1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only 2b5e95b48SJohn Johansen /* 3b5e95b48SJohn Johansen * AppArmor security module 4b5e95b48SJohn Johansen * 5b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 6b5e95b48SJohn Johansen * 7b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 8b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 9b5e95b48SJohn Johansen */ 10b5e95b48SJohn Johansen 113c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 12b5e95b48SJohn Johansen #include <linux/moduleparam.h> 13b5e95b48SJohn Johansen #include <linux/mm.h> 14b5e95b48SJohn Johansen #include <linux/mman.h> 15b5e95b48SJohn Johansen #include <linux/mount.h> 16b5e95b48SJohn Johansen #include <linux/namei.h> 17b5e95b48SJohn Johansen #include <linux/ptrace.h> 18b5e95b48SJohn Johansen #include <linux/ctype.h> 19b5e95b48SJohn Johansen #include <linux/sysctl.h> 20b5e95b48SJohn Johansen #include <linux/audit.h> 213486740aSSerge E. Hallyn #include <linux/user_namespace.h> 22ab9f2115SMatthew Garrett #include <linux/netfilter_ipv4.h> 23ab9f2115SMatthew Garrett #include <linux/netfilter_ipv6.h> 2463c16c3aSChris Coulson #include <linux/zlib.h> 25b5e95b48SJohn Johansen #include <net/sock.h> 26e262e32dSDavid Howells #include <uapi/linux/mount.h> 27b5e95b48SJohn Johansen 28b5e95b48SJohn Johansen #include "include/apparmor.h" 29b5e95b48SJohn Johansen #include "include/apparmorfs.h" 30b5e95b48SJohn Johansen #include "include/audit.h" 31b5e95b48SJohn Johansen #include "include/capability.h" 32d8889d49SJohn Johansen #include "include/cred.h" 33b5e95b48SJohn Johansen #include "include/file.h" 34b5e95b48SJohn Johansen #include "include/ipc.h" 3556974a6fSJohn Johansen #include "include/net.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37637f688dSJohn Johansen #include "include/label.h" 38b5e95b48SJohn Johansen #include "include/policy.h" 39cff281f6SJohn Johansen #include "include/policy_ns.h" 40b5e95b48SJohn Johansen #include "include/procattr.h" 412ea3ffb7SJohn Johansen #include "include/mount.h" 42c0929212SJohn Johansen #include "include/secid.h" 43b5e95b48SJohn Johansen 44b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 45545de8feSJohn Johansen int apparmor_initialized; 46b5e95b48SJohn Johansen 47df323337SSebastian Andrzej Siewior union aa_buffer { 48df323337SSebastian Andrzej Siewior struct list_head list; 49df323337SSebastian Andrzej Siewior char buffer[1]; 50df323337SSebastian Andrzej Siewior }; 51d4669f0bSJohn Johansen 52341c1fdaSJohn Johansen #define RESERVE_COUNT 2 53341c1fdaSJohn Johansen static int reserve_count = RESERVE_COUNT; 54341c1fdaSJohn Johansen static int buffer_count; 55341c1fdaSJohn Johansen 56df323337SSebastian Andrzej Siewior static LIST_HEAD(aa_global_buffers); 57df323337SSebastian Andrzej Siewior static DEFINE_SPINLOCK(aa_buffers_lock); 58d4669f0bSJohn Johansen 59b5e95b48SJohn Johansen /* 60b5e95b48SJohn Johansen * LSM hook functions 61b5e95b48SJohn Johansen */ 62b5e95b48SJohn Johansen 63b5e95b48SJohn Johansen /* 64d9087c49SJohn Johansen * put the associated labels 65b5e95b48SJohn Johansen */ 66b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 67b5e95b48SJohn Johansen { 68d9087c49SJohn Johansen aa_put_label(cred_label(cred)); 6969b5a44aSCasey Schaufler set_cred_label(cred, NULL); 70b5e95b48SJohn Johansen } 71b5e95b48SJohn Johansen 72b5e95b48SJohn Johansen /* 73b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 74b5e95b48SJohn Johansen */ 75b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 76b5e95b48SJohn Johansen { 7769b5a44aSCasey Schaufler set_cred_label(cred, NULL); 78b5e95b48SJohn Johansen return 0; 79b5e95b48SJohn Johansen } 80b5e95b48SJohn Johansen 81b5e95b48SJohn Johansen /* 82d9087c49SJohn Johansen * prepare new cred label for modification by prepare_cred block 83b5e95b48SJohn Johansen */ 84b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 85b5e95b48SJohn Johansen gfp_t gfp) 86b5e95b48SJohn Johansen { 8769b5a44aSCasey Schaufler set_cred_label(new, aa_get_newest_label(cred_label(old))); 88b5e95b48SJohn Johansen return 0; 89b5e95b48SJohn Johansen } 90b5e95b48SJohn Johansen 91b5e95b48SJohn Johansen /* 92b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 93b5e95b48SJohn Johansen */ 94b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 95b5e95b48SJohn Johansen { 9669b5a44aSCasey Schaufler set_cred_label(new, aa_get_newest_label(cred_label(old))); 97b5e95b48SJohn Johansen } 98b5e95b48SJohn Johansen 993b529a76SJohn Johansen static void apparmor_task_free(struct task_struct *task) 1003b529a76SJohn Johansen { 1013b529a76SJohn Johansen 1023b529a76SJohn Johansen aa_free_task_ctx(task_ctx(task)); 1033b529a76SJohn Johansen } 1043b529a76SJohn Johansen 1053b529a76SJohn Johansen static int apparmor_task_alloc(struct task_struct *task, 1063b529a76SJohn Johansen unsigned long clone_flags) 1073b529a76SJohn Johansen { 108f4ad8f2cSCasey Schaufler struct aa_task_ctx *new = task_ctx(task); 1093b529a76SJohn Johansen 110de62de59SJohn Johansen aa_dup_task_ctx(new, task_ctx(current)); 1113b529a76SJohn Johansen 1123b529a76SJohn Johansen return 0; 113b5e95b48SJohn Johansen } 114b5e95b48SJohn Johansen 115b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 116b5e95b48SJohn Johansen unsigned int mode) 117b5e95b48SJohn Johansen { 118b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 119b2d09ae4SJohn Johansen int error; 120b2d09ae4SJohn Johansen 1211f8266ffSJann Horn tracer = __begin_current_label_crit_section(); 122b2d09ae4SJohn Johansen tracee = aa_get_task_label(child); 123b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, 124338d0be4SJohn Johansen (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ 125338d0be4SJohn Johansen : AA_PTRACE_TRACE); 126b2d09ae4SJohn Johansen aa_put_label(tracee); 1271f8266ffSJann Horn __end_current_label_crit_section(tracer); 128b2d09ae4SJohn Johansen 129b2d09ae4SJohn Johansen return error; 130b5e95b48SJohn Johansen } 131b5e95b48SJohn Johansen 132b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 133b5e95b48SJohn Johansen { 134b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 135b2d09ae4SJohn Johansen int error; 136b2d09ae4SJohn Johansen 137ca3fde52SJann Horn tracee = __begin_current_label_crit_section(); 138b2d09ae4SJohn Johansen tracer = aa_get_task_label(parent); 139b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE); 140b2d09ae4SJohn Johansen aa_put_label(tracer); 141ca3fde52SJann Horn __end_current_label_crit_section(tracee); 142b2d09ae4SJohn Johansen 143b2d09ae4SJohn Johansen return error; 144b5e95b48SJohn Johansen } 145b5e95b48SJohn Johansen 146b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 147b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 148b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 149b5e95b48SJohn Johansen { 150637f688dSJohn Johansen struct aa_label *label; 151b5e95b48SJohn Johansen const struct cred *cred; 152b5e95b48SJohn Johansen 153b5e95b48SJohn Johansen rcu_read_lock(); 154b5e95b48SJohn Johansen cred = __task_cred(target); 155637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 156c70c86c4SJohn Johansen 157b1d9e6b0SCasey Schaufler /* 158b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 159b1d9e6b0SCasey Schaufler * initialize effective and permitted. 160b1d9e6b0SCasey Schaufler */ 161c70c86c4SJohn Johansen if (!unconfined(label)) { 162c70c86c4SJohn Johansen struct aa_profile *profile; 163c70c86c4SJohn Johansen struct label_it i; 164c70c86c4SJohn Johansen 165c70c86c4SJohn Johansen label_for_each_confined(i, label, profile) { 166c70c86c4SJohn Johansen if (COMPLAIN_MODE(profile)) 167c70c86c4SJohn Johansen continue; 168c70c86c4SJohn Johansen *effective = cap_intersect(*effective, 169c70c86c4SJohn Johansen profile->caps.allow); 170c70c86c4SJohn Johansen *permitted = cap_intersect(*permitted, 171c70c86c4SJohn Johansen profile->caps.allow); 172c70c86c4SJohn Johansen } 173b5e95b48SJohn Johansen } 174b5e95b48SJohn Johansen rcu_read_unlock(); 175637f688dSJohn Johansen aa_put_label(label); 176b5e95b48SJohn Johansen 177b5e95b48SJohn Johansen return 0; 178b5e95b48SJohn Johansen } 179b5e95b48SJohn Johansen 1806a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 181c1a85a00SMicah Morton int cap, unsigned int opts) 182b5e95b48SJohn Johansen { 183637f688dSJohn Johansen struct aa_label *label; 184b1d9e6b0SCasey Schaufler int error = 0; 185b1d9e6b0SCasey Schaufler 186637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 187637f688dSJohn Johansen if (!unconfined(label)) 188c1a85a00SMicah Morton error = aa_capable(label, cap, opts); 189637f688dSJohn Johansen aa_put_label(label); 190cf797c0eSJohn Johansen 191b5e95b48SJohn Johansen return error; 192b5e95b48SJohn Johansen } 193b5e95b48SJohn Johansen 194b5e95b48SJohn Johansen /** 195b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 196b5e95b48SJohn Johansen * @op: operation being checked 197b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 198b5e95b48SJohn Johansen * @mask: requested permissions mask 199b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 200b5e95b48SJohn Johansen * 201b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 202b5e95b48SJohn Johansen */ 20347f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 204b5e95b48SJohn Johansen struct path_cond *cond) 205b5e95b48SJohn Johansen { 206637f688dSJohn Johansen struct aa_label *label; 207b5e95b48SJohn Johansen int error = 0; 208b5e95b48SJohn Johansen 209637f688dSJohn Johansen label = __begin_current_label_crit_section(); 210637f688dSJohn Johansen if (!unconfined(label)) 211aebd873eSJohn Johansen error = aa_path_perm(op, label, path, 0, mask, cond); 212637f688dSJohn Johansen __end_current_label_crit_section(label); 213b5e95b48SJohn Johansen 214b5e95b48SJohn Johansen return error; 215b5e95b48SJohn Johansen } 216b5e95b48SJohn Johansen 217b5e95b48SJohn Johansen /** 21831f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 21931f75bfeSJohn Johansen * @op: operation being checked 22031f75bfeSJohn Johansen * @path: location to check (NOT NULL) 22131f75bfeSJohn Johansen * @mask: requested permissions mask 22231f75bfeSJohn Johansen * 22331f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 22431f75bfeSJohn Johansen */ 22531f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 22631f75bfeSJohn Johansen { 2273cee6079SChristian Brauner struct user_namespace *mnt_userns = mnt_user_ns(path->mnt); 2283cee6079SChristian Brauner struct path_cond cond = { 2293cee6079SChristian Brauner i_uid_into_mnt(mnt_userns, d_backing_inode(path->dentry)), 23031f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 23131f75bfeSJohn Johansen }; 23231f75bfeSJohn Johansen 23331f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 23431f75bfeSJohn Johansen return 0; 23531f75bfeSJohn Johansen 23631f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 23731f75bfeSJohn Johansen } 23831f75bfeSJohn Johansen 23931f75bfeSJohn Johansen /** 240b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 241b5e95b48SJohn Johansen * @op: operation being checked 242b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 243b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 244b5e95b48SJohn Johansen * @mask: requested permissions mask 245b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 246b5e95b48SJohn Johansen * 247b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 248b5e95b48SJohn Johansen */ 24947f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 250b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 251b5e95b48SJohn Johansen struct path_cond *cond) 252b5e95b48SJohn Johansen { 2538486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 254b5e95b48SJohn Johansen 255b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 256b5e95b48SJohn Johansen } 257b5e95b48SJohn Johansen 