John Johansen | c88d4c7 | 2010-07-29 14:48:00 -0700 | [diff] [blame] | 1 | /* |
| 2 | * AppArmor security module |
| 3 | * |
| 4 | * This file contains AppArmor policy definitions. |
| 5 | * |
| 6 | * Copyright (C) 1998-2008 Novell/SUSE |
| 7 | * Copyright 2009-2010 Canonical Ltd. |
| 8 | * |
| 9 | * This program is free software; you can redistribute it and/or |
| 10 | * modify it under the terms of the GNU General Public License as |
| 11 | * published by the Free Software Foundation, version 2 of the |
| 12 | * License. |
| 13 | */ |
| 14 | |
| 15 | #ifndef __AA_POLICY_H |
| 16 | #define __AA_POLICY_H |
| 17 | |
| 18 | #include <linux/capability.h> |
| 19 | #include <linux/cred.h> |
| 20 | #include <linux/kref.h> |
| 21 | #include <linux/sched.h> |
| 22 | #include <linux/slab.h> |
| 23 | #include <linux/socket.h> |
| 24 | |
| 25 | #include "apparmor.h" |
| 26 | #include "audit.h" |
| 27 | #include "capability.h" |
| 28 | #include "domain.h" |
| 29 | #include "file.h" |
| 30 | #include "resource.h" |
| 31 | |
| 32 | extern const char *profile_mode_names[]; |
| 33 | #define APPARMOR_NAMES_MAX_INDEX 3 |
| 34 | |
| 35 | #define COMPLAIN_MODE(_profile) \ |
| 36 | ((aa_g_profile_mode == APPARMOR_COMPLAIN) || \ |
| 37 | ((_profile)->mode == APPARMOR_COMPLAIN)) |
| 38 | |
| 39 | #define KILL_MODE(_profile) \ |
| 40 | ((aa_g_profile_mode == APPARMOR_KILL) || \ |
| 41 | ((_profile)->mode == APPARMOR_KILL)) |
| 42 | |
| 43 | #define PROFILE_IS_HAT(_profile) ((_profile)->flags & PFLAG_HAT) |
| 44 | |
| 45 | /* |
| 46 | * FIXME: currently need a clean way to replace and remove profiles as a |
| 47 | * set. It should be done at the namespace level. |
| 48 | * Either, with a set of profiles loaded at the namespace level or via |
| 49 | * a mark and remove marked interface. |
| 50 | */ |
| 51 | enum profile_mode { |
| 52 | APPARMOR_ENFORCE, /* enforce access rules */ |
| 53 | APPARMOR_COMPLAIN, /* allow and log access violations */ |
| 54 | APPARMOR_KILL, /* kill task on access violation */ |
| 55 | }; |
| 56 | |
| 57 | enum profile_flags { |
| 58 | PFLAG_HAT = 1, /* profile is a hat */ |
| 59 | PFLAG_UNCONFINED = 2, /* profile is an unconfined profile */ |
| 60 | PFLAG_NULL = 4, /* profile is null learning profile */ |
| 61 | PFLAG_IX_ON_NAME_ERROR = 8, /* fallback to ix on name lookup fail */ |
| 62 | PFLAG_IMMUTABLE = 0x10, /* don't allow changes/replacement */ |
| 63 | PFLAG_USER_DEFINED = 0x20, /* user based profile - lower privs */ |
| 64 | PFLAG_NO_LIST_REF = 0x40, /* list doesn't keep profile ref */ |
| 65 | PFLAG_OLD_NULL_TRANS = 0x100, /* use // as the null transition */ |
| 66 | |
| 67 | /* These flags must correspond with PATH_flags */ |
| 68 | PFLAG_MEDIATE_DELETED = 0x10000, /* mediate instead delegate deleted */ |
| 69 | }; |
| 70 | |
| 71 | struct aa_profile; |
| 72 | |
| 73 | /* struct aa_policy - common part of both namespaces and profiles |
| 74 | * @name: name of the object |
| 75 | * @hname - The hierarchical name |
| 76 | * @count: reference count of the obj |
| 77 | * @list: list policy object is on |
| 78 | * @profiles: head of the profiles list contained in the object |
| 79 | */ |
| 80 | struct aa_policy { |
| 81 | char *name; |
| 82 | char *hname; |
| 83 | struct kref count; |
| 84 | struct list_head list; |
| 85 | struct list_head profiles; |
| 86 | }; |
| 87 | |
| 88 | /* struct aa_ns_acct - accounting of profiles in namespace |
| 89 | * @max_size: maximum space allowed for all profiles in namespace |
| 90 | * @max_count: maximum number of profiles that can be in this namespace |
| 91 | * @size: current size of profiles |
| 92 | * @count: current count of profiles (includes null profiles) |
| 93 | */ |
| 94 | struct aa_ns_acct { |
| 95 | int max_size; |
| 96 | int max_count; |
| 97 | int size; |
| 98 | int count; |
| 99 | }; |
| 100 | |
| 101 | /* struct aa_namespace - namespace for a set of profiles |
| 102 | * @base: common policy |
| 103 | * @parent: parent of namespace |
| 104 | * @lock: lock for modifying the object |
