]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - security/apparmor/file.c
2 * AppArmor security module
4 * This file contains AppArmor mediation of files
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/tty.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
19 #include "include/af_unix.h"
20 #include "include/apparmor.h"
21 #include "include/audit.h"
22 #include "include/context.h"
23 #include "include/file.h"
24 #include "include/match.h"
25 #include "include/path.h"
26 #include "include/policy.h"
27 #include "include/label.h"
29 static u32
map_mask_to_chr_mask(u32 mask
)
31 u32 m
= mask
& PERMS_CHRS_MASK
;
32 if (mask
& AA_MAY_GETATTR
)
34 if (mask
& (AA_MAY_SETATTR
| AA_MAY_CHMOD
| AA_MAY_CHOWN
))
41 * audit_file_mask - convert mask to permission string
42 * @buffer: buffer to write string to (NOT NULL)
43 * @mask: permission mask to convert
45 static void audit_file_mask(struct audit_buffer
*ab
, u32 mask
)
49 aa_perm_mask_to_str(str
, aa_file_perm_chrs
, map_mask_to_chr_mask(mask
));
50 audit_log_string(ab
, str
);
54 * file_audit_cb - call back for file specific audit fields
55 * @ab: audit_buffer (NOT NULL)
56 * @va: audit struct to audit values of (NOT NULL)
58 static void file_audit_cb(struct audit_buffer
*ab
, void *va
)
60 struct common_audit_data
*sa
= va
;
61 kuid_t fsuid
= current_fsuid();
63 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
64 audit_log_format(ab
, " requested_mask=");
65 audit_file_mask(ab
, aad(sa
)->request
);
67 if (aad(sa
)->denied
& AA_AUDIT_FILE_MASK
) {
68 audit_log_format(ab
, " denied_mask=");
69 audit_file_mask(ab
, aad(sa
)->denied
);
71 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
72 audit_log_format(ab
, " fsuid=%d",
73 from_kuid(&init_user_ns
, fsuid
));
74 audit_log_format(ab
, " ouid=%d",
75 from_kuid(&init_user_ns
, aad(sa
)->fs
.ouid
));
79 audit_log_format(ab
, " target=");
80 aa_label_xaudit(ab
, labels_ns(aad(sa
)->label
), aad(sa
)->peer
,
81 FLAG_VIEW_SUBNS
, GFP_ATOMIC
);
82 } else if (aad(sa
)->fs
.target
) {
83 audit_log_format(ab
, " target=");
84 audit_log_untrustedstring(ab
, aad(sa
)->fs
.target
);
89 * aa_audit_file - handle the auditing of file operations
90 * @profile: the profile being enforced (NOT NULL)
91 * @perms: the permissions computed for the request (NOT NULL)
92 * @op: operation being mediated
93 * @request: permissions requested
94 * @name: name of object being mediated (MAYBE NULL)
95 * @target: name of target (MAYBE NULL)
96 * @tlabel: target label (MAY BE NULL)
98 * @info: extra information message (MAYBE NULL)
99 * @error: 0 if operation allowed else failure error code
101 * Returns: %0 or error on failure
103 int aa_audit_file(struct aa_profile
*profile
, struct aa_perms
*perms
,
104 const char *op
, u32 request
, const char *name
,
105 const char *target
, struct aa_label
*tlabel
,
106 kuid_t ouid
, const char *info
, int error
)
108 int type
= AUDIT_APPARMOR_AUTO
;
110 DEFINE_AUDIT_DATA(sa
, LSM_AUDIT_DATA_TASK
, op
);
112 aad(&sa
)->request
= request
;
113 aad(&sa
)->name
= name
;
114 aad(&sa
)->fs
.target
= target
;
115 aad(&sa
)->peer
= tlabel
;
116 aad(&sa
)->fs
.ouid
= ouid
;
117 aad(&sa
)->info
= info
;
118 aad(&sa
)->error
= error
;
121 if (likely(!aad(&sa
)->error
)) {
122 u32 mask
= perms
->audit
;
124 if (unlikely(AUDIT_MODE(profile
) == AUDIT_ALL
))
127 /* mask off perms that are not being force audited */
128 aad(&sa
)->request
&= mask
;
130 if (likely(!aad(&sa
)->request
))
132 type
= AUDIT_APPARMOR_AUDIT
;
134 /* only report permissions that were denied */
135 aad(&sa
)->request
= aad(&sa
)->request
& ~perms
->allow
;
136 AA_BUG(!aad(&sa
)->request
);
138 if (aad(&sa
)->request
& perms
->kill
)
139 type
= AUDIT_APPARMOR_KILL
;
141 /* quiet known rejects, assumes quiet and kill do not overlap */
142 if ((aad(&sa
)->request
& perms
->quiet
) &&
