]>
git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - security/apparmor/domain.c
2 * AppArmor security module
4 * This file contains AppArmor policy attachment and domain transitions
6 * Copyright (C) 2002-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/errno.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
18 #include <linux/mount.h>
19 #include <linux/syscalls.h>
20 #include <linux/tracehook.h>
21 #include <linux/personality.h>
23 #include "include/audit.h"
24 #include "include/apparmorfs.h"
25 #include "include/context.h"
26 #include "include/domain.h"
27 #include "include/file.h"
28 #include "include/ipc.h"
29 #include "include/match.h"
30 #include "include/path.h"
31 #include "include/policy.h"
32 #include "include/policy_ns.h"
35 * aa_free_domain_entries - free entries in a domain table
36 * @domain: the domain table to free (MAYBE NULL)
38 void aa_free_domain_entries(struct aa_domain
*domain
)
45 for (i
= 0; i
< domain
->size
; i
++)
46 kzfree(domain
->table
[i
]);
47 kzfree(domain
->table
);
53 * may_change_ptraced_domain - check if can change profile on ptraced task
54 * @to_label: profile to change to (NOT NULL)
55 * @info: message if there is an error
57 * Check if current is ptraced and if so if the tracing task is allowed
58 * to trace the new domain
60 * Returns: %0 or error if change not allowed
62 static int may_change_ptraced_domain(struct aa_label
*to_label
,
65 struct task_struct
*tracer
;
66 struct aa_label
*tracerl
= NULL
;
70 tracer
= ptrace_parent(current
);
73 tracerl
= aa_get_task_label(tracer
);
76 if (!tracer
|| unconfined(tracerl
))
79 error
= aa_may_ptrace(tracerl
, to_label
, PTRACE_MODE_ATTACH
);
83 aa_put_label(tracerl
);
86 *info
= "ptrace prevents transition";
91 * change_profile_perms - find permissions for change_profile
92 * @profile: the current profile (NOT NULL)
93 * @ns: the namespace being switched to (NOT NULL)
94 * @name: the name of the profile to change to (NOT NULL)
95 * @request: requested perms
96 * @start: state to start matching in
98 * Returns: permission set
100 static struct aa_perms
change_profile_perms(struct aa_profile
*profile
,
102 const char *name
, u32 request
,
105 struct aa_perms perms
;
106 struct path_cond cond
= { };
109 if (profile_unconfined(profile
)) {
110 perms
.allow
= AA_MAY_CHANGE_PROFILE
| AA_MAY_ONEXEC
;
111 perms
.audit
= perms
.quiet
= perms
.kill
= 0;
113 } else if (!profile
->file
.dfa
) {
115 } else if ((ns
== profile
->ns
)) {
116 /* try matching against rules with out namespace prepended */
117 aa_str_perms(profile
->file
.dfa
, start
, name
, &cond
, &perms
);
118 if (COMBINED_PERM_MASK(perms
) & request
)
122 /* try matching with namespace name and then profile */
123 state
= aa_dfa_match(profile
->file
.dfa
, start
, ns
->base
.name
);
124 state
= aa_dfa_match_len(profile
->file
.dfa
, state
, ":", 1);
125 aa_str_perms(profile
->file
.dfa
, state
, name
, &cond
, &perms
);
131 * __attach_match_ - find an attachment match
132 * @name - to match against (NOT NULL)
133 * @head - profile list to walk (NOT NULL)
135 * Do a linear search on the profiles in the list. There is a matching
136 * preference where an exact match is preferred over a name which uses
137 * expressions to match, and matching expressions with the greatest
138 * xmatch_len are preferred.
