xref: /openbmc/linux/security/apparmor/domain.c (revision 8ee90c5c)
1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor policy attachment and domain transitions
5  *
6  * Copyright (C) 2002-2008 Novell/SUSE
7  * Copyright 2009-2010 Canonical Ltd.
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License as
11  * published by the Free Software Foundation, version 2 of the
12  * License.
13  */
14 
15 #include <linux/errno.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
18 #include <linux/mount.h>
19 #include <linux/syscalls.h>
20 #include <linux/tracehook.h>
21 #include <linux/personality.h>
22 
23 #include "include/audit.h"
24 #include "include/apparmorfs.h"
25 #include "include/context.h"
26 #include "include/domain.h"
27 #include "include/file.h"
28 #include "include/ipc.h"
29 #include "include/match.h"
30 #include "include/path.h"
31 #include "include/policy.h"
32 #include "include/policy_ns.h"
33 
34 /**
35  * aa_free_domain_entries - free entries in a domain table
36  * @domain: the domain table to free  (MAYBE NULL)
37  */
38 void aa_free_domain_entries(struct aa_domain *domain)
39 {
40 	int i;
41 	if (domain) {
42 		if (!domain->table)
43 			return;
44 
45 		for (i = 0; i < domain->size; i++)
46 			kzfree(domain->table[i]);
47 		kzfree(domain->table);
48 		domain->table = NULL;
49 	}
50 }
51 
52 /**
53  * may_change_ptraced_domain - check if can change profile on ptraced task
54  * @to_label: profile to change to  (NOT NULL)
55  * @info: message if there is an error
56  *
57  * Check if current is ptraced and if so if the tracing task is allowed
58  * to trace the new domain
59  *
60  * Returns: %0 or error if change not allowed
61  */
62 static int may_change_ptraced_domain(struct aa_label *to_label,
63 				     const char **info)
64 {
65 	struct task_struct *tracer;
66 	struct aa_label *tracerl = NULL;
67 	int error = 0;
68 
69 	rcu_read_lock();
70 	tracer = ptrace_parent(current);
71 	if (tracer)
72 		/* released below */
73 		tracerl = aa_get_task_label(tracer);
74 
75 	/* not ptraced */
76 	if (!tracer || unconfined(tracerl))
77 		goto out;
78 
79 	error = aa_may_ptrace(tracerl, to_label, PTRACE_MODE_ATTACH);
80 
81 out:
82 	rcu_read_unlock();
83 	aa_put_label(tracerl);
84 
85 	if (error)
86 		*info = "ptrace prevents transition";
87 	return error;
88 }
89 
90 /**** TODO: dedup to aa_label_match - needs perm and dfa, merging
91  * specifically this is an exact copy of aa_label_match except
92  * aa_compute_perms is replaced with aa_compute_fperms
93  * and policy.dfa with file.dfa
94  ****/
95 /* match a profile and its associated ns component if needed
96  * Assumes visibility test has already been done.
97  * If a subns profile is not to be matched should be prescreened with
98  * visibility test.
99  */
100 static inline unsigned int match_component(struct aa_profile *profile,
101 					   struct aa_profile *tp,
102 					   bool stack, unsigned int state)
103 {
104 	const char *ns_name;
105 
106 	if (stack)
107 		state = aa_dfa_match(profile->file.dfa, state, "&");
108 	if (profile->ns == tp->ns)
109 		return aa_dfa_match(profile->file.dfa, state, tp->base.hname);
110 
111 	/* try matching with namespace name and then profile */
112 	ns_name = aa_ns_name(profile->ns, tp->ns, true);
113 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);
114 	state = aa_dfa_match(profile->file.dfa, state, ns_name);
115 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);
116 	return aa_dfa_match(profile->file.dfa, state, tp->base.hname);
117 }
118 
119 /**
120  * label_compound_match - find perms for full compound label
121  * @profile: profile to find perms for
122  * @label: label to check access permissions for
123  * @stack: whether this is a stacking request
124  * @start: state to start match in
125  * @subns: whether to do permission checks on components in a subns
126  * @request: permissions to request
127  * @perms: perms struct to set
128  *
129  * Returns: 0 on success else ERROR
130  *
131  * For the label A//&B//&C this does the perm match for A//&B//&C
132  * @perms should be preinitialized with allperms OR a previous permission
133  *        check to be stacked.
134  */
135 static int label_compound_match(struct aa_profile *profile,
136 				struct aa_label *label, bool stack,
137 				unsigned int state, bool subns, u32 request,
138 				struct aa_perms *perms)
139 {
140 	struct aa_profile *tp;
141 	struct label_it i;
142 	struct path_cond cond = { };
143 
144 	/* find first subcomponent that is visible */
145 	label_for_each(i, label, tp) {
146 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
147 			continue;
148 		state = match_component(profile, tp, stack, state);
149 		if (!state)
150 			goto fail;
151 		goto next;
152 	}
153 
154 	/* no component visible */
155 	*perms = allperms;
156 	return 0;
157 
158 next:
159 	label_for_each_cont(i, label, tp) {
160 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
161 			continue;
162 		state = aa_dfa_match(profile->file.dfa, state, "//&");
163 		state = match_component(profile, tp, false, state);
164 		if (!state)
165 			goto fail;
166 	}
167 	*perms = aa_compute_fperms(profile->file.dfa, state, &cond);
168 	aa_apply_modes_to_perms(profile, perms);
169 	if ((perms->allow & request) != request)
170 		return -EACCES;
171 
172 	return 0;
173 
174 fail:
175 	*perms = nullperms;
176 	return -EACCES;
177 }
178 
179 /**
180  * label_components_match - find perms for all subcomponents of a label
181  * @profile: profile to find perms for
182  * @label: label to check access permissions for
183  * @stack: whether this is a stacking request
184  * @start: state to start match in
185  * @subns: whether to do permission checks on components in a subns
186  * @request: permissions to request
187  * @perms: an initialized perms struct to add accumulation to
188  *
189  * Returns: 0 on success else ERROR
190  *
191  * For the label A//&B//&C this does the perm match for each of A and B and C
192  * @perms should be preinitialized with allperms OR a previous permission
193  *        check to be stacked.
