]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - security/apparmor/file.c
2 * AppArmor security module
4 * This file contains AppArmor mediation of files
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/tty.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
19 #include "include/af_unix.h"
20 #include "include/apparmor.h"
21 #include "include/audit.h"
22 #include "include/context.h"
23 #include "include/file.h"
24 #include "include/match.h"
25 #include "include/path.h"
26 #include "include/policy.h"
27 #include "include/label.h"
29 static u32
map_mask_to_chr_mask(u32 mask
)
31 u32 m
= mask
& PERMS_CHRS_MASK
;
32 if (mask
& AA_MAY_GETATTR
)
34 if (mask
& (AA_MAY_SETATTR
| AA_MAY_CHMOD
| AA_MAY_CHOWN
))
41 * audit_file_mask - convert mask to permission string
42 * @buffer: buffer to write string to (NOT NULL)
43 * @mask: permission mask to convert
45 static void audit_file_mask(struct audit_buffer
*ab
, u32 mask
)
49 aa_perm_mask_to_str(str
, aa_file_perm_chrs
, map_mask_to_chr_mask(mask
));
50 audit_log_string(ab
, str
);
54 * file_audit_cb - call back for file specific audit fields
55 * @ab: audit_buffer (NOT NULL)
56 * @va: audit struct to audit values of (NOT NULL)
58 static void file_audit_cb(struct audit_buffer
*ab
, void *va
)
60 struct common_audit_data
*sa
= va
;
61 kuid_t fsuid
= current_fsuid();
63 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
64 audit_log_format(ab
, " requested_mask=");
65 audit_file_mask(ab
, aad(sa
)->request
);
67 if (aad(sa
)->denied
& AA_AUDIT_FILE_MASK
) {
68 audit_log_format(ab
, " denied_mask=");
69 audit_file_mask(ab
, aad(sa
)->denied
);
71 if (aad(sa
)->request
& AA_AUDIT_FILE_MASK
) {
72 audit_log_format(ab
, " fsuid=%d",
73 from_kuid(&init_user_ns
, fsuid
));
74 audit_log_format(ab
, " ouid=%d",
75 from_kuid(&init_user_ns
, aad(sa
)->fs
.ouid
));
79 audit_log_format(ab
, " target=");
80 aa_label_xaudit(ab
, labels_ns(aad(sa
)->label
), aad(sa
)->peer
,
81 FLAG_VIEW_SUBNS
, GFP_ATOMIC
);
82 } else if (aad(sa
)->fs
.target
) {
83 audit_log_format(ab
, " target=");
84 audit_log_untrustedstring(ab
, aad(sa
)->fs
.target
);
89 * aa_audit_file - handle the auditing of file operations
90 * @profile: the profile being enforced (NOT NULL)
91 * @perms: the permissions computed for the request (NOT NULL)
92 * @op: operation being mediated
93 * @request: permissions requested
94 * @name: name of object being mediated (MAYBE NULL)
95 * @target: name of target (MAYBE NULL)
96 * @tlabel: target label (MAY BE NULL)
98 * @info: extra information message (MAYBE NULL)
99 * @error: 0 if operation allowed else failure error code
101 * Returns: %0 or error on failure
103 int aa_audit_file(struct aa_profile
*profile
, struct aa_perms
*perms
,
104 const char *op
, u32 request
, const char *name
,
105 const char *target
, struct aa_label
*tlabel
,
106 kuid_t ouid
, const char *info
, int error
)
108 int type
= AUDIT_APPARMOR_AUTO
;
110 DEFINE_AUDIT_DATA(sa
, LSM_AUDIT_DATA_TASK
, op
);
112 aad(&sa
)->request
= request
;
113 aad(&sa
)->name
= name
;
114 aad(&sa
)->fs
.target
= target
;
115 aad(&sa
)->peer
= tlabel
;
116 aad(&sa
)->fs
.ouid
= ouid
;
117 aad(&sa
)->info
= info
;
118 aad(&sa
)->error
= error
;
121 if (likely(!aad(&sa
)->error
)) {
122 u32 mask
= perms
->audit
;
124 if (unlikely(AUDIT_MODE(profile
) == AUDIT_ALL
))
127 /* mask off perms that are not being force audited */
128 aad(&sa
)->request
&= mask
;
130 if (likely(!aad(&sa
)->request
))
132 type
= AUDIT_APPARMOR_AUDIT
;
134 /* only report permissions that were denied */
135 aad(&sa
)->request
= aad(&sa
)->request
& ~perms
->allow
;
136 AA_BUG(!aad(&sa
