1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor mediation of files 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #include "include/apparmor.h" 16 #include "include/audit.h" 17 #include "include/file.h" 18 #include "include/match.h" 19 #include "include/path.h" 20 #include "include/policy.h" 21 22 struct file_perms nullperms; 23 24 static u32 map_mask_to_chr_mask(u32 mask) 25 { 26 u32 m = mask & PERMS_CHRS_MASK; 27 28 if (mask & AA_MAY_GETATTR) 29 m |= MAY_READ; 30 if (mask & (AA_MAY_SETATTR | AA_MAY_CHMOD | AA_MAY_CHOWN)) 31 m |= MAY_WRITE; 32 33 return m; 34 } 35 36 /** 37 * audit_file_mask - convert mask to permission string 38 * @buffer: buffer to write string to (NOT NULL) 39 * @mask: permission mask to convert 40 */ 41 static void audit_file_mask(struct audit_buffer *ab, u32 mask) 42 { 43 char str[10]; 44 45 aa_perm_mask_to_str(str, aa_file_perm_chrs, map_mask_to_chr_mask(mask)); 46 audit_log_string(ab, str); 47 } 48 49 /** 50 * file_audit_cb - call back for file specific audit fields 51 * @ab: audit_buffer (NOT NULL) 52 * @va: audit struct to audit values of (NOT NULL) 53 */ 54 static void file_audit_cb(struct audit_buffer *ab, void *va) 55 { 56 struct common_audit_data *sa = va; 57 kuid_t fsuid = current_fsuid(); 58 59 if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) { 60 audit_log_format(ab, " requested_mask="); 61 audit_file_mask(ab, aad(sa)->fs.request); 62 } 63 if (aad(sa)->fs.denied & AA_AUDIT_FILE_MASK) { 64 audit_log_format(ab, " denied_mask="); 65 audit_file_mask(ab, aad(sa)->fs.denied); 66 } 67 if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) { 68 audit_log_format(ab, " fsuid=%d", 69 from_kuid(&init_user_ns, fsuid)); 70 audit_log_format(ab, " ouid=%d", 71 from_kuid(&init_user_ns, aad(sa)->fs.ouid)); 72 } 73 74 if (aad(sa)->fs.target) { 75 audit_log_format(ab, " target="); 76 audit_log_untrustedstring(ab, aad(sa)->fs.target); 77 } 78 } 79 80 /** 81 * aa_audit_file - handle the auditing of file operations 82 * @profile: the profile being enforced (NOT NULL) 83 * @perms: the permissions computed for the request (NOT NULL) 84 * @gfp: allocation flags 85 * @op: operation being mediated 86 * @request: permissions requested 87 * @name: name of object being mediated (MAYBE NULL) 88 * @target: name of target (MAYBE NULL) 89 * @ouid: object uid 90 * @info: extra information message (MAYBE NULL) 91 * @error: 0 if operation allowed else failure error code 92 * 93 * Returns: %0 or error on failure 94 */ 95 int aa_audit_file(struct aa_profile *profile, struct file_perms *perms, 96 const char *op, u32 request, const char *name, 97 const char *target, kuid_t ouid, const char *info, int error) 98 { 99 int type = AUDIT_APPARMOR_AUTO; 100 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, op); 101 102 sa.u.tsk = NULL; 103 aad(&sa)->fs.request = request; 104 aad(&sa)->name = name; 105 aad(&sa)->fs.target = target; 106 aad(&sa)->fs.ouid = ouid; 107 aad(&sa)->info = info; 108 aad(&sa)->error = error; 109 sa.u.tsk = NULL; 110 111 if (likely(!aad(&sa)->error)) { 112 u32 mask = perms->audit; 113 114 if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL)) 115 mask = 0xffff; 116 117 /* mask off perms that are not being force audited */ 118 aad(&sa)->fs.request &= mask; 119 120 if (likely(!aad(&sa)->fs.request)) 121 return 0; 122 type = AUDIT_APPARMOR_AUDIT; 123 } else { 124 /* only report permissions that were denied */ 125 aad(&sa)->fs.request = aad(&sa)->fs.request & ~perms->allow; 126 AA_BUG(!aad(&sa)->fs.request); 127 128 if (aad(&sa)->fs.request & perms->kill) 129 type = AUDIT_APPARMOR_KILL; 130 131 /* quiet known rejects, assumes quiet and kill do not overlap */ 132 if ((aad(&sa)->fs.request & perms->quiet) && 133 AUDIT_MODE(profile) != AUDIT_NOQUIET && 134 AUDIT_MODE(profile) != AUDIT_ALL) 135 aad(&sa)->fs.request &= ~perms->quiet; 136 137 if (!aad(&sa)->fs.request) 138 return COMPLAIN_MODE(profile) ? 