John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1 | /* |
| 2 | * AppArmor security module |
| 3 | * |
| 4 | * This file contains AppArmor policy manipulation functions |
| 5 | * |
| 6 | * Copyright (C) 1998-2008 Novell/SUSE |
| 7 | * Copyright 2009-2010 Canonical Ltd. |
| 8 | * |
| 9 | * This program is free software; you can redistribute it and/or |
| 10 | * modify it under the terms of the GNU General Public License as |
| 11 | * published by the Free Software Foundation, version 2 of the |
| 12 | * License. |
| 13 | * |
| 14 | * |
| 15 | * AppArmor policy is based around profiles, which contain the rules a |
| 16 | * task is confined by. Every task in the system has a profile attached |
| 17 | * to it determined either by matching "unconfined" tasks against the |
| 18 | * visible set of profiles or by following a profiles attachment rules. |
| 19 | * |
| 20 | * Each profile exists in a profile namespace which is a container of |
| 21 | * visible profiles. Each namespace contains a special "unconfined" profile, |
| 22 | * which doesn't enforce any confinement on a task beyond DAC. |
| 23 | * |
| 24 | * Namespace and profile names can be written together in either |
| 25 | * of two syntaxes. |
| 26 | * :namespace:profile - used by kernel interfaces for easy detection |
| 27 | * namespace://profile - used by policy |
| 28 | * |
| 29 | * Profile names can not start with : or @ or ^ and may not contain \0 |
| 30 | * |
| 31 | * Reserved profile names |
| 32 | * unconfined - special automatically generated unconfined profile |
| 33 | * inherit - special name to indicate profile inheritance |
| 34 | * null-XXXX-YYYY - special automatically generated learning profiles |
| 35 | * |
| 36 | * Namespace names may not start with / or @ and may not contain \0 or : |
| 37 | * Reserved namespace names |
| 38 | * user-XXXX - user defined profiles |
| 39 | * |
| 40 | * a // in a profile or namespace name indicates a hierarchical name with the |
| 41 | * name before the // being the parent and the name after the child. |
| 42 | * |
| 43 | * Profile and namespace hierarchies serve two different but similar purposes. |
| 44 | * The namespace contains the set of visible profiles that are considered |
| 45 | * for attachment. The hierarchy of namespaces allows for virtualizing |
| 46 | * the namespace so that for example a chroot can have its own set of profiles |
| 47 | * which may define some local user namespaces. |
| 48 | * The profile hierarchy severs two distinct purposes, |
| 49 | * - it allows for sub profiles or hats, which allows an application to run |
| 50 | * subprograms under its own profile with different restriction than it |
| 51 | * self, and not have it use the system profile. |
| 52 | * eg. if a mail program starts an editor, the policy might make the |
| 53 | * restrictions tighter on the editor tighter than the mail program, |
| 54 | * and definitely different than general editor restrictions |
| 55 | * - it allows for binary hierarchy of profiles, so that execution history |
| 56 | * is preserved. This feature isn't exploited by AppArmor reference policy |
| 57 | * but is allowed. NOTE: this is currently suboptimal because profile |
| 58 | * aliasing is not currently implemented so that a profile for each |
| 59 | * level must be defined. |
| 60 | * eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started |
| 61 | * from /bin/bash |
| 62 | * |
| 63 | * A profile or namespace name that can contain one or more // separators |
| 64 | * is referred to as an hname (hierarchical). |
| 65 | * eg. /bin/bash//bin/ls |
| 66 | * |
| 67 | * An fqname is a name that may contain both namespace and profile hnames. |
| 68 | * eg. :ns:/bin/bash//bin/ls |
| 69 | * |
| 70 | * NOTES: |
| 71 | * - locking of profile lists is currently fairly coarse. All profile |
| 72 | * lists within a namespace use the namespace lock. |
| 73 | * FIXME: move profile lists to using rcu_lists |
| 74 | */ |
| 75 | |
| 76 | #include <linux/slab.h> |
| 77 | #include <linux/spinlock.h> |
| 78 | #include <linux/string.h> |
Ingo Molnar | 5b825c3 | 2017-02-02 17:54:15 +0100 | [diff] [blame] | 79 | #include <linux/cred.h> |
Ingo Molnar | b2d0910 | 2017-02-04 01:27:20 +0100 | [diff] [blame] | 80 | #include <linux/rculist.h> |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 81 | #include <linux/user_namespace.h> |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 82 | |
| 83 | #include "include/apparmor.h" |
| 84 | #include "include/capability.h" |
| 85 | #include "include/context.h" |
| 86 | #include "include/file.h" |
| 87 | #include "include/ipc.h" |
| 88 | #include "include/match.h" |
| 89 | #include "include/path.h" |
| 90 | #include "include/policy.h" |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 91 | #include "include/policy_ns.h" |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 92 | #include "include/policy_unpack.h" |
| 93 | #include "include/resource.h" |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 94 | |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 95 | int unprivileged_userns_apparmor_policy = 1; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 96 | |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 97 | const char *const aa_profile_mode_names[] = { |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 98 | "enforce", |
| 99 | "complain", |
| 100 | "kill", |
John Johansen | 0381650 | 2013-07-10 21:12:43 -0700 | [diff] [blame] | 101 | "unconfined", |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 102 | }; |
| 103 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 104 | |
| 105 | /** |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 106 | * __add_profile - add a profiles to list and label tree |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 107 | * @list: list to add it to (NOT NULL) |
| 108 | * @profile: the profile to add (NOT NULL) |
| 109 | * |
| 110 | * refcount @profile, should be put by __list_remove_profile |
| 111 | * |
| 112 | * Requires: namespace lock be held, or list not be shared |
| 113 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 114 | static void __add_profile(struct list_head *list, struct aa_profile *profile) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 115 | { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 116 | struct aa_label *l; |
| 117 | |
| 118 | AA_BUG(!list); |
| 119 | AA_BUG(!profile); |
| 120 | AA_BUG(!profile->ns); |
| 121 | AA_BUG(!mutex_is_locked(&profile->ns->lock)); |
| 122 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 123 | list_add_rcu(&profile->base.list, list); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 124 | /* get list reference */ |
| 125 | aa_get_profile(profile); |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 126 | l = aa_label_insert(&profile->ns->labels, &profile->label); |
| 127 | AA_BUG(l != &profile->label); |
| 128 | aa_put_label(l); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 129 | } |
| 130 | |
| 131 | /** |
| 132 | * __list_remove_profile - remove a profile from the list it is on |
| 133 | * @profile: the profile to remove (NOT NULL) |
| 134 | * |
| 135 | * remove a profile from the list, warning generally removal should |
| 136 | * be done with __replace_profile as most profile removals are |
| 137 | * replacements to the unconfined profile. |
| 138 | * |
| 139 | * put @profile list refcount |
| 140 | * |
| 141 | * Requires: namespace lock be held, or list not have been live |
| 142 | */ |
| 143 | static void __list_remove_profile(struct aa_profile *profile) |
| 144 | { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 145 | AA_BUG(!profile); |
| 146 | AA_BUG(!profile->ns); |
| 147 | AA_BUG(!mutex_is_locked(&profile->ns->lock)); |
