]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/apparmor/resource.c
2 * AppArmor security module
4 * This file contains AppArmor resource mediation and attachment
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/audit.h>
17 #include "include/audit.h"
18 #include "include/resource.h"
19 #include "include/policy.h"
22 * Table of rlimit names: we generate it from resource.h.
24 #include "rlim_names.h"
26 /* audit callback for resource specific fields */
27 static void audit_cb(struct audit_buffer
*ab
, void *va
)
29 struct common_audit_data
*sa
= va
;
31 audit_log_format(ab
, " rlimit=%s value=%lu",
32 rlim_names
[sa
->aad
.rlim
.rlim
], sa
->aad
.rlim
.max
);
36 * audit_resource - audit setting resource limit
37 * @profile: profile being enforced (NOT NULL)
38 * @resoure: rlimit being auditing
39 * @value: value being set
42 * Returns: 0 or sa->error else other error code on failure
44 static int audit_resource(struct aa_profile
*profile
, unsigned int resource
,
45 unsigned long value
, int error
)
47 struct common_audit_data sa
;
49 COMMON_AUDIT_DATA_INIT(&sa
, NONE
);
50 sa
.aad
.op
= OP_SETRLIMIT
,
51 sa
.aad
.rlim
.rlim
= resource
;
52 sa
.aad
.rlim
.max
= value
;
54 return aa_audit(AUDIT_APPARMOR_AUTO
, profile
, GFP_KERNEL
, &sa
,
59 * aa_map_resouce - map compiled policy resource to internal #
60 * @resource: flattened policy resource number
62 * Returns: resource # for the current architecture.
64 * rlimit resource can vary based on architecture, map the compiled policy
65 * resource # to the internal representation for the architecture.
67 int aa_map_resource(int resource
)
69 return rlim_map
[resource
];
73 * aa_task_setrlimit - test permission to set an rlimit
74 * @profile - profile confining the task (NOT NULL)
75 * @task - task the resource is being set on
76 * @resource - the resource being set
77 * @new_rlim - the new resource limit (NOT NULL)
79 * Control raising the processes hard limit.
81 * Returns: 0 or error code if setting resource failed
83 int aa_task_setrlimit(struct aa_profile
*profile
, struct task_struct
*task
,
84 unsigned int resource
, struct rlimit
*new_rlim
)
88 /* TODO: extend resource control to handle other (non current)
89 * processes. AppArmor rules currently have the implicit assumption
90 * that the task is setting the resource of the current process
92 if ((task
!= current
->group_leader
) ||
93 (profile
->rlimits
.mask
& (1 << resource
) &&
94 new_rlim
->rlim_max
> profile
->rlimits
.limits
[resource
].rlim_max
))
97 return audit_resource(profile
, resource
, new_rlim
->rlim_max
, error
);
101 * __aa_transition_rlimits - apply new profile rlimits
102 * @old: old profile on task (NOT NULL)
103 * @new: new profile with rlimits to apply (NOT NULL)
105 void __aa_transition_rlimits(struct aa_profile
*old
, struct aa_profile
*new)
107 unsigned int mask
= 0;
108 struct rlimit
*rlim
, *initrlim
;
111 /* for any rlimits the profile controlled reset the soft limit
112 * to the less of the tasks hard limit and the init tasks soft limit
114 if (old
->rlimits
.mask
) {
115 for (i
= 0, mask
= 1; i
< RLIM_NLIMITS
; i
++, mask
<<= 1) {
116 if (old
->rlimits
.mask
& mask
) {
117 rlim
= current
->signal
->rlim
+ i
;
118 initrlim
= init_task
.signal
->rlim
+ i
;
119 rlim
->rlim_cur
= min(rlim
->rlim_max
,
125 /* set any new hard limits as dictated by the new profile */
126 if (!new->rlimits
.mask
)
128 for (i
= 0, mask
= 1; i
< RLIM_NLIMITS
; i
++, mask
<<= 1) {
129 if (!(new->rlimits
.mask
& mask
))
132 rlim
= current
->signal
->rlim
+ i
;
133 rlim
->rlim_max
= min(rlim
->rlim_max
,
134 new->rlimits
.limits
[i
].rlim_max
);
135 /* soft limit should not exceed hard limit */
136 rlim
->rlim_cur
= min(rlim
->rlim_cur
, rlim
->rlim_max
);