blob: 2660fbcf94d1e0e8affa72d4656584bc0aa06216 [file] [log] [blame]
John Johansenb5e95b42010-07-29 14:48:07 -07001/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor LSM hooks.
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 */
14
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070015#include <linux/lsm_hooks.h>
John Johansenb5e95b42010-07-29 14:48:07 -070016#include <linux/moduleparam.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/mount.h>
20#include <linux/namei.h>
21#include <linux/ptrace.h>
22#include <linux/ctype.h>
23#include <linux/sysctl.h>
24#include <linux/audit.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070025#include <linux/user_namespace.h>
John Johansenb5e95b42010-07-29 14:48:07 -070026#include <net/sock.h>
27
28#include "include/apparmor.h"
29#include "include/apparmorfs.h"
30#include "include/audit.h"
31#include "include/capability.h"
32#include "include/context.h"
33#include "include/file.h"
34#include "include/ipc.h"
35#include "include/path.h"
36#include "include/policy.h"
37#include "include/procattr.h"
38
39/* Flag indicating whether initialization completed */
40int apparmor_initialized __initdata;
41
42/*
43 * LSM hook functions
44 */
45
46/*
47 * free the associated aa_task_cxt and put its profiles
48 */
49static void apparmor_cred_free(struct cred *cred)
50{
John Johansen214beac2013-02-27 03:43:40 -080051 aa_free_task_context(cred_cxt(cred));
52 cred_cxt(cred) = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -070053}
54
55/*
56 * allocate the apparmor part of blank credentials
57 */
58static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
59{
60 /* freed by apparmor_cred_free */
61 struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
62 if (!cxt)
63 return -ENOMEM;
64
John Johansen214beac2013-02-27 03:43:40 -080065 cred_cxt(cred) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -070066 return 0;
67}
68
69/*
70 * prepare new aa_task_cxt for modification by prepare_cred block
71 */
72static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
73 gfp_t gfp)
74{
75 /* freed by apparmor_cred_free */
76 struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
77 if (!cxt)
78 return -ENOMEM;
79
John Johansen214beac2013-02-27 03:43:40 -080080 aa_dup_task_context(cxt, cred_cxt(old));
81 cred_cxt(new) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -070082 return 0;
83}
84
85/*
86 * transfer the apparmor data to a blank set of creds
87 */
88static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
89{
John Johansen214beac2013-02-27 03:43:40 -080090 const struct aa_task_cxt *old_cxt = cred_cxt(old);
91 struct aa_task_cxt *new_cxt = cred_cxt(new);
John Johansenb5e95b42010-07-29 14:48:07 -070092
93 aa_dup_task_context(new_cxt, old_cxt);
94}
95
96static int apparmor_ptrace_access_check(struct task_struct *child,
97 unsigned int mode)
98{
John Johansenb5e95b42010-07-29 14:48:07 -070099 return aa_ptrace(current, child, mode);
100}
101
102static int apparmor_ptrace_traceme(struct task_struct *parent)
103{
John Johansenb5e95b42010-07-29 14:48:07 -0700104 return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
105}
106
107/* Derived from security/commoncap.c:cap_capget */
108static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
109 kernel_cap_t *inheritable, kernel_cap_t *permitted)
110{
111 struct aa_profile *profile;
112 const struct cred *cred;
113
114 rcu_read_lock();
115 cred = __task_cred(target);
116 profile = aa_cred_profile(cred);
117
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700118 /*
119 * cap_capget is stacked ahead of this and will
120 * initialize effective and permitted.
