1b5e95b48SJohn Johansen /* 2b5e95b48SJohn Johansen * AppArmor security module 3b5e95b48SJohn Johansen * 4b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 5b5e95b48SJohn Johansen * 6b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 7b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 8b5e95b48SJohn Johansen * 9b5e95b48SJohn Johansen * This program is free software; you can redistribute it and/or 10b5e95b48SJohn Johansen * modify it under the terms of the GNU General Public License as 11b5e95b48SJohn Johansen * published by the Free Software Foundation, version 2 of the 12b5e95b48SJohn Johansen * License. 13b5e95b48SJohn Johansen */ 14b5e95b48SJohn Johansen 153c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 16b5e95b48SJohn Johansen #include <linux/moduleparam.h> 17b5e95b48SJohn Johansen #include <linux/mm.h> 18b5e95b48SJohn Johansen #include <linux/mman.h> 19b5e95b48SJohn Johansen #include <linux/mount.h> 20b5e95b48SJohn Johansen #include <linux/namei.h> 21b5e95b48SJohn Johansen #include <linux/ptrace.h> 22b5e95b48SJohn Johansen #include <linux/ctype.h> 23b5e95b48SJohn Johansen #include <linux/sysctl.h> 24b5e95b48SJohn Johansen #include <linux/audit.h> 253486740aSSerge E. Hallyn #include <linux/user_namespace.h> 26b5e95b48SJohn Johansen #include <net/sock.h> 27b5e95b48SJohn Johansen 28b5e95b48SJohn Johansen #include "include/apparmor.h" 29b5e95b48SJohn Johansen #include "include/apparmorfs.h" 30b5e95b48SJohn Johansen #include "include/audit.h" 31b5e95b48SJohn Johansen #include "include/capability.h" 32d8889d49SJohn Johansen #include "include/cred.h" 33b5e95b48SJohn Johansen #include "include/file.h" 34b5e95b48SJohn Johansen #include "include/ipc.h" 3556974a6fSJohn Johansen #include "include/net.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37637f688dSJohn Johansen #include "include/label.h" 38b5e95b48SJohn Johansen #include "include/policy.h" 39cff281f6SJohn Johansen #include "include/policy_ns.h" 40b5e95b48SJohn Johansen #include "include/procattr.h" 412ea3ffb7SJohn Johansen #include "include/mount.h" 42c0929212SJohn Johansen #include "include/secid.h" 43b5e95b48SJohn Johansen 44b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 45545de8feSJohn Johansen int apparmor_initialized; 46b5e95b48SJohn Johansen 47d4669f0bSJohn Johansen DEFINE_PER_CPU(struct aa_buffers, aa_buffers); 48d4669f0bSJohn Johansen 49d4669f0bSJohn Johansen 50b5e95b48SJohn Johansen /* 51b5e95b48SJohn Johansen * LSM hook functions 52b5e95b48SJohn Johansen */ 53b5e95b48SJohn Johansen 54b5e95b48SJohn Johansen /* 55d9087c49SJohn Johansen * put the associated labels 56b5e95b48SJohn Johansen */ 57b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 58b5e95b48SJohn Johansen { 59d9087c49SJohn Johansen aa_put_label(cred_label(cred)); 60d9087c49SJohn Johansen cred_label(cred) = NULL; 61b5e95b48SJohn Johansen } 62b5e95b48SJohn Johansen 63b5e95b48SJohn Johansen /* 64b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 65b5e95b48SJohn Johansen */ 66b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 67b5e95b48SJohn Johansen { 68d9087c49SJohn Johansen cred_label(cred) = NULL; 69b5e95b48SJohn Johansen return 0; 70b5e95b48SJohn Johansen } 71b5e95b48SJohn Johansen 72b5e95b48SJohn Johansen /* 73d9087c49SJohn Johansen * prepare new cred label for modification by prepare_cred block 74b5e95b48SJohn Johansen */ 75b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 76b5e95b48SJohn Johansen gfp_t gfp) 77b5e95b48SJohn Johansen { 78d9087c49SJohn Johansen cred_label(new) = aa_get_newest_label(cred_label(old)); 79b5e95b48SJohn Johansen return 0; 80b5e95b48SJohn Johansen } 81b5e95b48SJohn Johansen 82b5e95b48SJohn Johansen /* 83b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 84b5e95b48SJohn Johansen */ 85b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 86b5e95b48SJohn Johansen { 87d9087c49SJohn Johansen cred_label(new) = aa_get_newest_label(cred_label(old)); 88b5e95b48SJohn Johansen } 89b5e95b48SJohn Johansen 903b529a76SJohn Johansen static void apparmor_task_free(struct task_struct *task) 913b529a76SJohn Johansen { 923b529a76SJohn Johansen 933b529a76SJohn Johansen aa_free_task_ctx(task_ctx(task)); 943b529a76SJohn Johansen task_ctx(task) = NULL; 953b529a76SJohn Johansen } 963b529a76SJohn Johansen 973b529a76SJohn Johansen static int apparmor_task_alloc(struct task_struct *task, 983b529a76SJohn Johansen unsigned long clone_flags) 993b529a76SJohn Johansen { 1003b529a76SJohn Johansen struct aa_task_ctx *new = aa_alloc_task_ctx(GFP_KERNEL); 1013b529a76SJohn Johansen 1023b529a76SJohn Johansen if (!new) 1033b529a76SJohn Johansen return -ENOMEM; 1043b529a76SJohn Johansen 105de62de59SJohn Johansen aa_dup_task_ctx(new, task_ctx(current)); 1063b529a76SJohn Johansen task_ctx(task) = new; 1073b529a76SJohn Johansen 1083b529a76SJohn Johansen return 0; 109b5e95b48SJohn Johansen } 110b5e95b48SJohn Johansen 111b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 112b5e95b48SJohn Johansen unsigned int mode) 113b5e95b48SJohn Johansen { 114b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 115b2d09ae4SJohn Johansen int error; 116b2d09ae4SJohn Johansen 117b2d09ae4SJohn Johansen tracer = begin_current_label_crit_section(); 118b2d09ae4SJohn Johansen tracee = aa_get_task_label(child); 119b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, 120338d0be4SJohn Johansen (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ 121338d0be4SJohn Johansen : AA_PTRACE_TRACE); 122b2d09ae4SJohn Johansen aa_put_label(tracee); 123b2d09ae4SJohn Johansen end_current_label_crit_section(tracer); 124b2d09ae4SJohn Johansen 125b2d09ae4SJohn Johansen return error; 126b5e95b48SJohn Johansen } 127b5e95b48SJohn Johansen 128b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 129b5e95b48SJohn Johansen { 130b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 131b2d09ae4SJohn Johansen int error; 132b2d09ae4SJohn Johansen 133b2d09ae4SJohn Johansen tracee = begin_current_label_crit_section(); 134b2d09ae4SJohn Johansen tracer = aa_get_task_label(parent); 135b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE); 136b2d09ae4SJohn Johansen aa_put_label(tracer); 137b2d09ae4SJohn Johansen end_current_label_crit_section(tracee); 138b2d09ae4SJohn Johansen 139b2d09ae4SJohn Johansen return error; 140b5e95b48SJohn Johansen } 141b5e95b48SJohn Johansen 142b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 143b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 144b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 145b5e95b48SJohn Johansen { 146637f688dSJohn Johansen struct aa_label *label; 147b5e95b48SJohn Johansen const struct cred *cred; 148b5e95b48SJohn Johansen 149b5e95b48SJohn Johansen rcu_read_lock(); 150b5e95b48SJohn Johansen cred = __task_cred(target); 151637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 152c70c86c4SJohn Johansen 153b1d9e6b0SCasey Schaufler /* 154b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 155b1d9e6b0SCasey Schaufler * initialize effective and permitted. 156b1d9e6b0SCasey Schaufler */ 157c70c86c4SJohn Johansen if (!unconfined(label)) { 158c70c86c4SJohn Johansen struct aa_profile *profile; 159c70c86c4SJohn Johansen struct label_it i; 160c70c86c4SJohn Johansen 161c70c86c4SJohn Johansen label_for_each_confined(i, label, profile) { 162c70c86c4SJohn Johansen if (COMPLAIN_MODE(profile)) 163c70c86c4SJohn Johansen continue; 164c70c86c4SJohn Johansen *effective = cap_intersect(*effective, 165c70c86c4SJohn Johansen profile->caps.allow); 166c70c86c4SJohn Johansen *permitted = cap_intersect(*permitted, 167c70c86c4SJohn Johansen profile->caps.allow); 168c70c86c4SJohn Johansen } 169b5e95b48SJohn Johansen } 170b5e95b48SJohn Johansen rcu_read_unlock(); 171637f688dSJohn Johansen aa_put_label(label); 172b5e95b48SJohn Johansen 173b5e95b48SJohn Johansen return 0; 174b5e95b48SJohn Johansen } 175b5e95b48SJohn Johansen 1766a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 1776a9de491SEric Paris int cap, int audit) 178b5e95b48SJohn Johansen { 179637f688dSJohn Johansen struct aa_label *label; 180b1d9e6b0SCasey Schaufler int error = 0; 181b1d9e6b0SCasey Schaufler 182637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 183637f688dSJohn Johansen if (!unconfined(label)) 184c70c86c4SJohn Johansen error = aa_capable(label, cap, audit); 185637f688dSJohn Johansen aa_put_label(label); 186cf797c0eSJohn Johansen 187b5e95b48SJohn Johansen return error; 188b5e95b48SJohn Johansen } 189b5e95b48SJohn Johansen 190b5e95b48SJohn Johansen /** 191b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 192b5e95b48SJohn Johansen * @op: operation being checked 193b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 194b5e95b48SJohn Johansen * @mask: requested permissions mask 195b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 196b5e95b48SJohn Johansen * 197b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 198b5e95b48SJohn Johansen */ 19947f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 200b5e95b48SJohn Johansen struct path_cond *cond) 201b5e95b48SJohn Johansen { 202637f688dSJohn Johansen struct aa_label *label; 203b5e95b48SJohn Johansen int error = 0; 204b5e95b48SJohn Johansen 205637f688dSJohn Johansen label = __begin_current_label_crit_section(); 206637f688dSJohn Johansen if (!unconfined(label)) 207aebd873eSJohn Johansen error = aa_path_perm(op, label, path, 0, mask, cond); 208637f688dSJohn Johansen __end_current_label_crit_section(label); 209b5e95b48SJohn Johansen 210b5e95b48SJohn Johansen return error; 211b5e95b48SJohn Johansen } 212b5e95b48SJohn Johansen 213b5e95b48SJohn Johansen /** 