destroy_str_table(&pdb->trans);
|
| 116 | aa_destroy_tags(&pdb->tags);
|
| 117 | kfree(pdb);
|
| 118 | }
|
| 119 | }
|
| 120 |
|
| 121 | |
| 122 | * aa_pdb_free_kref - free aa_policydb by kref (called by aa_put_pdb)
|
| 123 | * @kref: kref callback for freeing of a dfa (NOT NULL)
|
| 124 |
|
| 125 | void aa_pdb_free_kref(struct kref *kref)
|
| 126 | {
|
| 127 | struct aa_policydb *pdb = container_of(kref, struct aa_policydb, count);
|
| 128 |
|
| 129 | aa_free_pdb(pdb);
|
| 130 | }
|
| 131 |
|
| 132 |
|
| 133 | struct aa_policydb *aa_alloc_pdb(gfp_t gfp)
|
| 134 | {
|
| 135 | struct aa_policydb *pdb = kzalloc_obj(struct aa_policydb, gfp);
|
| 136 |
|
| 137 | if (!pdb)
|
| 138 | return NULL;
|
| 139 |
|
| 140 | kref_init(&pdb->count);
|
| 141 |
|
| 142 | return pdb;
|
| 143 | }
|
| 144 |
|
| 145 |
|
| 146 | |
| 147 | * __add_profile - add a profiles to list and label tree
|
| 148 | * @list: list to add it to (NOT NULL)
|
| 149 | * @profile: the profile to add (NOT NULL)
|
| 150 | *
|
| 151 | * refcount @profile, should be put by __list_remove_profile
|
| 152 | *
|
| 153 | * Requires: namespace lock be held, or list not be shared
|
| 154 |
|
| 155 | static void __add_profile(struct list_head *list, struct aa_profile *profile)
|
| 156 | {
|
| 157 | struct aa_label *l;
|
| 158 |
|
| 159 | AA_BUG(!list);
|
| 160 | AA_BUG(!profile);
|
| 161 | AA_BUG(!profile->ns);
|
| 162 | AA_BUG(!mutex_is_locked(&profile->ns->lock));
|
| 163 |
|
| 164 | list_add_rcu(&profile->base.list, list);
|
| 165 |
|
| 166 | aa_get_profile(profile);
|
| 167 | l = aa_label_insert(&profile->ns->labels, &profile->label);
|
| 168 | AA_BUG(l != &profile->label);
|
| 169 | aa_put_label(l);
|
| 170 | }
|
| 171 |
|
| 172 | |
| 173 | * __list_remove_profile - remove a profile from the list it is on
|
| 174 | * @profile: the profile to remove (NOT NULL)
|
| 175 | *
|
| 176 | * remove a profile from the list, warning generally removal should
|
| 177 | * be done with __replace_profile as most profile removals are
|
| 178 | * replacements to the unconfined profile.
|
| 179 | *
|
| 180 | * put @profile list refcount
|
| 181 | *
|
| 182 | * Requires: namespace lock be held, or list not have been live
|
| 183 |
|
| 184 | static void __list_remove_profile(struct aa_profile *profile)
|
| 185 | {
|
| 186 | AA_BUG(!profile);
|
| 187 | AA_BUG(!profile->ns);
|
| 188 | AA_BUG(!mutex_is_locked(&profile->ns->lock));
|
| 189 |
|
| 190 | list_del_rcu(&profile->base.list);
|
| 191 | aa_put_profile(profile);
|
| 192 | }
|
| 193 |
|
| 194 | |
| 195 | * __remove_profile - remove profile, and children
|
| 196 | * @profile: profile to be removed (NOT NULL)
|
| 197 | *
|
| 198 | * Requires: namespace list lock be held, or list not be shared
|
| 199 |
|
| 200 | static void __remove_profile(struct aa_profile *profile)
|
| 201 | {
|
| 202 | struct aa_profile *curr, *to_remove;
|
| 203 |
|
| 204 | AA_BUG(!profile);
|
| 205 | AA_BUG(!profile->ns);
|
| 206 | AA_BUG(!mutex_is_locked(&profile->ns->lock));
|
| 207 |
|
| 208 |
|
| 209 | if (!list_empty(&profile->base.profiles)) {
|
| 210 | curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list);
|
| 211 |
|
| 212 | while (curr != profile) {
|
| 213 |
|
| 214 | while (!list_empty(&curr->base.profiles))
|
| 215 | curr = list_first_entry(&curr->base.profiles,
|
| 216 | struct aa_profile, base.list);
|
| 217 |
|
| 218 | to_remove = curr;
|
| 219 | if (!list_is_last(&to_remove->base.list,
|
| 220 | &aa_deref_parent(curr)->base.profiles))
|
| 221 | curr = list_next_entry(to_remove, base.list);
|
| 222 | else
|
| 223 | curr = aa_deref_parent(curr);
|
| 224 |
|
| 225 |
|
| 226 | aa_label_remove(&to_remove->label);
|
| 227 | __aafs_profile_rmdir(to_remove);
|
| 228 | __list_remove_profile(to_remove);
|
| 229 | }
|
| 230 | }
|
| 231 |
|
| 232 |
|
| 233 | aa_label_remove(&profile->label);
|
| 234 | __aafs_profile_rmdir(profile);
|
| 235 | __list_remove_profile(profile);
|
| 236 | |
| 237 | * longer possible here, so put the reference to it. This will
|
| 238 | * enable the rawdata to be freed if for some reason the profile
|
| 239 | * is pinned and going to live for a while.
|
| 240 |
|
| 241 | aa_put_profile_loaddata(profile->rawdata);
|
| 242 | profile->rawdata = NULL;
|
| 243 | }
|
| 244 |
|
| 245 | |
| 246 | * __aa_profile_list_release - remove all profiles on the list and put refs
|
| 247 | * @head: list of profiles (NOT NULL)
|
| 248 | *
|
| 249 | * Requires: namespace lock be held
|
| 250 |
|
| 251 | void __aa_profile_list_release(struct list_head *head)
|
| 252 | {
|
| 253 | struct aa_profile *profile, *tmp;
|
| 254 | list_for_each_entry_safe(profile, tmp, head, base.list)
|
| 255 | __remove_profile(profile);
|
| 256 | }
|
| 257 |
|
| 258 | |
| 259 | * aa_free_data - free a data blob
|
| 260 | * @ptr: data to free
|
| 261 | * @arg: unused
|
| 262 |
|
| 263 | static void aa_free_data(void *ptr, void *arg)
|
| 264 | {
|
| 265 | struct aa_data *data = ptr;
|
| 266 |
|
| 267 | if (!ptr)
|
| 268 | return;
|
| 269 |
|
| 270 | kvfree_sensitive(data->data, data->size);
|
| 271 | kfree_sensitive(data->key);
|
| 272 | kfree_sensitive(data);
|
| 273 | }
|
| 274 |
|
| 275 | static void free_attachment(struct aa_attachment *attach)
|
| 276 | {
|
| 277 | int i;
|
| 278 |
|
| 279 | if (!attach)
|
| 280 | return;
|
| 281 |
|
| 282 | for (i = 0; i < attach->xattr_count; i++)
|
| 283 | kfree_sensitive(attach->xattrs[i]);
|
| 284 | kfree_sensitive(attach->xattrs);
|
| 285 | aa_put_pdb(attach->xmatch);
|
| 286 | }
|
| 287 |
|
| 288 | static void free_ruleset(struct aa_ruleset *rules)
|
| 289 | {
|
| 290 | int i;
|
| 291 |
|
| 292 | if (!rules)
|
| 293 | return;
|
| 294 |
|
| 295 | aa_put_pdb(rules->file);
|
| 296 | aa_put_pdb(rules->policy);
|
| 297 | aa_free_cap_rules(&rules->caps);
|
| 298 | aa_free_rlimit_rules(&rules->rlimits);
|
| 299 |
|
| 300 | for (i = 0; i < rules->secmark_count; i++)
|
| 301 | kfree_sensitive(rules->secmark[i].label);
|
| 302 | kfree_sensitive(rules->secmark);
|
| 303 | kfree_sensitive(rules);
|
| 304 | }
|
| 305 |
|
| 306 | struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp)
|
| 307 | {
|
| 308 | struct aa_ruleset *rules;
|
| 309 |
|
| 310 | rules = kzalloc_obj(*rules, gfp);
|
| 311 |
|
| 312 | return rules;
|
| 313 | }
|
| 314 |
|
| 315 | |
| 316 | * aa_free_profile - free a profile
|
| 317 | * @profile: the profile to free (MAYBE NULL)
|
| 318 | *
|
| 319 | * Free a profile, its hats and null_profile. All references to the profile,
|
| 320 | * its hats and null_profile must have been put.