121 */
John Johansen25e75df2011-06-25 16:57:07 +0100122 if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
John Johansenb5e95b42010-07-29 14:48:07 -0700123 *effective = cap_intersect(*effective, profile->caps.allow);
124 *permitted = cap_intersect(*permitted, profile->caps.allow);
125 }
126 rcu_read_unlock();
127
128 return 0;
129}
130
Eric Paris6a9de492012-01-03 12:25:14 -0500131static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
132 int cap, int audit)
John Johansenb5e95b42010-07-29 14:48:07 -0700133{
134 struct aa_profile *profile;
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700135 int error = 0;
136
137 profile = aa_cred_profile(cred);
138 if (!unconfined(profile))
139 error = aa_capable(profile, cap, audit);
John Johansenb5e95b42010-07-29 14:48:07 -0700140 return error;
141}
142
143/**
144 * common_perm - basic common permission check wrapper fn for paths
145 * @op: operation being checked
146 * @path: path to check permission of (NOT NULL)
147 * @mask: requested permissions mask
148 * @cond: conditional info for the permission request (NOT NULL)
149 *
150 * Returns: %0 else error code if error or permission denied
151 */
Al Viro2c7661f2016-03-25 14:18:14 -0400152static int common_perm(int op, const struct path *path, u32 mask,
John Johansenb5e95b42010-07-29 14:48:07 -0700153 struct path_cond *cond)
154{
155 struct aa_profile *profile;
156 int error = 0;
157
158 profile = __aa_current_profile();
159 if (!unconfined(profile))
160 error = aa_path_perm(op, profile, path, 0, mask, cond);
161
162 return error;
163}
164
165/**
166 * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
167 * @op: operation being checked
168 * @dir: directory of the dentry (NOT NULL)
169 * @dentry: dentry to check (NOT NULL)
170 * @mask: requested permissions mask
171 * @cond: conditional info for the permission request (NOT NULL)
172 *
173 * Returns: %0 else error code if error or permission denied
174 */
Al Virod6b49f72016-03-25 15:10:04 -0400175static int common_perm_dir_dentry(int op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700176 struct dentry *dentry, u32 mask,
177 struct path_cond *cond)
178{
179 struct path path = { dir->mnt, dentry };
180
181 return common_perm(op, &path, mask, cond);
182}
183
184/**
Al Viro741aca72016-03-25 15:04:36 -0400185 * common_perm_path - common permission wrapper when mnt, dentry
John Johansenb5e95b42010-07-29 14:48:07 -0700186 * @op: operation being checked
Al Viro741aca72016-03-25 15:04:36 -0400187 * @path: location to check (NOT NULL)
John Johansenb5e95b42010-07-29 14:48:07 -0700188 * @mask: requested permissions mask
189 *
190 * Returns: %0 else error code if error or permission denied
191 */
Al Viro741aca72016-03-25 15:04:36 -0400192static inline int common_perm_path(int op, const struct path *path, u32 mask)
John Johansenb5e95b42010-07-29 14:48:07 -0700193{
Al Viro741aca72016-03-25 15:04:36 -0400194 struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
195 d_backing_inode(path->dentry)->i_mode
John Johansenb5e95b42010-07-29 14:48:07 -0700196 };
Al Viro741aca72016-03-25 15:04:36 -0400197 if (!mediated_filesystem(path->dentry))
198 return 0;
John Johansenb5e95b42010-07-29 14:48:07 -0700199
Al Viro741aca72016-03-25 15:04:36 -0400200 return common_perm(op, path, mask, &cond);
John Johansenb5e95b42010-07-29 14:48:07 -0700201}
202
203/**
204 * common_perm_rm - common permission wrapper for operations doing rm
205 * @op: operation being checked
206 * @dir: directory that the dentry is in (NOT NULL)
207 * @dentry: dentry being rm'd (NOT NULL)
208 * @mask: requested permission mask
209 *
210 * Returns: %0 else error code if error or permission denied
211 */
Al Virod6b49f72016-03-25 15:10:04 -0400212static int common_perm_rm(int op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700213 struct dentry *dentry, u32 mask)
214{
David Howellsc6f493d2015-03-17 22:26:22 +0000215 struct inode *inode = d_backing_inode(dentry);
John Johansenb5e95b42010-07-29 14:48:07 -0700216 struct path_cond cond = { };
217
Al Viro8db01852016-03-25 15:22:49 -0400218 if (!inode || !mediated_filesystem(dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700219 return 0;
220
221 cond.uid = inode->i_uid;
222 cond.mode = inode->i_mode;
223
224 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
225}
226
227/**
228 * common_perm_create - common permission wrapper for operations doing create
229 * @op: operation being checked
230 * @dir: directory that dentry will be created in (NOT NULL)
231 * @dentry: dentry to create (NOT NULL)
232 * @mask: request permission mask
233 * @mode: created file mode
234 *
235 * Returns: %0 else error code if error or permission denied
236 */
Al Virod6b49f72016-03-25 15:10:04 -0400237static int common_perm_create(int op, const struct path *dir,
238 struct dentry *dentry, u32 mask, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700239{
