1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor /sys/kernel/security/apparmor interface functions 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #include <linux/ctype.h> 16 #include <linux/security.h> 17 #include <linux/vmalloc.h> 18 #include <linux/module.h> 19 #include <linux/seq_file.h> 20 #include <linux/uaccess.h> 21 #include <linux/mount.h> 22 #include <linux/namei.h> 23 #include <linux/capability.h> 24 #include <linux/rcupdate.h> 25 #include <linux/fs.h> 26 #include <linux/poll.h> 27 #include <uapi/linux/major.h> 28 #include <uapi/linux/magic.h> 29 30 #include "include/apparmor.h" 31 #include "include/apparmorfs.h" 32 #include "include/audit.h" 33 #include "include/context.h" 34 #include "include/crypto.h" 35 #include "include/ipc.h" 36 #include "include/policy_ns.h" 37 #include "include/label.h" 38 #include "include/policy.h" 39 #include "include/policy_ns.h" 40 #include "include/resource.h" 41 #include "include/policy_unpack.h" 42 43 /* 44 * The apparmor filesystem interface used for policy load and introspection 45 * The interface is split into two main components based on their function 46 * a securityfs component: 47 * used for static files that are always available, and which allows 48 * userspace to specificy the location of the security filesystem. 49 * 50 * fns and data are prefixed with 51 * aa_sfs_ 52 * 53 * an apparmorfs component: 54 * used loaded policy content and introspection. It is not part of a 55 * regular mounted filesystem and is available only through the magic 56 * policy symlink in the root of the securityfs apparmor/ directory. 57 * Tasks queries will be magically redirected to the correct portion 58 * of the policy tree based on their confinement. 59 * 60 * fns and data are prefixed with 61 * aafs_ 62 * 63 * The aa_fs_ prefix is used to indicate the fn is used by both the 64 * securityfs and apparmorfs filesystems. 65 */ 66 67 68 /* 69 * support fns 70 */ 71 72 /** 73 * aa_mangle_name - mangle a profile name to std profile layout form 74 * @name: profile name to mangle (NOT NULL) 75 * @target: buffer to store mangled name, same length as @name (MAYBE NULL) 76 * 77 * Returns: length of mangled name 78 */ 79 static int mangle_name(const char *name, char *target) 80 { 81 char *t = target; 82 83 while (*name == '/' || *name == '.') 84 name++; 85 86 if (target) { 87 for (; *name; name++) { 88 if (*name == '/') 89 *(t)++ = '.'; 90 else if (isspace(*name)) 91 *(t)++ = '_'; 92 else if (isalnum(*name) || strchr("._-", *name)) 93 *(t)++ = *name; 94 } 95 96 *t = 0; 97 } else { 98 int len = 0; 99 for (; *name; name++) { 100 if (isalnum(*name) || isspace(*name) || 101 strchr("/._-", *name)) 102 len++; 103 } 104 105 return len; 106 } 107 108 return t - target; 109 } 110 111 112 /* 113 * aafs - core fns and data for the policy tree 114 */ 115 116 #define AAFS_NAME "apparmorfs" 117 static struct vfsmount *aafs_mnt; 118 static int aafs_count; 119 120 121 static int aafs_show_path(struct seq_file *seq, struct dentry *dentry) 122 { 123 struct inode *inode = d_inode(dentry); 124 125 seq_printf(seq, "%s:[%lu]", AAFS_NAME, inode->i_ino); 126 return 0; 127 } 128 129 static void aafs_evict_inode(struct inode *inode) 130 { 131 truncate_inode_pages_final(&inode->i_data); 132 clear_inode(inode); 133 if (S_ISLNK(inode->i_mode)) 134 kfree(inode->i_link); 135 } 136 137 static const struct super_operations aafs_super_ops = { 138 .statfs = simple_statfs, 139 .evict_inode = aafs_evict_inode, 140 .show_path = aafs_show_path, 141 }; 142 143 static int fill_super(struct super_block *sb, void *data, int silent) 144 { 145 static struct tree_descr files[] = { {""} }; 146 int error; 147 148 error = simple_fill_super(sb, AAFS_MAGIC, files); 149 if (error) 150 return error; 151 sb->s_op = &aafs_super_ops; 152 153 return 0; 154 } 155 156 static struct dentry *aafs_mount(struct file_system_type *fs_type, 157 int flags, const char *dev_name, void *data) 158 { 159 return mount_single(fs_type, flags, data, fill_super); 160 } 161 162 static struct file_system_type aafs_ops = { 163 .owner = THIS_MODULE, 164 .name = AAFS_NAME, 165 .mount = aafs_mount, 166 .kill_sb = kill_anon_super, 167 }; 168 169 /** 170 * __aafs_setup_d_inode - basic inode setup for apparmorfs 171 * @dir: parent directory for the dentry 172 * @dentry: dentry we are seting the inode up for 173 * @mode: permissions the file should have 174 * @data: data to store on inode.i_private, available in open() 175 * @link: if symlink, symlink target string 176 * @fops: struct file_operations that should be used 177 * @iops: struct of inode_operations that should be used 178 */ 179 static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry, 180 umode_t mode, void *data, char *link, 181 const struct file_operations *fops, 182 const struct inode_operations *iops) 183 { 184 struct inode *inode = new_inode(dir->i_sb); 185 186 AA_BUG(!dir); 187 AA_BUG(!dentry); 188 189 if (!inode) 190 return -ENOMEM; 191 192 inode->i_ino = get_next_ino(); 193 inode->i_mode = mode; 194 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode); 195 inode->i_private = data; 196 if (S_ISDIR(mode)) { 197 inode->i_op = iops ? iops : &simple_dir_inode_operations; 198 inode->i_fop = &simple_dir_operations; 199 inc_nlink(inode); 200 inc_nlink(dir); 201 } else if (S_ISLNK(mode)) { 202 inode->i_op = iops ? iops : &simple_symlink_inode_operations; 203 inode->i_link = link; 204 } else { 205 inode->i_fop = fops; 206 } 207 d_instantiate(dentry, inode); 208 dget(dentry); 209 210 return 0; 211 } 212 213 /** 214 * aafs_create - create a dentry in the apparmorfs filesystem 215 * 216 * @name: name of dentry to create 217 * @mode: permissions the file should have 218 * @parent: parent directory for this dentry 219 * @data: data to store on inode.i_private, available in open() 220 * @link: if symlink, symlink target string 221 * @fops: struct file_operations that should be used for 222 * @iops: struct of inode_operations that should be used 223 * 224 * This is the basic "create a xxx" function for apparmorfs. 225 * 226 * Returns a pointer to a dentry if it succeeds, that must be free with 227 * aafs_remove(). Will return ERR_PTR on failure. 228 */ 229 static struct dentry *aafs_create(const char *name, umode_t mode, 230 struct dentry *parent, void *data, void *link, 231 const struct file_operations *fops, 232 const struct inode_operations *iops) 233 { 234 struct dentry *dentry; 235 struct inode *dir; 236 int error; 237 238 AA_BUG(!name); 239 AA_BUG(!parent); 240 241 if (!(mode & S_IFMT)) 242 mode = (mode & S_IALLUGO) | S_IFREG; 243 244 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count); 245 if (error) 246 return ERR_PTR(error); 247 248 dir = d_inode(parent); 249 250 inode_lock(dir); 251 dentry = lookup_one_len(name, parent, strlen(name)); 252 if (IS_ERR(dentry)) { 253 error = PTR_ERR(dentry); 254 goto fail_lock; 255 } 256 257 if (d_really_is_positive(dentry)) { 258 error = -EEXIST; 259 goto fail_dentry; 260 } 261 262 error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops); 263 if (error) 264 goto fail_dentry; 265 inode_unlock(dir); 266 267 return dentry; 268 269 fail_dentry: 270 dput(dentry); 271 272 fail_lock: 273 inode_unlock(dir); 274 simple_release_fs(&aafs_mnt, &aafs_count); 275 276 return ERR_PTR(error); 277 } 278 279 /** 280 * aafs_create_file - create a file in the apparmorfs filesystem 281 * 282 * @name: name of dentry to create 283 * @mode: permissions the file should have 284 * @parent: parent directory for this dentry 285 * @data: data to store on inode.i_private, available in open() 286 * @fops: struct file_operations that should be used for 287 * 288 * see aafs_create 289 */ 290 static struct dentry *aafs_create_file(const char *name, umode_t mode, 291 struct dentry *parent, void *data, 292 const struct file_operations *fops) 293 { 294 return aafs_create(name, mode, parent, data, NULL, fops, NULL); 295 } 296 297 /** 298 * aafs_create_dir - create a directory in the apparmorfs filesystem 299 * 300 * @name: name of dentry to create 301 * @parent: parent directory for this dentry 302 * 303 * see aafs_create 304 */ 305 static struct dentry *aafs_create_dir(const char *name, struct dentry *parent) 306 { 307 return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL, 308 NULL); 309 } 310 311 /** 312 * aafs_create_symlink - create a symlink in the apparmorfs filesystem 313 * @name: name of dentry to create 314 * @parent: parent directory for this dentry 315 * @target: if symlink, symlink target string 316 * @iops: struct of inode_operations that should be used 317 * 318 * If @target parameter is %NULL, then the @iops parameter needs to be 319 * setup to handle .readlink and .get_link inode_operations. 