blob: 41b8cb115801724172ce48cbb3ac6b3d96a8d6f6 [file] [log] [blame]
John Johansenb5e95b42010-07-29 14:48:07 -07001/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor LSM hooks.
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 */
14
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070015#include <linux/lsm_hooks.h>
John Johansenb5e95b42010-07-29 14:48:07 -070016#include <linux/moduleparam.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/mount.h>
20#include <linux/namei.h>
21#include <linux/ptrace.h>
22#include <linux/ctype.h>
23#include <linux/sysctl.h>
24#include <linux/audit.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070025#include <linux/user_namespace.h>
John Johansenb5e95b42010-07-29 14:48:07 -070026#include <net/sock.h>
27
28#include "include/apparmor.h"
29#include "include/apparmorfs.h"
30#include "include/audit.h"
31#include "include/capability.h"
32#include "include/context.h"
33#include "include/file.h"
34#include "include/ipc.h"
35#include "include/path.h"
36#include "include/policy.h"
37#include "include/procattr.h"
38
39/* Flag indicating whether initialization completed */
40int apparmor_initialized __initdata;
41
42/*
43 * LSM hook functions
44 */
45
46/*
47 * free the associated aa_task_cxt and put its profiles
48 */
49static void apparmor_cred_free(struct cred *cred)
50{
John Johansen214beac2013-02-27 03:43:40 -080051 aa_free_task_context(cred_cxt(cred));
52 cred_cxt(cred) = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -070053}
54
55/*
56 * allocate the apparmor part of blank credentials
57 */
58static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
59{
60 /* freed by apparmor_cred_free */
61 struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
62 if (!cxt)
63 return -ENOMEM;
64
John Johansen214beac2013-02-27 03:43:40 -080065 cred_cxt(cred) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -070066 return 0;
67}
68
69/*
70 * prepare new aa_task_cxt for modification by prepare_cred block
71 */
72static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
73 gfp_t gfp)
74{
75 /* freed by apparmor_cred_free */
76 struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
77 if (!cxt)
78 return -ENOMEM;
79
John Johansen214beac2013-02-27 03:43:40 -080080 aa_dup_task_context(cxt, cred_cxt(old));
81 cred_cxt(new) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -070082 return 0;
83}
84
85/*
86 * transfer the apparmor data to a blank set of creds
87 */
88static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
89{
John Johansen214beac2013-02-27 03:43:40 -080090 const struct aa_task_cxt *old_cxt = cred_cxt(old);
91 struct aa_task_cxt *new_cxt = cred_cxt(new);
John Johansenb5e95b42010-07-29 14:48:07 -070092
93 aa_dup_task_context(new_cxt, old_cxt);
94}
95
96static int apparmor_ptrace_access_check(struct task_struct *child,
97 unsigned int mode)
98{
John Johansenb5e95b42010-07-29 14:48:07 -070099 return aa_ptrace(current, child, mode);
100}
101
102static int apparmor_ptrace_traceme(struct task_struct *parent)
103{
John Johansenb5e95b42010-07-29 14:48:07 -0700104 return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
105}
106
107/* Derived from security/commoncap.c:cap_capget */
108static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
109 kernel_cap_t *inheritable, kernel_cap_t *permitted)
110{
111 struct aa_profile *profile;
112 const struct cred *cred;
113
114 rcu_read_lock();
115 cred = __task_cred(target);
116 profile = aa_cred_profile(cred);
117
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700118 /*
119 * cap_capget is stacked ahead of this and will
120 * initialize effective and permitted.