240 struct path_cond cond = { current_fsuid(), mode };
241
Al Viro8db01852016-03-25 15:22:49 -0400242 if (!mediated_filesystem(dir->dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700243 return 0;
244
245 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
246}
247
Al Viro989f74e2016-03-25 15:13:39 -0400248static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700249{
250 return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
251}
252
Al Virod3607752016-03-25 15:21:09 -0400253static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
Al Viro4572bef2011-11-21 14:56:21 -0500254 umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700255{
256 return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
257 S_IFDIR);
258}
259
Al Viro989f74e2016-03-25 15:13:39 -0400260static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700261{
262 return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
263}
264
Al Virod3607752016-03-25 15:21:09 -0400265static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
Al Viro04fc66e2011-11-21 14:58:38 -0500266 umode_t mode, unsigned int dev)
John Johansenb5e95b42010-07-29 14:48:07 -0700267{
268 return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
269}
270
Al Viro81f4c502016-03-25 14:22:01 -0400271static int apparmor_path_truncate(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700272{
Al Viro741aca72016-03-25 15:04:36 -0400273 return common_perm_path(OP_TRUNC, path, MAY_WRITE | AA_MAY_META_WRITE);
John Johansenb5e95b42010-07-29 14:48:07 -0700274}
275
Al Virod3607752016-03-25 15:21:09 -0400276static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
John Johansenb5e95b42010-07-29 14:48:07 -0700277 const char *old_name)
278{
279 return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
280 S_IFLNK);
281}
282
Al Viro3ccee462016-03-25 15:27:45 -0400283static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700284 struct dentry *new_dentry)
285{
286 struct aa_profile *profile;
287 int error = 0;
288
David Howells7ac28562015-01-29 12:02:31 +0000289 if (!mediated_filesystem(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700290 return 0;
291
292 profile = aa_current_profile();
293 if (!unconfined(profile))
294 error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
295 return error;
296}
297
Al Viro3ccee462016-03-25 15:27:45 -0400298static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
299 const struct path *new_dir, struct dentry *new_dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700300{
301 struct aa_profile *profile;
302 int error = 0;
303
David Howells7ac28562015-01-29 12:02:31 +0000304 if (!mediated_filesystem(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700305 return 0;
306
307 profile = aa_current_profile();
308 if (!unconfined(profile)) {
309 struct path old_path = { old_dir->mnt, old_dentry };
310 struct path new_path = { new_dir->mnt, new_dentry };
David Howellsc6f493d2015-03-17 22:26:22 +0000311 struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
312 d_backing_inode(old_dentry)->i_mode
John Johansenb5e95b42010-07-29 14:48:07 -0700313 };
314
315 error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0,
316 MAY_READ | AA_MAY_META_READ | MAY_WRITE |
317 AA_MAY_META_WRITE | AA_MAY_DELETE,
318 &cond);
319 if (!error)
320 error = aa_path_perm(OP_RENAME_DEST, profile, &new_path,
321 0, MAY_WRITE | AA_MAY_META_WRITE |
322 AA_MAY_CREATE, &cond);
323
324 }
325 return error;
326}
327
Al Virobe01f9f2016-03-25 14:56:23 -0400328static int apparmor_path_chmod(const struct path *path, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700329{
Al Viro741aca72016-03-25 15:04:36 -0400330 return common_perm_path(OP_CHMOD, path, AA_MAY_CHMOD);
John Johansenb5e95b42010-07-29 14:48:07 -0700331}
332
Al Viro7fd25da2016-03-25 14:44:41 -0400333static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
John Johansenb5e95b42010-07-29 14:48:07 -0700334{
Al Viro741aca72016-03-25 15:04:36 -0400335 return common_perm_path(OP_CHOWN, path, AA_MAY_CHOWN);
John Johansenb5e95b42010-07-29 14:48:07 -0700336}
337
Al Viro3f7036a2015-03-08 19:28:30 -0400338static int apparmor_inode_getattr(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700339{
Al Viro741aca72016-03-25 15:04:36 -0400340 return common_perm_path(OP_GETATTR, path, AA_MAY_META_READ);
John Johansenb5e95b42010-07-29 14:48:07 -0700341}
342
Eric Paris83d49852012-04-04 13:45:40 -0400343static int apparmor_file_open(struct file *file, const struct cred *cred)
John Johansenb5e95b42010-07-29 14:48:07 -0700344{
345 struct aa_file_cxt *fcxt = file->f_security;
346 struct aa_profile *profile;
347 int error = 0;
348
David Howells7ac28562015-01-29 12:02:31 +0000349 if (!mediated_filesystem(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700350 return 0;
351
352 /* If in exec, permission is handled by bprm hooks.
