xref: /openbmc/linux/security/apparmor/domain.c (revision fb960bd2)
1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor policy attachment and domain transitions
5  *
6  * Copyright (C) 2002-2008 Novell/SUSE
7  * Copyright 2009-2010 Canonical Ltd.
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License as
11  * published by the Free Software Foundation, version 2 of the
12  * License.
13  */
14 
15 #include <linux/errno.h>
16 #include <linux/fdtable.h>
17 #include <linux/file.h>
18 #include <linux/mount.h>
19 #include <linux/syscalls.h>
20 #include <linux/tracehook.h>
21 #include <linux/personality.h>
22 
23 #include "include/audit.h"
24 #include "include/apparmorfs.h"
25 #include "include/context.h"
26 #include "include/domain.h"
27 #include "include/file.h"
28 #include "include/ipc.h"
29 #include "include/match.h"
30 #include "include/path.h"
31 #include "include/policy.h"
32 #include "include/policy_ns.h"
33 
34 /**
35  * aa_free_domain_entries - free entries in a domain table
36  * @domain: the domain table to free  (MAYBE NULL)
37  */
38 void aa_free_domain_entries(struct aa_domain *domain)
39 {
40 	int i;
41 	if (domain) {
42 		if (!domain->table)
43 			return;
44 
45 		for (i = 0; i < domain->size; i++)
46 			kzfree(domain->table[i]);
47 		kzfree(domain->table);
48 		domain->table = NULL;
49 	}
50 }
51 
52 /**
53  * may_change_ptraced_domain - check if can change profile on ptraced task
54  * @to_label: profile to change to  (NOT NULL)
55  * @info: message if there is an error
56  *
57  * Check if current is ptraced and if so if the tracing task is allowed
58  * to trace the new domain
59  *
60  * Returns: %0 or error if change not allowed
61  */
62 static int may_change_ptraced_domain(struct aa_label *to_label,
63 				     const char **info)
64 {
65 	struct task_struct *tracer;
66 	struct aa_label *tracerl = NULL;
67 	int error = 0;
68 
69 	rcu_read_lock();
70 	tracer = ptrace_parent(current);
71 	if (tracer)
72 		/* released below */
73 		tracerl = aa_get_task_label(tracer);
74 
75 	/* not ptraced */
76 	if (!tracer || unconfined(tracerl))
77 		goto out;
78 
79 	error = aa_may_ptrace(tracerl, to_label, PTRACE_MODE_ATTACH);
80 
81 out:
82 	rcu_read_unlock();
83 	aa_put_label(tracerl);
84 
85 	if (error)
86 		*info = "ptrace prevents transition";
87 	return error;
88 }
89 
90 /**** TODO: dedup to aa_label_match - needs perm and dfa, merging
91  * specifically this is an exact copy of aa_label_match except
92  * aa_compute_perms is replaced with aa_compute_fperms
93  * and policy.dfa with file.dfa
94  ****/
95 /* match a profile and its associated ns component if needed
96  * Assumes visibility test has already been done.
97  * If a subns profile is not to be matched should be prescreened with
98  * visibility test.
99  */
100 static inline unsigned int match_component(struct aa_profile *profile,
101 					   struct aa_profile *tp,
102 					   bool stack, unsigned int state)
103 {
104 	const char *ns_name;
105 
106 	if (stack)
107 		state = aa_dfa_match(profile->file.dfa, state, "&");
108 	if (profile->ns == tp->ns)
109 		return aa_dfa_match(profile->file.dfa, state, tp->base.hname);
110 
111 	/* try matching with namespace name and then profile */
112 	ns_name = aa_ns_name(profile->ns, tp->ns, true);
113 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);
114 	state = aa_dfa_match(profile->file.dfa, state, ns_name);
115 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);
116 	return aa_dfa_match(profile->file.dfa, state, tp->base.hname);
117 }
118 
119 /**
120  * label_compound_match - find perms for full compound label
121  * @profile: profile to find perms for
122  * @label: label to check access permissions for
123  * @stack: whether this is a stacking request
124  * @start: state to start match in
125  * @subns: whether to do permission checks on components in a subns
126  * @request: permissions to request
127  * @perms: perms struct to set
128  *
129  * Returns: 0 on success else ERROR
130  *
131  * For the label A//&B//&C this does the perm match for A//&B//&C
132  * @perms should be preinitialized with allperms OR a previous permission
133  *        check to be stacked.
134  */
135 static int label_compound_match(struct aa_profile *profile,
136 				struct aa_label *label, bool stack,
137 				unsigned int state, bool subns, u32 request,
138 				struct aa_perms *perms)
139 {
140 	struct aa_profile *tp;
141 	struct label_it i;
142 	struct path_cond cond = { };
143 
144 	/* find first subcomponent that is visible */
145 	label_for_each(i, label, tp) {
146 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
147 			continue;
148 		state = match_component(profile, tp, stack, state);
149 		if (!state)
150 			goto fail;
151 		goto next;
152 	}
153 
154 	/* no component visible */
155 	*perms = allperms;
156 	return 0;
157 
158 next:
159 	label_for_each_cont(i, label, tp) {
160 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
161 			continue;
162 		state = aa_dfa_match(profile->file.dfa, state, "//&");
163 		state = match_component(profile, tp, false, state);
164 		if (!state)
165 			goto fail;
166 	}
167 	*perms = aa_compute_fperms(profile->file.dfa, state, &cond);
168 	aa_apply_modes_to_perms(profile, perms);
169 	if ((perms->allow & request) != request)
170 		return -EACCES;
171 
172 	return 0;
173 
174 fail:
175 	*perms = nullperms;
176 	return -EACCES;
177 }
178 
179 /**
180  * label_components_match - find perms for all subcomponents of a label
181  * @profile: profile to find perms for
182  * @label: label to check access permissions for
183  * @stack: whether this is a stacking request
184  * @start: state to start match in
185  * @subns: whether to do permission checks on components in a subns
186  * @request: permissions to request
187  * @perms: an initialized perms struct to add accumulation to
188  *
189  * Returns: 0 on success else ERROR
190  *
191  * For the label A//&B//&C this does the perm match for each of A and B and C
192  * @perms should be preinitialized with allperms OR a previous permission
193  *        check to be stacked.
