]>
Commit | Line | Data |
---|---|---|
b886d83c | 1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
c88d4c7b JJ |
2 | /* |
3 | * AppArmor security module | |
4 | * | |
5 | * This file contains AppArmor policy definitions. | |
6 | * | |
7 | * Copyright (C) 1998-2008 Novell/SUSE | |
8 | * Copyright 2009-2010 Canonical Ltd. | |
c88d4c7b JJ |
9 | */ |
10 | ||
11 | #ifndef __AA_POLICY_H | |
12 | #define __AA_POLICY_H | |
13 | ||
14 | #include <linux/capability.h> | |
15 | #include <linux/cred.h> | |
16 | #include <linux/kref.h> | |
e025be0f | 17 | #include <linux/rhashtable.h> |
c88d4c7b JJ |
18 | #include <linux/sched.h> |
19 | #include <linux/slab.h> | |
20 | #include <linux/socket.h> | |
21 | ||
22 | #include "apparmor.h" | |
23 | #include "audit.h" | |
24 | #include "capability.h" | |
25 | #include "domain.h" | |
26 | #include "file.h" | |
12557dcb | 27 | #include "lib.h" |
637f688d | 28 | #include "label.h" |
56974a6f | 29 | #include "net.h" |
fc7e0b26 | 30 | #include "perms.h" |
c88d4c7b JJ |
31 | #include "resource.h" |
32 | ||
cff281f6 | 33 | |
98849dff | 34 | struct aa_ns; |
cff281f6 | 35 | |
2bd8dbbf JJ |
36 | extern int unprivileged_userns_apparmor_policy; |
37 | ||
0d259f04 JJ |
38 | extern const char *const aa_profile_mode_names[]; |
39 | #define APPARMOR_MODE_NAMES_MAX_INDEX 4 | |
c88d4c7b | 40 | |
50c5ecd5 JJ |
41 | #define PROFILE_MODE(_profile, _mode) \ |
42 | ((aa_g_profile_mode == (_mode)) || \ | |
43 | ((_profile)->mode == (_mode))) | |
c88d4c7b | 44 | |
50c5ecd5 JJ |
45 | #define COMPLAIN_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_COMPLAIN) |
46 | ||
47 | #define KILL_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_KILL) | |
c88d4c7b | 48 | |
637f688d | 49 | #define PROFILE_IS_HAT(_profile) ((_profile)->label.flags & FLAG_HAT) |
c88d4c7b | 50 | |
637f688d | 51 | #define profile_is_stale(_profile) (label_is_stale(&(_profile)->label)) |
77b071b3 | 52 | |
01e2b670 JJ |
53 | #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2) |
54 | ||
c88d4c7b JJ |
55 | /* |
56 | * FIXME: currently need a clean way to replace and remove profiles as a | |
57 | * set. It should be done at the namespace level. | |
58 | * Either, with a set of profiles loaded at the namespace level or via | |
59 | * a mark and remove marked interface. | |
60 | */ | |
61 | enum profile_mode { | |
62 | APPARMOR_ENFORCE, /* enforce access rules */ | |
63 | APPARMOR_COMPLAIN, /* allow and log access violations */ | |
64 | APPARMOR_KILL, /* kill task on access violation */ | |
03816507 | 65 | APPARMOR_UNCONFINED, /* profile set to unconfined */ |
c88d4c7b JJ |
66 | }; |
67 | ||
c88d4c7b | 68 | |
ad5ff3db JJ |
69 | /* struct aa_policydb - match engine for a policy |
70 | * dfa: dfa pattern match | |
71 | * start: set of start states for the different classes of data | |
72 | */ | |
73 | struct aa_policydb { | |
74 | /* Generic policy DFA specific rule types will be subsections of it */ | |
75 | struct aa_dfa *dfa; | |
76 | unsigned int start[AA_CLASS_LAST + 1]; | |
77 | ||
78 | }; | |
79 | ||
e025be0f WH |
80 | /* struct aa_data - generic data structure |
81 | * key: name for retrieving this data | |
82 | * size: size of data in bytes | |
83 | * data: binary data | |