258b5e95b48SJohn Johansen /** 259b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 260b5e95b48SJohn Johansen * @op: operation being checked 261b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 262b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 263b5e95b48SJohn Johansen * @mask: requested permission mask 264b5e95b48SJohn Johansen * 265b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 266b5e95b48SJohn Johansen */ 26747f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 268b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 269b5e95b48SJohn Johansen { 270c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 2713cee6079SChristian Brauner struct user_namespace *mnt_userns = mnt_user_ns(dir->mnt); 272b5e95b48SJohn Johansen struct path_cond cond = { }; 273b5e95b48SJohn Johansen 274efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 275b5e95b48SJohn Johansen return 0; 276b5e95b48SJohn Johansen 2773cee6079SChristian Brauner cond.uid = i_uid_into_mnt(mnt_userns, inode); 278b5e95b48SJohn Johansen cond.mode = inode->i_mode; 279b5e95b48SJohn Johansen 280b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 281b5e95b48SJohn Johansen } 282b5e95b48SJohn Johansen 283b5e95b48SJohn Johansen /** 284b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 285b5e95b48SJohn Johansen * @op: operation being checked 286b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 287b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 288b5e95b48SJohn Johansen * @mask: request permission mask 289b5e95b48SJohn Johansen * @mode: created file mode 290b5e95b48SJohn Johansen * 291b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 292b5e95b48SJohn Johansen */ 29347f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 294d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 295b5e95b48SJohn Johansen { 296b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 297b5e95b48SJohn Johansen 298efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 299b5e95b48SJohn Johansen return 0; 300b5e95b48SJohn Johansen 301b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 302b5e95b48SJohn Johansen } 303b5e95b48SJohn Johansen 304989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 305b5e95b48SJohn Johansen { 306b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 307b5e95b48SJohn Johansen } 308b5e95b48SJohn Johansen 309d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 3104572befeSAl Viro umode_t mode) 311b5e95b48SJohn Johansen { 312b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 313b5e95b48SJohn Johansen S_IFDIR); 314b5e95b48SJohn Johansen } 315b5e95b48SJohn Johansen 316989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 317b5e95b48SJohn Johansen { 318b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 319b5e95b48SJohn Johansen } 320b5e95b48SJohn Johansen 321d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 32204fc66e7SAl Viro umode_t mode, unsigned int dev) 323b5e95b48SJohn Johansen { 324b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 325b5e95b48SJohn Johansen } 326b5e95b48SJohn Johansen 32781f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 328b5e95b48SJohn Johansen { 329e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 330b5e95b48SJohn Johansen } 331b5e95b48SJohn Johansen 332d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 333b5e95b48SJohn Johansen const char *old_name) 334b5e95b48SJohn Johansen { 335b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 336b5e95b48SJohn Johansen S_IFLNK); 337b5e95b48SJohn Johansen } 338b5e95b48SJohn Johansen 3393ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 340b5e95b48SJohn Johansen struct dentry *new_dentry) 341b5e95b48SJohn Johansen { 342637f688dSJohn Johansen struct aa_label *label; 343b5e95b48SJohn Johansen int error = 0; 344b5e95b48SJohn Johansen 345efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 346b5e95b48SJohn Johansen return 0; 347b5e95b48SJohn Johansen 348637f688dSJohn Johansen label = begin_current_label_crit_section(); 349637f688dSJohn Johansen if (!unconfined(label)) 3508014370fSJohn Johansen error = aa_path_link(label, old_dentry, new_dir, new_dentry); 351637f688dSJohn Johansen end_current_label_crit_section(label); 352cf797c0eSJohn Johansen 353b5e95b48SJohn Johansen return error; 354b5e95b48SJohn Johansen } 355b5e95b48SJohn Johansen 3563ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 357100f59d9SMickaël Salaün const struct path *new_dir, struct dentry *new_dentry, 358100f59d9SMickaël Salaün const unsigned int flags) 359b5e95b48SJohn Johansen { 360637f688dSJohn Johansen struct aa_label *label; 361b5e95b48SJohn Johansen int error = 0; 362b5e95b48SJohn Johansen 363efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 364b5e95b48SJohn Johansen return 0; 365100f59d9SMickaël Salaün if ((flags & RENAME_EXCHANGE) && !path_mediated_fs(new_dentry)) 366100f59d9SMickaël Salaün return 0; 367b5e95b48SJohn Johansen 368637f688dSJohn Johansen label = begin_current_label_crit_section(); 369637f688dSJohn Johansen if (!unconfined(label)) { 3703cee6079SChristian Brauner struct user_namespace *mnt_userns = mnt_user_ns(old_dir->mnt); 3718486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3728486adf0SKees Cook .dentry = old_dentry }; 3738486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3748486adf0SKees Cook .dentry = new_dentry }; 3753cee6079SChristian Brauner struct path_cond cond = { 3763cee6079SChristian Brauner i_uid_into_mnt(mnt_userns, d_backing_inode(old_dentry)), 377c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 378b5e95b48SJohn Johansen }; 379b5e95b48SJohn Johansen 380100f59d9SMickaël Salaün if (flags & RENAME_EXCHANGE) { 381100f59d9SMickaël Salaün struct path_cond cond_exchange = { 382100f59d9SMickaël Salaün i_uid_into_mnt(mnt_userns, d_backing_inode(new_dentry)), 383100f59d9SMickaël Salaün d_backing_inode(new_dentry)->i_mode 384100f59d9SMickaël Salaün }; 385100f59d9SMickaël Salaün 386100f59d9SMickaël Salaün error = aa_path_perm(OP_RENAME_SRC, label, &new_path, 0, 387100f59d9SMickaël Salaün MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 388100f59d9SMickaël Salaün AA_MAY_SETATTR | AA_MAY_DELETE, 389100f59d9SMickaël Salaün &cond_exchange); 390100f59d9SMickaël Salaün if (!error) 391100f59d9SMickaël Salaün error = aa_path_perm(OP_RENAME_DEST, label, &old_path, 392100f59d9SMickaël Salaün 0, MAY_WRITE | AA_MAY_SETATTR | 393100f59d9SMickaël Salaün AA_MAY_CREATE, &cond_exchange); 394100f59d9SMickaël Salaün } 395100f59d9SMickaël Salaün 396100f59d9SMickaël Salaün if (!error) 397aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0, 398e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 399e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 400b5e95b48SJohn Johansen &cond); 401b5e95b48SJohn Johansen if (!error) 402aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_DEST, label, &new_path, 403e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 404b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 405b5e95b48SJohn Johansen 406b5e95b48SJohn Johansen } 407637f688dSJohn Johansen end_current_label_crit_section(label); 408cf797c0eSJohn Johansen 409b5e95b48SJohn Johansen return error; 410b5e95b48SJohn Johansen } 411b5e95b48SJohn Johansen 412be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 413b5e95b48SJohn Johansen { 41431f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 415b5e95b48SJohn Johansen } 416b5e95b48SJohn Johansen 4177fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 418b5e95b48SJohn Johansen { 41931f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 420b5e95b48SJohn Johansen } 421b5e95b48SJohn Johansen 4223f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 423b5e95b48SJohn Johansen { 424e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 425b5e95b48SJohn Johansen } 426b5e95b48SJohn Johansen 42794817692SAl Viro static int apparmor_file_open(struct file *file) 428b5e95b48SJohn Johansen { 429637f688dSJohn Johansen struct aa_file_ctx *fctx = file_ctx(file); 430637f688dSJohn Johansen struct aa_label *label; 431b5e95b48SJohn Johansen int error = 0; 432b5e95b48SJohn Johansen 433efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 434b5e95b48SJohn Johansen return 0; 435b5e95b48SJohn Johansen 436b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 437b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 438b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 439b5e95b48SJohn Johansen * actually execute the image. 440b5e95b48SJohn Johansen */ 441b5e95b48SJohn Johansen if (current->in_execve) { 44255a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 443b5e95b48SJohn Johansen return 0; 444b5e95b48SJohn Johansen } 445b5e95b48SJohn Johansen 44694817692SAl Viro label = aa_get_newest_cred_label(file->f_cred); 447637f688dSJohn Johansen if (!unconfined(label)) { 4483cee6079SChristian Brauner struct user_namespace *mnt_userns = file_mnt_user_ns(file); 449496ad9aaSAl Viro struct inode *inode = file_inode(file); 4503cee6079SChristian Brauner struct path_cond cond = { 4513cee6079SChristian Brauner i_uid_into_mnt(mnt_userns, inode), 4523cee6079SChristian Brauner inode->i_mode 4533cee6079SChristian Brauner }; 454b5e95b48SJohn Johansen 455aebd873eSJohn Johansen error = aa_path_perm(OP_OPEN, label, &file->f_path, 0, 456b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 457b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 45855a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 459b5e95b48SJohn Johansen } 460637f688dSJohn Johansen aa_put_label(label); 461b5e95b48SJohn Johansen 462b5e95b48SJohn Johansen return error; 463b5e95b48SJohn Johansen } 464b5e95b48SJohn Johansen 465b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 466b5e95b48SJohn Johansen { 46733bf60caSCasey Schaufler struct aa_file_ctx *ctx = file_ctx(file); 468637f688dSJohn Johansen struct aa_label *label = begin_current_label_crit_section(); 469b5e95b48SJohn Johansen 47033bf60caSCasey Schaufler spin_lock_init(&ctx->lock); 47133bf60caSCasey Schaufler rcu_assign_pointer(ctx->label, aa_get_label(label)); 47233bf60caSCasey Schaufler end_current_label_crit_section(label); 47333bf60caSCasey Schaufler return 0; 474b5e95b48SJohn Johansen } 475b5e95b48SJohn Johansen 476b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 477b5e95b48SJohn Johansen { 47833bf60caSCasey Schaufler struct aa_file_ctx *ctx = file_ctx(file); 47933bf60caSCasey Schaufler 48033bf60caSCasey Schaufler if (ctx) 48133bf60caSCasey Schaufler aa_put_label(rcu_access_pointer(ctx->label)); 482b5e95b48SJohn Johansen } 483b5e95b48SJohn Johansen 484341c1fdaSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask, 485341c1fdaSJohn Johansen bool in_atomic) 486b5e95b48SJohn Johansen { 487190a9518SJohn Johansen struct aa_label *label; 488b5e95b48SJohn Johansen int error = 0; 489b5e95b48SJohn Johansen 490192ca6b5SJohn Johansen /* don't reaudit files closed during inheritance */ 491192ca6b5SJohn Johansen if (file->f_path.dentry == aa_null.dentry) 492192ca6b5SJohn Johansen return -EACCES; 493192ca6b5SJohn Johansen 494637f688dSJohn Johansen label = __begin_current_label_crit_section(); 495341c1fdaSJohn Johansen error = aa_file_perm(op, label, file, mask, in_atomic); 496637f688dSJohn Johansen __end_current_label_crit_section(label); 497b5e95b48SJohn Johansen 498b5e95b48SJohn Johansen return error; 499b5e95b48SJohn Johansen } 500b5e95b48SJohn Johansen 501064dc947SJohn Johansen static int apparmor_file_receive(struct file *file) 502064dc947SJohn Johansen { 503341c1fdaSJohn Johansen return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file), 504341c1fdaSJohn Johansen false); 505064dc947SJohn Johansen } 506064dc947SJohn Johansen 507b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 508b5e95b48SJohn Johansen { 509341c1fdaSJohn