121 */
John Johansen25e75df2011-06-25 16:57:07 +0100122 if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
John Johansenb5e95b42010-07-29 14:48:07 -0700123 *effective = cap_intersect(*effective, profile->caps.allow);
124 *permitted = cap_intersect(*permitted, profile->caps.allow);
125 }
126 rcu_read_unlock();
127
128 return 0;
129}
130
Eric Paris6a9de492012-01-03 12:25:14 -0500131static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
132 int cap, int audit)
John Johansenb5e95b42010-07-29 14:48:07 -0700133{
134 struct aa_profile *profile;
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700135 int error = 0;
136
137 profile = aa_cred_profile(cred);
138 if (!unconfined(profile))
139 error = aa_capable(profile, cap, audit);
John Johansenb5e95b42010-07-29 14:48:07 -0700140 return error;
141}
142
143/**
144 * common_perm - basic common permission check wrapper fn for paths
145 * @op: operation being checked
146 * @path: path to check permission of (NOT NULL)
147 * @mask: requested permissions mask
148 * @cond: conditional info for the permission request (NOT NULL)
149 *
150 * Returns: %0 else error code if error or permission denied
151 */
Al Viro2c7661f2016-03-25 14:18:14 -0400152static int common_perm(int op, const struct path *path, u32 mask,
John Johansenb5e95b42010-07-29 14:48:07 -0700153 struct path_cond *cond)
154{
155 struct aa_profile *profile;
156 int error = 0;
157
158 profile = __aa_current_profile();
159 if (!unconfined(profile))
160 error = aa_path_perm(op, profile, path, 0, mask, cond);
161
162 return error;
163}
164
165/**
166 * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
167 * @op: operation being checked
168 * @dir: directory of the dentry (NOT NULL)
169 * @dentry: dentry to check (NOT NULL)
170 * @mask: requested permissions mask
171 * @cond: conditional info for the permission request (NOT NULL)
172 *
173 * Returns: %0 else error code if error or permission denied
174 */
Al Virod6b49f72016-03-25 15:10:04 -0400175static int common_perm_dir_dentry(int op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700176 struct dentry *dentry, u32 mask,
177 struct path_cond *cond)
178{
179 struct path path = { dir->mnt, dentry };
180
181 return common_perm(op, &path, mask, cond);
182}
183
184/**
Al Viro741aca72016-03-25 15:04:36 -0400185 * common_perm_path - common permission wrapper when mnt, dentry
John Johansenb5e95b42010-07-29 14:48:07 -0700186 * @op: operation being checked
Al Viro741aca72016-03-25 15:04:36 -0400187 * @path: location to check (NOT NULL)
John Johansenb5e95b42010-07-29 14:48:07 -0700188 * @mask: requested permissions mask
189 *
190 * Returns: %0 else error code if error or permission denied
191 */
Al Viro741aca72016-03-25 15:04:36 -0400192static inline int common_perm_path(int op, const struct path *path, u32 mask)
John Johansenb5e95b42010-07-29 14:48:07 -0700193{
Al Viro741aca72016-03-25 15:04:36 -0400194 struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
195 d_backing_inode(path->dentry)->i_mode
John Johansenb5e95b42010-07-29 14:48:07 -0700196 };
Al Viro741aca72016-03-25 15:04:36 -0400197 if (!mediated_filesystem(path->dentry))
198 return 0;
John Johansenb5e95b42010-07-29 14:48:07 -0700199
Al Viro741aca72016-03-25 15:04:36 -0400200 return common_perm(op, path, mask, &cond);
John Johansenb5e95b42010-07-29 14:48:07 -0700201}
202
203/**
204 * common_perm_rm - common permission wrapper for operations doing rm
205 * @op: operation being checked
206 * @dir: directory that the dentry is in (NOT NULL)
207 * @dentry: dentry being rm'd (NOT NULL)
208 * @mask: requested permission mask
209 *
210 * Returns: %0 else error code if error or permission denied
211 */
Al Virod6b49f72016-03-25 15:10:04 -0400212static int common_perm_rm(int op, const struct path *dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700213 struct dentry *dentry, u32 mask)
214{
David Howellsc6f493d2015-03-17 22:26:22 +0000215 struct inode *inode = d_backing_inode(dentry);
John Johansenb5e95b42010-07-29 14:48:07 -0700216 struct path_cond cond = { };
217
Al Viro8db01852016-03-25 15:22:49 -0400218 if (!inode || !mediated_filesystem(dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700219 return 0;
220
221 cond.uid = inode->i_uid;
222 cond.mode = inode->i_mode;
223
224 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
225}
226
227/**
228 * common_perm_create - common permission wrapper for operations doing create
229 * @op: operation being checked
230 * @dir: directory that dentry will be created in (NOT NULL)
231 * @dentry: dentry to create (NOT NULL)
232 * @mask: request permission mask
233 * @mode: created file mode
234 *
235 * Returns: %0 else error code if error or permission denied
236 */
Al Virod6b49f72016-03-25 15:10:04 -0400237static int common_perm_create(int op, const struct path *dir,
238 struct dentry *dentry, u32 mask, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700239{
240 struct path_cond cond = { current_fsuid(), mode };
241
