1b5e95b48SJohn Johansen /* 2b5e95b48SJohn Johansen * AppArmor security module 3b5e95b48SJohn Johansen * 4b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 5b5e95b48SJohn Johansen * 6b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 7b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 8b5e95b48SJohn Johansen * 9b5e95b48SJohn Johansen * This program is free software; you can redistribute it and/or 10b5e95b48SJohn Johansen * modify it under the terms of the GNU General Public License as 11b5e95b48SJohn Johansen * published by the Free Software Foundation, version 2 of the 12b5e95b48SJohn Johansen * License. 13b5e95b48SJohn Johansen */ 14b5e95b48SJohn Johansen 153c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 16b5e95b48SJohn Johansen #include <linux/moduleparam.h> 17b5e95b48SJohn Johansen #include <linux/mm.h> 18b5e95b48SJohn Johansen #include <linux/mman.h> 19b5e95b48SJohn Johansen #include <linux/mount.h> 20b5e95b48SJohn Johansen #include <linux/namei.h> 21b5e95b48SJohn Johansen #include <linux/ptrace.h> 22b5e95b48SJohn Johansen #include <linux/ctype.h> 23b5e95b48SJohn Johansen #include <linux/sysctl.h> 24b5e95b48SJohn Johansen #include <linux/audit.h> 253486740aSSerge E. Hallyn #include <linux/user_namespace.h> 26e025be0fSWilliam Hua #include <linux/kmemleak.h> 27b5e95b48SJohn Johansen #include <net/sock.h> 28b5e95b48SJohn Johansen 29b5e95b48SJohn Johansen #include "include/apparmor.h" 30b5e95b48SJohn Johansen #include "include/apparmorfs.h" 31b5e95b48SJohn Johansen #include "include/audit.h" 32b5e95b48SJohn Johansen #include "include/capability.h" 33b5e95b48SJohn Johansen #include "include/context.h" 34b5e95b48SJohn Johansen #include "include/file.h" 35b5e95b48SJohn Johansen #include "include/ipc.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37b5e95b48SJohn Johansen #include "include/policy.h" 38cff281f6SJohn Johansen #include "include/policy_ns.h" 39b5e95b48SJohn Johansen #include "include/procattr.h" 40b5e95b48SJohn Johansen 41b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 42545de8feSJohn Johansen int apparmor_initialized; 43b5e95b48SJohn Johansen 44d4669f0bSJohn Johansen DEFINE_PER_CPU(struct aa_buffers, aa_buffers); 45d4669f0bSJohn Johansen 46d4669f0bSJohn Johansen 47b5e95b48SJohn Johansen /* 48b5e95b48SJohn Johansen * LSM hook functions 49b5e95b48SJohn Johansen */ 50b5e95b48SJohn Johansen 51b5e95b48SJohn Johansen /* 5255a26ebfSJohn Johansen * free the associated aa_task_ctx and put its profiles 53b5e95b48SJohn Johansen */ 54b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 55b5e95b48SJohn Johansen { 5655a26ebfSJohn Johansen aa_free_task_context(cred_ctx(cred)); 5755a26ebfSJohn Johansen cred_ctx(cred) = NULL; 58b5e95b48SJohn Johansen } 59b5e95b48SJohn Johansen 60b5e95b48SJohn Johansen /* 61b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 62b5e95b48SJohn Johansen */ 63b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 64b5e95b48SJohn Johansen { 65b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 6655a26ebfSJohn Johansen struct aa_task_ctx *ctx = aa_alloc_task_context(gfp); 6755a26ebfSJohn Johansen 6855a26ebfSJohn Johansen if (!ctx) 69b5e95b48SJohn Johansen return -ENOMEM; 70b5e95b48SJohn Johansen 7155a26ebfSJohn Johansen cred_ctx(cred) = ctx; 72b5e95b48SJohn Johansen return 0; 73b5e95b48SJohn Johansen } 74b5e95b48SJohn Johansen 75b5e95b48SJohn Johansen /* 7655a26ebfSJohn Johansen * prepare new aa_task_ctx for modification by prepare_cred block 77b5e95b48SJohn Johansen */ 78b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 79b5e95b48SJohn Johansen gfp_t gfp) 80b5e95b48SJohn Johansen { 81b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 8255a26ebfSJohn Johansen struct aa_task_ctx *ctx = aa_alloc_task_context(gfp); 8355a26ebfSJohn Johansen 8455a26ebfSJohn Johansen if (!ctx) 85b5e95b48SJohn Johansen return -ENOMEM; 86b5e95b48SJohn Johansen 8755a26ebfSJohn Johansen aa_dup_task_context(ctx, cred_ctx(old)); 8855a26ebfSJohn Johansen cred_ctx(new) = ctx; 89b5e95b48SJohn Johansen return 0; 90b5e95b48SJohn Johansen } 91b5e95b48SJohn Johansen 92b5e95b48SJohn Johansen /* 93b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 94b5e95b48SJohn Johansen */ 95b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 96b5e95b48SJohn