Johansen return common_file_perm(OP_FPERM, file, mask, false); 510b5e95b48SJohn Johansen } 511b5e95b48SJohn Johansen 512b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 513b5e95b48SJohn Johansen { 514b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 515b5e95b48SJohn Johansen 516b5e95b48SJohn Johansen if (cmd == F_WRLCK) 517b5e95b48SJohn Johansen mask |= MAY_WRITE; 518b5e95b48SJohn Johansen 519341c1fdaSJohn Johansen return common_file_perm(OP_FLOCK, file, mask, false); 520b5e95b48SJohn Johansen } 521b5e95b48SJohn Johansen 52247f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 523341c1fdaSJohn Johansen unsigned long flags, bool in_atomic) 524b5e95b48SJohn Johansen { 525b5e95b48SJohn Johansen int mask = 0; 526b5e95b48SJohn Johansen 527637f688dSJohn Johansen if (!file || !file_ctx(file)) 528b5e95b48SJohn Johansen return 0; 529b5e95b48SJohn Johansen 530b5e95b48SJohn Johansen if (prot & PROT_READ) 531b5e95b48SJohn Johansen mask |= MAY_READ; 532b5e95b48SJohn Johansen /* 533b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 534b5e95b48SJohn Johansen * write back to the files 535b5e95b48SJohn Johansen */ 536b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 537b5e95b48SJohn Johansen mask |= MAY_WRITE; 538b5e95b48SJohn Johansen if (prot & PROT_EXEC) 539b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 540b5e95b48SJohn Johansen 541341c1fdaSJohn Johansen return common_file_perm(op, file, mask, in_atomic); 542b5e95b48SJohn Johansen } 543b5e95b48SJohn Johansen 544e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 545e5467859SAl Viro unsigned long prot, unsigned long flags) 546b5e95b48SJohn Johansen { 547341c1fdaSJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags, GFP_ATOMIC); 548b5e95b48SJohn Johansen } 549b5e95b48SJohn Johansen 550b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 551b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 552b5e95b48SJohn Johansen { 553b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 554341c1fdaSJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0, 555341c1fdaSJohn Johansen false); 556b5e95b48SJohn Johansen } 557b5e95b48SJohn Johansen 5582ea3ffb7SJohn Johansen static int apparmor_sb_mount(const char *dev_name, const struct path *path, 5592ea3ffb7SJohn Johansen const char *type, unsigned long flags, void *data) 5602ea3ffb7SJohn Johansen { 5612ea3ffb7SJohn Johansen struct aa_label *label; 5622ea3ffb7SJohn Johansen int error = 0; 5632ea3ffb7SJohn Johansen 5642ea3ffb7SJohn Johansen /* Discard magic */ 5652ea3ffb7SJohn Johansen if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 5662ea3ffb7SJohn Johansen flags &= ~MS_MGC_MSK; 5672ea3ffb7SJohn Johansen 5682ea3ffb7SJohn Johansen flags &= ~AA_MS_IGNORE_MASK; 5692ea3ffb7SJohn Johansen 5702ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5712ea3ffb7SJohn Johansen if (!unconfined(label)) { 5722ea3ffb7SJohn Johansen if (flags & MS_REMOUNT) 5732ea3ffb7SJohn Johansen error = aa_remount(label, path, flags, data); 5742ea3ffb7SJohn Johansen else if (flags & MS_BIND) 5752ea3ffb7SJohn Johansen error = aa_bind_mount(label, path, dev_name, flags); 5762ea3ffb7SJohn Johansen else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | 5772ea3ffb7SJohn Johansen MS_UNBINDABLE)) 5782ea3ffb7SJohn Johansen error = aa_mount_change_type(label, path, flags); 5792ea3ffb7SJohn Johansen else if (flags & MS_MOVE) 5802ea3ffb7SJohn Johansen error = aa_move_mount(label, path, dev_name); 5812ea3ffb7SJohn Johansen else 5822ea3ffb7SJohn Johansen error = aa_new_mount(label, dev_name, path, type, 5832ea3ffb7SJohn Johansen flags, data); 5842ea3ffb7SJohn Johansen } 5852ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5862ea3ffb7SJohn Johansen 5872ea3ffb7SJohn Johansen return error; 5882ea3ffb7SJohn Johansen } 5892ea3ffb7SJohn Johansen 5902ea3ffb7SJohn Johansen static int apparmor_sb_umount(struct vfsmount *mnt, int flags) 5912ea3ffb7SJohn Johansen { 5922ea3ffb7SJohn Johansen struct aa_label *label; 5932ea3ffb7SJohn Johansen int error = 0; 5942ea3ffb7SJohn Johansen 5952ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5962ea3ffb7SJohn Johansen if (!unconfined(label)) 5972ea3ffb7SJohn Johansen error = aa_umount(label, mnt, flags); 5982ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5992ea3ffb7SJohn Johansen 6002ea3ffb7SJohn Johansen return error; 6012ea3ffb7SJohn Johansen } 6022ea3ffb7SJohn Johansen 6032ea3ffb7SJohn Johansen static int apparmor_sb_pivotroot(const struct path *old_path, 6042ea3ffb7SJohn Johansen const struct path *new_path) 6052ea3ffb7SJohn Johansen { 6062ea3ffb7SJohn Johansen struct aa_label *label; 6072ea3ffb7SJohn Johansen int error = 0; 6082ea3ffb7SJohn Johansen 6092ea3ffb7SJohn Johansen label = aa_get_current_label(); 6102ea3ffb7SJohn Johansen if (!unconfined(label)) 6112ea3ffb7SJohn Johansen error = aa_pivotroot(label, old_path, new_path); 6122ea3ffb7SJohn Johansen aa_put_label(label); 6132ea3ffb7SJohn Johansen 6142ea3ffb7SJohn Johansen return error; 6152ea3ffb7SJohn Johansen } 6162ea3ffb7SJohn Johansen 617b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 618b5e95b48SJohn Johansen char **value) 619b5e95b48SJohn Johansen { 620b5e95b48SJohn Johansen int error = -ENOENT; 621b5e95b48SJohn Johansen /* released below */ 622b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 623de62de59SJohn Johansen struct aa_task_ctx *ctx = task_ctx(current); 624637f688dSJohn Johansen struct aa_label *label = NULL; 625b5e95b48SJohn Johansen 626b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 627d9087c49SJohn Johansen label = aa_get_newest_label(cred_label(cred)); 62855a26ebfSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 629637f688dSJohn Johansen label = aa_get_newest_label(ctx->previous); 63055a26ebfSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 631637f688dSJohn Johansen label = aa_get_newest_label(ctx->onexec); 632b5e95b48SJohn Johansen else 633b5e95b48SJohn Johansen error = -EINVAL; 634b5e95b48SJohn Johansen 635637f688dSJohn Johansen if (label) 63676a1d263SJohn Johansen error = aa_getprocattr(label, value); 63777b071b3SJohn Johansen 638637f688dSJohn Johansen aa_put_label(label); 639b5e95b48SJohn Johansen put_cred(cred); 640b5e95b48SJohn Johansen 641b5e95b48SJohn Johansen return error; 642b5e95b48SJohn Johansen } 643b5e95b48SJohn Johansen 644b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 645b21507e2SStephen Smalley size_t size) 646b5e95b48SJohn Johansen { 647e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 648b5e95b48SJohn Johansen size_t arg_size; 649b5e95b48SJohn Johansen int error; 650ef88a7acSJohn Johansen DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR); 651b5e95b48SJohn Johansen 652b5e95b48SJohn Johansen if (size == 0) 653b5e95b48SJohn Johansen return -EINVAL; 654b5e95b48SJohn Johansen 655e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 656e89b8081SVegard Nossum if (args[size - 1] != '\0') { 657e89b8081SVegard Nossum /* null terminate */ 658e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 659e89b8081SVegard Nossum if (!args) 660e89b8081SVegard Nossum return -ENOMEM; 661e89b8081SVegard Nossum memcpy(args, value, size); 662e89b8081SVegard Nossum args[size] = '\0'; 663e89b8081SVegard Nossum } 664e89b8081SVegard Nossum 665e89b8081SVegard Nossum error = -EINVAL; 666b5e95b48SJohn Johansen args = strim(args); 667b5e95b48SJohn Johansen command = strsep(&args, " "); 668b5e95b48SJohn Johansen if (!args) 669e89b8081SVegard Nossum goto out; 670b5e95b48SJohn Johansen args = skip_spaces(args); 671b5e95b48SJohn Johansen if (!*args) 672e89b8081SVegard Nossum goto out; 673b5e95b48SJohn Johansen 674d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 675b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 676b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 677b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 678df8073c6SJohn Johansen AA_CHANGE_NOFLAGS); 679b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 680b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 681df8073c6SJohn Johansen AA_CHANGE_TEST); 682b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 683df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_NOFLAGS); 684b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 685df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_TEST); 6866c5fc8f1SJohn Johansen } else if (strcmp(command, "stack") == 0) { 6876c5fc8f1SJohn Johansen error = aa_change_profile(args, AA_CHANGE_STACK); 6883eea57c2SJohn Johansen } else 6893eea57c2SJohn Johansen goto fail; 690b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 6913eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 692df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_ONEXEC); 6936c5fc8f1SJohn Johansen else if (strcmp(command, "stack") == 0) 6946c5fc8f1SJohn Johansen error = aa_change_profile(args, (AA_CHANGE_ONEXEC | 6956c5fc8f1SJohn Johansen AA_CHANGE_STACK)); 6963eea57c2SJohn Johansen else 6973eea57c2SJohn Johansen goto fail; 6983eea57c2SJohn Johansen } else 699b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 700e89b8081SVegard Nossum goto fail; 7013eea57c2SJohn Johansen 702b5e95b48SJohn Johansen if (!error) 703b5e95b48SJohn Johansen error = size; 704e89b8081SVegard Nossum out: 705e89b8081SVegard Nossum kfree(largs); 706b5e95b48SJohn Johansen return error; 7073eea57c2SJohn Johansen 7083eea57c2SJohn Johansen fail: 709637f688dSJohn Johansen aad(&sa)->label = begin_current_label_crit_section(); 710ef88a7acSJohn Johansen aad(&sa)->info = name; 711ef88a7acSJohn Johansen aad(&sa)->error = error = -EINVAL; 7123eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 713637f688dSJohn Johansen end_current_label_crit_section(aad(&sa)->label); 714e89b8081SVegard Nossum goto out; 715b5e95b48SJohn Johansen } 716b5e95b48SJohn Johansen 717fe864821SJohn Johansen /** 718fe864821SJohn Johansen * apparmor_bprm_committing_creds - do task cleanup on committing new creds 719fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 720fe864821SJohn Johansen */ 721fe864821SJohn Johansen static void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 722fe864821SJohn Johansen { 723637f688dSJohn Johansen struct aa_label *label = aa_current_raw_label(); 724d9087c49SJohn Johansen struct aa_label *new_label = cred_label(bprm->cred); 725fe864821SJohn Johansen 726fe864821SJohn Johansen /* bail out if unconfined or not changing profile */ 727d9087c49SJohn Johansen if ((new_label->proxy == label->proxy) || 728d9087c49SJohn Johansen (unconfined(new_label))) 729fe864821SJohn Johansen return; 730fe864821SJohn Johansen 731192ca6b5SJohn Johansen aa_inherit_files(bprm->cred, current->files); 732192ca6b5SJohn Johansen 733fe864821SJohn Johansen current->pdeath_signal = 0; 734fe864821SJohn Johansen 735637f688dSJohn Johansen /* reset soft limits and set hard limits for the new label */ 736d9087c49SJohn Johansen __aa_transition_rlimits(label, new_label); 737fe864821SJohn Johansen } 738fe864821SJohn Johansen 739fe864821SJohn Johansen /** 740fe864821SJohn Johansen * apparmor_bprm_committed_cred - do cleanup after new creds committed 741fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 742fe864821SJohn Johansen */ 743fe864821SJohn Johansen static void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 744fe864821SJohn Johansen { 7453b529a76SJohn Johansen /* clear out temporary/transitional state from the context */ 746de62de59SJohn Johansen aa_clear_task_ctx_trans(task_ctx(current)); 7473b529a76SJohn Johansen 748fe864821SJohn Johansen return; 749fe864821SJohn Johansen } 750fe864821SJohn Johansen 7516326948fSPaul Moore static void apparmor_current_getsecid_subj(u32 *secid) 7526326948fSPaul Moore { 7536326948fSPaul Moore struct aa_label *label = aa_get_current_label(); 7546326948fSPaul Moore *secid = label->secid; 7556326948fSPaul Moore aa_put_label(label); 7566326948fSPaul Moore } 7576326948fSPaul Moore 7586326948fSPaul Moore static void apparmor_task_getsecid_obj(struct task_struct *p, u32 *secid) 759a7ae3645SJohn Johansen { 760a7ae3645SJohn Johansen struct aa_label *label = aa_get_task_label(p); 761a7ae3645SJohn Johansen *secid = label->secid; 762a7ae3645SJohn Johansen aa_put_label(label); 763a7ae3645SJohn Johansen } 764a7ae3645SJohn Johansen 7657cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 7667cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 767b5e95b48SJohn Johansen { 768637f688dSJohn Johansen struct aa_label *label = __begin_current_label_crit_section(); 769b5e95b48SJohn Johansen int error = 0; 770b5e95b48SJohn Johansen 771637f688dSJohn Johansen if (!unconfined(label)) 77286b92cb7SJohn Johansen error = aa_task_setrlimit(label, task, resource, new_rlim); 773637f688dSJohn Johansen __end_current_label_crit_section(label); 774b5e95b48SJohn Johansen 775b5e95b48SJohn Johansen return error; 776b5e95b48SJohn Johansen } 777b5e95b48SJohn Johansen 778ae7795bcSEric W. Biederman static int apparmor_task_kill(struct task_struct *target, struct kernel_siginfo *info, 7796b4f3d01SStephen Smalley int sig, const struct cred *cred) 780cd1dbf76SJohn Johansen { 781cd1dbf76SJohn Johansen struct aa_label *cl, *tl; 782cd1dbf76SJohn Johansen int error; 783cd1dbf76SJohn Johansen 7846b4f3d01SStephen Smalley if (cred) { 7856b4f3d01SStephen Smalley /* 786cd1dbf76SJohn Johansen * Dealing with USB IO specific behavior 787cd1dbf76SJohn Johansen */ 7886b4f3d01SStephen Smalley cl = aa_get_newest_cred_label(cred); 7896b4f3d01SStephen Smalley tl = aa_get_task_label(target); 7906b4f3d01SStephen Smalley error = aa_may_signal(cl, tl, sig); 7916b4f3d01SStephen Smalley aa_put_label(cl); 7926b4f3d01SStephen Smalley aa_put_label(tl); 7936b4f3d01SStephen Smalley return error; 7946b4f3d01SStephen Smalley } 7956b4f3d01SStephen Smalley 796cd1dbf76SJohn Johansen cl = __begin_current_label_crit_section(); 797cd1dbf76SJohn Johansen tl = aa_get_task_label(target); 798cd1dbf76SJohn Johansen error = aa_may_signal(cl, tl, sig); 799cd1dbf76SJohn Johansen aa_put_label(tl); 800cd1dbf76SJohn Johansen __end_current_label_crit_section(cl); 801cd1dbf76SJohn Johansen 802cd1dbf76SJohn Johansen return error; 803cd1dbf76SJohn Johansen } 804cd1dbf76SJohn Johansen 80556974a6fSJohn Johansen /** 80656974a6fSJohn Johansen * apparmor_sk_alloc_security - allocate and attach the sk_security field 80756974a6fSJohn Johansen */ 80856974a6fSJohn Johansen static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags) 80956974a6fSJohn Johansen { 81056974a6fSJohn Johansen struct aa_sk_ctx *ctx; 81156974a6fSJohn Johansen 81256974a6fSJohn Johansen ctx = kzalloc(sizeof(*ctx), flags); 81356974a6fSJohn Johansen if (!ctx) 81456974a6fSJohn Johansen return -ENOMEM; 81556974a6fSJohn Johansen 81656974a6fSJohn Johansen SK_CTX(sk) = ctx; 81756974a6fSJohn Johansen 81856974a6fSJohn Johansen return 0; 81956974a6fSJohn Johansen } 82056974a6fSJohn Johansen 82156974a6fSJohn Johansen /** 82256974a6fSJohn Johansen * apparmor_sk_free_security - free the sk_security field 82356974a6fSJohn Johansen */ 82456974a6fSJohn Johansen static void apparmor_sk_free_security(struct sock *sk) 82556974a6fSJohn Johansen { 82656974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 82756974a6fSJohn Johansen 82856974a6fSJohn Johansen SK_CTX(sk) = NULL; 82956974a6fSJohn Johansen aa_put_label(ctx->label); 83056974a6fSJohn Johansen aa_put_label(ctx->peer); 83156974a6fSJohn Johansen kfree(ctx); 83256974a6fSJohn Johansen } 83356974a6fSJohn Johansen 83456974a6fSJohn Johansen /** 835*0fc6ab40SYang Li * apparmor_sk_clone_security - clone the sk_security field 83656974a6fSJohn Johansen */ 83756974a6fSJohn Johansen static void apparmor_sk_clone_security(const struct sock *sk, 83856974a6fSJohn Johansen struct sock *newsk) 83956974a6fSJohn Johansen { 84056974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 84156974a6fSJohn Johansen struct aa_sk_ctx *new = SK_CTX(newsk); 84256974a6fSJohn Johansen 8433b646abcSMauricio Faria de Oliveira if (new->label) 8443b646abcSMauricio Faria de Oliveira aa_put_label(new->label); 84556974a6fSJohn Johansen new->label = aa_get_label(ctx->label); 8463b646abcSMauricio Faria de Oliveira 8473b646abcSMauricio Faria de Oliveira if (new->peer) 8483b646abcSMauricio Faria de Oliveira aa_put_label(new->peer); 84956974a6fSJohn Johansen new->peer = aa_get_label(ctx->peer); 85056974a6fSJohn Johansen } 85156974a6fSJohn Johansen 85256974a6fSJohn Johansen /** 85356974a6fSJohn Johansen * apparmor_socket_create - check perms before creating a new socket 85456974a6fSJohn Johansen */ 85556974a6fSJohn Johansen static int apparmor_socket_create(int family, int type, int protocol, int kern) 85656974a6fSJohn Johansen { 85756974a6fSJohn Johansen struct aa_label *label; 85856974a6fSJohn Johansen int error = 0; 85956974a6fSJohn Johansen 86056974a6fSJohn Johansen AA_BUG(in_interrupt()); 86156974a6fSJohn Johansen 86256974a6fSJohn Johansen label = begin_current_label_crit_section(); 86356974a6fSJohn Johansen if (!(kern || unconfined(label))) 86456974a6fSJohn Johansen error = af_select(family, 86556974a6fSJohn Johansen create_perm(label, family, type, protocol), 86656974a6fSJohn Johansen aa_af_perm(label, OP_CREATE, AA_MAY_CREATE, 86756974a6fSJohn Johansen family, type, protocol)); 86856974a6fSJohn Johansen end_current_label_crit_section(label); 86956974a6fSJohn Johansen 87056974a6fSJohn Johansen return error; 87156974a6fSJohn Johansen } 87256974a6fSJohn Johansen 87356974a6fSJohn Johansen /** 87456974a6fSJohn Johansen * apparmor_socket_post_create - setup the per-socket security struct 87556974a6fSJohn Johansen * 87656974a6fSJohn Johansen * Note: 87756974a6fSJohn Johansen * - kernel sockets currently labeled unconfined but we may want to 87856974a6fSJohn Johansen * move to a special kernel label 87956974a6fSJohn Johansen * - socket may not have sk here if created with sock_create_lite or 88056974a6fSJohn Johansen * sock_alloc. These should be accept cases which will be handled in 88156974a6fSJohn Johansen * sock_graft. 88256974a6fSJohn Johansen */ 88356974a6fSJohn Johansen static int apparmor_socket_post_create(struct socket *sock, int family, 88456974a6fSJohn Johansen int type, int protocol, int kern) 88556974a6fSJohn Johansen { 88656974a6fSJohn Johansen struct aa_label *label; 88756974a6fSJohn Johansen 88856974a6fSJohn Johansen if (kern) { 88956974a6fSJohn Johansen struct aa_ns *ns = aa_get_current_ns(); 89056974a6fSJohn Johansen 89156974a6fSJohn Johansen label = aa_get_label(ns_unconfined(ns)); 89256974a6fSJohn Johansen aa_put_ns(ns); 89356974a6fSJohn Johansen } else 89456974a6fSJohn Johansen label = aa_get_current_label(); 89556974a6fSJohn Johansen 89656974a6fSJohn Johansen if (sock->sk) { 89756974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sock->sk); 89856974a6fSJohn Johansen 89956974a6fSJohn Johansen aa_put_label(ctx->label); 90056974a6fSJohn Johansen ctx->label = aa_get_label(label); 90156974a6fSJohn Johansen } 90256974a6fSJohn Johansen aa_put_label(label); 90356974a6fSJohn Johansen 90456974a6fSJohn Johansen return 0; 90556974a6fSJohn Johansen } 90656974a6fSJohn Johansen 90756974a6fSJohn Johansen /** 90856974a6fSJohn Johansen * apparmor_socket_bind - check perms before bind addr to socket 90956974a6fSJohn Johansen */ 91056974a6fSJohn Johansen static int apparmor_socket_bind(struct socket *sock, 91156974a6fSJohn Johansen struct sockaddr *address, int addrlen) 91256974a6fSJohn Johansen { 91356974a6fSJohn Johansen AA_BUG(!sock); 91456974a6fSJohn Johansen AA_BUG(!sock->sk); 91556974a6fSJohn Johansen AA_BUG(!address); 91656974a6fSJohn Johansen AA_BUG(in_interrupt()); 91756974a6fSJohn Johansen 91856974a6fSJohn Johansen return af_select(sock->sk->sk_family, 91956974a6fSJohn Johansen bind_perm(sock, address, addrlen), 92056974a6fSJohn Johansen aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk)); 92156974a6fSJohn Johansen } 92256974a6fSJohn Johansen 92356974a6fSJohn Johansen /** 92456974a6fSJohn Johansen * apparmor_socket_connect - check perms before connecting @sock to @address 92556974a6fSJohn Johansen */ 92656974a6fSJohn Johansen static int apparmor_socket_connect(struct socket *sock, 92756974a6fSJohn Johansen struct sockaddr *address, int addrlen) 92856974a6fSJohn Johansen { 92956974a6fSJohn Johansen AA_BUG(!sock); 93056974a6fSJohn Johansen AA_BUG(!sock->sk); 93156974a6fSJohn Johansen AA_BUG(!address); 93256974a6fSJohn Johansen AA_BUG(in_interrupt()); 93356974a6fSJohn Johansen 93456974a6fSJohn Johansen return af_select(sock->sk->sk_family, 93556974a6fSJohn Johansen connect_perm(sock, address, addrlen), 93656974a6fSJohn Johansen aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk)); 93756974a6fSJohn Johansen } 93856974a6fSJohn Johansen 93956974a6fSJohn Johansen /** 940*0fc6ab40SYang Li * apparmor_socket_listen - check perms before allowing listen 94156974a6fSJohn Johansen */ 94256974a6fSJohn Johansen static int apparmor_socket_listen(struct socket *sock, int backlog) 94356974a6fSJohn Johansen { 94456974a6fSJohn Johansen AA_BUG(!sock); 94556974a6fSJohn Johansen AA_BUG(!sock->sk); 94656974a6fSJohn Johansen AA_BUG(in_interrupt()); 94756974a6fSJohn Johansen 94856974a6fSJohn Johansen return af_select(sock->sk->sk_family, 94956974a6fSJohn Johansen listen_perm(sock, backlog), 95056974a6fSJohn Johansen aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk)); 95156974a6fSJohn Johansen } 95256974a6fSJohn Johansen 95356974a6fSJohn Johansen /** 95456974a6fSJohn Johansen * apparmor_socket_accept - check perms before accepting a new connection. 95556974a6fSJohn Johansen * 95656974a6fSJohn Johansen * Note: while @newsock is created and has some information, the accept 95756974a6fSJohn Johansen * has not been done. 95856974a6fSJohn Johansen */ 95956974a6fSJohn Johansen static int apparmor_socket_accept(struct socket *sock, struct socket *newsock) 96056974a6fSJohn Johansen { 96156974a6fSJohn Johansen AA_BUG(!sock); 96256974a6fSJohn Johansen AA_BUG(!sock->sk); 96356974a6fSJohn Johansen AA_BUG(!newsock); 96456974a6fSJohn Johansen AA_BUG(in_interrupt()); 96556974a6fSJohn Johansen 96656974a6fSJohn Johansen return af_select(sock->sk->sk_family, 96756974a6fSJohn Johansen accept_perm(sock, newsock), 96856974a6fSJohn Johansen aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk)); 96956974a6fSJohn Johansen } 97056974a6fSJohn Johansen 97156974a6fSJohn Johansen static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock, 97256974a6fSJohn Johansen struct msghdr *msg, int size) 97356974a6fSJohn Johansen { 97456974a6fSJohn Johansen AA_BUG(!sock); 97556974a6fSJohn Johansen AA_BUG(!sock->sk); 97656974a6fSJohn Johansen AA_BUG(!msg); 97756974a6fSJohn Johansen AA_BUG(in_interrupt()); 97856974a6fSJohn Johansen 97956974a6fSJohn Johansen return af_select(sock->sk->sk_family, 98056974a6fSJohn Johansen msg_perm(op, request, sock, msg, size), 98156974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 98256974a6fSJohn Johansen } 98356974a6fSJohn Johansen 98456974a6fSJohn Johansen /** 98556974a6fSJohn Johansen * apparmor_socket_sendmsg - check perms before sending msg to another socket 98656974a6fSJohn Johansen */ 98756974a6fSJohn Johansen static int apparmor_socket_sendmsg(struct socket *sock, 98856974a6fSJohn Johansen struct msghdr *msg, int size) 98956974a6fSJohn Johansen { 99056974a6fSJohn Johansen return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size); 99156974a6fSJohn Johansen } 99256974a6fSJohn Johansen 99356974a6fSJohn Johansen /** 99456974a6fSJohn Johansen * apparmor_socket_recvmsg - check perms before receiving a message 99556974a6fSJohn Johansen */ 99656974a6fSJohn Johansen static int