blob: bf28b48bf6dd4a7b63e41a1c2b77848ba47f49fd [file] [log] [blame]
John Johansenb5e95b42010-07-29 14:48:07 -07001/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor LSM hooks.
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 */
14
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070015#include <linux/lsm_hooks.h>
John Johansenb5e95b42010-07-29 14:48:07 -070016#include <linux/moduleparam.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/mount.h>
20#include <linux/namei.h>
21#include <linux/ptrace.h>
22#include <linux/ctype.h>
23#include <linux/sysctl.h>
24#include <linux/audit.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070025#include <linux/user_namespace.h>
William Huae025be02017-01-15 16:49:28 -080026#include <linux/kmemleak.h>
John Johansenb5e95b42010-07-29 14:48:07 -070027#include <net/sock.h>
28
29#include "include/apparmor.h"
30#include "include/apparmorfs.h"
31#include "include/audit.h"
32#include "include/capability.h"
33#include "include/context.h"
34#include "include/file.h"
35#include "include/ipc.h"
36#include "include/path.h"
John Johansen637f6882017-06-09 08:14:28 -070037#include "include/label.h"
John Johansenb5e95b42010-07-29 14:48:07 -070038#include "include/policy.h"
John Johansencff281f2017-01-16 00:42:15 -080039#include "include/policy_ns.h"
John Johansenb5e95b42010-07-29 14:48:07 -070040#include "include/procattr.h"
41
42/* Flag indicating whether initialization completed */
John Johansen545de8f2017-04-06 06:55:23 -070043int apparmor_initialized;
John Johansenb5e95b42010-07-29 14:48:07 -070044
John Johansend4669f02017-01-16 00:43:10 -080045DEFINE_PER_CPU(struct aa_buffers, aa_buffers);
46
47
John Johansenb5e95b42010-07-29 14:48:07 -070048/*
49 * LSM hook functions
50 */
51
52/*
John Johansen637f6882017-06-09 08:14:28 -070053 * free the associated aa_task_ctx and put its labels
John Johansenb5e95b42010-07-29 14:48:07 -070054 */
55static void apparmor_cred_free(struct cred *cred)
56{
John Johansen55a26eb2017-01-16 00:43:00 -080057 aa_free_task_context(cred_ctx(cred));
58 cred_ctx(cred) = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -070059}
60
61/*
62 * allocate the apparmor part of blank credentials
63 */
64static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
65{
66 /* freed by apparmor_cred_free */
John Johansen55a26eb2017-01-16 00:43:00 -080067 struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
68
69 if (!ctx)
John Johansenb5e95b42010-07-29 14:48:07 -070070 return -ENOMEM;
71
John Johansen55a26eb2017-01-16 00:43:00 -080072 cred_ctx(cred) = ctx;
John Johansenb5e95b42010-07-29 14:48:07 -070073 return 0;
74}
75
76/*
John Johansen55a26eb2017-01-16 00:43:00 -080077 * prepare new aa_task_ctx for modification by prepare_cred block
John Johansenb5e95b42010-07-29 14:48:07 -070078 */
79static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
80 gfp_t gfp)
81{
82 /* freed by apparmor_cred_free */
John Johansen55a26eb2017-01-16 00:43:00 -080083 struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
84
85 if (!ctx)
John Johansenb5e95b42010-07-29 14:48:07 -070086 return -ENOMEM;
87
John Johansen55a26eb2017-01-16 00:43:00 -080088 aa_dup_task_context(ctx, cred_ctx(old));
89 cred_ctx(new) = ctx;
John Johansenb5e95b42010-07-29 14:48:07 -070090 return 0;
91}
92
93/*
94 * transfer the apparmor data to a blank set of creds
95 */
96static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
97{
John Johansen55a26eb2017-01-16 00:43:00 -080098 const struct aa_task_ctx *old_ctx = cred_ctx(old);
99 struct aa_task_ctx *new_ctx = cred_ctx(new);
John Johansenb5e95b42010-07-29 14:48:07 -0700100
John Johansen55a26eb2017-01-16 00:43:00 -0800101 aa_dup_task_context(new_ctx, old_ctx);
John Johansenb5e95b42010-07-29 14:48:07 -0700102}
103
104static int apparmor_ptrace_access_check(struct task_struct *child,
105 unsigned int mode)
106{
John Johansenb2d09ae2017-06-09 14:22:14 -0700107 struct aa_label *tracer, *tracee;
108 int error;
109
110 tracer = begin_current_label_crit_section();
111 tracee = aa_get_task_label(child);
112 error = aa_may_ptrace(tracer, tracee,
113 mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE);
114 aa_put_label(tracee);
115 end_current_label_crit_section(tracer);
116
117 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700118}
119
120static int apparmor_ptrace_traceme(struct task_struct *parent)
121{
John Johansenb2d09ae2017-06-09 14:22:14 -0700122 struct aa_label *tracer, *tracee;
123 int error;
124
125 tracee = begin_current_label_crit_section();
126 tracer = aa_get_task_label(parent);
127 error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE);
128 aa_put_label(tracer);
129 end_current_label_crit_section(tracee);
130
131 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700132}
133
134/* Derived from security/commoncap.c:cap_capget */
135static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
136 kernel_cap_t *inheritable, kernel_cap_t *permitted)
137{
John Johansen637f6882017-06-09 08:14:28 -0700138 struct aa_label *label;
John Johansenb5e95b42010-07-29 14:48:07 -0700139 const struct cred *cred;
140
141 rcu_read_lock();
142 cred = __task_cred(target);
John Johansen637f6882017-06-09 08:14:28 -0700143 label = aa_get_newest_cred_label(cred);
John Johansenc70c86c2017-06-09 14:07:02 -0700144
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700145 /*
146 * cap_capget is stacked ahead of this and will
147 * initialize effective and permitted.