194  */
195 static int label_components_match(struct aa_profile *profile,
196 				  struct aa_label *label, bool stack,
197 				  unsigned int start, bool subns, u32 request,
198 				  struct aa_perms *perms)
199 {
200 	struct aa_profile *tp;
201 	struct label_it i;
202 	struct aa_perms tmp;
203 	struct path_cond cond = { };
204 	unsigned int state = 0;
205 
206 	/* find first subcomponent to test */
207 	label_for_each(i, label, tp) {
208 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
209 			continue;
210 		state = match_component(profile, tp, stack, start);
211 		if (!state)
212 			goto fail;
213 		goto next;
214 	}
215 
216 	/* no subcomponents visible - no change in perms */
217 	return 0;
218 
219 next:
220 	tmp = aa_compute_fperms(profile->file.dfa, state, &cond);
221 	aa_apply_modes_to_perms(profile, &tmp);
222 	aa_perms_accum(perms, &tmp);
223 	label_for_each_cont(i, label, tp) {
224 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
225 			continue;
226 		state = match_component(profile, tp, stack, start);
227 		if (!state)
228 			goto fail;
229 		tmp = aa_compute_fperms(profile->file.dfa, state, &cond);
230 		aa_apply_modes_to_perms(profile, &tmp);
231 		aa_perms_accum(perms, &tmp);
232 	}
233 
234 	if ((perms->allow & request) != request)
235 		return -EACCES;
236 
237 	return 0;
238 
239 fail:
240 	*perms = nullperms;
241 	return -EACCES;
242 }
243 
244 /**
245  * label_match - do a multi-component label match
246  * @profile: profile to match against (NOT NULL)
247  * @label: label to match (NOT NULL)
248  * @stack: whether this is a stacking request
249  * @state: state to start in
250  * @subns: whether to match subns components
251  * @request: permission request
252  * @perms: Returns computed perms (NOT NULL)
253  *
254  * Returns: the state the match finished in, may be the none matching state
255  */
256 static int label_match(struct aa_profile *profile, struct aa_label *label,
257 		       bool stack, unsigned int state, bool subns, u32 request,
258 		       struct aa_perms *perms)
259 {
260 	int error;
261 
262 	*perms = nullperms;
263 	error = label_compound_match(profile, label, stack, state, subns,
264 				     request, perms);
265 	if (!error)
266 		return error;
267 
268 	*perms = allperms;
269 	return label_components_match(profile, label, stack, state, subns,
270 				      request, perms);
271 }
272 
273 /******* end TODO: dedup *****/
274 
275 /**
276  * change_profile_perms - find permissions for change_profile
277  * @profile: the current profile  (NOT NULL)
278  * @target: label to transition to (NOT NULL)
279  * @stack: whether this is a stacking request
280  * @request: requested perms
281  * @start: state to start matching in
282  *
283  *
284  * Returns: permission set
285  *
286  * currently only matches full label A//&B//&C or individual components A, B, C
287  * not arbitrary combinations. Eg. A//&B, C
288  */
289 static int change_profile_perms(struct aa_profile *profile,
290 				struct aa_label *target, bool stack,
291 				u32 request, unsigned int start,
292 				struct aa_perms *perms)
293 {
294 	if (profile_unconfined(profile)) {
295 		perms->allow = AA_MAY_CHANGE_PROFILE | AA_MAY_ONEXEC;
296 		perms->audit = perms->quiet = perms->kill = 0;
297 		return 0;
298 	}
299 
300 	/* TODO: add profile in ns screening */
301 	return label_match(profile, target, stack, start, true, request, perms);
302 }
303 
304 /**
305  * __attach_match_ - find an attachment match
306  * @name - to match against  (NOT NULL)
307  * @head - profile list to walk  (NOT NULL)
308  *
309  * Do a linear search on the profiles in the list.  There is a matching
310  * preference where an exact match is preferred over a name which uses
311  * expressions to match, and matching expressions with the greatest
312  * xmatch_len are preferred.