140 * Requires: @head not be shared or have appropriate locks held
142 * Returns: profile or NULL if no match found
144 static struct aa_profile
*__attach_match(const char *name
,
145 struct list_head
*head
)
148 struct aa_profile
*profile
, *candidate
= NULL
;
150 list_for_each_entry_rcu(profile
, head
, base
.list
) {
151 if (profile
->label
.flags
& FLAG_NULL
)
153 if (profile
->xmatch
&& profile
->xmatch_len
> len
) {
154 unsigned int state
= aa_dfa_match(profile
->xmatch
,
156 u32 perm
= dfa_user_allow(profile
->xmatch
, state
);
157 /* any accepting state means a valid match. */
158 if (perm
& MAY_EXEC
) {
160 len
= profile
->xmatch_len
;
162 } else if (!strcmp(profile
->base
.name
, name
))
163 /* exact non-re match, no more searching required */
171 * find_attach - do attachment search for unconfined processes
172 * @ns: the current namespace (NOT NULL)
173 * @list: list to search (NOT NULL)
174 * @name: the executable name to match against (NOT NULL)
176 * Returns: profile or NULL if no match found
178 static struct aa_profile
*find_attach(struct aa_ns
*ns
,
179 struct list_head
*list
, const char *name
)
181 struct aa_profile
*profile
;
184 profile
= aa_get_profile(__attach_match(name
, list
));
191 * separate_fqname - separate the namespace and profile names
192 * @fqname: the fqname name to split (NOT NULL)
193 * @ns_name: the namespace name if it exists (NOT NULL)
195 * This is the xtable equivalent routine of aa_split_fqname. It finds the
196 * split in an xtable fqname which contains an embedded \0 instead of a :
197 * if a namespace is specified. This is done so the xtable is constant and
198 * isn't re-split on every lookup.
200 * Either the profile or namespace name may be optional but if the namespace
201 * is specified the profile name termination must be present. This results
202 * in the following possible encodings:
204 * :ns_name\0profile_name\0
207 * NOTE: the xtable fqname is pre-validated at load time in unpack_trans_table
209 * Returns: profile name if it is specified else NULL
211 static const char *separate_fqname(const char *fqname
, const char **ns_name
)
215 if (fqname
[0] == ':') {
216 /* In this case there is guaranteed to be two \0 terminators
217 * in the string. They are verified at load time by
218 * by unpack_trans_table
220 *ns_name
= fqname
+ 1; /* skip : */
221 name
= *ns_name
+ strlen(*ns_name
) + 1;
232 static const char *next_name(int xtype
, const char *name
)
238 * x_table_lookup - lookup an x transition name via transition table
239 * @profile: current profile (NOT NULL)
240 * @xindex: index into x transition table
242 * Returns: refcounted profile, or NULL on failure (MAYBE NULL)
244 static struct aa_profile
*x_table_lookup(struct aa_profile
*profile
, u32 xindex
)
246 struct aa_profile
*new_profile
= NULL
;
247 struct aa_ns
*ns
= profile
->ns
;
248 u32 xtype
= xindex
& AA_X_TYPE_MASK
;
249 int index
= xindex
& AA_X_INDEX_MASK
;
252 /* index is guaranteed to be in range, validated at load time */
253 for (name
= profile
->file
.trans
.table
[index
]; !new_profile
&& name
;
254 name
= next_name(xtype
, name
)) {
255 struct aa_ns
*new_ns
;
256 const char *xname
= NULL
;
259 if (xindex
& AA_X_CHILD
) {
260 /* release by caller */
261 new_profile
= aa_find_child(profile
, name
);
263 } else if (*name
== ':') {
264 /* switching namespace */
266 xname
= name
= separate_fqname(name
, &ns_name
);
268 /* no name so use profile name */
269 xname
= profile
->base
.hname
;
270 if (*ns_name
== '@') {
271 /* TODO: variable support */
275 new_ns
= aa_find_ns(ns
, ns_name
);
278 } else if (*name
== '@') {
279 /* TODO: variable support */
282 /* basic namespace lookup */
286 /* released by caller */
287 new_profile
= aa_lookup_profile(new_ns
? new_ns
: ns
, xname
);
291 /* released by caller */
296 * x_to_profile - get target profile for a given xindex
297 * @profile: current profile (NOT NULL)
298 * @name: name to lookup (NOT NULL)
299 * @xindex: index into x transition table
301 * find profile for a transition index
303 * Returns: refcounted profile or NULL if not found available
305 static struct aa_profile