148 */
John Johansenc70c86c2017-06-09 14:07:02 -0700149 if (!unconfined(label)) {
150 struct aa_profile *profile;
151 struct label_it i;
152
153 label_for_each_confined(i, label, profile) {
154 if (COMPLAIN_MODE(profile))
155 continue;
156 *effective = cap_intersect(*effective,
157 profile->caps.allow);
158 *permitted = cap_intersect(*permitted,
159 profile->caps.allow);
160 }
John Johansenb5e95b42010-07-29 14:48:07 -0700161 }
162 rcu_read_unlock();
John Johansen637f6882017-06-09 08:14:28 -0700163 aa_put_label(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700164
165 return 0;
166}
167
Eric Paris6a9de492012-01-03 12:25:14 -0500168static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
169 int cap, int audit)
John Johansenb5e95b42010-07-29 14:48:07 -0700170{
John Johansen637f6882017-06-09 08:14:28 -0700171 struct aa_label *label;
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700172 int error = 0;
173
John Johansen637f6882017-06-09 08:14:28 -0700174 label = aa_get_newest_cred_label(cred);
175 if (!unconfined(label))
John Johansenc70c86c2017-06-09 14:07:02 -0700176 error = aa_capable(label, cap, audit);
John Johansen637f6882017-06-09 08:14:28 -0700177 aa_put_label(label);
John Johansencf797c02017-06-09 02:08:28 -0700178
John Johansenb5e95b42010-07-29 14:48:07 -0700179 return error;
180}
181
182/**
183 * common_perm - basic common permission check wrapper fn for paths
184 * @op: operation being checked
185 * @path: path to check permission of (NOT NULL)
186 * @mask: requested permissions mask
187 * @cond: conditional info for the permission request (NOT NULL)
188 *
189 * Returns: %0 else error code if error or permission denied
190 */
John Johansen47f6e5c2017-01-16 00:43:01 -0800191static int common_perm(const char *op, const struct path *path, u32 mask,
John Johansenb5e95b42010-07-29 14:48:07 -0700192 struct path_cond *cond)
193{
John Johansen637f6882017-06-09 08:14:28 -0700194 struct aa_label *label;
John Johansenb5e95b42010-07-29 14:48:07 -0700195 int error = 0;
196
John Johansen637f6882017-06-09 08:14:28 -0700197 label = __begin_current_label_crit_section();
198 if (!unconfined(label))
199 error = aa_path_perm(op, labels_profile(label), path, 0, mask,
200 cond);
201 __end_current_label_crit_section(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700202
203 return error;
204}
205
206/**
John Johansen31f75bf2017-01-16 00:43:07 -0800207 * common_perm_cond - common permission wrapper around inode cond
208 * @op: operation being checked
209 * @path: location to check (NOT NULL)
210 * @mask: requested permissions mask
211 *
212 * Returns: %0 else error code if error or permission denied
213 */
214static int common_perm_cond(const char *op, const struct path *path, u32 mask)
215{
216 struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
217 d_backing_inode(path->dentry)->i_mode
218 };
219
220 if (!path_mediated_fs(path->dentry))
221 return 0;
222
223 return common_perm(op, path, mask, &cond);
224}
225
226/**
John Johansenb5e95b42010-07-29 14:48:07 -0700227 * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
228 * @op: operation being checked
229 * @dir: directory of the dentry (NOT NULL)
230 * @dentry: dentry to check (NOT NULL)
231 * @mask: requested permissions mask
232 * @cond: conditional info for the permission request (NOT NULL)
233 *
234 * Returns: %0 else error code if error or permission denied
235 */
John Johansen47f6e5c2017-01-16 00:43:01 -0800236static int common_perm_dir_dentry(const char *op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700237 struct dentry *dentry, u32 mask,
238 struct path_cond *cond)
239{
Kees Cook8486adf2016-12-16 17:04:13 -0800240 struct path path = { .mnt = dir->mnt, .dentry = dentry };
John Johansenb5e95b42010-07-29 14:48:07 -0700241
242 return common_perm(op, &path, mask, cond);
243}
244
245/**
John Johansenb5e95b42010-07-29 14:48:07 -0700246 * common_perm_rm - common permission wrapper for operations doing rm
247 * @op: operation being checked
248 * @dir: directory that the dentry is in (NOT NULL)
249 * @dentry: dentry being rm'd (NOT NULL)
250 * @mask: requested permission mask
251 *
252 * Returns: %0 else error code if error or permission denied
253 */
John Johansen47f6e5c2017-01-16 00:43:01 -0800254static int common_perm_rm(const char *op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700255 struct dentry *dentry, u32 mask)
256{
David Howellsc6f493d2015-03-17 22:26:22 +0000257 struct inode *inode = d_backing_inode(dentry);
John Johansenb5e95b42010-07-29 14:48:07 -0700258 struct path_cond cond = { };
259
John Johansenefeee832017-01-16 00:42:28 -0800260 if (!inode || !path_mediated_fs(dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700261 return 0;
262
263 cond.uid = inode->i_uid;
264 cond.mode = inode->i_mode;
265
266 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
267}
268
269/**
270 * common_perm_create - common permission wrapper for operations doing create
271 * @op: operation being checked
272 * @dir: directory that dentry will be created in (NOT NULL)
273 * @dentry: dentry to create (NOT NULL)
274 * @mask: request permission mask
275 * @mode: created file mode
276 *
277 * Returns: %0 else error code if error or permission denied
278 */
John Johansen47f6e5c2017-01-16 00:43:01 -0800279static int common_perm_create(const char *op, const struct path *dir,
Al Virod6b49f72016-03-25 15:10:04 -0400280 struct dentry *dentry, u32 mask, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700281{
282 struct path_cond cond = { current_fsuid(), mode };
283
John Johansenefeee832017-01-16 00:42:28 -0800284 if (!path_mediated_fs(dir->dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700285 return 0;
286
287 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
288}
289
