security/apparmor/ipc.c

   1 /*
   2  * AppArmor security module
   3  *
   4  * This file contains AppArmor ipc mediation
   5  *
   6  * Copyright (C) 1998-2008 Novell/SUSE
   7  * Copyright 2009-2017 Canonical Ltd.
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License as
  11  * published by the Free Software Foundation, version 2 of the
  12  * License.
  13  */
  14
  15 #include <linux/gfp.h>
  16 #include <linux/ptrace.h>
  17
  18 #include "include/audit.h"
  19 #include "include/capability.h"
  20 #include "include/context.h"
  21 #include "include/policy.h"
  22 #include "include/ipc.h"
  23
  24 /* call back to audit ptrace fields */
  25 static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
  26 {
  27         struct common_audit_data *sa = va;
  28
  29         audit_log_format(ab, " peer=");
  30         aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
  31                         FLAGS_NONE, GFP_ATOMIC);
  32 }
  33
  34 static int cross_ptrace_perm(struct aa_profile *tracer,
  35                              struct aa_profile *tracee, u32 request,
  36                              struct common_audit_data *sa)
  37 {
  38         /* policy uses the old style capability check for ptrace */
  39         if (profile_unconfined(tracer) || tracer == tracee)
  40                 return 0;
  41
  42         aad(sa)->label = &tracer->label;
  43         aad(sa)->peer = &tracee->label;
  44         aad(sa)->request = 0;
  45         aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 1);
  46
  47         return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
  48 }
  49
  50 /**
  51  * aa_may_ptrace - test if tracer task can trace the tracee
  52  * @tracer: label of the task doing the tracing  (NOT NULL)
  53  * @tracee: task label to be traced
  54  * @request: permission request
  55  *
  56  * Returns: %0 else error code if permission denied or error
  57  */
  58 int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
  59                   u32 request)
  60 {
  61         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
  62
  63         return xcheck_labels_profiles(tracer, tracee, cross_ptrace_perm,
  64                                       request, &sa);
  65 }
  66
  67