1b886d83cSThomas Gleixner /* SPDX-License-Identifier: GPL-2.0-only */
256974a6fSJohn Johansen /*
356974a6fSJohn Johansen * AppArmor security module
456974a6fSJohn Johansen *
556974a6fSJohn Johansen * This file contains AppArmor network mediation definitions.
656974a6fSJohn Johansen *
756974a6fSJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE
856974a6fSJohn Johansen * Copyright 2009-2017 Canonical Ltd.
956974a6fSJohn Johansen */
1056974a6fSJohn Johansen
1156974a6fSJohn Johansen #ifndef __AA_NET_H
1256974a6fSJohn Johansen #define __AA_NET_H
1356974a6fSJohn Johansen
1456974a6fSJohn Johansen #include <net/sock.h>
1556974a6fSJohn Johansen #include <linux/path.h>
1656974a6fSJohn Johansen
1756974a6fSJohn Johansen #include "apparmorfs.h"
1856974a6fSJohn Johansen #include "label.h"
1956974a6fSJohn Johansen #include "perms.h"
2056974a6fSJohn Johansen #include "policy.h"
2156974a6fSJohn Johansen
2256974a6fSJohn Johansen #define AA_MAY_SEND AA_MAY_WRITE
2356974a6fSJohn Johansen #define AA_MAY_RECEIVE AA_MAY_READ
2456974a6fSJohn Johansen
2556974a6fSJohn Johansen #define AA_MAY_SHUTDOWN AA_MAY_DELETE
2656974a6fSJohn Johansen
2756974a6fSJohn Johansen #define AA_MAY_CONNECT AA_MAY_OPEN
2856974a6fSJohn Johansen #define AA_MAY_ACCEPT 0x00100000
2956974a6fSJohn Johansen
3056974a6fSJohn Johansen #define AA_MAY_BIND 0x00200000
3156974a6fSJohn Johansen #define AA_MAY_LISTEN 0x00400000
3256974a6fSJohn Johansen
3356974a6fSJohn Johansen #define AA_MAY_SETOPT 0x01000000
3456974a6fSJohn Johansen #define AA_MAY_GETOPT 0x02000000
3556974a6fSJohn Johansen
3656974a6fSJohn Johansen #define NET_PERMS_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE | \
3756974a6fSJohn Johansen AA_MAY_SHUTDOWN | AA_MAY_BIND | AA_MAY_LISTEN | \
3856974a6fSJohn Johansen AA_MAY_CONNECT | AA_MAY_ACCEPT | AA_MAY_SETATTR | \
3956974a6fSJohn Johansen AA_MAY_GETATTR | AA_MAY_SETOPT | AA_MAY_GETOPT)
4056974a6fSJohn Johansen
4156974a6fSJohn Johansen #define NET_FS_PERMS (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE | \
4256974a6fSJohn Johansen AA_MAY_SHUTDOWN | AA_MAY_CONNECT | AA_MAY_RENAME |\
4356974a6fSJohn Johansen AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_CHMOD | \
4456974a6fSJohn Johansen AA_MAY_CHOWN | AA_MAY_CHGRP | AA_MAY_LOCK | \
4556974a6fSJohn Johansen AA_MAY_MPROT)
4656974a6fSJohn Johansen
4756974a6fSJohn Johansen #define NET_PEER_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CONNECT | \
4856974a6fSJohn Johansen AA_MAY_ACCEPT)
4956974a6fSJohn Johansen struct aa_sk_ctx {
5056974a6fSJohn Johansen struct aa_label *label;
5156974a6fSJohn Johansen struct aa_label *peer;
5256974a6fSJohn Johansen };
5356974a6fSJohn Johansen
5456974a6fSJohn Johansen #define SK_CTX(X) ((X)->sk_security)
5556974a6fSJohn Johansen #define SOCK_ctx(X) SOCK_INODE(X)->i_security
5656974a6fSJohn Johansen #define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P) \
5756974a6fSJohn Johansen struct lsm_network_audit NAME ## _net = { .sk = (SK), \
5856974a6fSJohn Johansen .family = (F)}; \