| 148 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 149 | list_del_rcu(&profile->base.list); |
| 150 | aa_put_profile(profile); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 151 | } |
| 152 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 153 | /** |
| 154 | * __remove_profile - remove old profile, and children |
| 155 | * @profile: profile to be replaced (NOT NULL) |
| 156 | * |
| 157 | * Requires: namespace list lock be held, or list not be shared |
| 158 | */ |
| 159 | static void __remove_profile(struct aa_profile *profile) |
| 160 | { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 161 | AA_BUG(!profile); |
| 162 | AA_BUG(!profile->ns); |
| 163 | AA_BUG(!mutex_is_locked(&profile->ns->lock)); |
| 164 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 165 | /* release any children lists first */ |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 166 | __aa_profile_list_release(&profile->base.profiles); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 167 | /* released by free_profile */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 168 | aa_label_remove(&profile->label); |
John Johansen | c97204b | 2017-05-25 06:23:42 -0700 | [diff] [blame] | 169 | __aafs_profile_rmdir(profile); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 170 | __list_remove_profile(profile); |
| 171 | } |
| 172 | |
| 173 | /** |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 174 | * __aa_profile_list_release - remove all profiles on the list and put refs |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 175 | * @head: list of profiles (NOT NULL) |
| 176 | * |
| 177 | * Requires: namespace lock be held |
| 178 | */ |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 179 | void __aa_profile_list_release(struct list_head *head) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 180 | { |
| 181 | struct aa_profile *profile, *tmp; |
| 182 | list_for_each_entry_safe(profile, tmp, head, base.list) |
| 183 | __remove_profile(profile); |
| 184 | } |
| 185 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 186 | /** |
William Hua | e025be0 | 2017-01-15 16:49:28 -0800 | [diff] [blame] | 187 | * aa_free_data - free a data blob |
| 188 | * @ptr: data to free |
| 189 | * @arg: unused |
| 190 | */ |
| 191 | static void aa_free_data(void *ptr, void *arg) |
| 192 | { |
| 193 | struct aa_data *data = ptr; |
| 194 | |
| 195 | kzfree(data->data); |
| 196 | kzfree(data->key); |
| 197 | kzfree(data); |
| 198 | } |
| 199 | |
| 200 | /** |
John Johansen | 8651e1d6 | 2013-07-10 21:11:43 -0700 | [diff] [blame] | 201 | * aa_free_profile - free a profile |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 202 | * @profile: the profile to free (MAYBE NULL) |
| 203 | * |
| 204 | * Free a profile, its hats and null_profile. All references to the profile, |
| 205 | * its hats and null_profile must have been put. |
| 206 | * |
| 207 | * If the profile was referenced from a task context, free_profile() will |
| 208 | * be called from an rcu callback routine, so we must not sleep here. |
| 209 | */ |
John Johansen | 8651e1d6 | 2013-07-10 21:11:43 -0700 | [diff] [blame] | 210 | void aa_free_profile(struct aa_profile *profile) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 211 | { |
William Hua | e025be0 | 2017-01-15 16:49:28 -0800 | [diff] [blame] | 212 | struct rhashtable *rht; |
| 213 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 214 | AA_DEBUG("%s(%p)\n", __func__, profile); |
| 215 | |
| 216 | if (!profile) |
| 217 | return; |
| 218 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 219 | /* free children profiles */ |
John Johansen | fe6bb31 | 2017-01-16 00:42:14 -0800 | [diff] [blame] | 220 | aa_policy_destroy(&profile->base); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 221 | aa_put_profile(rcu_access_pointer(profile->parent)); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 222 | |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 223 | aa_put_ns(profile->ns); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 224 | kzfree(profile->rename); |
| 225 | |
| 226 | aa_free_file_rules(&profile->file); |
| 227 | aa_free_cap_rules(&profile->caps); |
| 228 | aa_free_rlimit_rules(&profile->rlimits); |
| 229 | |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 230 | kzfree(profile->dirname); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 231 | aa_put_dfa(profile->xmatch); |
John Johansen | ad5ff3d | 2012-02-16 07:07:53 -0800 | [diff] [blame] | 232 | aa_put_dfa(profile->policy.dfa); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 233 | |
William Hua | e025be0 | 2017-01-15 16:49:28 -0800 | [diff] [blame] | 234 | if (profile->data) { |
| 235 | rht = profile->data; |
| 236 | profile->data = NULL; |
| 237 | rhashtable_free_and_destroy(rht, aa_free_data, NULL); |
| 238 | kzfree(rht); |
| 239 | } |
| 240 | |
John Johansen | 5cb3e91 | 2013-10-14 11:44:34 -0700 | [diff] [blame] | 241 | kzfree(profile->hash); |
John Johansen | 5ac8c35 | 2017-01-16 00:42:55 -0800 | [diff] [blame] | 242 | aa_put_loaddata(profile->rawdata); |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 243 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 244 | kzfree(profile); |
| 245 | } |
| 246 | |
| 247 | /** |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 248 | * aa_alloc_profile - allocate, initialize and return a new profile |
| 249 | * @hname: name of the profile (NOT NULL) |
John Johansen | 30b026a | 2017-01-16 00:42:35 -0800 | [diff] [blame] | 250 | * @gfp: allocation type |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 251 | * |
| 252 | * Returns: refcount profile or NULL on failure |
| 253 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 254 | struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy, |
| 255 | gfp_t gfp) |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 256 | { |
| 257 | struct aa_profile *profile; |
| 258 | |
| 259 | /* freed by free_profile - usually through aa_put_profile */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 260 | profile = kzalloc(sizeof(*profile) + sizeof(struct aa_profile *) * 2, |
| 261 | gfp); |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 262 | if (!profile) |
| 263 | return NULL; |
| 264 | |
John Johansen | 30b026a | 2017-01-16 00:42:35 -0800 | [diff] [blame] | 265 | if (!aa_policy_init(&profile->base, NULL, hname, gfp)) |
John Johansen | 77b071b | 2013-07-10 21:07:43 -0700 | [diff] [blame] | 266 | goto fail; |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 267 | if (!aa_label_init(&profile->label, 1)) |
| 268 | goto fail; |
| 269 | |
| 270 | /* update being set needed by fs interface */ |
| 271 | if (!proxy) { |
| 272 | proxy = aa_alloc_proxy(&profile->label, gfp); |
| 273 | if (!proxy) |
| 274 | goto fail; |
| 275 | } else |
| 276 | aa_get_proxy(proxy); |
| 277 | profile->label.proxy = proxy; |
| 278 | |
| 279 | profile->label.hname = profile->base.hname; |
| 280 | profile->label.flags |= FLAG_PROFILE; |
| 281 | profile->label.vec[0] = profile; |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 282 | |
| 283 | /* refcount released by caller */ |
| 284 | return profile; |
John Johansen | 77b071b | 2013-07-10 21:07:43 -0700 | [diff] [blame] | 285 | |
| 286 | fail: |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 287 | aa_free_profile(profile); |
John Johansen | 77b071b | 2013-07-10 21:07:43 -0700 | [diff] [blame] | 288 | |
| 289 | return NULL; |
John Johansen | 4da05cc | 2013-02-18 16:11:34 -0800 | [diff] [blame] | 290 | } |
| 291 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 292 | /* TODO: profile accounting - setup in remove */ |
| 293 | |