194  */
195 static int label_components_match(struct aa_profile *profile,
196 				  struct aa_label *label, bool stack,
197 				  unsigned int start, bool subns, u32 request,
198 				  struct aa_perms *perms)
199 {
200 	struct aa_profile *tp;
201 	struct label_it i;
202 	struct aa_perms tmp;
203 	struct path_cond cond = { };
204 	unsigned int state = 0;
205 
206 	/* find first subcomponent to test */
207 	label_for_each(i, label, tp) {
208 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
209 			continue;
210 		state = match_component(profile, tp, stack, start);
211 		if (!state)
212 			goto fail;
213 		goto next;
214 	}
215 
216 	/* no subcomponents visible - no change in perms */
217 	return 0;
218 
219 next:
220 	tmp = aa_compute_fperms(profile->file.dfa, state, &cond);
221 	aa_apply_modes_to_perms(profile, &tmp);
222 	aa_perms_accum(perms, &tmp);
223 	label_for_each_cont(i, label, tp) {
224 		if (!aa_ns_visible(profile->ns, tp->ns, subns))
225 			continue;
226 		state = match_component(profile, tp, stack, start);
227 		if (!state)
228 			goto fail;
229 		tmp = aa_compute_fperms(profile->file.dfa, state, &cond);
230 		aa_apply_modes_to_perms(profile, &tmp);
231 		aa_perms_accum(perms, &tmp);
232 	}
233 
234 	if ((perms->allow & request) != request)
235 		return -EACCES;
236 
237 	return 0;
238 
239 fail:
240 	*perms = nullperms;
241 	return -EACCES;
242 }
243 
244 /**
245  * label_match - do a multi-component label match
246  * @profile: profile to match against (NOT NULL)
247  * @label: label to match (NOT NULL)
248  * @stack: whether this is a stacking request
249  * @state: state to start in
250  * @subns: whether to match subns components
251  * @request: permission request
252  * @perms: Returns computed perms (NOT NULL)
253  *
254  * Returns: the state the match finished in, may be the none matching state
255  */
256 static int label_match(struct aa_profile *profile, struct aa_label *label,
257 		       bool stack, unsigned int state, bool subns, u32 request,
258 		       struct aa_perms *perms)
259 {
260 	int error;
261 
262 	*perms = nullperms;
263 	error = label_compound_match(profile, label, stack, state, subns,
264 				     request, perms);
265 	if (!error)
266 		return error;
267 
268 	*perms = allperms;
269 	return label_components_match(profile, label, stack, state, subns,
270 				      request, perms);
271 }
272 
273 /******* end TODO: dedup *****/
274 
275 /**
276  * change_profile_perms - find permissions for change_profile
277  * @profile: the current profile  (NOT NULL)
278  * @target: label to transition to (NOT NULL)
279  * @stack: whether this is a stacking request
280  * @request: requested perms
281  * @start: state to start matching in
282  *
283  *
284  * Returns: permission set
285  *
286  * currently only matches full label A//&B//&C or individual components A, B, C
287  * not arbitrary combinations. Eg. A//&B, C
288  */
289 static int change_profile_perms(struct aa_profile *profile,
290 				struct aa_label *target, bool stack,
291 				u32 request, unsigned int start,
292 				struct aa_perms *perms)
293 {
294 	if (profile_unconfined(profile)) {
295 		perms->allow = AA_MAY_CHANGE_PROFILE | AA_MAY_ONEXEC;
296 		perms->audit = perms->quiet = perms->kill = 0;
297 		return 0;
298 	}
299 
300 	/* TODO: add profile in ns screening */
301 	return label_match(profile, target, stack, start, true, request, perms);
302 }
303 
304 /**
305  * __attach_match_ - find an attachment match
306  * @name - to match against  (NOT NULL)
307  * @head - profile list to walk  (NOT NULL)
308  * @info - info message if there was an error (NOT NULL)
309  *
310  * Do a linear search on the profiles in the list.  There is a matching
311  * preference where an exact match is preferred over a name which uses
312  * expressions to match, and matching expressions with the greatest
313  * xmatch_len are preferred.