320 */ 321 static struct dentry *aafs_create_symlink(const char *name, 322 struct dentry *parent, 323 const char *target, 324 const struct inode_operations *iops) 325 { 326 struct dentry *dent; 327 char *link = NULL; 328 329 if (target) { 330 link = kstrdup(target, GFP_KERNEL); 331 if (!link) 332 return ERR_PTR(-ENOMEM); 333 } 334 dent = aafs_create(name, S_IFLNK | 0444, parent, NULL, link, NULL, 335 iops); 336 if (IS_ERR(dent)) 337 kfree(link); 338 339 return dent; 340 } 341 342 /** 343 * aafs_remove - removes a file or directory from the apparmorfs filesystem 344 * 345 * @dentry: dentry of the file/directory/symlink to removed. 346 */ 347 static void aafs_remove(struct dentry *dentry) 348 { 349 struct inode *dir; 350 351 if (!dentry || IS_ERR(dentry)) 352 return; 353 354 dir = d_inode(dentry->d_parent); 355 inode_lock(dir); 356 if (simple_positive(dentry)) { 357 if (d_is_dir(dentry)) 358 simple_rmdir(dir, dentry); 359 else 360 simple_unlink(dir, dentry); 361 dput(dentry); 362 } 363 inode_unlock(dir); 364 simple_release_fs(&aafs_mnt, &aafs_count); 365 } 366 367 368 /* 369 * aa_fs - policy load/replace/remove 370 */ 371 372 /** 373 * aa_simple_write_to_buffer - common routine for getting policy from user 374 * @userbuf: user buffer to copy data from (NOT NULL) 375 * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size) 376 * @copy_size: size of data to copy from user buffer 377 * @pos: position write is at in the file (NOT NULL) 378 * 379 * Returns: kernel buffer containing copy of user buffer data or an 380 * ERR_PTR on failure. 381 */ 382 static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf, 383 size_t alloc_size, 384 size_t copy_size, 385 loff_t *pos) 386 { 387 struct aa_loaddata *data; 388 389 AA_BUG(copy_size > alloc_size); 390 391 if (*pos != 0) 392 /* only writes from pos 0, that is complete writes */ 393 return ERR_PTR(-ESPIPE); 394 395 /* freed by caller to simple_write_to_buffer */ 396 data = aa_loaddata_alloc(alloc_size); 397 if (IS_ERR(data)) 398 return data; 399 400 data->size = copy_size; 401 if (copy_from_user(data->data, userbuf, copy_size)) { 402 kvfree(data); 403 return ERR_PTR(-EFAULT); 404 } 405 406 return data; 407 } 408 409 static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, 410 loff_t *pos, struct aa_ns *ns) 411 { 412 struct aa_loaddata *data; 413 struct aa_label *label; 414 ssize_t error; 415 416 label = begin_current_label_crit_section(); 417 418 /* high level check about policy management - fine grained in 419 * below after unpack 420 */ 421 error = aa_may_manage_policy(label, ns, mask); 422 if (error) 423 return error; 424 425 data = aa_simple_write_to_buffer(buf, size, size, pos); 426 error = PTR_ERR(data); 427 if (!IS_ERR(data)) { 428 error = aa_replace_profiles(ns, label, mask, data); 429 aa_put_loaddata(data); 430 } 431 end_current_label_crit_section(label); 432 433 return error; 434 } 435 436 /* .load file hook fn to load policy */ 437 static ssize_t profile_load(struct file *f, const char __user *buf, size_t size, 438 loff_t *pos) 439 { 440 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private); 441 int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns); 442 443 aa_put_ns(ns); 444 445 return error; 446 } 447 448 static const struct file_operations aa_fs_profile_load = { 449 .write = profile_load, 450 .llseek = default_llseek, 451 }; 452 453 /* .replace file hook fn to load and/or replace policy */ 454 static ssize_t profile_replace(struct file *f, const char __user *buf, 455 size_t size, loff_t *pos) 456 { 457 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private); 458 int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY, 459 buf, size, pos, ns); 460 aa_put_ns(ns); 461 462 return error; 463 } 464 465 static const struct file_operations aa_fs_profile_replace = { 466 .write = profile_replace, 467 .llseek = default_llseek, 468 }; 469 470 /* .remove file hook fn to remove loaded policy */ 471 static ssize_t profile_remove(struct file *f, const char __user *buf, 472 size_t size, loff_t *pos) 473 { 474 struct aa_loaddata *data; 475 struct aa_label *label; 476 ssize_t error; 477 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private); 478 479 label = begin_current_label_crit_section(); 480 /* high level check about policy management - fine grained in 481 * below after unpack 482 */ 483 error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY); 484 if (error) 485 goto out; 486 487 /* 488 * aa_remove_profile needs a null terminated string so 1 extra 489 * byte is allocated and the copied data is null terminated. 490 */ 491 data = aa_simple_write_to_buffer(buf, size + 1, size, pos); 492 493 error = PTR_ERR(data); 494 if (!IS_ERR(data)) { 495 data->data[size] = 0; 496 error = aa_remove_profiles(ns, label, data->data, size); 497 aa_put_loaddata(data); 498 } 499 out: 500 end_current_label_crit_section(label); 501 aa_put_ns(ns); 502 return error; 503 } 504 505 static const struct file_operations aa_fs_profile_remove = { 506 .write = profile_remove, 507 .llseek = default_llseek, 508 }; 509 510 struct aa_revision { 511 struct aa_ns *ns; 512 long last_read; 513 }; 514 515 /* revision file hook fn for policy loads */ 516 static int ns_revision_release(struct inode *inode, struct file *file) 517 { 518 struct aa_revision *rev = file->private_data; 519 520 if (rev) { 521 aa_put_ns(rev->ns); 522 kfree(rev); 523 } 524 525 return 0; 526 } 527 528 static ssize_t ns_revision_read(struct file *file, char __user *buf, 529 size_t size, loff_t *ppos) 530 { 531 struct aa_revision *rev = file->private_data; 532 char buffer[32]; 533 long last_read; 534 int avail; 535 536 mutex_lock(&rev->ns->lock); 537 last_read = rev->last_read; 538 if (last_read == rev->ns->revision) { 539 mutex_unlock(&rev->ns->lock); 540 if (file->f_flags & O_NONBLOCK) 541 return -EAGAIN; 542 if (wait_event_interruptible(rev->ns->wait, 543 last_read != 544 READ_ONCE(rev->ns->revision))) 545 return -ERESTARTSYS; 546 mutex_lock(&rev->ns->lock); 547 } 548 549 avail = sprintf(buffer, "%ld\n", rev->ns->revision); 550 if (*ppos + size > avail) { 551 rev->last_read = rev->ns->revision; 552 *ppos = 0; 553 } 554 mutex_unlock(&rev->ns->lock); 555 556 return simple_read_from_buffer(buf, size, ppos, buffer, avail); 557 } 558 559 static int ns_revision_open(struct inode *inode, struct file *file) 560 { 561 struct aa_revision *rev = kzalloc(sizeof(*rev), GFP_KERNEL); 562 563 if (!rev) 564 return -ENOMEM; 565 566 rev->ns = aa_get_ns(inode->i_private); 567 if (!rev->ns) 568 rev->ns = aa_get_current_ns(); 569 file->private_data = rev; 570 571 return 0; 572 } 573 574 static unsigned int ns_revision_poll(struct file *file, poll_table *pt) 575 { 576 struct aa_revision *rev = file->private_data; 577 unsigned int mask = 0; 578 579 if (rev) { 580 mutex_lock(&rev->ns->lock); 581 poll_wait(file, &rev->ns->wait, pt); 582 if (rev->last_read < rev->ns->revision) 583 mask |= POLLIN | POLLRDNORM; 584 mutex_unlock(&rev->ns->lock); 585 } 586 587 return mask; 588 } 589 590 void __aa_bump_ns_revision(struct aa_ns *ns) 591 { 592 ns->revision++; 593 wake_up_interruptible(&ns->wait); 594 } 595 596 static const struct file_operations aa_fs_ns_revision_fops = { 597 .owner = THIS_MODULE, 598 .open = ns_revision_open, 599 .poll = ns_revision_poll, 600 .read = ns_revision_read, 601 .llseek = generic_file_llseek, 602 .release = ns_revision_release, 603 }; 604 605 static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms, 606 const char *match_str, size_t match_len) 607 { 608 struct aa_perms tmp; 609 struct aa_dfa *dfa; 610 unsigned int state = 0; 611 612 if (profile_unconfined(profile)) 613 return; 614 if (profile->file.dfa && *match_str == AA_CLASS_FILE) { 615 dfa = profile->file.dfa; 616 state = aa_dfa_match_len(dfa, profile->file.start, 617 match_str + 1, match_len - 1); 618 tmp = nullperms; 619 if (state) { 620 struct path_cond cond = { }; 621 622 tmp = aa_compute_fperms(dfa, state, &cond); 623 } 624 } else if (profile->policy.dfa) { 625 if (!PROFILE_MEDIATES_SAFE(profile, *match_str)) 626 return; /* no change to current perms */ 627 dfa = profile->policy.dfa; 628 state = aa_dfa_match_len(dfa, profile->policy.start[0], 629 match_str, match_len); 630 if (state) 631 aa_compute_perms(dfa, state, &tmp); 632 else 633 tmp = nullperms; 634 } 635 aa_apply_modes_to_perms(profile, &tmp); 636 aa_perms_accum_raw(perms, &tmp); 637 } 638 639 640 /** 641 * query_data - queries a policy and writes its data to buf 642 * @buf: the resulting data is stored here (NOT NULL) 643 * @buf_len: size of buf 644 * @query: query string used to retrieve data 645 * @query_len: size of query including second NUL byte 646 * 647 * The buffers pointed to by buf and query may overlap. The query buffer is 648 * parsed before buf is written to. 649 * 650 * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of 651 * the security confinement context and <KEY> is the name of the data to 652 * retrieve. <LABEL> and <KEY> must not be NUL-terminated. 