313  *
314  * Requires: @head not be shared or have appropriate locks held
315  *
316  * Returns: profile or NULL if no match found
317  */
318 static struct aa_profile *__attach_match(const char *name,
319 					 struct list_head *head)
320 {
321 	int len = 0;
322 	struct aa_profile *profile, *candidate = NULL;
323 
324 	list_for_each_entry_rcu(profile, head, base.list) {
325 		if (profile->label.flags & FLAG_NULL)
326 			continue;
327 		if (profile->xmatch && profile->xmatch_len > len) {
328 			unsigned int state = aa_dfa_match(profile->xmatch,
329 							  DFA_START, name);
330 			u32 perm = dfa_user_allow(profile->xmatch, state);
331 			/* any accepting state means a valid match. */
332 			if (perm & MAY_EXEC) {
333 				candidate = profile;
334 				len = profile->xmatch_len;
335 			}
336 		} else if (!strcmp(profile->base.name, name))
337 			/* exact non-re match, no more searching required */
338 			return profile;
339 	}
340 
341 	return candidate;
342 }
343 
344 /**
345  * find_attach - do attachment search for unconfined processes
346  * @ns: the current namespace  (NOT NULL)
347  * @list: list to search  (NOT NULL)
348  * @name: the executable name to match against  (NOT NULL)
349  *
350  * Returns: label or NULL if no match found
351  */
352 static struct aa_label *find_attach(struct aa_ns *ns, struct list_head *list,
353 				    const char *name)
354 {
355 	struct aa_profile *profile;
356 
357 	rcu_read_lock();
358 	profile = aa_get_profile(__attach_match(name, list));
359 	rcu_read_unlock();
360 
361 	return profile ? &profile->label : NULL;
362 }
363 
364 static const char *next_name(int xtype, const char *name)
365 {
366 	return NULL;
367 }
368 
369 /**
370  * x_table_lookup - lookup an x transition name via transition table
371  * @profile: current profile (NOT NULL)
372  * @xindex: index into x transition table
373  * @name: returns: name tested to find label (NOT NULL)
374  *
375  * Returns: refcounted label, or NULL on failure (MAYBE NULL)
376  */
377 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
378 				const char **name)
379 {
380 	struct aa_label *label = NULL;
381 	u32 xtype = xindex & AA_X_TYPE_MASK;
382 	int index = xindex & AA_X_INDEX_MASK;
383 
384 	AA_BUG(!name);
385 
386 	/* index is guaranteed to be in range, validated at load time */
387 	/* TODO: move lookup parsing to unpack time so this is a straight
388 	 *       index into the resultant label
389 	 */
390 	for (*name = profile->file.trans.table[index]; !label && *name;
391 	     *name = next_name(xtype, *name)) {
392 		if (xindex & AA_X_CHILD) {
393 			struct aa_profile *new_profile;
394 			/* release by caller */
395 			new_profile = aa_find_child(profile, *name);
396 			if (new_profile)
397 				label = &new_profile->label;
398 			continue;
399 		}
400 		label = aa_label_parse(&profile->label, *name, GFP_ATOMIC,
401 				       true, false);
402 		if (IS_ERR(label))
403 			label = NULL;
404 	}
405 
406 	/* released by caller */
407 
408 	return label;
409 }
410 
411 /**
412  * x_to_label - get target label for a given xindex
413  * @profile: current profile  (NOT NULL)
414  * @name: name to lookup (NOT NULL)
415  * @xindex: index into x transition table
416  * @lookupname: returns: name used in lookup if one was specified (NOT NULL)
417  *
418  * find label for a transition index
419  *
420  * Returns: refcounted label or NULL if not found available
421  */
422 static struct aa_label *x_to_label(struct aa_profile *profile,
423 				   const char *name, u32 xindex,
424 				   const char **lookupname,
425 				   const char **info)
426 {
427 	struct aa_label *new = NULL;
428 	struct aa_ns *ns = profile->ns;
429 	u32 xtype = xindex & AA_X_TYPE_MASK;
430 	const char *stack = NULL;
431 
432 	switch (xtype) {
433 	case AA_X_NONE:
434 		/* fail exec unless ix || ux fallback - handled by caller */
435 		*lookupname = NULL;
436 		break;
437 	case AA_X_TABLE:
438 		/* TODO: fix when perm mapping done at unload */
439 		stack = profile->file.trans.table[xindex & AA_X_INDEX_MASK];
440 		if (*stack != '&') {
441 			/* released by caller */
442 			new = x_table_lookup(profile, xindex, lookupname);
443 			stack = NULL;
444 			break;
445 		}
446 		/* fall through to X_NAME */
447 	case AA_X_NAME:
448 		if (xindex & AA_X_CHILD)
449 			/* released by caller */
450 			new = find_attach(ns, &profile->base.profiles,
451 						name);
452 		else
453 			/* released by caller */
454 			new = find_attach(ns, &ns->base.profiles,
455 						name);
456 		*lookupname = name;
457 		break;
458 	}
459 
460 	if (!new) {
461 		if (xindex & AA_X_INHERIT) {
462 			/* (p|c|n)ix - don't change profile but do
463 			 * use the newest version
464 			 */
465 			*info = "ix fallback";
466 			/* no profile && no error */
467 			new = aa_get_newest_label(&profile->label);
468 		} else if (xindex & AA_X_UNCONFINED) {
469 			new = aa_get_newest_label(ns_unconfined(profile->ns));
470 			*info = "ux fallback";
471 		}
472 	}
473 
474 	if (new && stack) {
475 		/* base the stack on post domain transition */
476 		struct aa_label *base = new;
477 
478 		new = aa_label_parse(base, stack, GFP_ATOMIC, true, false);
479 		if (IS_ERR(new))
480 			new = NULL;
481 		aa_put_label(base);
482 	}
483 
484 	/* released by caller */
485 	return new;
486 }
487 
488 static struct aa_label *profile_transition(struct aa_profile *profile,
489 					   const struct linux_binprm *bprm,
490 					   char *buffer, struct path_cond *cond,
491 					   bool *secure_exec)
492 {