Al Viro989f74e2016-03-25 15:13:39 -0400290static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700291{
292 return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
293}
294
Al Virod3607752016-03-25 15:21:09 -0400295static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
Al Viro4572bef2011-11-21 14:56:21 -0500296 umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700297{
298 return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
299 S_IFDIR);
300}
301
Al Viro989f74e2016-03-25 15:13:39 -0400302static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700303{
304 return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
305}
306
Al Virod3607752016-03-25 15:21:09 -0400307static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
Al Viro04fc66e2011-11-21 14:58:38 -0500308 umode_t mode, unsigned int dev)
John Johansenb5e95b42010-07-29 14:48:07 -0700309{
310 return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
311}
312
Al Viro81f4c502016-03-25 14:22:01 -0400313static int apparmor_path_truncate(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700314{
John Johansene53cfe62017-05-26 15:07:22 -0700315 return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR);
John Johansenb5e95b42010-07-29 14:48:07 -0700316}
317
Al Virod3607752016-03-25 15:21:09 -0400318static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
John Johansenb5e95b42010-07-29 14:48:07 -0700319 const char *old_name)
320{
321 return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
322 S_IFLNK);
323}
324
Al Viro3ccee462016-03-25 15:27:45 -0400325static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700326 struct dentry *new_dentry)
327{
John Johansen637f6882017-06-09 08:14:28 -0700328 struct aa_label *label;
John Johansenb5e95b42010-07-29 14:48:07 -0700329 int error = 0;
330
John Johansenefeee832017-01-16 00:42:28 -0800331 if (!path_mediated_fs(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700332 return 0;
333
John Johansen637f6882017-06-09 08:14:28 -0700334 label = begin_current_label_crit_section();
335 if (!unconfined(label))
336 error = aa_path_link(labels_profile(label), old_dentry, new_dir,
337 new_dentry);
338 end_current_label_crit_section(label);
John Johansencf797c02017-06-09 02:08:28 -0700339
John Johansenb5e95b42010-07-29 14:48:07 -0700340 return error;
341}
342
Al Viro3ccee462016-03-25 15:27:45 -0400343static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
344 const struct path *new_dir, struct dentry *new_dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700345{
John Johansen637f6882017-06-09 08:14:28 -0700346 struct aa_label *label;
John Johansenb5e95b42010-07-29 14:48:07 -0700347 int error = 0;
348
John Johansenefeee832017-01-16 00:42:28 -0800349 if (!path_mediated_fs(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700350 return 0;
351
John Johansen637f6882017-06-09 08:14:28 -0700352 label = begin_current_label_crit_section();
353 if (!unconfined(label)) {
Kees Cook8486adf2016-12-16 17:04:13 -0800354 struct path old_path = { .mnt = old_dir->mnt,
355 .dentry = old_dentry };
356 struct path new_path = { .mnt = new_dir->mnt,
357 .dentry = new_dentry };
David Howellsc6f493d2015-03-17 22:26:22 +0000358 struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
359 d_backing_inode(old_dentry)->i_mode
John Johansenb5e95b42010-07-29 14:48:07 -0700360 };
361
John Johansen637f6882017-06-09 08:14:28 -0700362 error = aa_path_perm(OP_RENAME_SRC, labels_profile(label),
363 &old_path, 0,
John Johansene53cfe62017-05-26 15:07:22 -0700364 MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
365 AA_MAY_SETATTR | AA_MAY_DELETE,
John Johansenb5e95b42010-07-29 14:48:07 -0700366 &cond);
367 if (!error)
John Johansen637f6882017-06-09 08:14:28 -0700368 error = aa_path_perm(OP_RENAME_DEST,
369 labels_profile(label),
370 &new_path,
John Johansene53cfe62017-05-26 15:07:22 -0700371 0, MAY_WRITE | AA_MAY_SETATTR |
John Johansenb5e95b42010-07-29 14:48:07 -0700372 AA_MAY_CREATE, &cond);
373
374 }
John Johansen637f6882017-06-09 08:14:28 -0700375 end_current_label_crit_section(label);
John Johansencf797c02017-06-09 02:08:28 -0700376
John Johansenb5e95b42010-07-29 14:48:07 -0700377 return error;
378}
379
Al Virobe01f9f2016-03-25 14:56:23 -0400380static int apparmor_path_chmod(const struct path *path, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700381{
John Johansen31f75bf2017-01-16 00:43:07 -0800382 return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD);
John Johansenb5e95b42010-07-29 14:48:07 -0700383}
384
Al Viro7fd25da2016-03-25 14:44:41 -0400385static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
John Johansenb5e95b42010-07-29 14:48:07 -0700386{
John Johansen31f75bf2017-01-16 00:43:07 -0800387 return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN);
John Johansenb5e95b42010-07-29 14:48:07 -0700388}
389
Al Viro3f7036a2015-03-08 19:28:30 -0400390static int apparmor_inode_getattr(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700391{
John Johansene53cfe62017-05-26 15:07:22 -0700392 return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR);
John Johansenb5e95b42010-07-29 14:48:07 -0700393}
394
Eric Paris83d49852012-04-04 13:45:40 -0400395static int apparmor_file_open(struct file *file, const struct cred *cred)
John Johansenb5e95b42010-07-29 14:48:07 -0700396{
John Johansen637f6882017-06-09 08:14:28 -0700397 struct aa_file_ctx *fctx = file_ctx(file);
398 struct aa_label *label;
John Johansenb5e95b42010-07-29 14:48:07 -0700399 int error = 0;
400
John Johansenefeee832017-01-16 00:42:28 -0800401 if (!path_mediated_fs(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700402 return 0;
403
404 /* If in exec, permission is handled by bprm hooks.
405 * Cache permissions granted by the previous exec check, with
406 * implicit read and executable mmap which are required to
407 * actually execute the image.
