]>
Commit | Line | Data |
---|---|---|
63e2b423 JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor /proc/<pid>/attr/ interface functions | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #include "include/apparmor.h" | |
16 | #include "include/context.h" | |
17 | #include "include/policy.h" | |
18 | #include "include/domain.h" | |
cc7db099 | 19 | #include "include/procattr.h" |
63e2b423 JJ |
20 | |
21 | ||
22 | /** | |
23 | * aa_getprocattr - Return the profile information for @profile | |
24 | * @profile: the profile to print profile info about (NOT NULL) | |
25 | * @string: Returns - string containing the profile info (NOT NULL) | |
26 | * | |
27 | * Returns: length of @string on success else error on failure | |
28 | * | |
29 | * Requires: profile != NULL | |
30 | * | |
31 | * Creates a string containing the namespace_name://profile_name for | |
32 | * @profile. | |
33 | * | |
34 | * Returns: size of string placed in @string else error code on failure | |
35 | */ | |
80594fc2 | 36 | int aa_getprocattr(struct aa_label *label, char **string) |
63e2b423 | 37 | { |
80594fc2 JJ |
38 | struct aa_ns *ns = labels_ns(label); |
39 | struct aa_ns *current_ns = aa_get_current_ns(); | |
40 | int len; | |
63e2b423 | 41 | |
80594fc2 JJ |
42 | if (!aa_ns_visible(current_ns, ns, true)) { |
43 | aa_put_ns(current_ns); | |
44 | return -EACCES; | |
45 | } | |
63e2b423 | 46 | |
80594fc2 JJ |
47 | len = aa_label_snxprint(NULL, 0, current_ns, label, |
48 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | | |
49 | FLAG_HIDDEN_UNCONFINED); | |
50 | AA_BUG(len < 0); | |
63e2b423 | 51 | |
80594fc2 JJ |
52 | *string = kmalloc(len + 2, GFP_KERNEL); |
53 | if (!*string) { | |
54 | aa_put_ns(current_ns); | |
63e2b423 | 55 | return -ENOMEM; |
80594fc2 | 56 | } |
63e2b423 | 57 | |
80594fc2 JJ |
58 | len = aa_label_snxprint(*string, len + 2, current_ns, label, |
59 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | | |
60 | FLAG_HIDDEN_UNCONFINED); | |
61 | if (len < 0) { | |
62 | aa_put_ns(current_ns); | |
63 | return len; | |
63e2b423 | 64 | } |
80594fc2 JJ |
65 | |
66 | (*string)[len] = '\n'; | |
67 | (*string)[len + 1] = 0; | |
68 | ||
69 | aa_put_ns(current_ns); | |
70 | return len + 1; | |
63e2b423 JJ |
71 | } |
72 | ||
73 | /** | |
74 | * split_token_from_name - separate a string of form <token>^<name> | |
75 | * @op: operation being checked | |
76 | * @args: string to parse (NOT NULL) | |
77 | * @token: stores returned parsed token value (NOT NULL) | |
78 | * | |
79 | * Returns: start position of name after token else NULL on failure | |
80 | */ | |
80594fc2 | 81 | static char *split_token_from_name(const char *op, char *args, u64 * token) |
63e2b423 JJ |
82 | { |
83 | char *name; | |
84 | ||
85 | *token = simple_strtoull(args, &name, 16); | |
86 | if ((name == args) || *name != '^') { | |
80594fc2 | 87 | AA_ERROR("%s: Invalid input '%s'", op, args); |
63e2b423 JJ |
88 | return ERR_PTR(-EINVAL); |
89 | } | |
90 | ||
91 | name++; /* skip ^ */ | |
92 | if (!*name) | |
93 | name = NULL; | |
94 | return name; | |
95 | } | |
96 | ||
97 | /** | |
98 | * aa_setprocattr_chagnehat - handle procattr interface to change_hat | |
99 | * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL) | |
100 | * @size: size of the args | |
101 | * @test: true if this is a test of change_hat permissions | |
102 | * | |
103 | * Returns: %0 or error code if change_hat fails | |
104 | */ | |
105 | int aa_setprocattr_changehat(char *args, size_t size, int test) | |
106 | { | |
107 | char *hat; | |
108 | u64 token; | |
109 | const char *hats[16]; /* current hard limit on # of names */ | |
110 | int count = 0; | |
111 | ||
112 | hat = split_token_from_name(OP_CHANGE_HAT, args, &token); | |
113 | if (IS_ERR(hat)) | |
114 | return PTR_ERR(hat); | |
115 | ||
116 | if (!hat && !token) { | |
117 | AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic"); | |
118 | return -EINVAL; | |
119 | } | |
120 | ||
121 | if (hat) { | |
122 | /* set up hat name vector, args guaranteed null terminated | |
123 | * at args[size] by setprocattr. | |
124 | * | |
125 | * If there are multiple hat names in the buffer each is | |
126 | * separated by a \0. Ie. userspace writes them pre tokenized | |
127 | */ | |
128 | char *end = args + size; | |
129 | for (count = 0; (hat < end) && count < 16; ++count) { | |
130 | char *next = hat + strlen(hat) + 1; | |
131 | hats[count] = hat; | |
80594fc2 JJ |
132 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n" |
133 | , __func__, current->pid, token, count, hat); | |
63e2b423 JJ |
134 | hat = next; |
135 | } | |
80594fc2 JJ |
136 | } else |
137 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n", | |
138 | __func__, current->pid, token, count, "<NULL>"); | |
63e2b423 JJ |
139 | |
140 | return aa_change_hat(hats, count, token, test); | |
141 | } |