314  *
315  * Requires: @head not be shared or have appropriate locks held
316  *
317  * Returns: profile or NULL if no match found
318  */
319 static struct aa_profile *__attach_match(const char *name,
320 					 struct list_head *head,
321 					 const char **info)
322 {
323 	int len = 0;
324 	bool conflict = false;
325 	struct aa_profile *profile, *candidate = NULL;
326 
327 	list_for_each_entry_rcu(profile, head, base.list) {
328 		if (profile->label.flags & FLAG_NULL &&
329 		    &profile->label == ns_unconfined(profile->ns))
330 			continue;
331 
332 		if (profile->xmatch) {
333 			if (profile->xmatch_len == len) {
334 				conflict = true;
335 				continue;
336 			} else if (profile->xmatch_len > len) {
337 				unsigned int state;
338 				u32 perm;
339 
340 				state = aa_dfa_match(profile->xmatch,
341 						     DFA_START, name);
342 				perm = dfa_user_allow(profile->xmatch, state);
343 				/* any accepting state means a valid match. */
344 				if (perm & MAY_EXEC) {
345 					candidate = profile;
346 					len = profile->xmatch_len;
347 					conflict = false;
348 				}
349 			}
350 		} else if (!strcmp(profile->base.name, name))
351 			/* exact non-re match, no more searching required */
352 			return profile;
353 	}
354 
355 	if (conflict) {
356 		*info = "conflicting profile attachments";
357 		return NULL;
358 	}
359 
360 	return candidate;
361 }
362 
363 /**
364  * find_attach - do attachment search for unconfined processes
365  * @ns: the current namespace  (NOT NULL)
366  * @list: list to search  (NOT NULL)
367  * @name: the executable name to match against  (NOT NULL)
368  * @info: info message if there was an error
369  *
370  * Returns: label or NULL if no match found
371  */
372 static struct aa_label *find_attach(struct aa_ns *ns, struct list_head *list,
373 				    const char *name, const char **info)
374 {
375 	struct aa_profile *profile;
376 
377 	rcu_read_lock();
378 	profile = aa_get_profile(__attach_match(name, list, info));
379 	rcu_read_unlock();
380 
381 	return profile ? &profile->label : NULL;
382 }
383 
384 static const char *next_name(int xtype, const char *name)
385 {
386 	return NULL;
387 }
388 
389 /**
390  * x_table_lookup - lookup an x transition name via transition table
391  * @profile: current profile (NOT NULL)
392  * @xindex: index into x transition table
393  * @name: returns: name tested to find label (NOT NULL)
394  *
395  * Returns: refcounted label, or NULL on failure (MAYBE NULL)
396  */
397 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
398 				const char **name)
399 {
400 	struct aa_label *label = NULL;
401 	u32 xtype = xindex & AA_X_TYPE_MASK;
402 	int index = xindex & AA_X_INDEX_MASK;
403 
404 	AA_BUG(!name);
405 
406 	/* index is guaranteed to be in range, validated at load time */
407 	/* TODO: move lookup parsing to unpack time so this is a straight
408 	 *       index into the resultant label
409 	 */
410 	for (*name = profile->file.trans.table[index]; !label && *name;
411 	     *name = next_name(xtype, *name)) {
412 		if (xindex & AA_X_CHILD) {
413 			struct aa_profile *new_profile;
414 			/* release by caller */
415 			new_profile = aa_find_child(profile, *name);
416 			if (new_profile)
417 				label = &new_profile->label;
418 			continue;
419 		}
420 		label = aa_label_parse(&profile->label, *name, GFP_ATOMIC,
421 				       true, false);
422 		if (IS_ERR(label))
423 			label = NULL;
424 	}
425 
426 	/* released by caller */
427 
428 	return label;
429 }
430 
431 /**
432  * x_to_label - get target label for a given xindex
433  * @profile: current profile  (NOT NULL)
434  * @name: name to lookup (NOT NULL)
435  * @xindex: index into x transition table
436  * @lookupname: returns: name used in lookup if one was specified (NOT NULL)
437  *
438  * find label for a transition index
439  *
440  * Returns: refcounted label or NULL if not found available
441  */
442 static struct aa_label *x_to_label(struct aa_profile *profile,
443 				   const char *name, u32 xindex,
444 				   const char **lookupname,
445 				   const char **info)
446 {
447 	struct aa_label *new = NULL;
448 	struct aa_ns *ns = profile->ns;
449 	u32 xtype = xindex & AA_X_TYPE_MASK;
450 	const char *stack = NULL;
451 
452 	switch (xtype) {
453 	case AA_X_NONE:
454 		/* fail exec unless ix || ux fallback - handled by caller */
455 		*lookupname = NULL;
456 		break;
457 	case AA_X_TABLE:
458 		/* TODO: fix when perm mapping done at unload */
459 		stack = profile->file.trans.table[xindex & AA_X_INDEX_MASK];
460 		if (*stack != '&') {
461 			/* released by caller */
462 			new = x_table_lookup(profile, xindex, lookupname);
463 			stack = NULL;
464 			break;
465 		}
466 		/* fall through to X_NAME */
467 	case AA_X_NAME:
468 		if (xindex & AA_X_CHILD)
469 			/* released by caller */
470 			new = find_attach(ns, &profile->base.profiles,
471 					  name, info);
472 		else
473 			/* released by caller */
474 			new = find_attach(ns, &ns->base.profiles,
475 					  name, info);
476 		*lookupname = name;
477 		break;
478 	}
479 
480 	if (!new) {
481 		if (xindex & AA_X_INHERIT) {
482 			/* (p|c|n)ix - don't change profile but do
483 			 * use the newest version
484 			 */
485 			*info = "ix fallback";
486 			/* no profile && no error */
487 			new = aa_get_newest_label(&profile->label);
488 		} else if (xindex & AA_X_UNCONFINED) {
489 			new = aa_get_newest_label(ns_unconfined(profile->ns));
490 			*info = "ux fallback";
491 		}
492 	}
493 
494 	if (new && stack) {
495 		/* base the stack on post domain transition */
496 		struct aa_label *base = new;
497 
498 		new = aa_label_parse(base, stack, GFP_ATOMIC, true, false);
499 		if (IS_ERR(new))
500 			new = NULL;
501 		aa_put_label(base);
502 	}
503 
504 	/* released by caller */
505 	return new;
506 }
507 
