163e2b423SJohn Johansen /* 263e2b423SJohn Johansen * AppArmor security module 363e2b423SJohn Johansen * 463e2b423SJohn Johansen * This file contains AppArmor /sys/kernel/security/apparmor interface functions 563e2b423SJohn Johansen * 663e2b423SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 763e2b423SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 863e2b423SJohn Johansen * 963e2b423SJohn Johansen * This program is free software; you can redistribute it and/or 1063e2b423SJohn Johansen * modify it under the terms of the GNU General Public License as 1163e2b423SJohn Johansen * published by the Free Software Foundation, version 2 of the 1263e2b423SJohn Johansen * License. 1363e2b423SJohn Johansen */ 1463e2b423SJohn Johansen 1563e2b423SJohn Johansen #include <linux/security.h> 1663e2b423SJohn Johansen #include <linux/vmalloc.h> 1763e2b423SJohn Johansen #include <linux/module.h> 1863e2b423SJohn Johansen #include <linux/seq_file.h> 1963e2b423SJohn Johansen #include <linux/uaccess.h> 2063e2b423SJohn Johansen #include <linux/namei.h> 2163e2b423SJohn Johansen 2263e2b423SJohn Johansen #include "include/apparmor.h" 2363e2b423SJohn Johansen #include "include/apparmorfs.h" 2463e2b423SJohn Johansen #include "include/audit.h" 2563e2b423SJohn Johansen #include "include/context.h" 2663e2b423SJohn Johansen #include "include/policy.h" 2763e2b423SJohn Johansen 2863e2b423SJohn Johansen /** 2963e2b423SJohn Johansen * aa_simple_write_to_buffer - common routine for getting policy from user 3063e2b423SJohn Johansen * @op: operation doing the user buffer copy 3163e2b423SJohn Johansen * @userbuf: user buffer to copy data from (NOT NULL) 323ed02adaSJohn Johansen * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size) 3363e2b423SJohn Johansen * @copy_size: size of data to copy from user buffer 3463e2b423SJohn Johansen * @pos: position write is at in the file (NOT NULL) 3563e2b423SJohn Johansen * 3663e2b423SJohn Johansen * Returns: kernel buffer containing copy of user buffer data or an 3763e2b423SJohn Johansen * ERR_PTR on failure. 3863e2b423SJohn Johansen */ 3963e2b423SJohn Johansen static char *aa_simple_write_to_buffer(int op, const char __user *userbuf, 4063e2b423SJohn Johansen size_t alloc_size, size_t copy_size, 4163e2b423SJohn Johansen loff_t *pos) 4263e2b423SJohn Johansen { 4363e2b423SJohn Johansen char *data; 4463e2b423SJohn Johansen 453ed02adaSJohn Johansen BUG_ON(copy_size > alloc_size); 463ed02adaSJohn Johansen 4763e2b423SJohn Johansen if (*pos != 0) 4863e2b423SJohn Johansen /* only writes from pos 0, that is complete writes */ 4963e2b423SJohn Johansen return ERR_PTR(-ESPIPE); 5063e2b423SJohn Johansen 5163e2b423SJohn Johansen /* 5263e2b423SJohn Johansen * Don't allow profile load/replace/remove from profiles that don't 5363e2b423SJohn Johansen * have CAP_MAC_ADMIN 5463e2b423SJohn Johansen */ 5563e2b423SJohn Johansen if (!aa_may_manage_policy(op)) 5663e2b423SJohn Johansen return ERR_PTR(-EACCES); 5763e2b423SJohn Johansen 5863e2b423SJohn Johansen /* freed by caller to simple_write_to_buffer */ 5963e2b423SJohn Johansen data = kvmalloc(alloc_size); 6063e2b423SJohn Johansen if (data == NULL) 6163e2b423SJohn Johansen return ERR_PTR(-ENOMEM); 6263e2b423SJohn Johansen 6363e2b423SJohn Johansen if (copy_from_user(data, userbuf, copy_size)) { 6463e2b423SJohn Johansen kvfree(data); 6563e2b423SJohn Johansen return ERR_PTR(-EFAULT); 6663e2b423SJohn Johansen } 6763e2b423SJohn Johansen 6863e2b423SJohn Johansen return data; 