|
| 321 | *
|
| 322 | * If the profile was referenced from a task context, free_profile() will
|
| 323 | * be called from an rcu callback routine, so we must not sleep here.
|
| 324 |
|
| 325 | void aa_free_profile(struct aa_profile *profile)
|
| 326 | {
|
| 327 | struct rhashtable *rht;
|
| 328 |
|
| 329 | AA_DEBUG(DEBUG_POLICY, "%s(%p)\n", __func__, profile);
|
| 330 |
|
| 331 | if (!profile)
|
| 332 | return;
|
| 333 |
|
| 334 |
|
| 335 | aa_policy_destroy(&profile->base);
|
| 336 | aa_put_profile(rcu_access_pointer(profile->parent));
|
| 337 |
|
| 338 | aa_put_ns(profile->ns);
|
| 339 | kfree_sensitive(profile->rename);
|
| 340 | kfree_sensitive(profile->disconnected);
|
| 341 |
|
| 342 | free_attachment(&profile->attach);
|
| 343 |
|
| 344 | |
| 345 | * at this point there are no tasks that can have a reference
|
| 346 | * to rules
|
| 347 |
|
| 348 | for (int i = 0; i < profile->n_rules; i++)
|
| 349 | free_ruleset(profile->label.rules[i]);
|
| 350 |
|
| 351 | kfree_sensitive(profile->dirname);
|
| 352 |
|
| 353 | if (profile->data) {
|
| 354 | rht = profile->data;
|
| 355 | profile->data = NULL;
|
| 356 | rhashtable_free_and_destroy(rht, aa_free_data, NULL);
|
| 357 | kfree_sensitive(rht);
|
| 358 | }
|
| 359 |
|
| 360 | kfree_sensitive(profile->hash);
|
| 361 | aa_put_profile_loaddata(profile->rawdata);
|
| 362 | aa_label_destroy(&profile->label);
|
| 363 |
|
| 364 | kfree_sensitive(profile);
|
| 365 | }
|
| 366 |
|
| 367 | |
| 368 | * aa_alloc_profile - allocate, initialize and return a new profile
|
| 369 | * @hname: name of the profile (NOT NULL)
|
| 370 | * @proxy: proxy to use OR null if to allocate a new one
|
| 371 | * @gfp: allocation type
|
| 372 | *
|
| 373 | * Returns: refcount profile or NULL on failure
|
| 374 |
|
| 375 | struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,
|
| 376 | gfp_t gfp)
|
| 377 | {
|
| 378 | struct aa_profile *profile;
|
| 379 |
|
| 380 | |
| 381 | * this adds space for a single ruleset in the rules section of the
|
| 382 | * label
|
| 383 |
|
| 384 | profile = kzalloc_flex(*profile, label.rules, 1, gfp);
|
| 385 | if (!profile)
|
| 386 | return NULL;
|
| 387 |
|
| 388 | if (!aa_policy_init(&profile->base, NULL, hname, gfp))
|
| 389 | goto fail;
|
| 390 | if (!aa_label_init(&profile->label, 1, gfp))
|
| 391 | goto fail;
|
| 392 |
|
| 393 |
|
| 394 | profile->label.rules[0] = aa_alloc_ruleset(gfp);
|
| 395 | if (!profile->label.rules[0])
|
| 396 | goto fail;
|
| 397 | profile->n_rules = 1;
|
| 398 |
|
| 399 |
|
| 400 | if (!proxy) {
|
| 401 | proxy = aa_alloc_proxy(&profile->label, gfp);
|
| 402 | if (!proxy)
|
| 403 | goto fail;
|
| 404 | } else
|
| 405 | aa_get_proxy(proxy);
|
| 406 | profile->label.proxy = proxy;
|
| 407 |
|
| 408 | profile->label.hname = profile->base.hname;
|
| 409 | profile->label.flags |= FLAG_PROFILE;
|
| 410 | profile->label.vec[0] = profile;
|
| 411 |
|
| 412 | profile->signal = SIGKILL;
|
| 413 |
|
| 414 | return profile;
|
| 415 |
|
| 416 | fail:
|
| 417 | aa_free_profile(profile);
|
| 418 |
|
| 419 | return NULL;
|
| 420 | }
|
| 421 |
|
| 422 | static inline bool ANY_RULE_MEDIATES(struct aa_profile *profile,
|
| 423 | unsigned char class)
|
| 424 | {
|
| 425 | int i;
|
| 426 |
|
| 427 | for (i = 0; i < profile->n_rules; i++) {
|
| 428 | if (RULE_MEDIATES(profile->label.rules[i], class))
|
| 429 | return true;
|
| 430 | }
|
| 431 | return false;
|
| 432 | }
|
| 433 |
|
| 434 |
|
| 435 | static int unconfined_mediates[] = { AA_CLASS_NS, AA_CLASS_IO_URING, 0 };
|
| 436 |
|
| 437 |
|
| 438 | void aa_compute_profile_mediates(struct aa_profile *profile)
|
| 439 | {
|
| 440 | int c;
|
| 441 |
|
| 442 | if (profile_unconfined(profile)) {
|
| 443 | int *pos;
|
| 444 |
|
| 445 | for (pos = unconfined_mediates; *pos; pos++) {
|
| 446 | if (ANY_RULE_MEDIATES(profile, *pos))
|
| 447 | profile->label.mediates |= ((u64) 1) << AA_CLASS_NS;
|
| 448 | }
|
| 449 | return;
|
| 450 | }
|
| 451 | for (c = 0; c <= AA_CLASS_LAST; c++) {
|
| 452 | if (ANY_RULE_MEDIATES(profile, c))
|
| 453 | profile->label.mediates |= ((u64) 1) << c;
|
| 454 | }
|
| 455 | }
|
| 456 |
|
| 457 |
|
| 458 |
|
| 459 | |
| 460 | * __strn_find_child - find a profile on @head list using substring of @name
|
| 461 | * @head: list to search (NOT NULL)
|
| 462 | * @name: name of profile (NOT NULL)
|
| 463 | * @len: length of @name substring to match
|
| 464 | *
|
| 465 | * Requires: rcu_read_lock be held
|
| 466 | *
|
| 467 | * Returns: unrefcounted profile ptr, or NULL if not found
|
| 468 |
|
| 469 | static struct aa_profile *__strn_find_child(struct list_head *head,
|
| 470 | const char *name, int len)
|
| 471 | {
|
| 472 | return (struct aa_profile *)__policy_strn_find(head, name, len);
|
| 473 | }
|
| 474 |
|
| 475 | |
| 476 | * __find_child - find a profile on @head list with a name matching @name
|
| 477 | * @head: list to search (NOT NULL)
|
| 478 | * @name: name of profile (NOT NULL)
|
| 479 | *
|
| 480 | * Requires: rcu_read_lock be held
|
| 481 | *
|
| 482 | * Returns: unrefcounted profile ptr, or NULL if not found
|
| 483 |
|
| 484 | static struct aa_profile *__find_child(struct list_head *head, const char *name)
|
| 485 | {
|
| 486 | return __strn_find_child(head, name, strlen(name));
|
| 487 | }
|
| 488 |
|
| 489 | |
| 490 | * aa_find_child - find a profile by @name in @parent
|
| 491 | * @parent: profile to search (NOT NULL)
|
| 492 | * @name: profile name to search for (NOT NULL)
|
| 493 | *
|
| 494 | * Returns: a refcounted profile or NULL if not found
|
| 495 |
|
| 496 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
|
| 497 | {
|
| 498 | struct aa_profile *profile;
|
| 499 |
|
| 500 | rcu_read_lock();
|
| 501 | do {
|
| 502 | profile = __find_child(&parent->base.profiles, name);
|
| 503 | } while (profile && !aa_get_profile_not0(profile));
|
| 504 | rcu_read_unlock();
|
| 505 |
|
| 506 |
|
| 507 | return profile;
|
| 508 | }
|
| 509 |
|
| 510 | |
| 511 | * __lookup_parent - lookup the parent of a profile of name @hname
|
| 512 | * @ns: namespace to lookup profile in (NOT NULL)
|
| 513 | * @hname: hierarchical profile name to find parent of (NOT NULL)
|
| 514 | *
|
| 515 | * Lookups up the parent of a fully qualified profile name, the profile
|
| 516 | * that matches hname does not need to exist, in general this
|
| 517 | * is used to load a new profile.