Johansen { 9755a26ebfSJohn Johansen const struct aa_task_ctx *old_ctx = cred_ctx(old); 9855a26ebfSJohn Johansen struct aa_task_ctx *new_ctx = cred_ctx(new); 99b5e95b48SJohn Johansen 10055a26ebfSJohn Johansen aa_dup_task_context(new_ctx, old_ctx); 101b5e95b48SJohn Johansen } 102b5e95b48SJohn Johansen 103b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 104b5e95b48SJohn Johansen unsigned int mode) 105b5e95b48SJohn Johansen { 106b5e95b48SJohn Johansen return aa_ptrace(current, child, mode); 107b5e95b48SJohn Johansen } 108b5e95b48SJohn Johansen 109b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 110b5e95b48SJohn Johansen { 111b5e95b48SJohn Johansen return aa_ptrace(parent, current, PTRACE_MODE_ATTACH); 112b5e95b48SJohn Johansen } 113b5e95b48SJohn Johansen 114b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 115b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 116b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 117b5e95b48SJohn Johansen { 118b5e95b48SJohn Johansen struct aa_profile *profile; 119b5e95b48SJohn Johansen const struct cred *cred; 120b5e95b48SJohn Johansen 121b5e95b48SJohn Johansen rcu_read_lock(); 122b5e95b48SJohn Johansen cred = __task_cred(target); 123b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 124b5e95b48SJohn Johansen 125b1d9e6b0SCasey Schaufler /* 126b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 127b1d9e6b0SCasey Schaufler * initialize effective and permitted. 128b1d9e6b0SCasey Schaufler */ 12925e75dffSJohn Johansen if (!unconfined(profile) && !COMPLAIN_MODE(profile)) { 130b5e95b48SJohn Johansen *effective = cap_intersect(*effective, profile->caps.allow); 131b5e95b48SJohn Johansen *permitted = cap_intersect(*permitted, profile->caps.allow); 132b5e95b48SJohn Johansen } 133b5e95b48SJohn Johansen rcu_read_unlock(); 134b5e95b48SJohn Johansen 135b5e95b48SJohn Johansen return 0; 136b5e95b48SJohn Johansen } 137b5e95b48SJohn Johansen 1386a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 1396a9de491SEric Paris int cap, int audit) 140b5e95b48SJohn Johansen { 141b5e95b48SJohn Johansen struct aa_profile *profile; 142b1d9e6b0SCasey Schaufler int error = 0; 143b1d9e6b0SCasey Schaufler 144b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 145b5e95b48SJohn Johansen if (!unconfined(profile)) 146dd0c6e86SJohn Johansen error = aa_capable(profile, cap, audit); 147b5e95b48SJohn Johansen return error; 148b5e95b48SJohn Johansen } 149b5e95b48SJohn Johansen 150b5e95b48SJohn Johansen /** 151b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 152b5e95b48SJohn Johansen * @op: operation being checked 153b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 154b5e95b48SJohn Johansen * @mask: requested permissions mask 155b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 156b5e95b48SJohn Johansen * 157b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 158b5e95b48SJohn Johansen */ 15947f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 160b5e95b48SJohn Johansen struct path_cond *cond) 161b5e95b48SJohn Johansen { 162b5e95b48SJohn Johansen struct aa_profile *profile; 163b5e95b48SJohn Johansen int error = 0; 164b5e95b48SJohn Johansen 165b5e95b48SJohn Johansen profile = __aa_current_profile(); 166b5e95b48SJohn Johansen if (!unconfined(profile)) 167b5e95b48SJohn Johansen error = aa_path_perm(op, profile, path, 0, mask, cond); 168b5e95b48SJohn Johansen 169b5e95b48SJohn Johansen return error; 170b5e95b48SJohn Johansen } 171b5e95b48SJohn Johansen 172b5e95b48SJohn Johansen /** 17331f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 17431f75bfeSJohn Johansen * @op: operation being checked 17531f75bfeSJohn Johansen * @path: location to check (NOT NULL) 17631f75bfeSJohn Johansen * @mask: requested permissions mask 17731f75bfeSJohn Johansen * 17831f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 17931f75bfeSJohn Johansen */ 18031f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 18131f75bfeSJohn Johansen { 18231f75bfeSJohn Johansen struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 18331f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 18431f75bfeSJohn Johansen }; 18531f75bfeSJohn Johansen 18631f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 18731f75bfeSJohn Johansen return 0; 18831f75bfeSJohn