)->request
);
138 if (aad(&sa
)->request
& perms
->kill
)
139 type
= AUDIT_APPARMOR_KILL
;
141 /* quiet known rejects, assumes quiet and kill do not overlap */
142 if ((aad(&sa
)->request
& perms
->quiet
) &&
143 AUDIT_MODE(profile
) != AUDIT_NOQUIET
&&
144 AUDIT_MODE(profile
) != AUDIT_ALL
)
145 aad(&sa
)->request
&= ~perms
->quiet
;
147 if (!aad(&sa
)->request
)
148 return aad(&sa
)->error
;
151 aad(&sa
)->denied
= aad(&sa
)->request
& ~perms
->allow
;
152 return aa_audit(type
, profile
, &sa
, file_audit_cb
);
156 * is_deleted - test if a file has been completely unlinked
157 * @dentry: dentry of file to test for deletion (NOT NULL)
159 * Returns: %1 if deleted else %0
161 static inline bool is_deleted(struct dentry
*dentry
)
163 if (d_unlinked(dentry
) && d_backing_inode(dentry
)->i_nlink
== 0)
168 static int path_name(const char *op
, struct aa_label
*label
,
169 const struct path
*path
, int flags
, char *buffer
,
170 const char**name
, struct path_cond
*cond
, u32 request
,
171 bool delegate_deleted
)
173 struct aa_profile
*profile
;
174 const char *info
= NULL
;
175 int error
= aa_path_name(path
, flags
, buffer
, name
, &info
,
176 labels_profile(label
)->disconnected
);
178 if (error
== -ENOENT
&& is_deleted(path
->dentry
) &&
181 fn_for_each_confined(label
, profile
,
182 aa_audit_file(profile
, &nullperms
, op
, request
, *name
,
183 NULL
, NULL
, cond
->uid
, info
, error
));
191 * map_old_perms - map old file perms layout to the new layout
192 * @old: permission set in old mapping
194 * Returns: new permission mapping
196 static u32
map_old_perms(u32 old
)
200 new |= AA_MAY_GETATTR
| AA_MAY_OPEN
;
202 new |= AA_MAY_SETATTR
| AA_MAY_CREATE
| AA_MAY_DELETE
|
203 AA_MAY_CHMOD
| AA_MAY_CHOWN
| AA_MAY_OPEN
|
207 /* the old mapping lock and link_subset flags where overlaid
208 * and use was determined by part of a pair that they were in
211 new |= AA_MAY_LOCK
| AA_LINK_SUBSET
;
212 if (old
& 0x40) /* AA_EXEC_MMAP */
219 * aa_compute_fperms - convert dfa compressed perms to internal perms
220 * @dfa: dfa to compute perms for (NOT NULL)
221 * @state: state in dfa
222 * @cond: conditions to consider (NOT NULL)
224 * TODO: convert from dfa + state to permission entry, do computation conversion
227 * Returns: computed permission set
229 struct aa_perms
aa_compute_fperms(struct aa_dfa
*dfa
, unsigned int state
,
230 struct path_cond
*cond
)
232 struct aa_perms perms
;
234 /* FIXME: change over to new dfa format
235 * currently file perms are encoded in the dfa, new format
236 * splits the permissions from the dfa. This mapping can be
237 * done at profile load
240 perms
.kill
= perms
.stop
= 0;
241 perms
.complain
= perms
.cond
= 0;
245 if (uid_eq(current_fsuid(), cond
->uid
)) {
246 perms
.allow
= map_old_perms(dfa_user_allow(dfa
, state
));
247 perms
.audit
= map_old_perms(dfa_user_audit(dfa
, state
));
248 perms
.quiet
= map_old_perms(dfa_user_quiet(dfa
, state
));
249 perms
.xindex
= dfa_user_xindex(dfa
, state
);
251 perms
.allow
= map_old_perms(dfa_other_allow(dfa
, state
));
252 perms
.audit
= map_old_perms(dfa_other_audit(dfa
, state
));
253 perms
.quiet
= map_old_perms(dfa_other_quiet(dfa
, state
));
254 perms
.xindex
= dfa_other_xindex(dfa
, state
);
256 perms
.allow
|= AA_MAY_GETATTR
;
258 /* change_profile wasn't determined by ownership in old mapping */
259 if (ACCEPT_TABLE(dfa
)[state
] & 0x80000000)
260 perms
.allow
|= AA_MAY_CHANGE_PROFILE
;
261 if (ACCEPT_TABLE(dfa
)[state
] & 0x40000000)
262 perms
.allow
|= AA_MAY_ONEXEC
;
268 * aa_str_perms - find permission that match @name
269 * @dfa: to match against (MAYBE NULL)