653 * 654 * Don't expect the contents of buf to be preserved on failure. 655 * 656 * Returns: number of characters written to buf or -errno on failure 657 */ 658 static ssize_t query_data(char *buf, size_t buf_len, 659 char *query, size_t query_len) 660 { 661 char *out; 662 const char *key; 663 struct label_it i; 664 struct aa_label *label, *curr; 665 struct aa_profile *profile; 666 struct aa_data *data; 667 u32 bytes, blocks; 668 __le32 outle32; 669 670 if (!query_len) 671 return -EINVAL; /* need a query */ 672 673 key = query + strnlen(query, query_len) + 1; 674 if (key + 1 >= query + query_len) 675 return -EINVAL; /* not enough space for a non-empty key */ 676 if (key + strnlen(key, query + query_len - key) >= query + query_len) 677 return -EINVAL; /* must end with NUL */ 678 679 if (buf_len < sizeof(bytes) + sizeof(blocks)) 680 return -EINVAL; /* not enough space */ 681 682 curr = begin_current_label_crit_section(); 683 label = aa_label_parse(curr, query, GFP_KERNEL, false, false); 684 end_current_label_crit_section(curr); 685 if (IS_ERR(label)) 686 return PTR_ERR(label); 687 688 /* We are going to leave space for two numbers. The first is the total 689 * number of bytes we are writing after the first number. This is so 690 * users can read the full output without reallocation. 691 * 692 * The second number is the number of data blocks we're writing. An 693 * application might be confined by multiple policies having data in 694 * the same key. 695 */ 696 memset(buf, 0, sizeof(bytes) + sizeof(blocks)); 697 out = buf + sizeof(bytes) + sizeof(blocks); 698 699 blocks = 0; 700 label_for_each_confined(i, label, profile) { 701 if (!profile->data) 702 continue; 703 704 data = rhashtable_lookup_fast(profile->data, &key, 705 profile->data->p); 706 707 if (data) { 708 if (out + sizeof(outle32) + data->size > buf + 709 buf_len) { 710 aa_put_label(label); 711 return -EINVAL; /* not enough space */ 712 } 713 outle32 = __cpu_to_le32(data->size); 714 memcpy(out, &outle32, sizeof(outle32)); 715 out += sizeof(outle32); 716 memcpy(out, data->data, data->size); 717 out += data->size; 718 blocks++; 719 } 720 } 721 aa_put_label(label); 722 723 outle32 = __cpu_to_le32(out - buf - sizeof(bytes)); 724 memcpy(buf, &outle32, sizeof(outle32)); 725 outle32 = __cpu_to_le32(blocks); 726 memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32)); 727 728 return out - buf; 729 } 730 731 /** 732 * query_label - queries a label and writes permissions to buf 733 * @buf: the resulting permissions string is stored here (NOT NULL) 734 * @buf_len: size of buf 735 * @query: binary query string to match against the dfa 736 * @query_len: size of query 737 * @view_only: only compute for querier's view 738 * 739 * The buffers pointed to by buf and query may overlap. The query buffer is 740 * parsed before buf is written to. 741 * 742 * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is 743 * the name of the label, in the current namespace, that is to be queried and 744 * DFA_STRING is a binary string to match against the label(s)'s DFA. 745 * 746 * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters 747 * but must *not* be NUL terminated. 748 * 749 * Returns: number of characters written to buf or -errno on failure 750 */ 751 static ssize_t query_label(char *buf, size_t buf_len, 752 char *query, size_t query_len, bool view_only) 753 { 754 struct aa_profile *profile; 755 struct aa_label *label, *curr; 756 char *label_name, *match_str; 757 size_t label_name_len, match_len; 758 struct aa_perms perms; 759 struct label_it i; 760 761 if (!query_len) 762 return -EINVAL; 763 764 label_name = query; 765 label_name_len = strnlen(query, query_len); 766 if (!label_name_len || label_name_len == query_len) 767 return -EINVAL; 768 769 /** 770 * The extra byte is to account for the null byte between the 771 * profile name and dfa string. profile_name_len is greater 772 * than zero and less than query_len, so a byte can be safely 773 * added or subtracted. 774 */ 775 match_str = label_name + label_name_len + 1; 776 match_len = query_len - label_name_len - 1; 777 778 curr = begin_current_label_crit_section(); 779 label = aa_label_parse(curr, label_name, GFP_KERNEL, false, false); 780 end_current_label_crit_section(curr); 781 if (IS_ERR(label)) 782 return PTR_ERR(label); 783 784 perms = allperms; 785 if (view_only) { 786 label_for_each_in_ns(i, labels_ns(label), label, profile) { 787 profile_query_cb(profile, &perms, match_str, match_len); 788 } 789 } else { 790 label_for_each(i, label, profile) { 791 profile_query_cb(profile, &perms, match_str, match_len); 792 } 793 } 794 aa_put_label(label); 795 796 return scnprintf(buf, buf_len, 797 "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n", 798 perms.allow, perms.deny, perms.audit, perms.quiet); 799 } 800 801 /* 802 * Transaction based IO. 803 * The file expects a write which triggers the transaction, and then 804 * possibly a read(s) which collects the result - which is stored in a 805 * file-local buffer. Once a new write is performed, a new set of results 806 * are stored in the file-local buffer. 807 */ 808 struct multi_transaction { 809 struct kref count; 810 ssize_t size; 811 char data[0]; 812 }; 813 814 #define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction)) 815 /* TODO: replace with per file lock */ 816 static DEFINE_SPINLOCK(multi_transaction_lock); 817 818 static void multi_transaction_kref(struct kref *kref) 819 { 820 struct multi_transaction *t; 821 822 t = container_of(kref, struct multi_transaction, count); 823 free_page((unsigned long) t); 824 } 825 826 static struct multi_transaction * 827 get_multi_transaction(struct multi_transaction *t) 828 { 829 if (t) 830 kref_get(&(t->count)); 831 832 return t; 833 } 834 835 static void put_multi_transaction(struct multi_transaction *t) 836 { 837 if (t) 838 kref_put(&(t->count), multi_transaction_kref); 839 } 840 841 /* does not increment @new's count */ 842 static void multi_transaction_set(struct file *file, 843 struct multi_transaction *new, size_t n) 844 { 845 struct multi_transaction *old; 846 847 AA_BUG(n > MULTI_TRANSACTION_LIMIT); 848 849 new->size = n; 850 spin_lock(&multi_transaction_lock); 851 old = (struct multi_transaction *) file->private_data; 852 file->private_data = new; 853 spin_unlock(&multi_transaction_lock); 854 put_multi_transaction(old); 855 } 856 857 static struct multi_transaction *multi_transaction_new(struct file *file, 858 const char __user *buf, 859 size_t size) 860 { 861 struct multi_transaction *t; 862 863 if (size > MULTI_TRANSACTION_LIMIT - 1) 864 return ERR_PTR(-EFBIG); 865 866 t = (struct multi_transaction *)get_zeroed_page(GFP_KERNEL); 867 if (!t) 868 return ERR_PTR(-ENOMEM); 869 kref_init(&t->count); 870 if (copy_from_user(t->data, buf, size)) 871 return ERR_PTR(-EFAULT); 872 873 return t; 874 } 875 876 static ssize_t multi_transaction_read(struct file *file, char __user *buf, 877 size_t size, loff_t *pos) 878 { 879 struct multi_transaction *t; 880 ssize_t ret; 881 882 spin_lock(&multi_transaction_lock); 883 t = get_multi_transaction(file->private_data); 884 spin_unlock(&multi_transaction_lock); 885 if (!t) 886 return 0; 887 888 ret = simple_read_from_buffer(buf, size, pos, t->data, t->size); 889 put_multi_transaction(t); 890 891 return ret; 892 } 893 894 static int multi_transaction_release(struct inode *inode, struct file *file) 895 { 896 put_multi_transaction(file->private_data); 897 898 return 0; 899 } 900 901 #define QUERY_CMD_LABEL "label\0" 902 #define QUERY_CMD_LABEL_LEN 6 903 #define QUERY_CMD_PROFILE "profile\0" 904 #define QUERY_CMD_PROFILE_LEN 8 905 #define QUERY_CMD_LABELALL "labelall\0" 906 #define QUERY_CMD_LABELALL_LEN 9 907 #define QUERY_CMD_DATA "data\0" 908 #define QUERY_CMD_DATA_LEN 5 909 910 /** 911 * aa_write_access - generic permissions and data query 912 * @file: pointer to open apparmorfs/access file 913 * @ubuf: user buffer containing the complete query string (NOT NULL) 914 * @count: size of ubuf 915 * @ppos: position in the file (MUST BE ZERO) 916 * 917 * Allows for one permissions or data query per open(), write(), and read() 918 * sequence. The only queries currently supported are label-based queries for 919 * permissions or data. 920 * 921 * For permissions queries, ubuf must begin with "label\0", followed by the 922 * profile query specific format described in the query_label() function 923 * documentation. 924 * 925 * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where 926 * <LABEL> is the name of the security confinement context and <KEY> is the 927 * name of the data to retrieve. 