apparmor_socket_recvmsg(struct socket *sock, 99756974a6fSJohn Johansen struct msghdr *msg, int size, int flags) 99856974a6fSJohn Johansen { 99956974a6fSJohn Johansen return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size); 100056974a6fSJohn Johansen } 100156974a6fSJohn Johansen 100256974a6fSJohn Johansen /* revaliation, get/set attr, shutdown */ 100356974a6fSJohn Johansen static int aa_sock_perm(const char *op, u32 request, struct socket *sock) 100456974a6fSJohn Johansen { 100556974a6fSJohn Johansen AA_BUG(!sock); 100656974a6fSJohn Johansen AA_BUG(!sock->sk); 100756974a6fSJohn Johansen AA_BUG(in_interrupt()); 100856974a6fSJohn Johansen 100956974a6fSJohn Johansen return af_select(sock->sk->sk_family, 101056974a6fSJohn Johansen sock_perm(op, request, sock), 101156974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 101256974a6fSJohn Johansen } 101356974a6fSJohn Johansen 101456974a6fSJohn Johansen /** 101556974a6fSJohn Johansen * apparmor_socket_getsockname - check perms before getting the local address 101656974a6fSJohn Johansen */ 101756974a6fSJohn Johansen static int apparmor_socket_getsockname(struct socket *sock) 101856974a6fSJohn Johansen { 101956974a6fSJohn Johansen return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock); 102056974a6fSJohn Johansen } 102156974a6fSJohn Johansen 102256974a6fSJohn Johansen /** 102356974a6fSJohn Johansen * apparmor_socket_getpeername - check perms before getting remote address 102456974a6fSJohn Johansen */ 102556974a6fSJohn Johansen static int apparmor_socket_getpeername(struct socket *sock) 102656974a6fSJohn Johansen { 102756974a6fSJohn Johansen return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock); 102856974a6fSJohn Johansen } 102956974a6fSJohn Johansen 103056974a6fSJohn Johansen /* revaliation, get/set attr, opt */ 103156974a6fSJohn Johansen static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock, 103256974a6fSJohn Johansen int level, int optname) 103356974a6fSJohn Johansen { 103456974a6fSJohn Johansen AA_BUG(!sock); 103556974a6fSJohn Johansen AA_BUG(!sock->sk); 103656974a6fSJohn Johansen AA_BUG(in_interrupt()); 103756974a6fSJohn Johansen 103856974a6fSJohn Johansen return af_select(sock->sk->sk_family, 103956974a6fSJohn Johansen opt_perm(op, request, sock, level, optname), 104056974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 104156974a6fSJohn Johansen } 104256974a6fSJohn Johansen 104356974a6fSJohn Johansen /** 1044*0fc6ab40SYang Li * apparmor_socket_getsockopt - check perms before getting socket options 104556974a6fSJohn Johansen */ 104656974a6fSJohn Johansen static int apparmor_socket_getsockopt(struct socket *sock, int level, 104756974a6fSJohn Johansen int optname) 104856974a6fSJohn Johansen { 104956974a6fSJohn Johansen return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock, 105056974a6fSJohn Johansen level, optname); 105156974a6fSJohn Johansen } 105256974a6fSJohn Johansen 105356974a6fSJohn Johansen /** 1054*0fc6ab40SYang Li * apparmor_socket_setsockopt - check perms before setting socket options 105556974a6fSJohn Johansen */ 105656974a6fSJohn Johansen static int apparmor_socket_setsockopt(struct socket *sock, int level, 105756974a6fSJohn Johansen int optname) 105856974a6fSJohn Johansen { 105956974a6fSJohn Johansen return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock, 106056974a6fSJohn Johansen level, optname); 106156974a6fSJohn Johansen } 106256974a6fSJohn Johansen 106356974a6fSJohn Johansen /** 106456974a6fSJohn Johansen * apparmor_socket_shutdown - check perms before shutting down @sock conn 106556974a6fSJohn Johansen */ 106656974a6fSJohn Johansen static int apparmor_socket_shutdown(struct socket *sock, int how) 106756974a6fSJohn Johansen { 106856974a6fSJohn Johansen return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock); 106956974a6fSJohn Johansen } 107056974a6fSJohn Johansen 1071e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 107256974a6fSJohn Johansen /** 1073*0fc6ab40SYang Li * apparmor_socket_sock_rcv_skb - check perms before associating skb to sk 107456974a6fSJohn Johansen * 107556974a6fSJohn Johansen * Note: can not sleep may be called with locks held 107656974a6fSJohn Johansen * 107756974a6fSJohn Johansen * dont want protocol specific in __skb_recv_datagram() 107856974a6fSJohn Johansen * to deny an incoming connection socket_sock_rcv_skb() 107956974a6fSJohn Johansen */ 108056974a6fSJohn Johansen static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 108156974a6fSJohn Johansen { 1082ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx = SK_CTX(sk); 1083ab9f2115SMatthew Garrett 1084ab9f2115SMatthew Garrett if (!skb->secmark) 108556974a6fSJohn Johansen return 0; 1086ab9f2115SMatthew Garrett 1087ab9f2115SMatthew Garrett return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, 1088ab9f2115SMatthew Garrett skb->secmark, sk); 108956974a6fSJohn Johansen } 1090e1af4779SArnd Bergmann #endif 109156974a6fSJohn Johansen 109256974a6fSJohn Johansen 109356974a6fSJohn Johansen static struct aa_label *sk_peer_label(struct sock *sk) 109456974a6fSJohn Johansen { 109556974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 109656974a6fSJohn Johansen 109756974a6fSJohn Johansen if (ctx->peer) 109856974a6fSJohn Johansen return ctx->peer; 109956974a6fSJohn Johansen 110056974a6fSJohn Johansen return ERR_PTR(-ENOPROTOOPT); 110156974a6fSJohn Johansen } 110256974a6fSJohn Johansen 110356974a6fSJohn Johansen /** 110456974a6fSJohn Johansen * apparmor_socket_getpeersec_stream - get security context of peer 110556974a6fSJohn Johansen * 110656974a6fSJohn Johansen * Note: for tcp only valid if using ipsec or cipso on lan 110756974a6fSJohn Johansen */ 110856974a6fSJohn Johansen static int apparmor_socket_getpeersec_stream(struct socket *sock, 110956974a6fSJohn Johansen char __user *optval, 111056974a6fSJohn Johansen int __user *optlen, 111156974a6fSJohn Johansen unsigned int len) 111256974a6fSJohn Johansen { 111356974a6fSJohn Johansen char *name; 111456974a6fSJohn Johansen int slen, error = 0; 111556974a6fSJohn Johansen struct aa_label *label; 111656974a6fSJohn Johansen struct aa_label *peer; 111756974a6fSJohn Johansen 111856974a6fSJohn Johansen label = begin_current_label_crit_section(); 111956974a6fSJohn Johansen peer = sk_peer_label(sock->sk); 112056974a6fSJohn Johansen if (IS_ERR(peer)) { 112156974a6fSJohn Johansen error = PTR_ERR(peer); 112256974a6fSJohn Johansen goto done; 112356974a6fSJohn Johansen } 112456974a6fSJohn Johansen slen = aa_label_asxprint(&name, labels_ns(label), peer, 112556974a6fSJohn Johansen FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 112656974a6fSJohn Johansen FLAG_HIDDEN_UNCONFINED, GFP_KERNEL); 112756974a6fSJohn Johansen /* don't include terminating \0 in slen, it breaks some apps */ 112856974a6fSJohn Johansen if (slen < 0) { 112956974a6fSJohn Johansen error = -ENOMEM; 113056974a6fSJohn Johansen } else { 113156974a6fSJohn Johansen if (slen > len) { 113256974a6fSJohn Johansen error = -ERANGE; 113356974a6fSJohn Johansen } else if (copy_to_user(optval, name, slen)) { 113456974a6fSJohn Johansen error = -EFAULT; 113556974a6fSJohn Johansen goto out; 113656974a6fSJohn Johansen } 113756974a6fSJohn Johansen if (put_user(slen, optlen)) 113856974a6fSJohn Johansen error = -EFAULT; 113956974a6fSJohn Johansen out: 114056974a6fSJohn Johansen kfree(name); 114156974a6fSJohn Johansen 114256974a6fSJohn Johansen } 114356974a6fSJohn Johansen 114456974a6fSJohn Johansen done: 114556974a6fSJohn Johansen end_current_label_crit_section(label); 114656974a6fSJohn Johansen 114756974a6fSJohn Johansen return error; 114856974a6fSJohn Johansen } 114956974a6fSJohn Johansen 115056974a6fSJohn Johansen /** 115156974a6fSJohn Johansen * apparmor_socket_getpeersec_dgram - get security label of packet 115256974a6fSJohn Johansen * @sock: the peer socket 115356974a6fSJohn Johansen * @skb: packet data 115456974a6fSJohn Johansen * @secid: pointer to where to put the secid of the packet 115556974a6fSJohn Johansen * 115656974a6fSJohn Johansen * Sets the netlabel socket state on sk from parent 115756974a6fSJohn Johansen */ 115856974a6fSJohn Johansen static int apparmor_socket_getpeersec_dgram(struct socket *sock, 115956974a6fSJohn Johansen struct sk_buff *skb, u32 *secid) 116056974a6fSJohn Johansen 116156974a6fSJohn Johansen { 116256974a6fSJohn Johansen /* TODO: requires secid support */ 116356974a6fSJohn Johansen return -ENOPROTOOPT; 116456974a6fSJohn Johansen } 116556974a6fSJohn Johansen 116656974a6fSJohn Johansen /** 116756974a6fSJohn Johansen * apparmor_sock_graft - Initialize newly created socket 116856974a6fSJohn Johansen * @sk: child sock 116956974a6fSJohn Johansen * @parent: parent socket 117056974a6fSJohn Johansen * 117156974a6fSJohn Johansen * Note: could set off of SOCK_CTX(parent) but need to track inode and we can 117256974a6fSJohn Johansen * just set sk security information off of current creating process label 117356974a6fSJohn Johansen * Labeling of sk for accept case - probably should be sock based 117456974a6fSJohn Johansen * instead of task, because of the case where an implicitly labeled 117556974a6fSJohn Johansen * socket is shared by different tasks. 117656974a6fSJohn Johansen */ 117756974a6fSJohn Johansen static void apparmor_sock_graft(struct sock *sk, struct socket *parent) 117856974a6fSJohn Johansen { 117956974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 118056974a6fSJohn Johansen 118156974a6fSJohn Johansen if (!ctx->label) 118256974a6fSJohn Johansen ctx->label = aa_get_current_label(); 118356974a6fSJohn Johansen } 118456974a6fSJohn Johansen 1185e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 118641dd9596SFlorian Westphal static int apparmor_inet_conn_request(const struct sock *sk, struct sk_buff *skb, 1187ab9f2115SMatthew Garrett struct request_sock *req) 1188ab9f2115SMatthew Garrett { 1189ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx = SK_CTX(sk); 1190ab9f2115SMatthew Garrett 1191ab9f2115SMatthew Garrett if (!skb->secmark) 1192ab9f2115SMatthew Garrett return 0; 1193ab9f2115SMatthew Garrett 1194ab9f2115SMatthew Garrett return apparmor_secmark_check(ctx->label, OP_CONNECT, AA_MAY_CONNECT, 1195ab9f2115SMatthew Garrett skb->secmark, sk); 1196ab9f2115SMatthew Garrett } 1197e1af4779SArnd Bergmann #endif 1198ab9f2115SMatthew Garrett 1199bbd3662aSCasey Schaufler /* 1200bbd3662aSCasey Schaufler * The cred blob is a pointer to, not an instance of, an aa_task_ctx. 1201bbd3662aSCasey Schaufler */ 1202bbd3662aSCasey Schaufler struct lsm_blob_sizes apparmor_blob_sizes __lsm_ro_after_init = { 1203bbd3662aSCasey Schaufler .lbs_cred = sizeof(struct aa_task_ctx *), 120433bf60caSCasey Schaufler .lbs_file = sizeof(struct aa_file_ctx), 1205f4ad8f2cSCasey Schaufler .lbs_task = sizeof(struct aa_task_ctx), 1206bbd3662aSCasey Schaufler }; 1207bbd3662aSCasey Schaufler 1208ca97d939SJames Morris static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 1209e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 1210e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 1211e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 1212e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 1213b5e95b48SJohn Johansen 12142ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), 12152ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), 12162ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), 12172ea3ffb7SJohn Johansen 1218e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 1219e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 1220e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 1221e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 1222e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 1223e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 