]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/apparmor/file.c
2 * AppArmor security module
4 * This file contains AppArmor mediation of files
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/tty.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
19 #include "include/apparmor.h"
20 #include "include/audit.h"
21 #include "include/context.h"
22 #include "include/file.h"
23 #include "include/match.h"
24 #include "include/path.h"
25 #include "include/policy.h"
26 #include "include/label.h"
28 static u32
map_mask_to_chr_mask(u32 mask
)
30 u32 m
= mask
& PERMS_CHRS_MASK
;
32 if (mask
& AA_MAY_GETATTR
)
34 if (mask
& (AA_MAY_SETATTR
| AA_MAY_CHMOD
| AA_MAY_CHOWN
))
41 * audit_file_mask - convert mask to permission string
42 * @buffer: buffer to write string to (NOT NULL)
43 * @mask: permission mask to convert
45 static void audit_file_mask(struct audit_buffer
*ab
, u32 mask
)
49 aa_perm_mask_to_str(str
, aa_file_perm_chrs
, map_mask_to_chr_mask(mask
));
50 audit_log_string(ab
, str
);
54 * file_audit_cb - call back for file specific audit fields
55 * @ab: audit_buffer (NOT NULL)
56 * @va: audit struct to audit values of (NOT NULL)
58 static void file_audit_cb(struct audit_buffer
*ab
, void *va
)
60 struct common_audit_data
*sa
= va
;
61 kuid_t fsuid
= current_fsuid();
63 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
64 audit_log_format(ab
, " requested_mask=");
65 audit_file_mask(ab
, aad(sa
)->request
);
67 if (aad(sa
)->denied
& AA_AUDIT_FILE_MASK
) {
68 audit_log_format(ab
, " denied_mask=");
69 audit_file_mask(ab
, aad(sa
)->denied
);
71 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
72 audit_log_format(ab
, " fsuid=%d",
73 from_kuid(&init_user_ns
, fsuid
));
74 audit_log_format(ab
, " ouid=%d",
75 from_kuid(&init_user_ns
, aad(sa
)->fs
.ouid
));
79 audit_log_format(ab
, " target=");
80 aa_label_xaudit(ab
, labels_ns(aad(sa
)->label
), aad(sa
)->peer
,
81 FLAG_VIEW_SUBNS
, GFP_ATOMIC
);
82 } else if (aad(sa
)->fs
.target
) {
83 audit_log_format(ab
, " target=");
84 audit_log_untrustedstring(ab
, aad(sa
)->fs
.target
);
89 * aa_audit_file - handle the auditing of file operations
90 * @profile: the profile being enforced (NOT NULL)
91 * @perms: the permissions computed for the request (NOT NULL)
92 * @op: operation being mediated
93 * @request: permissions requested
94 * @name: name of object being mediated (MAYBE NULL)
95 * @target: name of target (MAYBE NULL)
96 * @tlabel: target label (MAY BE NULL)
98 * @info: extra information message (MAYBE NULL)
99 * @error: 0 if operation allowed else failure error code
101 * Returns: %0 or error on failure
103 int aa_audit_file(struct aa_profile
*profile
, struct aa_perms
*perms
,
104 const char *op
, u32 request
, const char *name
,
105 const char *target
, struct aa_label
*tlabel
,
106 kuid_t ouid
, const char *info
, int error
)
108 int type
= AUDIT_APPARMOR_AUTO
;
109 DEFINE_AUDIT_DATA(sa
, LSM_AUDIT_DATA_TASK
, op
);
112 aad(&sa
)->request
= request
;
113 aad(&sa
)->name
= name
;
114 aad(&sa
)->fs
.target
= target
;
115 aad(&sa
)->peer
= tlabel
;
116 aad(&sa
)->fs
.ouid
= ouid
;
117 aad(&sa
)->info
= info
;
118 aad(&sa
)->error
= error
;
121 if (likely(!aad(&sa
)->error
)) {
122 u32 mask
= perms
->audit
;
124 if (unlikely(AUDIT_MODE(profile
) == AUDIT_ALL
))
127 /* mask off perms that are not being force audited */
128 aad(&sa
)->request
&= mask
;
130 if (likely(!aad(&sa
)->request
))
132 type
= AUDIT_APPARMOR_AUDIT
;
134 /* only report permissions that were denied */
135 aad(&sa
)->request
= aad(&sa
)->request
& ~perms
->allow
;
136 AA_BUG(!aad(&sa
)->request
);
138 if (aad(&sa
)->request
& perms
->kill
)
139 type
= AUDIT_APPARMOR_KILL
;
141 /* quiet known rejects, assumes quiet and kill do not overlap */
142 if ((aad(&sa
)->request
& perms
->quiet
) &&
143 AUDIT_MODE(profile
) != AUDIT_NOQUIET