|
| 518 | *
|
| 519 | * Requires: rcu_read_lock be held
|
| 520 | *
|
| 521 | * Returns: unrefcounted policy or NULL if not found
|
| 522 |
|
| 523 | static struct aa_policy *__lookup_parent(struct aa_ns *ns,
|
| 524 | const char *hname)
|
| 525 | {
|
| 526 | struct aa_policy *policy;
|
| 527 | struct aa_profile *profile = NULL;
|
| 528 | char *split;
|
| 529 |
|
| 530 | policy = &ns->base;
|
| 531 |
|
| 532 | for (split = strstr(hname, "//"); split;) {
|
| 533 | profile = __strn_find_child(&policy->profiles, hname,
|
| 534 | split - hname);
|
| 535 | if (!profile)
|
| 536 | return NULL;
|
| 537 | policy = &profile->base;
|
| 538 | hname = split + 2;
|
| 539 | split = strstr(hname, "//");
|
| 540 | }
|
| 541 | if (!profile)
|
| 542 | return &ns->base;
|
| 543 | return &profile->base;
|
| 544 | }
|
| 545 |
|
| 546 | |
| 547 | * __create_missing_ancestors - create place holders for missing ancestors
|
| 548 | * @ns: namespace to lookup profile in (NOT NULL)
|
| 549 | * @hname: hierarchical profile name to find parent of (NOT NULL)
|
| 550 | * @gfp: type of allocation.
|
| 551 | *
|
| 552 | * Requires: ns mutex lock held
|
| 553 | *
|
| 554 | * Return: unrefcounted parent policy on success or %NULL if error creating
|
| 555 | * place holder profiles.
|
| 556 |
|
| 557 | static struct aa_policy *__create_missing_ancestors(struct aa_ns *ns,
|
| 558 | const char *hname,
|
| 559 | gfp_t gfp)
|
| 560 | {
|
| 561 | struct aa_policy *policy;
|
| 562 | struct aa_profile *parent, *profile = NULL;
|
| 563 | char *split;
|
| 564 |
|
| 565 | AA_BUG(!ns);
|
| 566 | AA_BUG(!hname);
|
| 567 |
|
| 568 | policy = &ns->base;
|
| 569 |
|
| 570 | for (split = strstr(hname, "//"); split;) {
|
| 571 | parent = profile;
|
| 572 | profile = __strn_find_child(&policy->profiles, hname,
|
| 573 | split - hname);
|
| 574 | if (!profile) {
|
| 575 | const char *name = kstrndup(hname, split - hname,
|
| 576 | gfp);
|
| 577 | if (!name)
|
| 578 | return NULL;
|
| 579 | profile = aa_alloc_null(parent, name, gfp);
|
| 580 | kfree(name);
|
| 581 | if (!profile)
|
| 582 | return NULL;
|
| 583 | if (!parent)
|
| 584 | profile->ns = aa_get_ns(ns);
|
| 585 | }
|
| 586 | policy = &profile->base;
|
| 587 | hname = split + 2;
|
| 588 | split = strstr(hname, "//");
|
| 589 | }
|
| 590 | if (!profile)
|
| 591 | return &ns->base;
|
| 592 | return &profile->base;
|
| 593 | }
|
| 594 |
|
| 595 | |
| 596 | * __lookupn_profile - lookup the profile matching @hname
|
| 597 | * @base: base list to start looking up profile name from (NOT NULL)
|
| 598 | * @hname: hierarchical profile name (NOT NULL)
|
| 599 | * @n: length of @hname
|
| 600 | *
|
| 601 | * Requires: rcu_read_lock be held
|
| 602 | *
|
| 603 | * Returns: unrefcounted profile pointer or NULL if not found
|
| 604 | *
|
| 605 | * Do a relative name lookup, recursing through profile tree.
|
| 606 |
|
| 607 | static struct aa_profile *__lookupn_profile(struct aa_policy *base,
|
| 608 | const char *hname, size_t n)
|
| 609 | {
|
| 610 | struct aa_profile *profile = NULL;
|
| 611 | const char *split;
|
| 612 |
|
| 613 | for (split = strnstr(hname, "//", n); split;
|
| 614 | split = strnstr(hname, "//", n)) {
|
| 615 | profile = __strn_find_child(&base->profiles, hname,
|
| 616 | split - hname);
|
| 617 | if (!profile)
|
| 618 | return NULL;
|
| 619 |
|
| 620 | base = &profile->base;
|
| 621 | n -= split + 2 - hname;
|
| 622 | hname = split + 2;
|
| 623 | }
|
| 624 |
|
| 625 | if (n)
|
| 626 | return __strn_find_child(&base->profiles, hname, n);
|
| 627 | return NULL;
|
| 628 | }
|
| 629 |
|
| 630 | static struct aa_profile *__lookup_profile(struct aa_policy *base,
|
| 631 | const char *hname)
|
| 632 | {
|
| 633 | return __lookupn_profile(base, hname, strlen(hname));
|
| 634 | }
|
| 635 |
|
| 636 | |
| 637 | * aa_lookupn_profile - find a profile by its full or partial name
|
| 638 | * @ns: the namespace to start from (NOT NULL)
|
| 639 | * @hname: name to do lookup on. Does not contain namespace prefix (NOT NULL)
|
| 640 | * @n: size of @hname
|
| 641 | *
|
| 642 | * Returns: refcounted profile or NULL if not found
|
| 643 |
|
| 644 | struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
|
| 645 | size_t n)
|
| 646 | {
|
| 647 | struct aa_profile *profile;
|
| 648 |
|
| 649 | rcu_read_lock();
|
| 650 | do {
|
| 651 | profile = __lookupn_profile(&ns->base, hname, n);
|
| 652 | } while (profile && !aa_get_profile_not0(profile));
|
| 653 | rcu_read_unlock();
|
| 654 |
|
| 655 |
|
| 656 | if (!profile && strncmp(hname, "unconfined", n) == 0)
|
| 657 | profile = aa_get_newest_profile(ns->unconfined);
|
| 658 |
|
| 659 |
|
| 660 | return profile;
|
| 661 | }
|
| 662 |
|
| 663 | struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
|
| 664 | const char *fqname, size_t n)
|
| 665 | {
|
| 666 | struct aa_profile *profile;
|
| 667 | struct aa_ns *ns;
|
| 668 | const char *name, *ns_name;
|
| 669 | size_t ns_len;
|
| 670 |
|
| 671 | name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len);
|
| 672 | if (ns_name) {
|
| 673 | ns = aa_lookupn_ns(labels_ns(base), ns_name, ns_len);
|
| 674 | if (!ns)
|
| 675 | return NULL;
|
| 676 | } else
|
| 677 | ns = aa_get_ns(labels_ns(base));
|
| 678 |
|
| 679 | if (name)
|
| 680 | profile = aa_lookupn_profile(ns, name, n - (name - fqname));
|
| 681 | else if (ns)
|
| 682 |
|
| 683 | profile = aa_get_newest_profile(ns->unconfined);
|
| 684 | else
|
| 685 | profile = NULL;
|
| 686 | aa_put_ns(ns);
|
| 687 |
|
| 688 | return profile;
|
| 689 | }
|
| 690 |
|
| 691 |
|
| 692 | struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
|
| 693 | gfp_t gfp)
|
| 694 | {
|
| 695 | struct aa_profile *profile;
|
| 696 | struct aa_ruleset *rules;
|
| 697 |
|
| 698 | profile = aa_alloc_profile(name, NULL, gfp);
|
| 699 | if (!profile)
|
| 700 | return NULL;
|
| 701 |
|
| 702 |
|
| 703 | profile->label.flags |= FLAG_NULL;
|
| 704 | profile->attach.xmatch = aa_get_pdb(nullpdb);
|
| 705 | rules = profile->label.rules[0];
|
| 706 | rules->file = aa_get_pdb(nullpdb);
|
| 707 | rules->policy = aa_get_pdb(nullpdb);
|
| 708 | aa_compute_profile_mediates(profile);
|
| 709 |
|
| 710 | if (parent) {
|
| 711 | profile->path_flags = parent->path_flags;
|
| 712 |
|
| 713 | profile->label.mediates = parent->label.mediates;
|
| 714 |
|
| 715 | rcu_assign_pointer(profile->parent, aa_get_profile(parent));
|