| 294 | /** |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 295 | * __strn_find_child - find a profile on @head list using substring of @name |
| 296 | * @head: list to search (NOT NULL) |
| 297 | * @name: name of profile (NOT NULL) |
| 298 | * @len: length of @name substring to match |
| 299 | * |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 300 | * Requires: rcu_read_lock be held |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 301 | * |
| 302 | * Returns: unrefcounted profile ptr, or NULL if not found |
| 303 | */ |
| 304 | static struct aa_profile *__strn_find_child(struct list_head *head, |
| 305 | const char *name, int len) |
| 306 | { |
| 307 | return (struct aa_profile *)__policy_strn_find(head, name, len); |
| 308 | } |
| 309 | |
| 310 | /** |
John Johansen | ae3b316 | 2017-06-02 13:50:22 -0700 | [diff] [blame] | 311 | * __find_child - find a profile on @head list with a name matching @name |
| 312 | * @head: list to search (NOT NULL) |
| 313 | * @name: name of profile (NOT NULL) |
| 314 | * |
| 315 | * Requires: rcu_read_lock be held |
| 316 | * |
| 317 | * Returns: unrefcounted profile ptr, or NULL if not found |
| 318 | */ |
| 319 | static struct aa_profile *__find_child(struct list_head *head, const char *name) |
| 320 | { |
| 321 | return __strn_find_child(head, name, strlen(name)); |
| 322 | } |
| 323 | |
| 324 | /** |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 325 | * aa_find_child - find a profile by @name in @parent |
| 326 | * @parent: profile to search (NOT NULL) |
| 327 | * @name: profile name to search for (NOT NULL) |
| 328 | * |
| 329 | * Returns: a refcounted profile or NULL if not found |
| 330 | */ |
| 331 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name) |
| 332 | { |
| 333 | struct aa_profile *profile; |
| 334 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 335 | rcu_read_lock(); |
John Johansen | de7c4cc | 2015-12-16 18:09:10 -0800 | [diff] [blame] | 336 | do { |
| 337 | profile = __find_child(&parent->base.profiles, name); |
| 338 | } while (profile && !aa_get_profile_not0(profile)); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 339 | rcu_read_unlock(); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 340 | |
| 341 | /* refcount released by caller */ |
| 342 | return profile; |
| 343 | } |
| 344 | |
| 345 | /** |
| 346 | * __lookup_parent - lookup the parent of a profile of name @hname |
| 347 | * @ns: namespace to lookup profile in (NOT NULL) |
| 348 | * @hname: hierarchical profile name to find parent of (NOT NULL) |
| 349 | * |
| 350 | * Lookups up the parent of a fully qualified profile name, the profile |
| 351 | * that matches hname does not need to exist, in general this |
| 352 | * is used to load a new profile. |
| 353 | * |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 354 | * Requires: rcu_read_lock be held |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 355 | * |
| 356 | * Returns: unrefcounted policy or NULL if not found |
| 357 | */ |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 358 | static struct aa_policy *__lookup_parent(struct aa_ns *ns, |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 359 | const char *hname) |
| 360 | { |
| 361 | struct aa_policy *policy; |
| 362 | struct aa_profile *profile = NULL; |
| 363 | char *split; |
| 364 | |
| 365 | policy = &ns->base; |
| 366 | |
| 367 | for (split = strstr(hname, "//"); split;) { |
| 368 | profile = __strn_find_child(&policy->profiles, hname, |
| 369 | split - hname); |
| 370 | if (!profile) |
| 371 | return NULL; |
| 372 | policy = &profile->base; |
| 373 | hname = split + 2; |
| 374 | split = strstr(hname, "//"); |
| 375 | } |
| 376 | if (!profile) |
| 377 | return &ns->base; |
| 378 | return &profile->base; |
| 379 | } |
| 380 | |
| 381 | /** |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 382 | * __lookupn_profile - lookup the profile matching @hname |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 383 | * @base: base list to start looking up profile name from (NOT NULL) |
| 384 | * @hname: hierarchical profile name (NOT NULL) |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 385 | * @n: length of @hname |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 386 | * |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 387 | * Requires: rcu_read_lock be held |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 388 | * |
| 389 | * Returns: unrefcounted profile pointer or NULL if not found |
| 390 | * |
| 391 | * Do a relative name lookup, recursing through profile tree. |
| 392 | */ |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 393 | static struct aa_profile *__lookupn_profile(struct aa_policy *base, |
| 394 | const char *hname, size_t n) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 395 | { |
| 396 | struct aa_profile *profile = NULL; |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 397 | const char *split; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 398 | |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 399 | for (split = strnstr(hname, "//", n); split; |
| 400 | split = strnstr(hname, "//", n)) { |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 401 | profile = __strn_find_child(&base->profiles, hname, |
| 402 | split - hname); |
| 403 | if (!profile) |
| 404 | return NULL; |
| 405 | |
| 406 | base = &profile->base; |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 407 | n -= split + 2 - hname; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 408 | hname = split + 2; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 409 | } |
| 410 | |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 411 | if (n) |
| 412 | return __strn_find_child(&base->profiles, hname, n); |
| 413 | return NULL; |
| 414 | } |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 415 | |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 416 | static struct aa_profile *__lookup_profile(struct aa_policy *base, |
| 417 | const char *hname) |
| 418 | { |
| 419 | return __lookupn_profile(base, hname, strlen(hname)); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 420 | } |
| 421 | |
| 422 | /** |
| 423 | * aa_lookup_profile - find a profile by its full or partial name |
| 424 | * @ns: the namespace to start from (NOT NULL) |
| 425 | * @hname: name to do lookup on. Does not contain namespace prefix (NOT NULL) |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 426 | * @n: size of @hname |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 427 | * |
| 428 | * Returns: refcounted profile or NULL if not found |
| 429 | */ |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 430 | struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname, |
| 431 | size_t n) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 432 | { |
| 433 | struct aa_profile *profile; |
| 434 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 435 | rcu_read_lock(); |
| 436 | do { |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 437 | profile = __lookupn_profile(&ns->base, hname, n); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 438 | } while (profile && !aa_get_profile_not0(profile)); |
| 439 | rcu_read_unlock(); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 440 | |
John Johansen | bf83208 | 2012-05-16 11:00:05 -0700 | [diff] [blame] | 441 | /* the unconfined profile is not in the regular profile list */ |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 442 | if (!profile && strncmp(hname, "unconfined", n) == 0) |
John Johansen | fa2ac46 | 2013-07-10 21:08:43 -0700 | [diff] [blame] | 443 | profile = aa_get_newest_profile(ns->unconfined); |
John Johansen | bf83208 | 2012-05-16 11:00:05 -0700 | [diff] [blame] | 444 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 445 | /* refcount released by caller */ |