Al Viro8db01852016-03-25 15:22:49 -0400242 if (!mediated_filesystem(dir->dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700243 return 0;
244
245 return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
246}
247
Al Viro989f74e2016-03-25 15:13:39 -0400248static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700249{
250 return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
251}
252
Al Virod3607752016-03-25 15:21:09 -0400253static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
Al Viro4572bef2011-11-21 14:56:21 -0500254 umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700255{
256 return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
257 S_IFDIR);
258}
259
Al Viro989f74e2016-03-25 15:13:39 -0400260static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700261{
262 return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
263}
264
Al Virod3607752016-03-25 15:21:09 -0400265static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
Al Viro04fc66e2011-11-21 14:58:38 -0500266 umode_t mode, unsigned int dev)
John Johansenb5e95b42010-07-29 14:48:07 -0700267{
268 return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
269}
270
Al Viro81f4c502016-03-25 14:22:01 -0400271static int apparmor_path_truncate(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700272{
Al Viro741aca72016-03-25 15:04:36 -0400273 return common_perm_path(OP_TRUNC, path, MAY_WRITE | AA_MAY_META_WRITE);
John Johansenb5e95b42010-07-29 14:48:07 -0700274}
275
Al Virod3607752016-03-25 15:21:09 -0400276static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
John Johansenb5e95b42010-07-29 14:48:07 -0700277 const char *old_name)
278{
279 return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
280 S_IFLNK);
281}
282
Al Viro3ccee462016-03-25 15:27:45 -0400283static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
John Johansenb5e95b42010-07-29 14:48:07 -0700284 struct dentry *new_dentry)
285{
286 struct aa_profile *profile;
287 int error = 0;
288
David Howells7ac28562015-01-29 12:02:31 +0000289 if (!mediated_filesystem(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700290 return 0;
291
292 profile = aa_current_profile();
293 if (!unconfined(profile))
294 error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
295 return error;
296}
297
Al Viro3ccee462016-03-25 15:27:45 -0400298static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
299 const struct path *new_dir, struct dentry *new_dentry)
John Johansenb5e95b42010-07-29 14:48:07 -0700300{
301 struct aa_profile *profile;
302 int error = 0;
303
David Howells7ac28562015-01-29 12:02:31 +0000304 if (!mediated_filesystem(old_dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700305 return 0;
306
307 profile = aa_current_profile();
308 if (!unconfined(profile)) {
309 struct path old_path = { old_dir->mnt, old_dentry };
310 struct path new_path = { new_dir->mnt, new_dentry };
David Howellsc6f493d2015-03-17 22:26:22 +0000311 struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
312 d_backing_inode(old_dentry)->i_mode
John Johansenb5e95b42010-07-29 14:48:07 -0700313 };
314
315 error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0,
316 MAY_READ | AA_MAY_META_READ | MAY_WRITE |
317 AA_MAY_META_WRITE | AA_MAY_DELETE,
318 &cond);
319 if (!error)
320 error = aa_path_perm(OP_RENAME_DEST, profile, &new_path,
321 0, MAY_WRITE | AA_MAY_META_WRITE |
322 AA_MAY_CREATE, &cond);
323
324 }
325 return error;
326}
327
Al Virobe01f9f2016-03-25 14:56:23 -0400328static int apparmor_path_chmod(const struct path *path, umode_t mode)
John Johansenb5e95b42010-07-29 14:48:07 -0700329{
Al Viro741aca72016-03-25 15:04:36 -0400330 return common_perm_path(OP_CHMOD, path, AA_MAY_CHMOD);
John Johansenb5e95b42010-07-29 14:48:07 -0700331}
332
Al Viro7fd25da2016-03-25 14:44:41 -0400333static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
John Johansenb5e95b42010-07-29 14:48:07 -0700334{
Al Viro741aca72016-03-25 15:04:36 -0400335 return common_perm_path(OP_CHOWN, path, AA_MAY_CHOWN);
John Johansenb5e95b42010-07-29 14:48:07 -0700336}
337
Al Viro3f7036a2015-03-08 19:28:30 -0400338static int apparmor_inode_getattr(const struct path *path)
John Johansenb5e95b42010-07-29 14:48:07 -0700339{
Al Viro741aca72016-03-25 15:04:36 -0400340 return common_perm_path(OP_GETATTR, path, AA_MAY_META_READ);
John Johansenb5e95b42010-07-29 14:48:07 -0700341}
342
Eric Paris83d49852012-04-04 13:45:40 -0400343static int apparmor_file_open(struct file *file, const struct cred *cred)
John Johansenb5e95b42010-07-29 14:48:07 -0700344{
345 struct aa_file_cxt *fcxt = file->f_security;
346 struct aa_profile *profile;
347 int error = 0;
348
David Howells7ac28562015-01-29 12:02:31 +0000349 if (!mediated_filesystem(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700350 return 0;
351
352 /* If in exec, permission is handled by bprm hooks.
353 * Cache permissions granted by the previous exec check, with
354 * implicit read and executable mmap which are required to
355 * actually execute the image.