| 716 | profile->ns = aa_get_ns(parent->ns);
|
| 717 | }
|
| 718 |
|
| 719 | return profile;
|
| 720 | }
|
| 721 |
|
| 722 | |
| 723 | * __aa_new_learning_profile - create or find a null-X learning profile
|
| 724 | * @parent: profile that caused this profile to be created (NOT NULL)
|
| 725 | * @hat: true if the null- learning profile is a hat
|
| 726 | * @base: name to base the null profile off of
|
| 727 | * @gfp: type of allocation
|
| 728 | *
|
| 729 | * Find/Create a null- complain mode profile used in learning mode. The
|
| 730 | * name of the profile is unique and follows the format of parent//null-XXX.
|
| 731 | * where XXX is based on the @name or if that fails or is not supplied
|
| 732 | * a unique number
|
| 733 | *
|
| 734 | * null profiles are added to the profile list but the list does not
|
| 735 | * hold a count on them so that they are automatically released when
|
| 736 | * not in use.
|
| 737 | *
|
| 738 | * Returns: new refcounted profile else NULL on failure
|
| 739 |
|
| 740 | struct aa_profile *__aa_new_learning_profile(struct aa_profile *parent,
|
| 741 | bool hat, const char *base,
|
| 742 | gfp_t gfp)
|
| 743 | {
|
| 744 | struct aa_profile *p, *profile;
|
| 745 | const char *bname;
|
| 746 | char *name = NULL;
|
| 747 | size_t name_sz;
|
| 748 |
|
| 749 | AA_BUG(!parent);
|
| 750 | AA_BUG(!mutex_is_locked(&parent->ns->lock));
|
| 751 |
|
| 752 | if (base) {
|
| 753 | name_sz = strlen(parent->base.hname) + 8 + strlen(base);
|
| 754 | name = kmalloc(name_sz, gfp);
|
| 755 | if (name) {
|
| 756 | snprintf(name, name_sz, "%s//null-%s",
|
| 757 | parent->base.hname, base);
|
| 758 | goto name;
|
| 759 | }
|
| 760 |
|
| 761 | }
|
| 762 |
|
| 763 | name_sz = strlen(parent->base.hname) + 2 + 7 + 8;
|
| 764 | name = kmalloc(name_sz, gfp);
|
| 765 | if (!name)
|
| 766 | return NULL;
|
| 767 | snprintf(name, name_sz, "%s//null-%x", parent->base.hname,
|
| 768 | atomic_inc_return(&parent->ns->uniq_null));
|
| 769 |
|
| 770 | name:
|
| 771 |
|
| 772 | bname = basename(name);
|
| 773 | profile = aa_find_child(parent, bname);
|
| 774 | if (profile)
|
| 775 | goto out;
|
| 776 |
|
| 777 | profile = aa_alloc_null(parent, name, gfp);
|
| 778 | if (!profile)
|
| 779 | goto fail;
|
| 780 | profile->mode = APPARMOR_COMPLAIN;
|
| 781 | if (hat)
|
| 782 | profile->label.flags |= FLAG_HAT;
|
| 783 |
|
| 784 | p = __find_child(&parent->base.profiles, bname);
|
| 785 | if (p) {
|
| 786 | aa_free_profile(profile);
|
| 787 | profile = aa_get_profile(p);
|
| 788 | } else {
|
| 789 | __add_profile(&parent->base.profiles, profile);
|
| 790 | }
|
| 791 |
|
| 792 |
|
| 793 | out:
|
| 794 | kfree(name);
|
| 795 |
|
| 796 | return profile;
|
| 797 |
|
| 798 | fail:
|
| 799 | kfree(name);
|
| 800 | aa_free_profile(profile);
|
| 801 | return NULL;
|
| 802 | }
|
| 803 |
|
| 804 | struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
|
| 805 | const char *base, gfp_t gfp)
|
| 806 | {
|
| 807 | struct aa_profile *profile;
|
| 808 |
|
| 809 | mutex_lock_nested(&parent->ns->lock, parent->ns->level);
|
| 810 | profile = __aa_new_learning_profile(parent, hat, base, gfp);
|
| 811 | mutex_unlock(&parent->ns->lock);
|
| 812 |
|
| 813 | return profile;
|
| 814 | }
|
| 815 |
|
| 816 | |
| 817 | * replacement_allowed - test to see if replacement is allowed
|
| 818 | * @profile: profile to test if it can be replaced (MAYBE NULL)
|
| 819 | * @noreplace: true if replacement shouldn't be allowed but addition is okay
|
| 820 | * @info: Returns - info about why replacement failed (NOT NULL)
|
| 821 | *
|
| 822 | * Returns: %0 if replacement allowed else error code
|
| 823 |
|
| 824 | static int replacement_allowed(struct aa_profile *profile, int noreplace,
|
| 825 | const char **info)
|
| 826 | {
|
| 827 | if (profile) {
|
| 828 | if (profile->label.flags & FLAG_IMMUTIBLE) {
|
| 829 | *info = "cannot replace immutable profile";
|
| 830 | return -EPERM;
|
| 831 | } else if (noreplace) {
|
| 832 | *info = "profile already exists";
|
| 833 | return -EEXIST;
|
| 834 | }
|
| 835 | }
|
| 836 | return 0;
|
| 837 | }
|
| 838 |
|
| 839 |
|
| 840 | static void audit_cb(struct audit_buffer *ab, void *va)
|
| 841 | {
|
| 842 | struct common_audit_data *sa = va;
|
| 843 | struct apparmor_audit_data *ad = aad(sa);
|
| 844 |
|
| 845 | if (ad->iface.ns) {
|
| 846 | audit_log_format(ab, " ns=");
|
| 847 | audit_log_untrustedstring(ab, ad->iface.ns);
|
| 848 | }
|
| 849 | }
|
| 850 |
|
| 851 | |
| 852 | * audit_policy - Do auditing of policy changes
|
| 853 | * @subj_label: label to check if it can manage policy
|
| 854 | * @op: policy operation being performed
|
| 855 | * @ns_name: name of namespace being manipulated
|
| 856 | * @name: name of profile being manipulated (NOT NULL)
|
| 857 | * @info: any extra information to be audited (MAYBE NULL)
|
| 858 | * @error: error code
|
| 859 | *
|
| 860 | * Returns: the error to be returned after audit is done
|
| 861 |
|
| 862 | static int audit_policy(struct aa_label *subj_label, const char *op,
|
| 863 | const char *ns_name, const char *name,
|
| 864 | const char *info, int error)
|
| 865 | {
|
| 866 | DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, op);
|
| 867 |
|
| 868 | ad.iface.ns = ns_name;
|
| 869 | ad.name = name;
|
| 870 | ad.info = info;
|
| 871 | ad.error = error;
|
| 872 | ad.subj_label = subj_label;
|
| 873 |
|
| 874 | aa_audit_msg(AUDIT_APPARMOR_STATUS, &ad, audit_cb);
|
| 875 |
|
| 876 | return error;
|
| 877 | }
|
| 878 |
|
| 879 | |
| 880 | * permissions
|
| 881 |
|
| 882 | static int policy_ns_capable(const struct cred *subj_cred,
|
| 883 | struct aa_label *label,
|
| 884 | struct user_namespace *userns, int cap)
|
| 885 | {
|
| 886 | int err;
|
| 887 |
|
| 888 |
|
| 889 | err = cap_capable(subj_cred, userns, cap, CAP_OPT_NONE);
|
| 890 | if (!err)
|
| 891 | err = aa_capable(subj_cred, label, cap, CAP_OPT_NONE);
|
| 892 |
|
| 893 | return err;
|
| 894 | }
|
| 895 |
|
| 896 | |
| 897 | * aa_policy_view_capable - check if viewing policy in at @ns is allowed
|
| 898 | * @subj_cred: cred of subject
|
| 899 | * @label: label that is trying to view policy in ns
|
| 900 | * @ns: namespace being viewed by @label (may be NULL if @label's ns)
|
| 901 | *
|
| 902 | * Returns: true if viewing policy is allowed
|
| 903 | *
|
| 904 | * If @ns is NULL then the namespace being viewed is assumed to be the
|
| 905 | * tasks current namespace.