928 * 929 * Returns: number of bytes written or -errno on failure 930 */ 931 static ssize_t aa_write_access(struct file *file, const char __user *ubuf, 932 size_t count, loff_t *ppos) 933 { 934 struct multi_transaction *t; 935 ssize_t len; 936 937 if (*ppos) 938 return -ESPIPE; 939 940 t = multi_transaction_new(file, ubuf, count); 941 if (IS_ERR(t)) 942 return PTR_ERR(t); 943 944 if (count > QUERY_CMD_PROFILE_LEN && 945 !memcmp(t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) { 946 len = query_label(t->data, MULTI_TRANSACTION_LIMIT, 947 t->data + QUERY_CMD_PROFILE_LEN, 948 count - QUERY_CMD_PROFILE_LEN, true); 949 } else if (count > QUERY_CMD_LABEL_LEN && 950 !memcmp(t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) { 951 len = query_label(t->data, MULTI_TRANSACTION_LIMIT, 952 t->data + QUERY_CMD_LABEL_LEN, 953 count - QUERY_CMD_LABEL_LEN, true); 954 } else if (count > QUERY_CMD_LABELALL_LEN && 955 !memcmp(t->data, QUERY_CMD_LABELALL, 956 QUERY_CMD_LABELALL_LEN)) { 957 len = query_label(t->data, MULTI_TRANSACTION_LIMIT, 958 t->data + QUERY_CMD_LABELALL_LEN, 959 count - QUERY_CMD_LABELALL_LEN, false); 960 } else if (count > QUERY_CMD_DATA_LEN && 961 !memcmp(t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) { 962 len = query_data(t->data, MULTI_TRANSACTION_LIMIT, 963 t->data + QUERY_CMD_DATA_LEN, 964 count - QUERY_CMD_DATA_LEN); 965 } else 966 len = -EINVAL; 967 968 if (len < 0) { 969 put_multi_transaction(t); 970 return len; 971 } 972 973 multi_transaction_set(file, t, len); 974 975 return count; 976 } 977 978 static const struct file_operations aa_sfs_access = { 979 .write = aa_write_access, 980 .read = multi_transaction_read, 981 .release = multi_transaction_release, 982 .llseek = generic_file_llseek, 983 }; 984 985 static int aa_sfs_seq_show(struct seq_file *seq, void *v) 986 { 987 struct aa_sfs_entry *fs_file = seq->private; 988 989 if (!fs_file) 990 return 0; 991 992 switch (fs_file->v_type) { 993 case AA_SFS_TYPE_BOOLEAN: 994 seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no"); 995 break; 996 case AA_SFS_TYPE_STRING: 997 seq_printf(seq, "%s\n", fs_file->v.string); 998 break; 999 case AA_SFS_TYPE_U64: 1000 seq_printf(seq, "%#08lx\n", fs_file->v.u64); 1001 break; 1002 default: 1003 /* Ignore unpritable entry types. */ 1004 break; 1005 } 1006 1007 return 0; 1008 } 1009 1010 static int aa_sfs_seq_open(struct inode *inode, struct file *file) 1011 { 1012 return single_open(file, aa_sfs_seq_show, inode->i_private); 1013 } 1014 1015 const struct file_operations aa_sfs_seq_file_ops = { 1016 .owner = THIS_MODULE, 1017 .open = aa_sfs_seq_open, 1018 .read = seq_read, 1019 .llseek = seq_lseek, 1020 .release = single_release, 1021 }; 1022 1023 /* 1024 * profile based file operations 1025 * policy/profiles/XXXX/profiles/ * 1026 */ 1027 1028 #define SEQ_PROFILE_FOPS(NAME) \ 1029 static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\ 1030 { \ 1031 return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show); \ 1032 } \ 1033 \ 1034 static const struct file_operations seq_profile_ ##NAME ##_fops = { \ 1035 .owner = THIS_MODULE, \ 1036 .open = seq_profile_ ##NAME ##_open, \ 1037 .read = seq_read, \ 1038 .llseek = seq_lseek, \ 1039 .release = seq_profile_release, \ 1040 } \ 1041 1042 static int seq_profile_open(struct inode *inode, struct file *file, 1043 int (*show)(struct seq_file *, void *)) 1044 { 1045 struct aa_proxy *proxy = aa_get_proxy(inode->i_private); 1046 int error = single_open(file, show, proxy); 1047 1048 if (error) { 1049 file->private_data = NULL; 1050 aa_put_proxy(proxy); 1051 } 1052 1053 return error; 1054 } 1055 1056 static int seq_profile_release(struct inode *inode, struct file *file) 1057 { 1058 struct seq_file *seq = (struct seq_file *) file->private_data; 1059 if (seq) 1060 aa_put_proxy(seq->private); 1061 return single_release(inode, file); 1062 } 1063 1064 static int seq_profile_name_show(struct seq_file *seq, void *v) 1065 { 1066 struct aa_proxy *proxy = seq->private; 1067 struct aa_label *label = aa_get_label_rcu(&proxy->label); 1068 struct aa_profile *profile = labels_profile(label); 1069 seq_printf(seq, "%s\n", profile->base.name); 1070 aa_put_label(label); 1071 1072 return 0; 1073 } 1074 1075 static int seq_profile_mode_show(struct seq_file *seq, void *v) 1076 { 1077 struct aa_proxy *proxy = seq->private; 1078 struct aa_label *label = aa_get_label_rcu(&proxy->label); 1079 struct aa_profile *profile = labels_profile(label); 1080 seq_printf(seq, "%s\n", aa_profile_mode_names[profile->mode]); 1081 aa_put_label(label); 1082 1083 return 0; 1084 } 1085 1086 static int seq_profile_attach_show(struct seq_file *seq, void *v) 1087 { 1088 struct aa_proxy *proxy = seq->private; 1089 struct aa_label *label = aa_get_label_rcu(&proxy->label); 1090 struct aa_profile *profile = labels_profile(label); 1091 if (profile->attach) 1092 seq_printf(seq, "%s\n", profile->attach); 1093 else if (profile->xmatch) 1094 seq_puts(seq, "<unknown>\n"); 1095 else 1096 seq_printf(seq, "%s\n", profile->base.name); 1097 aa_put_label(label); 1098 1099 return 0; 1100 } 1101 1102 static int seq_profile_hash_show(struct seq_file *seq, void *v) 1103 { 1104 struct aa_proxy *proxy = seq->private; 1105 struct aa_label *label = aa_get_label_rcu(&proxy->label); 1106 struct aa_profile *profile = labels_profile(label); 1107 unsigned int i, size = aa_hash_size(); 1108 1109 if (profile->hash) { 1110 for (i = 0; i < size; i++) 1111 seq_printf(seq, "%.2x", profile->hash[i]); 1112 seq_putc(seq, '\n'); 1113 } 1114 aa_put_label(label); 1115 1116 return 0; 1117 } 1118 1119 SEQ_PROFILE_FOPS(name); 1120 SEQ_PROFILE_FOPS(mode); 1121 SEQ_PROFILE_FOPS(attach); 1122 SEQ_PROFILE_FOPS(hash); 1123 1124 /* 1125 * namespace based files 1126 * several root files and 1127 * policy/ * 1128 */ 1129 1130 #define SEQ_NS_FOPS(NAME) \ 1131 static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file) \ 1132 { \ 1133 return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private); \ 1134 } \ 1135 \ 1136 static const struct file_operations seq_ns_ ##NAME ##_fops = { \ 1137 .owner = THIS_MODULE, \ 1138 .open = seq_ns_ ##NAME ##_open, \ 1139 .read = seq_read, \ 1140 .llseek = seq_lseek, \ 1141 .release = single_release, \ 1142 } \ 1143 1144 static int seq_ns_stacked_show(struct seq_file *seq, void *v) 1145 { 1146 struct aa_label *label; 1147 1148 label = begin_current_label_crit_section(); 1149 seq_printf(seq, "%s\n", label->size > 1 ? "yes" : "no"); 1150 end_current_label_crit_section(label); 1151 1152 return 0; 1153 } 1154 1155 static int seq_ns_nsstacked_show(struct seq_file *seq, void *v) 1156 { 1157 struct aa_label *label; 1158 struct aa_profile *profile; 1159 struct label_it it; 1160 int count = 1; 1161 1162 label = begin_current_label_crit_section(); 1163 1164 if (label->size > 1) { 1165 label_for_each(it, label, profile) 1166 if (profile->ns != labels_ns(label)) { 1167 count++; 1168 break; 1169 } 1170 } 1171 1172 seq_printf(seq, "%s\n", count > 1 ? "yes" : "no"); 1173 end_current_label_crit_section(label); 1174 1175 return 0; 1176 } 1177 1178 static int seq_ns_level_show(struct seq_file *seq, void *v) 1179 { 1180 struct aa_label *label; 1181 1182 label = begin_current_label_crit_section(); 1183 seq_printf(seq, "%d\n", labels_ns(label)->level); 1184 end_current_label_crit_section(label); 1185 1186 return 0; 1187 } 1188 1189 static int seq_ns_name_show(struct seq_file *seq, void *v) 1190 { 1191 struct aa_label *label = begin_current_label_crit_section(); 1192 1193 seq_printf(seq, "%s\n", aa_ns_name(labels_ns(label), 1194 labels_ns(label), true)); 1195 end_current_label_crit_section(label); 1196 1197 return 0; 1198 } 1199 1200 SEQ_NS_FOPS(stacked); 1201 SEQ_NS_FOPS(nsstacked); 1202 SEQ_NS_FOPS(level); 1203 SEQ_NS_FOPS(name); 1204 1205 1206 /* policy/raw_data/ * file ops */ 1207 1208 #define SEQ_RAWDATA_FOPS(NAME) \ 1209 static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\ 1210 { \ 1211 return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show); \ 1212 } \ 1213 \ 1214 static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \ 1215 .owner = THIS_MODULE, \ 1216 .open = seq_rawdata_ ##NAME ##_open, \ 1217 .read = seq_read, \ 1218 .llseek = seq_lseek, \ 1219 .release = seq_rawdata_release, \ 1220 } \ 1221 1222 static int seq_rawdata_open(struct inode *inode, struct file *file, 1223 int (*show)(struct seq_file *, void *)) 1224 { 1225 struct aa_loaddata *data = __aa_get_loaddata(inode->i_private); 1226 int error; 1227 1228 if (!data) 1229 /* lost race this ent is being reaped */ 1230 return -ENOENT; 1231 1232 error = single_open(file, show, data); 1233 if (error) { 1234 AA_BUG(file->private_data && 1235 ((struct seq_file *)file->private_data)->private); 1236 aa_put_loaddata(data); 1237 } 1238 1239 