270 * @state: state to start matching in
271 * @name: string to match against dfa (NOT NULL)
272 * @cond: conditions to consider for permission set computation (NOT NULL)
273 * @perms: Returns - the permissions found when matching @name
275 * Returns: the final state in @dfa when beginning @start and walking @name
277 unsigned int aa_str_perms(struct aa_dfa
*dfa
, unsigned int start
,
278 const char *name
, struct path_cond
*cond
,
279 struct aa_perms
*perms
)
282 state
= aa_dfa_match(dfa
, start
, name
);
283 *perms
= aa_compute_fperms(dfa
, state
, cond
);
288 int __aa_path_perm(const char *op
, struct aa_profile
*profile
, const char *name
,
289 u32 request
, struct path_cond
*cond
, int flags
,
290 struct aa_perms
*perms
)
293 if (profile_unconfined(profile
) ||
294 ((flags
& PATH_SOCK_COND
) && !PROFILE_MEDIATES_AF(profile
, AF_UNIX
)))
296 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, name
, cond
, perms
);
297 if (request
& ~perms
->allow
)
299 return aa_audit_file(profile
, perms
, op
, request
, name
, NULL
, NULL
,
304 * aa_path_perm - do permissions check & audit for @path
305 * @op: operation being checked
306 * @label: profile being enforced (NOT NULL)
307 * @path: path to check permissions of (NOT NULL)
308 * @flags: any additional path flags beyond what the profile specifies
309 * @request: requested permissions
310 * @cond: conditional info for this request (NOT NULL)
312 * Returns: %0 else error if access denied or other error
314 int aa_path_perm(const char *op
, struct aa_label
*label
,
315 const struct path
*path
, int flags
, u32 request
,
316 struct path_cond
*cond
)
318 struct aa_perms perms
= {};
321 struct aa_profile
*profile
;
324 /* TODO: fix path lookup flags */
325 flags
|= labels_profile(label
)->path_flags
|
326 (S_ISDIR(cond
->mode
) ? PATH_IS_DIR
: 0);
329 error
= path_name(op
, label
, path
, flags
, buffer
, &name
, cond
,
332 error
= fn_for_each_confined(label
, profile
,
333 __aa_path_perm(op
, profile
, name
, request
, cond
,
341 * xindex_is_subset - helper for aa_path_link
342 * @link: link permission set
343 * @target: target permission set
345 * test target x permissions are equal OR a subset of link x permissions
346 * this is done as part of the subset test, where a hardlink must have
347 * a subset of permissions that the target has.
349 * Returns: %1 if subset else %0
351 static inline bool xindex_is_subset(u32 link
, u32 target
)
353 if (((link
& ~AA_X_UNSAFE
) != (target
& ~AA_X_UNSAFE
)) ||
354 ((link
& AA_X_UNSAFE
) && !(target
& AA_X_UNSAFE
)))
360 static int profile_path_link(struct aa_profile
*profile
, const char *lname
,
361 const char *tname
, struct path_cond
*cond
)
363 struct aa_perms lperms
, perms
;
364 const char *info
= NULL
;
365 u32 request
= AA_MAY_LINK
;
369 /* aa_str_perms - handles the case of the dfa being NULL */
370 state
= aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, lname
,
373 if (!(lperms
.allow
& AA_MAY_LINK
))
376 /* test to see if target can be paired with link */
377 state
= aa_dfa_null_transition(profile
->file
.dfa
, state
);
378 aa_str_perms(profile
->file
.dfa
, state
, tname
, cond
, &perms
);
380 /* force audit/quiet masks for link are stored in the second entry
383 lperms
.audit
= perms
.audit
;
384 lperms
.quiet
= perms
.quiet
;
385 lperms
.kill
= perms
.kill
;
387 if (!(perms
.allow
& AA_MAY_LINK
)) {
388 info
= "target restricted";
393 /* done if link subset test is not required */
394 if (!(perms
.allow
& AA_LINK_SUBSET
))
397 /* Do link perm subset test requiring allowed permission on link are
398 * a subset of the allowed permissions on target.