|
| 906 |
|
| 907 | bool aa_policy_view_capable(const struct cred *subj_cred,
|
| 908 | struct aa_label *label, struct aa_ns *ns)
|
| 909 | {
|
| 910 | struct user_namespace *user_ns = subj_cred->user_ns;
|
| 911 | struct aa_ns *view_ns = labels_view(label);
|
| 912 | bool root_in_user_ns = uid_eq(current_euid(), make_kuid(user_ns, 0)) ||
|
| 913 | in_egroup_p(make_kgid(user_ns, 0));
|
| 914 | bool response = false;
|
| 915 | if (!ns)
|
| 916 | ns = view_ns;
|
| 917 |
|
| 918 | if (root_in_user_ns && aa_ns_visible(view_ns, ns, true) &&
|
| 919 | (user_ns == &init_user_ns ||
|
| 920 | (unprivileged_userns_apparmor_policy != 0 &&
|
| 921 | user_ns->level == view_ns->level)))
|
| 922 | response = true;
|
| 923 |
|
| 924 | return response;
|
| 925 | }
|
| 926 |
|
| 927 | bool aa_policy_admin_capable(const struct cred *subj_cred,
|
| 928 | struct aa_label *label, struct aa_ns *ns)
|
| 929 | {
|
| 930 | struct user_namespace *user_ns = subj_cred->user_ns;
|
| 931 | bool capable = policy_ns_capable(subj_cred, label, user_ns,
|
| 932 | CAP_MAC_ADMIN) == 0;
|
| 933 |
|
| 934 | AA_DEBUG(DEBUG_POLICY, "cap_mac_admin? %d\n", capable);
|
| 935 | AA_DEBUG(DEBUG_POLICY, "policy locked? %d\n", aa_g_lock_policy);
|
| 936 |
|
| 937 | return aa_policy_view_capable(subj_cred, label, ns) && capable &&
|
| 938 | !aa_g_lock_policy;
|
| 939 | }
|
| 940 |
|
| 941 | bool aa_current_policy_view_capable(struct aa_ns *ns)
|
| 942 | {
|
| 943 | struct aa_label *label;
|
| 944 | bool needput, res;
|
| 945 |
|
| 946 | label = __begin_current_label_crit_section(&needput);
|
| 947 | res = aa_policy_view_capable(current_cred(), label, ns);
|
| 948 | __end_current_label_crit_section(label, needput);
|
| 949 |
|
| 950 | return res;
|
| 951 | }
|
| 952 |
|
| 953 | bool aa_current_policy_admin_capable(struct aa_ns *ns)
|
| 954 | {
|
| 955 | struct aa_label *label;
|
| 956 | bool needput, res;
|
| 957 |
|
| 958 | label = __begin_current_label_crit_section(&needput);
|
| 959 | res = aa_policy_admin_capable(current_cred(), label, ns);
|
| 960 | __end_current_label_crit_section(label, needput);
|
| 961 |
|
| 962 | return res;
|
| 963 | }
|
| 964 |
|
| 965 | static bool is_subset_of_obj_privilege(const struct cred *cred,
|
| 966 | struct aa_label *label,
|
| 967 | const struct cred *ocred)
|
| 968 | {
|
| 969 | if (cred == ocred)
|
| 970 | return true;
|
| 971 |
|
| 972 | if (!aa_label_is_subset(label, cred_label(ocred)))
|
| 973 | return false;
|
| 974 |
|
| 975 | if (cred->user_ns != ocred->user_ns)
|
| 976 | return false;
|
| 977 | if (!cap_issubset(cred->cap_inheritable, ocred->cap_inheritable))
|
| 978 | return false;
|
| 979 | if (!cap_issubset(cred->cap_permitted, ocred->cap_permitted))
|
| 980 | return false;
|
| 981 | if (!cap_issubset(cred->cap_effective, ocred->cap_effective))
|
| 982 | return false;
|
| 983 | if (!cap_issubset(cred->cap_bset, ocred->cap_bset))
|
| 984 | return false;
|
| 985 | if (!cap_issubset(cred->cap_ambient, ocred->cap_ambient))
|
| 986 | return false;
|
| 987 | return true;
|
| 988 | }
|
| 989 |
|
| 990 |
|
| 991 | |
| 992 | * aa_may_manage_policy - can the current task manage policy
|
| 993 | * @subj_cred: subjects cred
|
| 994 | * @label: label to check if it can manage policy
|
| 995 | * @ns: namespace being managed by @label (may be NULL if @label's ns)
|
| 996 | * @ocred: object cred if request is coming from an open object
|
| 997 | * @mask: contains the policy manipulation operation being done
|
| 998 | *
|
| 999 | * Returns: 0 if the task is allowed to manipulate policy else error
|
| 1000 |
|
| 1001 | int aa_may_manage_policy(const struct cred *subj_cred, struct aa_label *label,
|
| 1002 | struct aa_ns *ns, const struct cred *ocred, u32 mask)
|
| 1003 | {
|
| 1004 | const char *op;
|
| 1005 |
|
| 1006 | if (mask & AA_MAY_REMOVE_POLICY)
|
| 1007 | op = OP_PROF_RM;
|
| 1008 | else if (mask & AA_MAY_REPLACE_POLICY)
|
| 1009 | op = OP_PROF_REPL;
|
| 1010 | else
|
| 1011 | op = OP_PROF_LOAD;
|
| 1012 |
|
| 1013 |
|
| 1014 | if (aa_g_lock_policy)
|
| 1015 | return audit_policy(label, op, NULL, NULL, "policy_locked",
|
| 1016 | -EACCES);
|
| 1017 |
|
| 1018 | if (ocred && !is_subset_of_obj_privilege(subj_cred, label, ocred))
|
| 1019 | return audit_policy(label, op, NULL, NULL,
|
| 1020 | "not privileged for target profile",
|
| 1021 | -EACCES);
|
| 1022 |
|
| 1023 | if (!aa_policy_admin_capable(subj_cred, label, ns))
|
| 1024 | return audit_policy(label, op, NULL, NULL, "not policy admin",
|
| 1025 | -EACCES);
|
| 1026 |
|
| 1027 |
|
| 1028 | return 0;
|
| 1029 | }
|
| 1030 |
|
| 1031 | static struct aa_profile *__list_lookup_parent(struct list_head *lh,
|
| 1032 | struct aa_profile *profile)
|
| 1033 | {
|
| 1034 | const char *base = basename(profile->base.hname);
|
| 1035 | long len = base - profile->base.hname;
|
| 1036 | struct aa_load_ent *ent;
|
| 1037 |
|
| 1038 |
|
| 1039 | if (len <= 2)
|
| 1040 | return NULL;
|
| 1041 | len -= 2;
|
| 1042 |
|
| 1043 | list_for_each_entry(ent, lh, list) {
|
| 1044 | if (ent->new == profile)
|
| 1045 | continue;
|
| 1046 | if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
|
| 1047 | 0 && ent->new->base.hname[len] == 0)
|
| 1048 | return ent->new;
|
| 1049 | }
|
| 1050 |
|
| 1051 | return NULL;
|
| 1052 | }
|
| 1053 |
|
| 1054 | |
| 1055 | * __replace_profile - replace @old with @new on a list
|
| 1056 | * @old: profile to be replaced (NOT NULL)
|
| 1057 | * @new: profile to replace @old with (NOT NULL)
|
| 1058 | *
|
| 1059 | * Will duplicate and refcount elements that @new inherits from @old
|
| 1060 | * and will inherit @old children.