return error; 1240 } 1241 1242 static int seq_rawdata_release(struct inode *inode, struct file *file) 1243 { 1244 struct seq_file *seq = (struct seq_file *) file->private_data; 1245 1246 if (seq) 1247 aa_put_loaddata(seq->private); 1248 1249 return single_release(inode, file); 1250 } 1251 1252 static int seq_rawdata_abi_show(struct seq_file *seq, void *v) 1253 { 1254 struct aa_loaddata *data = seq->private; 1255 1256 seq_printf(seq, "v%d\n", data->abi); 1257 1258 return 0; 1259 } 1260 1261 static int seq_rawdata_revision_show(struct seq_file *seq, void *v) 1262 { 1263 struct aa_loaddata *data = seq->private; 1264 1265 seq_printf(seq, "%ld\n", data->revision); 1266 1267 return 0; 1268 } 1269 1270 static int seq_rawdata_hash_show(struct seq_file *seq, void *v) 1271 { 1272 struct aa_loaddata *data = seq->private; 1273 unsigned int i, size = aa_hash_size(); 1274 1275 if (data->hash) { 1276 for (i = 0; i < size; i++) 1277 seq_printf(seq, "%.2x", data->hash[i]); 1278 seq_putc(seq, '\n'); 1279 } 1280 1281 return 0; 1282 } 1283 1284 SEQ_RAWDATA_FOPS(abi); 1285 SEQ_RAWDATA_FOPS(revision); 1286 SEQ_RAWDATA_FOPS(hash); 1287 1288 static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size, 1289 loff_t *ppos) 1290 { 1291 struct aa_loaddata *rawdata = file->private_data; 1292 1293 return simple_read_from_buffer(buf, size, ppos, rawdata->data, 1294 rawdata->size); 1295 } 1296 1297 static int rawdata_release(struct inode *inode, struct file *file) 1298 { 1299 aa_put_loaddata(file->private_data); 1300 1301 return 0; 1302 } 1303 1304 static int rawdata_open(struct inode *inode, struct file *file) 1305 { 1306 if (!policy_view_capable(NULL)) 1307 return -EACCES; 1308 file->private_data = __aa_get_loaddata(inode->i_private); 1309 if (!file->private_data) 1310 /* lost race: this entry is being reaped */ 1311 return -ENOENT; 1312 1313 return 0; 1314 } 1315 1316 static const struct file_operations rawdata_fops = { 1317 .open = rawdata_open, 1318 .read = rawdata_read, 1319 .llseek = generic_file_llseek, 1320 .release = rawdata_release, 1321 }; 1322 1323 static void remove_rawdata_dents(struct aa_loaddata *rawdata) 1324 { 1325 int i; 1326 1327 for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) { 1328 if (!IS_ERR_OR_NULL(rawdata->dents[i])) { 1329 /* no refcounts on i_private */ 1330 aafs_remove(rawdata->dents[i]); 1331 rawdata->dents[i] = NULL; 1332 } 1333 } 1334 } 1335 1336 void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata) 1337 { 1338 AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock)); 1339 1340 if (rawdata->ns) { 1341 remove_rawdata_dents(rawdata); 1342 list_del_init(&rawdata->list); 1343 aa_put_ns(rawdata->ns); 1344 rawdata->ns = NULL; 1345 } 1346 } 1347 1348 int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata) 1349 { 1350 struct dentry *dent, *dir; 1351 1352 AA_BUG(!ns); 1353 AA_BUG(!rawdata); 1354 AA_BUG(!mutex_is_locked(&ns->lock)); 1355 AA_BUG(!ns_subdata_dir(ns)); 1356 1357 /* 1358 * just use ns revision dir was originally created at. This is 1359 * under ns->lock and if load is successful revision will be 1360 * bumped and is guaranteed to be unique 1361 */ 1362 rawdata->name = kasprintf(GFP_KERNEL, "%ld", ns->revision); 1363 if (!rawdata->name) 1364 return -ENOMEM; 1365 1366 dir = aafs_create_dir(rawdata->name, ns_subdata_dir(ns)); 1367 if (IS_ERR(dir)) 1368 /* ->name freed when rawdata freed */ 1369 return PTR_ERR(dir); 1370 rawdata->dents[AAFS_LOADDATA_DIR] = dir; 1371 1372 dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata, 1373 &seq_rawdata_abi_fops); 1374 if (IS_ERR(dent)) 1375 goto fail; 1376 rawdata->dents[AAFS_LOADDATA_ABI] = dent; 1377 1378 dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata, 1379 &seq_rawdata_revision_fops); 1380 if (IS_ERR(dent)) 1381 goto fail; 1382 rawdata->dents[AAFS_LOADDATA_REVISION] = dent; 1383 1384 if (aa_g_hash_policy) { 1385 dent = aafs_create_file("sha1", S_IFREG | 0444, dir, 1386 rawdata, &seq_rawdata_hash_fops); 1387 if (IS_ERR(dent)) 1388 goto fail; 1389 rawdata->dents[AAFS_LOADDATA_HASH] = dent; 1390 } 1391 1392 dent = aafs_create_file("raw_data", S_IFREG | 0444, 1393 dir, rawdata, &rawdata_fops); 1394 if (IS_ERR(dent)) 1395 goto fail; 1396 rawdata->dents[AAFS_LOADDATA_DATA] = dent; 1397 d_inode(dent)->i_size = rawdata->size; 1398 1399 rawdata->ns = aa_get_ns(ns); 1400 list_add(&rawdata->list, &ns->rawdata_list); 1401 /* no refcount on inode rawdata */ 1402 1403 return 0; 1404 1405 fail: 1406 remove_rawdata_dents(rawdata); 1407 1408 return PTR_ERR(dent); 1409 } 1410 1411 /** fns to setup dynamic per profile/namespace files **/ 1412 1413 /** 1414 * 1415 * Requires: @profile->ns->lock held 1416 */ 1417 void __aafs_profile_rmdir(struct aa_profile *profile) 1418 { 1419 struct aa_profile *child; 1420 int i; 1421 1422 if (!profile) 1423 return; 1424 1425 list_for_each_entry(child, &profile->base.profiles, base.list) 1426 __aafs_profile_rmdir(child); 1427 1428 for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) { 1429 struct aa_proxy *proxy; 1430 if (!profile->dents[i]) 1431 continue; 1432 1433 proxy = d_inode(profile->dents[i])->i_private; 1434 aafs_remove(profile->dents[i]); 1435 aa_put_proxy(proxy); 1436 profile->dents[i] = NULL; 1437 } 1438 } 1439 1440 /** 1441 * 1442 * Requires: @old->ns->lock held 1443 */ 1444 void __aafs_profile_migrate_dents(struct aa_profile *old, 1445 struct aa_profile *new) 1446 { 1447 int i; 1448 1449 AA_BUG(!old); 1450 AA_BUG(!new); 1451 AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock)); 1452 1453 for (i = 0; i < AAFS_PROF_SIZEOF; i++) { 1454 new->dents[i] = old->dents[i]; 1455 if (new->dents[i]) 1456 new->dents[i]->d_inode->i_mtime = current_time(new->dents[i]->d_inode); 1457 old->dents[i] = NULL; 1458 } 1459 } 1460 1461 static struct dentry *create_profile_file(struct dentry *dir, const char *name, 1462 struct aa_profile *profile, 1463 const struct file_operations *fops) 1464 { 1465 struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy); 1466 struct dentry *dent; 1467 1468 dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops); 1469 if (IS_ERR(dent)) 1470 aa_put_proxy(proxy); 1471 1472 return dent; 1473 } 1474 1475 static int profile_depth(struct aa_profile *profile) 1476 { 1477 int depth = 0; 1478 1479 rcu_read_lock(); 1480 for (depth = 0; profile; profile = rcu_access_pointer(profile->parent)) 1481 depth++; 1482 rcu_read_unlock(); 1483 1484 return depth; 1485 } 1486 1487 static int gen_symlink_name(char *buffer, size_t bsize, int depth, 1488 const char *dirname, const char *fname) 1489 { 1490 int error; 1491 1492 for (; depth > 0; depth--) { 1493 if (bsize < 7) 1494 return -ENAMETOOLONG; 1495 strcpy(buffer, "../../"); 1496 buffer += 6; 1497 bsize -= 6; 1498 } 1499 1500 error = snprintf(buffer, bsize, "raw_data/%s/%s", dirname, fname); 1501 if (error >= bsize || error < 0) 1502 return -ENAMETOOLONG; 1503 1504 return 0; 1505 } 1506 1507 /* 1508 * Requires: @profile->ns->lock held 1509 */ 1510 int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent) 1511 { 1512 struct aa_profile *child; 1513 struct dentry *dent = NULL, *dir; 1514 int error; 1515 1516 AA_BUG(!profile); 1517 AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock)); 1518 1519 if (!parent) { 1520 struct aa_profile *p; 1521 p = aa_deref_parent(profile); 1522 dent = prof_dir(p); 1523 /* adding to parent that previously didn't have children */ 1524 dent = aafs_create_dir("profiles", dent); 1525 if (IS_ERR(dent)) 1526 goto fail; 1527 prof_child_dir(p) = parent = dent; 1528 } 1529 1530 if (!profile->dirname) { 1531 int len, id_len; 1532 len = mangle_name(profile->base.name, NULL); 1533 id_len = snprintf(NULL, 0, ".%ld", profile->ns->uniq_id); 1534 1535 profile->dirname = kmalloc(len + id_len + 1, GFP_KERNEL); 1536 if (!profile->dirname) { 1537 error = -ENOMEM; 1538 goto fail2; 1539 } 1540 1541 mangle_name(profile->base.name, profile->dirname); 1542 sprintf(profile->dirname + len, ".