353 * Cache permissions granted by the previous exec check, with
354 * implicit read and executable mmap which are required to
355 * actually execute the image.
356 */
357 if (current->in_execve) {
358 fcxt->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
359 return 0;
360 }
361
362 profile = aa_cred_profile(cred);
363 if (!unconfined(profile)) {
Al Viro496ad9a2013-01-23 17:07:38 -0500364 struct inode *inode = file_inode(file);
John Johansenb5e95b42010-07-29 14:48:07 -0700365 struct path_cond cond = { inode->i_uid, inode->i_mode };
366
367 error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0,
368 aa_map_file_to_perms(file), &cond);
369 /* todo cache full allowed permissions set and state */
370 fcxt->allow = aa_map_file_to_perms(file);
371 }
372
373 return error;
374}
375
376static int apparmor_file_alloc_security(struct file *file)
377{
378 /* freed by apparmor_file_free_security */
379 file->f_security = aa_alloc_file_context(GFP_KERNEL);
380 if (!file->f_security)
381 return -ENOMEM;
382 return 0;
383
384}
385
386static void apparmor_file_free_security(struct file *file)
387{
388 struct aa_file_cxt *cxt = file->f_security;
389
390 aa_free_file_context(cxt);
391}
392
393static int common_file_perm(int op, struct file *file, u32 mask)
394{
395 struct aa_file_cxt *fcxt = file->f_security;
396 struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred);
397 int error = 0;
398
399 BUG_ON(!fprofile);
400
401 if (!file->f_path.mnt ||
David Howells7ac28562015-01-29 12:02:31 +0000402 !mediated_filesystem(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700403 return 0;
404
405 profile = __aa_current_profile();
406
407 /* revalidate access, if task is unconfined, or the cached cred
408 * doesn't match or if the request is for more permissions than
409 * was granted.
410 *
411 * Note: the test for !unconfined(fprofile) is to handle file
412 * delegation from unconfined tasks
413 */
414 if (!unconfined(profile) && !unconfined(fprofile) &&
415 ((fprofile != profile) || (mask & ~fcxt->allow)))
416 error = aa_file_perm(op, profile, file, mask);
417
418 return error;
419}
420
421static int apparmor_file_permission(struct file *file, int mask)
422{
423 return common_file_perm(OP_FPERM, file, mask);
424}
425
426static int apparmor_file_lock(struct file *file, unsigned int cmd)
427{
428 u32 mask = AA_MAY_LOCK;
429
430 if (cmd == F_WRLCK)
431 mask |= MAY_WRITE;
432
433 return common_file_perm(OP_FLOCK, file, mask);
434}
435
436static int common_mmap(int op, struct file *file, unsigned long prot,
437 unsigned long flags)
438{
John Johansenb5e95b42010-07-29 14:48:07 -0700439 int mask = 0;
440
441 if (!file || !file->f_security)
442 return 0;
443
444 if (prot & PROT_READ)
445 mask |= MAY_READ;
446 /*
447 * Private mappings don't require write perms since they don't
448 * write back to the files
449 */
450 if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
451 mask |= MAY_WRITE;
452 if (prot & PROT_EXEC)
453 mask |= AA_EXEC_MMAP;
454
John Johansenb5e95b42010-07-29 14:48:07 -0700455 return common_file_perm(op, file, mask);
456}
457
Al Viroe5467852012-05-30 13:30:51 -0400458static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
459 unsigned long prot, unsigned long flags)
John Johansenb5e95b42010-07-29 14:48:07 -0700460{
John Johansenb5e95b42010-07-29 14:48:07 -0700461 return common_mmap(OP_FMMAP, file, prot, flags);
462}
463
464static int apparmor_file_mprotect(struct vm_area_struct *vma,
465 unsigned long reqprot, unsigned long prot)
466{
467 return common_mmap(OP_FMPROT, vma->vm_file, prot,
468 !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
469}
470
471static int apparmor_getprocattr(struct task_struct *task, char *name,
472 char **value)
473{
474 int error = -ENOENT;
John Johansenb5e95b42010-07-29 14:48:07 -0700475 /* released below */
476 const struct cred *cred = get_task_cred(task);
John Johansen214beac2013-02-27 03:43:40 -0800477 struct aa_task_cxt *cxt = cred_cxt(cred);
John Johansen77b071b2013-07-10 21:07:43 -0700478 struct aa_profile *profile = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -0700479
480 if (strcmp(name, "current") == 0)
John Johansen77b071b2013-07-10 21:07:43 -0700481 profile = aa_get_newest_profile(cxt->profile);
John Johansenb5e95b42010-07-29 14:48:07 -0700482 else if (strcmp(name, "prev") == 0 && cxt->previous)