Johansen 18931f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 19031f75bfeSJohn Johansen } 19131f75bfeSJohn Johansen 19231f75bfeSJohn Johansen /** 193b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 194b5e95b48SJohn Johansen * @op: operation being checked 195b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 196b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 197b5e95b48SJohn Johansen * @mask: requested permissions mask 198b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 199b5e95b48SJohn Johansen * 200b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 201b5e95b48SJohn Johansen */ 20247f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 203b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 204b5e95b48SJohn Johansen struct path_cond *cond) 205b5e95b48SJohn Johansen { 2068486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 207b5e95b48SJohn Johansen 208b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 209b5e95b48SJohn Johansen } 210b5e95b48SJohn Johansen 211b5e95b48SJohn Johansen /** 212b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 213b5e95b48SJohn Johansen * @op: operation being checked 214b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 215b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 216b5e95b48SJohn Johansen * @mask: requested permission mask 217b5e95b48SJohn Johansen * 218b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 219b5e95b48SJohn Johansen */ 22047f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 221b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 222b5e95b48SJohn Johansen { 223c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 224b5e95b48SJohn Johansen struct path_cond cond = { }; 225b5e95b48SJohn Johansen 226efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 227b5e95b48SJohn Johansen return 0; 228b5e95b48SJohn Johansen 229b5e95b48SJohn Johansen cond.uid = inode->i_uid; 230b5e95b48SJohn Johansen cond.mode = inode->i_mode; 231b5e95b48SJohn Johansen 232b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 233b5e95b48SJohn Johansen } 234b5e95b48SJohn Johansen 235b5e95b48SJohn Johansen /** 236b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 237b5e95b48SJohn Johansen * @op: operation being checked 238b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 239b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 240b5e95b48SJohn Johansen * @mask: request permission mask 241b5e95b48SJohn Johansen * @mode: created file mode 242b5e95b48SJohn Johansen * 243b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 244b5e95b48SJohn Johansen */ 24547f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 246d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 247b5e95b48SJohn Johansen { 248b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 249b5e95b48SJohn Johansen 250efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 251b5e95b48SJohn Johansen return 0; 252b5e95b48SJohn Johansen 253b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 254b5e95b48SJohn Johansen } 255b5e95b48SJohn Johansen 256989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 257b5e95b48SJohn Johansen { 258b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 259b5e95b48SJohn Johansen } 260b5e95b48SJohn Johansen 261d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 2624572befeSAl Viro umode_t mode) 263b5e95b48SJohn Johansen { 264b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 265b5e95b48SJohn Johansen S_IFDIR); 266b5e95b48SJohn Johansen } 267b5e95b48SJohn Johansen 268989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 269b5e95b48SJohn Johansen { 270b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 271b5e95b48SJohn Johansen } 272b5e95b48SJohn Johansen 273d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 27404fc66e7SAl Viro umode_t mode, unsigned int dev) 275b5e95b48SJohn Johansen { 276b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 277b5e95b48SJohn Johansen } 278b5e95b48SJohn Johansen 27981f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 280b5e95b48SJohn Johansen { 281e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 282b5e95b48SJohn Johansen } 283b5e95b48SJohn Johansen 284d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 285b5e95b48SJohn Johansen