1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor ipc mediation 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2017 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #include <linux/gfp.h> 16 #include <linux/ptrace.h> 17 18 #include "include/audit.h" 19 #include "include/capability.h" 20 #include "include/cred.h" 21 #include "include/policy.h" 22 #include "include/ipc.h" 23 #include "include/sig_names.h" 24 25 /** 26 * audit_ptrace_mask - convert mask to permission string 27 * @buffer: buffer to write string to (NOT NULL) 28 * @mask: permission mask to convert 29 */ 30 static void audit_ptrace_mask(struct audit_buffer *ab, u32 mask) 31 { 32 switch (mask) { 33 case MAY_READ: 34 audit_log_string(ab, "read"); 35 break; 36 case MAY_WRITE: 37 audit_log_string(ab, "trace"); 38 break; 39 case AA_MAY_BE_READ: 40 audit_log_string(ab, "readby"); 41 break; 42 case AA_MAY_BE_TRACED: 43 audit_log_string(ab, "tracedby"); 44 break; 45 } 46 } 47 48 /* call back to audit ptrace fields */ 49 static void audit_ptrace_cb(struct audit_buffer *ab, void *va) 50 { 51 struct common_audit_data *sa = va; 52 53 if (aad(sa)->request & AA_PTRACE_PERM_MASK) { 54 audit_log_format(ab, " requested_mask="); 55 audit_ptrace_mask(ab, aad(sa)->request); 56 57 if (aad(sa)->denied & AA_PTRACE_PERM_MASK) { 58 audit_log_format(ab, " denied_mask="); 59 audit_ptrace_mask(ab, aad(sa)->denied); 60 } 61 } 62 audit_log_format(ab, " peer="); 63 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, 64 FLAGS_NONE, GFP_ATOMIC); 65 } 66 67 /* assumes check for PROFILE_MEDIATES is already done */ 68 /* TODO: conditionals */ 69 static int profile_ptrace_perm(struct aa_profile *profile, 70 struct aa_label *peer, u32 request, 71 struct common_audit_data *sa) 72 { 73 struct aa_perms perms = { }; 74 75 aad(sa)->peer = peer; 76 aa_profile_match_label(profile, peer, AA_CLASS_PTRACE, request, 77 &perms); 78 aa_apply_modes_to_perms(profile, &perms); 79 return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb); 80 } 81 82 static int profile_tracee_perm(struct aa_profile *tracee, 83 struct aa_label *tracer, u32 request, 84 struct common_audit_data *sa) 85 { 86 if (profile_unconfined(tracee) || unconfined(tracer) || 87 !PROFILE_MEDIATES(tracee, AA_CLASS_PTRACE)) 88 return 0; 89 90 return profile_ptrace_perm(tracee, tracer, request, sa); 91 } 92 93 static int profile_tracer_perm(struct aa_profile *tracer, 94 struct aa_label *tracee, u32 request, 95 struct common_audit_data *sa) 96 { 97 if (profile_unconfined(tracer)) 98 return 0; 99 100 if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE)) 101 return profile_ptrace_perm(tracer, tracee, request, sa); 102 103 /* profile uses the old style capability check for ptrace */ 104 if (&tracer->label == tracee) 105 return 0; 106 107 aad(sa)->label = &tracer->label; 108 aad(sa)->peer = tracee; 109 aad(sa)->request = 0; 110 aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 111 CAP_OPT_NONE); 112 113 return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb); 114 } 115 116 /** 117 * aa_may_ptrace - test if tracer task can trace the tracee 118 * @tracer: label of the task doing the tracing (NOT NULL) 119 * @tracee: task label to be traced 120 * @request: permission request 121 * 122 * Returns: %0 else error code if permission denied or error 123 */ 124 int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee, 125 u32 request) 126 { 127 struct aa_profile *profile; 128 u32 xrequest = request << PTRACE_PERM_SHIFT; 129 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE); 130 131 return xcheck_labels(tracer, tracee, profile, 132 profile_tracer_perm(profile, tracee, request, &sa), 133 profile_tracee_perm(profile, tracer, xrequest, &sa)); 134 } 135 136 137 static inline int map_signal_num(int sig) 138 { 139 if (sig > SIGRTMAX) 140 return SIGUNKNOWN; 141 else if (sig >= SIGRTMIN) 142 return sig - SIGRTMIN + SIGRT_BASE; 143 else if (sig < MAXMAPPED_SIG) 144 return sig_map[sig]; 145 return SIGUNKNOWN; 146 } 147 148 /** 149 * audit_file_mask - convert mask to permission string 150 * @buffer: buffer to write string to (NOT NULL) 151 * @mask: permission mask to convert 152 */ 153 static void audit_signal_mask(struct audit_buffer *ab, u32 mask) 154 { 155 if (mask & MAY_READ) 156 audit_log_string(ab, "receive"); 157 if (mask & MAY_WRITE) 158 audit_log_string(ab, "send"); 159 } 160 161 /** 162 * audit_cb - call back for signal specific audit fields 163 * @ab: audit_buffer (NOT NULL) 164 * @va: audit struct to audit values of (NOT NULL) 165 */ 166 static void audit_signal_cb(struct audit_buffer *ab, void *va) 167 { 168 struct common_audit_data *sa = va; 169 170 if (aad(sa)->request & AA_SIGNAL_PERM_MASK) { 171 audit_log_format(ab, " requested_mask="); 172 audit_signal_mask(ab, aad(sa)->request); 173 if (aad(sa)->denied & AA_SIGNAL_PERM_MASK) { 174 audit_log_format(ab, " denied_mask="); 175 audit_signal_mask(ab, aad(sa)->denied); 176 } 177 } 178 if (aad(sa)->signal == SIGUNKNOWN) 179 audit_log_format(ab, "signal=unknown(%d)", 180 aad(sa)->unmappedsig); 181 else if (aad(sa)->signal < MAXMAPPED_SIGNAME) 182 audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]); 183 else 184 audit_log_format(ab, " signal=rtmin+%d", 185 aad(sa)->signal - SIGRT_BASE); 186 audit_log_format(ab, " peer="); 187 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, 188 FLAGS_NONE, GFP_ATOMIC); 189 } 190 191 static int profile_signal_perm(struct aa_profile *profile, 192 struct aa_label *peer, u32 request, 193 struct common_audit_data *sa) 194 { 195 struct aa_perms perms; 196 unsigned int state; 197 198 if (profile_unconfined(profile) || 199 !PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL)) 200 return 0; 201 202 aad(sa)->peer = peer; 203 /* TODO: secondary cache check <profile, profile, perm> */ 204 state = aa_dfa_next(profile->policy.dfa, 205 profile->policy.start[AA_CLASS_SIGNAL], 206 aad(sa)->signal); 207 aa_label_match(profile, peer, state, false, request, &perms); 208 aa_apply_modes_to_perms(profile, &perms); 209 return aa_check_perms(profile, &perms, request, sa, audit_signal_cb); 210 } 211 212 int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig) 213 { 214 struct aa_profile *profile; 215 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SIGNAL); 216 217 aad(&sa)->signal = map_signal_num(sig); 218 aad(&sa)->unmappedsig = sig; 219 return xcheck_labels(sender, target, profile, 220 profile_signal_perm(profile, target, MAY_WRITE, &sa), 221 profile_signal_perm(profile, sender, MAY_READ, &sa)); 222 } 223