408 */
409 if (current->in_execve) {
John Johansen55a26eb2017-01-16 00:43:00 -0800410 fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
John Johansenb5e95b42010-07-29 14:48:07 -0700411 return 0;
412 }
413
John Johansen637f6882017-06-09 08:14:28 -0700414 label = aa_get_newest_cred_label(cred);
415 if (!unconfined(label)) {
Al Viro496ad9a2013-01-23 17:07:38 -0500416 struct inode *inode = file_inode(file);
John Johansenb5e95b42010-07-29 14:48:07 -0700417 struct path_cond cond = { inode->i_uid, inode->i_mode };
418
John Johansen637f6882017-06-09 08:14:28 -0700419 error = aa_path_perm(OP_OPEN, labels_profile(label),
420 &file->f_path, 0,
John Johansenb5e95b42010-07-29 14:48:07 -0700421 aa_map_file_to_perms(file), &cond);
422 /* todo cache full allowed permissions set and state */
John Johansen55a26eb2017-01-16 00:43:00 -0800423 fctx->allow = aa_map_file_to_perms(file);
John Johansenb5e95b42010-07-29 14:48:07 -0700424 }
John Johansen637f6882017-06-09 08:14:28 -0700425 aa_put_label(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700426
427 return error;
428}
429
430static int apparmor_file_alloc_security(struct file *file)
431{
John Johansencf797c02017-06-09 02:08:28 -0700432 int error = 0;
433
John Johansenb5e95b42010-07-29 14:48:07 -0700434 /* freed by apparmor_file_free_security */
John Johansen637f6882017-06-09 08:14:28 -0700435 struct aa_label *label = begin_current_label_crit_section();
John Johansen2835a132017-06-09 11:43:45 -0700436 file->f_security = aa_alloc_file_ctx(GFP_KERNEL);
437 if (!file_ctx(file))
438 error = -ENOMEM;
John Johansen637f6882017-06-09 08:14:28 -0700439 end_current_label_crit_section(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700440
John Johansencf797c02017-06-09 02:08:28 -0700441 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700442}
443
444static void apparmor_file_free_security(struct file *file)
445{
John Johansen2835a132017-06-09 11:43:45 -0700446 aa_free_file_ctx(file_ctx(file));
John Johansenb5e95b42010-07-29 14:48:07 -0700447}
448
John Johansen47f6e5c2017-01-16 00:43:01 -0800449static int common_file_perm(const char *op, struct file *file, u32 mask)
John Johansenb5e95b42010-07-29 14:48:07 -0700450{
John Johansen55a26eb2017-01-16 00:43:00 -0800451 struct aa_file_ctx *fctx = file->f_security;
John Johansen637f6882017-06-09 08:14:28 -0700452 struct aa_label *label, *flabel;
John Johansenb5e95b42010-07-29 14:48:07 -0700453 int error = 0;
454
John Johansen192ca6b2017-06-09 11:58:42 -0700455 /* don't reaudit files closed during inheritance */
456 if (file->f_path.dentry == aa_null.dentry)
457 return -EACCES;
458
John Johansen637f6882017-06-09 08:14:28 -0700459 flabel = aa_cred_raw_label(file->f_cred);
460 AA_BUG(!flabel);
John Johansenb5e95b42010-07-29 14:48:07 -0700461
462 if (!file->f_path.mnt ||
John Johansenefeee832017-01-16 00:42:28 -0800463 !path_mediated_fs(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700464 return 0;
465
John Johansen637f6882017-06-09 08:14:28 -0700466 label = __begin_current_label_crit_section();
John Johansenb5e95b42010-07-29 14:48:07 -0700467
468 /* revalidate access, if task is unconfined, or the cached cred
469 * doesn't match or if the request is for more permissions than
470 * was granted.
471 *
472 * Note: the test for !unconfined(fprofile) is to handle file
473 * delegation from unconfined tasks
474 */
John Johansen637f6882017-06-09 08:14:28 -0700475 if (!unconfined(label) && !unconfined(flabel) &&
476 ((flabel != label) || (mask & ~fctx->allow)))
477 error = aa_file_perm(op, labels_profile(label), file, mask);
478 __end_current_label_crit_section(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700479
480 return error;
481}
482
483static int apparmor_file_permission(struct file *file, int mask)
484{
485 return common_file_perm(OP_FPERM, file, mask);
486}
487
488static int apparmor_file_lock(struct file *file, unsigned int cmd)
489{
490 u32 mask = AA_MAY_LOCK;
491
492 if (cmd == F_WRLCK)
493 mask |= MAY_WRITE;
494
495 return common_file_perm(OP_FLOCK, file, mask);
496}
497
John Johansen47f6e5c2017-01-16 00:43:01 -0800498static int common_mmap(const char *op, struct file *file, unsigned long prot,
John Johansenb5e95b42010-07-29 14:48:07 -0700499 unsigned long flags)
500{
John Johansenb5e95b42010-07-29 14:48:07 -0700501 int mask = 0;
502
John Johansen637f6882017-06-09 08:14:28 -0700503 if (!file || !file_ctx(file))
John Johansenb5e95b42010-07-29 14:48:07 -0700504 return 0;
505
506 if (prot & PROT_READ)
507 mask |= MAY_READ;
508 /*
509 * Private mappings don't require write perms since they don't
510 * write back to the files
511 */
512 if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
513 mask |= MAY_WRITE;
514 if (prot & PROT_EXEC)
515 mask |= AA_EXEC_MMAP;
516
John Johansenb5e95b42010-07-29 14:48:07 -0700517 return common_file_perm(op, file, mask);
518}
519
Al Viroe5467852012-05-30 13:30:51 -0400520static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
521 unsigned long prot, unsigned long flags)
John Johansenb5e95b42010-07-29 14:48:07 -0700522{
John Johansenb5e95b42010-07-29 14:48:07 -0700523 return common_mmap(OP_FMMAP, file, prot, flags);
524}
525
526static int apparmor_file_mprotect(struct vm_area_struct *vma,
527 unsigned long reqprot, unsigned long prot)
528{
529 return common_mmap(OP_FMPROT, vma->vm_file, prot,
530 !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
531}
532
533static int apparmor_getprocattr(struct task_struct *task, char *name,
534 char **value)
535{
536 int error = -ENOENT;
John Johansenb5e95b42010-07-29 14:48:07 -0700537 /* released below */
538 const struct cred *cred = get_task_cred(task);
John Johansen55a26eb2017-01-16 00:43:00 -0800539 struct aa_task_ctx *ctx = cred_ctx(cred);
John Johansen637f6882017-06-09 08:14:28 -0700540 struct aa_label *label = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -0700541
542 if (strcmp(name, "current") == 0)
John Johansen637f6882017-06-09 08:14:28 -0700543 label = aa_get_newest_label(ctx->label);
John Johansen55a26eb2017-01-16 00:43:00 -0800544 else if (strcmp(name, "prev") == 0 && ctx->previous)
John Johansen637f6882017-06-09 08:14:28 -0700545 label = aa_get_newest_label(ctx->previous);
John Johansen55a26eb2017-01-16 00:43:00 -0800546 else if (strcmp(name, "exec") == 0 && ctx->onexec)
John Johansen637f6882017-06-09 08:14:28 -0700547 label = aa_get_newest_label(ctx->onexec);
John Johansenb5e95b42010-07-29 14:48:07 -0700548 else
549 error = -EINVAL;
550
John Johansen637f6882017-06-09 08:14:28 -0700551 if (label)
John Johansen76a1d262017-06-09 12:47:17 -0700552 error = aa_getprocattr(label, value);
John Johansen77b071b2013-07-10 21:07:43 -0700553
