1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor basic permission sets definitions.
5  *
6  * Copyright 2017 Canonical Ltd.
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License as
10  * published by the Free Software Foundation, version 2 of the
11  * License.
12  */
13 
14 #ifndef __AA_PERM_H
15 #define __AA_PERM_H
16 
17 #include <linux/fs.h>
18 #include "label.h"
19 
20 #define AA_MAY_EXEC		MAY_EXEC
21 #define AA_MAY_WRITE		MAY_WRITE
22 #define AA_MAY_READ		MAY_READ
23 #define AA_MAY_APPEND		MAY_APPEND
24 
25 #define AA_MAY_CREATE		0x0010
26 #define AA_MAY_DELETE		0x0020
27 #define AA_MAY_OPEN		0x0040
28 #define AA_MAY_RENAME		0x0080		/* pair */
29 
30 #define AA_MAY_SETATTR		0x0100		/* meta write */
31 #define AA_MAY_GETATTR		0x0200		/* meta read */
32 #define AA_MAY_SETCRED		0x0400		/* security cred/attr */
33 #define AA_MAY_GETCRED		0x0800
34 
35 #define AA_MAY_CHMOD		0x1000		/* pair */
36 #define AA_MAY_CHOWN		0x2000		/* pair */
37 #define AA_MAY_CHGRP		0x4000		/* pair */
38 #define AA_MAY_LOCK		0x8000		/* LINK_SUBSET overlaid */
39 
40 #define AA_EXEC_MMAP		0x00010000
41 #define AA_MAY_MPROT		0x00020000	/* extend conditions */
42 #define AA_MAY_LINK		0x00040000	/* pair */
43 #define AA_MAY_SNAPSHOT		0x00080000	/* pair */
44 
45 #define AA_MAY_DELEGATE
46 #define AA_CONT_MATCH		0x08000000
47 
48 #define AA_MAY_STACK		0x10000000
49 #define AA_MAY_ONEXEC		0x20000000 /* either stack or change_profile */
50 #define AA_MAY_CHANGE_PROFILE	0x40000000
51 #define AA_MAY_CHANGEHAT	0x80000000
52 
53 #define AA_LINK_SUBSET		AA_MAY_LOCK	/* overlaid */
54 
55 
56 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |		\
57 			 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |	\
58 			 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
59 
60 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
61 			  AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
62 			  AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
63 			  AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
64 			  AA_MAY_STACK | AA_MAY_ONEXEC |		\
65 			  AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
66 
67 extern const char aa_file_perm_chrs[];
68 extern const char *aa_file_perm_names[];
69 
70 struct aa_perms {
71 	u32 allow;
72 	u32 audit;	/* set only when allow is set */
73 
74 	u32 deny;	/* explicit deny, or conflict if allow also set */
75 	u32 quiet;	/* set only when ~allow | deny */
76 	u32 kill;	/* set only when ~allow | deny */
77 	u32 stop;	/* set only when ~allow | deny */
78 
79 	u32 complain;	/* accumulates only used when ~allow & ~deny */
80 	u32 cond;	/* set only when ~allow and ~deny */
81 
82 	u32 hide;	/* set only when  ~allow | deny */
83 	u32 prompt;	/* accumulates only used when ~allow & ~deny */
84 
85 	/* Reserved:
86 	 * u32 subtree;	/ * set only when allow is set * /
87 	 */
88 	u16 xindex;
89 };
90 
91 #define ALL_PERMS_MASK 0xffffffff
92 extern struct aa_perms nullperms;
93 extern struct aa_perms allperms;
94 
95 
96 #define xcheck(FN1, FN2)	\
97 ({				\
98 	int e, error = FN1;	\
99 	e = FN2;		\
100 	if (e)			\
101 		error = e;	\
102 	error;			\
103 })
104 
105 
106 /*
107  * TODO: update for labels pointing to labels instead of profiles
108  * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
109  * gah this doesn't allow for label compound check!!!!
110  */
111 #define xcheck_ns_profile_profile(P1, P2, FN, args...)		\
112 ({								\
113 	int ____e = 0;						\
114 	if (P1->ns == P2->ns)					\
115 		____e = FN((P1), (P2), args);			\
116 	(____e);						\
117 })
118 
119 #define xcheck_ns_profile_label(P, L, FN, args...)		\
120 ({								\
121 	struct aa_profile *__p2;				\
122 	fn_for_each((L), __p2,					\
123 		    xcheck_ns_profile_profile((P), __p2, (FN), args));	\
124 })
125 
126 #define xcheck_ns_labels(L1, L2, FN, args...)			\
127 ({								\
128 	struct aa_profile *__p1;				\
129 	fn_for_each((L1), __p1, FN(__p1, (L2), args));		\
130 })
131 
132 /* Do the cross check but applying FN at the profiles level */
133 #define xcheck_labels_profiles(L1, L2, FN, args...)		\
134 	xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
135 
136 #define xcheck_labels(L1, L2, P, FN1, FN2)			\
137 	xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
138 
139 
140 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs,
141 			 u32 mask);
142 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
143 			 u32 mask);
144 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
145 			u32 chrsmask, const char * const *names, u32 namesmask);
146 void aa_apply_modes_to_perms(struct aa_profile *profile,
147 			     struct aa_perms *perms);
148 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
149 		      struct aa_perms *perms);
150 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
151 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
152 void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
153 			    int type, u32 request, struct aa_perms *perms);
154 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
155 			  u32 request, int type, u32 *deny,
156 			  struct common_audit_data *sa);
157 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
158 		   u32 request, struct common_audit_data *sa,
159 		   void (*cb)(struct audit_buffer *, void *));
160 #endif /* __AA_PERM_H */
161