6963e2b423SJohn Johansen } 7063e2b423SJohn Johansen 7163e2b423SJohn Johansen 7263e2b423SJohn Johansen /* .load file hook fn to load policy */ 7363e2b423SJohn Johansen static ssize_t profile_load(struct file *f, const char __user *buf, size_t size, 7463e2b423SJohn Johansen loff_t *pos) 7563e2b423SJohn Johansen { 7663e2b423SJohn Johansen char *data; 7763e2b423SJohn Johansen ssize_t error; 7863e2b423SJohn Johansen 7963e2b423SJohn Johansen data = aa_simple_write_to_buffer(OP_PROF_LOAD, buf, size, size, pos); 8063e2b423SJohn Johansen 8163e2b423SJohn Johansen error = PTR_ERR(data); 8263e2b423SJohn Johansen if (!IS_ERR(data)) { 8363e2b423SJohn Johansen error = aa_replace_profiles(data, size, PROF_ADD); 8463e2b423SJohn Johansen kvfree(data); 8563e2b423SJohn Johansen } 8663e2b423SJohn Johansen 8763e2b423SJohn Johansen return error; 8863e2b423SJohn Johansen } 8963e2b423SJohn Johansen 9063e2b423SJohn Johansen static const struct file_operations aa_fs_profile_load = { 916038f373SArnd Bergmann .write = profile_load, 926038f373SArnd Bergmann .llseek = default_llseek, 9363e2b423SJohn Johansen }; 9463e2b423SJohn Johansen 9563e2b423SJohn Johansen /* .replace file hook fn to load and/or replace policy */ 9663e2b423SJohn Johansen static ssize_t profile_replace(struct file *f, const char __user *buf, 9763e2b423SJohn Johansen size_t size, loff_t *pos) 9863e2b423SJohn Johansen { 9963e2b423SJohn Johansen char *data; 10063e2b423SJohn Johansen ssize_t error; 10163e2b423SJohn Johansen 10263e2b423SJohn Johansen data = aa_simple_write_to_buffer(OP_PROF_REPL, buf, size, size, pos); 10363e2b423SJohn Johansen error = PTR_ERR(data); 10463e2b423SJohn Johansen if (!IS_ERR(data)) { 10563e2b423SJohn Johansen error = aa_replace_profiles(data, size, PROF_REPLACE); 10663e2b423SJohn Johansen kvfree(data); 10763e2b423SJohn Johansen } 10863e2b423SJohn Johansen 10963e2b423SJohn Johansen return error; 11063e2b423SJohn Johansen } 11163e2b423SJohn Johansen 11263e2b423SJohn Johansen static const struct file_operations aa_fs_profile_replace = { 1136038f373SArnd Bergmann .write = profile_replace, 1146038f373SArnd Bergmann .llseek = default_llseek, 11563e2b423SJohn Johansen }; 11663e2b423SJohn Johansen 11763e2b423SJohn Johansen /* .remove file hook fn to remove loaded policy */ 11863e2b423SJohn Johansen static ssize_t profile_remove(struct file *f, const char __user *buf, 11963e2b423SJohn Johansen size_t size, loff_t *pos) 12063e2b423SJohn Johansen { 12163e2b423SJohn Johansen char *data; 12263e2b423SJohn Johansen ssize_t error; 12363e2b423SJohn Johansen 12463e2b423SJohn Johansen /* 12563e2b423SJohn Johansen * aa_remove_profile needs a null terminated string so 1 extra 12663e2b423SJohn Johansen * byte is allocated and the copied data is null terminated. 12763e2b423SJohn Johansen */ 12863e2b423SJohn Johansen data = aa_simple_write_to_buffer(OP_PROF_RM, buf, size + 1, size, pos); 12963e2b423SJohn Johansen 13063e2b423SJohn Johansen error = PTR_ERR(data); 13163e2b423SJohn Johansen if (!IS_ERR(data)) { 13263e2b423SJohn Johansen data[size] = 0; 13363e2b423SJohn Johansen error = aa_remove_profiles(data, size); 13463e2b423SJohn Johansen kvfree(data); 13563e2b423SJohn Johansen } 13663e2b423SJohn Johansen 13763e2b423SJohn Johansen return error; 13863e2b423SJohn Johansen } 13963e2b423SJohn Johansen 14063e2b423SJohn Johansen static const struct file_operations aa_fs_profile_remove = { 1416038f373SArnd Bergmann .write = profile_remove, 1426038f373SArnd Bergmann .llseek = default_llseek, 14363e2b423SJohn Johansen }; 14463e2b423SJohn Johansen 14563e2b423SJohn Johansen /** Base file system setup **/ 14663e2b423SJohn Johansen 1479acd494bSKees Cook static struct aa_fs_entry aa_fs_entry_apparmor[] = { 1489acd494bSKees Cook AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load), 1499acd494bSKees Cook AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace), 1509acd494bSKees Cook AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove), 1519acd494bSKees Cook { } 1529acd494bSKees Cook }; 15363e2b423SJohn Johansen 1549acd494bSKees Cook static struct aa_fs_entry aa_fs_entry = 1559acd494bSKees Cook AA_FS_DIR("apparmor", aa_fs_entry_apparmor); 1569acd494bSKees Cook 1579acd494bSKees Cook /** 1589acd494bSKees Cook * aafs_create_file - create a file entry in the apparmor securityfs 1599acd494bSKees Cook * @fs_file: aa_fs_entry to build an entry for (NOT NULL) 1609acd494bSKees Cook * @parent: the parent dentry in the securityfs 1619acd494bSKees Cook * 1629acd494bSKees Cook * Use aafs_remove_file to remove entries created with this fn. 1639acd494bSKees Cook */ 1649acd494bSKees Cook static int __init aafs_create_file(struct aa_fs_entry *fs_file, 1659acd494bSKees Cook struct dentry *parent) 16663e2b423SJohn Johansen { 1679acd494bSKees Cook int error = 0; 16863e2b423SJohn Johansen 1699acd494bSKees Cook fs_file->dentry = securityfs_create_file(fs_file->name, 1709acd494bSKees Cook S_IFREG | fs_file->mode, 1719acd494bSKees Cook parent, fs_file, 1729acd494bSKees Cook fs_file->file_ops); 1739acd494bSKees Cook if (IS_ERR(fs_file->dentry)) { 1749acd494bSKees Cook error = PTR_ERR(fs_file->dentry); 1759acd494bSKees Cook fs_file->dentry = NULL; 17663e2b423SJohn Johansen } 1779acd494bSKees Cook return error; 17863e2b423SJohn Johansen } 17963e2b423SJohn Johansen 18063e2b423SJohn Johansen /** 1819acd494bSKees Cook * aafs_create_dir - recursively create a directory entry in the securityfs 1829acd494bSKees Cook * @fs_dir: aa_fs_entry (and all child entries) to build (NOT NULL) 1839acd494bSKees Cook * @parent: the parent dentry in the securityfs 18463e2b423SJohn Johansen * 1859acd494bSKees Cook * Use aafs_remove_dir to remove entries created with this fn. 18663e2b423SJohn Johansen */ 1879acd494bSKees Cook static int __init aafs_create_dir(struct aa_fs_entry *fs_dir, 1889acd494bSKees Cook struct dentry *parent) 18963e2b423SJohn Johansen { 1909acd494bSKees Cook int error; 1919acd494bSKees Cook struct aa_fs_entry *fs_file; 19263e2b423SJohn Johansen 1939acd494bSKees Cook fs_dir->dentry = securityfs_create_dir(fs_dir->name, parent); 1949acd494bSKees Cook if (IS_ERR(fs_dir->dentry)) { 1959acd494bSKees Cook error = PTR_ERR(fs_dir->dentry); 1969acd494bSKees Cook fs_dir->dentry = NULL; 1979acd494bSKees Cook goto failed; 1989acd494bSKees Cook } 19963e2b423SJohn Johansen 2009acd494bSKees Cook for (fs_file = fs_dir->v.files; fs_file->name; ++fs_file) { 2019acd494bSKees Cook if (fs_file->v_type == AA_FS_TYPE_DIR) 2029acd494bSKees Cook error = aafs_create_dir(fs_file, fs_dir->dentry); 2039acd494bSKees Cook else 2049acd494bSKees Cook error = aafs_create_file(fs_file, fs_dir->dentry); 2059acd494bSKees Cook if (error) 2069acd494bSKees Cook goto failed; 2079acd494bSKees Cook } 2089acd494bSKees Cook 2099acd494bSKees Cook return 0; 2109acd494bSKees Cook 2119acd494bSKees Cook failed: 2129acd494bSKees Cook return error; 2139acd494bSKees Cook } 2149acd494bSKees Cook 2159acd494bSKees Cook /** 2169acd494bSKees Cook * aafs_remove_file - drop a single file entry in the apparmor securityfs 2179acd494bSKees Cook * @fs_file: aa_fs_entry to detach from the securityfs (NOT NULL) 2189acd494bSKees Cook */ 2199acd494bSKees Cook static void __init aafs_remove_file(struct aa_fs_entry *fs_file) 2209acd494bSKees Cook { 2219acd494bSKees Cook if (!fs_file->dentry) 2229acd494bSKees Cook return; 2239acd494bSKees Cook 2249acd494bSKees Cook securityfs_remove(fs_file->dentry); 2259acd494bSKees Cook fs_file->dentry = NULL; 2269acd494bSKees Cook } 2279acd494bSKees Cook 2289acd494bSKees Cook /** 2299acd494bSKees Cook * aafs_remove_dir - recursively drop a directory entry from the securityfs 2309acd494bSKees Cook * @fs_dir: aa_fs_entry (and all child entries) to detach (NOT NULL) 2319acd494bSKees Cook */ 2329acd494bSKees Cook static void __init aafs_remove_dir(struct aa_fs_entry *fs_dir) 2339acd494bSKees Cook { 2349acd494bSKees Cook struct aa_fs_entry *fs_file; 2359acd494bSKees Cook 2369acd494bSKees Cook for (fs_file = fs_dir->v.files; fs_file->name; ++fs_file) { 2379acd494bSKees Cook if (fs_file->v_type == AA_FS_TYPE_DIR) 2389acd494bSKees Cook aafs_remove_dir(fs_file); 2399acd494bSKees Cook else 2409acd494bSKees Cook aafs_remove_file(fs_file); 2419acd494bSKees Cook } 2429acd494bSKees Cook 2439acd494bSKees Cook aafs_remove_file(fs_dir); 24463e2b423SJohn Johansen } 24563e2b423SJohn Johansen 24663e2b423SJohn Johansen /** 24763e2b423SJohn Johansen * aa_destroy_aafs - cleanup and free aafs 24863e2b423SJohn Johansen * 24963e2b423SJohn Johansen * releases dentries allocated by aa_create_aafs 25063e2b423SJohn Johansen */ 25163e2b423SJohn Johansen void __init aa_destroy_aafs(void) 25263e2b423SJohn Johansen { 2539acd494bSKees Cook aafs_remove_dir(&aa_fs_entry); 25463e2b423SJohn Johansen } 25563e2b423SJohn Johansen 25663e2b423SJohn Johansen /** 25763e2b423SJohn Johansen * aa_create_aafs - create the apparmor security filesystem 25863e2b423SJohn Johansen * 25963e2b423SJohn Johansen * dentries created here are released by aa_destroy_aafs 26063e2b423SJohn Johansen * 26163e2b423SJohn Johansen * Returns: error on failure 26263e2b423SJohn Johansen */ 2633417d8d5SJames Morris static int __init aa_create_aafs(void) 26463e2b423SJohn Johansen { 26563e2b423SJohn Johansen int error; 26663e2b423SJohn Johansen 26763e2b423SJohn Johansen if (!apparmor_initialized) 26863e2b423SJohn Johansen return 0; 26963e2b423SJohn Johansen 2709acd494bSKees Cook if (aa_fs_entry.dentry) { 27163e2b423SJohn Johansen AA_ERROR("%s: AppArmor securityfs already exists\n", __func__); 27263e2b423SJohn Johansen return -EEXIST; 27363e2b423SJohn Johansen } 27463e2b423SJohn Johansen 2759acd494bSKees Cook /* Populate fs tree. */ 2769acd494bSKees Cook error = aafs_create_dir(&aa_fs_entry, NULL); 27763e2b423SJohn Johansen if (error) 27863e2b423SJohn Johansen goto error; 27963e2b423SJohn Johansen 28063e2b423SJohn Johansen /* TODO: add support for apparmorfs_null and apparmorfs_mnt */ 28163e2b423SJohn Johansen 28263e2b423SJohn Johansen /* Report that AppArmor fs is enabled */ 28363e2b423SJohn Johansen aa_info_message("AppArmor Filesystem Enabled"); 28463e2b423SJohn Johansen return 0; 28563e2b423SJohn Johansen 28663e2b423SJohn Johansen error: 28763e2b423SJohn Johansen aa_destroy_aafs(); 28863e2b423SJohn Johansen AA_ERROR("Error creating AppArmor securityfs\n"); 28963e2b423SJohn Johansen return error; 29063e2b423SJohn Johansen } 29163e2b423SJohn Johansen 29263e2b423SJohn Johansen fs_initcall(aa_create_aafs); 293