| 446 | return profile; |
| 447 | } |
| 448 | |
John Johansen | 1741e9e | 2017-01-16 00:42:21 -0800 | [diff] [blame] | 449 | struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *hname) |
| 450 | { |
| 451 | return aa_lookupn_profile(ns, hname, strlen(hname)); |
| 452 | } |
John Johansen | 31617dd | 2017-01-16 00:42:24 -0800 | [diff] [blame] | 453 | |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 454 | struct aa_profile *aa_fqlookupn_profile(struct aa_label *base, |
John Johansen | 31617dd | 2017-01-16 00:42:24 -0800 | [diff] [blame] | 455 | const char *fqname, size_t n) |
| 456 | { |
| 457 | struct aa_profile *profile; |
| 458 | struct aa_ns *ns; |
| 459 | const char *name, *ns_name; |
| 460 | size_t ns_len; |
| 461 | |
| 462 | name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len); |
| 463 | if (ns_name) { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 464 | ns = aa_lookupn_ns(labels_ns(base), ns_name, ns_len); |
John Johansen | 31617dd | 2017-01-16 00:42:24 -0800 | [diff] [blame] | 465 | if (!ns) |
| 466 | return NULL; |
| 467 | } else |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 468 | ns = aa_get_ns(labels_ns(base)); |
John Johansen | 31617dd | 2017-01-16 00:42:24 -0800 | [diff] [blame] | 469 | |
| 470 | if (name) |
| 471 | profile = aa_lookupn_profile(ns, name, n - (name - fqname)); |
| 472 | else if (ns) |
| 473 | /* default profile for ns, currently unconfined */ |
| 474 | profile = aa_get_newest_profile(ns->unconfined); |
| 475 | else |
| 476 | profile = NULL; |
| 477 | aa_put_ns(ns); |
| 478 | |
| 479 | return profile; |
| 480 | } |
| 481 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 482 | /** |
John Johansen | d07881d | 2017-08-16 08:59:57 -0700 | [diff] [blame] | 483 | * aa_new_null_profile - create or find a null-X learning profile |
| 484 | * @parent: profile that caused this profile to be created (NOT NULL) |
| 485 | * @hat: true if the null- learning profile is a hat |
| 486 | * @base: name to base the null profile off of |
| 487 | * @gfp: type of allocation |
| 488 | * |
| 489 | * Find/Create a null- complain mode profile used in learning mode. The |
| 490 | * name of the profile is unique and follows the format of parent//null-XXX. |
| 491 | * where XXX is based on the @name or if that fails or is not supplied |
| 492 | * a unique number |
| 493 | * |
| 494 | * null profiles are added to the profile list but the list does not |
| 495 | * hold a count on them so that they are automatically released when |
| 496 | * not in use. |
| 497 | * |
| 498 | * Returns: new refcounted profile else NULL on failure |
| 499 | */ |
| 500 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat, |
| 501 | const char *base, gfp_t gfp) |
| 502 | { |
John Johansen | 290638a | 2017-08-16 05:40:49 -0700 | [diff] [blame] | 503 | struct aa_profile *p, *profile; |
| 504 | const char *bname; |
John Johansen | d07881d | 2017-08-16 08:59:57 -0700 | [diff] [blame] | 505 | char *name; |
| 506 | |
| 507 | AA_BUG(!parent); |
| 508 | |
| 509 | if (base) { |
| 510 | name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base), |
| 511 | gfp); |
| 512 | if (name) { |
| 513 | sprintf(name, "%s//null-%s", parent->base.hname, base); |
| 514 | goto name; |
| 515 | } |
| 516 | /* fall through to try shorter uniq */ |
| 517 | } |
| 518 | |
| 519 | name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp); |
| 520 | if (!name) |
| 521 | return NULL; |
| 522 | sprintf(name, "%s//null-%x", parent->base.hname, |
| 523 | atomic_inc_return(&parent->ns->uniq_null)); |
| 524 | |
| 525 | name: |
| 526 | /* lookup to see if this is a dup creation */ |
John Johansen | 290638a | 2017-08-16 05:40:49 -0700 | [diff] [blame] | 527 | bname = basename(name); |
| 528 | profile = aa_find_child(parent, bname); |
John Johansen | d07881d | 2017-08-16 08:59:57 -0700 | [diff] [blame] | 529 | if (profile) |
| 530 | goto out; |
| 531 | |
| 532 | profile = aa_alloc_profile(name, NULL, gfp); |
| 533 | if (!profile) |
| 534 | goto fail; |
| 535 | |
| 536 | profile->mode = APPARMOR_COMPLAIN; |
| 537 | profile->label.flags |= FLAG_NULL; |
| 538 | if (hat) |
| 539 | profile->label.flags |= FLAG_HAT; |
| 540 | profile->path_flags = parent->path_flags; |
| 541 | |
| 542 | /* released on free_profile */ |
| 543 | rcu_assign_pointer(profile->parent, aa_get_profile(parent)); |
| 544 | profile->ns = aa_get_ns(parent->ns); |
| 545 | profile->file.dfa = aa_get_dfa(nulldfa); |
| 546 | profile->policy.dfa = aa_get_dfa(nulldfa); |
| 547 | |
| 548 | mutex_lock(&profile->ns->lock); |
John Johansen | 290638a | 2017-08-16 05:40:49 -0700 | [diff] [blame] | 549 | p = __find_child(&parent->base.profiles, bname); |
| 550 | if (p) { |
| 551 | aa_free_profile(profile); |
| 552 | profile = aa_get_profile(p); |
| 553 | } else { |
| 554 | __add_profile(&parent->base.profiles, profile); |
| 555 | } |
John Johansen | d07881d | 2017-08-16 08:59:57 -0700 | [diff] [blame] | 556 | mutex_unlock(&profile->ns->lock); |
| 557 | |
| 558 | /* refcount released by caller */ |
| 559 | out: |
| 560 | kfree(name); |
| 561 | |
| 562 | return profile; |
| 563 | |
| 564 | fail: |
| 565 | aa_free_profile(profile); |
| 566 | return NULL; |
| 567 | } |
| 568 | |
| 569 | /** |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 570 | * replacement_allowed - test to see if replacement is allowed |
| 571 | * @profile: profile to test if it can be replaced (MAYBE NULL) |
| 572 | * @noreplace: true if replacement shouldn't be allowed but addition is okay |
| 573 | * @info: Returns - info about why replacement failed (NOT NULL) |
| 574 | * |
| 575 | * Returns: %0 if replacement allowed else error code |
| 576 | */ |
| 577 | static int replacement_allowed(struct aa_profile *profile, int noreplace, |
| 578 | const char **info) |
| 579 | { |
| 580 | if (profile) { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 581 | if (profile->label.flags & FLAG_IMMUTIBLE) { |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 582 | *info = "cannot replace immutible profile"; |
| 583 | return -EPERM; |
| 584 | } else if (noreplace) { |
| 585 | *info = "profile already exists"; |
| 586 | return -EEXIST; |
| 587 | } |
| 588 | } |
| 589 | return 0; |
| 590 | } |
| 591 | |
John Johansen | fc1c9fd | 2017-01-16 00:42:54 -0800 | [diff] [blame] | 592 | /* audit callback for net specific fields */ |
| 593 | static void audit_cb(struct audit_buffer *ab, void *va) |
| 594 | { |
| 595 | struct common_audit_data *sa = va; |
| 596 | |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 597 | if (aad(sa)->iface.ns) { |
John Johansen | fc1c9fd | 2017-01-16 00:42:54 -0800 | [diff] [blame] | 598 | audit_log_format(ab, " ns="); |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 599 | audit_log_untrustedstring(ab, aad(sa)->iface.ns); |
John Johansen | fc1c9fd | 2017-01-16 00:42:54 -0800 | [diff] [blame] | 600 | } |
| 601 | } |
| 602 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 603 | /** |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 604 | * audit_policy - Do auditing of policy changes |
| 605 | * @label: label to check if it can manage policy |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 606 | * @op: policy operation being performed |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 607 | * @ns_name: name of namespace being manipulated |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 608 | * @name: name of profile being manipulated (NOT NULL) |
| 609 | * @info: any extra information to be audited (MAYBE NULL) |
| 610 | * @error: error code |
| 611 | * |
| 612 | * Returns: the error to be returned after audit is done |
| 613 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 614 | static int audit_policy(struct aa_label *label, const char *op, |