const char *old_name) 286b5e95b48SJohn Johansen { 287b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 288b5e95b48SJohn Johansen S_IFLNK); 289b5e95b48SJohn Johansen } 290b5e95b48SJohn Johansen 2913ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 292b5e95b48SJohn Johansen struct dentry *new_dentry) 293b5e95b48SJohn Johansen { 294b5e95b48SJohn Johansen struct aa_profile *profile; 295b5e95b48SJohn Johansen int error = 0; 296b5e95b48SJohn Johansen 297efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 298b5e95b48SJohn Johansen return 0; 299b5e95b48SJohn Johansen 300b5e95b48SJohn Johansen profile = aa_current_profile(); 301b5e95b48SJohn Johansen if (!unconfined(profile)) 302b5e95b48SJohn Johansen error = aa_path_link(profile, old_dentry, new_dir, new_dentry); 303b5e95b48SJohn Johansen return error; 304b5e95b48SJohn Johansen } 305b5e95b48SJohn Johansen 3063ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 3073ccee46aSAl Viro const struct path *new_dir, struct dentry *new_dentry) 308b5e95b48SJohn Johansen { 309b5e95b48SJohn Johansen struct aa_profile *profile; 310b5e95b48SJohn Johansen int error = 0; 311b5e95b48SJohn Johansen 312efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 313b5e95b48SJohn Johansen return 0; 314b5e95b48SJohn Johansen 315b5e95b48SJohn Johansen profile = aa_current_profile(); 316b5e95b48SJohn Johansen if (!unconfined(profile)) { 3178486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3188486adf0SKees Cook .dentry = old_dentry }; 3198486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3208486adf0SKees Cook .dentry = new_dentry }; 321c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(old_dentry)->i_uid, 322c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 323b5e95b48SJohn Johansen }; 324b5e95b48SJohn Johansen 325b5e95b48SJohn Johansen error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0, 326e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 327e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 328b5e95b48SJohn Johansen &cond); 329b5e95b48SJohn Johansen if (!error) 330b5e95b48SJohn Johansen error = aa_path_perm(OP_RENAME_DEST, profile, &new_path, 331e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 332b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 333b5e95b48SJohn Johansen 334b5e95b48SJohn Johansen } 335b5e95b48SJohn Johansen return error; 336b5e95b48SJohn Johansen } 337b5e95b48SJohn Johansen 338be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 339b5e95b48SJohn Johansen { 34031f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 341b5e95b48SJohn Johansen } 342b5e95b48SJohn Johansen 3437fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 344b5e95b48SJohn Johansen { 34531f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 346b5e95b48SJohn Johansen } 347b5e95b48SJohn Johansen 3483f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 349b5e95b48SJohn Johansen { 350e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 351b5e95b48SJohn Johansen } 352b5e95b48SJohn Johansen 35383d49856SEric Paris static int apparmor_file_open(struct file *file, const struct cred *cred) 354b5e95b48SJohn Johansen { 35555a26ebfSJohn Johansen struct aa_file_ctx *fctx = file->f_security; 356b5e95b48SJohn Johansen struct aa_profile *profile; 357b5e95b48SJohn Johansen int error = 0; 358b5e95b48SJohn Johansen 359efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 360b5e95b48SJohn Johansen return 0; 361b5e95b48SJohn Johansen 362b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 363b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 364b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 365b5e95b48SJohn Johansen * actually execute the image. 