400 aa_str_perms(profile
->file
.dfa
, profile
->file
.start
, tname
, cond
,
403 /* AA_MAY_LINK is not considered in the subset test */
404 request
= lperms
.allow
& ~AA_MAY_LINK
;
405 lperms
.allow
&= perms
.allow
| AA_MAY_LINK
;
407 request
|= AA_AUDIT_FILE_MASK
& (lperms
.allow
& ~perms
.allow
);
408 if (request
& ~lperms
.allow
) {
410 } else if ((lperms
.allow
& MAY_EXEC
) &&
411 !xindex_is_subset(lperms
.xindex
, perms
.xindex
)) {
412 lperms
.allow
&= ~MAY_EXEC
;
414 info
= "link not subset of target";
422 return aa_audit_file(profile
, &lperms
, OP_LINK
, request
, lname
, tname
,
423 NULL
, cond
->uid
, info
, e
);
427 * aa_path_link - Handle hard link permission check
428 * @label: the label being enforced (NOT NULL)
429 * @old_dentry: the target dentry (NOT NULL)
430 * @new_dir: directory the new link will be created in (NOT NULL)
431 * @new_dentry: the link being created (NOT NULL)
433 * Handle the permission test for a link & target pair. Permission
434 * is encoded as a pair where the link permission is determined
435 * first, and if allowed, the target is tested. The target test
436 * is done from the point of the link match (not start of DFA)
437 * making the target permission dependent on the link permission match.
439 * The subset test if required forces that permissions granted
440 * on link are a subset of the permission granted to target.
442 * Returns: %0 if allowed else error
444 int aa_path_link(struct aa_label
*label
, struct dentry
*old_dentry
,
445 const struct path
*new_dir
, struct dentry
*new_dentry
)
447 struct path link
= { new_dir
->mnt
, new_dentry
};
448 struct path target
= { new_dir
->mnt
, old_dentry
};
449 struct path_cond cond
= {
450 d_backing_inode(old_dentry
)->i_uid
,
451 d_backing_inode(old_dentry
)->i_mode
453 char *buffer
= NULL
, *buffer2
= NULL
;
454 const char *lname
, *tname
= NULL
;
455 struct aa_profile
*profile
;
458 /* TODO: fix path lookup flags, auditing of failed path for profile */
459 profile
= labels_profile(label
);
460 /* buffer freed below, lname is pointer in buffer */
461 get_buffers(buffer
, buffer2
);
462 error
= path_name(OP_LINK
, label
, &link
,
463 labels_profile(label
)->path_flags
, buffer
,
464 &lname
, &cond
, AA_MAY_LINK
, false);
468 /* buffer2 freed below, tname is pointer in buffer2 */
469 error
= path_name(OP_LINK
, label
, &target
,
470 labels_profile(label
)->path_flags
, buffer2
, &tname
,
471 &cond
, AA_MAY_LINK
, false);
475 error
= fn_for_each_confined(label
, profile
,
476 profile_path_link(profile
, lname
, tname
, &cond
));
479 put_buffers(buffer
, buffer2
);
484 static void update_file_ctx(struct aa_file_ctx
*fctx
, struct aa_label
*label
,
487 struct aa_label
*l
, *old
;
489 /* update caching of label on file_ctx */
490 spin_lock(&fctx
->lock
);
491 old
= rcu_dereference_protected(fctx
->label
,
492 spin_is_locked(&fctx
->lock
));
493 l
= aa_label_merge(old
, label
, GFP_ATOMIC
);
496 rcu_assign_pointer(fctx
->label
, l
);
500 fctx
->allow
|= request
;
502 spin_unlock(&fctx
->lock
);
505 static int __file_path_perm(const char *op
, struct aa_label
*label
,
506 struct aa_label
*flabel
, struct file
*file
,
507 u32 request
, u32 denied
)
509 struct aa_profile
*profile
;
510 struct aa_perms perms
= {};
511 struct path_cond cond
= {
512 .uid
= file_inode(file
)->i_uid
,
513 .mode
= file_inode(file
)->i_mode
519 /* revalidation due to label out of date. No revocation at this time */
520 if (!denied
&& aa_label_is_subset(flabel
, label
))
521 /* TODO: check for revocation on stale profiles */
524 /* TODO: fix path lookup flags */
525 flags
= PATH_DELEGATE_DELETED
| labels_profile(label
)->path_flags
|
526 (S_ISDIR(cond
.mode
) ? PATH_IS_DIR
: 0);
529 error
= path_name(op
, label
, &file
->f_path
, flags
, buffer
, &name
, &cond
,
533 /* Access to open files that are deleted are
534 * given a pass (implicit delegation)
536 /* TODO not needed when full perms cached */
541 /* check every profile in task label not in current cache */
542 error
= fn_for_each_not_in_set(flabel
, label
, profile
,
543 __aa_path_perm(op
, profile
, name
, request
, &cond
, 0,
546 /* check every profile in file label that was not tested
547 * in the initial check above.