| 615 | const char *ns_name, const char *name, |
John Johansen | fc1c9fd | 2017-01-16 00:42:54 -0800 | [diff] [blame] | 616 | const char *info, int error) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 617 | { |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 618 | DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, op); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 619 | |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 620 | aad(&sa)->iface.ns = ns_name; |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 621 | aad(&sa)->name = name; |
| 622 | aad(&sa)->info = info; |
| 623 | aad(&sa)->error = error; |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 624 | aad(&sa)->label = label; |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 625 | |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 626 | aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, audit_cb); |
| 627 | |
| 628 | return error; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 629 | } |
| 630 | |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 631 | /** |
| 632 | * policy_view_capable - check if viewing policy in at @ns is allowed |
| 633 | * ns: namespace being viewed by current task (may be NULL) |
| 634 | * Returns: true if viewing policy is allowed |
| 635 | * |
| 636 | * If @ns is NULL then the namespace being viewed is assumed to be the |
| 637 | * tasks current namespace. |
| 638 | */ |
| 639 | bool policy_view_capable(struct aa_ns *ns) |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 640 | { |
| 641 | struct user_namespace *user_ns = current_user_ns(); |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 642 | struct aa_ns *view_ns = aa_get_current_ns(); |
| 643 | bool root_in_user_ns = uid_eq(current_euid(), make_kuid(user_ns, 0)) || |
| 644 | in_egroup_p(make_kgid(user_ns, 0)); |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 645 | bool response = false; |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 646 | if (!ns) |
| 647 | ns = view_ns; |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 648 | |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 649 | if (root_in_user_ns && aa_ns_visible(view_ns, ns, true) && |
| 650 | (user_ns == &init_user_ns || |
| 651 | (unprivileged_userns_apparmor_policy != 0 && |
| 652 | user_ns->level == view_ns->level))) |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 653 | response = true; |
John Johansen | 2bd8dbb | 2017-01-16 00:42:50 -0800 | [diff] [blame] | 654 | aa_put_ns(view_ns); |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 655 | |
| 656 | return response; |
| 657 | } |
| 658 | |
John Johansen | fd2a804 | 2017-01-16 00:42:51 -0800 | [diff] [blame] | 659 | bool policy_admin_capable(struct aa_ns *ns) |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 660 | { |
John Johansen | fd2a804 | 2017-01-16 00:42:51 -0800 | [diff] [blame] | 661 | struct user_namespace *user_ns = current_user_ns(); |
| 662 | bool capable = ns_capable(user_ns, CAP_MAC_ADMIN); |
| 663 | |
| 664 | AA_DEBUG("cap_mac_admin? %d\n", capable); |
| 665 | AA_DEBUG("policy locked? %d\n", aa_g_lock_policy); |
| 666 | |
| 667 | return policy_view_capable(ns) && capable && !aa_g_lock_policy; |
John Johansen | 58acf9d | 2016-06-22 18:01:08 -0700 | [diff] [blame] | 668 | } |
| 669 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 670 | /** |
| 671 | * aa_may_manage_policy - can the current task manage policy |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 672 | * @label: label to check if it can manage policy |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 673 | * @op: the policy manipulation operation being done |
| 674 | * |
John Johansen | 078c73c6 | 2017-01-16 00:42:52 -0800 | [diff] [blame] | 675 | * Returns: 0 if the task is allowed to manipulate policy else error |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 676 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 677 | int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 678 | { |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 679 | const char *op; |
| 680 | |
| 681 | if (mask & AA_MAY_REMOVE_POLICY) |
| 682 | op = OP_PROF_RM; |
| 683 | else if (mask & AA_MAY_REPLACE_POLICY) |
| 684 | op = OP_PROF_REPL; |
| 685 | else |
| 686 | op = OP_PROF_LOAD; |
| 687 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 688 | /* check if loading policy is locked out */ |
John Johansen | 078c73c6 | 2017-01-16 00:42:52 -0800 | [diff] [blame] | 689 | if (aa_g_lock_policy) |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 690 | return audit_policy(label, op, NULL, NULL, "policy_locked", |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 691 | -EACCES); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 692 | |
John Johansen | 078c73c6 | 2017-01-16 00:42:52 -0800 | [diff] [blame] | 693 | if (!policy_admin_capable(ns)) |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 694 | return audit_policy(label, op, NULL, NULL, "not policy admin", |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 695 | -EACCES); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 696 | |
John Johansen | 078c73c6 | 2017-01-16 00:42:52 -0800 | [diff] [blame] | 697 | /* TODO: add fine grained mediation of policy loads */ |
| 698 | return 0; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 699 | } |
| 700 | |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 701 | static struct aa_profile *__list_lookup_parent(struct list_head *lh, |
| 702 | struct aa_profile *profile) |
| 703 | { |
John Johansen | 6e474e3 | 2017-01-16 00:42:29 -0800 | [diff] [blame] | 704 | const char *base = basename(profile->base.hname); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 705 | long len = base - profile->base.hname; |
| 706 | struct aa_load_ent *ent; |
| 707 | |
| 708 | /* parent won't have trailing // so remove from len */ |
| 709 | if (len <= 2) |
| 710 | return NULL; |
| 711 | len -= 2; |
| 712 | |
| 713 | list_for_each_entry(ent, lh, list) { |
| 714 | if (ent->new == profile) |
| 715 | continue; |
| 716 | if (strncmp(ent->new->base.hname, profile->base.hname, len) == |
| 717 | 0 && ent->new->base.hname[len] == 0) |
| 718 | return ent->new; |
| 719 | } |
| 720 | |
| 721 | return NULL; |
| 722 | } |
| 723 | |
| 724 | /** |
| 725 | * __replace_profile - replace @old with @new on a list |
| 726 | * @old: profile to be replaced (NOT NULL) |
| 727 | * @new: profile to replace @old with (NOT NULL) |
John Johansen | 8399588 | 2017-01-16 00:42:19 -0800 | [diff] [blame] | 728 | * @share_proxy: transfer @old->proxy to @new |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 729 | * |
| 730 | * Will duplicate and refcount elements that @new inherits from @old |
| 731 | * and will inherit @old children. |
| 732 | * |
| 733 | * refcount @new for list, put @old list refcount |
| 734 | * |
| 735 | * Requires: namespace list lock be held, or list not be shared |
| 736 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 737 | static void __replace_profile(struct aa_profile *old, struct aa_profile *new) |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 738 | { |
| 739 | struct aa_profile *child, *tmp; |
| 740 | |
| 741 | if (!list_empty(&old->base.profiles)) { |
| 742 | LIST_HEAD(lh); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 743 | list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 744 | |
| 745 | list_for_each_entry_safe(child, tmp, &lh, base.list) { |
| 746 | struct aa_profile *p; |
| 747 | |
| 748 | list_del_init(&child->base.list); |
| 749 | p = __find_child(&new->base.profiles, child->base.name); |
| 750 | if (p) { |