366b5e95b48SJohn Johansen */ 367b5e95b48SJohn Johansen if (current->in_execve) { 36855a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 369b5e95b48SJohn Johansen return 0; 370b5e95b48SJohn Johansen } 371b5e95b48SJohn Johansen 372b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 373b5e95b48SJohn Johansen if (!unconfined(profile)) { 374496ad9aaSAl Viro struct inode *inode = file_inode(file); 375b5e95b48SJohn Johansen struct path_cond cond = { inode->i_uid, inode->i_mode }; 376b5e95b48SJohn Johansen 377b5e95b48SJohn Johansen error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0, 378b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 379b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 38055a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 381b5e95b48SJohn Johansen } 382b5e95b48SJohn Johansen 383b5e95b48SJohn Johansen return error; 384b5e95b48SJohn Johansen } 385b5e95b48SJohn Johansen 386b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 387b5e95b48SJohn Johansen { 388b5e95b48SJohn Johansen /* freed by apparmor_file_free_security */ 389b5e95b48SJohn Johansen file->f_security = aa_alloc_file_context(GFP_KERNEL); 390b5e95b48SJohn Johansen if (!file->f_security) 391b5e95b48SJohn Johansen return -ENOMEM; 392b5e95b48SJohn Johansen return 0; 393b5e95b48SJohn Johansen 394b5e95b48SJohn Johansen } 395b5e95b48SJohn Johansen 396b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 397b5e95b48SJohn Johansen { 39855a26ebfSJohn Johansen struct aa_file_ctx *ctx = file->f_security; 399b5e95b48SJohn Johansen 40055a26ebfSJohn Johansen aa_free_file_context(ctx); 401b5e95b48SJohn Johansen } 402b5e95b48SJohn Johansen 40347f6e5ccSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask) 404b5e95b48SJohn Johansen { 40555a26ebfSJohn Johansen struct aa_file_ctx *fctx = file->f_security; 406b5e95b48SJohn Johansen struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred); 407b5e95b48SJohn Johansen int error = 0; 408b5e95b48SJohn Johansen 409e6bfa25dSJohn Johansen AA_BUG(!fprofile); 410b5e95b48SJohn Johansen 411b5e95b48SJohn Johansen if (!file->f_path.mnt || 412efeee83aSJohn Johansen !path_mediated_fs(file->f_path.dentry)) 413b5e95b48SJohn Johansen return 0; 414b5e95b48SJohn Johansen 415b5e95b48SJohn Johansen profile = __aa_current_profile(); 416b5e95b48SJohn Johansen 417b5e95b48SJohn Johansen /* revalidate access, if task is unconfined, or the cached cred 418b5e95b48SJohn Johansen * doesn't match or if the request is for more permissions than 419b5e95b48SJohn Johansen * was granted. 420b5e95b48SJohn Johansen * 421b5e95b48SJohn Johansen * Note: the test for !unconfined(fprofile) is to handle file 422b5e95b48SJohn Johansen * delegation from unconfined tasks 423b5e95b48SJohn Johansen */ 424b5e95b48SJohn Johansen if (!unconfined(profile) && !unconfined(fprofile) && 42555a26ebfSJohn Johansen ((fprofile != profile) || (mask & ~fctx->allow))) 426b5e95b48SJohn Johansen error = aa_file_perm(op, profile, file, mask); 427b5e95b48SJohn Johansen 428b5e95b48SJohn Johansen return error; 429b5e95b48SJohn Johansen } 430b5e95b48SJohn Johansen 431b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 432b5e95b48SJohn Johansen { 433b5e95b48SJohn Johansen return common_file_perm(OP_FPERM, file, mask); 434b5e95b48SJohn Johansen } 435b5e95b48SJohn Johansen 436b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 437b5e95b48SJohn Johansen { 438b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 439b5e95b48SJohn Johansen 440b5e95b48SJohn Johansen if (cmd == F_WRLCK) 441b5e95b48SJohn Johansen mask |= MAY_WRITE; 442b5e95b48SJohn Johansen 443b5e95b48SJohn Johansen return common_file_perm(OP_FLOCK, file, mask); 444b5e95b48SJohn Johansen } 445b5e95b48SJohn Johansen 44647f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 447b5e95b48SJohn Johansen unsigned long flags) 448b5e95b48SJohn Johansen { 449b5e95b48SJohn Johansen int mask = 0; 450b5e95b48SJohn Johansen 451b5e95b48SJohn Johansen if (!file || !file->f_security) 452b5e95b48SJohn Johansen return 0; 453b5e95b48SJohn Johansen 454b5e95b48SJohn Johansen if (prot & PROT_READ) 455b5e95b48SJohn Johansen mask |= MAY_READ; 456b5e95b48SJohn Johansen /* 457b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 458b5e95b48SJohn Johansen * write back to the files 459b5e95b48SJohn Johansen */ 460b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 461b5e95b48SJohn Johansen mask |= MAY_WRITE; 462b5e95b48SJohn Johansen if (prot & PROT_EXEC) 463b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 464b5e95b48SJohn Johansen 465b5e95b48SJohn Johansen return common_file_perm(op, file, mask); 466b5e95b48SJohn Johansen } 467b5e95b48SJohn Johansen 468e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 469e5467859SAl Viro unsigned long prot, unsigned long flags) 470b5e95b48SJohn Johansen { 