143 AUDIT_MODE(profile
) != AUDIT_NOQUIET
&&
144 AUDIT_MODE(profile
) != AUDIT_ALL
)
145 aad(&sa
)->request
&= ~perms
->quiet
;
147 if (!aad(&sa
)->request
)
148 return aad(&sa
)->error
;
151 aad(&sa
)->denied
= aad(&sa
)->request
& ~perms
->allow
;
152 return aa_audit(type
, profile
, &sa
, file_audit_cb
);
156 * is_deleted - test if a file has been completely unlinked
157 * @dentry: dentry of file to test for deletion (NOT NULL)
159 * Returns: %1 if deleted else %0
161 static inline bool is_deleted(struct dentry
*dentry
)
163 if (d_unlinked(dentry
) && d_backing_inode(dentry
)->i_nlink
== 0)
168 static int path_name(const char *op
, struct aa_label
*label
,
169 const struct path
*path
, int flags
, char *buffer
,
170 const char**name
, struct path_cond
*cond
, u32 request
)
172 struct aa_profile
*profile
;
173 const char *info
= NULL
;
174 int error
= aa_path_name(path
, flags
, buffer
, name
, &info
,
175 labels_profile(label
)->disconnected
);
177 fn_for_each_confined(label
, profile
,
178 aa_audit_file(profile
, &nullperms
, op
, request
, *name
,
179 NULL
, NULL
, cond
->uid
, info
, error
));
187 * map_old_perms - map old file perms layout to the new layout
188 * @old: permission set in old mapping
190 * Returns: new permission mapping
192 static u32
map_old_perms(u32 old
)
196 new |= AA_MAY_GETATTR
| AA_MAY_OPEN
;
198 new |= AA_MAY_SETATTR
| AA_MAY_CREATE
| AA_MAY_DELETE
|
199 AA_MAY_CHMOD
| AA_MAY_CHOWN
| AA_MAY_OPEN
|
203 /* the old mapping lock and link_subset flags where overlaid
204 * and use was determined by part of a pair that they were in
207 new |= AA_MAY_LOCK
| AA_LINK_SUBSET
;
208 if (old
& 0x40) /* AA_EXEC_MMAP */
215 * aa_compute_fperms - convert dfa compressed perms to internal perms
216 * @dfa: dfa to compute perms for (NOT NULL)
217 * @state: state in dfa
218 * @cond: conditions to consider (NOT NULL)
220 * TODO: convert from dfa + state to permission entry, do computation conversion
223 * Returns: computed permission set
225 struct aa_perms
aa_compute_fperms(struct aa_dfa
*dfa
, unsigned int state
,
226 struct path_cond
*cond
)
228 struct aa_perms perms
;
230 /* FIXME: change over to new dfa format
231 * currently file perms are encoded in the dfa, new format
232 * splits the permissions from the dfa. This mapping can be
233 * done at profile load
236 perms
.kill
= perms
.stop
= 0;
237 perms
.complain
= perms
.cond
= 0;
241 if (uid_eq(current_fsuid(), cond
->uid
)) {
242 perms
.allow
= map_old_perms(dfa_user_allow(dfa
, state
));
243 perms
.audit
= map_old_perms(dfa_user_audit(dfa
, state
));
244 perms
.quiet
= map_old_perms(dfa_user_quiet(dfa
, state
));
245 perms
.xindex
= dfa_user_xindex(dfa
, state
);
247 perms
.allow
= map_old_perms(dfa_other_allow(dfa
, state
));
248 perms
.audit
= map_old_perms(dfa_other_audit(dfa
, state
));
249 perms
.quiet
= map_old_perms(dfa_other_quiet(dfa
, state
));
250 perms
.xindex
= dfa_other_xindex(dfa
, state
);
252 perms
.allow
|= AA_MAY_GETATTR
;
254 /* change_profile wasn't determined by ownership in old mapping */
255 if (ACCEPT_TABLE(dfa
)[state
] & 0x80000000)
256 perms
.allow
|= AA_MAY_CHANGE_PROFILE
;
257 if (ACCEPT_TABLE(dfa
)[state
] & 0x40000000)
258 perms
.allow
|= AA_MAY_ONEXEC
;
264 * aa_str_perms - find permission that match @name
265 * @dfa: to match against (MAYBE NULL)
266 * @state: state to start matching in
267 * @name: string to match against dfa (NOT NULL)
268 * @cond: conditions to consider for permission set computation (NOT NULL)
269 * @perms: Returns - the permissions found when matching @name
271 * Returns: the final state in @dfa when beginning @start and walking @name
273 unsigned int aa_str_perms(struct aa_dfa
*dfa
, unsigned int start
,
274 const char *name
, struct path_cond
*cond
,
275 struct aa_perms
*perms
)
278 state
= aa_dfa_match(dfa
, start
, name
);
279 *perms