356 */
357 if (current->in_execve) {
358 fcxt->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
359 return 0;
360 }
361
362 profile = aa_cred_profile(cred);
363 if (!unconfined(profile)) {
Al Viro496ad9a2013-01-23 17:07:38 -0500364 struct inode *inode = file_inode(file);
John Johansenb5e95b42010-07-29 14:48:07 -0700365 struct path_cond cond = { inode->i_uid, inode->i_mode };
366
367 error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0,
368 aa_map_file_to_perms(file), &cond);
369 /* todo cache full allowed permissions set and state */
370 fcxt->allow = aa_map_file_to_perms(file);
371 }
372
373 return error;
374}
375
376static int apparmor_file_alloc_security(struct file *file)
377{
378 /* freed by apparmor_file_free_security */
379 file->f_security = aa_alloc_file_context(GFP_KERNEL);
380 if (!file->f_security)
381 return -ENOMEM;
382 return 0;
383
384}
385
386static void apparmor_file_free_security(struct file *file)
387{
388 struct aa_file_cxt *cxt = file->f_security;
389
390 aa_free_file_context(cxt);
391}
392
393static int common_file_perm(int op, struct file *file, u32 mask)
394{
395 struct aa_file_cxt *fcxt = file->f_security;
396 struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred);
397 int error = 0;
398
399 BUG_ON(!fprofile);
400
401 if (!file->f_path.mnt ||
David Howells7ac28562015-01-29 12:02:31 +0000402 !mediated_filesystem(file->f_path.dentry))
John Johansenb5e95b42010-07-29 14:48:07 -0700403 return 0;
404
405 profile = __aa_current_profile();
406
407 /* revalidate access, if task is unconfined, or the cached cred
408 * doesn't match or if the request is for more permissions than
409 * was granted.
410 *
411 * Note: the test for !unconfined(fprofile) is to handle file
412 * delegation from unconfined tasks
413 */
414 if (!unconfined(profile) && !unconfined(fprofile) &&
415 ((fprofile != profile) || (mask & ~fcxt->allow)))
416 error = aa_file_perm(op, profile, file, mask);
417
418 return error;
419}
420
421static int apparmor_file_permission(struct file *file, int mask)
422{
423 return common_file_perm(OP_FPERM, file, mask);
424}
425
426static int apparmor_file_lock(struct file *file, unsigned int cmd)
427{
428 u32 mask = AA_MAY_LOCK;
429
430 if (cmd == F_WRLCK)
431 mask |= MAY_WRITE;
432
433 return common_file_perm(OP_FLOCK, file, mask);
434}
435
436static int common_mmap(int op, struct file *file, unsigned long prot,
437 unsigned long flags)
438{
John Johansenb5e95b42010-07-29 14:48:07 -0700439 int mask = 0;
440
441 if (!file || !file->f_security)
442 return 0;
443
444 if (prot & PROT_READ)
445 mask |= MAY_READ;
446 /*
447 * Private mappings don't require write perms since they don't
448 * write back to the files
449 */
450 if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
451 mask |= MAY_WRITE;
452 if (prot & PROT_EXEC)
453 mask |= AA_EXEC_MMAP;
454
John Johansenb5e95b42010-07-29 14:48:07 -0700455 return common_file_perm(op, file, mask);
456}
457
Al Viroe5467852012-05-30 13:30:51 -0400458static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
459 unsigned long prot, unsigned long flags)
John Johansenb5e95b42010-07-29 14:48:07 -0700460{
John Johansenb5e95b42010-07-29 14:48:07 -0700461 return common_mmap(OP_FMMAP, file, prot, flags);
462}
463
464static int apparmor_file_mprotect(struct vm_area_struct *vma,
465 unsigned long reqprot, unsigned long prot)
466{
467 return common_mmap(OP_FMPROT, vma->vm_file, prot,
468 !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
469}
470
471static int apparmor_getprocattr(struct task_struct *task, char *name,
472 char **value)
473{
474 int error = -ENOENT;
John Johansenb5e95b42010-07-29 14:48:07 -0700475 /* released below */
476 const struct cred *cred = get_task_cred(task);
John Johansen214beac2013-02-27 03:43:40 -0800477 struct aa_task_cxt *cxt = cred_cxt(cred);
John Johansen77b071b2013-07-10 21:07:43 -0700478 struct aa_profile *profile = NULL;
John Johansenb5e95b42010-07-29 14:48:07 -0700479
480 if (strcmp(name, "current") == 0)
John Johansen77b071b2013-07-10 21:07:43 -0700481 profile = aa_get_newest_profile(cxt->profile);
John Johansenb5e95b42010-07-29 14:48:07 -0700482 else if (strcmp(name, "prev") == 0 && cxt->previous)
John Johansen77b071b2013-07-10 21:07:43 -0700483 profile = aa_get_newest_profile(cxt->previous);
John Johansenb5e95b42010-07-29 14:48:07 -0700484 else if (strcmp(name, "exec") == 0 && cxt->onexec)
John Johansen77b071b2013-07-10 21:07:43 -0700485 profile = aa_get_newest_profile(cxt->onexec);
John Johansenb5e95b42010-07-29 14:48:07 -0700486 else
487 error = -EINVAL;
488