*x_to_profile(struct aa_profile
*profile
,
306 const char *name
, u32 xindex
)
308 struct aa_profile
*new_profile
= NULL
;
309 struct aa_ns
*ns
= profile
->ns
;
310 u32 xtype
= xindex
& AA_X_TYPE_MASK
;
314 /* fail exec unless ix || ux fallback - handled by caller */
317 if (xindex
& AA_X_CHILD
)
318 /* released by caller */
319 new_profile
= find_attach(ns
, &profile
->base
.profiles
,
322 /* released by caller */
323 new_profile
= find_attach(ns
, &ns
->base
.profiles
,
327 /* released by caller */
328 new_profile
= x_table_lookup(profile
, xindex
);
332 /* released by caller */
337 * apparmor_bprm_set_creds - set the new creds on the bprm struct
338 * @bprm: binprm for the exec (NOT NULL)
340 * Returns: %0 or error on failure
342 int apparmor_bprm_set_creds(struct linux_binprm
*bprm
)
344 struct aa_task_ctx
*ctx
;
345 struct aa_label
*label
;
346 struct aa_profile
*profile
, *new_profile
= NULL
;
350 struct aa_perms perms
= {};
351 struct path_cond cond
= {
352 file_inode(bprm
->file
)->i_uid
,
353 file_inode(bprm
->file
)->i_mode
355 const char *name
= NULL
, *info
= NULL
;
358 if (bprm
->cred_prepared
)
361 ctx
= cred_ctx(bprm
->cred
);
364 label
= aa_get_newest_label(ctx
->label
);
365 profile
= labels_profile(label
);
367 /* buffer freed below, name is pointer into buffer */
370 * get the namespace from the replacement profile as replacement
371 * can change the namespace
374 state
= profile
->file
.start
;
376 error
= aa_path_name(&bprm
->file
->f_path
, profile
->path_flags
, buffer
,
377 &name
, &info
, profile
->disconnected
);
379 if (profile_unconfined(profile
) ||
380 (profile
->label
.flags
& FLAG_IX_ON_NAME_ERROR
))
382 name
= bprm
->filename
;
386 /* Test for onexec first as onexec directives override other
389 if (profile_unconfined(profile
)) {
390 /* unconfined task */
392 /* change_profile on exec already been granted */
393 new_profile
= labels_profile(aa_get_label(ctx
->onexec
));
395 new_profile
= find_attach(ns
, &ns
->base
.profiles
, name
);
399 * NOTE: Domain transitions from unconfined are allowed
400 * even when no_new_privs is set because this aways results
401 * in a further reduction of permissions.
406 /* find exec permissions for name */
407 state
= aa_str_perms(profile
->file
.dfa
, state
, name
, &cond
, &perms
);
410 info
= "change_profile onexec";
411 new_profile
= labels_profile(aa_get_newest_label(ctx
->onexec
));
412 if (!(perms
.allow
& AA_MAY_ONEXEC
))
415 /* test if this exec can be paired with change_profile onexec.
416 * onexec permission is linked to exec with a standard pairing
417 * exec\0change_profile
419 state
= aa_dfa_null_transition(profile
->file
.dfa
, state
);
420 cp
= change_profile_perms(profile
, labels_ns(ctx
->onexec
),
421 labels_profile(ctx
->onexec
)->base
.name
,
422 AA_MAY_ONEXEC
, state
);
424 if (!(cp
.allow
& AA_MAY_ONEXEC
))
429 if (perms
.allow
& MAY_EXEC
) {
430 /* exec permission determine how to transition */
431 new_profile
= x_to_profile(profile
, name
, perms
.xindex
);
433 if (perms
.xindex
& AA_X_INHERIT
) {
434 /* (p|c|n)ix - don't change profile but do
435 * use the newest version, which was picked
436 * up above when getting profile
438 info
= "ix fallback";
439 new_profile
= aa_get_profile(profile
);
441 } else if (perms
.xindex
& AA_X_UNCONFINED
) {
442 new_profile
= aa_get_newest_profile(ns
->unconfined
);
443 info
= "ux fallback";
446 info
= "profile not found";
447 /* remove MAY_EXEC to audit as failure */
448 perms
.allow
&= ~MAY_EXEC
;
451 } else if (COMPLAIN_MODE(profile
)) {
452 /* no exec permission - are we in learning mode */
453 new_profile
= aa_new_null_profile(profile
, false, name
,
457 info
= "could not create null profile";
460 perms
.xindex
|= AA_X_UNSAFE
;
466 * Policy has specified a domain transition, if no_new_privs then
469 if (bprm
->unsafe
& LSM_UNSAFE_NO_NEW_PRIVS
) {
477 if (bprm
->unsafe
& LSM_UNSAFE_SHARE
) {
478 /* FIXME: currently don't mediate shared state */
482 if (bprm
->unsafe
& LSM_UNSAFE_PTRACE
) {
483 error
= may_change_ptraced_domain(&new_profile
->label
, &info
);
488 /* Determine if secure exec is needed.
