2 * AppArmor security module
4 * This file contains AppArmor policy definitions.
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
18 #include <linux/capability.h>
19 #include <linux/cred.h>
20 #include <linux/kref.h>
21 #include <linux/rhashtable.h>
22 #include <linux/sched.h>
23 #include <linux/slab.h>
24 #include <linux/socket.h>
28 #include "capability.h"
38 extern int unprivileged_userns_apparmor_policy
;
40 extern const char *const aa_profile_mode_names
[];
41 #define APPARMOR_MODE_NAMES_MAX_INDEX 4
43 #define PROFILE_MODE(_profile, _mode) \
44 ((aa_g_profile_mode == (_mode)) || \
45 ((_profile)->mode == (_mode)))
47 #define COMPLAIN_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_COMPLAIN)
49 #define KILL_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_KILL)
51 #define PROFILE_IS_HAT(_profile) ((_profile)->flags & PFLAG_HAT)
53 #define profile_is_stale(_profile) ((_profile)->flags & PFLAG_STALE)
55 #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)
58 * FIXME: currently need a clean way to replace and remove profiles as a
59 * set. It should be done at the namespace level.
60 * Either, with a set of profiles loaded at the namespace level or via
61 * a mark and remove marked interface.
64 APPARMOR_ENFORCE
, /* enforce access rules */
65 APPARMOR_COMPLAIN
, /* allow and log access violations */
66 APPARMOR_KILL
, /* kill task on access violation */
67 APPARMOR_UNCONFINED
, /* profile set to unconfined */
71 PFLAG_HAT
= 1, /* profile is a hat */
72 PFLAG_NULL
= 4, /* profile is null learning profile */
73 PFLAG_IX_ON_NAME_ERROR
= 8, /* fallback to ix on name lookup fail */
74 PFLAG_IMMUTABLE
= 0x10, /* don't allow changes/replacement */
75 PFLAG_USER_DEFINED
= 0x20, /* user based profile - lower privs */
76 PFLAG_NO_LIST_REF
= 0x40, /* list doesn't keep profile ref */
77 PFLAG_OLD_NULL_TRANS
= 0x100, /* use // as the null transition */
78 PFLAG_STALE
= 0x200, /* profile replaced/removed */
79 PFLAG_NS_COUNT
= 0x400, /* carries NS ref count */
81 /* These flags must correspond with PATH_flags */
82 PFLAG_MEDIATE_DELETED
= 0x10000, /* mediate instead delegate deleted */
87 /* struct aa_policydb - match engine for a policy
88 * dfa: dfa pattern match
89 * start: set of start states for the different classes of data
92 /* Generic policy DFA specific rule types will be subsections of it */
94 unsigned int start
[AA_CLASS_LAST
+ 1];
100 struct aa_profile __rcu
*profile
;
103 /* struct aa_data - generic data structure
104 * key: name for retrieving this data
105 * size: size of data in bytes
107 * head: reserved for rhashtable
113 struct rhash_head head
;
117 /* struct aa_profile - basic confinement data
118 * @base - base components of the profile (name, refcount, lists, lock ...)
119 * @count: reference count of the obj
120 * @rcu: rcu head used when removing from @list
121 * @parent: parent of profile
122 * @ns: namespace the profile is in
123 * @proxy: is set to the profile that replaced this profile
124 * @rename: optional profile name that this profile renamed
125 * @attach: human readable attachment string
126 * @xmatch: optional extended matching for unconfined executables names
127 * @xmatch_len: xmatch prefix len, used to determine xmatch priority
128 * @audit: the auditing mode of the profile
129 * @mode: the enforcement mode of the profile
130 * @flags: flags controlling profile behavior
131 * @path_flags: flags controlling path generation behavior
132 * @disconnected: what to prepend if attach_disconnected is specified
133 * @size: the memory consumed by this profiles rules
134 * @policy: general match rules governing policy
135 * @file: The set of rules governing basic file access and domain transitions
136 * @caps: capabilities for the profile
137 * @rlimits: rlimits for the profile
139 * @dents: dentries for the profiles file entries in apparmorfs
140 * @dirname: name of the profile dir in apparmorfs
141 * @data: hashtable for free-form policy aa_data
143 * The AppArmor profile contains the basic confinement data. Each profile
144 * has a name, and exists in a namespace. The @name and @exec_match are
145 * used to determine profile attachment against unconfined tasks. All other
146 * attachments are determined by profile X transition rules.
148 * The @proxy struct is write protected by the profile lock.
150 * Profiles have a hierarchy where hats and children profiles keep
151 * a reference to their parent.
153 * Profile names can not begin with a : and can not contain the \0
154 * character. If a profile name begins with / it will be considered when
155 * determining profile attachment on "unconfined" tasks.