549 /* TODO: cache full perms so this only happens because of
551 /* TODO: don't audit here */
553 fn_for_each_not_in_set(label
, flabel
, profile
,
554 __aa_path_perm(op
, profile
, name
, request
,
558 update_file_ctx(file_ctx(file
), label
, request
);
566 static int __file_sock_perm(const char *op
, struct aa_label
*label
,
567 struct aa_label
*flabel
, struct file
*file
,
568 u32 request
, u32 denied
)
570 struct socket
*sock
= (struct socket
*) file
->private_data
;
575 /* revalidation due to label out of date. No revocation at this time */
576 if (!denied
&& aa_label_is_subset(flabel
, label
))
579 /* TODO: improve to skip profiles cached in flabel */
580 error
= aa_sock_file_perm(label
, op
, request
, sock
);
582 /* TODO: improve to skip profiles checked above */
583 /* check every profile in file label to is cached */
584 last_error(error
, aa_sock_file_perm(flabel
, op
, request
, sock
));
587 update_file_ctx(file_ctx(file
), label
, request
);
593 * aa_file_perm - do permission revalidation check & audit for @file
594 * @op: operation being checked
595 * @label: label being enforced (NOT NULL)
596 * @file: file to revalidate access permissions on (NOT NULL)
597 * @request: requested permissions
599 * Returns: %0 if access allowed else error
601 int aa_file_perm(const char *op
, struct aa_label
*label
, struct file
*file
,
604 struct aa_file_ctx
*fctx
;
605 struct aa_label
*flabel
;
612 fctx
= file_ctx(file
);
615 flabel
= rcu_dereference(fctx
->label
);
618 /* revalidate access, if task is unconfined, or the cached cred
619 * doesn't match or if the request is for more permissions than
622 * Note: the test for !unconfined(flabel) is to handle file
623 * delegation from unconfined tasks
625 denied
= request
& ~fctx
->allow
;
626 if (unconfined(label
) || unconfined(flabel
) ||
627 (!denied
&& aa_label_is_subset(flabel
, label
)))
630 /* TODO: label cross check */
632 if (file
->f_path
.mnt
&& path_mediated_fs(file
->f_path
.dentry
)) {
633 error
= __file_path_perm(op
, label
, flabel
, file
, request
,
636 } else if (S_ISSOCK(file_inode(file
)->i_mode
)) {
637 error
= __file_sock_perm(op
, label
, flabel
, file
, request
,
646 static void revalidate_tty(struct aa_label
*label
)
648 struct tty_struct
*tty
;
651 tty
= get_current_tty();
655 spin_lock(&tty
->files_lock
);
656 if (!list_empty(&tty
->tty_files
)) {
657 struct tty_file_private
*file_priv
;
659 /* TODO: Revalidate access to controlling tty. */
660 file_priv
= list_first_entry(&tty
->tty_files
,
661 struct tty_file_private
, list
);
662 file
= file_priv
->file
;
664 if (aa_file_perm(OP_INHERIT
, label
, file
, MAY_READ
| MAY_WRITE
))
667 spin_unlock(&tty
->files_lock
);
674 static int match_file(const void *p
, struct file
*file
, unsigned fd
)
676 struct aa_label
*label
= (struct aa_label
*)p
;
677 if (aa_file_perm(OP_INHERIT
, label
, file
, aa_map_file_to_perms(file
)))
683 /* based on selinux's flush_unauthorized_files */
684 void aa_inherit_files(const struct cred
*cred
, struct files_struct
*files
)
686 struct aa_label
*label
= aa_get_newest_cred_label(cred
);
687 struct file
*devnull
= NULL
;
690 revalidate_tty(label
);
692 /* Revalidate access to inherited open files. */
693 n
= iterate_fd(files
, 0, match_file
, label
);
694 if (!n
) /* none found? */
697 devnull
= dentry_open(&aa_null
, O_RDWR
, cred
);
700 /* replace all the matching ones with this */
702 replace_fd(n
- 1, devnull
, 0);
703 } while ((n
= iterate_fd(files
, n
, match_file
, label
)) != 0);