| 751 | /* @p replaces @child */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 752 | __replace_profile(child, p); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 753 | continue; |
| 754 | } |
| 755 | |
| 756 | /* inherit @child and its children */ |
| 757 | /* TODO: update hname of inherited children */ |
| 758 | /* list refcount transferred to @new */ |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 759 | p = aa_deref_parent(child); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 760 | rcu_assign_pointer(child->parent, aa_get_profile(new)); |
| 761 | list_add_rcu(&child->base.list, &new->base.profiles); |
| 762 | aa_put_profile(p); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 763 | } |
| 764 | } |
| 765 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 766 | if (!rcu_access_pointer(new->parent)) { |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 767 | struct aa_profile *parent = aa_deref_parent(old); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 768 | rcu_assign_pointer(new->parent, aa_get_profile(parent)); |
| 769 | } |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 770 | aa_label_replace(&old->label, &new->label); |
| 771 | /* migrate dents must come after label replacement b/c update */ |
John Johansen | c97204b | 2017-05-25 06:23:42 -0700 | [diff] [blame] | 772 | __aafs_profile_migrate_dents(old, new); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 773 | |
| 774 | if (list_empty(&new->base.list)) { |
| 775 | /* new is not on a list already */ |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 776 | list_replace_rcu(&old->base.list, &new->base.list); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 777 | aa_get_profile(new); |
| 778 | aa_put_profile(old); |
| 779 | } else |
| 780 | __list_remove_profile(old); |
| 781 | } |
| 782 | |
| 783 | /** |
| 784 | * __lookup_replace - lookup replacement information for a profile |
| 785 | * @ns - namespace the lookup occurs in |
| 786 | * @hname - name of profile to lookup |
| 787 | * @noreplace - true if not replacing an existing profile |
| 788 | * @p - Returns: profile to be replaced |
| 789 | * @info - Returns: info string on why lookup failed |
| 790 | * |
| 791 | * Returns: profile to replace (no ref) on success else ptr error |
| 792 | */ |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 793 | static int __lookup_replace(struct aa_ns *ns, const char *hname, |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 794 | bool noreplace, struct aa_profile **p, |
| 795 | const char **info) |
| 796 | { |
| 797 | *p = aa_get_profile(__lookup_profile(&ns->base, hname)); |
| 798 | if (*p) { |
| 799 | int error = replacement_allowed(*p, noreplace, info); |
| 800 | if (error) { |
| 801 | *info = "profile can not be replaced"; |
| 802 | return error; |
| 803 | } |
| 804 | } |
| 805 | |
| 806 | return 0; |
| 807 | } |
| 808 | |
John Johansen | a1bd627 | 2017-06-09 07:09:05 -0700 | [diff] [blame] | 809 | static void share_name(struct aa_profile *old, struct aa_profile *new) |
| 810 | { |
| 811 | aa_put_str(new->base.hname); |
| 812 | aa_get_str(old->base.hname); |
| 813 | new->base.hname = old->base.hname; |
| 814 | new->base.name = old->base.name; |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 815 | new->label.hname = old->label.hname; |
John Johansen | a1bd627 | 2017-06-09 07:09:05 -0700 | [diff] [blame] | 816 | } |
| 817 | |
John Johansen | 435222b | 2017-06-09 07:16:46 -0700 | [diff] [blame] | 818 | /* Update to newest version of parent after previous replacements |
| 819 | * Returns: unrefcount newest version of parent |
| 820 | */ |
| 821 | static struct aa_profile *update_to_newest_parent(struct aa_profile *new) |
| 822 | { |
| 823 | struct aa_profile *parent, *newest; |
| 824 | |
| 825 | parent = rcu_dereference_protected(new->parent, |
| 826 | mutex_is_locked(&new->ns->lock)); |
| 827 | newest = aa_get_newest_profile(parent); |
| 828 | |
| 829 | /* parent replaced in this atomic set? */ |
| 830 | if (newest != parent) { |
| 831 | aa_put_profile(parent); |
| 832 | rcu_assign_pointer(new->parent, newest); |
| 833 | } else |
| 834 | aa_put_profile(newest); |
| 835 | |
| 836 | return newest; |
| 837 | } |
| 838 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 839 | /** |
| 840 | * aa_replace_profiles - replace profile(s) on the profile list |
John Johansen | 60285eb | 2017-06-04 12:22:22 -0700 | [diff] [blame] | 841 | * @policy_ns: namespace load is occurring on |
John Johansen | 12dd717 | 2017-01-16 00:42:57 -0800 | [diff] [blame] | 842 | * @label: label that is attempting to load/replace policy |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 843 | * @mask: permission mask |
John Johansen | 5ac8c35 | 2017-01-16 00:42:55 -0800 | [diff] [blame] | 844 | * @udata: serialized data stream (NOT NULL) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 845 | * |
| 846 | * unpack and replace a profile on the profile list and uses of that profile |
John Johansen | 55a26eb | 2017-01-16 00:43:00 -0800 | [diff] [blame] | 847 | * by any aa_task_ctx. If the profile does not exist on the profile list |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 848 | * it is added. |
| 849 | * |
| 850 | * Returns: size of data consumed else error code on failure. |
| 851 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 852 | ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label, |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 853 | u32 mask, struct aa_loaddata *udata) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 854 | { |
John Johansen | bf15cf0 | 2016-04-16 14:16:50 -0700 | [diff] [blame] | 855 | const char *ns_name, *info = NULL; |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 856 | struct aa_ns *ns = NULL; |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 857 | struct aa_load_ent *ent, *tmp; |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 858 | struct aa_loaddata *rawdata_ent; |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 859 | const char *op; |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 860 | ssize_t count, error; |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 861 | LIST_HEAD(lh); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 862 | |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 863 | op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD; |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 864 | aa_get_loaddata(udata); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 865 | /* released below */ |
John Johansen | 5ac8c35 | 2017-01-16 00:42:55 -0800 | [diff] [blame] | 866 | error = aa_unpack(udata, &lh, &ns_name); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 867 | if (error) |
| 868 | goto out; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 869 | |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 870 | /* ensure that profiles are all for the same ns |
| 871 | * TODO: update locking to remove this constaint. All profiles in |
| 872 | * the load set must succeed as a set or the load will |
| 873 | * fail. Sort ent list and take ns locks in hierarchy order |
| 874 | */ |
| 875 | count = 0; |
| 876 | list_for_each_entry(ent, &lh, list) { |
| 877 | if (ns_name) { |
| 878 | if (ent->ns_name && |
| 879 | strcmp(ent->ns_name, ns_name) != 0) { |
| 880 | info = "policy load has mixed namespaces"; |
| 881 | error = -EACCES; |
| 882 | goto fail; |
| 883 | } |
| 884 | } else if (ent->ns_name) { |
| 885 | if (count) { |
| 886 | info = "policy load has mixed namespaces"; |
| 887 | error = -EACCES; |
| 888 | goto fail; |
| 889 | } |
| 890 | ns_name = ent->ns_name; |
| 891 | } else |
| 892 | count++; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 893 | } |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 894 | if (ns_name) { |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 895 | ns = aa_prepare_ns(policy_ns ? policy_ns : labels_ns(label), |