158 struct aa_policy base
;
161 struct aa_profile __rcu
*parent
;
164 struct aa_proxy
*proxy
;
168 struct aa_dfa
*xmatch
;
170 enum audit_mode audit
;
174 const char *disconnected
;
177 struct aa_policydb policy
;
178 struct aa_file_rules file
;
180 struct aa_rlimit rlimits
;
182 struct aa_loaddata
*rawdata
;
185 struct dentry
*dents
[AAFS_PROF_SIZEOF
];
186 struct rhashtable
*data
;
189 extern enum profile_mode aa_g_profile_mode
;
191 #define AA_MAY_LOAD_POLICY AA_MAY_APPEND
192 #define AA_MAY_REPLACE_POLICY AA_MAY_WRITE
193 #define AA_MAY_REMOVE_POLICY AA_MAY_DELETE
195 void __aa_update_proxy(struct aa_profile
*orig
, struct aa_profile
*new);
197 void aa_add_profile(struct aa_policy
*common
, struct aa_profile
*profile
);
200 void aa_free_proxy_kref(struct kref
*kref
);
201 struct aa_profile
*aa_alloc_profile(const char *name
, gfp_t gfp
);
202 struct aa_profile
*aa_new_null_profile(struct aa_profile
*parent
, bool hat
,
203 const char *base
, gfp_t gfp
);
204 void aa_free_profile(struct aa_profile
*profile
);
205 void aa_free_profile_kref(struct kref
*kref
);
206 struct aa_profile
*aa_find_child(struct aa_profile
*parent
, const char *name
);
207 struct aa_profile
*aa_lookupn_profile(struct aa_ns
*ns
, const char *hname
,
209 struct aa_profile
*aa_lookup_profile(struct aa_ns
*ns
, const char *name
);
210 struct aa_profile
*aa_fqlookupn_profile(struct aa_profile
*base
,
211 const char *fqname
, size_t n
);
212 struct aa_profile
*aa_match_profile(struct aa_ns
*ns
, const char *name
);
214 ssize_t
aa_replace_profiles(struct aa_ns
*view
, struct aa_profile
*profile
,
215 u32 mask
, struct aa_loaddata
*udata
);
216 ssize_t
aa_remove_profiles(struct aa_ns
*view
, struct aa_profile
*profile
,
217 char *name
, size_t size
);
218 void __aa_profile_list_release(struct list_head
*head
);
221 #define PROF_REPLACE 0
223 #define unconfined(X) ((X)->mode == APPARMOR_UNCONFINED)
225 #define PROFILE_MEDIATES(P, T) ((P)->policy.start[(T)])
226 /* safe version of POLICY_MEDIATES for full range input */
227 static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile
*profile
,
230 if (profile
->policy
.dfa
)
231 return aa_dfa_match_len(profile
->policy
.dfa
,
232 profile
->policy
.start
[0], &class, 1);
237 * aa_get_profile - increment refcount on profile @p
238 * @p: profile (MAYBE NULL)
240 * Returns: pointer to @p if @p is NULL will return NULL
241 * Requires: @p must be held with valid refcount when called
243 static inline struct aa_profile
*aa_get_profile(struct aa_profile
*p
)
246 kref_get(&(p
->count
));
252 * aa_get_profile_not0 - increment refcount on profile @p found via lookup
253 * @p: profile (MAYBE NULL)
255 * Returns: pointer to @p if @p is NULL will return NULL
256 * Requires: @p must be held with valid refcount when called
258 static inline struct aa_profile
*aa_get_profile_not0(struct aa_profile
*p
)
260 if (p
&& kref_get_unless_zero(&p
->count
))
267 * aa_get_profile_rcu - increment a refcount profile that can be replaced
268 * @p: pointer to profile that can be replaced (NOT NULL)
270 * Returns: pointer to a refcounted profile.
271 * else NULL if no profile
273 static inline struct aa_profile
*aa_get_profile_rcu(struct aa_profile __rcu
**p
)
275 struct aa_profile
*c
;
279 c
= rcu_dereference(*p
);
280 } while (c
&& !kref_get_unless_zero(&c
->count
));
287 * aa_get_newest_profile - find the newest version of @profile
288 * @profile: the profile to check for newer versions of
290 * Returns: refcounted newest version of @profile taking into account
291 * replacement, renames and removals
294 static inline struct aa_profile
*aa_get_newest_profile(struct aa_profile
*p
)
299 if (profile_is_stale(p
))
300 return aa_get_profile_rcu(&p
->proxy
->profile
);
302 return aa_get_profile(p
);
306 * aa_put_profile - decrement refcount on profile @p
307 * @p: profile (MAYBE NULL)
309 static inline void aa_put_profile(struct aa_profile
*p
)
312 kref_put(&p
->count
, aa_free_profile_kref
);
315 static inline struct aa_proxy
*aa_get_proxy(struct aa_proxy
*p
)
318 kref_get(&(p
->count
));
323 static inline void aa_put_proxy(struct aa_proxy
*p
)
326 kref_put(&p
->count
, aa_free_proxy_kref
);
329 static inline int AUDIT_MODE(struct aa_profile
*profile
)
331 if (aa_g_audit
!= AUDIT_NORMAL
)
334 return profile
->audit
;
337 bool policy_view_capable(struct aa_ns
*ns
);
338 bool policy_admin_capable(struct aa_ns
*ns
);
339 int aa_may_manage_policy(struct aa_profile
*profile
, struct aa_ns
*ns
,
342 #endif /* __AA_POLICY_H */