489 * Can be at this point for the following reasons:
490 * 1. unconfined switching to confined
491 * 2. confined switching to different confinement
492 * 3. confined switching to unconfined
494 * Cases 2 and 3 are marked as requiring secure exec
495 * (unless policy specified "unsafe exec")
497 * bprm->unsafe is used to cache the AA_X_UNSAFE permission
498 * to avoid having to recompute in secureexec
500 if (!(perms
.xindex
& AA_X_UNSAFE
)) {
501 AA_DEBUG("scrubbing environment variables for %s profile=%s\n",
502 name
, new_profile
->base
.hname
);
503 bprm
->unsafe
|= AA_SECURE_X_NEEDED
;
506 /* when transitioning profiles clear unsafe personality bits */
507 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
510 aa_put_label(ctx
->label
);
511 /* transfer new profile reference will be released when ctx is freed */
512 ctx
->label
= &new_profile
->label
;
515 /* clear out all temporary/transitional state from the context */
516 aa_clear_task_ctx_trans(ctx
);
519 error
= aa_audit_file(profile
, &perms
, OP_EXEC
, MAY_EXEC
, name
,
520 new_profile
? new_profile
->base
.hname
: NULL
,
521 new_profile
? &new_profile
->label
: NULL
,
522 cond
.uid
, info
, error
);
525 aa_put_profile(new_profile
);
533 * apparmor_bprm_secureexec - determine if secureexec is needed
534 * @bprm: binprm for exec (NOT NULL)
536 * Returns: %1 if secureexec is needed else %0
538 int apparmor_bprm_secureexec(struct linux_binprm
*bprm
)
540 /* the decision to use secure exec is computed in set_creds
541 * and stored in bprm->unsafe.
543 if (bprm
->unsafe
& AA_SECURE_X_NEEDED
)
550 * Functions for self directed profile change
554 * new_compound_name - create an hname with @n2 appended to @n1
555 * @n1: base of hname (NOT NULL)
556 * @n2: name to append (NOT NULL)
558 * Returns: new name or NULL on error
560 static char *new_compound_name(const char *n1
, const char *n2
)
562 char *name
= kmalloc(strlen(n1
) + strlen(n2
) + 3, GFP_KERNEL
);
564 sprintf(name
, "%s//%s", n1
, n2
);
569 * aa_change_hat - change hat to/from subprofile
570 * @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0)
571 * @count: number of hat names in @hats
572 * @token: magic value to validate the hat change
573 * @flags: flags affecting behavior of the change
575 * Change to the first profile specified in @hats that exists, and store
576 * the @hat_magic in the current task context. If the count == 0 and the
577 * @token matches that stored in the current task context, return to the
580 * Returns %0 on success, error otherwise.
582 int aa_change_hat(const char *hats
[], int count
, u64 token
, int flags
)
584 const struct cred
*cred
;
585 struct aa_task_ctx
*ctx
;
586 struct aa_label
*label
, *previous_label
;
587 struct aa_profile
*profile
, *hat
= NULL
;
590 struct aa_perms perms
= {};
591 const char *target
= NULL
, *info
= NULL
;
595 * Fail explicitly requested domain transitions if no_new_privs.
596 * There is no exception for unconfined as change_hat is not
599 if (task_no_new_privs(current
))
603 cred
= get_current_cred();
604 ctx
= cred_ctx(cred
);
605 label
= aa_get_newest_cred_label(cred
);
606 previous_label
= aa_get_newest_label(ctx
->previous
);
607 profile
= labels_profile(label
);
609 if (unconfined(label
)) {
616 /* attempting to change into a new hat or switch to a sibling */
617 struct aa_profile
*root
;
618 if (PROFILE_IS_HAT(profile
))
619 root
= aa_get_profile_rcu(&profile
->parent
);
621 root
= aa_get_profile(profile
);
623 /* find first matching hat */
624 for (i
= 0; i
< count
&& !hat
; i
++)
626 hat
= aa_find_child(root
, hats
[i
]);
628 if (!COMPLAIN_MODE(root
) || (flags
& AA_CHANGE_TEST
)) {
629 if (list_empty(&root
->base
.profiles
))
633 aa_put_profile(root
);
638 * In complain mode and failed to match any hats.