21431f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 21531f75bfeSJohn Johansen * @op: operation being checked 21631f75bfeSJohn Johansen * @path: location to check (NOT NULL) 21731f75bfeSJohn Johansen * @mask: requested permissions mask 21831f75bfeSJohn Johansen * 21931f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 22031f75bfeSJohn Johansen */ 22131f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 22231f75bfeSJohn Johansen { 22331f75bfeSJohn Johansen struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 22431f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 22531f75bfeSJohn Johansen }; 22631f75bfeSJohn Johansen 22731f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 22831f75bfeSJohn Johansen return 0; 22931f75bfeSJohn Johansen 23031f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 23131f75bfeSJohn Johansen } 23231f75bfeSJohn Johansen 23331f75bfeSJohn Johansen /** 234b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 235b5e95b48SJohn Johansen * @op: operation being checked 236b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 237b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 238b5e95b48SJohn Johansen * @mask: requested permissions mask 239b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 240b5e95b48SJohn Johansen * 241b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 242b5e95b48SJohn Johansen */ 24347f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 244b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 245b5e95b48SJohn Johansen struct path_cond *cond) 246b5e95b48SJohn Johansen { 2478486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 248b5e95b48SJohn Johansen 249b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 250b5e95b48SJohn Johansen } 251b5e95b48SJohn Johansen 252b5e95b48SJohn Johansen /** 253b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 254b5e95b48SJohn Johansen * @op: operation being checked 255b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 256b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 257b5e95b48SJohn Johansen * @mask: requested permission mask 258b5e95b48SJohn Johansen * 259b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 260b5e95b48SJohn Johansen */ 26147f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 262b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 263b5e95b48SJohn Johansen { 264c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 265b5e95b48SJohn Johansen struct path_cond cond = { }; 266b5e95b48SJohn Johansen 267efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 268b5e95b48SJohn Johansen return 0; 269b5e95b48SJohn Johansen 270b5e95b48SJohn Johansen cond.uid = inode->i_uid; 271b5e95b48SJohn Johansen cond.mode = inode->i_mode; 272b5e95b48SJohn Johansen 273b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 274b5e95b48SJohn Johansen } 275b5e95b48SJohn Johansen 276b5e95b48SJohn Johansen /** 277b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 278b5e95b48SJohn Johansen * @op: operation being checked 279b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 280b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 281b5e95b48SJohn Johansen * @mask: request permission mask 282b5e95b48SJohn Johansen * @mode: created file mode 283b5e95b48SJohn Johansen * 284b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 285b5e95b48SJohn Johansen */ 28647f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 287d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 288b5e95b48SJohn Johansen { 289b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 290b5e95b48SJohn Johansen 291efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 292b5e95b48SJohn Johansen return 0; 293b5e95b48SJohn Johansen 294b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 295b5e95b48SJohn Johansen } 296b5e95b48SJohn Johansen 297989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 298b5e95b48SJohn Johansen { 299b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 300b5e95b48SJohn Johansen } 301b5e95b48SJohn Johansen 302d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 3034572befeSAl Viro umode_t mode) 304b5e95b48SJohn Johansen { 305b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 306b5e95b48SJohn Johansen S_IFDIR); 307b5e95b48SJohn Johansen } 308b5e95b48SJohn Johansen 309989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 310b5e95b48SJohn Johansen { 311b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 312b5e95b48SJohn Johansen } 313b5e95b48SJohn Johansen 314d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 31504fc66e7SAl Viro umode_t mode, unsigned int dev) 316b5e95b48SJohn Johansen { 317b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 318b5e95b48SJohn Johansen } 319b5e95b48SJohn Johansen 32081f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 321b5e95b48SJohn Johansen { 322e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 323b5e95b48SJohn Johansen } 324b5e95b48SJohn Johansen 325d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 326b5e95b48SJohn Johansen const char *old_name) 327b5e95b48SJohn Johansen { 328b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 329b5e95b48SJohn Johansen S_IFLNK); 330b5e95b48SJohn Johansen } 331b5e95b48SJohn Johansen 3323ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 333b5e95b48SJohn Johansen struct dentry *new_dentry) 334b5e95b48SJohn Johansen { 335637f688dSJohn Johansen struct aa_label *label; 336b5e95b48SJohn Johansen int error = 0; 337b5e95b48SJohn Johansen 338efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 339b5e95b48SJohn Johansen return 0; 340b5e95b48SJohn Johansen 341637f688dSJohn Johansen label = begin_current_label_crit_section(); 342637f688dSJohn Johansen if (!unconfined(label)) 3438014370fSJohn Johansen error = aa_path_link(label, old_dentry, new_dir, new_dentry); 344637f688dSJohn Johansen end_current_label_crit_section(label); 345cf797c0eSJohn Johansen 346b5e95b48SJohn Johansen return error; 347b5e95b48SJohn Johansen } 348b5e95b48SJohn Johansen 3493ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 3503ccee46aSAl Viro const struct path *new_dir, struct dentry *new_dentry) 351b5e95b48SJohn Johansen { 352637f688dSJohn Johansen struct aa_label *label; 353b5e95b48SJohn Johansen int error = 0; 354b5e95b48SJohn Johansen 355efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 356b5e95b48SJohn Johansen return 0; 357b5e95b48SJohn Johansen 358637f688dSJohn Johansen label = begin_current_label_crit_section(); 359637f688dSJohn Johansen if (!unconfined(label)) { 3608486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3618486adf0SKees Cook .dentry = old_dentry }; 3628486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3638486adf0SKees Cook .dentry = new_dentry }; 364c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(old_dentry)->i_uid, 365c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 366b5e95b48SJohn Johansen }; 367b5e95b48SJohn Johansen 368aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0, 369e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 370e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 371b5e95b48SJohn Johansen &cond); 372b5e95b48SJohn Johansen if (!error) 373aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_DEST, label, &new_path, 374e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 375b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 376b5e95b48SJohn Johansen 377b5e95b48SJohn Johansen } 378637f688dSJohn Johansen end_current_label_crit_section(label); 379cf797c0eSJohn Johansen 380b5e95b48SJohn Johansen return error; 381b5e95b48SJohn Johansen } 382b5e95b48SJohn Johansen 383be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 384b5e95b48SJohn Johansen { 38531f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 386b5e95b48SJohn Johansen } 387b5e95b48SJohn Johansen 3887fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 389b5e95b48SJohn Johansen { 39031f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 391b5e95b48SJohn Johansen } 392b5e95b48SJohn Johansen 3933f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 394b5e95b48SJohn Johansen { 395e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 396b5e95b48SJohn Johansen } 397b5e95b48SJohn Johansen 39894817692SAl Viro static int apparmor_file_open(struct file *file) 399b5e95b48SJohn Johansen { 400637f688dSJohn Johansen struct aa_file_ctx *fctx = file_ctx(file); 401637f688dSJohn Johansen struct aa_label *label; 402b5e95b48SJohn Johansen int error = 0; 403b5e95b48SJohn Johansen 404efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 405b5e95b48SJohn Johansen return 0; 406b5e95b48SJohn Johansen 407b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 408b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 409b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 410b5e95b48SJohn Johansen * actually execute the image. 