= aa_compute_fperms(dfa
, state
, cond
);
284 int __aa_path_perm(const char *op
, struct aa_profile
*profile
, const char *name
,
285 u32 request
, struct path_cond
*cond
, int flags
,
286 struct aa_perms
*perms
)
290 if (profile_unconfined(profile
) ||
291 ((flags
& PATH_SOCK_COND
) && !PROFILE_MEDIATES_AF(profile
, AF_UNIX
)))
293 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, name
, cond
, perms
);
294 if (request
& ~perms
->allow
)
296 return aa_audit_file(profile
, perms
, op
, request
, name
, NULL
, NULL
,
301 static int profile_path_perm(const char *op
, struct aa_profile
*profile
,
302 const struct path
*path
, char *buffer
, u32 request
,
303 struct path_cond
*cond
, int flags
,
304 struct aa_perms
*perms
)
309 if (profile_unconfined(profile
))
312 error
= path_name(op
, &profile
->label
, path
,
313 flags
| profile
->path_flags
, buffer
, &name
, cond
,
317 return __aa_path_perm(op
, profile
, name
, request
, cond
, flags
,
322 * aa_path_perm - do permissions check & audit for @path
323 * @op: operation being checked
324 * @label: profile being enforced (NOT NULL)
325 * @path: path to check permissions of (NOT NULL)
326 * @flags: any additional path flags beyond what the profile specifies
327 * @request: requested permissions
328 * @cond: conditional info for this request (NOT NULL)
330 * Returns: %0 else error if access denied or other error
332 int aa_path_perm(const char *op
, struct aa_label
*label
,
333 const struct path
*path
, int flags
, u32 request
,
334 struct path_cond
*cond
)
336 struct aa_perms perms
= {};
337 struct aa_profile
*profile
;
341 flags
|= PATH_DELEGATE_DELETED
| (S_ISDIR(cond
->mode
) ? PATH_IS_DIR
: 0);
343 error
= fn_for_each_confined(label
, profile
,
344 profile_path_perm(op
, profile
, path
, buffer
, request
,
345 cond
, flags
, &perms
));
352 * xindex_is_subset - helper for aa_path_link
353 * @link: link permission set
354 * @target: target permission set
356 * test target x permissions are equal OR a subset of link x permissions
357 * this is done as part of the subset test, where a hardlink must have
358 * a subset of permissions that the target has.
360 * Returns: %1 if subset else %0
362 static inline bool xindex_is_subset(u32 link
, u32 target
)
364 if (((link
& ~AA_X_UNSAFE
) != (target
& ~AA_X_UNSAFE
)) ||
365 ((link
& AA_X_UNSAFE
) && !(target
& AA_X_UNSAFE
)))
371 static int profile_path_link(struct aa_profile
*profile
,
372 const struct path
*link
, char *buffer
,
373 const struct path
*target
, char *buffer2
,
374 struct path_cond
*cond
)
376 const char *lname
, *tname
= NULL
;
377 struct aa_perms lperms
, perms
;
378 const char *info
= NULL
;
379 u32 request
= AA_MAY_LINK
;
383 error
= path_name(OP_LINK
, &profile
->label
, link
, profile
->path_flags
,
384 buffer
, &lname
, cond
, AA_MAY_LINK
);
388 /* buffer2 freed below, tname is pointer in buffer2 */
389 error
= path_name(OP_LINK
, &profile
->label
, target
, profile
->path_flags
,
390 buffer2
, &tname
, cond
, AA_MAY_LINK
);
395 /* aa_str_perms - handles the case of the dfa being NULL */
396 state
= aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, lname
,
399 if (!(lperms
.allow
& AA_MAY_LINK
))
402 /* test to see if target can be paired with link */
403 state
= aa_dfa_null_transition(profile
->file
.dfa
, state
);
404 aa_str_perms(profile
->file
.dfa
, state
, tname
, cond
, &perms
);
406 /* force audit/quiet masks for link are stored in the second entry
409 lperms
.audit
= perms
.audit
;
410 lperms
.quiet
= perms
.quiet
;
411 lperms
.kill
= perms
.kill
;
413 if (!(perms
.allow
& AA_MAY_LINK
)) {
414 info
= "target restricted";
419 /* done if link subset test is not required */
420 if (!(perms
.allow
& AA_LINK_SUBSET
))
423 /* Do link perm subset test requiring allowed permission on link are
424 * a subset of the allowed permissions on target.