John Johansen637f6882017-06-09 08:14:28 -0700554 aa_put_label(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700555 put_cred(cred);
556
557 return error;
558}
559
Stephen Smalleyb21507e2017-01-09 10:07:31 -0500560static int apparmor_setprocattr(const char *name, void *value,
561 size_t size)
John Johansenb5e95b42010-07-29 14:48:07 -0700562{
Vegard Nossume89b8082016-07-07 13:41:11 -0700563 char *command, *largs = NULL, *args = value;
John Johansenb5e95b42010-07-29 14:48:07 -0700564 size_t arg_size;
565 int error;
John Johansenef88a7a2017-01-16 00:43:02 -0800566 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR);
John Johansenb5e95b42010-07-29 14:48:07 -0700567
568 if (size == 0)
569 return -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700570
Vegard Nossume89b8082016-07-07 13:41:11 -0700571 /* AppArmor requires that the buffer must be null terminated atm */
572 if (args[size - 1] != '\0') {
573 /* null terminate */
574 largs = args = kmalloc(size + 1, GFP_KERNEL);
575 if (!args)
576 return -ENOMEM;
577 memcpy(args, value, size);
578 args[size] = '\0';
579 }
580
581 error = -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700582 args = strim(args);
583 command = strsep(&args, " ");
584 if (!args)
Vegard Nossume89b8082016-07-07 13:41:11 -0700585 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700586 args = skip_spaces(args);
587 if (!*args)
Vegard Nossume89b8082016-07-07 13:41:11 -0700588 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700589
John Johansend4d03f72016-07-09 23:46:33 -0700590 arg_size = size - (args - (largs ? largs : (char *) value));
John Johansenb5e95b42010-07-29 14:48:07 -0700591 if (strcmp(name, "current") == 0) {
592 if (strcmp(command, "changehat") == 0) {
593 error = aa_setprocattr_changehat(args, arg_size,
John Johansendf8073c2017-06-09 11:36:48 -0700594 AA_CHANGE_NOFLAGS);
John Johansenb5e95b42010-07-29 14:48:07 -0700595 } else if (strcmp(command, "permhat") == 0) {
596 error = aa_setprocattr_changehat(args, arg_size,
John Johansendf8073c2017-06-09 11:36:48 -0700597 AA_CHANGE_TEST);
John Johansenb5e95b42010-07-29 14:48:07 -0700598 } else if (strcmp(command, "changeprofile") == 0) {
John Johansendf8073c2017-06-09 11:36:48 -0700599 error = aa_change_profile(args, AA_CHANGE_NOFLAGS);
John Johansenb5e95b42010-07-29 14:48:07 -0700600 } else if (strcmp(command, "permprofile") == 0) {
John Johansendf8073c2017-06-09 11:36:48 -0700601 error = aa_change_profile(args, AA_CHANGE_TEST);
John Johansen3eea57c2013-02-27 03:44:40 -0800602 } else
603 goto fail;
John Johansenb5e95b42010-07-29 14:48:07 -0700604 } else if (strcmp(name, "exec") == 0) {
John Johansen3eea57c2013-02-27 03:44:40 -0800605 if (strcmp(command, "exec") == 0)
John Johansendf8073c2017-06-09 11:36:48 -0700606 error = aa_change_profile(args, AA_CHANGE_ONEXEC);
John Johansen3eea57c2013-02-27 03:44:40 -0800607 else
608 goto fail;
609 } else
John Johansenb5e95b42010-07-29 14:48:07 -0700610 /* only support the "current" and "exec" process attributes */
Vegard Nossume89b8082016-07-07 13:41:11 -0700611 goto fail;
John Johansen3eea57c2013-02-27 03:44:40 -0800612
John Johansenb5e95b42010-07-29 14:48:07 -0700613 if (!error)
614 error = size;
Vegard Nossume89b8082016-07-07 13:41:11 -0700615out:
616 kfree(largs);
John Johansenb5e95b42010-07-29 14:48:07 -0700617 return error;
John Johansen3eea57c2013-02-27 03:44:40 -0800618
619fail:
John Johansen637f6882017-06-09 08:14:28 -0700620 aad(&sa)->label = begin_current_label_crit_section();
John Johansenef88a7a2017-01-16 00:43:02 -0800621 aad(&sa)->info = name;
622 aad(&sa)->error = error = -EINVAL;
John Johansen3eea57c2013-02-27 03:44:40 -0800623 aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
John Johansen637f6882017-06-09 08:14:28 -0700624 end_current_label_crit_section(aad(&sa)->label);
Vegard Nossume89b8082016-07-07 13:41:11 -0700625 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700626}
627
John Johansenfe864822017-06-09 05:27:50 -0700628/**
629 * apparmor_bprm_committing_creds - do task cleanup on committing new creds
630 * @bprm: binprm for the exec (NOT NULL)
631 */
632static void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
633{
John Johansen637f6882017-06-09 08:14:28 -0700634 struct aa_label *label = aa_current_raw_label();
John Johansenfe864822017-06-09 05:27:50 -0700635 struct aa_task_ctx *new_ctx = cred_ctx(bprm->cred);
636
637 /* bail out if unconfined or not changing profile */
John Johansen637f6882017-06-09 08:14:28 -0700638 if ((new_ctx->label->proxy == label->proxy) ||
639 (unconfined(new_ctx->label)))
John Johansenfe864822017-06-09 05:27:50 -0700640 return;
641
John Johansen192ca6b2017-06-09 11:58:42 -0700642 aa_inherit_files(bprm->cred, current->files);
643
John Johansenfe864822017-06-09 05:27:50 -0700644 current->pdeath_signal = 0;
645
John Johansen637f6882017-06-09 08:14:28 -0700646 /* reset soft limits and set hard limits for the new label */
John Johansen86b92cb2017-06-09 14:15:20 -0700647 __aa_transition_rlimits(label, new_ctx->label);
John Johansenfe864822017-06-09 05:27:50 -0700648}
649
650/**
651 * apparmor_bprm_committed_cred - do cleanup after new creds committed
652 * @bprm: binprm for the exec (NOT NULL)
653 */
654static void apparmor_bprm_committed_creds(struct linux_binprm *bprm)
655{
656 /* TODO: cleanup signals - ipc mediation */
657 return;
658}
659
Jiri Slaby7cb4dc92010-08-11 11:28:02 +0200660static int apparmor_task_setrlimit(struct task_struct *task,
661 unsigned int resource, struct rlimit *new_rlim)
John Johansenb5e95b42010-07-29 14:48:07 -0700662{
John Johansen637f6882017-06-09 08:14:28 -0700663 struct aa_label *label = __begin_current_label_crit_section();
John Johansenb5e95b42010-07-29 14:48:07 -0700664 int error = 0;
665
John Johansen637f6882017-06-09 08:14:28 -0700666 if (!unconfined(label))
John Johansen86b92cb2017-06-09 14:15:20 -0700667 error = aa_task_setrlimit(label, task, resource, new_rlim);
John Johansen637f6882017-06-09 08:14:28 -0700668 __end_current_label_crit_section(label);
John Johansenb5e95b42010-07-29 14:48:07 -0700669
670 return error;
671}
672
James Morrisca97d932017-02-15 00:18:51 +1100673static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -0700674 LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
675 LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
676 LSM_HOOK_INIT(capget, apparmor_capget),
677 LSM_HOOK_INIT(capable, apparmor_capable),
John Johansenb5e95b42010-07-29 14:48:07 -0700678
Casey Schauflere20b0432015-05-02 15:11:36 -0700679 LSM_HOOK_INIT(path_link, apparmor_path_link),
680 LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
681 LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
682 LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
683 LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