John Johansen77b071b2013-07-10 21:07:43 -0700483 profile = aa_get_newest_profile(cxt->previous);
John Johansenb5e95b42010-07-29 14:48:07 -0700484 else if (strcmp(name, "exec") == 0 && cxt->onexec)
John Johansen77b071b2013-07-10 21:07:43 -0700485 profile = aa_get_newest_profile(cxt->onexec);
John Johansenb5e95b42010-07-29 14:48:07 -0700486 else
487 error = -EINVAL;
488
John Johansen77b071b2013-07-10 21:07:43 -0700489 if (profile)
490 error = aa_getprocattr(profile, value);
491
492 aa_put_profile(profile);
John Johansenb5e95b42010-07-29 14:48:07 -0700493 put_cred(cred);
494
495 return error;
496}
497
498static int apparmor_setprocattr(struct task_struct *task, char *name,
499 void *value, size_t size)
500{
John Johansen3eea57c2013-02-27 03:44:40 -0800501 struct common_audit_data sa;
502 struct apparmor_audit_data aad = {0,};
John Johansenb5e95b42010-07-29 14:48:07 -0700503 char *command, *args = value;
504 size_t arg_size;
505 int error;
506
507 if (size == 0)
508 return -EINVAL;
509 /* args points to a PAGE_SIZE buffer, AppArmor requires that
510 * the buffer must be null terminated or have size <= PAGE_SIZE -1
511 * so that AppArmor can null terminate them
512 */
513 if (args[size - 1] != '\0') {
514 if (size == PAGE_SIZE)
515 return -EINVAL;
516 args[size] = '\0';
517 }
518
519 /* task can only write its own attributes */
520 if (current != task)
521 return -EACCES;
522
523 args = value;
524 args = strim(args);
525 command = strsep(&args, " ");
526 if (!args)
527 return -EINVAL;
528 args = skip_spaces(args);
529 if (!*args)
530 return -EINVAL;
531
532 arg_size = size - (args - (char *) value);
533 if (strcmp(name, "current") == 0) {
534 if (strcmp(command, "changehat") == 0) {
535 error = aa_setprocattr_changehat(args, arg_size,
536 !AA_DO_TEST);
537 } else if (strcmp(command, "permhat") == 0) {
538 error = aa_setprocattr_changehat(args, arg_size,
539 AA_DO_TEST);
540 } else if (strcmp(command, "changeprofile") == 0) {
541 error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
542 !AA_DO_TEST);
543 } else if (strcmp(command, "permprofile") == 0) {
544 error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
545 AA_DO_TEST);
John Johansen3eea57c2013-02-27 03:44:40 -0800546 } else
547 goto fail;
John Johansenb5e95b42010-07-29 14:48:07 -0700548 } else if (strcmp(name, "exec") == 0) {
John Johansen3eea57c2013-02-27 03:44:40 -0800549 if (strcmp(command, "exec") == 0)
550 error = aa_setprocattr_changeprofile(args, AA_ONEXEC,
551 !AA_DO_TEST);
552 else
553 goto fail;
554 } else
John Johansenb5e95b42010-07-29 14:48:07 -0700555 /* only support the "current" and "exec" process attributes */
556 return -EINVAL;
John Johansen3eea57c2013-02-27 03:44:40 -0800557
John Johansenb5e95b42010-07-29 14:48:07 -0700558 if (!error)
559 error = size;
560 return error;
John Johansen3eea57c2013-02-27 03:44:40 -0800561
562fail:
563 sa.type = LSM_AUDIT_DATA_NONE;
564 sa.aad = &aad;
565 aad.profile = aa_current_profile();
566 aad.op = OP_SETPROCATTR;
567 aad.info = name;
568 aad.error = -EINVAL;
569 aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
570 return -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700571}
572
Jiri Slaby7cb4dc92010-08-11 11:28:02 +0200573static int apparmor_task_setrlimit(struct task_struct *task,
574 unsigned int resource, struct rlimit *new_rlim)
John Johansenb5e95b42010-07-29 14:48:07 -0700575{
John Johansen1780f2d2011-06-08 15:07:47 -0700576 struct aa_profile *profile = __aa_current_profile();
John Johansenb5e95b42010-07-29 14:48:07 -0700577 int error = 0;
578
579 if (!unconfined(profile))
John Johansen3a2dc832010-09-06 10:10:20 -0700580 error = aa_task_setrlimit(profile, task, resource, new_rlim);
John Johansenb5e95b42010-07-29 14:48:07 -0700581
582 return error;
583}
584
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700585static struct security_hook_list apparmor_hooks[] = {
Casey Schauflere20b0432015-05-02 15:11:36 -0700586 LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
587 LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
588 LSM_HOOK_INIT(capget, apparmor_capget),
589 LSM_HOOK_INIT(capable, apparmor_capable),
John Johansenb5e95b42010-07-29 14:48:07 -0700590
Casey Schauflere20b0432015-05-02 15:11:36 -0700591 LSM_HOOK_INIT(path_link, apparmor_path_link),
592 LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