0 : aad(&sa)->error; 139 } 140 141 aad(&sa)->fs.denied = aad(&sa)->fs.request & ~perms->allow; 142 return aa_audit(type, profile, &sa, file_audit_cb); 143 } 144 145 /** 146 * map_old_perms - map old file perms layout to the new layout 147 * @old: permission set in old mapping 148 * 149 * Returns: new permission mapping 150 */ 151 static u32 map_old_perms(u32 old) 152 { 153 u32 new = old & 0xf; 154 if (old & MAY_READ) 155 new |= AA_MAY_GETATTR | AA_MAY_OPEN; 156 if (old & MAY_WRITE) 157 new |= AA_MAY_SETATTR | AA_MAY_CREATE | AA_MAY_DELETE | 158 AA_MAY_CHMOD | AA_MAY_CHOWN | AA_MAY_OPEN; 159 if (old & 0x10) 160 new |= AA_MAY_LINK; 161 /* the old mapping lock and link_subset flags where overlaid 162 * and use was determined by part of a pair that they were in 163 */ 164 if (old & 0x20) 165 new |= AA_MAY_LOCK | AA_LINK_SUBSET; 166 if (old & 0x40) /* AA_EXEC_MMAP */ 167 new |= AA_EXEC_MMAP; 168 169 return new; 170 } 171 172 /** 173 * compute_perms - convert dfa compressed perms to internal perms 174 * @dfa: dfa to compute perms for (NOT NULL) 175 * @state: state in dfa 176 * @cond: conditions to consider (NOT NULL) 177 * 178 * TODO: convert from dfa + state to permission entry, do computation conversion 179 * at load time. 180 * 181 * Returns: computed permission set 182 */ 183 static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state, 184 struct path_cond *cond) 185 { 186 struct file_perms perms; 187 188 /* FIXME: change over to new dfa format 189 * currently file perms are encoded in the dfa, new format 190 * splits the permissions from the dfa. This mapping can be 191 * done at profile load 192 */ 193 perms.kill = 0; 194 195 if (uid_eq(current_fsuid(), cond->uid)) { 196 perms.allow = map_old_perms(dfa_user_allow(dfa, state)); 197 perms.audit = map_old_perms(dfa_user_audit(dfa, state)); 198 perms.quiet = map_old_perms(dfa_user_quiet(dfa, state)); 199 perms.xindex = dfa_user_xindex(dfa, state); 200 } else { 201 perms.allow = map_old_perms(dfa_other_allow(dfa, state)); 202 perms.audit = map_old_perms(dfa_other_audit(dfa, state)); 203 perms.quiet = map_old_perms(dfa_other_quiet(dfa, state)); 204 perms.xindex = dfa_other_xindex(dfa, state); 205 } 206 perms.allow |= AA_MAY_GETATTR; 207 208 /* change_profile wasn't determined by ownership in old mapping */ 209 if (ACCEPT_TABLE(dfa)[state] & 0x80000000) 210 perms.allow |= AA_MAY_CHANGE_PROFILE; 211 if (ACCEPT_TABLE(dfa)[state] & 0x40000000) 212 perms.allow |= AA_MAY_ONEXEC; 213 214 return perms; 215 } 216 217 /** 218 * aa_str_perms - find permission that match @name 219 * @dfa: to match against (MAYBE NULL) 220 * @state: state to start matching in 221 * @name: string to match against dfa (NOT NULL) 222 * @cond: conditions to consider for permission set computation (NOT NULL) 223 * @perms: Returns - the permissions found when matching @name 224 * 225 * Returns: the final state in @dfa when beginning @start and walking @name 226 */ 227 unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start, 228 const char *name, struct path_cond *cond, 229 struct file_perms *perms) 230 { 231 unsigned int state; 232 if (!dfa) { 233 *perms = nullperms; 234 return DFA_NOMATCH; 235 } 236 237 state = aa_dfa_match(dfa, start, name); 238 *perms = compute_perms(dfa, state, cond); 239 240 return state; 241 } 242 243 /** 244 * is_deleted - test if a file has been completely unlinked 245 * @dentry: dentry of file to test for deletion (NOT NULL) 246 * 247 * Returns: %1 if deleted else %0 248 */ 249 static inline bool is_deleted(struct dentry *dentry) 250 { 251 if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0) 252 return 1; 253 return 0; 254 } 255 256 /** 257 * aa_path_perm - do permissions check & audit for @path 258 * @op: operation being checked 259 * @profile: profile being enforced (NOT NULL) 260 * @path: path to check permissions of (NOT NULL) 261 * @flags: any additional path flags beyond what the profile specifies 262 * @request: requested permissions 263 * @cond: conditional info for this request (NOT NULL) 264 * 265 * Returns: %0 else error if access denied or other error 266 */ 267 int aa_path_perm(const char *op, struct aa_profile *profile, 268 const struct path *path, int flags, u32 request, 269 struct path_cond *cond) 270 { 271 char *buffer = NULL; 272 struct file_perms perms = {}; 273 const char *name, *info = NULL; 274 int error; 275 276 flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0); 277 get_buffers(buffer); 278 error = aa_path_name(path, flags, buffer, &name, &info, 279 profile->disconnected); 280 if (error) { 281 if (error == -ENOENT && is_deleted(path->dentry)) { 282 /* Access to open files that are deleted are 283 * give a pass (implicit delegation) 284 */ 285 error = 0; 286 info = NULL; 287 perms.allow = request; 288 } 289 } else { 290 aa_str_perms(profile->file.dfa, profile->file.start, name, cond, 291 &perms); 292 if (request & ~perms.allow) 293 error = -EACCES; 294 } 295 error = aa_audit_file(profile, &perms, op, request, name, NULL, 296 cond->uid, info, error); 297 put_buffers(buffer); 298 299 return error; 300 } 301 302 /** 303 * xindex_is_subset - helper for aa_path_link 304 * @link: link permission set 305 * @target: target permission set 306 * 307 * test target x permissions are equal OR a subset of link x permissions 308 * this is done as part of the subset test, where a hardlink must have 309 * a subset of permissions that the target has. 310 * 311 * Returns: %1 if subset else %0 312 */ 313 static inline bool xindex_is_subset(u32 link, u32 target) 314 { 315 if (((link & ~AA_X_UNSAFE) != (target & ~AA_X_UNSAFE)) || 316 ((link & AA_X_UNSAFE) && !(target & AA_X_UNSAFE))) 317 return 0; 318 319 return 1; 320 } 321 322 /** 323 * aa_path_link - Handle hard link permission check 324 * @profile: the profile being enforced (NOT NULL) 325 * @old_dentry: the target dentry (NOT NULL) 326 * @new_dir: directory the new link will be created in (NOT NULL) 327 * @new_dentry: the link being created (NOT NULL) 328 * 329 * Handle the permission test for a link & target pair. Permission 330 * is encoded as a pair where the link permission is determined 331 * first, and if allowed, the target is tested. The target test 332 * is done from the point of the link match (not start of DFA) 333 * making the target permission dependent on the link permission match. 334 * 335 * The subset test if required forces that permissions granted 336 * on link are a subset of the permission granted to target. 