| 105 | * @acct: accounting for the namespace |
| 106 | * @unconfined: special unconfined profile for the namespace |
| 107 | * @sub_ns: list of namespaces under the current namespace. |
| 108 | * |
| 109 | * An aa_namespace defines the set profiles that are searched to determine |
| 110 | * which profile to attach to a task. Profiles can not be shared between |
| 111 | * aa_namespaces and profile names within a namespace are guaranteed to be |
| 112 | * unique. When profiles in separate namespaces have the same name they |
| 113 | * are NOT considered to be equivalent. |
| 114 | * |
| 115 | * Namespaces are hierarchical and only namespaces and profiles below the |
| 116 | * current namespace are visible. |
| 117 | * |
| 118 | * Namespace names must be unique and can not contain the characters :/\0 |
| 119 | * |
| 120 | * FIXME TODO: add vserver support of namespaces (can it all be done in |
| 121 | * userspace?) |
| 122 | */ |
| 123 | struct aa_namespace { |
| 124 | struct aa_policy base; |
| 125 | struct aa_namespace *parent; |
| 126 | rwlock_t lock; |
| 127 | struct aa_ns_acct acct; |
| 128 | struct aa_profile *unconfined; |
| 129 | struct list_head sub_ns; |
| 130 | }; |
| 131 | |
| 132 | /* struct aa_profile - basic confinement data |
| 133 | * @base - base components of the profile (name, refcount, lists, lock ...) |
| 134 | * @parent: parent of profile |
| 135 | * @ns: namespace the profile is in |
| 136 | * @replacedby: is set to the profile that replaced this profile |
| 137 | * @rename: optional profile name that this profile renamed |
| 138 | * @xmatch: optional extended matching for unconfined executables names |
| 139 | * @xmatch_len: xmatch prefix len, used to determine xmatch priority |
| 140 | * @sid: the unique security id number of this profile |
| 141 | * @audit: the auditing mode of the profile |
| 142 | * @mode: the enforcement mode of the profile |
| 143 | * @flags: flags controlling profile behavior |
| 144 | * @path_flags: flags controlling path generation behavior |
| 145 | * @size: the memory consumed by this profiles rules |
| 146 | * @file: The set of rules governing basic file access and domain transitions |
| 147 | * @caps: capabilities for the profile |
| 148 | * @rlimits: rlimits for the profile |
| 149 | * |
| 150 | * The AppArmor profile contains the basic confinement data. Each profile |
| 151 | * has a name, and exists in a namespace. The @name and @exec_match are |
| 152 | * used to determine profile attachment against unconfined tasks. All other |
| 153 | * attachments are determined by profile X transition rules. |
| 154 | * |
| 155 | * The @replacedby field is write protected by the profile lock. Reads |
| 156 | * are assumed to be atomic, and are done without locking. |
| 157 | * |
| 158 | * Profiles have a hierarchy where hats and children profiles keep |
| 159 | * a reference to their parent. |
| 160 | * |
| 161 | * Profile names can not begin with a : and can not contain the \0 |
| 162 | * character. If a profile name begins with / it will be considered when |
| 163 | * determining profile attachment on "unconfined" tasks. |
| 164 | */ |
| 165 | struct aa_profile { |
| 166 | struct aa_policy base; |
| 167 | struct aa_profile *parent; |
| 168 | |
| 169 | struct aa_namespace *ns; |
| 170 | struct aa_profile *replacedby; |
| 171 | const char *rename; |
| 172 | |
| 173 | struct aa_dfa *xmatch; |
| 174 | int xmatch_len; |
| 175 | u32 sid; |
| 176 | enum audit_mode audit; |
| 177 | enum profile_mode mode; |
| 178 | u32 flags; |
| 179 | u32 path_flags; |
| 180 | int size; |
| 181 | |
| 182 | struct aa_file_rules file; |
| 183 | struct aa_caps caps; |
| 184 | struct aa_rlimit rlimits; |
| 185 | }; |
| 186 | |
| 187 | extern struct aa_namespace *root_ns; |
| 188 | extern enum profile_mode aa_g_profile_mode; |
| 189 | |
| 190 | void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); |
| 191 | |
| 192 | bool aa_ns_visible(struct aa_namespace *curr, struct aa_namespace *view); |