|
| 1061 | *
|
| 1062 | * refcount @new for list, put @old list refcount
|
| 1063 | *
|
| 1064 | * Requires: namespace list lock be held, or list not be shared
|
| 1065 |
|
| 1066 | static void __replace_profile(struct aa_profile *old, struct aa_profile *new)
|
| 1067 | {
|
| 1068 | struct aa_profile *child, *tmp;
|
| 1069 |
|
| 1070 | if (!list_empty(&old->base.profiles)) {
|
| 1071 | LIST_HEAD(lh);
|
| 1072 | list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu);
|
| 1073 |
|
| 1074 | list_for_each_entry_safe(child, tmp, &lh, base.list) {
|
| 1075 | struct aa_profile *p;
|
| 1076 |
|
| 1077 | list_del_init(&child->base.list);
|
| 1078 | p = __find_child(&new->base.profiles, child->base.name);
|
| 1079 | if (p) {
|
| 1080 |
|
| 1081 | __replace_profile(child, p);
|
| 1082 | continue;
|
| 1083 | }
|
| 1084 |
|
| 1085 |
|
| 1086 |
|
| 1087 |
|
| 1088 | p = aa_deref_parent(child);
|
| 1089 | rcu_assign_pointer(child->parent, aa_get_profile(new));
|
| 1090 | list_add_rcu(&child->base.list, &new->base.profiles);
|
| 1091 | aa_put_profile(p);
|
| 1092 | }
|
| 1093 | }
|
| 1094 |
|
| 1095 | if (!rcu_access_pointer(new->parent)) {
|
| 1096 | struct aa_profile *parent = aa_deref_parent(old);
|
| 1097 | rcu_assign_pointer(new->parent, aa_get_profile(parent));
|
| 1098 | }
|
| 1099 | aa_label_replace(&old->label, &new->label);
|
| 1100 |
|
| 1101 | __aafs_profile_migrate_dents(old, new);
|
| 1102 |
|
| 1103 | if (list_empty(&new->base.list)) {
|
| 1104 |
|
| 1105 | list_replace_rcu(&old->base.list, &new->base.list);
|
| 1106 | aa_get_profile(new);
|
| 1107 | aa_put_profile(old);
|
| 1108 | } else
|
| 1109 | __list_remove_profile(old);
|
| 1110 | }
|
| 1111 |
|
| 1112 | |
| 1113 | * __lookup_replace - lookup replacement information for a profile
|
| 1114 | * @ns: namespace the lookup occurs in
|
| 1115 | * @hname: name of profile to lookup
|
| 1116 | * @noreplace: true if not replacing an existing profile
|
| 1117 | * @p: Returns - profile to be replaced
|
| 1118 | * @info: Returns - info string on why lookup failed
|
| 1119 | *
|
| 1120 | * Returns: profile to replace (no ref) on success else ptr error
|
| 1121 |
|
| 1122 | static int __lookup_replace(struct aa_ns *ns, const char *hname,
|
| 1123 | bool noreplace, struct aa_profile **p,
|
| 1124 | const char **info)
|
| 1125 | {
|
| 1126 | *p = aa_get_profile(__lookup_profile(&ns->base, hname));
|
| 1127 | if (*p) {
|
| 1128 | int error = replacement_allowed(*p, noreplace, info);
|
| 1129 | if (error) {
|
| 1130 | *info = "profile can not be replaced";
|
| 1131 | return error;
|
| 1132 | }
|
| 1133 | }
|
| 1134 |
|
| 1135 | return 0;
|
| 1136 | }
|
| 1137 |
|
| 1138 | static void share_name(struct aa_profile *old, struct aa_profile *new)
|
| 1139 | {
|
| 1140 | aa_put_str(new->base.hname);
|
| 1141 | aa_get_str(old->base.hname);
|
| 1142 | new->base.hname = old->base.hname;
|
| 1143 | new->base.name = old->base.name;
|
| 1144 | new->label.hname = old->label.hname;
|
| 1145 | }
|
| 1146 |
|
| 1147 | |
| 1148 | * Returns: unrefcount newest version of parent
|
| 1149 |
|
| 1150 | static struct aa_profile *update_to_newest_parent(struct aa_profile *new)
|
| 1151 | {
|
| 1152 | struct aa_profile *parent, *newest;
|
| 1153 |
|
| 1154 | parent = rcu_dereference_protected(new->parent,
|
| 1155 | mutex_is_locked(&new->ns->lock));
|
| 1156 | newest = aa_get_newest_profile(parent);
|
| 1157 |
|
| 1158 |
|
| 1159 | if (newest != parent) {
|
| 1160 | aa_put_profile(parent);
|
| 1161 | rcu_assign_pointer(new->parent, newest);
|
| 1162 | } else
|
| 1163 | aa_put_profile(newest);
|
| 1164 |
|
| 1165 | return newest;
|
| 1166 | }
|
| 1167 |
|
| 1168 | |
| 1169 | * aa_replace_profiles - replace profile(s) on the profile list
|
| 1170 | * @policy_ns: namespace load is occurring on
|
| 1171 | * @label: label that is attempting to load/replace policy
|
| 1172 | * @mask: permission mask
|
| 1173 | * @udata: serialized data stream (NOT NULL)
|
| 1174 | * @compressed_profile: The userspace-provided compressed profile. May be NULL
|
| 1175 | * @compressed_size: If compressed_data is not NULL, the compressed data size
|
| 1176 | *
|
| 1177 | * unpack and replace a profile on the profile list and uses of that profile
|
| 1178 | * by any task creds via invalidating the old version of the profile, which
|
| 1179 | * tasks will notice to update their own cred. If the profile does not exist
|
| 1180 | * on the profile list it is added.
|
| 1181 | *
|
| 1182 | * Returns: size of data consumed else error code on failure.