1224e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 1225e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 1226e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 1227e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 1228e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 1229b5e95b48SJohn Johansen 1230e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 1231064dc947SJohn Johansen LSM_HOOK_INIT(file_receive, apparmor_file_receive), 1232e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 1233e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 1234e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 1235e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 1236e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 1237e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 1238b5e95b48SJohn Johansen 1239e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 1240e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 1241b5e95b48SJohn Johansen 124256974a6fSJohn Johansen LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security), 124356974a6fSJohn Johansen LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security), 124456974a6fSJohn Johansen LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security), 124556974a6fSJohn Johansen 124656974a6fSJohn Johansen LSM_HOOK_INIT(socket_create, apparmor_socket_create), 124756974a6fSJohn Johansen LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create), 124856974a6fSJohn Johansen LSM_HOOK_INIT(socket_bind, apparmor_socket_bind), 124956974a6fSJohn Johansen LSM_HOOK_INIT(socket_connect, apparmor_socket_connect), 125056974a6fSJohn Johansen LSM_HOOK_INIT(socket_listen, apparmor_socket_listen), 125156974a6fSJohn Johansen LSM_HOOK_INIT(socket_accept, apparmor_socket_accept), 125256974a6fSJohn Johansen LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg), 125356974a6fSJohn Johansen LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg), 125456974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname), 125556974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername), 125656974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), 125756974a6fSJohn Johansen LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), 125856974a6fSJohn Johansen LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), 1259e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 126056974a6fSJohn Johansen LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), 1261e1af4779SArnd Bergmann #endif 126256974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_stream, 126356974a6fSJohn Johansen apparmor_socket_getpeersec_stream), 126456974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_dgram, 126556974a6fSJohn Johansen apparmor_socket_getpeersec_dgram), 126656974a6fSJohn Johansen LSM_HOOK_INIT(sock_graft, apparmor_sock_graft), 1267e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 1268ab9f2115SMatthew Garrett LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request), 1269e1af4779SArnd Bergmann #endif 127056974a6fSJohn Johansen 1271e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 1272e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 1273e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 1274e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 1275b5e95b48SJohn Johansen 1276b8bff599SEric W. Biederman LSM_HOOK_INIT(bprm_creds_for_exec, apparmor_bprm_creds_for_exec), 1277e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 1278e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 1279b5e95b48SJohn Johansen 12803b529a76SJohn Johansen LSM_HOOK_INIT(task_free, apparmor_task_free), 12813b529a76SJohn Johansen LSM_HOOK_INIT(task_alloc, apparmor_task_alloc), 12826326948fSPaul Moore LSM_HOOK_INIT(current_getsecid_subj, apparmor_current_getsecid_subj), 12836326948fSPaul Moore LSM_HOOK_INIT(task_getsecid_obj, apparmor_task_getsecid_obj), 1284e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 1285cd1dbf76SJohn Johansen LSM_HOOK_INIT(task_kill, apparmor_task_kill), 1286c0929212SJohn Johansen 1287e79c26d0SMatthew Garrett #ifdef CONFIG_AUDIT 1288e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init), 1289e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known), 1290e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match), 1291e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free), 1292e79c26d0SMatthew Garrett #endif 1293e79c26d0SMatthew Garrett 1294c0929212SJohn Johansen LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), 1295c0929212SJohn Johansen LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), 1296c0929212SJohn Johansen LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), 1297b5e95b48SJohn Johansen }; 1298b5e95b48SJohn Johansen 1299b5e95b48SJohn Johansen /* 1300b5e95b48SJohn Johansen * AppArmor sysfs module parameters 1301b5e95b48SJohn Johansen */ 1302b5e95b48SJohn Johansen 1303101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 1304101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 1305b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 13069c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 13076a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1308101d6c82SStephen Rothwell .set = param_set_aabool, 1309101d6c82SStephen Rothwell .get = param_get_aabool 1310101d6c82SStephen Rothwell }; 1311b5e95b48SJohn Johansen 1312101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 1313101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 1314b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 13159c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 1316101d6c82SStephen Rothwell .set = param_set_aauint, 1317101d6c82SStephen Rothwell .get = param_get_aauint 1318101d6c82SStephen Rothwell }; 1319b5e95b48SJohn Johansen 132063c16c3aSChris Coulson static int param_set_aacompressionlevel(const char *val, 132163c16c3aSChris Coulson const struct kernel_param *kp); 132263c16c3aSChris Coulson static int param_get_aacompressionlevel(char *buffer, 132363c16c3aSChris Coulson const struct kernel_param *kp); 132463c16c3aSChris Coulson #define param_check_aacompressionlevel param_check_int 132563c16c3aSChris Coulson static const struct kernel_param_ops param_ops_aacompressionlevel = { 132663c16c3aSChris Coulson .set = param_set_aacompressionlevel, 132763c16c3aSChris Coulson .get = param_get_aacompressionlevel 132863c16c3aSChris Coulson }; 132963c16c3aSChris Coulson 1330101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 1331101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 1332b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 13339c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 13346a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1335101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 1336101d6c82SStephen Rothwell .get = param_get_aalockpolicy 1337101d6c82SStephen Rothwell }; 1338b5e95b48SJohn Johansen 1339e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp); 1340e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp); 1341b5e95b48SJohn Johansen 1342e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp); 1343e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp); 1344b5e95b48SJohn Johansen 1345b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 1346b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 1347b5e95b48SJohn Johansen */ 1348b5e95b48SJohn Johansen 1349b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 1350b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 1351b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 1352b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 1353b5e95b48SJohn Johansen 13546059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 13557616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 13563ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 13576059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 13587616ac70SArnd Bergmann #endif 13596059f71fSJohn Johansen 136063c16c3aSChris Coulson /* policy loaddata compression level */ 136163c16c3aSChris Coulson int aa_g_rawdata_compression_level = Z_DEFAULT_COMPRESSION; 136263c16c3aSChris Coulson module_param_named(rawdata_compression_level, aa_g_rawdata_compression_level, 136363c16c3aSChris Coulson aacompressionlevel, 0400); 136463c16c3aSChris Coulson 1365b5e95b48SJohn Johansen /* Debug mode */ 1366eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 1367b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 1368b5e95b48SJohn Johansen 1369b5e95b48SJohn Johansen /* Audit mode */ 1370b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 1371b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 1372b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 1373b5e95b48SJohn Johansen 1374b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 1375b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 1376b5e95b48SJohn Johansen */ 1377954317feSThomas Meyer bool aa_g_audit_header = true; 1378b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 1379b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1380b5e95b48SJohn Johansen 1381b5e95b48SJohn Johansen /* lock out loading/removal of policy 1382b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 1383b5e95b48SJohn Johansen * load policy, if lock_policy is set 1384b5e95b48SJohn Johansen */ 138590ab5ee9SRusty Russell bool aa_g_lock_policy; 1386b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 1387b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1388b5e95b48SJohn Johansen 1389b5e95b48SJohn Johansen /* Syscall logging mode */ 139090ab5ee9SRusty Russell bool aa_g_logsyscall; 1391b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 1392b5e95b48SJohn Johansen 1393b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 1394b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 1395622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 1396b5e95b48SJohn Johansen 1397b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 1398b5e95b48SJohn Johansen * on the loaded policy is done. 1399abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 1400abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 1401b5e95b48SJohn Johansen */ 1402954317feSThomas Meyer bool aa_g_paranoid_load = true; 1403abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 1404b5e95b48SJohn Johansen 1405e33c1b99SKees Cook static int param_get_aaintbool(char *buffer, const struct kernel_param *kp); 1406e33c1b99SKees Cook static int param_set_aaintbool(const char *val, const struct kernel_param *kp); 1407e33c1b99SKees Cook #define param_check_aaintbool param_check_int 1408e33c1b99SKees Cook static const struct kernel_param_ops param_ops_aaintbool = { 1409e33c1b99SKees Cook .set = param_set_aaintbool, 1410e33c1b99SKees Cook .get = param_get_aaintbool 1411e33c1b99SKees Cook }; 1412b5e95b48SJohn Johansen /* Boot time disable flag */ 14130102fb83SKees Cook static int apparmor_enabled __lsm_ro_after_init = 1; 1414e33c1b99SKees Cook module_param_named(enabled, apparmor_enabled, aaintbool, 0444); 1415b5e95b48SJohn Johansen 1416b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 1417b5e95b48SJohn Johansen { 1418b5e95b48SJohn Johansen unsigned long enabled; 141929707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 1420b5e95b48SJohn Johansen if (!error) 1421b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 1422b5e95b48SJohn Johansen return 1; 1423b5e95b48SJohn Johansen } 1424b5e95b48SJohn Johansen 1425b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 1426b5e95b48SJohn Johansen 1427b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 1428101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 1429b5e95b48SJohn Johansen { 1430545de8feSJohn Johansen if (!apparmor_enabled) 1431545de8feSJohn Johansen return -EINVAL; 