508 static struct aa_label *profile_transition(struct aa_profile *profile,
509 					   const struct linux_binprm *bprm,
510 					   char *buffer, struct path_cond *cond,
511 					   bool *secure_exec)
512 {
513 	struct aa_label *new = NULL;
514 	const char *info = NULL, *name = NULL, *target = NULL;
515 	unsigned int state = profile->file.start;
516 	struct aa_perms perms = {};
517 	bool nonewprivs = false;
518 	int error = 0;
519 
520 	AA_BUG(!profile);
521 	AA_BUG(!bprm);
522 	AA_BUG(!buffer);
523 
524 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
525 			     &name, &info, profile->disconnected);
526 	if (error) {
527 		if (profile_unconfined(profile) ||
528 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
529 			AA_DEBUG("name lookup ix on error");
530 			error = 0;
531 			new = aa_get_newest_label(&profile->label);
532 		}
533 		name = bprm->filename;
534 		goto audit;
535 	}
536 
537 	if (profile_unconfined(profile)) {
538 		new = find_attach(profile->ns, &profile->ns->base.profiles,
539 				  name, &info);
540 		if (new) {
541 			AA_DEBUG("unconfined attached to new label");
542 			return new;
543 		}
544 		AA_DEBUG("unconfined exec no attachment");
545 		return aa_get_newest_label(&profile->label);
546 	}
547 
548 	/* find exec permissions for name */
549 	state = aa_str_perms(profile->file.dfa, state, name, cond, &perms);
550 	if (perms.allow & MAY_EXEC) {
551 		/* exec permission determine how to transition */
552 		new = x_to_label(profile, name, perms.xindex, &target, &info);
553 		if (new && new->proxy == profile->label.proxy && info) {
554 			/* hack ix fallback - improve how this is detected */
555 			goto audit;
556 		} else if (!new) {
557 			error = -EACCES;
558 			info = "profile transition not found";
559 			/* remove MAY_EXEC to audit as failure */
560 			perms.allow &= ~MAY_EXEC;
561 		}
562 	} else if (COMPLAIN_MODE(profile)) {
563 		/* no exec permission - learning mode */
564 		struct aa_profile *new_profile = NULL;
565 		char *n = kstrdup(name, GFP_ATOMIC);
566 
567 		if (n) {
568 			/* name is ptr into buffer */
569 			long pos = name - buffer;
570 			/* break per cpu buffer hold */
571 			put_buffers(buffer);
572 			new_profile = aa_new_null_profile(profile, false, n,
573 							  GFP_KERNEL);
574 			get_buffers(buffer);
575 			name = buffer + pos;
576 			strcpy((char *)name, n);
577 			kfree(n);
578 		}
579 		if (!new_profile) {
580 			error = -ENOMEM;
581 			info = "could not create null profile";
582 		} else {
583 			error = -EACCES;
584 			new = &new_profile->label;
585 		}
586 		perms.xindex |= AA_X_UNSAFE;
587 	} else
588 		/* fail exec */
589 		error = -EACCES;
590 
591 	if (!new)
592 		goto audit;
593 
594 	/* Policy has specified a domain transitions. if no_new_privs and
595 	 * confined and not transitioning to the current domain fail.
596 	 *
597 	 * NOTE: Domain transitions from unconfined and to stritly stacked
598 	 * subsets are allowed even when no_new_privs is set because this
599 	 * aways results in a further reduction of permissions.
600 	 */
601 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) &&
602 	    !profile_unconfined(profile) &&
603 	    !aa_label_is_subset(new, &profile->label)) {
604 		error = -EPERM;
605 		info = "no new privs";
606 		nonewprivs = true;
607 		perms.allow &= ~MAY_EXEC;
608 		goto audit;
609 	}
610 
611 	if (!(perms.xindex & AA_X_UNSAFE)) {
612 		if (DEBUG_ON) {
613 			dbg_printk("apparmor: scrubbing environment variables"
614 				   " for %s profile=", name);
615 			aa_label_printk(new, GFP_ATOMIC);
616 			dbg_printk("\n");
617 		}
618 		*secure_exec = true;
619 	}
620 
621 audit:
622 	aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name, target, new,
623 		      cond->uid, info, error);
624 	if (!new || nonewprivs) {
625 		aa_put_label(new);
626 		return ERR_PTR(error);
627 	}
628 
629 	return new;
630 }
631 
632 static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,
633 			  bool stack, const struct linux_binprm *bprm,
634 			  char *buffer, struct path_cond *cond,
635 			  bool *secure_exec)
636 {
637 	unsigned int state = profile->file.start;
638 	struct aa_perms perms = {};
639 	const char *xname = NULL, *info = "change_profile onexec";
640 	int error = -EACCES;
641 
642 	AA_BUG(!profile);
643 	AA_BUG(!onexec);
644 	AA_BUG(!bprm);
645 	AA_BUG(!buffer);
646 
647 	if (profile_unconfined(profile)) {
648 		/* change_profile on exec already granted */
649 		/*
650 		 * NOTE: Domain transitions from unconfined are allowed
651 		 * even when no_new_privs is set because this aways results
652 		 * in a further reduction of permissions.
653 		 */
654 		return 0;
655 	}
656 
657 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
658 			     &xname, &info, profile->disconnected);
659 	if (error) {
660 		if (profile_unconfined(profile) ||
661 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
662 			AA_DEBUG("name lookup ix on error");
663 			error = 0;
664 		}
665 		xname = bprm->filename;
666 		goto audit;
667 	}
668 
669 	/* find exec permissions for name */
670 	state = aa_str_perms(profile->file.dfa, state, xname, cond, &perms);
671 	if (!(perms.allow & AA_MAY_ONEXEC)) {
672 		info = "no change_onexec valid for executable";
673 		goto audit;
674 	}
675 	/* test if this exec can be paired with change_profile onexec.
676 	 * onexec permission is linked to exec with a standard pairing
677 	 * exec\0change_profile
678 	 */
679 	state = aa_dfa_null_transition(profile->file.dfa, state);
680 	error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC,
681 				     state, &perms);
682 	if (error) {
683 		perms.allow &= ~AA_MAY_ONEXEC;
684 		goto audit;
685 	}
686 	/* Policy has specified a domain transitions. if no_new_privs and
687 	 * confined and not transitioning to the current domain fail.