%ld", profile->ns->uniq_id++); 1543 } 1544 1545 dent = aafs_create_dir(profile->dirname, parent); 1546 if (IS_ERR(dent)) 1547 goto fail; 1548 prof_dir(profile) = dir = dent; 1549 1550 dent = create_profile_file(dir, "name", profile, 1551 &seq_profile_name_fops); 1552 if (IS_ERR(dent)) 1553 goto fail; 1554 profile->dents[AAFS_PROF_NAME] = dent; 1555 1556 dent = create_profile_file(dir, "mode", profile, 1557 &seq_profile_mode_fops); 1558 if (IS_ERR(dent)) 1559 goto fail; 1560 profile->dents[AAFS_PROF_MODE] = dent; 1561 1562 dent = create_profile_file(dir, "attach", profile, 1563 &seq_profile_attach_fops); 1564 if (IS_ERR(dent)) 1565 goto fail; 1566 profile->dents[AAFS_PROF_ATTACH] = dent; 1567 1568 if (profile->hash) { 1569 dent = create_profile_file(dir, "sha1", profile, 1570 &seq_profile_hash_fops); 1571 if (IS_ERR(dent)) 1572 goto fail; 1573 profile->dents[AAFS_PROF_HASH] = dent; 1574 } 1575 1576 if (profile->rawdata) { 1577 char target[64]; 1578 int depth = profile_depth(profile); 1579 1580 error = gen_symlink_name(target, sizeof(target), depth, 1581 profile->rawdata->name, "sha1"); 1582 if (error < 0) 1583 goto fail2; 1584 dent = aafs_create_symlink("raw_sha1", dir, target, NULL); 1585 if (IS_ERR(dent)) 1586 goto fail; 1587 profile->dents[AAFS_PROF_RAW_HASH] = dent; 1588 1589 error = gen_symlink_name(target, sizeof(target), depth, 1590 profile->rawdata->name, "abi"); 1591 if (error < 0) 1592 goto fail2; 1593 dent = aafs_create_symlink("raw_abi", dir, target, NULL); 1594 if (IS_ERR(dent)) 1595 goto fail; 1596 profile->dents[AAFS_PROF_RAW_ABI] = dent; 1597 1598 error = gen_symlink_name(target, sizeof(target), depth, 1599 profile->rawdata->name, "raw_data"); 1600 if (error < 0) 1601 goto fail2; 1602 dent = aafs_create_symlink("raw_data", dir, target, NULL); 1603 if (IS_ERR(dent)) 1604 goto fail; 1605 profile->dents[AAFS_PROF_RAW_DATA] = dent; 1606 } 1607 1608 list_for_each_entry(child, &profile->base.profiles, base.list) { 1609 error = __aafs_profile_mkdir(child, prof_child_dir(profile)); 1610 if (error) 1611 goto fail2; 1612 } 1613 1614 return 0; 1615 1616 fail: 1617 error = PTR_ERR(dent); 1618 1619 fail2: 1620 __aafs_profile_rmdir(profile); 1621 1622 return error; 1623 } 1624 1625 static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode) 1626 { 1627 struct aa_ns *ns, *parent; 1628 /* TODO: improve permission check */ 1629 struct aa_label *label; 1630 int error; 1631 1632 label = begin_current_label_crit_section(); 1633 error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY); 1634 end_current_label_crit_section(label); 1635 if (error) 1636 return error; 1637 1638 parent = aa_get_ns(dir->i_private); 1639 AA_BUG(d_inode(ns_subns_dir(parent)) != dir); 1640 1641 /* we have to unlock and then relock to get locking order right 1642 * for pin_fs 1643 */ 1644 inode_unlock(dir); 1645 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count); 1646 mutex_lock(&parent->lock); 1647 inode_lock_nested(dir, I_MUTEX_PARENT); 1648 if (error) 1649 goto out; 1650 1651 error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR, NULL, 1652 NULL, NULL, NULL); 1653 if (error) 1654 goto out_pin; 1655 1656 ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name), 1657 dentry); 1658 if (IS_ERR(ns)) { 1659 error = PTR_ERR(ns); 1660 ns = NULL; 1661 } 1662 1663 aa_put_ns(ns); /* list ref remains */ 1664 out_pin: 1665 if (error) 1666 simple_release_fs(&aafs_mnt, &aafs_count); 1667 out: 1668 mutex_unlock(&parent->lock); 1669 aa_put_ns(parent); 1670 1671 return error; 1672 } 1673 1674 static int ns_rmdir_op(struct inode *dir, struct dentry *dentry) 1675 { 1676 struct aa_ns *ns, *parent; 1677 /* TODO: improve permission check */ 1678 struct aa_label *label; 1679 int error; 1680 1681 label = begin_current_label_crit_section(); 1682 error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY); 1683 end_current_label_crit_section(label); 1684 if (error) 1685 return error; 1686 1687 parent = aa_get_ns(dir->i_private); 1688 /* rmdir calls the generic securityfs functions to remove files 1689 * from the apparmor dir. It is up to the apparmor ns locking 1690 * to avoid races. 1691 */ 1692 inode_unlock(dir); 1693 inode_unlock(dentry->d_inode); 1694 1695 mutex_lock(&parent->lock); 1696 ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name, 1697 dentry->d_name.len)); 1698 if (!ns) { 1699 error = -ENOENT; 1700 goto out; 1701 } 1702 AA_BUG(ns_dir(ns) != dentry); 1703 1704 __aa_remove_ns(ns); 1705 aa_put_ns(ns); 1706 1707 out: 1708 mutex_unlock(&parent->lock); 1709 inode_lock_nested(dir, I_MUTEX_PARENT); 1710 inode_lock(dentry->d_inode); 1711 aa_put_ns(parent); 1712 1713 return error; 1714 } 1715 1716 static const struct inode_operations ns_dir_inode_operations = { 1717 .lookup = simple_lookup, 1718 .mkdir = ns_mkdir_op, 1719 .rmdir = ns_rmdir_op, 1720 }; 1721 1722 static void __aa_fs_list_remove_rawdata(struct aa_ns *ns) 1723 { 1724 struct aa_loaddata *ent, *tmp; 1725 1726 AA_BUG(!mutex_is_locked(&ns->lock)); 1727 1728 list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list) 1729 __aa_fs_remove_rawdata(ent); 1730 } 1731 1732 /** 1733 * 1734 * Requires: @ns->lock held 1735 */ 1736 void __aafs_ns_rmdir(struct aa_ns *ns) 1737 { 1738 struct aa_ns *sub; 1739 struct aa_profile *child; 1740 int i; 1741 1742 if (!ns) 1743 return; 1744 AA_BUG(!mutex_is_locked(&ns->lock)); 1745 1746 list_for_each_entry(child, &ns->base.profiles, base.list) 1747 __aafs_profile_rmdir(child); 1748 1749 list_for_each_entry(sub, &ns->sub_ns, base.list) { 1750 mutex_lock(&sub->lock); 1751 __aafs_ns_rmdir(sub); 1752 mutex_unlock(&sub->lock); 1753 } 1754 1755 __aa_fs_list_remove_rawdata(ns); 1756 1757 if (ns_subns_dir(ns)) { 1758 sub = d_inode(ns_subns_dir(ns))->i_private; 1759 aa_put_ns(sub); 1760 } 1761 if (ns_subload(ns)) { 1762 sub = d_inode(ns_subload(ns))->i_private; 1763 aa_put_ns(sub); 1764 } 1765 if (ns_subreplace(ns)) { 1766 sub = d_inode(ns_subreplace(ns))->i_private; 1767 aa_put_ns(sub); 1768 } 1769 if (ns_subremove(ns)) { 1770 sub = d_inode(ns_subremove(ns))->i_private; 1771 aa_put_ns(sub); 1772 } 1773 if (ns_subrevision(ns)) { 1774 sub = d_inode(ns_subrevision(ns))->i_private; 1775 aa_put_ns(sub); 1776 } 1777 1778 for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) { 1779 aafs_remove(ns->dents[i]); 1780 ns->dents[i] = NULL; 1781 } 1782 } 1783 1784 /* assumes cleanup in caller */ 1785 static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir) 1786 { 1787 struct dentry *dent; 1788 1789 AA_BUG(!ns); 1790 AA_BUG(!dir); 1791 1792 dent = aafs_create_dir("profiles", dir); 1793 if (IS_ERR(dent)) 1794 return PTR_ERR(dent); 1795 ns_subprofs_dir(ns) = dent; 1796 1797 dent = aafs_create_dir("raw_data", dir); 1798 if (IS_ERR(dent)) 1799 return PTR_ERR(dent); 1800 ns_subdata_dir(ns) = dent; 1801 1802 dent = aafs_create_file("revision", 0444, dir, ns, 1803 &aa_fs_ns_revision_fops); 1804 if (IS_ERR(dent)) 1805 return PTR_ERR(dent); 1806 aa_get_ns(ns); 1807 ns_subrevision(ns) = dent; 1808 1809 dent = aafs_create_file(".load", 0640, dir, ns, 1810 &aa_fs_profile_load); 1811 if (IS_ERR(dent)) 1812 return PTR_ERR(dent); 1813 aa_get_ns(ns); 1814 ns_subload(ns) = dent; 1815 1816 dent = aafs_create_file(".replace", 0640, dir, ns, 1817 &aa_fs_profile_replace); 1818 if (IS_ERR(dent)) 1819 return PTR_ERR(dent); 1820 aa_get_ns(ns); 1821 ns_subreplace(ns) = dent; 1822 1823 dent = aafs_create_file(".remove", 0640, dir, ns, 1824 &aa_fs_profile_remove); 1825 if (IS_ERR(dent)) 1826 return PTR_ERR(dent); 1827 aa_get_ns(ns); 1828 ns_subremove(ns) = dent; 1829 1830 /* use create_dentry so we can supply private data */ 1831 dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL, 1832 &ns_dir_inode_operations); 1833 if (IS_ERR(dent)) 1834 return PTR_ERR(dent); 1835 aa_get_ns(ns); 1836 ns_subns_dir(ns) = dent; 1837 1838 return 0; 1839 } 1840 1841 /* 1842 * Requires: @ns->lock held 1843 */ 1844 int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name, 1845 struct dentry *dent) 1846 { 1847 struct aa_ns *sub; 1848 struct aa_profile *child; 1849 struct dentry *dir; 1850 int error; 1851 1852 AA_BUG(!ns); 1853 AA_BUG(!parent); 1854 AA_BUG(!mutex_is_locked(&ns->lock)); 1855 1856 if (!name) 1857 name = ns->base.name; 1858 1859 if (!dent) { 1860 /* create ns dir if it doesn't already exist */ 1861 dent = aafs_create_dir(name, parent); 1862 if (IS_ERR(dent)) 1863 goto fail; 1864 } else 1865 dget(dent); 1866 ns_dir(ns) = dir = dent; 1867 error = __aafs_ns_mkdir_entries(ns, dir); 1868 if (error) 1869 goto fail2; 1870 1871 /* profiles */ 1872 list_for_each_entry(child, &ns->base.profiles, base.list) { 1873 error = __aafs_profile_mkdir(child, ns_subprofs_dir(ns)); 1874 if (error) 1875 goto fail2; 1876 } 1877 1878 /* subnamespaces */ 1879 list_for_each_entry(sub, &ns->sub_ns, base.list) { 1880 mutex_lock(&sub->lock); 1881 error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL); 1882 mutex_unlock(&sub->lock); 1883 if (error) 1884 goto fail2; 1885 } 1886 1887 return 0; 1888 1889 fail: 1890 error = PTR_ERR(dent); 1891 1892 fail2: 1893 __aafs_ns_rmdir(ns); 1894 1895 return error; 1896 } 1897 1898 1899 #define list_entry_is_head(pos, head, member) (&pos->member == (head)) 1900 1901 /** 1902 * __next_ns - find the next namespace to list 1903 * @root: root namespace to stop search at (NOT NULL) 1904 * @ns: current ns position (NOT NULL) 1905 * 1906 * Find the next namespace from @ns under @root and handle all locking needed 1907 * while switching current namespace. 