]>
Commit | Line | Data |
---|---|---|
fc7e0b26 JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor basic permission sets definitions. | |
5 | * | |
6 | * Copyright 2017 Canonical Ltd. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU General Public License as | |
10 | * published by the Free Software Foundation, version 2 of the | |
11 | * License. | |
12 | */ | |
13 | ||
14 | #ifndef __AA_PERM_H | |
15 | #define __AA_PERM_H | |
16 | ||
17 | #include <linux/fs.h> | |
637f688d | 18 | #include "label.h" |
fc7e0b26 | 19 | |
e53cfe6c JJ |
20 | #define AA_MAY_EXEC MAY_EXEC |
21 | #define AA_MAY_WRITE MAY_WRITE | |
22 | #define AA_MAY_READ MAY_READ | |
23 | #define AA_MAY_APPEND MAY_APPEND | |
24 | ||
25 | #define AA_MAY_CREATE 0x0010 | |
26 | #define AA_MAY_DELETE 0x0020 | |
27 | #define AA_MAY_OPEN 0x0040 | |
28 | #define AA_MAY_RENAME 0x0080 /* pair */ | |
29 | ||
30 | #define AA_MAY_SETATTR 0x0100 /* meta write */ | |
31 | #define AA_MAY_GETATTR 0x0200 /* meta read */ | |
32 | #define AA_MAY_SETCRED 0x0400 /* security cred/attr */ | |
33 | #define AA_MAY_GETCRED 0x0800 | |
34 | ||
35 | #define AA_MAY_CHMOD 0x1000 /* pair */ | |
36 | #define AA_MAY_CHOWN 0x2000 /* pair */ | |
37 | #define AA_MAY_CHGRP 0x4000 /* pair */ | |
38 | #define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */ | |
39 | ||
40 | #define AA_EXEC_MMAP 0x00010000 | |
41 | #define AA_MAY_MPROT 0x00020000 /* extend conditions */ | |
42 | #define AA_MAY_LINK 0x00040000 /* pair */ | |
43 | #define AA_MAY_SNAPSHOT 0x00080000 /* pair */ | |
44 | ||
45 | #define AA_MAY_DELEGATE | |
46 | #define AA_CONT_MATCH 0x08000000 | |
47 | ||
48 | #define AA_MAY_STACK 0x10000000 | |
49 | #define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */ | |
50 | #define AA_MAY_CHANGE_PROFILE 0x40000000 | |
51 | #define AA_MAY_CHANGEHAT 0x80000000 | |
52 | ||
53 | #define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */ | |
54 | ||
55 | ||
56 | #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE | \ | |
57 | AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK | \ | |
58 | AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND) | |
59 | ||
60 | #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME | \ | |
61 | AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \ | |
62 | AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \ | |
63 | AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \ | |
64 | AA_MAY_STACK | AA_MAY_ONEXEC | \ | |
65 | AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT) | |
66 | ||
67 | extern const char aa_file_perm_chrs[]; | |
68 | extern const char *aa_file_perm_names[]; | |
fc7e0b26 | 69 | |
aa9aeea8 JJ |
70 | struct aa_perms { |
71 | u32 allow; | |
72 | u32 audit; /* set only when allow is set */ | |
73 | ||
74 | u32 deny; /* explicit deny, or conflict if allow also set */ | |
75 | u32 quiet; /* set only when ~allow | deny */ | |
76 | u32 kill; /* set only when ~allow | deny */ | |
77 | u32 stop; /* set only when ~allow | deny */ | |
78 | ||
79 | u32 complain; /* accumulates only used when ~allow & ~deny */ | |
80 | u32 cond; /* set only when ~allow and ~deny */ | |
81 | ||
82 | u32 hide; /* set only when ~allow | deny */ | |
83 | u32 prompt; /* accumulates only used when ~allow & ~deny */ | |
84 | ||
85 | /* Reserved: | |
86 | * u32 subtree; / * set only when allow is set * / | |
87 | */ | |
88 | u16 xindex; | |
89 | }; | |
90 | ||
91 | #define ALL_PERMS_MASK 0xffffffff | |
2d679f3c | 92 | extern struct aa_perms nullperms; |
aa9aeea8 JJ |
93 | extern struct aa_perms allperms; |
94 | ||
ca916e8e JJ |
95 | |
96 | #define xcheck(FN1, FN2) \ | |
97 | ({ \ | |
98 | int e, error = FN1; \ | |
99 | e = FN2; \ | |
100 | if (e) \ | |
101 | error = e; \ | |
102 | error; \ | |
103 | }) | |
104 | ||
105 | ||
106 | /* | |
107 | * TODO: update for labels pointing to labels instead of profiles | |
108 | * TODO: optimize the walk, currently does subwalk of L2 for each P in L1 | |
109 | * gah this doesn't allow for label compound check!!!! | |
110 | */ | |
111 | #define xcheck_ns_profile_profile(P1, P2, FN, args...) \ | |
112 | ({ \ | |
113 | int ____e = 0; \ | |
114 | if (P1->ns == P2->ns) \ | |
115 | ____e = FN((P1), (P2), args); \ | |
116 | (____e); \ | |
117 | }) | |
118 | ||
119 | #define xcheck_ns_profile_label(P, L, FN, args...) \ | |
120 | ({ \ | |
121 | struct aa_profile *__p2; \ | |
122 | fn_for_each((L), __p2, \ | |
123 | xcheck_ns_profile_profile((P), __p2, (FN), args)); \ | |
124 | }) | |
125 | ||
126 | #define xcheck_ns_labels(L1, L2, FN, args...) \ | |
127 | ({ \ | |
128 | struct aa_profile *__p1; \ | |
129 | fn_for_each((L1), __p1, FN(__p1, (L2), args)); \ | |
130 | }) | |
131 | ||
132 | /* Do the cross check but applying FN at the profiles level */ | |
133 | #define xcheck_labels_profiles(L1, L2, FN, args...) \ | |
134 | xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args) | |
135 | ||
aa9aeea8 | 136 | |
e53cfe6c | 137 | void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask); |
695b0eb9 JJ |
138 | void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names, |
139 | u32 mask); | |
aa9aeea8 | 140 | void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs, |
695b0eb9 | 141 | u32 chrsmask, const char * const *names, u32 namesmask); |
aa9aeea8 JJ |
142 | void aa_apply_modes_to_perms(struct aa_profile *profile, |
143 | struct aa_perms *perms); | |
144 | void aa_compute_perms(struct aa_dfa *dfa, unsigned int state, | |
145 | struct aa_perms *perms); | |
637f688d JJ |
146 | void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend); |
147 | void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend); | |
148 | void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label, | |
149 | int type, u32 request, struct aa_perms *perms); | |
150 | int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target, | |
151 | u32 request, int type, u32 *deny, | |
152 | struct common_audit_data *sa); | |
153 | int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms, | |
154 | u32 request, struct common_audit_data *sa, | |
155 | void (*cb)(struct audit_buffer *, void *)); | |
fc7e0b26 | 156 | #endif /* __AA_PERM_H */ |