684 LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
685 LSM_HOOK_INIT(path_rename, apparmor_path_rename),
686 LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
687 LSM_HOOK_INIT(path_chown, apparmor_path_chown),
688 LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
689 LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700690
Casey Schauflere20b0432015-05-02 15:11:36 -0700691 LSM_HOOK_INIT(file_open, apparmor_file_open),
692 LSM_HOOK_INIT(file_permission, apparmor_file_permission),
693 LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
694 LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
695 LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
Casey Schauflere20b0432015-05-02 15:11:36 -0700696 LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
697 LSM_HOOK_INIT(file_lock, apparmor_file_lock),
John Johansenb5e95b42010-07-29 14:48:07 -0700698
Casey Schauflere20b0432015-05-02 15:11:36 -0700699 LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
700 LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700701
Casey Schauflere20b0432015-05-02 15:11:36 -0700702 LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
703 LSM_HOOK_INIT(cred_free, apparmor_cred_free),
704 LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
705 LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
John Johansenb5e95b42010-07-29 14:48:07 -0700706
Casey Schauflere20b0432015-05-02 15:11:36 -0700707 LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
708 LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
709 LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
710 LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
John Johansenb5e95b42010-07-29 14:48:07 -0700711
Casey Schauflere20b0432015-05-02 15:11:36 -0700712 LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
John Johansenb5e95b42010-07-29 14:48:07 -0700713};
714
715/*
716 * AppArmor sysfs module parameters
717 */
718
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000719static int param_set_aabool(const char *val, const struct kernel_param *kp);
720static int param_get_aabool(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030721#define param_check_aabool param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930722static const struct kernel_param_ops param_ops_aabool = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930723 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000724 .set = param_set_aabool,
725 .get = param_get_aabool
726};
John Johansenb5e95b42010-07-29 14:48:07 -0700727
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000728static int param_set_aauint(const char *val, const struct kernel_param *kp);
729static int param_get_aauint(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030730#define param_check_aauint param_check_uint
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930731static const struct kernel_param_ops param_ops_aauint = {
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000732 .set = param_set_aauint,
733 .get = param_get_aauint
734};
John Johansenb5e95b42010-07-29 14:48:07 -0700735
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000736static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
737static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030738#define param_check_aalockpolicy param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930739static const struct kernel_param_ops param_ops_aalockpolicy = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930740 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000741 .set = param_set_aalockpolicy,
742 .get = param_get_aalockpolicy
743};
John Johansenb5e95b42010-07-29 14:48:07 -0700744
745static int param_set_audit(const char *val, struct kernel_param *kp);
746static int param_get_audit(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700747
748static int param_set_mode(const char *val, struct kernel_param *kp);
749static int param_get_mode(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700750
751/* Flag values, also controllable via /sys/module/apparmor/parameters
752 * We define special types as we want to do additional mediation.
753 */
754
755/* AppArmor global enforcement switch - complain, enforce, kill */
756enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
757module_param_call(mode, param_set_mode, param_get_mode,
758 &aa_g_profile_mode, S_IRUSR | S_IWUSR);
759
John Johansen6059f712014-10-24 09:16:14 -0700760/* whether policy verification hashing is enabled */
Arnd Bergmann7616ac72016-07-25 10:59:07 -0700761bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
John Johansen3ccb76c2017-01-16 13:21:27 -0800762#ifdef CONFIG_SECURITY_APPARMOR_HASH
John Johansen6059f712014-10-24 09:16:14 -0700763module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
Arnd Bergmann7616ac72016-07-25 10:59:07 -0700764#endif
John Johansen6059f712014-10-24 09:16:14 -0700765
John Johansenb5e95b42010-07-29 14:48:07 -0700766/* Debug mode */
Valentin Rothbergeea7a052017-04-06 06:55:20 -0700767bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES);
John Johansenb5e95b42010-07-29 14:48:07 -0700768module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
769
770/* Audit mode */
771enum audit_mode aa_g_audit;
772module_param_call(audit, param_set_audit, param_get_audit,
773 &aa_g_audit, S_IRUSR | S_IWUSR);
774
775/* Determines if audit header is included in audited messages. This
776 * provides more context if the audit daemon is not running
777 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030778bool aa_g_audit_header = 1;
John Johansenb5e95b42010-07-29 14:48:07 -0700779module_param_named(audit_header, aa_g_audit_header, aabool,
780 S_IRUSR | S_IWUSR);
781
782/* lock out loading/removal of policy
783 * TODO: add in at boot loading of policy, which is the only way to
784 * load policy, if lock_policy is set
785 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030786bool aa_g_lock_policy;
John Johansenb5e95b42010-07-29 14:48:07 -0700787module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
788 S_IRUSR | S_IWUSR);
789
790/* Syscall logging mode */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030791bool aa_g_logsyscall;
John Johansenb5e95b42010-07-29 14:48:07 -0700792module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
793
794/* Maximum pathname length before accesses will start getting rejected */
795unsigned int aa_g_path_max = 2 * PATH_MAX;
John Johansen622f6e32017-04-06 06:55:24 -0700796module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
John Johansenb5e95b42010-07-29 14:48:07 -0700797
798/* Determines how paranoid loading of policy is and how much verification
799 * on the loaded policy is done.