John Johansen77b071b2013-07-10 21:07:43 -0700489 if (profile)
490 error = aa_getprocattr(profile, value);
491
492 aa_put_profile(profile);
John Johansenb5e95b42010-07-29 14:48:07 -0700493 put_cred(cred);
494
495 return error;
496}
497
498static int apparmor_setprocattr(struct task_struct *task, char *name,
499 void *value, size_t size)
500{
John Johansen3eea57c2013-02-27 03:44:40 -0800501 struct common_audit_data sa;
502 struct apparmor_audit_data aad = {0,};
Vegard Nossume89b8082016-07-07 13:41:11 -0700503 char *command, *largs = NULL, *args = value;
John Johansenb5e95b42010-07-29 14:48:07 -0700504 size_t arg_size;
505 int error;
506
507 if (size == 0)
508 return -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700509 /* task can only write its own attributes */
510 if (current != task)
511 return -EACCES;
512
Vegard Nossume89b8082016-07-07 13:41:11 -0700513 /* AppArmor requires that the buffer must be null terminated atm */
514 if (args[size - 1] != '\0') {
515 /* null terminate */
516 largs = args = kmalloc(size + 1, GFP_KERNEL);
517 if (!args)
518 return -ENOMEM;
519 memcpy(args, value, size);
520 args[size] = '\0';
521 }
522
523 error = -EINVAL;
John Johansenb5e95b42010-07-29 14:48:07 -0700524 args = strim(args);
525 command = strsep(&args, " ");
526 if (!args)
Vegard Nossume89b8082016-07-07 13:41:11 -0700527 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700528 args = skip_spaces(args);
529 if (!*args)
Vegard Nossume89b8082016-07-07 13:41:11 -0700530 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700531
John Johansend4d03f72016-07-09 23:46:33 -0700532 arg_size = size - (args - (largs ? largs : (char *) value));
John Johansenb5e95b42010-07-29 14:48:07 -0700533 if (strcmp(name, "current") == 0) {
534 if (strcmp(command, "changehat") == 0) {
535 error = aa_setprocattr_changehat(args, arg_size,
536 !AA_DO_TEST);
537 } else if (strcmp(command, "permhat") == 0) {
538 error = aa_setprocattr_changehat(args, arg_size,
539 AA_DO_TEST);
540 } else if (strcmp(command, "changeprofile") == 0) {
541 error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
542 !AA_DO_TEST);
543 } else if (strcmp(command, "permprofile") == 0) {
544 error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
545 AA_DO_TEST);
John Johansen3eea57c2013-02-27 03:44:40 -0800546 } else
547 goto fail;
John Johansenb5e95b42010-07-29 14:48:07 -0700548 } else if (strcmp(name, "exec") == 0) {
John Johansen3eea57c2013-02-27 03:44:40 -0800549 if (strcmp(command, "exec") == 0)
550 error = aa_setprocattr_changeprofile(args, AA_ONEXEC,
551 !AA_DO_TEST);
552 else
553 goto fail;
554 } else
John Johansenb5e95b42010-07-29 14:48:07 -0700555 /* only support the "current" and "exec" process attributes */
Vegard Nossume89b8082016-07-07 13:41:11 -0700556 goto fail;
John Johansen3eea57c2013-02-27 03:44:40 -0800557
John Johansenb5e95b42010-07-29 14:48:07 -0700558 if (!error)
559 error = size;
Vegard Nossume89b8082016-07-07 13:41:11 -0700560out:
561 kfree(largs);
John Johansenb5e95b42010-07-29 14:48:07 -0700562 return error;
John Johansen3eea57c2013-02-27 03:44:40 -0800563
564fail:
565 sa.type = LSM_AUDIT_DATA_NONE;
566 sa.aad = &aad;
567 aad.profile = aa_current_profile();
568 aad.op = OP_SETPROCATTR;
569 aad.info = name;
Vegard Nossume89b8082016-07-07 13:41:11 -0700570 aad.error = error = -EINVAL;
John Johansen3eea57c2013-02-27 03:44:40 -0800571 aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
Vegard Nossume89b8082016-07-07 13:41:11 -0700572 goto out;
John Johansenb5e95b42010-07-29 14:48:07 -0700573}
574
Jiri Slaby7cb4dc92010-08-11 11:28:02 +0200575static int apparmor_task_setrlimit(struct task_struct *task,
576 unsigned int resource, struct rlimit *new_rlim)
John Johansenb5e95b42010-07-29 14:48:07 -0700577{
John Johansen1780f2d2011-06-08 15:07:47 -0700578 struct aa_profile *profile = __aa_current_profile();
John Johansenb5e95b42010-07-29 14:48:07 -0700579 int error = 0;
580
581 if (!unconfined(profile))
John Johansen3a2dc832010-09-06 10:10:20 -0700582 error = aa_task_setrlimit(profile, task, resource, new_rlim);
John Johansenb5e95b42010-07-29 14:48:07 -0700583
584 return error;
585}
586
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700587static struct security_hook_list apparmor_hooks[] = {
Casey Schauflere20b0432015-05-02 15:11:36 -0700588 LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
589 LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
590 LSM_HOOK_INIT(capget, apparmor_capget),
591 LSM_HOOK_INIT(capable, apparmor_capable),
John Johansenb5e95b42010-07-29 14:48:07 -0700592