471b5e95b48SJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags); 472b5e95b48SJohn Johansen } 473b5e95b48SJohn Johansen 474b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 475b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 476b5e95b48SJohn Johansen { 477b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 478b5e95b48SJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); 479b5e95b48SJohn Johansen } 480b5e95b48SJohn Johansen 481b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 482b5e95b48SJohn Johansen char **value) 483b5e95b48SJohn Johansen { 484b5e95b48SJohn Johansen int error = -ENOENT; 485b5e95b48SJohn Johansen /* released below */ 486b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 48755a26ebfSJohn Johansen struct aa_task_ctx *ctx = cred_ctx(cred); 48877b071b3SJohn Johansen struct aa_profile *profile = NULL; 489b5e95b48SJohn Johansen 490b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 49155a26ebfSJohn Johansen profile = aa_get_newest_profile(ctx->profile); 49255a26ebfSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 49355a26ebfSJohn Johansen profile = aa_get_newest_profile(ctx->previous); 49455a26ebfSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 49555a26ebfSJohn Johansen profile = aa_get_newest_profile(ctx->onexec); 496b5e95b48SJohn Johansen else 497b5e95b48SJohn Johansen error = -EINVAL; 498b5e95b48SJohn Johansen 49977b071b3SJohn Johansen if (profile) 50077b071b3SJohn Johansen error = aa_getprocattr(profile, value); 50177b071b3SJohn Johansen 50277b071b3SJohn Johansen aa_put_profile(profile); 503b5e95b48SJohn Johansen put_cred(cred); 504b5e95b48SJohn Johansen 505b5e95b48SJohn Johansen return error; 506b5e95b48SJohn Johansen } 507b5e95b48SJohn Johansen 508b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 509b21507e2SStephen Smalley size_t size) 510b5e95b48SJohn Johansen { 511e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 512b5e95b48SJohn Johansen size_t arg_size; 513b5e95b48SJohn Johansen int error; 514ef88a7acSJohn Johansen DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR); 515b5e95b48SJohn Johansen 516b5e95b48SJohn Johansen if (size == 0) 517b5e95b48SJohn Johansen return -EINVAL; 518b5e95b48SJohn Johansen 519e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 520e89b8081SVegard Nossum if (args[size - 1] != '\0') { 521e89b8081SVegard Nossum /* null terminate */ 522e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 523e89b8081SVegard Nossum if (!args) 524e89b8081SVegard Nossum return -ENOMEM; 525e89b8081SVegard Nossum memcpy(args, value, size); 526e89b8081SVegard Nossum args[size] = '\0'; 527e89b8081SVegard Nossum } 528e89b8081SVegard Nossum 529e89b8081SVegard Nossum error = -EINVAL; 530b5e95b48SJohn Johansen args = strim(args); 531b5e95b48SJohn Johansen command = strsep(&args, " "); 532b5e95b48SJohn Johansen if (!args) 533e89b8081SVegard Nossum goto out; 534b5e95b48SJohn Johansen args = skip_spaces(args); 535b5e95b48SJohn Johansen if (!*args) 536e89b8081SVegard Nossum goto out; 537b5e95b48SJohn Johansen 538d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 539b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 540b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 541b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 542b5e95b48SJohn Johansen !AA_DO_TEST); 543b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 544b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 545b5e95b48SJohn Johansen AA_DO_TEST); 546b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 547aa9a39adSJohn Johansen error = aa_change_profile(args, !AA_ONEXEC, 548aa9a39adSJohn Johansen !AA_DO_TEST, false); 549b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 550aa9a39adSJohn Johansen error = aa_change_profile(args, !AA_ONEXEC, AA_DO_TEST, 551aa9a39adSJohn Johansen false); 5523eea57c2SJohn Johansen } else 5533eea57c2SJohn Johansen goto fail; 554b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 5553eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 556aa9a39adSJohn Johansen error = aa_change_profile(args, AA_ONEXEC, !AA_DO_TEST, 557aa9a39adSJohn Johansen false); 5583eea57c2SJohn Johansen else 5593eea57c2SJohn Johansen goto fail; 5603eea57c2SJohn Johansen } else 561b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 