1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor basic permission sets definitions.
6  *
7  * Copyright 2017 Canonical Ltd.
8  */
9 
10 #ifndef __AA_PERM_H
11 #define __AA_PERM_H
12 
13 #include <linux/fs.h>
14 #include "label.h"
15 
16 #define AA_MAY_EXEC		MAY_EXEC
17 #define AA_MAY_WRITE		MAY_WRITE
18 #define AA_MAY_READ		MAY_READ
19 #define AA_MAY_APPEND		MAY_APPEND
20 
21 #define AA_MAY_CREATE		0x0010
22 #define AA_MAY_DELETE		0x0020
23 #define AA_MAY_OPEN		0x0040
24 #define AA_MAY_RENAME		0x0080		/* pair */
25 
26 #define AA_MAY_SETATTR		0x0100		/* meta write */
27 #define AA_MAY_GETATTR		0x0200		/* meta read */
28 #define AA_MAY_SETCRED		0x0400		/* security cred/attr */
29 #define AA_MAY_GETCRED		0x0800
30 
31 #define AA_MAY_CHMOD		0x1000		/* pair */
32 #define AA_MAY_CHOWN		0x2000		/* pair */
33 #define AA_MAY_CHGRP		0x4000		/* pair */
34 #define AA_MAY_LOCK		0x8000		/* LINK_SUBSET overlaid */
35 
36 #define AA_EXEC_MMAP		0x00010000
37 #define AA_MAY_MPROT		0x00020000	/* extend conditions */
38 #define AA_MAY_LINK		0x00040000	/* pair */
39 #define AA_MAY_SNAPSHOT		0x00080000	/* pair */
40 
41 #define AA_MAY_DELEGATE
42 #define AA_CONT_MATCH		0x08000000
43 
44 #define AA_MAY_STACK		0x10000000
45 #define AA_MAY_ONEXEC		0x20000000 /* either stack or change_profile */
46 #define AA_MAY_CHANGE_PROFILE	0x40000000
47 #define AA_MAY_CHANGEHAT	0x80000000
48 
49 #define AA_LINK_SUBSET		AA_MAY_LOCK	/* overlaid */
50 
51 
52 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |		\
53 			 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |	\
54 			 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
55 
56 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
57 			  AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
58 			  AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
59 			  AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
60 			  AA_MAY_STACK | AA_MAY_ONEXEC |		\
61 			  AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
62 
63 extern const char aa_file_perm_chrs[];
64 extern const char *aa_file_perm_names[];
65 
66 struct aa_perms {
67 	u32 allow;
68 	u32 deny;	/* explicit deny, or conflict if allow also set */
69 
70 	u32 subtree;	/* allow perm on full subtree only when allow is set */
71 	u32 cond;	/* set only when ~allow and ~deny */
72 
73 	u32 kill;	/* set only when ~allow | deny */
74 	u32 complain;	/* accumulates only used when ~allow & ~deny */
75 	u32 prompt;	/* accumulates only used when ~allow & ~deny */
76 
77 	u32 audit;	/* set only when allow is set */
78 	u32 quiet;	/* set only when ~allow | deny */
79 	u32 hide;	/* set only when  ~allow | deny */
80 
81 
82 	u32 xindex;
83 	u32 tag;	/* tag string index, if present */
84 	u32 label;	/* label string index, if present */
85 };
86 
87 /*
88  * Indexes are broken into a 24 bit index and 8 bit flag.