493 	struct aa_label *new = NULL;
494 	const char *info = NULL, *name = NULL, *target = NULL;
495 	unsigned int state = profile->file.start;
496 	struct aa_perms perms = {};
497 	bool nonewprivs = false;
498 	int error = 0;
499 
500 	AA_BUG(!profile);
501 	AA_BUG(!bprm);
502 	AA_BUG(!buffer);
503 
504 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
505 			     &name, &info, profile->disconnected);
506 	if (error) {
507 		if (profile_unconfined(profile) ||
508 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
509 			AA_DEBUG("name lookup ix on error");
510 			error = 0;
511 			new = aa_get_newest_label(&profile->label);
512 		}
513 		name = bprm->filename;
514 		goto audit;
515 	}
516 
517 	if (profile_unconfined(profile)) {
518 		new = find_attach(profile->ns, &profile->ns->base.profiles,
519 				  name);
520 		if (new) {
521 			AA_DEBUG("unconfined attached to new label");
522 			return new;
523 		}
524 		AA_DEBUG("unconfined exec no attachment");
525 		return aa_get_newest_label(&profile->label);
526 	}
527 
528 	/* find exec permissions for name */
529 	state = aa_str_perms(profile->file.dfa, state, name, cond, &perms);
530 	if (perms.allow & MAY_EXEC) {
531 		/* exec permission determine how to transition */
532 		new = x_to_label(profile, name, perms.xindex, &target, &info);
533 		if (new && new->proxy == profile->label.proxy && info) {
534 			/* hack ix fallback - improve how this is detected */
535 			goto audit;
536 		} else if (!new) {
537 			error = -EACCES;
538 			info = "profile transition not found";
539 			/* remove MAY_EXEC to audit as failure */
540 			perms.allow &= ~MAY_EXEC;
541 		}
542 	} else if (COMPLAIN_MODE(profile)) {
543 		/* no exec permission - learning mode */
544 		struct aa_profile *new_profile = aa_new_null_profile(profile,
545 							      false, name,
546 							      GFP_ATOMIC);
547 		if (!new_profile) {
548 			error = -ENOMEM;
549 			info = "could not create null profile";
550 		} else {
551 			error = -EACCES;
552 			new = &new_profile->label;
553 		}
554 		perms.xindex |= AA_X_UNSAFE;
555 	} else
556 		/* fail exec */
557 		error = -EACCES;
558 
559 	if (!new)
560 		goto audit;
561 
562 	/* Policy has specified a domain transitions. if no_new_privs and
563 	 * confined and not transitioning to the current domain fail.
564 	 *
565 	 * NOTE: Domain transitions from unconfined and to stritly stacked
566 	 * subsets are allowed even when no_new_privs is set because this
567 	 * aways results in a further reduction of permissions.
568 	 */
569 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) &&
570 	    !profile_unconfined(profile) &&
571 	    !aa_label_is_subset(new, &profile->label)) {
572 		error = -EPERM;
573 		info = "no new privs";
574 		nonewprivs = true;
575 		perms.allow &= ~MAY_EXEC;
576 		goto audit;
577 	}
578 
579 	if (!(perms.xindex & AA_X_UNSAFE)) {
580 		if (DEBUG_ON) {
581 			dbg_printk("apparmor: scrubbing environment variables"
582 				   " for %s profile=", name);
583 			aa_label_printk(new, GFP_ATOMIC);
584 			dbg_printk("\n");
585 		}
586 		*secure_exec = true;
587 	}
588 
589 audit:
590 	aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name, target, new,
591 		      cond->uid, info, error);
592 	if (!new || nonewprivs) {
593 		aa_put_label(new);
594 		return ERR_PTR(error);
595 	}
596 
597 	return new;
598 }
599 
600 static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,
601 			  bool stack, const struct linux_binprm *bprm,
602 			  char *buffer, struct path_cond *cond,
603 			  bool *secure_exec)
604 {
605 	unsigned int state = profile->file.start;
606 	struct aa_perms perms = {};
607 	const char *xname = NULL, *info = "change_profile onexec";
608 	int error = -EACCES;
609 
610 	AA_BUG(!profile);
611 	AA_BUG(!onexec);
612 	AA_BUG(!bprm);
613 	AA_BUG(!buffer);
614 
615 	if (profile_unconfined(profile)) {
616 		/* change_profile on exec already granted */
617 		/*
618 		 * NOTE: Domain transitions from unconfined are allowed
619 		 * even when no_new_privs is set because this aways results
620 		 * in a further reduction of permissions.
621 		 */
622 		return 0;
623 	}
624 
625 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
626 			     &xname, &info, profile->disconnected);
627 	if (error) {
628 		if (profile_unconfined(profile) ||
629 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
630 			AA_DEBUG("name lookup ix on error");
631 			error = 0;
632 		}
633 		xname = bprm->filename;
634 		goto audit;
635 	}
636 
637 	/* find exec permissions for name */
638 	state = aa_str_perms(profile->file.dfa, state, xname, cond, &perms);
639 	if (!(perms.allow & AA_MAY_ONEXEC)) {
640 		info = "no change_onexec valid for executable";
641 		goto audit;
642 	}
643 	/* test if this exec can be paired with change_profile onexec.
644 	 * onexec permission is linked to exec with a standard pairing
645 	 * exec\0change_profile
646 	 */
647 	state = aa_dfa_null_transition(profile->file.dfa, state);
648 	error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC,
649 				     state, &perms);
650 	if (error) {
651 		perms.allow &= ~AA_MAY_ONEXEC;
652 		goto audit;
653 	}
654 	/* Policy has specified a domain transitions. if no_new_privs and
655 	 * confined and not transitioning to the current domain fail.
656 	 *
657 	 * NOTE: Domain transitions from unconfined and to stritly stacked
658 	 * subsets are allowed even when no_new_privs is set because this
659 	 * aways results in a further reduction of permissions.
