blob: 8a5632f397519e4e2c409989b5f90a4fd3f050c7 [file] [log] [blame]
John Johansencff281f2017-01-16 00:42:15 -08001/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor policy manipulation functions
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2017 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 *
14 * AppArmor policy namespaces, allow for different sets of policies
15 * to be loaded for tasks within the namespace.
16 */
17
18#include <linux/list.h>
19#include <linux/mutex.h>
20#include <linux/slab.h>
21#include <linux/string.h>
22
23#include "include/apparmor.h"
24#include "include/context.h"
25#include "include/policy_ns.h"
26#include "include/policy.h"
27
28/* root profile namespace */
John Johansen98849df2017-01-16 00:42:16 -080029struct aa_ns *root_ns;
John Johansencff281f2017-01-16 00:42:15 -080030const char *aa_hidden_ns_name = "---";
31
32/**
33 * aa_ns_visible - test if @view is visible from @curr
34 * @curr: namespace to treat as the parent (NOT NULL)
35 * @view: namespace to test if visible from @curr (NOT NULL)
John Johansen92b6d8e2017-01-16 00:42:25 -080036 * @subns: whether view of a subns is allowed
John Johansencff281f2017-01-16 00:42:15 -080037 *
38 * Returns: true if @view is visible from @curr else false
39 */
John Johansen92b6d8e2017-01-16 00:42:25 -080040bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns)
John Johansencff281f2017-01-16 00:42:15 -080041{
42 if (curr == view)
43 return true;
44
John Johansen92b6d8e2017-01-16 00:42:25 -080045 if (!subns)
46 return false;
47
John Johansencff281f2017-01-16 00:42:15 -080048 for ( ; view; view = view->parent) {
49 if (view->parent == curr)
50 return true;
51 }
John Johansen92b6d8e2017-01-16 00:42:25 -080052
John Johansencff281f2017-01-16 00:42:15 -080053 return false;
54}
55
56/**
57 * aa_na_name - Find the ns name to display for @view from @curr
58 * @curr - current namespace (NOT NULL)
59 * @view - namespace attempting to view (NOT NULL)
John Johansen92b6d8e2017-01-16 00:42:25 -080060 * @subns - are subns visible
John Johansencff281f2017-01-16 00:42:15 -080061 *
62 * Returns: name of @view visible from @curr
63 */
John Johansen92b6d8e2017-01-16 00:42:25 -080064const char *aa_ns_name(struct aa_ns *curr, struct aa_ns *view, bool subns)
John Johansencff281f2017-01-16 00:42:15 -080065{
66 /* if view == curr then the namespace name isn't displayed */
67 if (curr == view)
68 return "";
69
John Johansen92b6d8e2017-01-16 00:42:25 -080070 if (aa_ns_visible(curr, view, subns)) {
John Johansencff281f2017-01-16 00:42:15 -080071 /* at this point if a ns is visible it is in a view ns
72 * thus the curr ns.hname is a prefix of its name.
73 * Only output the virtualized portion of the name
74 * Add + 2 to skip over // separating curr hname prefix
75 * from the visible tail of the views hname
76 */
77 return view->base.hname + strlen(curr->base.hname) + 2;
78 }
79
80 return aa_hidden_ns_name;
81}
82
83/**
John Johansen98849df2017-01-16 00:42:16 -080084 * alloc_ns - allocate, initialize and return a new namespace
John Johansencff281f2017-01-16 00:42:15 -080085 * @prefix: parent namespace name (MAYBE NULL)
86 * @name: a preallocated name (NOT NULL)
87 *
88 * Returns: refcounted namespace or NULL on failure.