John Johansenabbf8732017-01-16 00:42:37 -0800800 * DEPRECATED: read only as strict checking of load is always done now
801 * that none root users (user namespaces) can load policy.
John Johansenb5e95b42010-07-29 14:48:07 -0700802 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030803bool aa_g_paranoid_load = 1;
John Johansenabbf8732017-01-16 00:42:37 -0800804module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
John Johansenb5e95b42010-07-29 14:48:07 -0700805
806/* Boot time disable flag */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030807static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
John Johansenc6116162013-07-10 21:03:43 -0700808module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
John Johansenb5e95b42010-07-29 14:48:07 -0700809
810static int __init apparmor_enabled_setup(char *str)
811{
812 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900813 int error = kstrtoul(str, 0, &enabled);
John Johansenb5e95b42010-07-29 14:48:07 -0700814 if (!error)
815 apparmor_enabled = enabled ? 1 : 0;
816 return 1;
817}
818
819__setup("apparmor=", apparmor_enabled_setup);
820
821/* set global flag turning off the ability to load policy */
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000822static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700823{
John Johansen545de8f2017-04-06 06:55:23 -0700824 if (!apparmor_enabled)
825 return -EINVAL;
826 if (apparmor_initialized && !policy_admin_capable(NULL))
John Johansenb5e95b42010-07-29 14:48:07 -0700827 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700828 return param_set_bool(val, kp);
829}
830
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000831static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700832{
John Johansenca4bd5a2017-01-16 00:43:11 -0800833 if (!apparmor_enabled)
834 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700835 if (apparmor_initialized && !policy_view_capable(NULL))
836 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700837 return param_get_bool(buffer, kp);
838}
839
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000840static int param_set_aabool(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700841{
John Johansenca4bd5a2017-01-16 00:43:11 -0800842 if (!apparmor_enabled)
843 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700844 if (apparmor_initialized && !policy_admin_capable(NULL))
845 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700846 return param_set_bool(val, kp);
847}
848
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000849static int param_get_aabool(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700850{
John Johansenca4bd5a2017-01-16 00:43:11 -0800851 if (!apparmor_enabled)
852 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700853 if (apparmor_initialized && !policy_view_capable(NULL))
854 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700855 return param_get_bool(buffer, kp);
856}
857
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000858static int param_set_aauint(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700859{
John Johansen39d84822017-03-30 05:25:23 -0700860 int error;
861
John Johansenca4bd5a2017-01-16 00:43:11 -0800862 if (!apparmor_enabled)
863 return -EINVAL;
John Johansen39d84822017-03-30 05:25:23 -0700864 /* file is ro but enforce 2nd line check */
865 if (apparmor_initialized)
John Johansen545de8f2017-04-06 06:55:23 -0700866 return -EPERM;
John Johansen39d84822017-03-30 05:25:23 -0700867
868 error = param_set_uint(val, kp);
869 pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max);
870
871 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700872}
873
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000874static int param_get_aauint(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700875{
John Johansenca4bd5a2017-01-16 00:43:11 -0800876 if (!apparmor_enabled)
877 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700878 if (apparmor_initialized && !policy_view_capable(NULL))
879 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700880 return param_get_uint(buffer, kp);
881}
882
883static int param_get_audit(char *buffer, struct kernel_param *kp)
884{
John Johansenb5e95b42010-07-29 14:48:07 -0700885 if (!apparmor_enabled)
886 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700887 if (apparmor_initialized && !policy_view_capable(NULL))
888 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700889 return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
890}
891
892static int param_set_audit(const char *val, struct kernel_param *kp)
893{
894 int i;
John Johansenb5e95b42010-07-29 14:48:07 -0700895
896 if (!apparmor_enabled)
897 return -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700898 if (!val)
899 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700900 if (apparmor_initialized && !policy_admin_capable(NULL))
901 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700902
903 for (i = 0; i < AUDIT_MAX_INDEX; i++) {
904 if (strcmp(val, audit_mode_names[i]) == 0) {
905 aa_g_audit = i;
906 return 0;
907 }
908 }
909
910 return -EINVAL;
911}
912
913static int param_get_mode(char *buffer, struct kernel_param *kp)
914{
John Johansenb5e95b42010-07-29 14:48:07 -0700915 if (!apparmor_enabled)
916 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700917 if (apparmor_initialized && !policy_view_capable(NULL))
918 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700919
John Johansen0d259f02013-07-10 21:13:43 -0700920 return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
John Johansenb5e95b42010-07-29 14:48:07 -0700921}
922
923static int param_set_mode(const char *val, struct kernel_param *kp)
924{
925 int i;
John Johansenb5e95b42010-07-29 14:48:07 -0700926
927 if (!apparmor_enabled)
928 return -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700929 if (!val)
930 return -EINVAL;
John Johansen545de8f2017-04-06 06:55:23 -0700931 if (apparmor_initialized && !policy_admin_capable(NULL))
932 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700933
John Johansen0d259f02013-07-10 21:13:43 -0700934 for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) {
935 if (strcmp(val, aa_profile_mode_names[i]) == 0) {
John Johansenb5e95b42010-07-29 14:48:07 -0700936 aa_g_profile_mode = i;
937 return 0;
938 }
939 }
940
941 return -EINVAL;
942}
943
944/*
945 * AppArmor init functions
946 */
947
948/**
John Johansen55a26eb2017-01-16 00:43:00 -0800949 * set_init_ctx - set a task context and profile on the first task.