660 	 */
661 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) &&
662 	    !profile_unconfined(profile) &&
663 	    !aa_label_is_subset(onexec, &profile->label)) {
664 		error = -EPERM;
665 		info = "no new privs";
666 		perms.allow &= ~AA_MAY_ONEXEC;
667 		goto audit;
668 	}
669 
670 	if (!(perms.xindex & AA_X_UNSAFE)) {
671 		if (DEBUG_ON) {
672 			dbg_printk("apparmor: scrubbing environment "
673 				   "variables for %s label=", xname);
674 			aa_label_printk(onexec, GFP_ATOMIC);
675 			dbg_printk("\n");
676 		}
677 		*secure_exec = true;
678 	}
679 
680 audit:
681 	return aa_audit_file(profile, &perms, OP_EXEC, AA_MAY_ONEXEC, xname,
682 			     NULL, onexec, cond->uid, info, error);
683 }
684 
685 /* ensure none ns domain transitions are correctly applied with onexec */
686 
687 static struct aa_label *handle_onexec(struct aa_label *label,
688 				      struct aa_label *onexec, bool stack,
689 				      const struct linux_binprm *bprm,
690 				      char *buffer, struct path_cond *cond,
691 				      bool *unsafe)
692 {
693 	struct aa_profile *profile;
694 	struct aa_label *new;
695 	int error;
696 
697 	AA_BUG(!label);
698 	AA_BUG(!onexec);
699 	AA_BUG(!bprm);
700 	AA_BUG(!buffer);
701 
702 	if (!stack) {
703 		error = fn_for_each_in_ns(label, profile,
704 				profile_onexec(profile, onexec, stack,
705 					       bprm, buffer, cond, unsafe));
706 		if (error)
707 			return ERR_PTR(error);
708 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,
709 				aa_get_newest_label(onexec),
710 				profile_transition(profile, bprm, buffer,
711 						   cond, unsafe));
712 
713 	} else {
714 		/* TODO: determine how much we want to losen this */
715 		error = fn_for_each_in_ns(label, profile,
716 				profile_onexec(profile, onexec, stack, bprm,
717 					       buffer, cond, unsafe));
718 		if (error)
719 			return ERR_PTR(error);
720 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,
721 				aa_label_merge(&profile->label, onexec,
722 					       GFP_ATOMIC),
723 				profile_transition(profile, bprm, buffer,
724 						   cond, unsafe));
725 	}
726 
727 	if (new)
728 		return new;
729 
730 	/* TODO: get rid of GLOBAL_ROOT_UID */
731 	error = fn_for_each_in_ns(label, profile,
732 			aa_audit_file(profile, &nullperms, OP_CHANGE_ONEXEC,
733 				      AA_MAY_ONEXEC, bprm->filename, NULL,
734 				      onexec, GLOBAL_ROOT_UID,
735 				      "failed to build target label", -ENOMEM));
736 	return ERR_PTR(error);
737 }
738 
739 /**
740  * apparmor_bprm_set_creds - set the new creds on the bprm struct
741  * @bprm: binprm for the exec  (NOT NULL)
742  *
743  * Returns: %0 or error on failure
744  *
745  * TODO: once the other paths are done see if we can't refactor into a fn
746  */
747 int apparmor_bprm_set_creds(struct linux_binprm *bprm)
748 {
749 	struct aa_task_ctx *ctx;
750 	struct aa_label *label, *new = NULL;
751 	struct aa_profile *profile;
752 	char *buffer = NULL;
753 	const char *info = NULL;
754 	int error = 0;
755 	bool unsafe = false;
756 	struct path_cond cond = {
757 		file_inode(bprm->file)->i_uid,
758 		file_inode(bprm->file)->i_mode
759 	};
760 
761 	if (bprm->called_set_creds)
762 		return 0;
763 
764 	ctx = cred_ctx(bprm->cred);
765 	AA_BUG(!ctx);
766 
767 	label = aa_get_newest_label(ctx->label);
768 
769 	/* buffer freed below, name is pointer into buffer */
770 	get_buffers(buffer);
771 	/* Test for onexec first as onexec override other x transitions. */
772 	if (ctx->onexec)
773 		new = handle_onexec(label, ctx->onexec, ctx->token,
774 				    bprm, buffer, &cond, &unsafe);
775 	else
776 		new = fn_label_build(label, profile, GFP_ATOMIC,
777 				profile_transition(profile, bprm, buffer,
778 						   &cond, &unsafe));
779 
780 	AA_BUG(!new);
781 	if (IS_ERR(new)) {
782 		error = PTR_ERR(new);
783 		goto done;
784 	} else if (!new) {
785 		error = -ENOMEM;
786 		goto done;
787 	}
788 
789 	/* TODO: Add ns level no_new_privs subset test */
790 
791 	if (bprm->unsafe & LSM_UNSAFE_SHARE) {
792 		/* FIXME: currently don't mediate shared state */
793 		;
794 	}
795 
796 	if (bprm->unsafe & (LSM_UNSAFE_PTRACE)) {
797 		/* TODO: test needs to be profile of label to new */
798 		error = may_change_ptraced_domain(new, &info);
799 		if (error)
800 			goto audit;
801 	}
802 
803 	if (unsafe) {
804 		if (DEBUG_ON) {
805 			dbg_printk("scrubbing environment variables for %s "
806 				   "label=", bprm->filename);