89 */
John Johansen98849df2017-01-16 00:42:16 -080090static struct aa_ns *alloc_ns(const char *prefix, const char *name)
John Johansencff281f2017-01-16 00:42:15 -080091{
John Johansen98849df2017-01-16 00:42:16 -080092 struct aa_ns *ns;
John Johansencff281f2017-01-16 00:42:15 -080093
94 ns = kzalloc(sizeof(*ns), GFP_KERNEL);
95 AA_DEBUG("%s(%p)\n", __func__, ns);
96 if (!ns)
97 return NULL;
John Johansend102d892017-01-16 00:42:31 -080098 if (!aa_policy_init(&ns->base, prefix, name, GFP_KERNEL))
John Johansencff281f2017-01-16 00:42:15 -080099 goto fail_ns;
100
101 INIT_LIST_HEAD(&ns->sub_ns);
102 mutex_init(&ns->lock);
103
John Johansen98849df2017-01-16 00:42:16 -0800104 /* released by aa_free_ns() */
John Johansencff281f2017-01-16 00:42:15 -0800105 ns->unconfined = aa_alloc_profile("unconfined");
106 if (!ns->unconfined)
107 goto fail_unconfined;
108
109 ns->unconfined->flags = PFLAG_IX_ON_NAME_ERROR |
110 PFLAG_IMMUTABLE | PFLAG_NS_COUNT;
111 ns->unconfined->mode = APPARMOR_UNCONFINED;
112
113 /* ns and ns->unconfined share ns->unconfined refcount */
114 ns->unconfined->ns = ns;
115
116 atomic_set(&ns->uniq_null, 0);
117
118 return ns;
119
120fail_unconfined:
121 kzfree(ns->base.hname);
122fail_ns:
123 kzfree(ns);
124 return NULL;
125}
126
127/**
John Johansen98849df2017-01-16 00:42:16 -0800128 * aa_free_ns - free a profile namespace
John Johansencff281f2017-01-16 00:42:15 -0800129 * @ns: the namespace to free (MAYBE NULL)
130 *
131 * Requires: All references to the namespace must have been put, if the
132 * namespace was referenced by a profile confining a task,
133 */
John Johansen98849df2017-01-16 00:42:16 -0800134void aa_free_ns(struct aa_ns *ns)
John Johansencff281f2017-01-16 00:42:15 -0800135{
136 if (!ns)
137 return;
138
139 aa_policy_destroy(&ns->base);
John Johansen98849df2017-01-16 00:42:16 -0800140 aa_put_ns(ns->parent);
John Johansencff281f2017-01-16 00:42:15 -0800141
142 ns->unconfined->ns = NULL;
143 aa_free_profile(ns->unconfined);
144 kzfree(ns);
145}
146
147/**
John Johansen9a2d40c2017-01-16 00:42:22 -0800148 * aa_findn_ns - look up a profile namespace on the namespace list
149 * @root: namespace to search in (NOT NULL)
150 * @name: name of namespace to find (NOT NULL)
151 * @n: length of @name
152 *
153 * Returns: a refcounted namespace on the list, or NULL if no namespace
154 * called @name exists.
155 *
156 * refcount released by caller
157 */
158struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n)
159{
160 struct aa_ns *ns = NULL;
161
162 rcu_read_lock();
163 ns = aa_get_ns(__aa_findn_ns(&root->sub_ns, name, n));
164 rcu_read_unlock();
165
166 return ns;
167}
168
169/**
John Johansen98849df2017-01-16 00:42:16 -0800170 * aa_find_ns - look up a profile namespace on the namespace list
John Johansencff281f2017-01-16 00:42:15 -0800171 * @root: namespace to search in (NOT NULL)
172 * @name: name of namespace to find (NOT NULL)
173 *
174 * Returns: a refcounted namespace on the list, or NULL if no namespace
175 * called @name exists.
176 *
177 * refcount released by caller
178 */
John Johansen98849df2017-01-16 00:42:16 -0800179struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name)
John Johansencff281f2017-01-16 00:42:15 -0800180{
John Johansen9a2d40c2017-01-16 00:42:22 -0800181 return aa_findn_ns(root, name, strlen(name));
John Johansencff281f2017-01-16 00:42:15 -0800182}
183
184/**
John Johansen98849df2017-01-16 00:42:16 -0800185 * aa_prepare_ns - find an existing or create a new namespace of @name
John Johansencff281f2017-01-16 00:42:15 -0800186 * @name: the namespace to find or add (MAYBE NULL)
187 *
John Johansen98849df2017-01-16 00:42:16 -0800188 * Returns: refcounted ns or NULL if failed to create one
John Johansencff281f2017-01-16 00:42:15 -0800189 */
John Johansen98849df2017-01-16 00:42:16 -0800190struct aa_ns *aa_prepare_ns(const char *name)
John Johansencff281f2017-01-16 00:42:15 -0800191{
John Johansen98849df2017-01-16 00:42:16 -0800192 struct aa_ns *ns, *root;
John Johansencff281f2017-01-16 00:42:15 -0800193
194 root = aa_current_profile()->ns;
195
196 mutex_lock(&root->lock);
197
198 /* if name isn't specified the profile is loaded to the current ns */
199 if (!name) {
200 /* released by caller */
John Johansen98849df2017-01-16 00:42:16 -0800201 ns = aa_get_ns(root);