John Johansen | 60285eb | 2017-06-04 12:22:22 -0700 | [diff] [blame] | 896 | ns_name); |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 897 | if (IS_ERR(ns)) { |
John Johansen | b9b144b | 2017-04-06 06:55:22 -0700 | [diff] [blame] | 898 | op = OP_PROF_LOAD; |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 899 | info = "failed to prepare namespace"; |
| 900 | error = PTR_ERR(ns); |
| 901 | ns = NULL; |
John Johansen | b9b144b | 2017-04-06 06:55:22 -0700 | [diff] [blame] | 902 | ent = NULL; |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 903 | goto fail; |
| 904 | } |
| 905 | } else |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 906 | ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label)); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 907 | |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 908 | mutex_lock(&ns->lock); |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 909 | /* check for duplicate rawdata blobs: space and file dedup */ |
| 910 | list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) { |
| 911 | if (aa_rawdata_eq(rawdata_ent, udata)) { |
| 912 | struct aa_loaddata *tmp; |
| 913 | |
| 914 | tmp = __aa_get_loaddata(rawdata_ent); |
| 915 | /* check we didn't fail the race */ |
| 916 | if (tmp) { |
| 917 | aa_put_loaddata(udata); |
| 918 | udata = tmp; |
| 919 | break; |
| 920 | } |
| 921 | } |
| 922 | } |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 923 | /* setup parent and ns info */ |
| 924 | list_for_each_entry(ent, &lh, list) { |
| 925 | struct aa_policy *policy; |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 926 | |
John Johansen | 5ac8c35 | 2017-01-16 00:42:55 -0800 | [diff] [blame] | 927 | ent->new->rawdata = aa_get_loaddata(udata); |
John Johansen | 18e99f1 | 2017-05-26 01:45:08 -0700 | [diff] [blame] | 928 | error = __lookup_replace(ns, ent->new->base.hname, |
| 929 | !(mask & AA_MAY_REPLACE_POLICY), |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 930 | &ent->old, &info); |
| 931 | if (error) |
| 932 | goto fail_lock; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 933 | |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 934 | if (ent->new->rename) { |
| 935 | error = __lookup_replace(ns, ent->new->rename, |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 936 | !(mask & AA_MAY_REPLACE_POLICY), |
| 937 | &ent->rename, &info); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 938 | if (error) |
| 939 | goto fail_lock; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 940 | } |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 941 | |
| 942 | /* released when @new is freed */ |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 943 | ent->new->ns = aa_get_ns(ns); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 944 | |
| 945 | if (ent->old || ent->rename) |
| 946 | continue; |
| 947 | |
| 948 | /* no ref on policy only use inside lock */ |
| 949 | policy = __lookup_parent(ns, ent->new->base.hname); |
| 950 | if (!policy) { |
| 951 | struct aa_profile *p; |
| 952 | p = __list_lookup_parent(&lh, ent->new); |
| 953 | if (!p) { |
| 954 | error = -ENOENT; |
| 955 | info = "parent does not exist"; |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 956 | goto fail_lock; |
| 957 | } |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 958 | rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); |
| 959 | } else if (policy != &ns->base) { |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 960 | /* released on profile replacement or free_profile */ |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 961 | struct aa_profile *p = (struct aa_profile *) policy; |
| 962 | rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); |
| 963 | } |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 964 | } |
| 965 | |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 966 | /* create new fs entries for introspection if needed */ |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 967 | if (!udata->dents[AAFS_LOADDATA_DIR]) { |
| 968 | error = __aa_fs_create_rawdata(ns, udata); |
| 969 | if (error) { |
| 970 | info = "failed to create raw_data dir and files"; |
| 971 | ent = NULL; |
| 972 | goto fail_lock; |
| 973 | } |
| 974 | } |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 975 | list_for_each_entry(ent, &lh, list) { |
John Johansen | dca9140 | 2017-06-09 07:24:18 -0700 | [diff] [blame] | 976 | if (!ent->old) { |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 977 | struct dentry *parent; |
| 978 | if (rcu_access_pointer(ent->new->parent)) { |
| 979 | struct aa_profile *p; |
| 980 | p = aa_deref_parent(ent->new); |
| 981 | parent = prof_child_dir(p); |
| 982 | } else |
| 983 | parent = ns_subprofs_dir(ent->new->ns); |
John Johansen | c97204b | 2017-05-25 06:23:42 -0700 | [diff] [blame] | 984 | error = __aafs_profile_mkdir(ent->new, parent); |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 985 | } |
| 986 | |
| 987 | if (error) { |
John Johansen | dca9140 | 2017-06-09 07:24:18 -0700 | [diff] [blame] | 988 | info = "failed to create"; |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 989 | goto fail_lock; |
| 990 | } |
| 991 | } |
| 992 | |
| 993 | /* Done with checks that may fail - do actual replacement */ |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 994 | __aa_bump_ns_revision(ns); |
| 995 | __aa_loaddata_update(udata, ns->revision); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 996 | list_for_each_entry_safe(ent, tmp, &lh, list) { |
| 997 | list_del_init(&ent->list); |
| 998 | op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 999 | |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1000 | if (ent->old && ent->old->rawdata == ent->new->rawdata) { |
| 1001 | /* dedup actual profile replacement */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1002 | audit_policy(label, op, ns_name, ent->new->base.hname, |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1003 | "same as current profile, skipping", |
| 1004 | error); |
| 1005 | goto skip; |
| 1006 | } |
| 1007 | |
| 1008 | /* |
| 1009 | * TODO: finer dedup based on profile range in data. Load set |
| 1010 | * can differ but profile may remain unchanged |
| 1011 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1012 | audit_policy(label, op, ns_name, ent->new->base.hname, NULL, |
| 1013 | error); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1014 | |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1015 | if (ent->old) { |
John Johansen | a1bd627 | 2017-06-09 07:09:05 -0700 | [diff] [blame] | 1016 | share_name(ent->old, ent->new); |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1017 | __replace_profile(ent->old, ent->new); |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 1018 | } else { |
John Johansen | 435222b | 2017-06-09 07:16:46 -0700 | [diff] [blame] | 1019 | struct list_head *lh; |
| 1020 | |
| 1021 | if (rcu_access_pointer(ent->new->parent)) { |
| 1022 | struct aa_profile *parent; |
| 1023 | |
| 1024 | parent = update_to_newest_parent(ent->new); |
| 1025 | lh = &parent->base.profiles; |
| 1026 | } else |
| 1027 | lh = &ns->base.profiles; |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1028 | __add_profile(lh, ent->new); |
John Johansen | 0d259f0 | 2013-07-10 21:13:43 -0700 | [diff] [blame] | 1029 | } |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1030 | skip: |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1031 | aa_load_ent_free(ent); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1032 | } |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1033 | __aa_labelset_update_subtree(ns); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1034 | mutex_unlock(&ns->lock); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1035 | |