Casey Schauflere20b0432015-05-02 15:11:36 -0700593 LSM_HOOK_INIT(path_link, apparmor_path_link),
594 LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
595 LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
596 LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
597 LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
598 LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
599 LSM_HOOK_INIT(path_rename, apparmor_path_rename),
600 LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
601 LSM_HOOK_INIT(path_chown, apparmor_path_chown),
602 LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
603 LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700604
Casey Schauflere20b0432015-05-02 15:11:36 -0700605 LSM_HOOK_INIT(file_open, apparmor_file_open),
606 LSM_HOOK_INIT(file_permission, apparmor_file_permission),
607 LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
608 LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
609 LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
Casey Schauflere20b0432015-05-02 15:11:36 -0700610 LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
611 LSM_HOOK_INIT(file_lock, apparmor_file_lock),
John Johansenb5e95b42010-07-29 14:48:07 -0700612
Casey Schauflere20b0432015-05-02 15:11:36 -0700613 LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
614 LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
John Johansenb5e95b42010-07-29 14:48:07 -0700615
Casey Schauflere20b0432015-05-02 15:11:36 -0700616 LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
617 LSM_HOOK_INIT(cred_free, apparmor_cred_free),
618 LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
619 LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
John Johansenb5e95b42010-07-29 14:48:07 -0700620
Casey Schauflere20b0432015-05-02 15:11:36 -0700621 LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
622 LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
623 LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
624 LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
John Johansenb5e95b42010-07-29 14:48:07 -0700625
Casey Schauflere20b0432015-05-02 15:11:36 -0700626 LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
John Johansenb5e95b42010-07-29 14:48:07 -0700627};
628
629/*
630 * AppArmor sysfs module parameters
631 */
632
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000633static int param_set_aabool(const char *val, const struct kernel_param *kp);
634static int param_get_aabool(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030635#define param_check_aabool param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930636static const struct kernel_param_ops param_ops_aabool = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930637 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000638 .set = param_set_aabool,
639 .get = param_get_aabool
640};
John Johansenb5e95b42010-07-29 14:48:07 -0700641
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000642static int param_set_aauint(const char *val, const struct kernel_param *kp);
643static int param_get_aauint(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030644#define param_check_aauint param_check_uint
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930645static const struct kernel_param_ops param_ops_aauint = {
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000646 .set = param_set_aauint,
647 .get = param_get_aauint
648};
John Johansenb5e95b42010-07-29 14:48:07 -0700649
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000650static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
651static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
Rusty Russellb8aa09f2011-12-15 13:41:32 +1030652#define param_check_aalockpolicy param_check_bool
Luis R. Rodriguez9c278472015-05-27 11:09:38 +0930653static const struct kernel_param_ops param_ops_aalockpolicy = {
Jani Nikula6a4c2642014-08-27 06:21:23 +0930654 .flags = KERNEL_PARAM_OPS_FL_NOARG,
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000655 .set = param_set_aalockpolicy,
656 .get = param_get_aalockpolicy
657};
John Johansenb5e95b42010-07-29 14:48:07 -0700658
659static int param_set_audit(const char *val, struct kernel_param *kp);
660static int param_get_audit(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700661
662static int param_set_mode(const char *val, struct kernel_param *kp);
663static int param_get_mode(char *buffer, struct kernel_param *kp);
John Johansenb5e95b42010-07-29 14:48:07 -0700664
665/* Flag values, also controllable via /sys/module/apparmor/parameters
666 * We define special types as we want to do additional mediation.