807 			aa_label_printk(new, GFP_ATOMIC);
808 			dbg_printk("\n");
809 		}
810 		bprm->secureexec = 1;
811 	}
812 
813 	if (label->proxy != new->proxy) {
814 		/* when transitioning clear unsafe personality bits */
815 		if (DEBUG_ON) {
816 			dbg_printk("apparmor: clearing unsafe personality "
817 				   "bits. %s label=", bprm->filename);
818 			aa_label_printk(new, GFP_ATOMIC);
819 			dbg_printk("\n");
820 		}
821 		bprm->per_clear |= PER_CLEAR_ON_SETID;
822 	}
823 	aa_put_label(ctx->label);
824 	/* transfer reference, released when ctx is freed */
825 	ctx->label = new;
826 
827 done:
828 	/* clear out temporary/transitional state from the context */
829 	aa_clear_task_ctx_trans(ctx);
830 
831 	aa_put_label(label);
832 	put_buffers(buffer);
833 
834 	return error;
835 
836 audit:
837 	error = fn_for_each(label, profile,
838 			aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,
839 				      bprm->filename, NULL, new,
840 				      file_inode(bprm->file)->i_uid, info,
841 				      error));
842 	aa_put_label(new);
843 	goto done;
844 }
845 
846 /*
847  * Functions for self directed profile change
848  */
849 
850 
851 /* helper fn for change_hat
852  *
853  * Returns: label for hat transition OR ERR_PTR.  Does NOT return NULL
854  */
855 static struct aa_label *build_change_hat(struct aa_profile *profile,
856 					 const char *name, bool sibling)
857 {
858 	struct aa_profile *root, *hat = NULL;
859 	const char *info = NULL;
860 	int error = 0;
861 
862 	if (sibling && PROFILE_IS_HAT(profile)) {
863 		root = aa_get_profile_rcu(&profile->parent);
864 	} else if (!sibling && !PROFILE_IS_HAT(profile)) {
865 		root = aa_get_profile(profile);
866 	} else {
867 		info = "conflicting target types";
868 		error = -EPERM;
869 		goto audit;
870 	}
871 
872 	hat = aa_find_child(root, name);
873 	if (!hat) {
874 		error = -ENOENT;
875 		if (COMPLAIN_MODE(profile)) {
876 			hat = aa_new_null_profile(profile, true, name,
877 						  GFP_KERNEL);
878 			if (!hat) {
879 				info = "failed null profile create";
880 				error = -ENOMEM;
881 			}
882 		}
883 	}
884 	aa_put_profile(root);
885 
886 audit:
887 	aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, AA_MAY_CHANGEHAT,
888 		      name, hat ? hat->base.hname : NULL,
889 		      hat ? &hat->label : NULL, GLOBAL_ROOT_UID, NULL,
890 		      error);
891 	if (!hat || (error && error != -ENOENT))
892 		return ERR_PTR(error);
893 	/* if hat && error - complain mode, already audited and we adjust for
894 	 * complain mode allow by returning hat->label
895 	 */
896 	return &hat->label;
897 }
898 
899 /* helper fn for changing into a hat
900  *
901  * Returns: label for hat transition or ERR_PTR. Does not return NULL
902  */
903 static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
904 				   int count, int flags)
905 {
906 	struct aa_profile *profile, *root, *hat = NULL;
907 	struct aa_label *new;
908 	struct label_it it;
909 	bool sibling = false;
910 	const char *name, *info = NULL;
911 	int i, error;
912 
913 	AA_BUG(!label);
914 	AA_BUG(!hats);
915 	AA_BUG(count < 1);
916 
917 	if (PROFILE_IS_HAT(labels_profile(label)))
918 		sibling = true;
919 
920 	/*find first matching hat */
921 	for (i = 0; i < count && !hat; i++) {
922 		name = hats[i];
923 		label_for_each_in_ns(it, labels_ns(label), label, profile) {
924 			if (sibling && PROFILE_IS_HAT(profile)) {
925 				root = aa_get_profile_rcu(&profile->parent);
926 			} else if (!sibling && !PROFILE_IS_HAT(profile)) {
927 				root = aa_get_profile(profile);
928 			} else {	/* conflicting change type */
929 				info = "conflicting targets types";
930 				error = -EPERM;
931 				goto fail;
932 			}
933 			hat = aa_find_child(root, name);
934 			aa_put_profile(root);
935 			if (!hat) {
936 				if (!COMPLAIN_MODE(profile))
937 					goto outer_continue;
938 				/* complain mode succeed as if hat */
939 			} else if (!PROFILE_IS_HAT(hat)) {
940 				info = "target not hat";
941 				error = -EPERM;
942 				aa_put_profile(hat);
943 				goto fail;
944 			}
945 			aa_put_profile(hat);
946 		}
947 		/* found a hat for all profiles in ns */
948 		goto build;
949 outer_continue:
950 	;
951 	}
952 	/* no hats that match, find appropriate error
953 	 *
954 	 * In complain mode audit of the failure is based off of the first
955 	 * hat supplied.  This is done due how userspace interacts with
956 	 * change_hat.