84 | * head: reserved for rhashtable | |
85 | */ | |
86 | struct aa_data { | |
87 | char *key; | |
88 | u32 size; | |
89 | char *data; | |
90 | struct rhash_head head; | |
91 | }; | |
92 | ||
77b071b3 | 93 | |
c88d4c7b JJ |
94 | /* struct aa_profile - basic confinement data |
95 | * @base - base components of the profile (name, refcount, lists, lock ...) | |
637f688d | 96 | * @label - label this profile is an extension of |
c88d4c7b JJ |
97 | * @parent: parent of profile |
98 | * @ns: namespace the profile is in | |
c88d4c7b | 99 | * @rename: optional profile name that this profile renamed |
556d0be7 | 100 | * @attach: human readable attachment string |
c88d4c7b JJ |
101 | * @xmatch: optional extended matching for unconfined executables names |
102 | * @xmatch_len: xmatch prefix len, used to determine xmatch priority | |
c88d4c7b JJ |
103 | * @audit: the auditing mode of the profile |
104 | * @mode: the enforcement mode of the profile | |
c88d4c7b | 105 | * @path_flags: flags controlling path generation behavior |
72c8a768 | 106 | * @disconnected: what to prepend if attach_disconnected is specified |
c88d4c7b | 107 | * @size: the memory consumed by this profiles rules |
ad5ff3db | 108 | * @policy: general match rules governing policy |
c88d4c7b JJ |
109 | * @file: The set of rules governing basic file access and domain transitions |
110 | * @caps: capabilities for the profile | |
21d53966 | 111 | * @net_compat: v2 compat network controls for the profile |
c88d4c7b JJ |
112 | * @rlimits: rlimits for the profile |
113 | * | |
0d259f04 JJ |
114 | * @dents: dentries for the profiles file entries in apparmorfs |
115 | * @dirname: name of the profile dir in apparmorfs | |
e025be0f | 116 | * @data: hashtable for free-form policy aa_data |
0d259f04 | 117 | * |
c88d4c7b JJ |
118 | * The AppArmor profile contains the basic confinement data. Each profile |
119 | * has a name, and exists in a namespace. The @name and @exec_match are | |
120 | * used to determine profile attachment against unconfined tasks. All other | |
121 | * attachments are determined by profile X transition rules. | |
122 | * | |
c88d4c7b JJ |
123 | * Profiles have a hierarchy where hats and children profiles keep |
124 | * a reference to their parent. | |
125 | * | |
126 | * Profile names can not begin with a : and can not contain the \0 | |
127 | * character. If a profile name begins with / it will be considered when | |
128 | * determining profile attachment on "unconfined" tasks. | |
129 | */ | |
130 | struct aa_profile { | |
131 | struct aa_policy base; | |
01e2b670 | 132 | struct aa_profile __rcu *parent; |
c88d4c7b | 133 | |
98849dff | 134 | struct aa_ns *ns; |
c88d4c7b JJ |
135 | const char *rename; |
136 | ||
556d0be7 | 137 | const char *attach; |
c88d4c7b JJ |
138 | struct aa_dfa *xmatch; |
139 | int xmatch_len; | |
c88d4c7b | 140 | enum audit_mode audit; |
03816507 | 141 | long mode; |
c88d4c7b | 142 | u32 path_flags; |
72c8a768 | 143 | const char *disconnected; |
c88d4c7b JJ |
144 | int size; |
145 | ||
ad5ff3db | 146 | struct aa_policydb policy; |
c88d4c7b JJ |
147 | struct aa_file_rules file; |
148 | struct aa_caps caps; | |
21d53966 | 149 | struct aa_net_compat *net_compat; |