411b5e95b48SJohn Johansen */ 412b5e95b48SJohn Johansen if (current->in_execve) { 41355a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 414b5e95b48SJohn Johansen return 0; 415b5e95b48SJohn Johansen } 416b5e95b48SJohn Johansen 41794817692SAl Viro label = aa_get_newest_cred_label(file->f_cred); 418637f688dSJohn Johansen if (!unconfined(label)) { 419496ad9aaSAl Viro struct inode *inode = file_inode(file); 420b5e95b48SJohn Johansen struct path_cond cond = { inode->i_uid, inode->i_mode }; 421b5e95b48SJohn Johansen 422aebd873eSJohn Johansen error = aa_path_perm(OP_OPEN, label, &file->f_path, 0, 423b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 424b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 42555a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 426b5e95b48SJohn Johansen } 427637f688dSJohn Johansen aa_put_label(label); 428b5e95b48SJohn Johansen 429b5e95b48SJohn Johansen return error; 430b5e95b48SJohn Johansen } 431b5e95b48SJohn Johansen 432b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 433b5e95b48SJohn Johansen { 434cf797c0eSJohn Johansen int error = 0; 435cf797c0eSJohn Johansen 436b5e95b48SJohn Johansen /* freed by apparmor_file_free_security */ 437637f688dSJohn Johansen struct aa_label *label = begin_current_label_crit_section(); 438190a9518SJohn Johansen file->f_security = aa_alloc_file_ctx(label, GFP_KERNEL); 4392835a13bSJohn Johansen if (!file_ctx(file)) 4402835a13bSJohn Johansen error = -ENOMEM; 441637f688dSJohn Johansen end_current_label_crit_section(label); 442b5e95b48SJohn Johansen 443cf797c0eSJohn Johansen return error; 444b5e95b48SJohn Johansen } 445b5e95b48SJohn Johansen 446b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 447b5e95b48SJohn Johansen { 4482835a13bSJohn Johansen aa_free_file_ctx(file_ctx(file)); 449b5e95b48SJohn Johansen } 450b5e95b48SJohn Johansen 45147f6e5ccSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask) 452b5e95b48SJohn Johansen { 453190a9518SJohn Johansen struct aa_label *label; 454b5e95b48SJohn Johansen int error = 0; 455b5e95b48SJohn Johansen 456192ca6b5SJohn Johansen /* don't reaudit files closed during inheritance */ 457192ca6b5SJohn Johansen if (file->f_path.dentry == aa_null.dentry) 458192ca6b5SJohn Johansen return -EACCES; 459192ca6b5SJohn Johansen 460637f688dSJohn Johansen label = __begin_current_label_crit_section(); 461190a9518SJohn Johansen error = aa_file_perm(op, label, file, mask); 462637f688dSJohn Johansen __end_current_label_crit_section(label); 463b5e95b48SJohn Johansen 464b5e95b48SJohn Johansen return error; 465b5e95b48SJohn Johansen } 466b5e95b48SJohn Johansen 467064dc947SJohn Johansen static int apparmor_file_receive(struct file *file) 468064dc947SJohn Johansen { 469064dc947SJohn Johansen return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file)); 470064dc947SJohn Johansen } 471064dc947SJohn Johansen 472b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 473b5e95b48SJohn Johansen { 474b5e95b48SJohn Johansen return common_file_perm(OP_FPERM, file, mask); 475b5e95b48SJohn Johansen } 476b5e95b48SJohn Johansen 477b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 478b5e95b48SJohn Johansen { 479b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 480b5e95b48SJohn Johansen 481b5e95b48SJohn Johansen if (cmd == F_WRLCK) 482b5e95b48SJohn Johansen mask |= MAY_WRITE; 483b5e95b48SJohn Johansen 484b5e95b48SJohn Johansen return common_file_perm(OP_FLOCK, file, mask); 485b5e95b48SJohn Johansen } 486b5e95b48SJohn Johansen 48747f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 488b5e95b48SJohn Johansen unsigned long flags) 489b5e95b48SJohn Johansen { 490b5e95b48SJohn Johansen int mask = 0; 491b5e95b48SJohn Johansen 492637f688dSJohn Johansen if (!file || !file_ctx(file)) 493b5e95b48SJohn Johansen return 0; 494b5e95b48SJohn Johansen 495b5e95b48SJohn Johansen if (prot & PROT_READ) 496b5e95b48SJohn Johansen mask |= MAY_READ; 497b5e95b48SJohn Johansen /* 498b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 499b5e95b48SJohn Johansen * write back to the files 500b5e95b48SJohn Johansen */ 501b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 502b5e95b48SJohn Johansen mask |= MAY_WRITE; 503b5e95b48SJohn Johansen if (prot & PROT_EXEC) 504b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 505b5e95b48SJohn Johansen 506b5e95b48SJohn Johansen return common_file_perm(op, file, mask); 507b5e95b48SJohn Johansen } 508b5e95b48SJohn Johansen 509e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 510e5467859SAl Viro unsigned long prot, unsigned long flags) 511b5e95b48SJohn Johansen { 512b5e95b48SJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags); 513b5e95b48SJohn Johansen } 514b5e95b48SJohn Johansen 515b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 516b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 517b5e95b48SJohn Johansen { 518b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 519b5e95b48SJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); 520b5e95b48SJohn Johansen } 521b5e95b48SJohn Johansen 5222ea3ffb7SJohn Johansen static int apparmor_sb_mount(const char *dev_name, const struct path *path, 5232ea3ffb7SJohn Johansen const char *type, unsigned long flags, void *data) 5242ea3ffb7SJohn Johansen { 5252ea3ffb7SJohn Johansen struct aa_label *label; 5262ea3ffb7SJohn Johansen int error = 0; 5272ea3ffb7SJohn Johansen 5282ea3ffb7SJohn Johansen /* Discard magic */ 5292ea3ffb7SJohn Johansen if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 5302ea3ffb7SJohn Johansen flags &= ~MS_MGC_MSK; 5312ea3ffb7SJohn Johansen 5322ea3ffb7SJohn Johansen flags &= ~AA_MS_IGNORE_MASK; 5332ea3ffb7SJohn Johansen 5342ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5352ea3ffb7SJohn Johansen if (!unconfined(label)) { 5362ea3ffb7SJohn Johansen if (flags & MS_REMOUNT) 5372ea3ffb7SJohn Johansen error = aa_remount(label, path, flags, data); 5382ea3ffb7SJohn Johansen else if (flags & MS_BIND) 5392ea3ffb7SJohn Johansen error = aa_bind_mount(label, path, dev_name, flags); 5402ea3ffb7SJohn Johansen else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | 5412ea3ffb7SJohn Johansen MS_UNBINDABLE)) 5422ea3ffb7SJohn Johansen error = aa_mount_change_type(label, path, flags); 5432ea3ffb7SJohn Johansen else if (flags & MS_MOVE) 5442ea3ffb7SJohn Johansen error = aa_move_mount(label, path, dev_name); 5452ea3ffb7SJohn Johansen else 5462ea3ffb7SJohn Johansen error = aa_new_mount(label, dev_name, path, type, 5472ea3ffb7SJohn Johansen flags, data); 5482ea3ffb7SJohn Johansen } 5492ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5502ea3ffb7SJohn Johansen 5512ea3ffb7SJohn Johansen return error; 5522ea3ffb7SJohn Johansen } 5532ea3ffb7SJohn Johansen 5542ea3ffb7SJohn Johansen static int apparmor_sb_umount(struct vfsmount *mnt, int flags) 5552ea3ffb7SJohn Johansen { 5562ea3ffb7SJohn Johansen struct aa_label *label; 5572ea3ffb7SJohn Johansen int error = 0; 5582ea3ffb7SJohn Johansen 5592ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5602ea3ffb7SJohn Johansen if (!unconfined(label)) 5612ea3ffb7SJohn Johansen error = aa_umount(label, mnt, flags); 5622ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5632ea3ffb7SJohn Johansen 5642ea3ffb7SJohn Johansen return error; 5652ea3ffb7SJohn Johansen } 5662ea3ffb7SJohn Johansen 5672ea3ffb7SJohn Johansen static int apparmor_sb_pivotroot(const struct path *old_path, 5682ea3ffb7SJohn Johansen const struct path *new_path) 5692ea3ffb7SJohn Johansen { 5702ea3ffb7SJohn Johansen struct aa_label *label; 5712ea3ffb7SJohn Johansen int error = 0; 5722ea3ffb7SJohn Johansen 5732ea3ffb7SJohn Johansen label = aa_get_current_label(); 5742ea3ffb7SJohn Johansen if (!unconfined(label)) 5752ea3ffb7SJohn Johansen error = aa_pivotroot(label, old_path, new_path); 5762ea3ffb7SJohn Johansen aa_put_label(label); 5772ea3ffb7SJohn Johansen 5782ea3ffb7SJohn Johansen return error; 5792ea3ffb7SJohn Johansen } 5802ea3ffb7SJohn Johansen 581b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 582b5e95b48SJohn Johansen char **value) 583b5e95b48SJohn Johansen { 584b5e95b48SJohn Johansen int error = -ENOENT; 585b5e95b48SJohn Johansen /* released below */ 586b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 587de62de59SJohn Johansen struct aa_task_ctx *ctx = task_ctx(current); 588637f688dSJohn Johansen struct aa_label *label = NULL; 589b5e95b48SJohn Johansen 590b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 591d9087c49SJohn Johansen label = aa_get_newest_label(cred_label(cred)); 59255a26ebfSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 593637f688dSJohn Johansen label = aa_get_newest_label(ctx->previous); 59455a26ebfSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 595637f688dSJohn Johansen label = aa_get_newest_label(ctx->onexec); 596b5e95b48SJohn Johansen else 597b5e95b48SJohn Johansen error = -EINVAL; 598b5e95b48SJohn Johansen 599637f688dSJohn Johansen if (label) 60076a1d263SJohn Johansen error = aa_getprocattr(label, value); 60177b071b3SJohn Johansen 602637f688dSJohn Johansen aa_put_label(label); 603b5e95b48SJohn Johansen put_cred(cred); 604b5e95b48SJohn Johansen 605b5e95b48SJohn Johansen return error; 606b5e95b48SJohn Johansen } 607b5e95b48SJohn Johansen 608b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 609b21507e2SStephen Smalley size_t size) 610b5e95b48SJohn Johansen { 611e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 612b5e95b48SJohn Johansen size_t arg_size; 613b5e95b48SJohn Johansen int error; 614ef88a7acSJohn Johansen DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR); 615b5e95b48SJohn Johansen 616b5e95b48SJohn Johansen if (size == 0) 617b5e95b48SJohn Johansen return -EINVAL; 618b5e95b48SJohn Johansen 619e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 620e89b8081SVegard Nossum if (args[size - 1] != '\0') { 621e89b8081SVegard Nossum /* null terminate */ 622e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 623e89b8081SVegard Nossum if (!args) 624e89b8081SVegard Nossum return -ENOMEM; 625e89b8081SVegard Nossum memcpy(args, value, size); 626e89b8081SVegard Nossum args[size] = '\0'; 627e89b8081SVegard Nossum } 628e89b8081SVegard Nossum 629e89b8081SVegard Nossum error = -EINVAL; 630b5e95b48SJohn Johansen args = strim(args); 631b5e95b48SJohn Johansen command = strsep(&args, " "); 632b5e95b48SJohn Johansen if (!args) 633e89b8081SVegard Nossum goto out; 634b5e95b48SJohn Johansen args = skip_spaces(args); 635b5e95b48SJohn Johansen if (!