688 	 *
689 	 * NOTE: Domain transitions from unconfined and to stritly stacked
690 	 * subsets are allowed even when no_new_privs is set because this
691 	 * aways results in a further reduction of permissions.
692 	 */
693 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) &&
694 	    !profile_unconfined(profile) &&
695 	    !aa_label_is_subset(onexec, &profile->label)) {
696 		error = -EPERM;
697 		info = "no new privs";
698 		perms.allow &= ~AA_MAY_ONEXEC;
699 		goto audit;
700 	}
701 
702 	if (!(perms.xindex & AA_X_UNSAFE)) {
703 		if (DEBUG_ON) {
704 			dbg_printk("apparmor: scrubbing environment "
705 				   "variables for %s label=", xname);
706 			aa_label_printk(onexec, GFP_ATOMIC);
707 			dbg_printk("\n");
708 		}
709 		*secure_exec = true;
710 	}
711 
712 audit:
713 	return aa_audit_file(profile, &perms, OP_EXEC, AA_MAY_ONEXEC, xname,
714 			     NULL, onexec, cond->uid, info, error);
715 }
716 
717 /* ensure none ns domain transitions are correctly applied with onexec */
718 
719 static struct aa_label *handle_onexec(struct aa_label *label,
720 				      struct aa_label *onexec, bool stack,
721 				      const struct linux_binprm *bprm,
722 				      char *buffer, struct path_cond *cond,
723 				      bool *unsafe)
724 {
725 	struct aa_profile *profile;
726 	struct aa_label *new;
727 	int error;
728 
729 	AA_BUG(!label);
730 	AA_BUG(!onexec);
731 	AA_BUG(!bprm);
732 	AA_BUG(!buffer);
733 
734 	if (!stack) {
735 		error = fn_for_each_in_ns(label, profile,
736 				profile_onexec(profile, onexec, stack,
737 					       bprm, buffer, cond, unsafe));
738 		if (error)
739 			return ERR_PTR(error);
740 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,
741 				aa_get_newest_label(onexec),
742 				profile_transition(profile, bprm, buffer,
743 						   cond, unsafe));
744 
745 	} else {
746 		/* TODO: determine how much we want to losen this */
747 		error = fn_for_each_in_ns(label, profile,
748 				profile_onexec(profile, onexec, stack, bprm,
749 					       buffer, cond, unsafe));
750 		if (error)
751 			return ERR_PTR(error);
752 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,
753 				aa_label_merge(&profile->label, onexec,
754 					       GFP_ATOMIC),
755 				profile_transition(profile, bprm, buffer,
756 						   cond, unsafe));
757 	}
758 
759 	if (new)
760 		return new;
761 
762 	/* TODO: get rid of GLOBAL_ROOT_UID */
763 	error = fn_for_each_in_ns(label, profile,
764 			aa_audit_file(profile, &nullperms, OP_CHANGE_ONEXEC,
765 				      AA_MAY_ONEXEC, bprm->filename, NULL,
766 				      onexec, GLOBAL_ROOT_UID,
767 				      "failed to build target label", -ENOMEM));
768 	return ERR_PTR(error);
769 }
770 
771 /**
772  * apparmor_bprm_set_creds - set the new creds on the bprm struct
773  * @bprm: binprm for the exec  (NOT NULL)
774  *
775  * Returns: %0 or error on failure
776  *
777  * TODO: once the other paths are done see if we can't refactor into a fn
778  */
779 int apparmor_bprm_set_creds(struct linux_binprm *bprm)
780 {
781 	struct aa_task_ctx *ctx;
782 	struct aa_label *label, *new = NULL;
783 	struct aa_profile *profile;
784 	char *buffer = NULL;
785 	const char *info = NULL;
786 	int error = 0;
787 	bool unsafe = false;
788 	struct path_cond cond = {
789 		file_inode(bprm->file)->i_uid,
790 		file_inode(bprm->file)->i_mode
791 	};
792 
793 	if (bprm->called_set_creds)
794 		return 0;
795 
796 	ctx = cred_ctx(bprm->cred);
797 	AA_BUG(!ctx);
798 
799 	label = aa_get_newest_label(ctx->label);
800 
801 	/* buffer freed below, name is pointer into buffer */
802 	get_buffers(buffer);
803 	/* Test for onexec first as onexec override other x transitions. */
804 	if (ctx->onexec)
805 		new = handle_onexec(label, ctx->onexec, ctx->token,
806 				    bprm, buffer, &cond, &unsafe);
807 	else
808 		new = fn_label_build(label, profile, GFP_ATOMIC,
809 				profile_transition(profile, bprm, buffer,
810 						   &cond, &unsafe));
811 
812 	AA_BUG(!new);
813 	if (IS_ERR(new)) {
814 		error = PTR_ERR(new);
815 		goto done;
816 	} else if (!new) {
817 		error = -ENOMEM;
818 		goto done;
819 	}
820 
821 	/* TODO: Add ns level no_new_privs subset test */
822 
823 	if (bprm->unsafe & LSM_UNSAFE_SHARE) {
824 		/* FIXME: currently don't mediate shared state */
825 		;
826 	}
827 
828 	if (bprm->unsafe & (LSM_UNSAFE_PTRACE)) {
829 		/* TODO: test needs to be profile of label to new */
830 		error = may_change_ptraced_domain(new, &info);
831 		if (error)
832 			goto audit;
833 	}
834 
835 	if (unsafe) {