5956974a6fSJohn Johansen DEFINE_AUDIT_DATA(NAME, \
6056974a6fSJohn Johansen ((SK) && (F) != AF_UNIX) ? LSM_AUDIT_DATA_NET : \
6156974a6fSJohn Johansen LSM_AUDIT_DATA_NONE, \
628c4b785aSJohn Johansen AA_CLASS_NET, \
6356974a6fSJohn Johansen OP); \
64c57bc80fSJohn Johansen NAME.common.u.net = &(NAME ## _net); \
65c57bc80fSJohn Johansen NAME.net.type = (T); \
66c57bc80fSJohn Johansen NAME.net.protocol = (P)
6756974a6fSJohn Johansen
6856974a6fSJohn Johansen #define DEFINE_AUDIT_SK(NAME, OP, SK) \
6956974a6fSJohn Johansen DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type, \
7056974a6fSJohn Johansen (SK)->sk_protocol)
7156974a6fSJohn Johansen
7256974a6fSJohn Johansen
7356974a6fSJohn Johansen #define af_select(FAMILY, FN, DEF_FN) \
7456974a6fSJohn Johansen ({ \
7556974a6fSJohn Johansen int __e; \
7656974a6fSJohn Johansen switch ((FAMILY)) { \
7756974a6fSJohn Johansen default: \
7856974a6fSJohn Johansen __e = DEF_FN; \
7956974a6fSJohn Johansen } \
8056974a6fSJohn Johansen __e; \
8156974a6fSJohn Johansen })
8256974a6fSJohn Johansen
839caafbe2SMatthew Garrett struct aa_secmark {
849caafbe2SMatthew Garrett u8 audit;
859caafbe2SMatthew Garrett u8 deny;
869caafbe2SMatthew Garrett u32 secid;
879caafbe2SMatthew Garrett char *label;
889caafbe2SMatthew Garrett };
899caafbe2SMatthew Garrett
9056974a6fSJohn Johansen extern struct aa_sfs_entry aa_sfs_entry_network[];
9156974a6fSJohn Johansen
9256974a6fSJohn Johansen void audit_net_cb(struct audit_buffer *ab, void *va);
93c57bc80fSJohn Johansen int aa_profile_af_perm(struct aa_profile *profile,
94c57bc80fSJohn Johansen struct apparmor_audit_data *ad,
9556974a6fSJohn Johansen u32 request, u16 family, int type);
96*690f33e1SJohn Johansen int aa_af_perm(const struct cred *subj_cred, struct aa_label *label,
97*690f33e1SJohn Johansen const char *op, u32 request, u16 family,
9856974a6fSJohn Johansen int type, int protocol);
aa_profile_af_sk_perm(struct aa_profile * profile,struct apparmor_audit_data * ad,u32 request,struct sock * sk)9956974a6fSJohn Johansen static inline int aa_profile_af_sk_perm(struct aa_profile *profile,
100c57bc80fSJohn Johansen struct apparmor_audit_data *ad,
10156974a6fSJohn Johansen u32 request,
10256974a6fSJohn Johansen struct sock *sk)
10356974a6fSJohn Johansen {
104c57bc80fSJohn Johansen return aa_profile_af_perm(profile, ad, request, sk->sk_family,
10556974a6fSJohn Johansen sk->sk_type);
10656974a6fSJohn Johansen }
10756974a6fSJohn Johansen int aa_sk_perm(const char *op, u32 request, struct sock *sk);
10856974a6fSJohn Johansen
109*690f33e1SJohn Johansen int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label,
110*690f33e1SJohn Johansen const char *op, u32 request,
11156974a6fSJohn Johansen struct socket *sock);
11256974a6fSJohn Johansen
1139caafbe2SMatthew Garrett int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
11441dd9596SFlorian Westphal u32 secid, const struct sock *sk);
1159caafbe2SMatthew Garrett
11656974a6fSJohn Johansen #endif /* __AA_NET_H */
117