1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor basic permission sets definitions. 6 * 7 * Copyright 2017 Canonical Ltd. 8 */ 9 10 #ifndef __AA_PERM_H 11 #define __AA_PERM_H 12 13 #include <linux/fs.h> 14 #include "label.h" 15 16 #define AA_MAY_EXEC MAY_EXEC 17 #define AA_MAY_WRITE MAY_WRITE 18 #define AA_MAY_READ MAY_READ 19 #define AA_MAY_APPEND MAY_APPEND 20 21 #define AA_MAY_CREATE 0x0010 22 #define AA_MAY_DELETE 0x0020 23 #define AA_MAY_OPEN 0x0040 24 #define AA_MAY_RENAME 0x0080 /* pair */ 25 26 #define AA_MAY_SETATTR 0x0100 /* meta write */ 27 #define AA_MAY_GETATTR 0x0200 /* meta read */ 28 #define AA_MAY_SETCRED 0x0400 /* security cred/attr */ 29 #define AA_MAY_GETCRED 0x0800 30 31 #define AA_MAY_CHMOD 0x1000 /* pair */ 32 #define AA_MAY_CHOWN 0x2000 /* pair */ 33 #define AA_MAY_CHGRP 0x4000 /* pair */ 34 #define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */ 35 36 #define AA_EXEC_MMAP 0x00010000 37 #define AA_MAY_MPROT 0x00020000 /* extend conditions */ 38 #define AA_MAY_LINK 0x00040000 /* pair */ 39 #define AA_MAY_SNAPSHOT 0x00080000 /* pair */ 40 41 #define AA_MAY_DELEGATE 42 #define AA_CONT_MATCH 0x08000000 43 44 #define AA_MAY_STACK 0x10000000 45 #define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */ 46 #define AA_MAY_CHANGE_PROFILE 0x40000000 47 #define AA_MAY_CHANGEHAT 0x80000000 48 49 #define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */ 50 51 52 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE | \ 53 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK | \ 54 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND) 55 56 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME | \ 57 AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \ 58 AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \ 59 AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \ 60 AA_MAY_STACK | AA_MAY_ONEXEC | \ 61 AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT) 62 63 extern const char aa_file_perm_chrs[]; 64 extern const char *aa_file_perm_names[]; 65 66 struct aa_perms { 67 u32 allow; 68 u32 deny; /* explicit deny, or conflict if allow also set */ 69 70 u32 subtree; /* allow perm on full subtree only when allow is set */ 71 u32 cond; /* set only when ~allow and ~deny */ 72 73 u32 kill; /* set only when ~allow | deny */ 74 u32 complain; /* accumulates only used when ~allow & ~deny */ 75 u32 prompt; /* accumulates only used when ~allow & ~deny */ 76 77 u32 audit; /* set only when allow is set */ 78 u32 quiet; /* set only when ~allow | deny */ 79 u32 hide; /* set only when ~allow | deny */ 80 81 82 u32 xindex; 83 u32 tag; /* tag string index, if present */ 84 u32 label; /* label string index, if present */ 85 }; 86 87 /* 88 * Indexes are broken into a 24 bit index and 8 bit flag. 89 * For the index to be valid there must be a value in the flag 90 */ 91 #define AA_INDEX_MASK 0x00ffffff 92 #define AA_INDEX_FLAG_MASK 0xff000000 93 #define AA_INDEX_NONE 0 94 95 #define ALL_PERMS_MASK 0xffffffff 96 extern struct aa_perms nullperms; 97 extern struct aa_perms allperms; 98 99 /** 100 * aa_perms_accum_raw - accumulate perms with out masking off overlapping perms 101 * @accum - perms struct to accumulate into 102 * @addend - perms struct to add to @accum 103 */ 104 static inline void aa_perms_accum_raw(struct aa_perms *accum, 105 struct aa_perms *addend) 106 { 107 accum->deny |= addend->deny; 108 accum->allow &= addend->allow & ~addend->deny; 109 accum->audit |= addend->audit & addend->allow; 110 accum->quiet &= addend->quiet & ~addend->allow; 111 accum->kill |= addend->kill & ~addend->allow; 112 accum->complain |= addend->complain & ~addend->allow & ~addend->deny; 113 accum->cond |= addend->cond & ~addend->allow & ~addend->deny; 114 accum->hide &= addend->hide & ~addend->allow; 115 accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny; 116 accum->subtree |= addend->subtree & ~addend->deny; 117 118 if (!accum->xindex) 119 accum->xindex = addend->xindex; 120 if (!accum->tag) 121 accum->tag = addend->tag; 122 if (!accum->label) 123 accum->label = addend->label; 124 } 125 126 /** 127 * aa_perms_accum - accumulate perms, masking off overlapping perms 128 * @accum - perms struct to accumulate into 129 * @addend - perms struct to add to @accum 130 */ 131 static inline void aa_perms_accum(struct aa_perms *accum, 132 struct aa_perms *addend) 133 { 134 accum->deny |= addend->deny; 135 accum->allow &= addend->allow & ~accum->deny; 136 accum->audit |= addend->audit & accum->allow; 137 accum->quiet &= addend->quiet & ~accum->allow; 138 accum->kill |= addend->kill & ~accum->allow; 139 accum->complain |= addend->complain & ~accum->allow & ~accum->deny; 140 accum->cond |= addend->cond & ~accum->allow & ~accum->deny; 141 accum->hide &= addend->hide & ~accum->allow; 142 accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny; 143 accum->subtree &= addend->subtree & ~accum->deny; 144 145 if (!accum->xindex) 146 accum->xindex = addend->xindex; 147 if (!accum->tag) 148 accum->tag = addend->tag; 149 if (!accum->label) 150 accum->label = addend->label; 151 } 152 153 #define xcheck(FN1, FN2) \ 154 ({ \ 155 int e, error = FN1; \ 156 e = FN2; \ 157 if (e) \ 158 error = e; \ 159 error; \ 160 }) 161 162 163 /* 164 * TODO: update for labels pointing to labels instead of profiles 165 * TODO: optimize the walk, currently does subwalk of L2 for each P in L1 166 * gah this doesn't allow for label compound check!!!! 167 */ 168 #define xcheck_ns_profile_profile(P1, P2, FN, args...) \ 169 ({ \ 170 int ____e = 0; \ 171 if (P1->ns == P2->ns) \ 172 ____e = FN((P1), (P2), args); \ 173 (____e); \ 174 }) 175 176 #define xcheck_ns_profile_label(P, L, FN, args...) \ 177 ({ \ 178 struct aa_profile *__p2; \ 179 fn_for_each((L), __p2, \ 180 xcheck_ns_profile_profile((P), __p2, (FN), args)); \ 181 }) 182 183 #define xcheck_ns_labels(L1, L2, FN, args...) \ 184 ({ \ 185 struct aa_profile *__p1; \ 186 fn_for_each((L1), __p1, FN(__p1, (L2), args)); \ 187 }) 188 189 /* Do the cross check but applying FN at the profiles level */ 190 #define xcheck_labels_profiles(L1, L2, FN, args...) \ 191 xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args) 192 193 #define xcheck_labels(L1, L2, P, FN1, FN2) \ 194 xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2))) 195 196 197 extern struct aa_perms default_perms; 198 199 200 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, 201 u32 mask); 202 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names, 203 u32 mask); 204 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs, 205 u32 chrsmask, const char * const *names, u32 namesmask); 206 void aa_apply_modes_to_perms(struct aa_profile *profile, 207 struct aa_perms *perms); 208 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend); 209 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend); 210 void aa_profile_match_label(struct aa_profile *profile, 211 struct aa_ruleset *rules, struct aa_label *label, 212 int type, u32 request, struct aa_perms *perms); 213 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target, 214 u32 request, int type, u32 *deny, 215 struct common_audit_data *sa); 216 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms, 217 u32 request, struct common_audit_data *sa, 218 void (*cb)(struct audit_buffer *, void *)); 219 #endif /* __AA_PERM_H */ 220