836 		if (DEBUG_ON) {
837 			dbg_printk("scrubbing environment variables for %s "
838 				   "label=", bprm->filename);
839 			aa_label_printk(new, GFP_ATOMIC);
840 			dbg_printk("\n");
841 		}
842 		bprm->secureexec = 1;
843 	}
844 
845 	if (label->proxy != new->proxy) {
846 		/* when transitioning clear unsafe personality bits */
847 		if (DEBUG_ON) {
848 			dbg_printk("apparmor: clearing unsafe personality "
849 				   "bits. %s label=", bprm->filename);
850 			aa_label_printk(new, GFP_ATOMIC);
851 			dbg_printk("\n");
852 		}
853 		bprm->per_clear |= PER_CLEAR_ON_SETID;
854 	}
855 	aa_put_label(ctx->label);
856 	/* transfer reference, released when ctx is freed */
857 	ctx->label = new;
858 
859 done:
860 	/* clear out temporary/transitional state from the context */
861 	aa_clear_task_ctx_trans(ctx);
862 
863 	aa_put_label(label);
864 	put_buffers(buffer);
865 
866 	return error;
867 
868 audit:
869 	error = fn_for_each(label, profile,
870 			aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,
871 				      bprm->filename, NULL, new,
872 				      file_inode(bprm->file)->i_uid, info,
873 				      error));
874 	aa_put_label(new);
875 	goto done;
876 }
877 
878 /*
879  * Functions for self directed profile change
880  */
881 
882 
883 /* helper fn for change_hat
884  *
885  * Returns: label for hat transition OR ERR_PTR.  Does NOT return NULL
886  */
887 static struct aa_label *build_change_hat(struct aa_profile *profile,
888 					 const char *name, bool sibling)
889 {
890 	struct aa_profile *root, *hat = NULL;
891 	const char *info = NULL;
892 	int error = 0;
893 
894 	if (sibling && PROFILE_IS_HAT(profile)) {
895 		root = aa_get_profile_rcu(&profile->parent);
896 	} else if (!sibling && !PROFILE_IS_HAT(profile)) {
897 		root = aa_get_profile(profile);
898 	} else {
899 		info = "conflicting target types";
900 		error = -EPERM;
901 		goto audit;
902 	}
903 
904 	hat = aa_find_child(root, name);
905 	if (!hat) {
906 		error = -ENOENT;
907 		if (COMPLAIN_MODE(profile)) {
908 			hat = aa_new_null_profile(profile, true, name,
909 						  GFP_KERNEL);
910 			if (!hat) {
911 				info = "failed null profile create";
912 				error = -ENOMEM;
913 			}
914 		}
915 	}
916 	aa_put_profile(root);
917 
918 audit:
919 	aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, AA_MAY_CHANGEHAT,
920 		      name, hat ? hat->base.hname : NULL,
921 		      hat ? &hat->label : NULL, GLOBAL_ROOT_UID, NULL,
922 		      error);
923 	if (!hat || (error && error != -ENOENT))
924 		return ERR_PTR(error);
925 	/* if hat && error - complain mode, already audited and we adjust for
926 	 * complain mode allow by returning hat->label
927 	 */
928 	return &hat->label;
929 }
930 
931 /* helper fn for changing into a hat
932  *
933  * Returns: label for hat transition or ERR_PTR. Does not return NULL
934  */
935 static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
936 				   int count, int flags)
937 {
938 	struct aa_profile *profile, *root, *hat = NULL;
939 	struct aa_label *new;
940 	struct label_it it;
941 	bool sibling = false;
942 	const char *name, *info = NULL;
943 	int i, error;
944 
945 	AA_BUG(!label);
946 	AA_BUG(!hats);
947 	AA_BUG(count < 1);
948 
949 	if (PROFILE_IS_HAT(labels_profile(label)))
950 		sibling = true;
951 
952 	/*find first matching hat */
953 	for (i = 0; i < count && !hat; i++) {
954 		name = hats[i];
955 		label_for_each_in_ns(it, labels_ns(label), label, profile) {
956 			if (sibling && PROFILE_IS_HAT(profile)) {
957 				root = aa_get_profile_rcu(&profile->parent);
958 			} else if (!sibling && !PROFILE_IS_HAT(profile)) {
959 				root = aa_get_profile(profile);
960 			} else {	/* conflicting change type */
961 				info = "conflicting targets types";
962 				error = -EPERM;
963 				goto fail;
964 			}
965 			hat = aa_find_child(root, name);
966 			aa_put_profile(root);
967 			if (!hat) {
968 				if (!COMPLAIN_MODE(profile))
969 					goto outer_continue;
970 				/* complain mode succeed as if hat */
971 			} else if (!PROFILE_IS_HAT(hat)) {
972 				info = "target not hat";
973 				error = -EPERM;
974 				aa_put_profile(hat);
975 				goto fail;
976 			}
977 			aa_put_profile(hat);
978 		}
979 		/* found a hat for all profiles in ns */
980 		goto build;
981 outer_continue:
982 	;
983 	}
984 	/* no hats that match, find appropriate error
985 	 *
986 	 * In complain mode audit of the failure is based off of the first
987 	 * hat supplied.  This is done due how userspace interacts with
988 	 * change_hat.