*args) 636e89b8081SVegard Nossum goto out; 637b5e95b48SJohn Johansen 638d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 639b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 640b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 641b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 642df8073c6SJohn Johansen AA_CHANGE_NOFLAGS); 643b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 644b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 645df8073c6SJohn Johansen AA_CHANGE_TEST); 646b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 647df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_NOFLAGS); 648b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 649df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_TEST); 6506c5fc8f1SJohn Johansen } else if (strcmp(command, "stack") == 0) { 6516c5fc8f1SJohn Johansen error = aa_change_profile(args, AA_CHANGE_STACK); 6523eea57c2SJohn Johansen } else 6533eea57c2SJohn Johansen goto fail; 654b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 6553eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 656df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_ONEXEC); 6576c5fc8f1SJohn Johansen else if (strcmp(command, "stack") == 0) 6586c5fc8f1SJohn Johansen error = aa_change_profile(args, (AA_CHANGE_ONEXEC | 6596c5fc8f1SJohn Johansen AA_CHANGE_STACK)); 6603eea57c2SJohn Johansen else 6613eea57c2SJohn Johansen goto fail; 6623eea57c2SJohn Johansen } else 663b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 664e89b8081SVegard Nossum goto fail; 6653eea57c2SJohn Johansen 666b5e95b48SJohn Johansen if (!error) 667b5e95b48SJohn Johansen error = size; 668e89b8081SVegard Nossum out: 669e89b8081SVegard Nossum kfree(largs); 670b5e95b48SJohn Johansen return error; 6713eea57c2SJohn Johansen 6723eea57c2SJohn Johansen fail: 673637f688dSJohn Johansen aad(&sa)->label = begin_current_label_crit_section(); 674ef88a7acSJohn Johansen aad(&sa)->info = name; 675ef88a7acSJohn Johansen aad(&sa)->error = error = -EINVAL; 6763eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 677637f688dSJohn Johansen end_current_label_crit_section(aad(&sa)->label); 678e89b8081SVegard Nossum goto out; 679b5e95b48SJohn Johansen } 680b5e95b48SJohn Johansen 681fe864821SJohn Johansen /** 682fe864821SJohn Johansen * apparmor_bprm_committing_creds - do task cleanup on committing new creds 683fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 684fe864821SJohn Johansen */ 685fe864821SJohn Johansen static void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 686fe864821SJohn Johansen { 687637f688dSJohn Johansen struct aa_label *label = aa_current_raw_label(); 688d9087c49SJohn Johansen struct aa_label *new_label = cred_label(bprm->cred); 689fe864821SJohn Johansen 690fe864821SJohn Johansen /* bail out if unconfined or not changing profile */ 691d9087c49SJohn Johansen if ((new_label->proxy == label->proxy) || 692d9087c49SJohn Johansen (unconfined(new_label))) 693fe864821SJohn Johansen return; 694fe864821SJohn Johansen 695192ca6b5SJohn Johansen aa_inherit_files(bprm->cred, current->files); 696192ca6b5SJohn Johansen 697fe864821SJohn Johansen current->pdeath_signal = 0; 698fe864821SJohn Johansen 699637f688dSJohn Johansen /* reset soft limits and set hard limits for the new label */ 700d9087c49SJohn Johansen __aa_transition_rlimits(label, new_label); 701fe864821SJohn Johansen } 702fe864821SJohn Johansen 703fe864821SJohn Johansen /** 704fe864821SJohn Johansen * apparmor_bprm_committed_cred - do cleanup after new creds committed 705fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 706fe864821SJohn Johansen */ 707fe864821SJohn Johansen static void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 708fe864821SJohn Johansen { 7093b529a76SJohn Johansen /* clear out temporary/transitional state from the context */ 710de62de59SJohn Johansen aa_clear_task_ctx_trans(task_ctx(current)); 7113b529a76SJohn Johansen 712fe864821SJohn Johansen return; 713fe864821SJohn Johansen } 714fe864821SJohn Johansen 715a7ae3645SJohn Johansen static void apparmor_task_getsecid(struct task_struct *p, u32 *secid) 716a7ae3645SJohn Johansen { 717a7ae3645SJohn Johansen struct aa_label *label = aa_get_task_label(p); 718a7ae3645SJohn Johansen *secid = label->secid; 719a7ae3645SJohn Johansen aa_put_label(label); 720a7ae3645SJohn Johansen } 721a7ae3645SJohn Johansen 7227cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 7237cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 724b5e95b48SJohn Johansen { 725637f688dSJohn Johansen struct aa_label *label = __begin_current_label_crit_section(); 726b5e95b48SJohn Johansen int error = 0; 727b5e95b48SJohn Johansen 728637f688dSJohn Johansen if (!unconfined(label)) 72986b92cb7SJohn Johansen error = aa_task_setrlimit(label, task, resource, new_rlim); 730637f688dSJohn Johansen __end_current_label_crit_section(label); 731b5e95b48SJohn Johansen 732b5e95b48SJohn Johansen return error; 733b5e95b48SJohn Johansen } 734b5e95b48SJohn Johansen 735cd1dbf76SJohn Johansen static int apparmor_task_kill(struct task_struct *target, struct siginfo *info, 7366b4f3d01SStephen Smalley int sig, const struct cred *cred) 737cd1dbf76SJohn Johansen { 738cd1dbf76SJohn Johansen struct aa_label *cl, *tl; 739cd1dbf76SJohn Johansen int error; 740cd1dbf76SJohn Johansen 7416b4f3d01SStephen Smalley if (cred) { 7426b4f3d01SStephen Smalley /* 743cd1dbf76SJohn Johansen * Dealing with USB IO specific behavior 744cd1dbf76SJohn Johansen */ 7456b4f3d01SStephen Smalley cl = aa_get_newest_cred_label(cred); 7466b4f3d01SStephen Smalley tl = aa_get_task_label(target); 7476b4f3d01SStephen Smalley error = aa_may_signal(cl, tl, sig); 7486b4f3d01SStephen Smalley aa_put_label(cl); 7496b4f3d01SStephen Smalley aa_put_label(tl); 7506b4f3d01SStephen Smalley return error; 7516b4f3d01SStephen Smalley } 7526b4f3d01SStephen Smalley 753cd1dbf76SJohn Johansen cl = __begin_current_label_crit_section(); 754cd1dbf76SJohn Johansen tl = aa_get_task_label(target); 755cd1dbf76SJohn Johansen error = aa_may_signal(cl, tl, sig); 756cd1dbf76SJohn Johansen aa_put_label(tl); 757cd1dbf76SJohn Johansen __end_current_label_crit_section(cl); 758cd1dbf76SJohn Johansen 759cd1dbf76SJohn Johansen return error; 760cd1dbf76SJohn Johansen } 761cd1dbf76SJohn Johansen 76256974a6fSJohn Johansen /** 76356974a6fSJohn Johansen * apparmor_sk_alloc_security - allocate and attach the sk_security field 76456974a6fSJohn Johansen */ 76556974a6fSJohn Johansen static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags) 76656974a6fSJohn Johansen { 76756974a6fSJohn Johansen struct aa_sk_ctx *ctx; 76856974a6fSJohn Johansen 76956974a6fSJohn Johansen ctx = kzalloc(sizeof(*ctx), flags); 77056974a6fSJohn Johansen if (!ctx) 77156974a6fSJohn Johansen return -ENOMEM; 77256974a6fSJohn Johansen 77356974a6fSJohn Johansen SK_CTX(sk) = ctx; 77456974a6fSJohn Johansen 77556974a6fSJohn Johansen return 0; 77656974a6fSJohn Johansen } 77756974a6fSJohn Johansen 77856974a6fSJohn Johansen /** 77956974a6fSJohn Johansen * apparmor_sk_free_security - free the sk_security field 78056974a6fSJohn Johansen */ 78156974a6fSJohn Johansen static void apparmor_sk_free_security(struct sock *sk) 78256974a6fSJohn Johansen { 78356974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 78456974a6fSJohn Johansen 78556974a6fSJohn Johansen SK_CTX(sk) = NULL; 78656974a6fSJohn Johansen aa_put_label(ctx->label); 78756974a6fSJohn Johansen aa_put_label(ctx->peer); 78856974a6fSJohn Johansen kfree(ctx); 78956974a6fSJohn Johansen } 79056974a6fSJohn Johansen 79156974a6fSJohn Johansen /** 79256974a6fSJohn Johansen * apparmor_clone_security - clone the sk_security field 79356974a6fSJohn Johansen */ 79456974a6fSJohn Johansen static void apparmor_sk_clone_security(const struct sock *sk, 79556974a6fSJohn Johansen struct sock *newsk) 79656974a6fSJohn Johansen { 79756974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 79856974a6fSJohn Johansen struct aa_sk_ctx *new = SK_CTX(newsk); 79956974a6fSJohn Johansen 80056974a6fSJohn Johansen new->label = aa_get_label(ctx->label); 80156974a6fSJohn Johansen new->peer = aa_get_label(ctx->peer); 80256974a6fSJohn Johansen } 80356974a6fSJohn Johansen 80456974a6fSJohn Johansen /** 80556974a6fSJohn Johansen * apparmor_socket_create - check perms before creating a new socket 80656974a6fSJohn Johansen */ 80756974a6fSJohn Johansen static int apparmor_socket_create(int family, int type, int protocol, int kern) 80856974a6fSJohn Johansen { 80956974a6fSJohn Johansen struct aa_label *label; 81056974a6fSJohn Johansen int error = 0; 81156974a6fSJohn Johansen 81256974a6fSJohn Johansen AA_BUG(in_interrupt()); 81356974a6fSJohn Johansen 81456974a6fSJohn Johansen label = begin_current_label_crit_section(); 81556974a6fSJohn Johansen if (!(kern || unconfined(label))) 81656974a6fSJohn Johansen error = af_select(family, 81756974a6fSJohn Johansen create_perm(label, family, type, protocol), 81856974a6fSJohn Johansen aa_af_perm(label, OP_CREATE, AA_MAY_CREATE, 81956974a6fSJohn Johansen family, type, protocol)); 82056974a6fSJohn Johansen end_current_label_crit_section(label); 82156974a6fSJohn Johansen 82256974a6fSJohn Johansen return error; 82356974a6fSJohn Johansen } 82456974a6fSJohn Johansen 82556974a6fSJohn Johansen /** 82656974a6fSJohn Johansen * apparmor_socket_post_create - setup the per-socket security struct 82756974a6fSJohn Johansen * 82856974a6fSJohn Johansen * Note: 82956974a6fSJohn Johansen * - kernel sockets currently labeled unconfined but we may want to 83056974a6fSJohn Johansen * move to a special kernel label 83156974a6fSJohn Johansen * - socket may not have sk here if created with sock_create_lite or 83256974a6fSJohn Johansen * sock_alloc. These should be accept cases which will be handled in 83356974a6fSJohn Johansen * sock_graft. 