&&
144 AUDIT_MODE(profile
) != AUDIT_ALL
)
145 aad(&sa
)->request
&= ~perms
->quiet
;
147 if (!aad(&sa
)->request
)
148 return aad(&sa
)->error
;
151 aad(&sa
)->denied
= aad(&sa
)->request
& ~perms
->allow
;
152 return aa_audit(type
, profile
, &sa
, file_audit_cb
);
156 * map_old_perms - map old file perms layout to the new layout
157 * @old: permission set in old mapping
159 * Returns: new permission mapping
161 static u32
map_old_perms(u32 old
)
165 new |= AA_MAY_GETATTR
| AA_MAY_OPEN
;
167 new |= AA_MAY_SETATTR
| AA_MAY_CREATE
| AA_MAY_DELETE
|
168 AA_MAY_CHMOD
| AA_MAY_CHOWN
| AA_MAY_OPEN
;
171 /* the old mapping lock and link_subset flags where overlaid
172 * and use was determined by part of a pair that they were in
175 new |= AA_MAY_LOCK
| AA_LINK_SUBSET
;
176 if (old
& 0x40) /* AA_EXEC_MMAP */
183 * aa_compute_fperms - convert dfa compressed perms to internal perms
184 * @dfa: dfa to compute perms for (NOT NULL)
185 * @state: state in dfa
186 * @cond: conditions to consider (NOT NULL)
188 * TODO: convert from dfa + state to permission entry, do computation conversion
191 * Returns: computed permission set
193 struct aa_perms
aa_compute_fperms(struct aa_dfa
*dfa
, unsigned int state
,
194 struct path_cond
*cond
)
196 struct aa_perms perms
;
198 /* FIXME: change over to new dfa format
199 * currently file perms are encoded in the dfa, new format
200 * splits the permissions from the dfa. This mapping can be
201 * done at profile load
204 perms
.kill
= perms
.stop
= 0;
205 perms
.complain
= perms
.cond
= 0;
209 if (uid_eq(current_fsuid(), cond
->uid
)) {
210 perms
.allow
= map_old_perms(dfa_user_allow(dfa
, state
));
211 perms
.audit
= map_old_perms(dfa_user_audit(dfa
, state
));
212 perms
.quiet
= map_old_perms(dfa_user_quiet(dfa
, state
));
213 perms
.xindex
= dfa_user_xindex(dfa
, state
);
215 perms
.allow
= map_old_perms(dfa_other_allow(dfa
, state
));
216 perms
.audit
= map_old_perms(dfa_other_audit(dfa
, state
));
217 perms
.quiet
= map_old_perms(dfa_other_quiet(dfa
, state
));
218 perms
.xindex
= dfa_other_xindex(dfa
, state
);
220 perms
.allow
|= AA_MAY_GETATTR
;
222 /* change_profile wasn't determined by ownership in old mapping */
223 if (ACCEPT_TABLE(dfa
)[state
] & 0x80000000)
224 perms
.allow
|= AA_MAY_CHANGE_PROFILE
;
225 if (ACCEPT_TABLE(dfa
)[state
] & 0x40000000)
226 perms
.allow
|= AA_MAY_ONEXEC
;
232 * aa_str_perms - find permission that match @name
233 * @dfa: to match against (MAYBE NULL)
234 * @state: state to start matching in
235 * @name: string to match against dfa (NOT NULL)
236 * @cond: conditions to consider for permission set computation (NOT NULL)
237 * @perms: Returns - the permissions found when matching @name
239 * Returns: the final state in @dfa when beginning @start and walking @name
241 unsigned int aa_str_perms(struct aa_dfa
*dfa
, unsigned int start
,
242 const char *name
, struct path_cond
*cond
,
243 struct aa_perms
*perms
)
246 state
= aa_dfa_match(dfa
, start
, name
);
247 *perms
= aa_compute_fperms(dfa
, state
, cond
);
253 * is_deleted - test if a file has been completely unlinked
254 * @dentry: dentry of file to test for deletion (NOT NULL)
256 * Returns: %1 if deleted else %0
258 static inline bool is_deleted(struct dentry
*dentry
)
260 if (d_unlinked(dentry
) && d_backing_inode(dentry
)->i_nlink
== 0)
266 * aa_path_perm - do permissions check & audit for @path
267 * @op: operation being checked
268 * @profile: profile being enforced (NOT NULL)
269 * @path: path to check permissions of (NOT NULL)
270 * @flags: any additional path flags beyond what the profile specifies
271 * @request: requested permissions
272 * @cond: conditional info for this request (NOT NULL)
274 * Returns: %0 else error if access denied or other error
276 int aa_path_perm(const char *op
, struct aa_profile
*profile
,
277 const struct path