667 */
668
669/* AppArmor global enforcement switch - complain, enforce, kill */
670enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
671module_param_call(mode, param_set_mode, param_get_mode,
672 &aa_g_profile_mode, S_IRUSR | S_IWUSR);
673
Arnd Bergmann7616ac72016-07-25 10:59:07 -0700674#ifdef CONFIG_SECURITY_APPARMOR_HASH
John Johansen6059f712014-10-24 09:16:14 -0700675/* whether policy verification hashing is enabled */
Arnd Bergmann7616ac72016-07-25 10:59:07 -0700676bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
John Johansen6059f712014-10-24 09:16:14 -0700677module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
Arnd Bergmann7616ac72016-07-25 10:59:07 -0700678#endif
John Johansen6059f712014-10-24 09:16:14 -0700679
John Johansenb5e95b42010-07-29 14:48:07 -0700680/* Debug mode */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030681bool aa_g_debug;
John Johansenb5e95b42010-07-29 14:48:07 -0700682module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
683
684/* Audit mode */
685enum audit_mode aa_g_audit;
686module_param_call(audit, param_set_audit, param_get_audit,
687 &aa_g_audit, S_IRUSR | S_IWUSR);
688
689/* Determines if audit header is included in audited messages. This
690 * provides more context if the audit daemon is not running
691 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030692bool aa_g_audit_header = 1;
John Johansenb5e95b42010-07-29 14:48:07 -0700693module_param_named(audit_header, aa_g_audit_header, aabool,
694 S_IRUSR | S_IWUSR);
695
696/* lock out loading/removal of policy
697 * TODO: add in at boot loading of policy, which is the only way to
698 * load policy, if lock_policy is set
699 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030700bool aa_g_lock_policy;
John Johansenb5e95b42010-07-29 14:48:07 -0700701module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
702 S_IRUSR | S_IWUSR);
703
704/* Syscall logging mode */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030705bool aa_g_logsyscall;
John Johansenb5e95b42010-07-29 14:48:07 -0700706module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
707
708/* Maximum pathname length before accesses will start getting rejected */
709unsigned int aa_g_path_max = 2 * PATH_MAX;
710module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
711
712/* Determines how paranoid loading of policy is and how much verification
713 * on the loaded policy is done.
714 */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030715bool aa_g_paranoid_load = 1;
John Johansenb5e95b42010-07-29 14:48:07 -0700716module_param_named(paranoid_load, aa_g_paranoid_load, aabool,
717 S_IRUSR | S_IWUSR);
718
719/* Boot time disable flag */
Rusty Russell90ab5ee2012-01-13 09:32:20 +1030720static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
John Johansenc6116162013-07-10 21:03:43 -0700721module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
John Johansenb5e95b42010-07-29 14:48:07 -0700722
723static int __init apparmor_enabled_setup(char *str)
724{
725 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900726 int error = kstrtoul(str, 0, &enabled);
John Johansenb5e95b42010-07-29 14:48:07 -0700727 if (!error)
728 apparmor_enabled = enabled ? 1 : 0;
729 return 1;
730}
731
732__setup("apparmor=", apparmor_enabled_setup);
733
734/* set global flag turning off the ability to load policy */
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000735static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700736{
John Johansen58acf9d2016-06-22 18:01:08 -0700737 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700738 return -EPERM;
John Johansenb5e95b42010-07-29 14:48:07 -0700739 return param_set_bool(val, kp);
740}
741
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000742static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700743{
John Johansen58acf9d2016-06-22 18:01:08 -0700744 if (!policy_view_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700745 return -EPERM;
746 return param_get_bool(buffer, kp);
747}
748
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000749static int param_set_aabool(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700750{
John Johansen58acf9d2016-06-22 18:01:08 -0700751 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700752 return -EPERM;
753 return param_set_bool(val, kp);
754}
755
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000756static int param_get_aabool(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700757{
John Johansen58acf9d2016-06-22 18:01:08 -0700758 if (!policy_view_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700759 return -EPERM;
760 return param_get_bool(buffer, kp);
761}
762