83456974a6fSJohn Johansen */ 83556974a6fSJohn Johansen static int apparmor_socket_post_create(struct socket *sock, int family, 83656974a6fSJohn Johansen int type, int protocol, int kern) 83756974a6fSJohn Johansen { 83856974a6fSJohn Johansen struct aa_label *label; 83956974a6fSJohn Johansen 84056974a6fSJohn Johansen if (kern) { 84156974a6fSJohn Johansen struct aa_ns *ns = aa_get_current_ns(); 84256974a6fSJohn Johansen 84356974a6fSJohn Johansen label = aa_get_label(ns_unconfined(ns)); 84456974a6fSJohn Johansen aa_put_ns(ns); 84556974a6fSJohn Johansen } else 84656974a6fSJohn Johansen label = aa_get_current_label(); 84756974a6fSJohn Johansen 84856974a6fSJohn Johansen if (sock->sk) { 84956974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sock->sk); 85056974a6fSJohn Johansen 85156974a6fSJohn Johansen aa_put_label(ctx->label); 85256974a6fSJohn Johansen ctx->label = aa_get_label(label); 85356974a6fSJohn Johansen } 85456974a6fSJohn Johansen aa_put_label(label); 85556974a6fSJohn Johansen 85656974a6fSJohn Johansen return 0; 85756974a6fSJohn Johansen } 85856974a6fSJohn Johansen 85956974a6fSJohn Johansen /** 86056974a6fSJohn Johansen * apparmor_socket_bind - check perms before bind addr to socket 86156974a6fSJohn Johansen */ 86256974a6fSJohn Johansen static int apparmor_socket_bind(struct socket *sock, 86356974a6fSJohn Johansen struct sockaddr *address, int addrlen) 86456974a6fSJohn Johansen { 86556974a6fSJohn Johansen AA_BUG(!sock); 86656974a6fSJohn Johansen AA_BUG(!sock->sk); 86756974a6fSJohn Johansen AA_BUG(!address); 86856974a6fSJohn Johansen AA_BUG(in_interrupt()); 86956974a6fSJohn Johansen 87056974a6fSJohn Johansen return af_select(sock->sk->sk_family, 87156974a6fSJohn Johansen bind_perm(sock, address, addrlen), 87256974a6fSJohn Johansen aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk)); 87356974a6fSJohn Johansen } 87456974a6fSJohn Johansen 87556974a6fSJohn Johansen /** 87656974a6fSJohn Johansen * apparmor_socket_connect - check perms before connecting @sock to @address 87756974a6fSJohn Johansen */ 87856974a6fSJohn Johansen static int apparmor_socket_connect(struct socket *sock, 87956974a6fSJohn Johansen struct sockaddr *address, int addrlen) 88056974a6fSJohn Johansen { 88156974a6fSJohn Johansen AA_BUG(!sock); 88256974a6fSJohn Johansen AA_BUG(!sock->sk); 88356974a6fSJohn Johansen AA_BUG(!address); 88456974a6fSJohn Johansen AA_BUG(in_interrupt()); 88556974a6fSJohn Johansen 88656974a6fSJohn Johansen return af_select(sock->sk->sk_family, 88756974a6fSJohn Johansen connect_perm(sock, address, addrlen), 88856974a6fSJohn Johansen aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk)); 88956974a6fSJohn Johansen } 89056974a6fSJohn Johansen 89156974a6fSJohn Johansen /** 89256974a6fSJohn Johansen * apparmor_socket_list - check perms before allowing listen 89356974a6fSJohn Johansen */ 89456974a6fSJohn Johansen static int apparmor_socket_listen(struct socket *sock, int backlog) 89556974a6fSJohn Johansen { 89656974a6fSJohn Johansen AA_BUG(!sock); 89756974a6fSJohn Johansen AA_BUG(!sock->sk); 89856974a6fSJohn Johansen AA_BUG(in_interrupt()); 89956974a6fSJohn Johansen 90056974a6fSJohn Johansen return af_select(sock->sk->sk_family, 90156974a6fSJohn Johansen listen_perm(sock, backlog), 90256974a6fSJohn Johansen aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk)); 90356974a6fSJohn Johansen } 90456974a6fSJohn Johansen 90556974a6fSJohn Johansen /** 90656974a6fSJohn Johansen * apparmor_socket_accept - check perms before accepting a new connection. 90756974a6fSJohn Johansen * 90856974a6fSJohn Johansen * Note: while @newsock is created and has some information, the accept 90956974a6fSJohn Johansen * has not been done. 91056974a6fSJohn Johansen */ 91156974a6fSJohn Johansen static int apparmor_socket_accept(struct socket *sock, struct socket *newsock) 91256974a6fSJohn Johansen { 91356974a6fSJohn Johansen AA_BUG(!sock); 91456974a6fSJohn Johansen AA_BUG(!sock->sk); 91556974a6fSJohn Johansen AA_BUG(!newsock); 91656974a6fSJohn Johansen AA_BUG(in_interrupt()); 91756974a6fSJohn Johansen 91856974a6fSJohn Johansen return af_select(sock->sk->sk_family, 91956974a6fSJohn Johansen accept_perm(sock, newsock), 92056974a6fSJohn Johansen aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk)); 92156974a6fSJohn Johansen } 92256974a6fSJohn Johansen 92356974a6fSJohn Johansen static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock, 92456974a6fSJohn Johansen struct msghdr *msg, int size) 92556974a6fSJohn Johansen { 92656974a6fSJohn Johansen AA_BUG(!sock); 92756974a6fSJohn Johansen AA_BUG(!sock->sk); 92856974a6fSJohn Johansen AA_BUG(!msg); 92956974a6fSJohn Johansen AA_BUG(in_interrupt()); 93056974a6fSJohn Johansen 93156974a6fSJohn Johansen return af_select(sock->sk->sk_family, 93256974a6fSJohn Johansen msg_perm(op, request, sock, msg, size), 93356974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 93456974a6fSJohn Johansen } 93556974a6fSJohn Johansen 93656974a6fSJohn Johansen /** 93756974a6fSJohn Johansen * apparmor_socket_sendmsg - check perms before sending msg to another socket 93856974a6fSJohn Johansen */ 93956974a6fSJohn Johansen static int apparmor_socket_sendmsg(struct socket *sock, 94056974a6fSJohn Johansen struct msghdr *msg, int size) 94156974a6fSJohn Johansen { 94256974a6fSJohn Johansen return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size); 94356974a6fSJohn Johansen } 94456974a6fSJohn Johansen 94556974a6fSJohn Johansen /** 94656974a6fSJohn Johansen * apparmor_socket_recvmsg - check perms before receiving a message 94756974a6fSJohn Johansen */ 94856974a6fSJohn Johansen static int apparmor_socket_recvmsg(struct socket *sock, 94956974a6fSJohn Johansen struct msghdr *msg, int size, int flags) 95056974a6fSJohn Johansen { 95156974a6fSJohn Johansen return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size); 95256974a6fSJohn Johansen } 95356974a6fSJohn Johansen 95456974a6fSJohn Johansen /* revaliation, get/set attr, shutdown */ 95556974a6fSJohn Johansen static int aa_sock_perm(const char *op, u32 request, struct socket *sock) 95656974a6fSJohn Johansen { 95756974a6fSJohn Johansen AA_BUG(!sock); 95856974a6fSJohn Johansen AA_BUG(!sock->sk); 95956974a6fSJohn Johansen AA_BUG(in_interrupt()); 96056974a6fSJohn Johansen 96156974a6fSJohn Johansen return af_select(sock->sk->sk_family, 96256974a6fSJohn Johansen sock_perm(op, request, sock), 96356974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 96456974a6fSJohn Johansen } 96556974a6fSJohn Johansen 96656974a6fSJohn Johansen /** 96756974a6fSJohn Johansen * apparmor_socket_getsockname - check perms before getting the local address 96856974a6fSJohn Johansen */ 96956974a6fSJohn Johansen static int apparmor_socket_getsockname(struct socket *sock) 97056974a6fSJohn Johansen { 97156974a6fSJohn Johansen return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock); 97256974a6fSJohn Johansen } 97356974a6fSJohn Johansen 97456974a6fSJohn Johansen /** 97556974a6fSJohn Johansen * apparmor_socket_getpeername - check perms before getting remote address 97656974a6fSJohn Johansen */ 97756974a6fSJohn Johansen static int apparmor_socket_getpeername(struct socket *sock) 97856974a6fSJohn Johansen { 97956974a6fSJohn Johansen return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock); 98056974a6fSJohn Johansen } 98156974a6fSJohn Johansen 98256974a6fSJohn Johansen /* revaliation, get/set attr, opt */ 98356974a6fSJohn Johansen static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock, 98456974a6fSJohn Johansen int level, int optname) 98556974a6fSJohn Johansen { 98656974a6fSJohn Johansen AA_BUG(!sock); 98756974a6fSJohn Johansen AA_BUG(!sock->sk); 98856974a6fSJohn Johansen AA_BUG(in_interrupt()); 98956974a6fSJohn Johansen 99056974a6fSJohn Johansen return af_select(sock->sk->sk_family, 99156974a6fSJohn Johansen opt_perm(op, request, sock, level, optname), 99256974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 99356974a6fSJohn Johansen } 99456974a6fSJohn Johansen 99556974a6fSJohn Johansen /** 99656974a6fSJohn Johansen * apparmor_getsockopt - check perms before getting socket options 99756974a6fSJohn Johansen */ 99856974a6fSJohn Johansen static int apparmor_socket_getsockopt(struct socket *sock, int level, 99956974a6fSJohn Johansen int optname) 100056974a6fSJohn Johansen { 100156974a6fSJohn Johansen return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock, 100256974a6fSJohn Johansen level, optname); 100356974a6fSJohn Johansen } 100456974a6fSJohn Johansen 100556974a6fSJohn Johansen /** 100656974a6fSJohn Johansen * apparmor_setsockopt - check perms before setting socket options 100756974a6fSJohn Johansen */ 100856974a6fSJohn Johansen static int apparmor_socket_setsockopt(struct socket *sock, int level, 100956974a6fSJohn Johansen int optname) 101056974a6fSJohn Johansen { 101156974a6fSJohn Johansen return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock, 101256974a6fSJohn Johansen level, optname); 101356974a6fSJohn Johansen } 101456974a6fSJohn Johansen 101556974a6fSJohn Johansen /** 101656974a6fSJohn Johansen * apparmor_socket_shutdown - check perms before shutting down @sock conn 101756974a6fSJohn Johansen */ 101856974a6fSJohn Johansen static int apparmor_socket_shutdown(struct socket *sock, int how) 101956974a6fSJohn Johansen { 102056974a6fSJohn Johansen