639 * Audit the failure is based off of the first hat
640 * supplied. This is done due how userspace
641 * interacts with change_hat.
643 * TODO: Add logging of all failed hats
647 name
= new_compound_name(root
->base
.hname
, hats
[0]);
648 aa_put_profile(root
);
651 hat
= aa_new_null_profile(profile
, true, hats
[0],
654 info
= "failed null profile create";
659 aa_put_profile(root
);
660 target
= hat
->base
.hname
;
661 if (!PROFILE_IS_HAT(hat
)) {
662 info
= "target not hat";
668 error
= may_change_ptraced_domain(&hat
->label
, &info
);
675 if (!(flags
& AA_CHANGE_TEST
)) {
676 error
= aa_set_current_hat(&hat
->label
, token
);
677 if (error
== -EACCES
)
678 /* kill task in case of brute force attacks */
679 perms
.kill
= AA_MAY_CHANGEHAT
;
680 else if (name
&& !error
)
681 /* reset error for learning of new hats */
684 } else if (previous_label
) {
685 /* Return to saved profile. Kill task if restore fails
686 * to avoid brute force attacks
688 target
= previous_label
->hname
;
689 error
= aa_restore_previous_label(token
);
690 perms
.kill
= AA_MAY_CHANGEHAT
;
692 /* ignore restores when there is no saved profile */
696 if (!(flags
& AA_CHANGE_TEST
))
697 error
= aa_audit_file(profile
, &perms
, OP_CHANGE_HAT
,
698 AA_MAY_CHANGEHAT
, NULL
, target
, NULL
,
699 GLOBAL_ROOT_UID
, info
, error
);
705 aa_put_label(previous_label
);
712 * aa_change_profile - perform a one-way profile transition
713 * @fqname: name of profile may include namespace (NOT NULL)
714 * @onexec: whether this transition is to take place immediately or at exec
715 * @flags: flags affecting change behavior
717 * Change to new profile @name. Unlike with hats, there is no way
718 * to change back. If @name isn't specified the current profile name is
720 * If @onexec then the transition is delayed until
723 * Returns %0 on success, error otherwise.
725 int aa_change_profile(const char *fqname
, int flags
)
727 const struct cred
*cred
;
728 struct aa_label
*label
;
729 struct aa_profile
*profile
, *target
= NULL
;
730 struct aa_perms perms
= {};
731 const char *info
= NULL
, *op
;
735 if (!fqname
|| !*fqname
) {
736 AA_DEBUG("no profile name");
740 if (flags
& AA_CHANGE_ONEXEC
) {
741 request
= AA_MAY_ONEXEC
;
742 op
= OP_CHANGE_ONEXEC
;
744 request
= AA_MAY_CHANGE_PROFILE
;
745 op
= OP_CHANGE_PROFILE
;
748 cred
= get_current_cred();
749 label
= aa_get_newest_cred_label(cred
);
750 profile
= labels_profile(label
);
753 * Fail explicitly requested domain transitions if no_new_privs
754 * and not unconfined.
755 * Domain transitions from unconfined are allowed even when
756 * no_new_privs is set because this aways results in a reduction
759 if (task_no_new_privs(current
) && !profile_unconfined(profile
)) {
764 target
= aa_fqlookupn_profile(label
, fqname
, strlen(fqname
));
766 info
= "profile not found";
768 if ((flags
& AA_CHANGE_TEST
) ||
769 !COMPLAIN_MODE(profile
))
772 target
= aa_new_null_profile(profile
, false, fqname
,
775 info
= "failed null profile create";
781 perms
= change_profile_perms(profile
, target
->ns
, target
->base
.hname
,
782 request
, profile
->file
.start
);
783 if (!(perms
.allow
& request
)) {
788 /* check if tracing task is allowed to trace target domain */
789 error
= may_change_ptraced_domain(&target
->label
, &info
);
791 info
= "ptrace prevents transition";
795 if (flags
& AA_CHANGE_TEST
)
798 if (flags
& AA_CHANGE_ONEXEC
)
799 error
= aa_set_current_onexec(&target
->label
, 0);
801 error
= aa_replace_current_label(&target
->label
);
804 if (!(flags
& AA_CHANGE_TEST
))
805 error
= aa_audit_file(profile
, &perms
, op
, request
, NULL
,
806 fqname
, NULL
, GLOBAL_ROOT_UID
, info
,
809 aa_put_profile(target
);