1 // SPDX-License-Identifier: GPL-2.0-only
5  * This file contains AppArmor mediation of files
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
40  * file_audit_cb - call back for file specific audit fields
42  * @va: audit struct to audit values of  (NOT NULL)
48 	kuid_t fsuid = ad->subj_cred ? ad->subj_cred->fsuid : current_fsuid();  in file_audit_cb()
51 	if (ad->request & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
53 				    map_mask_to_chr_mask(ad->request));  in file_audit_cb()
56 	if (ad->denied & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
58 				    map_mask_to_chr_mask(ad->denied));  in file_audit_cb()
61 	if (ad->request & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
65 				 from_kuid(&init_user_ns, ad->fs.ouid));  in file_audit_cb()
68 	if (ad->peer) {  in file_audit_cb()
70 		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,  in file_audit_cb()
72 	} else if (ad->fs.target) {  in file_audit_cb()
74 		audit_log_untrustedstring(ab, ad->fs.target);  in file_audit_cb()
79  * aa_audit_file - handle the auditing of file operations
80  * @subj_cred: cred of the subject
85  * @name: name of object being mediated (MAYBE NULL)
86  * @target: name of target (MAYBE NULL)
114 		u32 mask = perms->audit;  in aa_audit_file()
127 		ad.request = ad.request & ~perms->allow;  in aa_audit_file()
130 		if (ad.request & perms->kill)  in aa_audit_file()
134 		if ((ad.request & perms->quiet) &&  in aa_audit_file()
137 			ad.request &= ~perms->quiet;  in aa_audit_file()
143 	ad.denied = ad.request & ~perms->allow;  in aa_audit_file()
148  * is_deleted - test if a file has been completely unlinked
149  * @dentry: dentry of file to test for deletion  (NOT NULL)
155 	if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0)  in is_deleted()
170 			     labels_profile(label)->disconnected);  in path_name()
175 				      NULL, NULL, cond->uid, info, error));  in path_name()
184  * aa_lookup_fperms - convert dfa compressed perms to internal perms
196 	unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state];  in aa_lookup_fperms()
198 	if (!(file_rules->perms))  in aa_lookup_fperms()
201 	if (uid_eq(current_fsuid(), cond->uid))  in aa_lookup_fperms()
202 		return &(file_rules->perms[index]);  in aa_lookup_fperms()
204 	return &(file_rules->perms[index + 1]);  in aa_lookup_fperms()
208  * aa_str_perms - find permission that match @name
213  * @perms: Returns - the permissions found when matching @name
222 	state = aa_dfa_match(file_rules->dfa, start, name);  in aa_str_perms()
233 	struct aa_ruleset *rules = list_first_entry(&profile->rules,  in __aa_path_perm()
239 	aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE],  in __aa_path_perm()
241 	if (request & ~perms->allow)  in __aa_path_perm()
242 		e = -EACCES;  in __aa_path_perm()
245 			     cond->uid, NULL, e);  in __aa_path_perm()
261 	error = path_name(op, subj_cred, &profile->label, path,  in profile_path_perm()
262 			  flags | profile->path_flags, buffer, &name, cond,  in profile_path_perm()
271  * aa_path_perm - do permissions check & audit for @path
275  * @path: path to check permissions of  (NOT NULL)
292 	flags |= PATH_DELEGATE_DELETED | (S_ISDIR(cond->mode) ? PATH_IS_DIR :  in aa_path_perm()
296 		return -ENOMEM;  in aa_path_perm()
307  * xindex_is_subset - helper for aa_path_link
311  * test target x permissions are equal OR a subset of link x permissions
312  * this is done as part of the subset test, where a hardlink must have
313  * a subset of permissions that the target has.
315  * Returns: true if subset else false
332 	struct aa_ruleset *rules = list_first_entry(&profile->rules,  in profile_path_link()
341 	error = path_name(OP_LINK, subj_cred, &profile->label, link,  in profile_path_link()
342 			  profile->path_flags,  in profile_path_link()
348 	error = path_name(OP_LINK, subj_cred, &profile->label, target,  in profile_path_link()
349 			  profile->path_flags,  in profile_path_link()
354 	error = -EACCES;  in profile_path_link()
355 	/* aa_str_perms - handles the case of the dfa being NULL */  in profile_path_link()
356 	state = aa_str_perms(&(rules->file),  in profile_path_link()
357 			     rules->file.start[AA_CLASS_FILE], lname,  in profile_path_link()
364 	state = aa_dfa_null_transition(rules->file.dfa, state);  in profile_path_link()
365 	aa_str_perms(&(rules->file), state, tname, cond, &perms);  in profile_path_link()
380 	/* done if link subset test is not required */  in profile_path_link()
384 	/* Do link perm subset test requiring allowed permission on link are  in profile_path_link()
385 	 * a subset of the allowed permissions on target.  in profile_path_link()
387 	aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE],  in profile_path_link()
390 	/* AA_MAY_LINK is not considered in the subset test */  in profile_path_link()
401 		info = "link not subset of target";  in profile_path_link()
411 			     NULL, cond->uid, info, error);  in profile_path_link()
415  * aa_path_link - Handle hard link permission check
425  * is done from the point of the link match (not start of DFA)
428  * The subset test if required forces that permissions granted
429  * on link are a subset of the permission granted to target.
437 	struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };  in aa_path_link()
438 	struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };  in aa_path_link()
440 		d_backing_inode(old_dentry)->i_uid,  in aa_path_link()
441 		d_backing_inode(old_dentry)->i_mode  in aa_path_link()
450 	error = -ENOMEM;  in aa_path_link()
468 	/* update caching of label on file_ctx */  in update_file_ctx()
469 	spin_lock(&fctx->lock);  in update_file_ctx()
470 	old = rcu_dereference_protected(fctx->label,  in update_file_ctx()
471 					lockdep_is_held(&fctx->lock));  in update_file_ctx()
475 			rcu_assign_pointer(fctx->label, l);  in update_file_ctx()
479 		fctx->allow |= request;  in update_file_ctx()
481 	spin_unlock(&fctx->lock);  in update_file_ctx()
495 		.mode = file_inode(file)->i_mode  in __file_path_perm()
500 	/* revalidation due to label out of date. No revocation at this time */  in __file_path_perm()
508 		return -ENOMEM;  in __file_path_perm()
513 					  &file->f_path, buffer,  in __file_path_perm()
520 		 * TODO: cache full perms so this only happens because of  in __file_path_perm()
527 						  profile, &file->f_path,  in __file_path_perm()
533 						  profile, &file->f_path,  in __file_path_perm()
550 	struct socket *sock = (struct socket *) file->private_data;  in __file_sock_perm()
555 	/* revalidation due to label out of date. No revocation at this time */  in __file_sock_perm()
574  * aa_file_perm - do permission revalidation check & audit for @file
599 	flabel  = rcu_dereference(fctx->label);  in aa_file_perm()
609 	denied = request & ~fctx->allow;  in aa_file_perm()
620 	if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry))  in aa_file_perm()
624 	else if (S_ISSOCK(file_inode(file)->i_mode))  in aa_file_perm()
642 	spin_lock(&tty->files_lock);  in revalidate_tty()
643 	if (!list_empty(&tty->tty_files)) {  in revalidate_tty()
647 		file_priv = list_first_entry(&tty->tty_files,  in revalidate_tty()
649 		file = file_priv->file;  in revalidate_tty()
655 	spin_unlock(&tty->files_lock);  in revalidate_tty()
671 	if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,  in match_file()
701 		replace_fd(n - 1, devnull, 0);  in aa_inherit_files()