*path
, int flags
, u32 request
,
278 struct path_cond
*cond
)
281 struct aa_perms perms
= {};
282 const char *name
, *info
= NULL
;
285 flags
|= profile
->path_flags
| (S_ISDIR(cond
->mode
) ? PATH_IS_DIR
: 0);
287 error
= aa_path_name(path
, flags
, buffer
, &name
, &info
,
288 profile
->disconnected
);
290 if (error
== -ENOENT
&& is_deleted(path
->dentry
)) {
291 /* Access to open files that are deleted are
292 * give a pass (implicit delegation)
296 perms
.allow
= request
;
299 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, name
, cond
,
301 if (request
& ~perms
.allow
)
304 error
= aa_audit_file(profile
, &perms
, op
, request
, name
, NULL
, NULL
,
305 cond
->uid
, info
, error
);
312 * xindex_is_subset - helper for aa_path_link
313 * @link: link permission set
314 * @target: target permission set
316 * test target x permissions are equal OR a subset of link x permissions
317 * this is done as part of the subset test, where a hardlink must have
318 * a subset of permissions that the target has.
320 * Returns: %1 if subset else %0
322 static inline bool xindex_is_subset(u32 link
, u32 target
)
324 if (((link
& ~AA_X_UNSAFE
) != (target
& ~AA_X_UNSAFE
)) ||
325 ((link
& AA_X_UNSAFE
) && !(target
& AA_X_UNSAFE
)))
332 * aa_path_link - Handle hard link permission check
333 * @profile: the profile being enforced (NOT NULL)
334 * @old_dentry: the target dentry (NOT NULL)
335 * @new_dir: directory the new link will be created in (NOT NULL)
336 * @new_dentry: the link being created (NOT NULL)
338 * Handle the permission test for a link & target pair. Permission
339 * is encoded as a pair where the link permission is determined
340 * first, and if allowed, the target is tested. The target test
341 * is done from the point of the link match (not start of DFA)
342 * making the target permission dependent on the link permission match.
344 * The subset test if required forces that permissions granted
345 * on link are a subset of the permission granted to target.
347 * Returns: %0 if allowed else error
349 int aa_path_link(struct aa_profile
*profile
, struct dentry
*old_dentry
,
350 const struct path
*new_dir
, struct dentry
*new_dentry
)
352 struct path link
= { .mnt
= new_dir
->mnt
, .dentry
= new_dentry
};
353 struct path target
= { .mnt
= new_dir
->mnt
, .dentry
= old_dentry
};
354 struct path_cond cond
= {
355 d_backing_inode(old_dentry
)->i_uid
,
356 d_backing_inode(old_dentry
)->i_mode
358 char *buffer
= NULL
, *buffer2
= NULL
;
359 const char *lname
, *tname
= NULL
, *info
= NULL
;
360 struct aa_perms lperms
, perms
;
361 u32 request
= AA_MAY_LINK
;
365 get_buffers(buffer
, buffer2
);
368 /* buffer freed below, lname is pointer in buffer */
369 error
= aa_path_name(&link
, profile
->path_flags
, buffer
, &lname
,
370 &info
, profile
->disconnected
);
374 /* buffer2 freed below, tname is pointer in buffer2 */
375 error
= aa_path_name(&target
, profile
->path_flags
, buffer2
, &tname
,
376 &info
, profile
->disconnected
);
381 /* aa_str_perms - handles the case of the dfa being NULL */
382 state
= aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, lname
,
385 if (!(lperms
.allow
& AA_MAY_LINK
))
388 /* test to see if target can be paired with link */
389 state
= aa_dfa_null_transition(profile
->file
.dfa
, state
);
390 aa_str_perms(profile
->file
.dfa
, state
, tname
, &cond
, &perms
);
392 /* force audit/quiet masks for link are stored in the second entry
395 lperms
.audit
= perms
.audit
;
396 lperms
.quiet
= perms
.quiet
;
397 lperms
.kill
= perms
.kill
;
399 if (!(perms
.allow
& AA_MAY_LINK
)) {
400 info
= "target restricted";
404 /* done if link subset test is not required */
405 if (!(perms
.allow
& AA_LINK_SUBSET
))
408 /* Do link perm subset test requiring allowed permission on link are a
409 * subset of the allowed permissions on target.