|
| 1183 |
|
| 1184 | ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
|
| 1185 | u32 mask, struct aa_loaddata *udata,
|
| 1186 | char *compressed_profile, size_t compressed_size)
|
| 1187 | {
|
| 1188 | const char *ns_name = NULL, *info = NULL;
|
| 1189 | struct aa_ns *ns = NULL;
|
| 1190 | struct aa_load_ent *ent, *tmp;
|
| 1191 | struct aa_loaddata *rawdata_ent;
|
| 1192 | const char *op;
|
| 1193 | ssize_t count, error;
|
| 1194 | LIST_HEAD(lh);
|
| 1195 |
|
| 1196 | op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
|
| 1197 | aa_get_profile_loaddata(udata);
|
| 1198 |
|
| 1199 | error = aa_unpack(udata, &lh, &ns_name, compressed_profile, compressed_size);
|
| 1200 | if (error)
|
| 1201 | goto out;
|
| 1202 |
|
| 1203 | |
| 1204 | * TODO: update locking to remove this constraint. All profiles in
|
| 1205 | * the load set must succeed as a set or the load will
|
| 1206 | * fail. Sort ent list and take ns locks in hierarchy order
|
| 1207 |
|
| 1208 | count = 0;
|
| 1209 | list_for_each_entry(ent, &lh, list) {
|
| 1210 | if (ns_name) {
|
| 1211 | if (ent->ns_name &&
|
| 1212 | strcmp(ent->ns_name, ns_name) != 0) {
|
| 1213 | info = "policy load has mixed namespaces";
|
| 1214 | error = -EACCES;
|
| 1215 | goto fail;
|
| 1216 | }
|
| 1217 | } else if (ent->ns_name) {
|
| 1218 | if (count) {
|
| 1219 | info = "policy load has mixed namespaces";
|
| 1220 | error = -EACCES;
|
| 1221 | goto fail;
|
| 1222 | }
|
| 1223 | ns_name = ent->ns_name;
|
| 1224 | ent->ns_name = NULL;
|
| 1225 | } else
|
| 1226 | count++;
|
| 1227 | }
|
| 1228 | if (ns_name) {
|
| 1229 | ns = aa_prepare_ns(policy_ns ? policy_ns : labels_ns(label),
|
| 1230 | ns_name);
|
| 1231 | if (IS_ERR(ns)) {
|
| 1232 | op = OP_PROF_LOAD;
|
| 1233 | info = "failed to prepare namespace";
|
| 1234 | error = PTR_ERR(ns);
|
| 1235 | ns = NULL;
|
| 1236 | ent = NULL;
|
| 1237 | goto fail;
|
| 1238 | }
|
| 1239 | } else
|
| 1240 | ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label));
|
| 1241 |
|
| 1242 | mutex_lock_nested(&ns->lock, ns->level);
|
| 1243 |
|
| 1244 | if (!list_empty(&ns->rawdata_list)) {
|
| 1245 | list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) {
|
| 1246 | if (aa_rawdata_eq(rawdata_ent, udata)) {
|
| 1247 | struct aa_loaddata *tmp;
|
| 1248 |
|
| 1249 | |
| 1250 | * Entries remain on rawdata_list with
|
| 1251 | * pcount == 0 until do_ploaddata_rmfs()
|
| 1252 | * runs; only take a live profile ref.
|
| 1253 |
|
| 1254 | tmp = aa_get_profile_loaddata_not0(rawdata_ent);
|
| 1255 | if (tmp) {
|
| 1256 | aa_put_profile_loaddata(udata);
|
| 1257 | udata = tmp;
|
| 1258 | break;
|
| 1259 | }
|
| 1260 | }
|
| 1261 | }
|
| 1262 | }
|
| 1263 |
|
| 1264 | list_for_each_entry(ent, &lh, list) {
|
| 1265 | struct aa_policy *policy;
|
| 1266 | struct aa_profile *p;
|
| 1267 |
|
| 1268 | if (aa_g_export_binary)
|
| 1269 | ent->new->rawdata = aa_get_profile_loaddata(udata);
|
| 1270 | error = __lookup_replace(ns, ent->new->base.hname,
|
| 1271 | !(mask & AA_MAY_REPLACE_POLICY),
|
| 1272 | &ent->old, &info);
|
| 1273 | if (error)
|
| 1274 | goto fail_lock;
|
| 1275 |
|
| 1276 | if (ent->new->rename) {
|
| 1277 | error = __lookup_replace(ns, ent->new->rename,
|
| 1278 | !(mask & AA_MAY_REPLACE_POLICY),
|
| 1279 | &ent->rename, &info);
|
| 1280 | if (error)
|
| 1281 | goto fail_lock;
|
| 1282 | }
|
| 1283 |
|
| 1284 |
|
| 1285 | ent->new->ns = aa_get_ns(ns);
|
| 1286 |
|
| 1287 | if (ent->old || ent->rename)
|
| 1288 | continue;
|
| 1289 |
|
| 1290 |
|
| 1291 | p = NULL;
|
| 1292 | policy = __lookup_parent(ns, ent->new->base.hname);
|
| 1293 | if (!policy) {
|
| 1294 |
|
| 1295 | p = __list_lookup_parent(&lh, ent->new);
|
| 1296 | if (!p) {
|
| 1297 | |
| 1298 | * fill in missing parent with null
|
| 1299 | * profile that doesn't have
|
| 1300 | * permissions. This allows for
|
| 1301 | * individual profile loading where
|
| 1302 | * the child is loaded before the
|
| 1303 | * parent, and outside of the current
|
| 1304 | * atomic set. This unfortunately can
|
| 1305 | * happen with some userspaces. The
|
| 1306 | * null profile will be replaced once
|
| 1307 | * the parent is loaded.