| 193 | const char *aa_ns_name(struct aa_namespace *parent, struct aa_namespace *child); |
| 194 | int aa_alloc_root_ns(void); |
| 195 | void aa_free_root_ns(void); |
| 196 | void aa_free_namespace_kref(struct kref *kref); |
| 197 | |
| 198 | struct aa_namespace *aa_find_namespace(struct aa_namespace *root, |
| 199 | const char *name); |
| 200 | |
| 201 | static inline struct aa_policy *aa_get_common(struct aa_policy *c) |
| 202 | { |
| 203 | if (c) |
| 204 | kref_get(&c->count); |
| 205 | |
| 206 | return c; |
| 207 | } |
| 208 | |
| 209 | /** |
| 210 | * aa_get_namespace - increment references count on @ns |
| 211 | * @ns: namespace to increment reference count of (MAYBE NULL) |
| 212 | * |
| 213 | * Returns: pointer to @ns, if @ns is NULL returns NULL |
| 214 | * Requires: @ns must be held with valid refcount when called |
| 215 | */ |
| 216 | static inline struct aa_namespace *aa_get_namespace(struct aa_namespace *ns) |
| 217 | { |
| 218 | if (ns) |
| 219 | kref_get(&(ns->base.count)); |
| 220 | |
| 221 | return ns; |
| 222 | } |
| 223 | |
| 224 | /** |
| 225 | * aa_put_namespace - decrement refcount on @ns |
| 226 | * @ns: namespace to put reference of |
| 227 | * |
| 228 | * Decrement reference count of @ns and if no longer in use free it |
| 229 | */ |
| 230 | static inline void aa_put_namespace(struct aa_namespace *ns) |
| 231 | { |
| 232 | if (ns) |
| 233 | kref_put(&ns->base.count, aa_free_namespace_kref); |
| 234 | } |
| 235 | |
| 236 | struct aa_profile *aa_alloc_profile(const char *name); |
| 237 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat); |
| 238 | void aa_free_profile_kref(struct kref *kref); |
| 239 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); |
| 240 | struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *name); |
| 241 | struct aa_profile *aa_match_profile(struct aa_namespace *ns, const char *name); |
| 242 | |
| 243 | ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace); |
| 244 | ssize_t aa_remove_profiles(char *name, size_t size); |
| 245 | |
| 246 | #define PROF_ADD 1 |
| 247 | #define PROF_REPLACE 0 |
| 248 | |
| 249 | #define unconfined(X) ((X)->flags & PFLAG_UNCONFINED) |
| 250 | |
| 251 | /** |
| 252 | * aa_newest_version - find the newest version of @profile |
| 253 | * @profile: the profile to check for newer versions of (NOT NULL) |
| 254 | * |
| 255 | * Returns: newest version of @profile, if @profile is the newest version |
| 256 | * return @profile. |
| 257 | * |
| 258 | * NOTE: the profile returned is not refcounted, The refcount on @profile |
| 259 | * must be held until the caller decides what to do with the returned newest |
| 260 | * version. |
| 261 | */ |
| 262 | static inline struct aa_profile *aa_newest_version(struct aa_profile *profile) |
| 263 | { |
| 264 | while (profile->replacedby) |
| 265 | profile = profile->replacedby; |
| 266 | |
| 267 | return profile; |
| 268 | } |
| 269 | |
| 270 | /** |
| 271 | * aa_get_profile - increment refcount on profile @p |
| 272 | * @p: profile (MAYBE NULL) |
| 273 | * |
| 274 | * Returns: pointer to @p if @p is NULL will return NULL |
| 275 | * Requires: @p must be held with valid refcount when called |
| 276 | */ |
| 277 | static inline struct aa_profile *aa_get_profile(struct aa_profile *p) |
| 278 | { |
| 279 | if (p) |
| 280 | kref_get(&(p->base.count)); |
| 281 | |
| 282 | return p; |
| 283 | } |
| 284 | |
| 285 | /** |
| 286 | * aa_put_profile - decrement refcount on profile @p |
| 287 | * @p: profile (MAYBE NULL) |
| 288 | */ |
| 289 | static inline void aa_put_profile(struct aa_profile *p) |
| 290 | { |
| 291 | if (p) |
| 292 | kref_put(&p->base.count, aa_free_profile_kref); |
| 293 | } |
| 294 | |
| 295 | static inline int AUDIT_MODE(struct aa_profile *profile) |
| 296 | { |
| 297 | if (aa_g_audit != AUDIT_NORMAL) |
| 298 | return aa_g_audit; |
| 299 | |
| 300 | return profile->audit; |
| 301 | } |
| 302 | |
| 303 | bool aa_may_manage_policy(int op); |
| 304 | |
| 305 | #endif /* __AA_POLICY_H */ |