John Johansenb5e95b42010-07-29 14:48:07 -0700950 *
951 * TODO: allow setting an alternate profile than unconfined
952 */
John Johansen55a26eb2017-01-16 00:43:00 -0800953static int __init set_init_ctx(void)
John Johansenb5e95b42010-07-29 14:48:07 -0700954{
955 struct cred *cred = (struct cred *)current->real_cred;
John Johansen55a26eb2017-01-16 00:43:00 -0800956 struct aa_task_ctx *ctx;
John Johansenb5e95b42010-07-29 14:48:07 -0700957
John Johansen55a26eb2017-01-16 00:43:00 -0800958 ctx = aa_alloc_task_context(GFP_KERNEL);
959 if (!ctx)
John Johansenb5e95b42010-07-29 14:48:07 -0700960 return -ENOMEM;
961
John Johansen637f6882017-06-09 08:14:28 -0700962 ctx->label = aa_get_label(ns_unconfined(root_ns));
John Johansen55a26eb2017-01-16 00:43:00 -0800963 cred_ctx(cred) = ctx;
John Johansenb5e95b42010-07-29 14:48:07 -0700964
965 return 0;
966}
967
John Johansend4669f02017-01-16 00:43:10 -0800968static void destroy_buffers(void)
969{
970 u32 i, j;
971
972 for_each_possible_cpu(i) {
973 for_each_cpu_buffer(j) {
974 kfree(per_cpu(aa_buffers, i).buf[j]);
975 per_cpu(aa_buffers, i).buf[j] = NULL;
976 }
977 }
978}
979
980static int __init alloc_buffers(void)
981{
982 u32 i, j;
983
984 for_each_possible_cpu(i) {
985 for_each_cpu_buffer(j) {
986 char *buffer;
987
988 if (cpu_to_node(i) > num_online_nodes())
989 /* fallback to kmalloc for offline nodes */
990 buffer = kmalloc(aa_g_path_max, GFP_KERNEL);
991 else
992 buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL,
993 cpu_to_node(i));
994 if (!buffer) {
995 destroy_buffers();
996 return -ENOMEM;
997 }
998 per_cpu(aa_buffers, i).buf[j] = buffer;
999 }
1000 }
1001
1002 return 0;
1003}
1004
Tyler Hickse3ea1ca2016-03-16 19:19:10 -05001005#ifdef CONFIG_SYSCTL
1006static int apparmor_dointvec(struct ctl_table *table, int write,
1007 void __user *buffer, size_t *lenp, loff_t *ppos)
1008{
1009 if (!policy_admin_capable(NULL))
1010 return -EPERM;
1011 if (!apparmor_enabled)
1012 return -EINVAL;
1013
1014 return proc_dointvec(table, write, buffer, lenp, ppos);
1015}
1016
1017static struct ctl_path apparmor_sysctl_path[] = {
1018 { .procname = "kernel", },
1019 { }
1020};
1021
1022static struct ctl_table apparmor_sysctl_table[] = {
1023 {
1024 .procname = "unprivileged_userns_apparmor_policy",
1025 .data = &unprivileged_userns_apparmor_policy,
1026 .maxlen = sizeof(int),
1027 .mode = 0600,
1028 .proc_handler = apparmor_dointvec,
1029 },
1030 { }
1031};
1032
1033static int __init apparmor_init_sysctl(void)
1034{
1035 return register_sysctl_paths(apparmor_sysctl_path,
1036 apparmor_sysctl_table) ? 0 : -ENOMEM;
1037}
1038#else
1039static inline int apparmor_init_sysctl(void)
1040{
1041 return 0;
1042}
1043#endif /* CONFIG_SYSCTL */
1044
John Johansenb5e95b42010-07-29 14:48:07 -07001045static int __init apparmor_init(void)
1046{
1047 int error;
1048
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07001049 if (!apparmor_enabled || !security_module_enable("apparmor")) {
John Johansenb5e95b42010-07-29 14:48:07 -07001050 aa_info_message("AppArmor disabled by boot time parameter");
1051 apparmor_enabled = 0;
1052 return 0;
1053 }
1054
John Johansen11c236b2017-01-16 00:42:42 -08001055 error = aa_setup_dfa_engine();
1056 if (error) {
1057 AA_ERROR("Unable to setup dfa engine\n");
1058 goto alloc_out;
1059 }
1060
John Johansenb5e95b42010-07-29 14:48:07 -07001061 error = aa_alloc_root_ns();
1062 if (error) {
1063 AA_ERROR("Unable to allocate default profile namespace\n");
1064 goto alloc_out;
1065 }
1066
Tyler Hickse3ea1ca2016-03-16 19:19:10 -05001067 error = apparmor_init_sysctl();
1068 if (error) {
1069 AA_ERROR("Unable to register sysctls\n");
1070 goto alloc_out;
1071
1072 }
1073
John Johansend4669f02017-01-16 00:43:10 -08001074 error = alloc_buffers();
1075 if (error) {
1076 AA_ERROR("Unable to allocate work buffers\n");
1077 goto buffers_out;
1078 }
1079
John Johansen55a26eb2017-01-16 00:43:00 -08001080 error = set_init_ctx();
John Johansenb5e95b42010-07-29 14:48:07 -07001081 if (error) {
1082 AA_ERROR("Failed to set context on init task\n");
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07001083 aa_free_root_ns();
John Johansend4669f02017-01-16 00:43:10 -08001084 goto buffers_out;
John Johansenb5e95b42010-07-29 14:48:07 -07001085 }
Casey Schauflerd69dece2017-01-18 17:09:05 -08001086 security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
1087 "apparmor");
John Johansenb5e95b42010-07-29 14:48:07 -07001088
1089 /* Report that AppArmor successfully initialized */
1090 apparmor_initialized = 1;
1091 if (aa_g_profile_mode == APPARMOR_COMPLAIN)
1092 aa_info_message("AppArmor initialized: complain mode enabled");
1093 else if (aa_g_profile_mode == APPARMOR_KILL)
1094 aa_info_message("AppArmor initialized: kill mode enabled");
1095 else
1096 aa_info_message("AppArmor initialized");
1097
1098 return error;
1099
John Johansend4669f02017-01-16 00:43:10 -08001100buffers_out:
1101 destroy_buffers();
1102
John Johansenb5e95b42010-07-29 14:48:07 -07001103alloc_out:
1104 aa_destroy_aafs();
John Johansen11c236b2017-01-16 00:42:42 -08001105 aa_teardown_dfa_engine();
John Johansenb5e95b42010-07-29 14:48:07 -07001106
1107 apparmor_enabled = 0;
1108 return error;
John Johansenb5e95b42010-07-29 14:48:07 -07001109}
1110
1111security_initcall(apparmor_init);