8e51f908 MG |
150 | |
151 | int xattr_count; | |
152 | char **xattrs; | |
8e51f908 | 153 | |
c88d4c7b | 154 | struct aa_rlimit rlimits; |
0d259f04 | 155 | |
9caafbe2 MG |
156 | int secmark_count; |
157 | struct aa_secmark *secmark; | |
158 | ||
5ac8c355 | 159 | struct aa_loaddata *rawdata; |
f8eb8a13 | 160 | unsigned char *hash; |
0d259f04 JJ |
161 | char *dirname; |
162 | struct dentry *dents[AAFS_PROF_SIZEOF]; | |
e025be0f | 163 | struct rhashtable *data; |
637f688d | 164 | struct aa_label label; |
c88d4c7b JJ |
165 | }; |
166 | ||
c88d4c7b JJ |
167 | extern enum profile_mode aa_g_profile_mode; |
168 | ||
18e99f19 JJ |
169 | #define AA_MAY_LOAD_POLICY AA_MAY_APPEND |
170 | #define AA_MAY_REPLACE_POLICY AA_MAY_WRITE | |
171 | #define AA_MAY_REMOVE_POLICY AA_MAY_DELETE | |
172 | ||
637f688d JJ |
173 | #define profiles_ns(P) ((P)->ns) |
174 | #define name_is_shared(A, B) ((A)->hname && (A)->hname == (B)->hname) | |
c88d4c7b | 175 | |
cff281f6 | 176 | void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); |
c88d4c7b | 177 | |
c88d4c7b | 178 | |
8399588a | 179 | void aa_free_proxy_kref(struct kref *kref); |
637f688d JJ |
180 | struct aa_profile *aa_alloc_profile(const char *name, struct aa_proxy *proxy, |
181 | gfp_t gfp); | |
181f7c97 JJ |
182 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat, |
183 | const char *base, gfp_t gfp); | |
8651e1d6 | 184 | void aa_free_profile(struct aa_profile *profile); |
c88d4c7b JJ |
185 | void aa_free_profile_kref(struct kref *kref); |
186 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); | |
1741e9eb JJ |
187 | struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname, |
188 | size_t n); | |
98849dff | 189 | struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *name); |
637f688d | 190 | struct aa_profile *aa_fqlookupn_profile(struct aa_label *base, |
31617ddf | 191 | const char *fqname, size_t n); |
98849dff | 192 | struct aa_profile *aa_match_profile(struct aa_ns *ns, const char *name); |
c88d4c7b | 193 | |
637f688d | 194 | ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_label *label, |
18e99f19 | 195 | u32 mask, struct aa_loaddata *udata); |
637f688d JJ |
196 | ssize_t aa_remove_profiles(struct aa_ns *view, struct aa_label *label, |
197 | char *name, size_t size); | |
cff281f6 | 198 | void __aa_profile_list_release(struct list_head *head); |
c88d4c7b JJ |
199 | |
200 | #define PROF_ADD 1 | |
201 | #define PROF_REPLACE 0 | |
202 | ||
637f688d JJ |
203 | #define profile_unconfined(X) ((X)->mode == APPARMOR_UNCONFINED) |
204 | ||
205 | /** | |
206 | * aa_get_newest_profile - simple wrapper fn to wrap the label version | |
207 | * @p: profile (NOT NULL) | |
208 | * | |
209 | * Returns refcount to newest version of the profile (maybe @p) | |
210 | * | |
211 | * Requires: @p must be held with a valid refcount | |
212 | */ | |
213 | static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p) | |
214 | { | |
215 | return labels_profile(aa_get_newest_label(&p->label)); | |
216 | } | |
c88d4c7b | 217 | |
23375b13 JJ |
218 | static inline unsigned int PROFILE_MEDIATES(struct aa_profile *profile, |
219 | unsigned char class) | |
220 | { | |
221 | if (class <= AA_CLASS_LAST) | |
222 | return profile->policy.start[class]; | |