337 * 338 * Returns: %0 if allowed else error 339 */ 340 int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry, 341 const struct path *new_dir, struct dentry *new_dentry) 342 { 343 struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry }; 344 struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry }; 345 struct path_cond cond = { 346 d_backing_inode(old_dentry)->i_uid, 347 d_backing_inode(old_dentry)->i_mode 348 }; 349 char *buffer = NULL, *buffer2 = NULL; 350 const char *lname, *tname = NULL, *info = NULL; 351 struct file_perms lperms, perms; 352 u32 request = AA_MAY_LINK; 353 unsigned int state; 354 int error; 355 356 get_buffers(buffer, buffer2); 357 lperms = nullperms; 358 359 /* buffer freed below, lname is pointer in buffer */ 360 error = aa_path_name(&link, profile->path_flags, buffer, &lname, 361 &info, profile->disconnected); 362 if (error) 363 goto audit; 364 365 /* buffer2 freed below, tname is pointer in buffer2 */ 366 error = aa_path_name(&target, profile->path_flags, buffer2, &tname, 367 &info, profile->disconnected); 368 if (error) 369 goto audit; 370 371 error = -EACCES; 372 /* aa_str_perms - handles the case of the dfa being NULL */ 373 state = aa_str_perms(profile->file.dfa, profile->file.start, lname, 374 &cond, &lperms); 375 376 if (!(lperms.allow & AA_MAY_LINK)) 377 goto audit; 378 379 /* test to see if target can be paired with link */ 380 state = aa_dfa_null_transition(profile->file.dfa, state); 381 aa_str_perms(profile->file.dfa, state, tname, &cond, &perms); 382 383 /* force audit/quiet masks for link are stored in the second entry 384 * in the link pair. 385 */ 386 lperms.audit = perms.audit; 387 lperms.quiet = perms.quiet; 388 lperms.kill = perms.kill; 389 390 if (!(perms.allow & AA_MAY_LINK)) { 391 info = "target restricted"; 392 goto audit; 393 } 394 395 /* done if link subset test is not required */ 396 if (!(perms.allow & AA_LINK_SUBSET)) 397 goto done_tests; 398 399 /* Do link perm subset test requiring allowed permission on link are a 400 * subset of the allowed permissions on target. 401 */ 402 aa_str_perms(profile->file.dfa, profile->file.start, tname, &cond, 403 &perms); 404 405 /* AA_MAY_LINK is not considered in the subset test */ 406 request = lperms.allow & ~AA_MAY_LINK; 407 lperms.allow &= perms.allow | AA_MAY_LINK; 408 409 request |= AA_AUDIT_FILE_MASK & (lperms.allow & ~perms.allow); 410 if (request & ~lperms.allow) { 411 goto audit; 412 } else if ((lperms.allow & MAY_EXEC) && 413 !xindex_is_subset(lperms.xindex, perms.xindex)) { 414 lperms.allow &= ~MAY_EXEC; 415 request |= MAY_EXEC; 416 info = "link not subset of target"; 417 goto audit; 418 } 419 420 done_tests: 421 error = 0; 422 423 audit: 424 error = aa_audit_file(profile, &lperms, OP_LINK, request, 425 lname, tname, cond.uid, info, error); 426 put_buffers(buffer, buffer2); 427 428 return error; 429 } 430 431 /** 432 * aa_file_perm - do permission revalidation check & audit for @file 433 * @op: operation being checked 434 * @profile: profile being enforced (NOT NULL) 435 * @file: file to revalidate access permissions on (NOT NULL) 436 * @request: requested permissions 437 * 438 * Returns: %0 if access allowed else error 439 */ 440 int aa_file_perm(const char *op, struct aa_profile *profile, struct file *file, 441 u32 request) 442 { 443 struct path_cond cond = { 444 .uid = file_inode(file)->i_uid, 445 .mode = file_inode(file)->i_mode 446 }; 447 448 return aa_path_perm(op, profile, &file->f_path, PATH_DELEGATE_DELETED, 449 request, &cond); 450 } 451