return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock); 102156974a6fSJohn Johansen } 102256974a6fSJohn Johansen 102356974a6fSJohn Johansen /** 102456974a6fSJohn Johansen * apparmor_socket_sock_recv_skb - check perms before associating skb to sk 102556974a6fSJohn Johansen * 102656974a6fSJohn Johansen * Note: can not sleep may be called with locks held 102756974a6fSJohn Johansen * 102856974a6fSJohn Johansen * dont want protocol specific in __skb_recv_datagram() 102956974a6fSJohn Johansen * to deny an incoming connection socket_sock_rcv_skb() 103056974a6fSJohn Johansen */ 103156974a6fSJohn Johansen static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 103256974a6fSJohn Johansen { 103356974a6fSJohn Johansen return 0; 103456974a6fSJohn Johansen } 103556974a6fSJohn Johansen 103656974a6fSJohn Johansen 103756974a6fSJohn Johansen static struct aa_label *sk_peer_label(struct sock *sk) 103856974a6fSJohn Johansen { 103956974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 104056974a6fSJohn Johansen 104156974a6fSJohn Johansen if (ctx->peer) 104256974a6fSJohn Johansen return ctx->peer; 104356974a6fSJohn Johansen 104456974a6fSJohn Johansen return ERR_PTR(-ENOPROTOOPT); 104556974a6fSJohn Johansen } 104656974a6fSJohn Johansen 104756974a6fSJohn Johansen /** 104856974a6fSJohn Johansen * apparmor_socket_getpeersec_stream - get security context of peer 104956974a6fSJohn Johansen * 105056974a6fSJohn Johansen * Note: for tcp only valid if using ipsec or cipso on lan 105156974a6fSJohn Johansen */ 105256974a6fSJohn Johansen static int apparmor_socket_getpeersec_stream(struct socket *sock, 105356974a6fSJohn Johansen char __user *optval, 105456974a6fSJohn Johansen int __user *optlen, 105556974a6fSJohn Johansen unsigned int len) 105656974a6fSJohn Johansen { 105756974a6fSJohn Johansen char *name; 105856974a6fSJohn Johansen int slen, error = 0; 105956974a6fSJohn Johansen struct aa_label *label; 106056974a6fSJohn Johansen struct aa_label *peer; 106156974a6fSJohn Johansen 106256974a6fSJohn Johansen label = begin_current_label_crit_section(); 106356974a6fSJohn Johansen peer = sk_peer_label(sock->sk); 106456974a6fSJohn Johansen if (IS_ERR(peer)) { 106556974a6fSJohn Johansen error = PTR_ERR(peer); 106656974a6fSJohn Johansen goto done; 106756974a6fSJohn Johansen } 106856974a6fSJohn Johansen slen = aa_label_asxprint(&name, labels_ns(label), peer, 106956974a6fSJohn Johansen FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 107056974a6fSJohn Johansen FLAG_HIDDEN_UNCONFINED, GFP_KERNEL); 107156974a6fSJohn Johansen /* don't include terminating \0 in slen, it breaks some apps */ 107256974a6fSJohn Johansen if (slen < 0) { 107356974a6fSJohn Johansen error = -ENOMEM; 107456974a6fSJohn Johansen } else { 107556974a6fSJohn Johansen if (slen > len) { 107656974a6fSJohn Johansen error = -ERANGE; 107756974a6fSJohn Johansen } else if (copy_to_user(optval, name, slen)) { 107856974a6fSJohn Johansen error = -EFAULT; 107956974a6fSJohn Johansen goto out; 108056974a6fSJohn Johansen } 108156974a6fSJohn Johansen if (put_user(slen, optlen)) 108256974a6fSJohn Johansen error = -EFAULT; 108356974a6fSJohn Johansen out: 108456974a6fSJohn Johansen kfree(name); 108556974a6fSJohn Johansen 108656974a6fSJohn Johansen } 108756974a6fSJohn Johansen 108856974a6fSJohn Johansen done: 108956974a6fSJohn Johansen end_current_label_crit_section(label); 109056974a6fSJohn Johansen 109156974a6fSJohn Johansen return error; 109256974a6fSJohn Johansen } 109356974a6fSJohn Johansen 109456974a6fSJohn Johansen /** 109556974a6fSJohn Johansen * apparmor_socket_getpeersec_dgram - get security label of packet 109656974a6fSJohn Johansen * @sock: the peer socket 109756974a6fSJohn Johansen * @skb: packet data 109856974a6fSJohn Johansen * @secid: pointer to where to put the secid of the packet 109956974a6fSJohn Johansen * 110056974a6fSJohn Johansen * Sets the netlabel socket state on sk from parent 110156974a6fSJohn Johansen */ 110256974a6fSJohn Johansen static int apparmor_socket_getpeersec_dgram(struct socket *sock, 110356974a6fSJohn Johansen struct sk_buff *skb, u32 *secid) 110456974a6fSJohn Johansen 110556974a6fSJohn Johansen { 110656974a6fSJohn Johansen /* TODO: requires secid support */ 110756974a6fSJohn Johansen return -ENOPROTOOPT; 110856974a6fSJohn Johansen } 110956974a6fSJohn Johansen 111056974a6fSJohn Johansen /** 111156974a6fSJohn Johansen * apparmor_sock_graft - Initialize newly created socket 111256974a6fSJohn Johansen * @sk: child sock 111356974a6fSJohn Johansen * @parent: parent socket 111456974a6fSJohn Johansen * 111556974a6fSJohn Johansen * Note: could set off of SOCK_CTX(parent) but need to track inode and we can 111656974a6fSJohn Johansen * just set sk security information off of current creating process label 111756974a6fSJohn Johansen * Labeling of sk for accept case - probably should be sock based 111856974a6fSJohn Johansen * instead of task, because of the case where an implicitly labeled 111956974a6fSJohn Johansen * socket is shared by different tasks. 112056974a6fSJohn Johansen */ 112156974a6fSJohn Johansen static void apparmor_sock_graft(struct sock *sk, struct socket *parent) 112256974a6fSJohn Johansen { 112356974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 112456974a6fSJohn Johansen 112556974a6fSJohn Johansen if (!ctx->label) 112656974a6fSJohn Johansen ctx->label = aa_get_current_label(); 112756974a6fSJohn Johansen } 112856974a6fSJohn Johansen 1129ca97d939SJames Morris static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 1130e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 1131e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 1132e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 1133e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 1134b5e95b48SJohn Johansen 11352ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), 11362ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), 11372ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), 11382ea3ffb7SJohn Johansen 1139e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 1140e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 1141e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 1142e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 1143e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 1144e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 1145e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 1146e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 1147e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 1148e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 1149e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 1150b5e95b48SJohn Johansen 1151e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 1152064dc947SJohn Johansen LSM_HOOK_INIT(file_receive, apparmor_file_receive), 1153e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 1154e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 1155e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 1156e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 1157e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 1158e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 1159b5e95b48SJohn Johansen 1160e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 1161e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 1162b5e95b48SJohn Johansen 116356974a6fSJohn Johansen LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security), 116456974a6fSJohn Johansen LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security), 116556974a6fSJohn Johansen LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security), 116656974a6fSJohn Johansen 116756974a6fSJohn Johansen LSM_HOOK_INIT(socket_create, apparmor_socket_create), 116856974a6fSJohn Johansen LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create), 116956974a6fSJohn Johansen LSM_HOOK_INIT(socket_bind, apparmor_socket_bind), 117056974a6fSJohn Johansen LSM_HOOK_INIT(socket_connect, apparmor_socket_connect), 117156974a6fSJohn Johansen LSM_HOOK_INIT(socket_listen, apparmor_socket_listen), 117256974a6fSJohn Johansen LSM_HOOK_INIT(socket_accept, apparmor_socket_accept), 117356974a6fSJohn Johansen LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg), 117456974a6fSJohn Johansen LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg), 117556974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname), 117656974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername), 117756974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), 117856974a6fSJohn Johansen LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), 117956974a6fSJohn Johansen LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), 118056974a6fSJohn Johansen LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), 118156974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_stream, 118256974a6fSJohn Johansen apparmor_socket_getpeersec_stream), 118356974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_dgram, 118456974a6fSJohn Johansen apparmor_socket_getpeersec_dgram), 118556974a6fSJohn Johansen LSM_HOOK_INIT(sock_graft, apparmor_sock_graft), 118656974a6fSJohn Johansen 1187e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 1188e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 1189e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 1190e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 1191b5e95b48SJohn Johansen 1192e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds), 1193e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 1194e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 1195b5e95b48SJohn Johansen 11963b529a76SJohn