223 | else | |
224 | return aa_dfa_match_len(profile->policy.dfa, | |
225 | profile->policy.start[0], &class, 1); | |
226 | } | |
227 | ||
56974a6f JJ |
228 | static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile, |
229 | u16 AF) { | |
230 | unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET); | |
231 | __be16 be_af = cpu_to_be16(AF); | |
232 | ||
cc8c477b JJ |
233 | if (!state) { |
234 | state = PROFILE_MEDIATES(profile, AA_CLASS_NET_COMPAT); | |
235 | if (!state) | |
236 | return 0; | |
237 | } | |
238 | state = aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2); | |
239 | return state; | |
56974a6f JJ |
240 | } |
241 | ||
c88d4c7b JJ |
242 | /** |
243 | * aa_get_profile - increment refcount on profile @p | |
244 | * @p: profile (MAYBE NULL) | |
245 | * | |
246 | * Returns: pointer to @p if @p is NULL will return NULL | |
247 | * Requires: @p must be held with valid refcount when called | |
248 | */ | |
249 | static inline struct aa_profile *aa_get_profile(struct aa_profile *p) | |
250 | { | |
251 | if (p) | |
637f688d | 252 | kref_get(&(p->label.count)); |
c88d4c7b JJ |
253 | |
254 | return p; | |
255 | } | |
256 | ||
01e2b670 JJ |
257 | /** |
258 | * aa_get_profile_not0 - increment refcount on profile @p found via lookup | |
259 | * @p: profile (MAYBE NULL) | |
260 | * | |
261 | * Returns: pointer to @p if @p is NULL will return NULL | |
262 | * Requires: @p must be held with valid refcount when called | |
263 | */ | |
264 | static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p) | |
265 | { | |
637f688d | 266 | if (p && kref_get_unless_zero(&p->label.count)) |
01e2b670 JJ |
267 | return p; |
268 | ||
269 | return NULL; | |
270 | } | |
271 | ||
272 | /** | |
273 | * aa_get_profile_rcu - increment a refcount profile that can be replaced | |
274 | * @p: pointer to profile that can be replaced (NOT NULL) | |
275 | * | |
276 | * Returns: pointer to a refcounted profile. | |
277 | * else NULL if no profile | |
278 | */ | |
279 | static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p) | |
280 | { | |
281 | struct aa_profile *c; | |
282 | ||
283 | rcu_read_lock(); | |
284 | do { | |
285 | c = rcu_dereference(*p); | |
637f688d | 286 | } while (c && !kref_get_unless_zero(&c->label.count)); |
01e2b670 JJ |
287 | rcu_read_unlock(); |
288 | ||
289 | return c; | |
290 | } | |
291 | ||
c88d4c7b JJ |
292 | /** |
293 | * aa_put_profile - decrement refcount on profile @p | |
294 | * @p: profile (MAYBE NULL) | |
295 | */ | |
296 | static inline void aa_put_profile(struct aa_profile *p) | |
297 | { | |
742058b0 | 298 | if (p) |
637f688d | 299 | kref_put(&p->label.count, aa_label_kref); |
fa2ac468 JJ |
300 | } |
301 | ||
c88d4c7b JJ |
302 | static inline int AUDIT_MODE(struct aa_profile *profile) |
303 | { | |
304 | if (aa_g_audit != AUDIT_NORMAL) | |
305 | return aa_g_audit; | |
306 | ||
307 | return profile->audit; | |
308 | } | |
309 | ||
2bd8dbbf | 310 | bool policy_view_capable(struct aa_ns *ns); |
fd2a8043 | 311 | bool policy_admin_capable(struct aa_ns *ns); |
637f688d | 312 | int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, |
18e99f19 | 313 | u32 mask); |
c88d4c7b JJ |
314 | |
315 | #endif /* __AA_POLICY_H */ |