John Johansencff281f2017-01-16 00:42:15 -0800202 goto out;
203 }
204
205 /* try and find the specified ns and if it doesn't exist create it */
206 /* released by caller */
John Johansen98849df2017-01-16 00:42:16 -0800207 ns = aa_get_ns(__aa_find_ns(&root->sub_ns, name));
John Johansencff281f2017-01-16 00:42:15 -0800208 if (!ns) {
John Johansen98849df2017-01-16 00:42:16 -0800209 ns = alloc_ns(root->base.hname, name);
John Johansencff281f2017-01-16 00:42:15 -0800210 if (!ns)
211 goto out;
John Johansen98849df2017-01-16 00:42:16 -0800212 if (__aa_fs_ns_mkdir(ns, ns_subns_dir(root), name)) {
John Johansencff281f2017-01-16 00:42:15 -0800213 AA_ERROR("Failed to create interface for ns %s\n",
214 ns->base.name);
John Johansen98849df2017-01-16 00:42:16 -0800215 aa_free_ns(ns);
John Johansencff281f2017-01-16 00:42:15 -0800216 ns = NULL;
217 goto out;
218 }
John Johansen98849df2017-01-16 00:42:16 -0800219 ns->parent = aa_get_ns(root);
John Johansencff281f2017-01-16 00:42:15 -0800220 list_add_rcu(&ns->base.list, &root->sub_ns);
221 /* add list ref */
John Johansen98849df2017-01-16 00:42:16 -0800222 aa_get_ns(ns);
John Johansencff281f2017-01-16 00:42:15 -0800223 }
224out:
225 mutex_unlock(&root->lock);
226
227 /* return ref */
228 return ns;
229}
230
231static void __ns_list_release(struct list_head *head);
232
233/**
John Johansen98849df2017-01-16 00:42:16 -0800234 * destroy_ns - remove everything contained by @ns
John Johansen31617dd2017-01-16 00:42:24 -0800235 * @ns: namespace to have it contents removed (NOT NULL)
John Johansencff281f2017-01-16 00:42:15 -0800236 */
John Johansen98849df2017-01-16 00:42:16 -0800237static void destroy_ns(struct aa_ns *ns)
John Johansencff281f2017-01-16 00:42:15 -0800238{
239 if (!ns)
240 return;
241
242 mutex_lock(&ns->lock);
243 /* release all profiles in this namespace */
244 __aa_profile_list_release(&ns->base.profiles);
245
246 /* release all sub namespaces */
247 __ns_list_release(&ns->sub_ns);
248
249 if (ns->parent)
John Johansen83995882017-01-16 00:42:19 -0800250 __aa_update_proxy(ns->unconfined, ns->parent->unconfined);
John Johansen98849df2017-01-16 00:42:16 -0800251 __aa_fs_ns_rmdir(ns);
John Johansencff281f2017-01-16 00:42:15 -0800252 mutex_unlock(&ns->lock);
253}
254
255/**
John Johansen98849df2017-01-16 00:42:16 -0800256 * __aa_remove_ns - remove a namespace and all its children
John Johansencff281f2017-01-16 00:42:15 -0800257 * @ns: namespace to be removed (NOT NULL)
258 *
259 * Requires: ns->parent->lock be held and ns removed from parent.
260 */
John Johansen98849df2017-01-16 00:42:16 -0800261void __aa_remove_ns(struct aa_ns *ns)
John Johansencff281f2017-01-16 00:42:15 -0800262{
263 /* remove ns from namespace list */
264 list_del_rcu(&ns->base.list);
John Johansen98849df2017-01-16 00:42:16 -0800265 destroy_ns(ns);
266 aa_put_ns(ns);
John Johansencff281f2017-01-16 00:42:15 -0800267}
268
269/**
270 * __ns_list_release - remove all profile namespaces on the list put refs
271 * @head: list of profile namespaces (NOT NULL)
272 *
273 * Requires: namespace lock be held
274 */
275static void __ns_list_release(struct list_head *head)
276{
John Johansen98849df2017-01-16 00:42:16 -0800277 struct aa_ns *ns, *tmp;
John Johansencff281f2017-01-16 00:42:15 -0800278
279 list_for_each_entry_safe(ns, tmp, head, base.list)
John Johansen98849df2017-01-16 00:42:16 -0800280 __aa_remove_ns(ns);
John Johansencff281f2017-01-16 00:42:15 -0800281
282}
283
284/**
John Johansen31617dd2017-01-16 00:42:24 -0800285 * aa_alloc_root_ns - allocate the root profile namespace
John Johansencff281f2017-01-16 00:42:15 -0800286 *
287 * Returns: %0 on success else error
288 *
289 */
290int __init aa_alloc_root_ns(void)
291{
292 /* released by aa_free_root_ns - used as list ref*/
John Johansen98849df2017-01-16 00:42:16 -0800293 root_ns = alloc_ns(NULL, "root");
John Johansencff281f2017-01-16 00:42:15 -0800294 if (!root_ns)
295 return -ENOMEM;
296
297 return 0;
298}
299
300 /**
301 * aa_free_root_ns - free the root profile namespace
302 */
303void __init aa_free_root_ns(void)
304{
John Johansen98849df2017-01-16 00:42:16 -0800305 struct aa_ns *ns = root_ns;
John Johansencff281f2017-01-16 00:42:15 -0800306
307 root_ns = NULL;
308
John Johansen98849df2017-01-16 00:42:16 -0800309 destroy_ns(ns);
310 aa_put_ns(ns);
John Johansencff281f2017-01-16 00:42:15 -0800311}