593 LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
594 LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
595 LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
596 LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
597 LSM_HOOK_INIT(path_rename, apparmor_path_rename),
598 LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
599 LSM_HOOK_INIT(path_chown, apparmor_path_chown),
600 LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
601 LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700602
Casey Schauflere20b0432015-05-02 15:11:36 -0700603 LSM_HOOK_INIT(file_open, apparmor_file_open),
604 LSM_HOOK_INIT(file_permission, apparmor_file_permission),
605 LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
606 LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
607 LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
Casey Schauflere20b0432015-05-02 15:11:36 -0700608 LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
609 LSM_HOOK_INIT(file_lock, apparmor_file_lock),
John Johansenb5e95b42010-07-29 14:48:07 -0700610
Casey Schauflere20b0432015-05-02 15:11:36 -0700611 LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
612 LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700613
Casey Schauflere20b0432015-05-02 15:11:36 -0700614 LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
615 LSM_HOOK_INIT(cred_free, apparmor_cred_free),
616 LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
617 LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
John Johansenb5e95b42010-07-29 14:48:07 -0700618
Casey Schauflere20b0432015-05-02 15:11:36 -0700619 LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
620 LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
621 LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
622 LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
John Johansenb5e95b42010-07-29 14:48:07 -0700623
Casey Schauflere20b0432015-05-02 15:11:36 -0700624 LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
John Johansenb5e95b42010-07-29 14:48:07 -0700625};
626
627/*
628 * AppArmor sysfs module parameters
629 */
630
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000631static int param_set_aabool(const char *val, const struct kernel_param *kp);
632static int param_get_aabool(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030633#define param_check_aabool param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930634static const struct kernel_param_ops param_ops_aabool = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930635 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000636 .set = param_set_aabool,
637 .get = param_get_aabool
638};
John Johansenb5e95b42010-07-29 14:48:07 -0700639
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000640static int param_set_aauint(const char *val, const struct kernel_param *kp);
641static int param_get_aauint(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030642#define param_check_aauint param_check_uint
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930643static const struct kernel_param_ops param_ops_aauint = {
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000644 .set = param_set_aauint,
645 .get = param_get_aauint
646};
John Johansenb5e95b42010-07-29 14:48:07 -0700647
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000648static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
649static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030650#define param_check_aalockpolicy param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930651static const struct kernel_param_ops param_ops_aalockpolicy = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930652 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000653 .set = param_set_aalockpolicy,
654 .get = param_get_aalockpolicy
655};
John Johansenb5e95b42010-07-29 14:48:07 -0700656
657static int param_set_audit(const char *val, struct kernel_param *kp);
658static int param_get_audit(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700659
660static int param_set_mode(const char *val, struct kernel_param *kp);
661static int param_get_mode(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700662
663/* Flag values, also controllable via /sys/module/apparmor/parameters
664 * We define special types as we want to do additional mediation.