957 	 */
958 	name = NULL;
959 	label_for_each_in_ns(it, labels_ns(label), label, profile) {
960 		if (!list_empty(&profile->base.profiles)) {
961 			info = "hat not found";
962 			error = -ENOENT;
963 			goto fail;
964 		}
965 	}
966 	info = "no hats defined";
967 	error = -ECHILD;
968 
969 fail:
970 	label_for_each_in_ns(it, labels_ns(label), label, profile) {
971 		/*
972 		 * no target as it has failed to be found or built
973 		 *
974 		 * change_hat uses probing and should not log failures
975 		 * related to missing hats
976 		 */
977 		/* TODO: get rid of GLOBAL_ROOT_UID */
978 		if (count > 1 || COMPLAIN_MODE(profile)) {
979 			aa_audit_file(profile, &nullperms, OP_CHANGE_HAT,
980 				      AA_MAY_CHANGEHAT, name, NULL, NULL,
981 				      GLOBAL_ROOT_UID, info, error);
982 		}
983 	}
984 	return ERR_PTR(error);
985 
986 build:
987 	new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
988 				   build_change_hat(profile, name, sibling),
989 				   aa_get_label(&profile->label));
990 	if (!new) {
991 		info = "label build failed";
992 		error = -ENOMEM;
993 		goto fail;
994 	} /* else if (IS_ERR) build_change_hat has logged error so return new */
995 
996 	return new;
997 }
998 
999 /**
1000  * aa_change_hat - change hat to/from subprofile
1001  * @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0)
1002  * @count: number of hat names in @hats
1003  * @token: magic value to validate the hat change
1004  * @flags: flags affecting behavior of the change
1005  *
1006  * Returns %0 on success, error otherwise.
1007  *
1008  * Change to the first profile specified in @hats that exists, and store
1009  * the @hat_magic in the current task context.  If the count == 0 and the
1010  * @token matches that stored in the current task context, return to the
1011  * top level profile.
1012  *
1013  * change_hat only applies to profiles in the current ns, and each profile
1014  * in the ns must make the same transition otherwise change_hat will fail.
1015  */
1016 int aa_change_hat(const char *hats[], int count, u64 token, int flags)
1017 {
1018 	const struct cred *cred;
1019 	struct aa_task_ctx *ctx;
1020 	struct aa_label *label, *previous, *new = NULL, *target = NULL;
1021 	struct aa_profile *profile;
1022 	struct aa_perms perms = {};
1023 	const char *info = NULL;
1024 	int error = 0;
1025 
1026 	/*
1027 	 * Fail explicitly requested domain transitions if no_new_privs.
1028 	 * There is no exception for unconfined as change_hat is not
1029 	 * available.
1030 	 */
1031 	if (task_no_new_privs(current)) {
1032 		/* not an apparmor denial per se, so don't log it */
1033 		AA_DEBUG("no_new_privs - change_hat denied");
1034 		return -EPERM;
1035 	}
1036 
1037 	/* released below */
1038 	cred = get_current_cred();
1039 	ctx = cred_ctx(cred);
1040 	label = aa_get_newest_cred_label(cred);
1041 	previous = aa_get_newest_label(ctx->previous);
1042 
1043 	if (unconfined(label)) {
1044 		info = "unconfined can not change_hat";
1045 		error = -EPERM;
1046 		goto fail;
1047 	}
1048 
1049 	if (count) {
1050 		new = change_hat(label, hats, count, flags);
1051 		AA_BUG(!new);
1052 		if (IS_ERR(new)) {
1053 			error = PTR_ERR(new);
1054 			new = NULL;
1055 			/* already audited */
1056 			goto out;
1057 		}
1058 
1059 		error = may_change_ptraced_domain(new, &info);
1060 		if (error)
1061 			goto fail;
1062 
1063 		if (flags & AA_CHANGE_TEST)
1064 			goto out;
1065 
1066 		target = new;
1067 		error = aa_set_current_hat(new, token);
1068 		if (error == -EACCES)
1069 			/* kill task in case of brute force attacks */
1070 			goto kill;
1071 	} else if (previous && !(flags & AA_CHANGE_TEST)) {
1072 		/* Return to saved label.  Kill task if restore fails
1073 		 * to avoid brute force attacks
1074 		 */
1075 		target = previous;
1076 		error = aa_restore_previous_label(token);
1077 		if (error) {
1078 			if (error == -EACCES)
1079 				goto kill;
1080 			goto fail;
1081 		}
1082 	} /* else ignore @flags && restores when there is no saved profile */
1083 
1084 out:
1085 	aa_put_label(new);
1086 	aa_put_label(previous);
1087 	aa_put_label(label);
1088 	put_cred(cred);
1089 
1090 	return error;
1091 
1092 kill:
1093 	info = "failed token match";
1094 	perms.kill = AA_MAY_CHANGEHAT;
1095 
1096 fail:
1097 	fn_for_each_in_ns(label, profile,
1098 		aa_audit_file(profile, &perms, OP_CHANGE_HAT,
1099 			      AA_MAY_CHANGEHAT, NULL, NULL, target,
1100 			      GLOBAL_ROOT_UID, info, error));
1101 
1102 	goto out;
1103 }
1104 
1105 
1106 static int change_profile_perms_wrapper(const char *op, const char *name,
1107 					struct aa_profile *profile,
1108 					struct aa_label *target, bool stack,
1109 					u32 request, struct aa_perms *perms)
1110 {
1111 	const char *info = NULL;
1112 	int error = 0;
1113 
1114 	/*
1115 	 * Fail explicitly requested domain transitions when no_new_privs
1116 	 * and not unconfined OR the transition results in a stack on
1117 	 * the current label.
1118 	 * Stacking domain transitions and transitions from unconfined are
1119 	 * allowed even when no_new_privs is set because this aways results
1120 	 * in a reduction of permissions.