562e89b8081SVegard Nossum goto fail; 5633eea57c2SJohn Johansen 564b5e95b48SJohn Johansen if (!error) 565b5e95b48SJohn Johansen error = size; 566e89b8081SVegard Nossum out: 567e89b8081SVegard Nossum kfree(largs); 568b5e95b48SJohn Johansen return error; 5693eea57c2SJohn Johansen 5703eea57c2SJohn Johansen fail: 571ef88a7acSJohn Johansen aad(&sa)->profile = aa_current_profile(); 572ef88a7acSJohn Johansen aad(&sa)->info = name; 573ef88a7acSJohn Johansen aad(&sa)->error = error = -EINVAL; 5743eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 575e89b8081SVegard Nossum goto out; 576b5e95b48SJohn Johansen } 577b5e95b48SJohn Johansen 5787cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 5797cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 580b5e95b48SJohn Johansen { 5811780f2d3SJohn Johansen struct aa_profile *profile = __aa_current_profile(); 582b5e95b48SJohn Johansen int error = 0; 583b5e95b48SJohn Johansen 584b5e95b48SJohn Johansen if (!unconfined(profile)) 5853a2dc838SJohn Johansen error = aa_task_setrlimit(profile, task, resource, new_rlim); 586b5e95b48SJohn Johansen 587b5e95b48SJohn Johansen return error; 588b5e95b48SJohn Johansen } 589b5e95b48SJohn Johansen 590ca97d939SJames Morris static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 591e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 592e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 593e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 594e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 595b5e95b48SJohn Johansen 596e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 597e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 598e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 599e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 600e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 601e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 602e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 603e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 604e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 605e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 606e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 607b5e95b48SJohn Johansen 608e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 609e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 610e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 611e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 612e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 613e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 614e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 615b5e95b48SJohn Johansen 616e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 617e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 618b5e95b48SJohn Johansen 619e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 620e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 621e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 622e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 623b5e95b48SJohn Johansen 624e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds), 625e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 626e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 627e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec), 628b5e95b48SJohn Johansen 629e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 630b5e95b48SJohn Johansen }; 631b5e95b48SJohn Johansen 632b5e95b48SJohn Johansen /* 633b5e95b48SJohn Johansen * AppArmor sysfs module parameters 634b5e95b48SJohn Johansen */ 635b5e95b48SJohn Johansen 636101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 637101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 638b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 6399c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 6406a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 641101d6c82SStephen Rothwell .set = param_set_aabool, 642101d6c82SStephen Rothwell .get = param_get_aabool 643101d6c82SStephen Rothwell }; 644b5e95b48SJohn Johansen 645101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 646101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 647b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 6489c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 