665 */
666
667/* AppArmor global enforcement switch - complain, enforce, kill */
668enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
669module_param_call(mode, param_set_mode, param_get_mode,
670 &aa_g_profile_mode, S_IRUSR | S_IWUSR);
671
672/* Debug mode */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030673bool aa_g_debug;
John Johansenb5e95b42010-07-29 14:48:07 -0700674module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
675
676/* Audit mode */
677enum audit_mode aa_g_audit;
678module_param_call(audit, param_set_audit, param_get_audit,
679 &aa_g_audit, S_IRUSR | S_IWUSR);
680
681/* Determines if audit header is included in audited messages. This
682 * provides more context if the audit daemon is not running
683 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030684bool aa_g_audit_header = 1;
John Johansenb5e95b42010-07-29 14:48:07 -0700685module_param_named(audit_header, aa_g_audit_header, aabool,
686 S_IRUSR | S_IWUSR);
687
688/* lock out loading/removal of policy
689 * TODO: add in at boot loading of policy, which is the only way to
690 * load policy, if lock_policy is set
691 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030692bool aa_g_lock_policy;
John Johansenb5e95b42010-07-29 14:48:07 -0700693module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
694 S_IRUSR | S_IWUSR);
695
696/* Syscall logging mode */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030697bool aa_g_logsyscall;
John Johansenb5e95b42010-07-29 14:48:07 -0700698module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
699
700/* Maximum pathname length before accesses will start getting rejected */
701unsigned int aa_g_path_max = 2 * PATH_MAX;
702module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
703
704/* Determines how paranoid loading of policy is and how much verification
705 * on the loaded policy is done.
706 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030707bool aa_g_paranoid_load = 1;
John Johansenb5e95b42010-07-29 14:48:07 -0700708module_param_named(paranoid_load, aa_g_paranoid_load, aabool,
709 S_IRUSR | S_IWUSR);
710
711/* Boot time disable flag */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030712static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
John Johansenc6116162013-07-10 21:03:43 -0700713module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
John Johansenb5e95b42010-07-29 14:48:07 -0700714
715static int __init apparmor_enabled_setup(char *str)
716{
717 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900718 int error = kstrtoul(str, 0, &enabled);
John Johansenb5e95b42010-07-29 14:48:07 -0700719 if (!error)
720 apparmor_enabled = enabled ? 1 : 0;
721 return 1;
722}
723
724__setup("apparmor=", apparmor_enabled_setup);
725
726/* set global flag turning off the ability to load policy */
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000727static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700728{
729 if (!capable(CAP_MAC_ADMIN))
730 return -EPERM;
731 if (aa_g_lock_policy)
732 return -EACCES;
733 return param_set_bool(val, kp);
734}
735
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000736static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700737{
738 if (!capable(CAP_MAC_ADMIN))
739 return -EPERM;
740 return param_get_bool(buffer, kp);
741}
742
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000743static int param_set_aabool(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700744{
745 if (!capable(CAP_MAC_ADMIN))
746 return -EPERM;
747 return param_set_bool(val, kp);
748}
749
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000750static int param_get_aabool(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700751{
752 if (!capable(CAP_MAC_ADMIN))
753 return -EPERM;
754 return param_get_bool(buffer, kp);
755}
756
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000757static int param_set_aauint(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700758{
759 if (!capable(CAP_MAC_ADMIN))