Johansen LSM_HOOK_INIT(task_free, apparmor_task_free), 11973b529a76SJohn Johansen LSM_HOOK_INIT(task_alloc, apparmor_task_alloc), 1198a7ae3645SJohn Johansen LSM_HOOK_INIT(task_getsecid, apparmor_task_getsecid), 1199e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 1200cd1dbf76SJohn Johansen LSM_HOOK_INIT(task_kill, apparmor_task_kill), 1201c0929212SJohn Johansen 1202e79c26d0SMatthew Garrett #ifdef CONFIG_AUDIT 1203e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init), 1204e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known), 1205e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match), 1206e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free), 1207e79c26d0SMatthew Garrett #endif 1208e79c26d0SMatthew Garrett 1209c0929212SJohn Johansen LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), 1210c0929212SJohn Johansen LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), 1211c0929212SJohn Johansen LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), 1212b5e95b48SJohn Johansen }; 1213b5e95b48SJohn Johansen 1214b5e95b48SJohn Johansen /* 1215b5e95b48SJohn Johansen * AppArmor sysfs module parameters 1216b5e95b48SJohn Johansen */ 1217b5e95b48SJohn Johansen 1218101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 1219101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 1220b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 12219c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 12226a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1223101d6c82SStephen Rothwell .set = param_set_aabool, 1224101d6c82SStephen Rothwell .get = param_get_aabool 1225101d6c82SStephen Rothwell }; 1226b5e95b48SJohn Johansen 1227101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 1228101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 1229b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 12309c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 1231101d6c82SStephen Rothwell .set = param_set_aauint, 1232101d6c82SStephen Rothwell .get = param_get_aauint 1233101d6c82SStephen Rothwell }; 1234b5e95b48SJohn Johansen 1235101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 1236101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 1237b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 12389c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 12396a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1240101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 1241101d6c82SStephen Rothwell .get = param_get_aalockpolicy 1242101d6c82SStephen Rothwell }; 1243b5e95b48SJohn Johansen 1244e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp); 1245e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp); 1246b5e95b48SJohn Johansen 1247e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp); 1248e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp); 1249b5e95b48SJohn Johansen 1250b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 1251b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 1252b5e95b48SJohn Johansen */ 1253b5e95b48SJohn Johansen 1254b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 1255b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 1256b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 1257b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 1258b5e95b48SJohn Johansen 12596059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 12607616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 12613ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 12626059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 12637616ac70SArnd Bergmann #endif 12646059f71fSJohn Johansen 1265b5e95b48SJohn Johansen /* Debug mode */ 1266eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 1267b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 1268b5e95b48SJohn Johansen 1269b5e95b48SJohn Johansen /* Audit mode */ 1270b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 1271b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 1272b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 1273b5e95b48SJohn Johansen 1274b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 1275b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 1276b5e95b48SJohn Johansen */ 1277954317feSThomas Meyer bool aa_g_audit_header = true; 1278b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 1279b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1280b5e95b48SJohn Johansen 1281b5e95b48SJohn Johansen /* lock out loading/removal of policy 1282b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 1283b5e95b48SJohn Johansen * load policy, if lock_policy is set 1284b5e95b48SJohn Johansen */ 128590ab5ee9SRusty Russell bool aa_g_lock_policy; 1286b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 1287b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1288b5e95b48SJohn Johansen 1289b5e95b48SJohn Johansen /* Syscall logging mode */ 129090ab5ee9SRusty Russell bool aa_g_logsyscall; 1291b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 1292b5e95b48SJohn Johansen 1293b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 1294b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 1295622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 1296b5e95b48SJohn Johansen 1297b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 1298b5e95b48SJohn Johansen * on the loaded policy is done. 1299abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 1300abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 1301b5e95b48SJohn Johansen */ 1302954317feSThomas Meyer bool aa_g_paranoid_load = true; 1303abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 1304b5e95b48SJohn Johansen 1305b5e95b48SJohn Johansen /* Boot time disable flag */ 130690ab5ee9SRusty Russell static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE; 1307c611616cSJohn Johansen module_param_named(enabled, apparmor_enabled, bool, S_IRUGO); 1308b5e95b48SJohn Johansen 1309b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 1310b5e95b48SJohn Johansen { 1311b5e95b48SJohn Johansen unsigned long enabled; 131229707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 1313b5e95b48SJohn Johansen if (!error) 1314b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 1315b5e95b48SJohn Johansen return 1; 1316b5e95b48SJohn Johansen } 1317b5e95b48SJohn Johansen 1318b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 1319b5e95b48SJohn Johansen 1320b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 1321101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 1322b5e95b48SJohn Johansen { 1323545de8feSJohn Johansen if (!apparmor_enabled) 1324545de8feSJohn Johansen return -EINVAL; 1325545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 1326b5e95b48SJohn Johansen return -EPERM; 1327b5e95b48SJohn Johansen return param_set_bool(val, kp); 1328b5e95b48SJohn Johansen } 1329b5e95b48SJohn Johansen 1330101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 1331b5e95b48SJohn Johansen { 1332ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1333ca4bd5aeSJohn Johansen return -EINVAL; 1334545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 1335545de8feSJohn Johansen return -EPERM; 1336b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1337b5e95b48SJohn Johansen } 1338b5e95b48SJohn Johansen 1339101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 1340b5e95b48SJohn Johansen { 1341ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1342ca4bd5aeSJohn Johansen return -EINVAL; 1343545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 1344545de8feSJohn Johansen return -EPERM; 1345b5e95b48SJohn Johansen return param_set_bool(val, kp); 1346b5e95b48SJohn Johansen } 1347b5e95b48SJohn Johansen 1348101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 1349b5e95b48SJohn Johansen { 1350ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1351ca4bd5aeSJohn Johansen return -EINVAL; 1352545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 1353545de8feSJohn Johansen return -EPERM; 1354b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1355b5e95b48SJohn Johansen } 1356b5e95b48SJohn Johansen 1357101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 1358b5e95b48SJohn Johansen { 135939d84824SJohn Johansen int error; 136039d84824SJohn Johansen 1361ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1362ca4bd5aeSJohn Johansen return -EINVAL; 136339d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 136439d84824SJohn Johansen if (apparmor_initialized) 1365545de8feSJohn Johansen return -EPERM; 136639d84824SJohn Johansen 136739d84824SJohn Johansen error = param_set_uint(val, kp); 136839d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 136939d84824SJohn Johansen 137039d84824SJohn Johansen return error; 1371b5e95b48SJohn Johansen } 1372b5e95b48SJohn Johansen 1373101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 1374b5e95b48SJohn Johansen { 1375ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1376ca4bd5aeSJohn Johansen return -EINVAL; 1377545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 1378545de8feSJohn Johansen return -EPERM; 1379b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 1380b5e95b48SJohn Johansen } 1381b5e95b48SJohn Johansen 1382e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp) 1383b5e95b48SJohn Johansen { 1384b5e95b48SJohn Johansen if (!apparmor_enabled) 1385b5e95b48SJohn Johansen return -EINVAL; 1386545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 1387545de8feSJohn Johansen return -EPERM; 1388b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 1389b5e95b48SJohn Johansen } 1390b5e95b48SJohn Johansen 