]>
git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - security/apparmor/include/perms.h
2 * AppArmor security module
4 * This file contains AppArmor basic permission sets definitions.
6 * Copyright 2017 Canonical Ltd.
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
20 #define AA_MAY_EXEC MAY_EXEC
21 #define AA_MAY_WRITE MAY_WRITE
22 #define AA_MAY_READ MAY_READ
23 #define AA_MAY_APPEND MAY_APPEND
25 #define AA_MAY_CREATE 0x0010
26 #define AA_MAY_DELETE 0x0020
27 #define AA_MAY_OPEN 0x0040
28 #define AA_MAY_RENAME 0x0080 /* pair */
30 #define AA_MAY_SETATTR 0x0100 /* meta write */
31 #define AA_MAY_GETATTR 0x0200 /* meta read */
32 #define AA_MAY_SETCRED 0x0400 /* security cred/attr */
33 #define AA_MAY_GETCRED 0x0800
35 #define AA_MAY_CHMOD 0x1000 /* pair */
36 #define AA_MAY_CHOWN 0x2000 /* pair */
37 #define AA_MAY_CHGRP 0x4000 /* pair */
38 #define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */
40 #define AA_EXEC_MMAP 0x00010000
41 #define AA_MAY_MPROT 0x00020000 /* extend conditions */
42 #define AA_MAY_LINK 0x00040000 /* pair */
43 #define AA_MAY_SNAPSHOT 0x00080000 /* pair */
45 #define AA_MAY_DELEGATE
46 #define AA_CONT_MATCH 0x08000000
48 #define AA_MAY_STACK 0x10000000
49 #define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */
50 #define AA_MAY_CHANGE_PROFILE 0x40000000
51 #define AA_MAY_CHANGEHAT 0x80000000
53 #define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */
56 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE | \
57 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK | \
58 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
60 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME | \
61 AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
62 AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
63 AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
64 AA_MAY_STACK | AA_MAY_ONEXEC | \
65 AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
67 extern const char aa_file_perm_chrs
[];
68 extern const char *aa_file_perm_names
[];
72 u32 audit
; /* set only when allow is set */
74 u32 deny
; /* explicit deny, or conflict if allow also set */
75 u32 quiet
; /* set only when ~allow | deny */
76 u32 kill
; /* set only when ~allow | deny */
77 u32 stop
; /* set only when ~allow | deny */
79 u32 complain
; /* accumulates only used when ~allow & ~deny */
80 u32 cond
; /* set only when ~allow and ~deny */
82 u32 hide
; /* set only when ~allow | deny */
83 u32 prompt
; /* accumulates only used when ~allow & ~deny */
86 * u32 subtree; / * set only when allow is set * /
91 #define ALL_PERMS_MASK 0xffffffff
92 extern struct aa_perms nullperms
;
93 extern struct aa_perms allperms
;
96 #define xcheck(FN1, FN2) \
107 * TODO: update for labels pointing to labels instead of profiles
108 * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
109 * gah this doesn't allow for label compound check!!!!
111 #define xcheck_ns_profile_profile(P1, P2, FN, args...) \
114 if (P1->ns == P2->ns) \
115 ____e = FN((P1), (P2), args); \
119 #define xcheck_ns_profile_label(P, L, FN, args...) \
121 struct aa_profile *__p2; \
122 fn_for_each((L), __p2, \
123 xcheck_ns_profile_profile((P), __p2, (FN), args)); \
126 #define xcheck_ns_labels(L1, L2, FN, args...) \
128 struct aa_profile *__p1; \
129 fn_for_each((L1), __p1, FN(__p1, (L2), args)); \
132 /* Do the cross check but applying FN at the profiles level */
133 #define xcheck_labels_profiles(L1, L2, FN, args...) \
134 xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
136 #define xcheck_labels(L1, L2, P, FN1, FN2) \
137 xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
140 void aa_perm_mask_to_str(char *str
, const char *chrs
, u32 mask
);
141 void aa_audit_perm_names(struct audit_buffer
*ab
, const char **names
, u32 mask
);
142 void aa_audit_perm_mask(struct audit_buffer
*ab
, u32 mask
, const char *chrs
,
143 u32 chrsmask
, const char **names
, u32 namesmask
);
144 void aa_apply_modes_to_perms(struct aa_profile
*profile
,
145 struct aa_perms
*perms
);
146 void aa_compute_perms(struct aa_dfa
*dfa
, unsigned int state
,
147 struct aa_perms
*perms
);
148 void aa_perms_accum(struct aa_perms
*accum
, struct aa_perms
*addend
);
149 void aa_perms_accum_raw(struct aa_perms
*accum
, struct aa_perms
*addend
);
150 void aa_profile_match_label(struct aa_profile
*profile
, struct aa_label
*label
,
151 int type
, u32 request
, struct aa_perms
*perms
);
152 int aa_profile_label_perm(struct aa_profile
*profile
, struct aa_profile
*target
,
153 u32 request
, int type
, u32
*deny
,
154 struct common_audit_data
*sa
);
155 int aa_check_perms(struct aa_profile
*profile
, struct aa_perms
*perms
,
156 u32 request
, struct common_audit_data
*sa
,
157 void (*cb
)(struct audit_buffer
*, void *));
158 #endif /* __AA_PERM_H */