426 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, tname
, cond
,
429 /* AA_MAY_LINK is not considered in the subset test */
430 request
= lperms
.allow
& ~AA_MAY_LINK
;
431 lperms
.allow
&= perms
.allow
| AA_MAY_LINK
;
433 request
|= AA_AUDIT_FILE_MASK
& (lperms
.allow
& ~perms
.allow
);
434 if (request
& ~lperms
.allow
) {
436 } else if ((lperms
.allow
& MAY_EXEC
) &&
437 !xindex_is_subset(lperms
.xindex
, perms
.xindex
)) {
438 lperms
.allow
&= ~MAY_EXEC
;
440 info
= "link not subset of target";
448 return aa_audit_file(profile
, &lperms
, OP_LINK
, request
, lname
, tname
,
449 NULL
, cond
->uid
, info
, error
);
453 * aa_path_link - Handle hard link permission check
454 * @label: the label being enforced (NOT NULL)
455 * @old_dentry: the target dentry (NOT NULL)
456 * @new_dir: directory the new link will be created in (NOT NULL)
457 * @new_dentry: the link being created (NOT NULL)
459 * Handle the permission test for a link & target pair. Permission
460 * is encoded as a pair where the link permission is determined
461 * first, and if allowed, the target is tested. The target test
462 * is done from the point of the link match (not start of DFA)
463 * making the target permission dependent on the link permission match.
465 * The subset test if required forces that permissions granted
466 * on link are a subset of the permission granted to target.
468 * Returns: %0 if allowed else error
470 int aa_path_link(struct aa_label
*label
, struct dentry
*old_dentry
,
471 const struct path
*new_dir
, struct dentry
*new_dentry
)
473 struct path link
= { new_dir
->mnt
, new_dentry
};
474 struct path target
= { new_dir
->mnt
, old_dentry
};
475 struct path_cond cond
= {
476 d_backing_inode(old_dentry
)->i_uid
,
477 d_backing_inode(old_dentry
)->i_mode
479 char *buffer
= NULL
, *buffer2
= NULL
;
480 struct aa_profile
*profile
;
483 /* buffer freed below, lname is pointer in buffer */
484 get_buffers(buffer
, buffer2
);
485 error
= fn_for_each_confined(label
, profile
,
486 profile_path_link(profile
, &link
, buffer
, &target
,
488 put_buffers(buffer
, buffer2
);
493 static void update_file_ctx(struct aa_file_ctx
*fctx
, struct aa_label
*label
,
496 struct aa_label
*l
, *old
;
498 /* update caching of label on file_ctx */
499 spin_lock(&fctx
->lock
);
500 old
= rcu_dereference_protected(fctx
->label
,
501 spin_is_locked(&fctx
->lock
));
502 l
= aa_label_merge(old
, label
, GFP_ATOMIC
);
505 rcu_assign_pointer(fctx
->label
, l
);
509 fctx
->allow
|= request
;
511 spin_unlock(&fctx
->lock
);
514 static int __file_path_perm(const char *op
, struct aa_label
*label
,
515 struct aa_label
*flabel
, struct file
*file
,
516 u32 request
, u32 denied
)
518 struct aa_profile
*profile
;
519 struct aa_perms perms
= {};
520 struct path_cond cond
= {
521 .uid
= file_inode(file
)->i_uid
,
522 .mode
= file_inode(file
)->i_mode
527 /* revalidation due to label out of date. No revocation at this time */
528 if (!denied
&& aa_label_is_subset(flabel
, label
))
529 /* TODO: check for revocation on stale profiles */
532 flags
= PATH_DELEGATE_DELETED
| (S_ISDIR(cond
.mode
) ? PATH_IS_DIR
: 0);
535 /* check every profile in task label not in current cache */
536 error
= fn_for_each_not_in_set(flabel
, label
, profile
,
537 profile_path_perm(op
, profile
, &file
->f_path
, buffer
,
538 request
, &cond
, flags
, &perms
));
539 if (denied
&& !error
) {
540 /* check every profile in file label that was not tested
541 * in the initial check above.