1391e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp) 1392b5e95b48SJohn Johansen { 1393b5e95b48SJohn Johansen int i; 1394b5e95b48SJohn Johansen 1395b5e95b48SJohn Johansen if (!apparmor_enabled) 1396b5e95b48SJohn Johansen return -EINVAL; 1397b5e95b48SJohn Johansen if (!val) 1398b5e95b48SJohn Johansen return -EINVAL; 1399545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 1400545de8feSJohn Johansen return -EPERM; 1401b5e95b48SJohn Johansen 14025d8779a5SAndy Shevchenko i = match_string(audit_mode_names, AUDIT_MAX_INDEX, val); 14035d8779a5SAndy Shevchenko if (i < 0) 14045d8779a5SAndy Shevchenko return -EINVAL; 14055d8779a5SAndy Shevchenko 1406b5e95b48SJohn Johansen aa_g_audit = i; 1407b5e95b48SJohn Johansen return 0; 1408b5e95b48SJohn Johansen } 1409b5e95b48SJohn Johansen 1410e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp) 1411b5e95b48SJohn Johansen { 1412b5e95b48SJohn Johansen if (!apparmor_enabled) 1413b5e95b48SJohn Johansen return -EINVAL; 1414545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 1415545de8feSJohn Johansen return -EPERM; 1416b5e95b48SJohn Johansen 14170d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 1418b5e95b48SJohn Johansen } 1419b5e95b48SJohn Johansen 1420e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp) 1421b5e95b48SJohn Johansen { 1422b5e95b48SJohn Johansen int i; 1423b5e95b48SJohn Johansen 1424b5e95b48SJohn Johansen if (!apparmor_enabled) 1425b5e95b48SJohn Johansen return -EINVAL; 1426b5e95b48SJohn Johansen if (!val) 1427b5e95b48SJohn Johansen return -EINVAL; 1428545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 1429545de8feSJohn Johansen return -EPERM; 1430b5e95b48SJohn Johansen 14315d8779a5SAndy Shevchenko i = match_string(aa_profile_mode_names, APPARMOR_MODE_NAMES_MAX_INDEX, 14325d8779a5SAndy Shevchenko val); 14335d8779a5SAndy Shevchenko if (i < 0) 14345d8779a5SAndy Shevchenko return -EINVAL; 14355d8779a5SAndy Shevchenko 1436b5e95b48SJohn Johansen aa_g_profile_mode = i; 1437b5e95b48SJohn Johansen return 0; 1438b5e95b48SJohn Johansen } 1439b5e95b48SJohn Johansen 1440b5e95b48SJohn Johansen /* 1441b5e95b48SJohn Johansen * AppArmor init functions 1442b5e95b48SJohn Johansen */ 1443b5e95b48SJohn Johansen 1444b5e95b48SJohn Johansen /** 144555a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 1446b5e95b48SJohn Johansen * 1447b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 1448b5e95b48SJohn Johansen */ 144955a26ebfSJohn Johansen static int __init set_init_ctx(void) 1450b5e95b48SJohn Johansen { 1451b5e95b48SJohn Johansen struct cred *cred = (struct cred *)current->real_cred; 145255a26ebfSJohn Johansen struct aa_task_ctx *ctx; 1453b5e95b48SJohn Johansen 1454f175221aSJohn Johansen ctx = aa_alloc_task_ctx(GFP_KERNEL); 145555a26ebfSJohn Johansen if (!ctx) 1456b5e95b48SJohn Johansen return -ENOMEM; 1457b5e95b48SJohn Johansen 1458d9087c49SJohn Johansen cred_label(cred) = aa_get_label(ns_unconfined(root_ns)); 1459f175221aSJohn Johansen task_ctx(current) = ctx; 1460b5e95b48SJohn Johansen 1461b5e95b48SJohn Johansen return 0; 1462b5e95b48SJohn Johansen } 1463b5e95b48SJohn Johansen 1464d4669f0bSJohn Johansen static void destroy_buffers(void) 1465d4669f0bSJohn Johansen { 1466d4669f0bSJohn Johansen u32 i, j; 1467d4669f0bSJohn Johansen 1468d4669f0bSJohn Johansen for_each_possible_cpu(i) { 1469d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 1470d4669f0bSJohn Johansen kfree(per_cpu(aa_buffers, i).buf[j]); 1471d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = NULL; 1472d4669f0bSJohn Johansen } 1473d4669f0bSJohn Johansen } 1474d4669f0bSJohn Johansen } 1475d4669f0bSJohn Johansen 1476d4669f0bSJohn Johansen static int __init alloc_buffers(void) 1477d4669f0bSJohn Johansen { 1478d4669f0bSJohn Johansen u32 i, j; 1479d4669f0bSJohn Johansen 1480d4669f0bSJohn Johansen for_each_possible_cpu(i) { 1481d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 1482d4669f0bSJohn Johansen char *buffer; 1483d4669f0bSJohn Johansen 1484d4669f0bSJohn Johansen if (cpu_to_node(i) > num_online_nodes()) 1485d4669f0bSJohn Johansen /* fallback to kmalloc for offline nodes */ 1486d4669f0bSJohn Johansen buffer = kmalloc(aa_g_path_max, GFP_KERNEL); 1487d4669f0bSJohn Johansen else 1488d4669f0bSJohn Johansen buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL, 1489d4669f0bSJohn Johansen cpu_to_node(i)); 1490d4669f0bSJohn Johansen if (!buffer) { 1491d4669f0bSJohn Johansen destroy_buffers(); 1492d4669f0bSJohn Johansen return -ENOMEM; 1493d4669f0bSJohn Johansen } 1494d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = buffer; 1495d4669f0bSJohn Johansen } 1496d4669f0bSJohn Johansen } 1497d4669f0bSJohn Johansen 1498d4669f0bSJohn Johansen return 0; 1499d4669f0bSJohn Johansen } 1500d4669f0bSJohn Johansen 1501e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 1502e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 1503e3ea1ca5STyler Hicks void __user *buffer, size_t *lenp, loff_t *ppos) 1504e3ea1ca5STyler Hicks { 1505e3ea1ca5STyler Hicks if (!policy_admin_capable(NULL)) 1506e3ea1ca5STyler Hicks return -EPERM; 1507e3ea1ca5STyler Hicks if (!apparmor_enabled) 1508e3ea1ca5STyler Hicks return -EINVAL; 1509e3ea1ca5STyler Hicks 1510e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 1511e3ea1ca5STyler Hicks } 1512e3ea1ca5STyler Hicks 1513e3ea1ca5STyler Hicks static struct ctl_path apparmor_sysctl_path[] = { 1514e3ea1ca5STyler Hicks { .procname = "kernel", }, 1515e3ea1ca5STyler Hicks { } 1516e3ea1ca5STyler Hicks }; 1517e3ea1ca5STyler Hicks 1518e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 1519e3ea1ca5STyler Hicks { 1520e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 1521e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 1522e3ea1ca5STyler Hicks .maxlen = sizeof(int), 1523e3ea1ca5STyler Hicks .mode = 0600, 1524e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 1525e3ea1ca5STyler Hicks }, 1526e3ea1ca5STyler Hicks { } 1527e3ea1ca5STyler Hicks }; 1528e3ea1ca5STyler Hicks 1529e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 1530e3ea1ca5STyler Hicks { 1531e3ea1ca5STyler Hicks return register_sysctl_paths(apparmor_sysctl_path, 1532e3ea1ca5STyler Hicks apparmor_sysctl_table) ? 0 : -ENOMEM; 1533e3ea1ca5STyler Hicks } 1534e3ea1ca5STyler Hicks #else 1535e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 1536e3ea1ca5STyler Hicks { 1537e3ea1ca5STyler Hicks return 0; 1538e3ea1ca5STyler Hicks } 1539e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 1540e3ea1ca5STyler Hicks 1541b5e95b48SJohn Johansen static int __init apparmor_init(void) 1542b5e95b48SJohn Johansen { 1543b5e95b48SJohn Johansen int error; 1544b5e95b48SJohn Johansen 1545b1d9e6b0SCasey Schaufler if (!apparmor_enabled || !security_module_enable("apparmor")) { 1546b5e95b48SJohn Johansen aa_info_message("AppArmor disabled by boot time parameter"); 1547954317feSThomas Meyer apparmor_enabled = false; 1548b5e95b48SJohn Johansen return 0; 1549b5e95b48SJohn Johansen } 1550b5e95b48SJohn Johansen 1551a4c3f89cSJohn Johansen aa_secids_init(); 1552a4c3f89cSJohn Johansen 155311c236b8SJohn Johansen error = aa_setup_dfa_engine(); 155411c236b8SJohn Johansen if (error) { 155511c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 155611c236b8SJohn Johansen goto alloc_out; 155711c236b8SJohn Johansen } 155811c236b8SJohn Johansen 1559b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 1560b5e95b48SJohn Johansen if (error) { 1561b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 1562b5e95b48SJohn Johansen goto alloc_out; 1563b5e95b48SJohn Johansen } 1564b5e95b48SJohn Johansen 1565e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 1566e3ea1ca5STyler Hicks if (error) { 1567e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 1568e3ea1ca5STyler Hicks goto alloc_out; 1569e3ea1ca5STyler Hicks 1570e3ea1ca5STyler Hicks } 1571e3ea1ca5STyler Hicks 1572d4669f0bSJohn Johansen error = alloc_buffers(); 1573d4669f0bSJohn Johansen if (error) { 1574d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 1575d4669f0bSJohn Johansen goto buffers_out; 1576d4669f0bSJohn Johansen } 1577d4669f0bSJohn Johansen 157855a26ebfSJohn Johansen error = set_init_ctx(); 1579b5e95b48SJohn Johansen if (error) { 1580b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1581b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1582d4669f0bSJohn Johansen goto buffers_out; 1583b5e95b48SJohn Johansen } 1584d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1585d69dece5SCasey Schaufler "apparmor"); 1586b5e95b48SJohn Johansen 1587b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1588b5e95b48SJohn Johansen apparmor_initialized = 1; 1589b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1590b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1591b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1592b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1593b5e95b48SJohn Johansen else 1594b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1595b5e95b48SJohn Johansen 1596b5e95b48SJohn Johansen return error; 1597b5e95b48SJohn Johansen 1598d4669f0bSJohn Johansen buffers_out: 1599d4669f0bSJohn Johansen destroy_buffers(); 1600d4669f0bSJohn Johansen 1601b5e95b48SJohn Johansen alloc_out: 1602b5e95b48SJohn Johansen aa_destroy_aafs(); 160311c236b8SJohn Johansen aa_teardown_dfa_engine(); 1604b5e95b48SJohn Johansen 1605954317feSThomas Meyer apparmor_enabled = false; 1606b5e95b48SJohn Johansen return error; 1607b5e95b48SJohn Johansen } 1608b5e95b48SJohn Johansen 16093d6e5f6dSKees Cook DEFINE_LSM(apparmor) = { 1610*07aed2f2SKees Cook .name = "apparmor", 16113d6e5f6dSKees Cook .init = apparmor_init, 16123d6e5f6dSKees Cook }; 1613