|
| 1308 |
|
| 1309 | policy = __create_missing_ancestors(ns,
|
| 1310 | ent->new->base.hname,
|
| 1311 | GFP_KERNEL);
|
| 1312 | if (!policy) {
|
| 1313 | error = -ENOENT;
|
| 1314 | info = "parent does not exist";
|
| 1315 | goto fail_lock;
|
| 1316 | }
|
| 1317 | }
|
| 1318 | }
|
| 1319 | if (!p && policy != &ns->base)
|
| 1320 |
|
| 1321 | p = (struct aa_profile *) policy;
|
| 1322 | rcu_assign_pointer(ent->new->parent, aa_get_profile(p));
|
| 1323 | }
|
| 1324 |
|
| 1325 |
|
| 1326 | if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) {
|
| 1327 | error = __aa_fs_create_rawdata(ns, udata);
|
| 1328 | if (error) {
|
| 1329 | info = "failed to create raw_data dir and files";
|
| 1330 | ent = NULL;
|
| 1331 | goto fail_lock;
|
| 1332 | }
|
| 1333 | }
|
| 1334 | list_for_each_entry(ent, &lh, list) {
|
| 1335 | if (!ent->old) {
|
| 1336 | struct dentry *parent;
|
| 1337 | if (rcu_access_pointer(ent->new->parent)) {
|
| 1338 | struct aa_profile *p;
|
| 1339 | p = aa_deref_parent(ent->new);
|
| 1340 | parent = prof_child_dir(p);
|
| 1341 | } else
|
| 1342 | parent = ns_subprofs_dir(ent->new->ns);
|
| 1343 | error = __aafs_profile_mkdir(ent->new, parent);
|
| 1344 | }
|
| 1345 |
|
| 1346 | if (error) {
|
| 1347 | info = "failed to create";
|
| 1348 | goto fail_lock;
|
| 1349 | }
|
| 1350 | }
|
| 1351 |
|
| 1352 |
|
| 1353 | __aa_bump_ns_revision(ns);
|
| 1354 | if (aa_g_export_binary)
|
| 1355 | __aa_loaddata_update(udata, ns->revision);
|
| 1356 | list_for_each_entry_safe(ent, tmp, &lh, list) {
|
| 1357 | list_del_init(&ent->list);
|
| 1358 | op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;
|
| 1359 |
|
| 1360 | if (ent->old && ent->old->rawdata == ent->new->rawdata &&
|
| 1361 | ent->new->rawdata) {
|
| 1362 |
|
| 1363 | audit_policy(label, op, ns_name, ent->new->base.hname,
|
| 1364 | "same as current profile, skipping",
|
| 1365 | error);
|
| 1366 |
|
| 1367 | aa_put_proxy(ent->new->label.proxy);
|
| 1368 | ent->new->label.proxy = NULL;
|
| 1369 | goto skip;
|
| 1370 | }
|
| 1371 |
|
| 1372 | if (!aa_g_export_binary) {
|
| 1373 | if (ent->old && ent->old->rawdata &&
|
| 1374 | ent->old->dents[AAFS_LOADDATA_DIR]) {
|
| 1375 | |
| 1376 | * target will be removed
|
| 1377 |
|
| 1378 | __aa_remove_rawdata_symlink_dents(ent->old);
|
| 1379 | }
|
| 1380 | }
|
| 1381 |
|
| 1382 | |
| 1383 | * TODO: finer dedup based on profile range in data. Load set
|
| 1384 | * can differ but profile may remain unchanged
|
| 1385 |
|
| 1386 | audit_policy(label, op, ns_name, ent->new->base.hname, NULL,
|
| 1387 | error);
|
| 1388 |
|
| 1389 | if (ent->old) {
|
| 1390 | share_name(ent->old, ent->new);
|
| 1391 | __replace_profile(ent->old, ent->new);
|
| 1392 | if (aa_g_export_binary) {
|
| 1393 |
|
| 1394 | if (!ent->old->rawdata)
|
| 1395 | __aa_create_rawdata_symlink_dents(ent->new);
|
| 1396 | }
|
| 1397 | } else {
|
| 1398 | struct list_head *lh;
|
| 1399 |
|
| 1400 | if (rcu_access_pointer(ent->new->parent)) {
|
| 1401 | struct aa_profile *parent;
|
| 1402 |
|
| 1403 | parent = update_to_newest_parent(ent->new);
|
| 1404 | lh = &parent->base.profiles;
|
| 1405 | } else
|
| 1406 | lh = &ns->base.profiles;
|
| 1407 | __add_profile(lh, ent->new);
|
| 1408 | }
|
| 1409 | skip:
|
| 1410 | aa_load_ent_free(ent);
|
| 1411 | }
|
| 1412 | __aa_labelset_update_subtree(ns);
|
| 1413 | mutex_unlock(&ns->lock);
|
| 1414 |
|
| 1415 | out:
|
| 1416 | aa_put_ns(ns);
|
| 1417 |
|
| 1418 | ssize_t udata_sz = udata->size;
|
| 1419 |
|
| 1420 | aa_put_profile_loaddata(udata);
|
| 1421 | kfree(ns_name);
|
| 1422 |
|
| 1423 | if (error)
|
| 1424 | return error;
|
| 1425 | return udata_sz;
|
| 1426 |
|
| 1427 | fail_lock:
|
| 1428 | mutex_unlock(&ns->lock);
|
| 1429 |
|
| 1430 |
|
| 1431 | op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
|
| 1432 | fail:
|
| 1433 | audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL,
|
| 1434 | info, error);
|
| 1435 |
|
| 1436 | info = "valid profile in failed atomic policy load";
|
| 1437 | list_for_each_entry(tmp, &lh, list) {
|
| 1438 | if (tmp == ent) {
|
| 1439 | info = "unchecked profile in failed atomic policy load";
|
| 1440 |
|
| 1441 | continue;
|
| 1442 | }
|
| 1443 | op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
|
| 1444 | audit_policy(label, op, ns_name, tmp->new->base.hname, info,
|
| 1445 | error);
|
| 1446 | }
|
| 1447 | list_for_each_entry_safe(ent, tmp, &lh, list) {
|
| 1448 | list_del_init(&ent->list);
|
| 1449 | aa_load_ent_free(ent);
|
| 1450 | }
|
| 1451 |
|
| 1452 | goto out;
|
| 1453 | }
|
| 1454 |
|
| 1455 | |
| 1456 | * aa_remove_profiles - remove profile(s) from the system
|
| 1457 | * @policy_ns: namespace the remove is being done from
|
| 1458 | * @subj: label attempting to remove policy
|
| 1459 | * @fqname: name of the profile or namespace to remove (NOT NULL)
|
| 1460 | * @size: size of the name
|
| 1461 | *
|
| 1462 | * Remove a profile or sub namespace from the current namespace, so that
|
| 1463 | * they can not be found anymore and mark them as replaced by unconfined
|
| 1464 | *
|
| 1465 | * NOTE: removing confinement does not restore rlimits to preconfinement values
|
| 1466 | *
|
| 1467 | * Returns: size of data consume else error code if fails
|
| 1468 |
|
| 1469 | ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
|
| 1470 | char *fqname, size_t size)
|
| 1471 | {
|
| 1472 | struct aa_ns *ns = NULL;
|
| 1473 | struct aa_profile *profile = NULL;
|
| 1474 | const char *name = fqname, *info = NULL;
|
| 1475 | const char *ns_name = NULL;
|
| 1476 | ssize_t error = 0;
|
| 1477 |
|
| 1478 | if (*fqname == 0) {
|
| 1479 | info = "no profile specified";
|
| 1480 | error = -ENOENT;
|
| 1481 | goto fail;
|
| 1482 | }
|
| 1483 |
|
| 1484 | if (fqname[0] == ':') {
|
| 1485 | size_t ns_len;
|
| 1486 |
|
| 1487 | name = aa_splitn_fqname(fqname, size, &ns_name, &ns_len);
|
| 1488 |
|
| 1489 | ns = aa_lookupn_ns(policy_ns ? policy_ns : labels_ns(subj),
|
| 1490 | ns_name, ns_len);
|
| 1491 | if (!ns) {
|
| 1492 | info = "namespace does not exist";
|
| 1493 | error = -ENOENT;
|
| 1494 | goto fail;
|
| 1495 | }
|
| 1496 | } else
|
| 1497 |
|
| 1498 | ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(subj));
|
| 1499 |
|
| 1500 | if (!name) {
|
| 1501 |
|
| 1502 | mutex_lock_nested(&ns->parent->lock, ns->parent->level);
|
| 1503 | __aa_bump_ns_revision(ns);
|
| 1504 | __aa_remove_ns(ns);
|
| 1505 | mutex_unlock(&ns->parent->lock);
|
| 1506 | } else {
|
| 1507 |
|
| 1508 | mutex_lock_nested(&ns->lock, ns->level);
|
| 1509 | profile = aa_get_profile(__lookup_profile(&ns->base, name));
|
| 1510 | if (!profile) {
|
| 1511 | error = -ENOENT;
|
| 1512 | info = "profile does not exist";
|
| 1513 | goto fail_ns_lock;
|
| 1514 | }
|
| 1515 | name = profile->base.hname;
|
| 1516 | __aa_bump_ns_revision(ns);
|
| 1517 | __remove_profile(profile);
|
| 1518 | __aa_labelset_update_subtree(ns);
|
| 1519 | mutex_unlock(&ns->lock);
|
| 1520 | }
|
| 1521 |
|
| 1522 |
|
| 1523 | (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
|
| 1524 | error);
|
| 1525 | aa_put_ns(ns);
|
| 1526 | aa_put_profile(profile);
|
| 1527 | return size;
|
| 1528 |
|
| 1529 | fail_ns_lock:
|
| 1530 | mutex_unlock(&ns->lock);
|
| 1531 | aa_put_ns(ns);
|
| 1532 |
|
| 1533 | fail:
|
| 1534 | (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
|
| 1535 | error);
|
| 1536 | return error;
|
| 1537 | }
|