989 	 */
990 	name = NULL;
991 	label_for_each_in_ns(it, labels_ns(label), label, profile) {
992 		if (!list_empty(&profile->base.profiles)) {
993 			info = "hat not found";
994 			error = -ENOENT;
995 			goto fail;
996 		}
997 	}
998 	info = "no hats defined";
999 	error = -ECHILD;
1000 
1001 fail:
1002 	label_for_each_in_ns(it, labels_ns(label), label, profile) {
1003 		/*
1004 		 * no target as it has failed to be found or built
1005 		 *
1006 		 * change_hat uses probing and should not log failures
1007 		 * related to missing hats
1008 		 */
1009 		/* TODO: get rid of GLOBAL_ROOT_UID */
1010 		if (count > 1 || COMPLAIN_MODE(profile)) {
1011 			aa_audit_file(profile, &nullperms, OP_CHANGE_HAT,
1012 				      AA_MAY_CHANGEHAT, name, NULL, NULL,
1013 				      GLOBAL_ROOT_UID, info, error);
1014 		}
1015 	}
1016 	return ERR_PTR(error);
1017 
1018 build:
1019 	new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
1020 				   build_change_hat(profile, name, sibling),
1021 				   aa_get_label(&profile->label));
1022 	if (!new) {
1023 		info = "label build failed";
1024 		error = -ENOMEM;
1025 		goto fail;
1026 	} /* else if (IS_ERR) build_change_hat has logged error so return new */
1027 
1028 	return new;
1029 }
1030 
1031 /**
1032  * aa_change_hat - change hat to/from subprofile
1033  * @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0)
1034  * @count: number of hat names in @hats
1035  * @token: magic value to validate the hat change
1036  * @flags: flags affecting behavior of the change
1037  *
1038  * Returns %0 on success, error otherwise.
1039  *
1040  * Change to the first profile specified in @hats that exists, and store
1041  * the @hat_magic in the current task context.  If the count == 0 and the
1042  * @token matches that stored in the current task context, return to the
1043  * top level profile.
1044  *
1045  * change_hat only applies to profiles in the current ns, and each profile
1046  * in the ns must make the same transition otherwise change_hat will fail.
1047  */
1048 int aa_change_hat(const char *hats[], int count, u64 token, int flags)
1049 {
1050 	const struct cred *cred;
1051 	struct aa_task_ctx *ctx;
1052 	struct aa_label *label, *previous, *new = NULL, *target = NULL;
1053 	struct aa_profile *profile;
1054 	struct aa_perms perms = {};
1055 	const char *info = NULL;
1056 	int error = 0;
1057 
1058 	/*
1059 	 * Fail explicitly requested domain transitions if no_new_privs.
1060 	 * There is no exception for unconfined as change_hat is not
1061 	 * available.
1062 	 */
1063 	if (task_no_new_privs(current)) {
1064 		/* not an apparmor denial per se, so don't log it */
1065 		AA_DEBUG("no_new_privs - change_hat denied");
1066 		return -EPERM;
1067 	}
1068 
1069 	/* released below */
1070 	cred = get_current_cred();
1071 	ctx = cred_ctx(cred);
1072 	label = aa_get_newest_cred_label(cred);
1073 	previous = aa_get_newest_label(ctx->previous);
1074 
1075 	if (unconfined(label)) {
1076 		info = "unconfined can not change_hat";
1077 		error = -EPERM;
1078 		goto fail;
1079 	}
1080 
1081 	if (count) {
1082 		new = change_hat(label, hats, count, flags);
1083 		AA_BUG(!new);
1084 		if (IS_ERR(new)) {
1085 			error = PTR_ERR(new);
1086 			new = NULL;
1087 			/* already audited */
1088 			goto out;
1089 		}
1090 
1091 		error = may_change_ptraced_domain(new, &info);
1092 		if (error)
1093 			goto fail;
1094 
1095 		if (flags & AA_CHANGE_TEST)
1096 			goto out;
1097 
1098 		target = new;
1099 		error = aa_set_current_hat(new, token);
1100 		if (error == -EACCES)
1101 			/* kill task in case of brute force attacks */
1102 			goto kill;
1103 	} else if (previous && !(flags & AA_CHANGE_TEST)) {
1104 		/* Return to saved label.  Kill task if restore fails
1105 		 * to avoid brute force attacks
1106 		 */
1107 		target = previous;
1108 		error = aa_restore_previous_label(token);
1109 		if (error) {
1110 			if (error == -EACCES)
1111 				goto kill;
1112 			goto fail;
1113 		}
1114 	} /* else ignore @flags && restores when there is no saved profile */
1115 
1116 out:
1117 	aa_put_label(new);
1118 	aa_put_label(previous);
1119 	aa_put_label(label);
1120 	put_cred(cred);
1121 
1122 	return error;
1123 
1124 kill:
1125 	info = "failed token match";
1126 	perms.kill = AA_MAY_CHANGEHAT;
1127 
1128 fail:
1129 	fn_for_each_in_ns(label, profile,
1130 		aa_audit_file(profile, &perms, OP_CHANGE_HAT,
1131 			      AA_MAY_CHANGEHAT, NULL, NULL, target,
1132 			      GLOBAL_ROOT_UID, info, error));
1133 
1134 	goto out;
1135 }
1136 
1137 
1138 static int change_profile_perms_wrapper(const char *op, const char *name,
1139 					struct aa_profile *profile,
1140 					struct aa_label *target, bool stack,
1141 					u32 request, struct aa_perms *perms)
1142 {
1143 	const char *info = NULL;
1144 	int error = 0;
1145 
1146 	/*
1147 	 * Fail explicitly requested domain transitions when no_new_privs
1148 	 * and not unconfined OR the transition results in a stack on
1149 	 * the current label.
1150 	 * Stacking domain transitions and transitions from unconfined are
1151 	 * allowed even when no_new_privs is set because this aways results
1152 	 * in a reduction of permissions.