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000763static int param_set_aauint(const char *val, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700764{
John Johansen58acf9d2016-06-22 18:01:08 -0700765 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700766 return -EPERM;
767 return param_set_uint(val, kp);
768}
769
Stephen Rothwell101d6c82010-08-02 12:00:43 +1000770static int param_get_aauint(char *buffer, const struct kernel_param *kp)
John Johansenb5e95b42010-07-29 14:48:07 -0700771{
John Johansen58acf9d2016-06-22 18:01:08 -0700772 if (!policy_view_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700773 return -EPERM;
774 return param_get_uint(buffer, kp);
775}
776
777static int param_get_audit(char *buffer, struct kernel_param *kp)
778{
John Johansen58acf9d2016-06-22 18:01:08 -0700779 if (!policy_view_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700780 return -EPERM;
781
782 if (!apparmor_enabled)
783 return -EINVAL;
784
785 return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
786}
787
788static int param_set_audit(const char *val, struct kernel_param *kp)
789{
790 int i;
John Johansen58acf9d2016-06-22 18:01:08 -0700791 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700792 return -EPERM;
793
794 if (!apparmor_enabled)
795 return -EINVAL;
796
797 if (!val)
798 return -EINVAL;
799
800 for (i = 0; i < AUDIT_MAX_INDEX; i++) {
801 if (strcmp(val, audit_mode_names[i]) == 0) {
802 aa_g_audit = i;
803 return 0;
804 }
805 }
806
807 return -EINVAL;
808}
809
810static int param_get_mode(char *buffer, struct kernel_param *kp)
811{
John Johansen58acf9d2016-06-22 18:01:08 -0700812 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700813 return -EPERM;
814
815 if (!apparmor_enabled)
816 return -EINVAL;
817
John Johansen0d259f02013-07-10 21:13:43 -0700818 return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
John Johansenb5e95b42010-07-29 14:48:07 -0700819}
820
821static int param_set_mode(const char *val, struct kernel_param *kp)
822{
823 int i;
John Johansen58acf9d2016-06-22 18:01:08 -0700824 if (!policy_admin_capable())
John Johansenb5e95b42010-07-29 14:48:07 -0700825 return -EPERM;
826
827 if (!apparmor_enabled)
828 return -EINVAL;
829
830 if (!val)
831 return -EINVAL;
832
John Johansen0d259f02013-07-10 21:13:43 -0700833 for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) {
834 if (strcmp(val, aa_profile_mode_names[i]) == 0) {
John Johansenb5e95b42010-07-29 14:48:07 -0700835 aa_g_profile_mode = i;
836 return 0;
837 }
838 }
839
840 return -EINVAL;
841}
842
843/*
844 * AppArmor init functions
845 */
846
847/**
848 * set_init_cxt - set a task context and profile on the first task.
849 *
850 * TODO: allow setting an alternate profile than unconfined
851 */
852static int __init set_init_cxt(void)
853{
854 struct cred *cred = (struct cred *)current->real_cred;
855 struct aa_task_cxt *cxt;
856
857 cxt = aa_alloc_task_context(GFP_KERNEL);
858 if (!cxt)
859 return -ENOMEM;
860
861 cxt->profile = aa_get_profile(root_ns->unconfined);
John Johansen214beac2013-02-27 03:43:40 -0800862 cred_cxt(cred) = cxt;
John Johansenb5e95b42010-07-29 14:48:07 -0700863
864 return 0;
865}
866
867static int __init apparmor_init(void)
868{
869 int error;
870
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700871 if (!apparmor_enabled || !security_module_enable("apparmor")) {
John Johansenb5e95b42010-07-29 14:48:07 -0700872 aa_info_message("AppArmor disabled by boot time parameter");
873 apparmor_enabled = 0;
874 return 0;
875 }
876
877 error = aa_alloc_root_ns();
878 if (error) {
879 AA_ERROR("Unable to allocate default profile namespace\n");
880 goto alloc_out;
881 }
882
883 error = set_init_cxt();
884 if (error) {
885 AA_ERROR("Failed to set context on init task\n");
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700886 aa_free_root_ns();
887 goto alloc_out;
John Johansenb5e95b42010-07-29 14:48:07 -0700888 }
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700889 security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
John Johansenb5e95b42010-07-29 14:48:07 -0700890
891 /* Report that AppArmor successfully initialized */
892 apparmor_initialized = 1;
893 if (aa_g_profile_mode == APPARMOR_COMPLAIN)
894 aa_info_message("AppArmor initialized: complain mode enabled");
895 else if (aa_g_profile_mode == APPARMOR_KILL)
896 aa_info_message("AppArmor initialized: kill mode enabled");
897 else
898 aa_info_message("AppArmor initialized");
899
900 return error;
901
John Johansenb5e95b42010-07-29 14:48:07 -0700902alloc_out:
903 aa_destroy_aafs();
904
905 apparmor_enabled = 0;
906 return error;
John Johansenb5e95b42010-07-29 14:48:07 -0700907}
908
909security_initcall(apparmor_init);