543 /* TODO: cache full perms so this only happens because of
545 /* TODO: don't audit here */
547 error
= fn_for_each(label
, profile
,
548 profile_path_perm(op
, profile
, &file
->f_path
,
549 buffer
, request
, &cond
, flags
,
552 error
= fn_for_each_not_in_set(label
, flabel
, profile
,
553 profile_path_perm(op
, profile
, &file
->f_path
,
554 buffer
, request
, &cond
, flags
,
558 update_file_ctx(file_ctx(file
), label
, request
);
565 static int __file_sock_perm(const char *op
, struct aa_label
*label
,
566 struct aa_label
*flabel
, struct file
*file
,
567 u32 request
, u32 denied
)
569 struct socket
*sock
= (struct socket
*) file
->private_data
;
574 /* revalidation due to label out of date. No revocation at this time */
575 if (!denied
&& aa_label_is_subset(flabel
, label
))
578 /* TODO: improve to skip profiles cached in flabel */
579 error
= aa_sock_file_perm(label
, op
, request
, sock
);
581 /* TODO: improve to skip profiles checked above */
582 /* check every profile in file label to is cached */
583 last_error(error
, aa_sock_file_perm(flabel
, op
, request
, sock
));
586 update_file_ctx(file_ctx(file
), label
, request
);
592 * aa_file_perm - do permission revalidation check & audit for @file
593 * @op: operation being checked
594 * @label: label being enforced (NOT NULL)
595 * @file: file to revalidate access permissions on (NOT NULL)
596 * @request: requested permissions
598 * Returns: %0 if access allowed else error
600 int aa_file_perm(const char *op
, struct aa_label
*label
, struct file
*file
,
603 struct aa_file_ctx
*fctx
;
604 struct aa_label
*flabel
;
611 fctx
= file_ctx(file
);
614 flabel
= rcu_dereference(fctx
->label
);
617 /* revalidate access, if task is unconfined, or the cached cred
618 * doesn't match or if the request is for more permissions than
621 * Note: the test for !unconfined(flabel) is to handle file
622 * delegation from unconfined tasks
624 denied
= request
& ~fctx
->allow
;
625 if (unconfined(label
) || unconfined(flabel
) ||
626 (!denied
&& aa_label_is_subset(flabel
, label
)))
629 /* TODO: label cross check */
631 if (file
->f_path
.mnt
&& path_mediated_fs(file
->f_path
.dentry
)) {
632 error
= __file_path_perm(op
, label
, flabel
, file
, request
,
635 } else if (S_ISSOCK(file_inode(file
)->i_mode
)) {
636 error
= __file_sock_perm(op
, label
, flabel
, file
, request
,
645 static void revalidate_tty(struct aa_label
*label
)
647 struct tty_struct
*tty
;
650 tty
= get_current_tty();
654 spin_lock(&tty
->files_lock
);
655 if (!list_empty(&tty
->tty_files
)) {
656 struct tty_file_private
*file_priv
;
658 /* TODO: Revalidate access to controlling tty. */
659 file_priv
= list_first_entry(&tty
->tty_files
,
660 struct tty_file_private
, list
);
661 file
= file_priv
->file
;
663 if (aa_file_perm(OP_INHERIT
, label
, file
, MAY_READ
| MAY_WRITE
))
666 spin_unlock(&tty
->files_lock
);
673 static int match_file(const void *p
, struct file
*file
, unsigned fd
)
675 struct aa_label
*label
= (struct aa_label
*)p
;
676 if (aa_file_perm(OP_INHERIT
, label
, file
, aa_map_file_to_perms(file
)))
682 /* based on selinux's flush_unauthorized_files */
683 void aa_inherit_files(const struct cred
*cred
, struct files_struct
*files
)
685 struct aa_label
*label
= aa_get_newest_cred_label(cred
);
686 struct file
*devnull
= NULL
;
689 revalidate_tty(label
);
691 /* Revalidate access to inherited open files. */
692 n
= iterate_fd(files
, 0, match_file
, label
);
693 if (!n
) /* none found? */
696 devnull
= dentry_open(&aa_null
, O_RDWR
, cred
);
699 /* replace all the matching ones with this */
701 replace_fd(n
- 1, devnull
, 0);
702 } while ((n
= iterate_fd(files
, n
, match_file
, label
)) != 0);