760 return -EPERM;
761 return param_set_uint(val, kp);
762}
763
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000764static int param_get_aauint(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700765{
766 if (!capable(CAP_MAC_ADMIN))
767 return -EPERM;
768 return param_get_uint(buffer, kp);
769}
770
771static int param_get_audit(char *buffer, struct kernel_param *kp)
772{
773 if (!capable(CAP_MAC_ADMIN))
774 return -EPERM;
775
776 if (!apparmor_enabled)
777 return -EINVAL;
778
779 return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
780}
781
782static int param_set_audit(const char *val, struct kernel_param *kp)
783{
784 int i;
785 if (!capable(CAP_MAC_ADMIN))
786 return -EPERM;
787
788 if (!apparmor_enabled)
789 return -EINVAL;
790
791 if (!val)
792 return -EINVAL;
793
794 for (i = 0; i < AUDIT_MAX_INDEX; i++) {
795 if (strcmp(val, audit_mode_names[i]) == 0) {
796 aa_g_audit = i;
797 return 0;
798 }
799 }
800
801 return -EINVAL;
802}
803
804static int param_get_mode(char *buffer, struct kernel_param *kp)
805{
806 if (!capable(CAP_MAC_ADMIN))
807 return -EPERM;
808
809 if (!apparmor_enabled)
810 return -EINVAL;
811
John Johansen0d259f02013-07-10 21:13:43 -0700812 return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
John Johansenb5e95b42010-07-29 14:48:07 -0700813}
814
815static int param_set_mode(const char *val, struct kernel_param *kp)
816{
817 int i;
818 if (!capable(CAP_MAC_ADMIN))
819 return -EPERM;
820
821 if (!apparmor_enabled)
822 return -EINVAL;
823
824 if (!val)
825 return -EINVAL;
826
John Johansen0d259f02013-07-10 21:13:43 -0700827 for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) {
828 if (strcmp(val, aa_profile_mode_names[i]) == 0) {
John Johansenb5e95b42010-07-29 14:48:07 -0700829 aa_g_profile_mode = i;
830 return 0;
831 }
832 }
833
834 return -EINVAL;
835}
836
837/*
838 * AppArmor init functions
839 */
840
841/**
842 * set_init_cxt - set a task context and profile on the first task.
843 *
844 * TODO: allow setting an alternate profile than unconfined
845 */
846static int __init set_init_cxt(void)
847{
848 struct cred *cred = (struct cred *)current->real_cred;
849 struct aa_task_cxt *cxt;
850
851 cxt = aa_alloc_task_context(GFP_KERNEL);
852 if (!cxt)
853 return -ENOMEM;
854
855 cxt->profile = aa_get_profile(root_ns->unconfined);
John Johansen214beac2013-02-27 03:43:40 -0800856 cred_cxt(cred) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -0700857
858 return 0;
859}
860
861static int __init apparmor_init(void)
862{
863 int error;
864
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700865 if (!apparmor_enabled || !security_module_enable("apparmor")) {
John Johansenb5e95b42010-07-29 14:48:07 -0700866 aa_info_message("AppArmor disabled by boot time parameter");
867 apparmor_enabled = 0;
868 return 0;
869 }
870
871 error = aa_alloc_root_ns();
872 if (error) {
873 AA_ERROR("Unable to allocate default profile namespace\n");
874 goto alloc_out;
875 }
876
877 error = set_init_cxt();
878 if (error) {
879 AA_ERROR("Failed to set context on init task\n");
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700880 aa_free_root_ns();
881 goto alloc_out;
John Johansenb5e95b42010-07-29 14:48:07 -0700882 }
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700883 security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
John Johansenb5e95b42010-07-29 14:48:07 -0700884
885 /* Report that AppArmor successfully initialized */
886 apparmor_initialized = 1;
887 if (aa_g_profile_mode == APPARMOR_COMPLAIN)
888 aa_info_message("AppArmor initialized: complain mode enabled");
889 else if (aa_g_profile_mode == APPARMOR_KILL)
890 aa_info_message("AppArmor initialized: kill mode enabled");
891 else
892 aa_info_message("AppArmor initialized");
893
894 return error;
895
John Johansenb5e95b42010-07-29 14:48:07 -0700896alloc_out:
897 aa_destroy_aafs();
898
899 apparmor_enabled = 0;
900 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700901}
902
903security_initcall(apparmor_init);