1908 * 1909 * Returns: next namespace or NULL if at last namespace under @root 1910 * Requires: ns->parent->lock to be held 1911 * NOTE: will not unlock root->lock 1912 */ 1913 static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns) 1914 { 1915 struct aa_ns *parent, *next; 1916 1917 AA_BUG(!root); 1918 AA_BUG(!ns); 1919 AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock)); 1920 1921 /* is next namespace a child */ 1922 if (!list_empty(&ns->sub_ns)) { 1923 next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list); 1924 mutex_lock(&next->lock); 1925 return next; 1926 } 1927 1928 /* check if the next ns is a sibling, parent, gp, .. */ 1929 parent = ns->parent; 1930 while (ns != root) { 1931 mutex_unlock(&ns->lock); 1932 next = list_next_entry(ns, base.list); 1933 if (!list_entry_is_head(next, &parent->sub_ns, base.list)) { 1934 mutex_lock(&next->lock); 1935 return next; 1936 } 1937 ns = parent; 1938 parent = parent->parent; 1939 } 1940 1941 return NULL; 1942 } 1943 1944 /** 1945 * __first_profile - find the first profile in a namespace 1946 * @root: namespace that is root of profiles being displayed (NOT NULL) 1947 * @ns: namespace to start in (NOT NULL) 1948 * 1949 * Returns: unrefcounted profile or NULL if no profile 1950 * Requires: profile->ns.lock to be held 1951 */ 1952 static struct aa_profile *__first_profile(struct aa_ns *root, 1953 struct aa_ns *ns) 1954 { 1955 AA_BUG(!root); 1956 AA_BUG(ns && !mutex_is_locked(&ns->lock)); 1957 1958 for (; ns; ns = __next_ns(root, ns)) { 1959 if (!list_empty(&ns->base.profiles)) 1960 return list_first_entry(&ns->base.profiles, 1961 struct aa_profile, base.list); 1962 } 1963 return NULL; 1964 } 1965 1966 /** 1967 * __next_profile - step to the next profile in a profile tree 1968 * @profile: current profile in tree (NOT NULL) 1969 * 1970 * Perform a depth first traversal on the profile tree in a namespace 1971 * 1972 * Returns: next profile or NULL if done 1973 * Requires: profile->ns.lock to be held 1974 */ 1975 static struct aa_profile *__next_profile(struct aa_profile *p) 1976 { 1977 struct aa_profile *parent; 1978 struct aa_ns *ns = p->ns; 1979 1980 AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock)); 1981 1982 /* is next profile a child */ 1983 if (!list_empty(&p->base.profiles)) 1984 return list_first_entry(&p->base.profiles, typeof(*p), 1985 base.list); 1986 1987 /* is next profile a sibling, parent sibling, gp, sibling, .. */ 1988 parent = rcu_dereference_protected(p->parent, 1989 mutex_is_locked(&p->ns->lock)); 1990 while (parent) { 1991 p = list_next_entry(p, base.list); 1992 if (!list_entry_is_head(p, &parent->base.profiles, base.list)) 1993 return p; 1994 p = parent; 1995 parent = rcu_dereference_protected(parent->parent, 1996 mutex_is_locked(&parent->ns->lock)); 1997 } 1998 1999 /* is next another profile in the namespace */ 2000 p = list_next_entry(p, base.list); 2001 if (!list_entry_is_head(p, &ns->base.profiles, base.list)) 2002 return p; 2003 2004 return NULL; 2005 } 2006 2007 /** 2008 * next_profile - step to the next profile in where ever it may be 2009 * @root: root namespace (NOT NULL) 2010 * @profile: current profile (NOT NULL) 2011 * 2012 * Returns: next profile or NULL if there isn't one 2013 */ 2014 static struct aa_profile *next_profile(struct aa_ns *root, 2015 struct aa_profile *profile) 2016 { 2017 struct aa_profile *next = __next_profile(profile); 2018 if (next) 2019 return next; 2020 2021 /* finished all profiles in namespace move to next namespace */ 2022 return __first_profile(root, __next_ns(root, profile->ns)); 2023 } 2024 2025 /** 2026 * p_start - start a depth first traversal of profile tree 2027 * @f: seq_file to fill 2028 * @pos: current position 2029 * 2030 * Returns: first profile under current namespace or NULL if none found 2031 * 2032 * acquires first ns->lock 2033 */ 2034 static void *p_start(struct seq_file *f, loff_t *pos) 2035 { 2036 struct aa_profile *profile = NULL; 2037 struct aa_ns *root = aa_get_current_ns(); 2038 loff_t l = *pos; 2039 f->private = root; 2040 2041 /* find the first profile */ 2042 mutex_lock(&root->lock); 2043 profile = __first_profile(root, root); 2044 2045 /* skip to position */ 2046 for (; profile && l > 0; l--) 2047 profile = next_profile(root, profile); 2048 2049 return profile; 2050 } 2051 2052 /** 2053 * p_next - read the next profile entry 2054 * @f: seq_file to fill 2055 * @p: profile previously returned 2056 * @pos: current position 2057 * 2058 * Returns: next profile after @p or NULL if none 2059 * 2060 * may acquire/release locks in namespace tree as necessary 2061 */ 2062 static void *p_next(struct seq_file *f, void *p, loff_t *pos) 2063 { 2064 struct aa_profile *profile = p; 2065 struct aa_ns *ns = f->private; 2066 (*pos)++; 2067 2068 return next_profile(ns, profile); 2069 } 2070 2071 /** 2072 * p_stop - stop depth first traversal 2073 * @f: seq_file we are filling 2074 * @p: the last profile writen 2075 * 2076 * Release all locking done by p_start/p_next on namespace tree 2077 */ 2078 static void p_stop(struct seq_file *f, void *p) 2079 { 2080 struct aa_profile *profile = p; 2081 struct aa_ns *root = f->private, *ns; 2082 2083 if (profile) { 2084 for (ns = profile->ns; ns && ns != root; ns = ns->parent) 2085 mutex_unlock(&ns->lock); 2086 } 2087 mutex_unlock(&root->lock); 2088 aa_put_ns(root); 2089 } 2090 2091 /** 2092 * seq_show_profile - show a profile entry 2093 * @f: seq_file to file 2094 * @p: current position (profile) (NOT NULL) 2095 * 2096 * Returns: error on failure 2097 */ 2098 static int seq_show_profile(struct seq_file *f, void *p) 2099 { 2100 struct aa_profile *profile = (struct aa_profile *)p; 2101 struct aa_ns *root = f->private; 2102 2103 aa_label_seq_xprint(f, root, &profile->label, 2104 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL); 2105 seq_putc(f, '\n'); 2106 2107 return 0; 2108 } 2109 2110 static const struct seq_operations aa_sfs_profiles_op = { 2111 .start = p_start, 2112 .next = p_next, 2113 .stop = p_stop, 2114 .show = seq_show_profile, 2115 }; 2116 2117 static int profiles_open(struct inode *inode, struct file *file) 2118 { 2119 if (!policy_view_capable(NULL)) 2120 return -EACCES; 2121 2122 return seq_open(file, &aa_sfs_profiles_op); 2123 } 2124 2125 static int profiles_release(struct inode *inode, struct file *file) 2126 { 2127 return seq_release(inode, file); 2128 } 2129 2130 static const struct file_operations aa_sfs_profiles_fops = { 2131 .open = profiles_open, 2132 .read = seq_read, 2133 .llseek = seq_lseek, 2134 .release = profiles_release, 2135 }; 2136 2137 2138 /** Base file system setup **/ 2139 static struct aa_sfs_entry aa_sfs_entry_file[] = { 2140 AA_SFS_FILE_STRING("mask", 2141 "create read write exec append mmap_exec link lock"), 2142 { } 2143 }; 2144 2145 static struct aa_sfs_entry aa_sfs_entry_ptrace[] = { 2146 AA_SFS_FILE_STRING("mask", "read trace"), 2147 { } 2148 }; 2149 2150 static struct aa_sfs_entry aa_sfs_entry_signal[] = { 2151 AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK), 2152 { } 2153 }; 2154 2155 static struct aa_sfs_entry aa_sfs_entry_domain[] = { 2156 AA_SFS_FILE_BOOLEAN("change_hat", 1), 2157 AA_SFS_FILE_BOOLEAN("change_hatv", 1), 2158 AA_SFS_FILE_BOOLEAN("change_onexec", 1), 2159 AA_SFS_FILE_BOOLEAN("change_profile", 1), 2160 AA_SFS_FILE_BOOLEAN("stack", 1), 2161 AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap", 1), 2162 AA_SFS_FILE_STRING("version", "1.2"), 2163 { } 2164 }; 2165 2166 static struct aa_sfs_entry aa_sfs_entry_versions[] = { 2167 AA_SFS_FILE_BOOLEAN("v5", 1), 2168 AA_SFS_FILE_BOOLEAN("v6", 1), 2169 AA_SFS_FILE_BOOLEAN("v7", 1), 2170 { } 2171 }; 2172 2173 static struct aa_sfs_entry aa_sfs_entry_policy[] = { 2174 AA_SFS_DIR("versions", aa_sfs_entry_versions), 2175 AA_SFS_FILE_BOOLEAN("set_load", 1), 2176 { } 2177 }; 2178 2179 static struct aa_sfs_entry aa_sfs_entry_mount[] = { 2180 AA_SFS_FILE_STRING("mask", "mount umount pivot_root"), 2181 { } 2182 }; 2183 2184 static struct aa_sfs_entry aa_sfs_entry_ns[] = { 2185 AA_SFS_FILE_BOOLEAN("profile", 1), 2186 AA_SFS_FILE_BOOLEAN("pivot_root", 0), 2187 { } 2188 }; 2189 2190 static struct aa_sfs_entry aa_sfs_entry_query_label[] = { 2191 AA_SFS_FILE_STRING("perms", "allow deny audit quiet"), 2192 AA_SFS_FILE_BOOLEAN("data", 1), 2193 AA_SFS_FILE_BOOLEAN("multi_transaction", 1), 2194 { } 2195 }; 2196 2197 static struct aa_sfs_entry aa_sfs_entry_query[] = { 2198 AA_SFS_DIR("label", aa_sfs_entry_query_label), 2199 { } 2200 }; 2201 static struct aa_sfs_entry aa_sfs_entry_features[] = { 2202 AA_SFS_DIR("policy", aa_sfs_entry_policy), 2203 AA_SFS_DIR("domain", aa_sfs_entry_domain), 2204 AA_SFS_DIR("file", aa_sfs_entry_file), 2205 AA_SFS_DIR("network", aa_sfs_entry_network), 2206 AA_SFS_DIR("mount", aa_sfs_entry_mount), 2207 AA_SFS_DIR("namespaces", aa_sfs_entry_ns), 2208 AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), 