143292de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1433b5e95b48SJohn Johansen return -EPERM; 1434b5e95b48SJohn Johansen return param_set_bool(val, kp); 1435b5e95b48SJohn Johansen } 1436b5e95b48SJohn Johansen 1437101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 1438b5e95b48SJohn Johansen { 1439ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1440ca4bd5aeSJohn Johansen return -EINVAL; 144192de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1442545de8feSJohn Johansen return -EPERM; 1443b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1444b5e95b48SJohn Johansen } 1445b5e95b48SJohn Johansen 1446101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 1447b5e95b48SJohn Johansen { 1448ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1449ca4bd5aeSJohn Johansen return -EINVAL; 145092de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1451545de8feSJohn Johansen return -EPERM; 1452b5e95b48SJohn Johansen return param_set_bool(val, kp); 1453b5e95b48SJohn Johansen } 1454b5e95b48SJohn Johansen 1455101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 1456b5e95b48SJohn Johansen { 1457ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1458ca4bd5aeSJohn Johansen return -EINVAL; 145992de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1460545de8feSJohn Johansen return -EPERM; 1461b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1462b5e95b48SJohn Johansen } 1463b5e95b48SJohn Johansen 1464101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 1465b5e95b48SJohn Johansen { 146639d84824SJohn Johansen int error; 146739d84824SJohn Johansen 1468ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1469ca4bd5aeSJohn Johansen return -EINVAL; 147039d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 147139d84824SJohn Johansen if (apparmor_initialized) 1472545de8feSJohn Johansen return -EPERM; 147339d84824SJohn Johansen 147439d84824SJohn Johansen error = param_set_uint(val, kp); 1475df323337SSebastian Andrzej Siewior aa_g_path_max = max_t(uint32_t, aa_g_path_max, sizeof(union aa_buffer)); 147639d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 147739d84824SJohn Johansen 147839d84824SJohn Johansen return error; 1479b5e95b48SJohn Johansen } 1480b5e95b48SJohn Johansen 1481101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 1482b5e95b48SJohn Johansen { 1483ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1484ca4bd5aeSJohn Johansen return -EINVAL; 148592de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1486545de8feSJohn Johansen return -EPERM; 1487b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 1488b5e95b48SJohn Johansen } 1489b5e95b48SJohn Johansen 1490e33c1b99SKees Cook /* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */ 1491e33c1b99SKees Cook static int param_set_aaintbool(const char *val, const struct kernel_param *kp) 1492e33c1b99SKees Cook { 1493e33c1b99SKees Cook struct kernel_param kp_local; 1494e33c1b99SKees Cook bool value; 1495e33c1b99SKees Cook int error; 1496e33c1b99SKees Cook 1497e33c1b99SKees Cook if (apparmor_initialized) 1498e33c1b99SKees Cook return -EPERM; 1499e33c1b99SKees Cook 1500e33c1b99SKees Cook /* Create local copy, with arg pointing to bool type. */ 1501e33c1b99SKees Cook value = !!*((int *)kp->arg); 1502e33c1b99SKees Cook memcpy(&kp_local, kp, sizeof(kp_local)); 1503e33c1b99SKees Cook kp_local.arg = &value; 1504e33c1b99SKees Cook 1505e33c1b99SKees Cook error = param_set_bool(val, &kp_local); 1506e33c1b99SKees Cook if (!error) 1507e33c1b99SKees Cook *((int *)kp->arg) = *((bool *)kp_local.arg); 1508e33c1b99SKees Cook return error; 1509e33c1b99SKees Cook } 1510e33c1b99SKees Cook 1511e33c1b99SKees Cook /* 1512e33c1b99SKees Cook * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to 1513e33c1b99SKees Cook * 1/0, this converts the "int that is actually bool" back to bool for 1514e33c1b99SKees Cook * display in the /sys filesystem, while keeping it "int" for the LSM 1515e33c1b99SKees Cook * infrastructure. 1516e33c1b99SKees Cook */ 1517e33c1b99SKees Cook static int param_get_aaintbool(char *buffer, const struct kernel_param *kp) 1518e33c1b99SKees Cook { 1519e33c1b99SKees Cook struct kernel_param kp_local; 1520e33c1b99SKees Cook bool value; 1521e33c1b99SKees Cook 1522e33c1b99SKees Cook /* Create local copy, with arg pointing to bool type. */ 1523e33c1b99SKees Cook value = !!*((int *)kp->arg); 1524e33c1b99SKees Cook memcpy(&kp_local, kp, sizeof(kp_local)); 1525e33c1b99SKees Cook kp_local.arg = &value; 1526e33c1b99SKees Cook 1527e33c1b99SKees Cook return param_get_bool(buffer, &kp_local); 1528e33c1b99SKees Cook } 1529e33c1b99SKees Cook 153063c16c3aSChris Coulson static int param_set_aacompressionlevel(const char *val, 153163c16c3aSChris Coulson const struct kernel_param *kp) 153263c16c3aSChris Coulson { 153363c16c3aSChris Coulson int error; 153463c16c3aSChris Coulson 153563c16c3aSChris Coulson if (!apparmor_enabled) 153663c16c3aSChris Coulson return -EINVAL; 153763c16c3aSChris Coulson if (apparmor_initialized) 153863c16c3aSChris Coulson return -EPERM; 153963c16c3aSChris Coulson 154063c16c3aSChris Coulson error = param_set_int(val, kp); 154163c16c3aSChris Coulson 154263c16c3aSChris Coulson aa_g_rawdata_compression_level = clamp(aa_g_rawdata_compression_level, 154363c16c3aSChris Coulson Z_NO_COMPRESSION, 154463c16c3aSChris Coulson Z_BEST_COMPRESSION); 154563c16c3aSChris Coulson pr_info("AppArmor: policy rawdata compression level set to %u\n", 154663c16c3aSChris Coulson aa_g_rawdata_compression_level); 154763c16c3aSChris Coulson 154863c16c3aSChris Coulson return error; 154963c16c3aSChris Coulson } 155063c16c3aSChris Coulson 155163c16c3aSChris Coulson static int param_get_aacompressionlevel(char *buffer, 155263c16c3aSChris Coulson const struct kernel_param *kp) 155363c16c3aSChris Coulson { 155463c16c3aSChris Coulson if (!apparmor_enabled) 155563c16c3aSChris Coulson return -EINVAL; 155692de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 155763c16c3aSChris Coulson return -EPERM; 155863c16c3aSChris Coulson return param_get_int(buffer, kp); 155963c16c3aSChris Coulson } 156063c16c3aSChris Coulson 1561e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp) 1562b5e95b48SJohn Johansen { 1563b5e95b48SJohn Johansen if (!apparmor_enabled) 1564b5e95b48SJohn Johansen return -EINVAL; 156592de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1566545de8feSJohn Johansen return -EPERM; 1567b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 1568b5e95b48SJohn Johansen } 1569b5e95b48SJohn Johansen 1570e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp) 1571b5e95b48SJohn Johansen { 1572b5e95b48SJohn Johansen int i; 1573b5e95b48SJohn Johansen 1574b5e95b48SJohn Johansen if (!apparmor_enabled) 1575b5e95b48SJohn Johansen return -EINVAL; 1576b5e95b48SJohn Johansen if (!val) 1577b5e95b48SJohn Johansen return -EINVAL; 157892de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1579545de8feSJohn Johansen return -EPERM; 1580b5e95b48SJohn Johansen 15815d8779a5SAndy Shevchenko i = match_string(audit_mode_names, AUDIT_MAX_INDEX, val); 15825d8779a5SAndy Shevchenko if (i < 0) 15835d8779a5SAndy Shevchenko return -EINVAL; 15845d8779a5SAndy Shevchenko 1585b5e95b48SJohn Johansen aa_g_audit = i; 1586b5e95b48SJohn Johansen return 0; 1587b5e95b48SJohn Johansen } 1588b5e95b48SJohn Johansen 1589e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp) 1590b5e95b48SJohn Johansen { 1591b5e95b48SJohn Johansen if (!apparmor_enabled) 1592b5e95b48SJohn Johansen return -EINVAL; 159392de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1594545de8feSJohn Johansen return -EPERM; 1595b5e95b48SJohn Johansen 15960d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 1597b5e95b48SJohn Johansen } 1598b5e95b48SJohn Johansen 1599e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp) 1600b5e95b48SJohn Johansen { 1601b5e95b48SJohn Johansen int i; 1602b5e95b48SJohn Johansen 1603b5e95b48SJohn Johansen if (!apparmor_enabled) 1604b5e95b48SJohn Johansen return -EINVAL; 1605b5e95b48SJohn Johansen if (!val) 1606b5e95b48SJohn Johansen return -EINVAL; 160792de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1608545de8feSJohn Johansen return -EPERM; 1609b5e95b48SJohn Johansen 16105d8779a5SAndy Shevchenko i = match_string(aa_profile_mode_names, APPARMOR_MODE_NAMES_MAX_INDEX, 16115d8779a5SAndy Shevchenko val); 16125d8779a5SAndy Shevchenko if (i < 0) 16135d8779a5SAndy Shevchenko return -EINVAL; 16145d8779a5SAndy Shevchenko 1615b5e95b48SJohn Johansen aa_g_profile_mode = i; 1616b5e95b48SJohn Johansen return 0; 1617b5e95b48SJohn Johansen } 1618b5e95b48SJohn Johansen 1619341c1fdaSJohn Johansen char *aa_get_buffer(bool in_atomic) 1620df323337SSebastian Andrzej Siewior { 1621df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1622df323337SSebastian Andrzej Siewior bool try_again = true; 1623341c1fdaSJohn Johansen gfp_t flags = (GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_NOWARN); 1624df323337SSebastian Andrzej Siewior 1625df323337SSebastian Andrzej Siewior retry: 1626df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1627341c1fdaSJohn Johansen if (buffer_count > reserve_count || 1628341c1fdaSJohn Johansen (in_atomic && !list_empty(&aa_global_buffers))) { 1629df323337SSebastian Andrzej Siewior aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer, 1630df323337SSebastian Andrzej Siewior list); 1631df323337SSebastian Andrzej Siewior list_del(&aa_buf->list); 1632341c1fdaSJohn Johansen buffer_count--; 1633df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1634df323337SSebastian Andrzej Siewior return &aa_buf->buffer[0]; 1635df323337SSebastian Andrzej Siewior } 1636341c1fdaSJohn Johansen if (in_atomic) { 1637341c1fdaSJohn Johansen /* 1638341c1fdaSJohn Johansen * out of reserve buffers and in atomic context so increase 1639341c1fdaSJohn Johansen * how many buffers to keep in reserve 1640341c1fdaSJohn Johansen */ 1641341c1fdaSJohn Johansen reserve_count++; 1642341c1fdaSJohn Johansen flags = GFP_ATOMIC; 1643341c1fdaSJohn Johansen } 1644df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1645df323337SSebastian Andrzej Siewior 1646341c1fdaSJohn Johansen if (!in_atomic) 1647341c1fdaSJohn Johansen might_sleep(); 1648341c1fdaSJohn Johansen aa_buf = kmalloc(aa_g_path_max, flags); 1649df323337SSebastian Andrzej Siewior if (!aa_buf) { 1650df323337SSebastian Andrzej Siewior if (try_again) { 1651df323337SSebastian Andrzej Siewior try_again = false; 1652df323337SSebastian Andrzej Siewior goto retry; 1653df323337SSebastian Andrzej Siewior } 1654df323337SSebastian Andrzej Siewior pr_warn_once("AppArmor: Failed to allocate a memory buffer.