1121 	 */
1122 	if (task_no_new_privs(current) && !stack &&
1123 	    !profile_unconfined(profile) &&
1124 	    !aa_label_is_subset(target, &profile->label)) {
1125 		info = "no new privs";
1126 		error = -EPERM;
1127 	}
1128 
1129 	if (!error)
1130 		error = change_profile_perms(profile, target, stack, request,
1131 					     profile->file.start, perms);
1132 	if (error)
1133 		error = aa_audit_file(profile, perms, op, request, name,
1134 				      NULL, target, GLOBAL_ROOT_UID, info,
1135 				      error);
1136 
1137 	return error;
1138 }
1139 
1140 /**
1141  * aa_change_profile - perform a one-way profile transition
1142  * @fqname: name of profile may include namespace (NOT NULL)
1143  * @onexec: whether this transition is to take place immediately or at exec
1144  * @flags: flags affecting change behavior
1145  *
1146  * Change to new profile @name.  Unlike with hats, there is no way
1147  * to change back.  If @name isn't specified the current profile name is
1148  * used.
1149  * If @onexec then the transition is delayed until
1150  * the next exec.
1151  *
1152  * Returns %0 on success, error otherwise.
1153  */
1154 int aa_change_profile(const char *fqname, int flags)
1155 {
1156 	struct aa_label *label, *new = NULL, *target = NULL;
1157 	struct aa_profile *profile;
1158 	struct aa_perms perms = {};
1159 	const char *info = NULL;
1160 	const char *auditname = fqname;		/* retain leading & if stack */
1161 	bool stack = flags & AA_CHANGE_STACK;
1162 	int error = 0;
1163 	char *op;
1164 	u32 request;
1165 
1166 	if (!fqname || !*fqname) {
1167 		AA_DEBUG("no profile name");
1168 		return -EINVAL;
1169 	}
1170 
1171 	if (flags & AA_CHANGE_ONEXEC) {
1172 		request = AA_MAY_ONEXEC;
1173 		if (stack)
1174 			op = OP_STACK_ONEXEC;
1175 		else
1176 			op = OP_CHANGE_ONEXEC;
1177 	} else {
1178 		request = AA_MAY_CHANGE_PROFILE;
1179 		if (stack)
1180 			op = OP_STACK;
1181 		else
1182 			op = OP_CHANGE_PROFILE;
1183 	}
1184 
1185 	label = aa_get_current_label();
1186 
1187 	if (*fqname == '&') {
1188 		stack = true;
1189 		/* don't have label_parse() do stacking */
1190 		fqname++;
1191 	}
1192 	target = aa_label_parse(label, fqname, GFP_KERNEL, true, false);
1193 	if (IS_ERR(target)) {
1194 		struct aa_profile *tprofile;
1195 
1196 		info = "label not found";
1197 		error = PTR_ERR(target);
1198 		target = NULL;
1199 		/*
1200 		 * TODO: fixme using labels_profile is not right - do profile
1201 		 * per complain profile
1202 		 */
1203 		if ((flags & AA_CHANGE_TEST) ||
1204 		    !COMPLAIN_MODE(labels_profile(label)))
1205 			goto audit;
1206 		/* released below */
1207 		tprofile = aa_new_null_profile(labels_profile(label), false,
1208 					       fqname, GFP_KERNEL);
1209 		if (!tprofile) {
1210 			info = "failed null profile create";
1211 			error = -ENOMEM;
1212 			goto audit;
1213 		}
1214 		target = &tprofile->label;
1215 		goto check;
1216 	}
1217 
1218 	/*
1219 	 * self directed transitions only apply to current policy ns
1220 	 * TODO: currently requiring perms for stacking and straight change
1221 	 *       stacking doesn't strictly need this. Determine how much
1222 	 *       we want to loosen this restriction for stacking
1223 	 *
1224 	 * if (!stack) {
1225 	 */
1226 	error = fn_for_each_in_ns(label, profile,
1227 			change_profile_perms_wrapper(op, auditname,
1228 						     profile, target, stack,
1229 						     request, &perms));
1230 	if (error)
1231 		/* auditing done in change_profile_perms_wrapper */
1232 		goto out;
1233 
1234 	/* } */
1235 
1236 check:
1237 	/* check if tracing task is allowed to trace target domain */
1238 	error = may_change_ptraced_domain(target, &info);
1239 	if (error && !fn_for_each_in_ns(label, profile,
1240 					COMPLAIN_MODE(profile)))
1241 		goto audit;
1242 
1243 	/* TODO: add permission check to allow this
1244 	 * if ((flags & AA_CHANGE_ONEXEC) && !current_is_single_threaded()) {
1245 	 *      info = "not a single threaded task";
1246 	 *      error = -EACCES;
1247 	 *      goto audit;
1248 	 * }
1249 	 */
1250 	if (flags & AA_CHANGE_TEST)
1251 		goto out;
1252 
1253 	if (!(flags & AA_CHANGE_ONEXEC)) {
1254 		/* only transition profiles in the current ns */
1255 		if (stack)
1256 			new = aa_label_merge(label, target, GFP_KERNEL);
1257 		else
1258 			new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
1259 					aa_get_label(target),
1260 					aa_get_label(&profile->label));
1261 		if (IS_ERR_OR_NULL(new)) {
1262 			info = "failed to build target label";
1263 			error = PTR_ERR(new);
1264 			new = NULL;
1265 			perms.allow = 0;
1266 			goto audit;
1267 		}
1268 		error = aa_replace_current_label(new);
1269 	} else
1270 		/* full transition will be built in exec path */
1271 		error = aa_set_current_onexec(target, stack);
1272 
1273 audit:
1274 	error = fn_for_each_in_ns(label, profile,
1275 			aa_audit_file(profile, &perms, op, request, auditname,
1276 				      NULL, new ? new : target,
1277 				      GLOBAL_ROOT_UID, info, error));
1278 
1279 out:
1280 	aa_put_label(new);
1281 	aa_put_label(target);
1282 	aa_put_label(label);
1283 
1284 	return error;
1285 }
1286