1153 	 */
1154 	if (task_no_new_privs(current) && !stack &&
1155 	    !profile_unconfined(profile) &&
1156 	    !aa_label_is_subset(target, &profile->label)) {
1157 		info = "no new privs";
1158 		error = -EPERM;
1159 	}
1160 
1161 	if (!error)
1162 		error = change_profile_perms(profile, target, stack, request,
1163 					     profile->file.start, perms);
1164 	if (error)
1165 		error = aa_audit_file(profile, perms, op, request, name,
1166 				      NULL, target, GLOBAL_ROOT_UID, info,
1167 				      error);
1168 
1169 	return error;
1170 }
1171 
1172 /**
1173  * aa_change_profile - perform a one-way profile transition
1174  * @fqname: name of profile may include namespace (NOT NULL)
1175  * @onexec: whether this transition is to take place immediately or at exec
1176  * @flags: flags affecting change behavior
1177  *
1178  * Change to new profile @name.  Unlike with hats, there is no way
1179  * to change back.  If @name isn't specified the current profile name is
1180  * used.
1181  * If @onexec then the transition is delayed until
1182  * the next exec.
1183  *
1184  * Returns %0 on success, error otherwise.
1185  */
1186 int aa_change_profile(const char *fqname, int flags)
1187 {
1188 	struct aa_label *label, *new = NULL, *target = NULL;
1189 	struct aa_profile *profile;
1190 	struct aa_perms perms = {};
1191 	const char *info = NULL;
1192 	const char *auditname = fqname;		/* retain leading & if stack */
1193 	bool stack = flags & AA_CHANGE_STACK;
1194 	int error = 0;
1195 	char *op;
1196 	u32 request;
1197 
1198 	if (!fqname || !*fqname) {
1199 		AA_DEBUG("no profile name");
1200 		return -EINVAL;
1201 	}
1202 
1203 	if (flags & AA_CHANGE_ONEXEC) {
1204 		request = AA_MAY_ONEXEC;
1205 		if (stack)
1206 			op = OP_STACK_ONEXEC;
1207 		else
1208 			op = OP_CHANGE_ONEXEC;
1209 	} else {
1210 		request = AA_MAY_CHANGE_PROFILE;
1211 		if (stack)
1212 			op = OP_STACK;
1213 		else
1214 			op = OP_CHANGE_PROFILE;
1215 	}
1216 
1217 	label = aa_get_current_label();
1218 
1219 	if (*fqname == '&') {
1220 		stack = true;
1221 		/* don't have label_parse() do stacking */
1222 		fqname++;
1223 	}
1224 	target = aa_label_parse(label, fqname, GFP_KERNEL, true, false);
1225 	if (IS_ERR(target)) {
1226 		struct aa_profile *tprofile;
1227 
1228 		info = "label not found";
1229 		error = PTR_ERR(target);
1230 		target = NULL;
1231 		/*
1232 		 * TODO: fixme using labels_profile is not right - do profile
1233 		 * per complain profile
1234 		 */
1235 		if ((flags & AA_CHANGE_TEST) ||
1236 		    !COMPLAIN_MODE(labels_profile(label)))
1237 			goto audit;
1238 		/* released below */
1239 		tprofile = aa_new_null_profile(labels_profile(label), false,
1240 					       fqname, GFP_KERNEL);
1241 		if (!tprofile) {
1242 			info = "failed null profile create";
1243 			error = -ENOMEM;
1244 			goto audit;
1245 		}
1246 		target = &tprofile->label;
1247 		goto check;
1248 	}
1249 
1250 	/*
1251 	 * self directed transitions only apply to current policy ns
1252 	 * TODO: currently requiring perms for stacking and straight change
1253 	 *       stacking doesn't strictly need this. Determine how much
1254 	 *       we want to loosen this restriction for stacking
1255 	 *
1256 	 * if (!stack) {
1257 	 */
1258 	error = fn_for_each_in_ns(label, profile,
1259 			change_profile_perms_wrapper(op, auditname,
1260 						     profile, target, stack,
1261 						     request, &perms));
1262 	if (error)
1263 		/* auditing done in change_profile_perms_wrapper */
1264 		goto out;
1265 
1266 	/* } */
1267 
1268 check:
1269 	/* check if tracing task is allowed to trace target domain */
1270 	error = may_change_ptraced_domain(target, &info);
1271 	if (error && !fn_for_each_in_ns(label, profile,
1272 					COMPLAIN_MODE(profile)))
1273 		goto audit;
1274 
1275 	/* TODO: add permission check to allow this
1276 	 * if ((flags & AA_CHANGE_ONEXEC) && !current_is_single_threaded()) {
1277 	 *      info = "not a single threaded task";
1278 	 *      error = -EACCES;
1279 	 *      goto audit;
1280 	 * }
1281 	 */
1282 	if (flags & AA_CHANGE_TEST)
1283 		goto out;
1284 
1285 	if (!(flags & AA_CHANGE_ONEXEC)) {
1286 		/* only transition profiles in the current ns */
1287 		if (stack)
1288 			new = aa_label_merge(label, target, GFP_KERNEL);
1289 		else
1290 			new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
1291 					aa_get_label(target),
1292 					aa_get_label(&profile->label));
1293 		if (IS_ERR_OR_NULL(new)) {
1294 			info = "failed to build target label";
1295 			error = PTR_ERR(new);
1296 			new = NULL;
1297 			perms.allow = 0;
1298 			goto audit;
1299 		}
1300 		error = aa_replace_current_label(new);
1301 	} else
1302 		/* full transition will be built in exec path */
1303 		error = aa_set_current_onexec(target, stack);
1304 
1305 audit:
1306 	error = fn_for_each_in_ns(label, profile,
1307 			aa_audit_file(profile, &perms, op, request, auditname,
1308 				      NULL, new ? new : target,
1309 				      GLOBAL_ROOT_UID, info, error));
1310 
1311 out:
1312 	aa_put_label(new);
1313 	aa_put_label(target);
1314 	aa_put_label(label);
1315 
1316 	return error;
1317 }
1318