\n"); 1655df323337SSebastian Andrzej Siewior return NULL; 1656df323337SSebastian Andrzej Siewior } 1657df323337SSebastian Andrzej Siewior return &aa_buf->buffer[0]; 1658df323337SSebastian Andrzej Siewior } 1659df323337SSebastian Andrzej Siewior 1660df323337SSebastian Andrzej Siewior void aa_put_buffer(char *buf) 1661df323337SSebastian Andrzej Siewior { 1662df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1663df323337SSebastian Andrzej Siewior 1664df323337SSebastian Andrzej Siewior if (!buf) 1665df323337SSebastian Andrzej Siewior return; 1666df323337SSebastian Andrzej Siewior aa_buf = container_of(buf, union aa_buffer, buffer[0]); 1667df323337SSebastian Andrzej Siewior 1668df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1669df323337SSebastian Andrzej Siewior list_add(&aa_buf->list, &aa_global_buffers); 1670341c1fdaSJohn Johansen buffer_count++; 1671df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1672df323337SSebastian Andrzej Siewior } 1673df323337SSebastian Andrzej Siewior 1674b5e95b48SJohn Johansen /* 1675b5e95b48SJohn Johansen * AppArmor init functions 1676b5e95b48SJohn Johansen */ 1677b5e95b48SJohn Johansen 1678b5e95b48SJohn Johansen /** 167955a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 1680b5e95b48SJohn Johansen * 1681b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 1682b5e95b48SJohn Johansen */ 168355a26ebfSJohn Johansen static int __init set_init_ctx(void) 1684b5e95b48SJohn Johansen { 1685bf1d2ee7SBharath Vedartham struct cred *cred = (__force struct cred *)current->real_cred; 1686b5e95b48SJohn Johansen 168769b5a44aSCasey Schaufler set_cred_label(cred, aa_get_label(ns_unconfined(root_ns))); 1688b5e95b48SJohn Johansen 1689b5e95b48SJohn Johansen return 0; 1690b5e95b48SJohn Johansen } 1691b5e95b48SJohn Johansen 1692d4669f0bSJohn Johansen static void destroy_buffers(void) 1693d4669f0bSJohn Johansen { 1694df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1695d4669f0bSJohn Johansen 1696df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1697df323337SSebastian Andrzej Siewior while (!list_empty(&aa_global_buffers)) { 1698df323337SSebastian Andrzej Siewior aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer, 1699df323337SSebastian Andrzej Siewior list); 1700df323337SSebastian Andrzej Siewior list_del(&aa_buf->list); 1701df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1702df323337SSebastian Andrzej Siewior kfree(aa_buf); 1703df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1704d4669f0bSJohn Johansen } 1705df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1706d4669f0bSJohn Johansen } 1707d4669f0bSJohn Johansen 1708d4669f0bSJohn Johansen static int __init alloc_buffers(void) 1709d4669f0bSJohn Johansen { 1710df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1711df323337SSebastian Andrzej Siewior int i, num; 1712d4669f0bSJohn Johansen 1713df323337SSebastian Andrzej Siewior /* 1714df323337SSebastian Andrzej Siewior * A function may require two buffers at once. Usually the buffers are 1715df323337SSebastian Andrzej Siewior * used for a short period of time and are shared. On UP kernel buffers 1716df323337SSebastian Andrzej Siewior * two should be enough, with more CPUs it is possible that more 1717df323337SSebastian Andrzej Siewior * buffers will be used simultaneously. The preallocated pool may grow. 1718df323337SSebastian Andrzej Siewior * This preallocation has also the side-effect that AppArmor will be 1719df323337SSebastian Andrzej Siewior * disabled early at boot if aa_g_path_max is extremly high. 1720df323337SSebastian Andrzej Siewior */ 1721df323337SSebastian Andrzej Siewior if (num_online_cpus() > 1) 1722341c1fdaSJohn Johansen num = 4 + RESERVE_COUNT; 1723d4669f0bSJohn Johansen else 1724341c1fdaSJohn Johansen num = 2 + RESERVE_COUNT; 1725df323337SSebastian Andrzej Siewior 1726df323337SSebastian Andrzej Siewior for (i = 0; i < num; i++) { 1727df323337SSebastian Andrzej Siewior 1728df323337SSebastian Andrzej Siewior aa_buf = kmalloc(aa_g_path_max, GFP_KERNEL | 1729df323337SSebastian Andrzej Siewior __GFP_RETRY_MAYFAIL | __GFP_NOWARN); 1730df323337SSebastian Andrzej Siewior if (!aa_buf) { 1731d4669f0bSJohn Johansen destroy_buffers(); 1732d4669f0bSJohn Johansen return -ENOMEM; 1733d4669f0bSJohn Johansen } 1734df323337SSebastian Andrzej Siewior aa_put_buffer(&aa_buf->buffer[0]); 1735d4669f0bSJohn Johansen } 1736d4669f0bSJohn Johansen return 0; 1737d4669f0bSJohn Johansen } 1738d4669f0bSJohn Johansen 1739e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 1740e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 174132927393SChristoph Hellwig void *buffer, size_t *lenp, loff_t *ppos) 1742e3ea1ca5STyler Hicks { 174392de220aSJohn Johansen if (!aa_current_policy_admin_capable(NULL)) 1744e3ea1ca5STyler Hicks return -EPERM; 1745e3ea1ca5STyler Hicks if (!apparmor_enabled) 1746e3ea1ca5STyler Hicks return -EINVAL; 1747e3ea1ca5STyler Hicks 1748e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 1749e3ea1ca5STyler Hicks } 1750e3ea1ca5STyler Hicks 1751e3ea1ca5STyler Hicks static struct ctl_path apparmor_sysctl_path[] = { 1752e3ea1ca5STyler Hicks { .procname = "kernel", }, 1753e3ea1ca5STyler Hicks { } 1754e3ea1ca5STyler Hicks }; 1755e3ea1ca5STyler Hicks 1756e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 1757e3ea1ca5STyler Hicks { 1758e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 1759e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 1760e3ea1ca5STyler Hicks .maxlen = sizeof(int), 1761e3ea1ca5STyler Hicks .mode = 0600, 1762e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 1763e3ea1ca5STyler Hicks }, 1764e3ea1ca5STyler Hicks { } 1765e3ea1ca5STyler Hicks }; 1766e3ea1ca5STyler Hicks 1767e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 1768e3ea1ca5STyler Hicks { 1769e3ea1ca5STyler Hicks return register_sysctl_paths(apparmor_sysctl_path, 1770e3ea1ca5STyler Hicks apparmor_sysctl_table) ? 0 : -ENOMEM; 1771e3ea1ca5STyler Hicks } 1772e3ea1ca5STyler Hicks #else 1773e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 1774e3ea1ca5STyler Hicks { 1775e3ea1ca5STyler Hicks return 0; 1776e3ea1ca5STyler Hicks } 1777e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 1778e3ea1ca5STyler Hicks 1779e1af4779SArnd Bergmann #if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK) 1780ab9f2115SMatthew Garrett static unsigned int apparmor_ip_postroute(void *priv, 1781ab9f2115SMatthew Garrett struct sk_buff *skb, 1782ab9f2115SMatthew Garrett const struct nf_hook_state *state) 1783ab9f2115SMatthew Garrett { 1784ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx; 1785ab9f2115SMatthew Garrett struct sock *sk; 1786ab9f2115SMatthew Garrett 1787ab9f2115SMatthew Garrett if (!skb->secmark) 1788ab9f2115SMatthew Garrett return NF_ACCEPT; 1789ab9f2115SMatthew Garrett 1790ab9f2115SMatthew Garrett sk = skb_to_full_sk(skb); 1791ab9f2115SMatthew Garrett if (sk == NULL) 1792ab9f2115SMatthew Garrett return NF_ACCEPT; 1793ab9f2115SMatthew Garrett 1794ab9f2115SMatthew Garrett ctx = SK_CTX(sk); 1795ab9f2115SMatthew Garrett if (!apparmor_secmark_check(ctx->label, OP_SENDMSG, AA_MAY_SEND, 1796ab9f2115SMatthew Garrett skb->secmark, sk)) 1797ab9f2115SMatthew Garrett return NF_ACCEPT; 1798ab9f2115SMatthew Garrett 1799ab9f2115SMatthew Garrett return NF_DROP_ERR(-ECONNREFUSED); 1800ab9f2115SMatthew Garrett 1801ab9f2115SMatthew Garrett } 1802ab9f2115SMatthew Garrett 1803ab9f2115SMatthew Garrett static const struct nf_hook_ops apparmor_nf_ops[] = { 1804ab9f2115SMatthew Garrett { 18057b721124SFlorian Westphal .hook = apparmor_ip_postroute, 1806ab9f2115SMatthew Garrett .pf = NFPROTO_IPV4, 1807ab9f2115SMatthew Garrett .hooknum = NF_INET_POST_ROUTING, 1808ab9f2115SMatthew Garrett .priority = NF_IP_PRI_SELINUX_FIRST, 1809ab9f2115SMatthew Garrett }, 1810ab9f2115SMatthew Garrett #if IS_ENABLED(CONFIG_IPV6) 1811ab9f2115SMatthew Garrett { 18127b721124SFlorian Westphal .hook = apparmor_ip_postroute, 1813ab9f2115SMatthew Garrett .pf = NFPROTO_IPV6, 1814ab9f2115SMatthew Garrett .hooknum = NF_INET_POST_ROUTING, 1815ab9f2115SMatthew Garrett .priority = NF_IP6_PRI_SELINUX_FIRST, 1816ab9f2115SMatthew Garrett }, 1817ab9f2115SMatthew Garrett #endif 1818ab9f2115SMatthew Garrett }; 1819ab9f2115SMatthew Garrett 1820ab9f2115SMatthew Garrett static int __net_init apparmor_nf_register(struct net *net) 1821ab9f2115SMatthew Garrett { 1822ab9f2115SMatthew Garrett int ret; 1823ab9f2115SMatthew Garrett 1824ab9f2115SMatthew Garrett ret = nf_register_net_hooks(net, apparmor_nf_ops, 1825ab9f2115SMatthew Garrett ARRAY_SIZE(apparmor_nf_ops)); 1826ab9f2115SMatthew Garrett return ret; 1827ab9f2115SMatthew Garrett } 1828ab9f2115SMatthew Garrett 1829ab9f2115SMatthew Garrett static void __net_exit apparmor_nf_unregister(struct net *net) 1830ab9f2115SMatthew Garrett { 1831ab9f2115SMatthew Garrett nf_unregister_net_hooks(net, apparmor_nf_ops, 1832ab9f2115SMatthew Garrett ARRAY_SIZE(apparmor_nf_ops)); 1833ab9f2115SMatthew Garrett } 1834ab9f2115SMatthew Garrett 1835ab9f2115SMatthew Garrett static struct pernet_operations apparmor_net_ops = { 1836ab9f2115SMatthew Garrett .init = apparmor_nf_register, 1837ab9f2115SMatthew Garrett .exit = apparmor_nf_unregister, 1838ab9f2115SMatthew Garrett }; 1839ab9f2115SMatthew Garrett 1840ab9f2115SMatthew Garrett static int __init apparmor_nf_ip_init(void) 1841ab9f2115SMatthew Garrett { 1842ab9f2115SMatthew Garrett int err; 1843ab9f2115SMatthew Garrett 1844ab9f2115SMatthew Garrett if (!apparmor_enabled) 1845ab9f2115SMatthew Garrett return 0; 1846ab9f2115SMatthew Garrett 1847ab9f2115SMatthew Garrett err = register_pernet_subsys(&apparmor_net_ops); 1848ab9f2115SMatthew Garrett if (err) 1849ab9f2115SMatthew Garrett panic("Apparmor: register_pernet_subsys: error %d\n", err); 1850ab9f2115SMatthew Garrett 1851ab9f2115SMatthew Garrett return 0; 1852ab9f2115SMatthew Garrett } 1853ab9f2115SMatthew Garrett __initcall(apparmor_nf_ip_init); 1854e1af4779SArnd Bergmann #endif 1855ab9f2115SMatthew Garrett 1856b5e95b48SJohn Johansen static int __init apparmor_init(void) 1857b5e95b48SJohn Johansen { 1858b5e95b48SJohn Johansen int error; 1859b5e95b48SJohn Johansen 1860a4c3f89cSJohn Johansen aa_secids_init(); 1861a4c3f89cSJohn Johansen 186211c236b8SJohn Johansen error = aa_setup_dfa_engine(); 186311c236b8SJohn Johansen if (error) { 186411c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 186511c236b8SJohn Johansen goto alloc_out; 186611c236b8SJohn Johansen } 186711c236b8SJohn Johansen 1868b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 1869b5e95b48SJohn Johansen if (error) { 1870b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 1871b5e95b48SJohn Johansen goto alloc_out; 1872b5e95b48SJohn Johansen } 1873b5e95b48SJohn Johansen 1874e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 1875e3ea1ca5STyler Hicks if (error) { 1876e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 1877e3ea1ca5STyler Hicks goto alloc_out; 1878e3ea1ca5STyler Hicks 1879e3ea1ca5STyler Hicks } 1880e3ea1ca5STyler Hicks 1881d4669f0bSJohn Johansen error = alloc_buffers(); 1882d4669f0bSJohn Johansen if (error) { 1883d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 1884df323337SSebastian Andrzej Siewior goto alloc_out; 1885d4669f0bSJohn Johansen } 1886d4669f0bSJohn Johansen 188755a26ebfSJohn Johansen error = set_init_ctx(); 1888b5e95b48SJohn Johansen if (error) { 1889b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1890b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1891d4669f0bSJohn Johansen goto buffers_out; 1892b5e95b48SJohn Johansen } 1893d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1894d69dece5SCasey Schaufler "apparmor"); 1895b5e95b48SJohn Johansen 1896b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1897b5e95b48SJohn Johansen apparmor_initialized = 1; 1898b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1899b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1900b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1901b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1902b5e95b48SJohn Johansen else 1903b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1904b5e95b48SJohn Johansen 1905b5e95b48SJohn Johansen return error; 1906b5e95b48SJohn Johansen 1907d4669f0bSJohn Johansen buffers_out: 1908d4669f0bSJohn Johansen destroy_buffers(); 1909b5e95b48SJohn Johansen alloc_out: 1910b5e95b48SJohn Johansen aa_destroy_aafs(); 191111c236b8SJohn Johansen aa_teardown_dfa_engine(); 1912b5e95b48SJohn Johansen 1913954317feSThomas Meyer apparmor_enabled = false; 1914b5e95b48SJohn Johansen return error; 1915b5e95b48SJohn Johansen } 1916b5e95b48SJohn Johansen 19173d6e5f6dSKees Cook DEFINE_LSM(apparmor) = { 191807aed2f2SKees Cook .name = "apparmor", 191914bd99c8SKees Cook .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, 1920c5459b82SKees Cook .enabled = &apparmor_enabled, 1921bbd3662aSCasey Schaufler .blobs = &apparmor_blob_sizes, 19223d6e5f6dSKees Cook .init = apparmor_init, 19233d6e5f6dSKees Cook }; 1924