89  * For the index to be valid there must be a value in the flag
90  */
91 #define AA_INDEX_MASK			0x00ffffff
92 #define AA_INDEX_FLAG_MASK		0xff000000
93 #define AA_INDEX_NONE			0
94 
95 #define ALL_PERMS_MASK 0xffffffff
96 extern struct aa_perms nullperms;
97 extern struct aa_perms allperms;
98 
99 /**
100  * aa_perms_accum_raw - accumulate perms with out masking off overlapping perms
101  * @accum - perms struct to accumulate into
102  * @addend - perms struct to add to @accum
103  */
104 static inline void aa_perms_accum_raw(struct aa_perms *accum,
105 				      struct aa_perms *addend)
106 {
107 	accum->deny |= addend->deny;
108 	accum->allow &= addend->allow & ~addend->deny;
109 	accum->audit |= addend->audit & addend->allow;
110 	accum->quiet &= addend->quiet & ~addend->allow;
111 	accum->kill |= addend->kill & ~addend->allow;
112 	accum->complain |= addend->complain & ~addend->allow & ~addend->deny;
113 	accum->cond |= addend->cond & ~addend->allow & ~addend->deny;
114 	accum->hide &= addend->hide & ~addend->allow;
115 	accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny;
116 	accum->subtree |= addend->subtree & ~addend->deny;
117 
118 	if (!accum->xindex)
119 		accum->xindex = addend->xindex;
120 	if (!accum->tag)
121 		accum->tag = addend->tag;
122 	if (!accum->label)
123 		accum->label = addend->label;
124 }
125 
126 /**
127  * aa_perms_accum - accumulate perms, masking off overlapping perms
128  * @accum - perms struct to accumulate into
129  * @addend - perms struct to add to @accum
130  */
131 static inline void aa_perms_accum(struct aa_perms *accum,
132 				  struct aa_perms *addend)
133 {
134 	accum->deny |= addend->deny;
135 	accum->allow &= addend->allow & ~accum->deny;
136 	accum->audit |= addend->audit & accum->allow;
137 	accum->quiet &= addend->quiet & ~accum->allow;
138 	accum->kill |= addend->kill & ~accum->allow;
139 	accum->complain |= addend->complain & ~accum->allow & ~accum->deny;
140 	accum->cond |= addend->cond & ~accum->allow & ~accum->deny;
141 	accum->hide &= addend->hide & ~accum->allow;
142 	accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny;
143 	accum->subtree &= addend->subtree & ~accum->deny;
144 
145 	if (!accum->xindex)
146 		accum->xindex = addend->xindex;
147 	if (!accum->tag)
148 		accum->tag = addend->tag;
149 	if (!accum->label)
150 		accum->label = addend->label;
151 }
152 
153 #define xcheck(FN1, FN2)	\
154 ({				\
155 	int e, error = FN1;	\
156 	e = FN2;		\
157 	if (e)			\
158 		error = e;	\
159 	error;			\
160 })
161 
162 
163 /*
164  * TODO: update for labels pointing to labels instead of profiles
165  * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
166  * gah this doesn't allow for label compound check!!!!
167  */
168 #define xcheck_ns_profile_profile(P1, P2, FN, args...)		\
169 ({								\
170 	int ____e = 0;						\
171 	if (P1->ns == P2->ns)					\
172 		____e = FN((P1), (P2), args);			\
173 	(____e);						\
174 })
175 
176 #define xcheck_ns_profile_label(P, L, FN, args...)		\
177 ({								\
178 	struct aa_profile *__p2;				\
179 	fn_for_each((L), __p2,					\
180 		    xcheck_ns_profile_profile((P), __p2, (FN), args));	\
181 })
182 
183 #define xcheck_ns_labels(L1, L2, FN, args...)			\
184 ({								\
185 	struct aa_profile *__p1;				\
186 	fn_for_each((L1), __p1, FN(__p1, (L2), args));		\
187 })
188 
189 /* Do the cross check but applying FN at the profiles level */
190 #define xcheck_labels_profiles(L1, L2, FN, args...)		\
191 	xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
192 
193 #define xcheck_labels(L1, L2, P, FN1, FN2)			\
194 	xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
195 
196 
197 extern struct aa_perms default_perms;
198 
199 
200 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs,
201 			 u32 mask);
202 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
203 			 u32 mask);
204 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
205 			u32 chrsmask, const char * const *names, u32 namesmask);
206 void aa_apply_modes_to_perms(struct aa_profile *profile,
207 			     struct aa_perms *perms);
208 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
209 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
210 void aa_profile_match_label(struct aa_profile *profile,
211 			    struct aa_ruleset *rules, struct aa_label *label,
212 			    int type, u32 request, struct aa_perms *perms);
213 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
214 			  u32 request, int type, u32 *deny,
215 			  struct common_audit_data *sa);
216 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
217 		   u32 request, struct common_audit_data *sa,
218 		   void (*cb)(struct audit_buffer *, void *));
219 #endif /* __AA_PERM_H */
220