411 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, tname
, &cond
,
414 /* AA_MAY_LINK is not considered in the subset test */
415 request
= lperms
.allow
& ~AA_MAY_LINK
;
416 lperms
.allow
&= perms
.allow
| AA_MAY_LINK
;
418 request
|= AA_AUDIT_FILE_MASK
& (lperms
.allow
& ~perms
.allow
);
419 if (request
& ~lperms
.allow
) {
421 } else if ((lperms
.allow
& MAY_EXEC
) &&
422 !xindex_is_subset(lperms
.xindex
, perms
.xindex
)) {
423 lperms
.allow
&= ~MAY_EXEC
;
425 info
= "link not subset of target";
433 error
= aa_audit_file(profile
, &lperms
, OP_LINK
, request
,
434 lname
, tname
, NULL
, cond
.uid
, info
, error
);
435 put_buffers(buffer
, buffer2
);
441 * aa_file_perm - do permission revalidation check & audit for @file
442 * @op: operation being checked
443 * @label: label being enforced (NOT NULL)
444 * @file: file to revalidate access permissions on (NOT NULL)
445 * @request: requested permissions
447 * Returns: %0 if access allowed else error
449 int aa_file_perm(const char *op
, struct aa_label
*label
, struct file
*file
,
452 struct path_cond cond
= {
453 .uid
= file_inode(file
)->i_uid
,
454 .mode
= file_inode(file
)->i_mode
456 struct aa_file_ctx
*fctx
;
457 struct aa_label
*flabel
;
464 fctx
= file_ctx(file
);
467 flabel
= rcu_dereference(fctx
->label
);
470 /* revalidate access, if task is unconfined, or the cached cred
471 * doesn't match or if the request is for more permissions than
474 * Note: the test for !unconfined(flabel) is to handle file
475 * delegation from unconfined tasks
477 denied
= request
& ~fctx
->allow
;
478 if (unconfined(label
) || unconfined(flabel
) ||
479 (!denied
&& aa_label_is_subset(flabel
, label
)))
482 /* TODO: label cross check */
484 if (file
->f_path
.mnt
&& path_mediated_fs(file
->f_path
.dentry
))
485 error
= aa_path_perm(op
, labels_profile(label
), &file
->f_path
,
486 PATH_DELEGATE_DELETED
, request
, &cond
);
494 static void revalidate_tty(struct aa_label
*label
)
496 struct tty_struct
*tty
;
499 tty
= get_current_tty();
503 spin_lock(&tty
->files_lock
);
504 if (!list_empty(&tty
->tty_files
)) {
505 struct tty_file_private
*file_priv
;
507 /* TODO: Revalidate access to controlling tty. */
508 file_priv
= list_first_entry(&tty
->tty_files
,
509 struct tty_file_private
, list
);
510 file
= file_priv
->file
;
512 if (aa_file_perm(OP_INHERIT
, label
, file
, MAY_READ
| MAY_WRITE
))
515 spin_unlock(&tty
->files_lock
);
522 static int match_file(const void *p
, struct file
*file
, unsigned int fd
)
524 struct aa_label
*label
= (struct aa_label
*)p
;
526 if (aa_file_perm(OP_INHERIT
, label
, file
, aa_map_file_to_perms(file
)))
532 /* based on selinux's flush_unauthorized_files */
533 void aa_inherit_files(const struct cred
*cred
, struct files_struct
*files
)
535 struct aa_label
*label
= aa_get_newest_cred_label(cred
);
536 struct file
*devnull
= NULL
;
539 revalidate_tty(label
);
541 /* Revalidate access to inherited open files. */
542 n
= iterate_fd(files
, 0, match_file
, label
);
543 if (!n
) /* none found? */
546 devnull
= dentry_open(&aa_null
, O_RDWR
, cred
);
549 /* replace all the matching ones with this */
551 replace_fd(n
- 1, devnull
, 0);
552 } while ((n
= iterate_fd(files
, n
, match_file
, label
)) != 0);