| 1036 | out: |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 1037 | aa_put_ns(ns); |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1038 | aa_put_loaddata(udata); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1039 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1040 | if (error) |
| 1041 | return error; |
John Johansen | 5ac8c35 | 2017-01-16 00:42:55 -0800 | [diff] [blame] | 1042 | return udata->size; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1043 | |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1044 | fail_lock: |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1045 | mutex_unlock(&ns->lock); |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1046 | |
John Johansen | bf15cf0 | 2016-04-16 14:16:50 -0700 | [diff] [blame] | 1047 | /* audit cause of failure */ |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1048 | op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; |
John Johansen | 04dc715 | 2017-01-16 00:42:56 -0800 | [diff] [blame] | 1049 | fail: |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1050 | audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL, |
| 1051 | info, error); |
John Johansen | bf15cf0 | 2016-04-16 14:16:50 -0700 | [diff] [blame] | 1052 | /* audit status that rest of profiles in the atomic set failed too */ |
| 1053 | info = "valid profile in failed atomic policy load"; |
| 1054 | list_for_each_entry(tmp, &lh, list) { |
| 1055 | if (tmp == ent) { |
| 1056 | info = "unchecked profile in failed atomic policy load"; |
| 1057 | /* skip entry that caused failure */ |
| 1058 | continue; |
| 1059 | } |
John Johansen | b9b144b | 2017-04-06 06:55:22 -0700 | [diff] [blame] | 1060 | op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL; |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1061 | audit_policy(label, op, ns_name, tmp->new->base.hname, info, |
| 1062 | error); |
John Johansen | bf15cf0 | 2016-04-16 14:16:50 -0700 | [diff] [blame] | 1063 | } |
John Johansen | dd51c848 | 2013-07-10 21:05:43 -0700 | [diff] [blame] | 1064 | list_for_each_entry_safe(ent, tmp, &lh, list) { |
| 1065 | list_del_init(&ent->list); |
| 1066 | aa_load_ent_free(ent); |
| 1067 | } |
| 1068 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1069 | goto out; |
| 1070 | } |
| 1071 | |
| 1072 | /** |
| 1073 | * aa_remove_profiles - remove profile(s) from the system |
John Johansen | 60285eb | 2017-06-04 12:22:22 -0700 | [diff] [blame] | 1074 | * @policy_ns: namespace the remove is being done from |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1075 | * @subj: label attempting to remove policy |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1076 | * @fqname: name of the profile or namespace to remove (NOT NULL) |
| 1077 | * @size: size of the name |
| 1078 | * |
| 1079 | * Remove a profile or sub namespace from the current namespace, so that |
| 1080 | * they can not be found anymore and mark them as replaced by unconfined |
| 1081 | * |
| 1082 | * NOTE: removing confinement does not restore rlimits to preconfinemnet values |
| 1083 | * |
| 1084 | * Returns: size of data consume else error code if fails |
| 1085 | */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1086 | ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, |
John Johansen | 12dd717 | 2017-01-16 00:42:57 -0800 | [diff] [blame] | 1087 | char *fqname, size_t size) |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1088 | { |
John Johansen | 60285eb | 2017-06-04 12:22:22 -0700 | [diff] [blame] | 1089 | struct aa_ns *ns = NULL; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1090 | struct aa_profile *profile = NULL; |
| 1091 | const char *name = fqname, *info = NULL; |
John Johansen | 3664268 | 2017-06-02 17:44:27 -0700 | [diff] [blame] | 1092 | const char *ns_name = NULL; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1093 | ssize_t error = 0; |
| 1094 | |
| 1095 | if (*fqname == 0) { |
| 1096 | info = "no profile specified"; |
| 1097 | error = -ENOENT; |
| 1098 | goto fail; |
| 1099 | } |
| 1100 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1101 | if (fqname[0] == ':') { |
John Johansen | 3664268 | 2017-06-02 17:44:27 -0700 | [diff] [blame] | 1102 | size_t ns_len; |
| 1103 | |
| 1104 | name = aa_splitn_fqname(fqname, size, &ns_name, &ns_len); |
John Johansen | 41d1b3e | 2013-02-21 01:14:17 -0800 | [diff] [blame] | 1105 | /* released below */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1106 | ns = aa_lookupn_ns(policy_ns ? policy_ns : labels_ns(subj), |
| 1107 | ns_name, ns_len); |
John Johansen | 41d1b3e | 2013-02-21 01:14:17 -0800 | [diff] [blame] | 1108 | if (!ns) { |
| 1109 | info = "namespace does not exist"; |
| 1110 | error = -ENOENT; |
| 1111 | goto fail; |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1112 | } |
| 1113 | } else |
| 1114 | /* released below */ |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1115 | ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(subj)); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1116 | |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1117 | if (!name) { |
| 1118 | /* remove namespace - can only happen if fqname[0] == ':' */ |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1119 | mutex_lock(&ns->parent->lock); |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 1120 | __aa_remove_ns(ns); |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1121 | __aa_bump_ns_revision(ns); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1122 | mutex_unlock(&ns->parent->lock); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1123 | } else { |
| 1124 | /* remove profile */ |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1125 | mutex_lock(&ns->lock); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1126 | profile = aa_get_profile(__lookup_profile(&ns->base, name)); |
| 1127 | if (!profile) { |
| 1128 | error = -ENOENT; |
| 1129 | info = "profile does not exist"; |
| 1130 | goto fail_ns_lock; |
| 1131 | } |
| 1132 | name = profile->base.hname; |
| 1133 | __remove_profile(profile); |
John Johansen | 637f688 | 2017-06-09 08:14:28 -0700 | [diff] [blame] | 1134 | __aa_labelset_update_subtree(ns); |
John Johansen | 5d5182ca | 2017-05-09 00:08:41 -0700 | [diff] [blame] | 1135 | __aa_bump_ns_revision(ns); |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1136 | mutex_unlock(&ns->lock); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1137 | } |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1138 | |
| 1139 | /* don't fail removal if audit fails */ |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 1140 | (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info, |
John Johansen | 12dd717 | 2017-01-16 00:42:57 -0800 | [diff] [blame] | 1141 | error); |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 1142 | aa_put_ns(ns); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1143 | aa_put_profile(profile); |
| 1144 | return size; |
| 1145 | |
| 1146 | fail_ns_lock: |
John Johansen | 01e2b67 | 2013-07-10 21:06:43 -0700 | [diff] [blame] | 1147 | mutex_unlock(&ns->lock); |
John Johansen | 98849df | 2017-01-16 00:42:16 -0800 | [diff] [blame] | 1148 | aa_put_ns(ns); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1149 | |
| 1150 | fail: |
John Johansen | ef88a7a | 2017-01-16 00:43:02 -0800 | [diff] [blame] | 1151 | (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info, |
John Johansen | 12dd717 | 2017-01-16 00:42:57 -0800 | [diff] [blame] | 1152 | error); |
John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1153 | return error; |
| 1154 | } |