2209 AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit), 2210 AA_SFS_DIR("caps", aa_sfs_entry_caps), 2211 AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace), 2212 AA_SFS_DIR("signal", aa_sfs_entry_signal), 2213 AA_SFS_DIR("query", aa_sfs_entry_query), 2214 { } 2215 }; 2216 2217 static struct aa_sfs_entry aa_sfs_entry_apparmor[] = { 2218 AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access), 2219 AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops), 2220 AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops), 2221 AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops), 2222 AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops), 2223 AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops), 2224 AA_SFS_DIR("features", aa_sfs_entry_features), 2225 { } 2226 }; 2227 2228 static struct aa_sfs_entry aa_sfs_entry = 2229 AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor); 2230 2231 /** 2232 * entry_create_file - create a file entry in the apparmor securityfs 2233 * @fs_file: aa_sfs_entry to build an entry for (NOT NULL) 2234 * @parent: the parent dentry in the securityfs 2235 * 2236 * Use entry_remove_file to remove entries created with this fn. 2237 */ 2238 static int __init entry_create_file(struct aa_sfs_entry *fs_file, 2239 struct dentry *parent) 2240 { 2241 int error = 0; 2242 2243 fs_file->dentry = securityfs_create_file(fs_file->name, 2244 S_IFREG | fs_file->mode, 2245 parent, fs_file, 2246 fs_file->file_ops); 2247 if (IS_ERR(fs_file->dentry)) { 2248 error = PTR_ERR(fs_file->dentry); 2249 fs_file->dentry = NULL; 2250 } 2251 return error; 2252 } 2253 2254 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir); 2255 /** 2256 * entry_create_dir - recursively create a directory entry in the securityfs 2257 * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL) 2258 * @parent: the parent dentry in the securityfs 2259 * 2260 * Use entry_remove_dir to remove entries created with this fn. 2261 */ 2262 static int __init entry_create_dir(struct aa_sfs_entry *fs_dir, 2263 struct dentry *parent) 2264 { 2265 struct aa_sfs_entry *fs_file; 2266 struct dentry *dir; 2267 int error; 2268 2269 dir = securityfs_create_dir(fs_dir->name, parent); 2270 if (IS_ERR(dir)) 2271 return PTR_ERR(dir); 2272 fs_dir->dentry = dir; 2273 2274 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) { 2275 if (fs_file->v_type == AA_SFS_TYPE_DIR) 2276 error = entry_create_dir(fs_file, fs_dir->dentry); 2277 else 2278 error = entry_create_file(fs_file, fs_dir->dentry); 2279 if (error) 2280 goto failed; 2281 } 2282 2283 return 0; 2284 2285 failed: 2286 entry_remove_dir(fs_dir); 2287 2288 return error; 2289 } 2290 2291 /** 2292 * entry_remove_file - drop a single file entry in the apparmor securityfs 2293 * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL) 2294 */ 2295 static void __init entry_remove_file(struct aa_sfs_entry *fs_file) 2296 { 2297 if (!fs_file->dentry) 2298 return; 2299 2300 securityfs_remove(fs_file->dentry); 2301 fs_file->dentry = NULL; 2302 } 2303 2304 /** 2305 * entry_remove_dir - recursively drop a directory entry from the securityfs 2306 * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL) 2307 */ 2308 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir) 2309 { 2310 struct aa_sfs_entry *fs_file; 2311 2312 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) { 2313 if (fs_file->v_type == AA_SFS_TYPE_DIR) 2314 entry_remove_dir(fs_file); 2315 else 2316 entry_remove_file(fs_file); 2317 } 2318 2319 entry_remove_file(fs_dir); 2320 } 2321 2322 /** 2323 * aa_destroy_aafs - cleanup and free aafs 2324 * 2325 * releases dentries allocated by aa_create_aafs 2326 */ 2327 void __init aa_destroy_aafs(void) 2328 { 2329 entry_remove_dir(&aa_sfs_entry); 2330 } 2331 2332 2333 #define NULL_FILE_NAME ".null" 2334 struct path aa_null; 2335 2336 static int aa_mk_null_file(struct dentry *parent) 2337 { 2338 struct vfsmount *mount = NULL; 2339 struct dentry *dentry; 2340 struct inode *inode; 2341 int count = 0; 2342 int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count); 2343 2344 if (error) 2345 return error; 2346 2347 inode_lock(d_inode(parent)); 2348 dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME)); 2349 if (IS_ERR(dentry)) { 2350 error = PTR_ERR(dentry); 2351 goto out; 2352 } 2353 inode = new_inode(parent->d_inode->i_sb); 2354 if (!inode) { 2355 error = -ENOMEM; 2356 goto out1; 2357 } 2358 2359 inode->i_ino = get_next_ino(); 2360 inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO; 2361 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode); 2362 init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, 2363 MKDEV(MEM_MAJOR, 3)); 2364 d_instantiate(dentry, inode); 2365 aa_null.dentry = dget(dentry); 2366 aa_null.mnt = mntget(mount); 2367 2368 error = 0; 2369 2370 out1: 2371 dput(dentry); 2372 out: 2373 inode_unlock(d_inode(parent)); 2374 simple_release_fs(&mount, &count); 2375 return error; 2376 } 2377 2378 2379 2380 static const char *policy_get_link(struct dentry *dentry, 2381 struct inode *inode, 2382 struct delayed_call *done) 2383 { 2384 struct aa_ns *ns; 2385 struct path path; 2386 2387 if (!dentry) 2388 return ERR_PTR(-ECHILD); 2389 ns = aa_get_current_ns(); 2390 path.mnt = mntget(aafs_mnt); 2391 path.dentry = dget(ns_dir(ns)); 2392 nd_jump_link(&path); 2393 aa_put_ns(ns); 2394 2395 return NULL; 2396 } 2397 2398 static int ns_get_name(char *buf, size_t size, struct aa_ns *ns, 2399 struct inode *inode) 2400 { 2401 int res = snprintf(buf, size, "%s:[%lu]", AAFS_NAME, inode->i_ino); 2402 2403 if (res < 0 || res >= size) 2404 res = -ENOENT; 2405 2406 return res; 2407 } 2408 2409 static int policy_readlink(struct dentry *dentry, char __user *buffer, 2410 int buflen) 2411 { 2412 struct aa_ns *ns; 2413 char name[32]; 2414 int res; 2415 2416 ns = aa_get_current_ns(); 2417 res = ns_get_name(name, sizeof(name), ns, d_inode(dentry)); 2418 if (res >= 0) 2419 res = readlink_copy(buffer, buflen, name); 2420 aa_put_ns(ns); 2421 2422 return res; 2423 } 2424 2425 static const struct inode_operations policy_link_iops = { 2426 .readlink = policy_readlink, 2427 .get_link = policy_get_link, 2428 }; 2429 2430 2431 /** 2432 * aa_create_aafs - create the apparmor security filesystem 2433 * 2434 * dentries created here are released by aa_destroy_aafs 2435 * 2436 * Returns: error on failure 2437 */ 2438 static int __init aa_create_aafs(void) 2439 { 2440 struct dentry *dent; 2441 int error; 2442 2443 if (!apparmor_initialized) 2444 return 0; 2445 2446 if (aa_sfs_entry.dentry) { 2447 AA_ERROR("%s: AppArmor securityfs already exists\n", __func__); 2448 return -EEXIST; 2449 } 2450 2451 /* setup apparmorfs used to virtualize policy/ */ 2452 aafs_mnt = kern_mount(&aafs_ops); 2453 if (IS_ERR(aafs_mnt)) 2454 panic("can't set apparmorfs up\n"); 2455 aafs_mnt->mnt_sb->s_flags &= ~MS_NOUSER; 2456 2457 /* Populate fs tree. */ 2458 error = entry_create_dir(&aa_sfs_entry, NULL); 2459 if (error) 2460 goto error; 2461 2462 dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry, 2463 NULL, &aa_fs_profile_load); 2464 if (IS_ERR(dent)) { 2465 error = PTR_ERR(dent); 2466 goto error; 2467 } 2468 ns_subload(root_ns) = dent; 2469 2470 dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry, 2471 NULL, &aa_fs_profile_replace); 2472 if (IS_ERR(dent)) { 2473 error = PTR_ERR(dent); 2474 goto error; 2475 } 2476 ns_subreplace(root_ns) = dent; 2477 2478 dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry, 2479 NULL, &aa_fs_profile_remove); 2480 if (IS_ERR(dent)) { 2481 error = PTR_ERR(dent); 2482 goto error; 2483 } 2484 ns_subremove(root_ns) = dent; 2485 2486 dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry, 2487 NULL, &aa_fs_ns_revision_fops); 2488 if (IS_ERR(dent)) { 2489 error = PTR_ERR(dent); 2490 goto error; 2491 } 2492 ns_subrevision(root_ns) = dent; 2493 2494 /* policy tree referenced by magic policy symlink */ 2495 mutex_lock(&root_ns->lock); 2496 error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy", 2497 aafs_mnt->mnt_root); 2498 mutex_unlock(&root_ns->lock); 2499 if (error) 2500 goto error; 2501 2502 /* magic symlink similar to nsfs redirects based on task policy */ 2503 dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry, 2504 NULL, &policy_link_iops); 2505 if (IS_ERR(dent)) { 2506 error = PTR_ERR(dent); 2507 goto error; 2508 } 2509 2510 error = aa_mk_null_file(aa_sfs_entry.dentry); 2511 if (error) 2512 goto error; 2513 2514 /* TODO: add default profile to apparmorfs */ 2515 2516 /* Report that AppArmor fs is enabled */ 2517 aa_info_message("AppArmor Filesystem Enabled"); 2518 return 0; 2519 2520 error: 2521 aa_destroy_aafs(); 2522 AA_ERROR("Error creating AppArmor securityfs\n"); 2523 return error; 2524 } 2525 2526 fs_initcall(aa_create_aafs); 2527