649101d6c82SStephen Rothwell .set = param_set_aauint, 650101d6c82SStephen Rothwell .get = param_get_aauint 651101d6c82SStephen Rothwell }; 652b5e95b48SJohn Johansen 653101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 654101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 655b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 6569c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 6576a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 658101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 659101d6c82SStephen Rothwell .get = param_get_aalockpolicy 660101d6c82SStephen Rothwell }; 661b5e95b48SJohn Johansen 662b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp); 663b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp); 664b5e95b48SJohn Johansen 665b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp); 666b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp); 667b5e95b48SJohn Johansen 668b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 669b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 670b5e95b48SJohn Johansen */ 671b5e95b48SJohn Johansen 672b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 673b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 674b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 675b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 676b5e95b48SJohn Johansen 6776059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 6787616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 6793ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 6806059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 6817616ac70SArnd Bergmann #endif 6826059f71fSJohn Johansen 683b5e95b48SJohn Johansen /* Debug mode */ 684eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 685b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 686b5e95b48SJohn Johansen 687b5e95b48SJohn Johansen /* Audit mode */ 688b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 689b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 690b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 691b5e95b48SJohn Johansen 692b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 693b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 694b5e95b48SJohn Johansen */ 69590ab5ee9SRusty Russell bool aa_g_audit_header = 1; 696b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 697b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 698b5e95b48SJohn Johansen 699b5e95b48SJohn Johansen /* lock out loading/removal of policy 700b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 701b5e95b48SJohn Johansen * load policy, if lock_policy is set 702b5e95b48SJohn Johansen */ 70390ab5ee9SRusty Russell bool aa_g_lock_policy; 704b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 705b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 706b5e95b48SJohn Johansen 707b5e95b48SJohn Johansen /* Syscall logging mode */ 70890ab5ee9SRusty Russell bool aa_g_logsyscall; 709b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 710b5e95b48SJohn Johansen 711b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 712b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 713622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 714b5e95b48SJohn Johansen 715b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 716b5e95b48SJohn Johansen * on the loaded policy is done. 717abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 718abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 719b5e95b48SJohn Johansen */ 72090ab5ee9SRusty Russell bool aa_g_paranoid_load = 1; 721abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 722b5e95b48SJohn Johansen 723b5e95b48SJohn Johansen /* Boot time disable flag */ 72490ab5ee9SRusty Russell static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE; 725c611616cSJohn Johansen module_param_named(enabled, apparmor_enabled, bool, S_IRUGO); 726b5e95b48SJohn Johansen 727b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 728b5e95b48SJohn Johansen { 729b5e95b48SJohn Johansen unsigned long enabled; 73029707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 731b5e95b48SJohn Johansen if (!error) 732b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 733b5e95b48SJohn Johansen return 1; 734b5e95b48SJohn Johansen } 735b5e95b48SJohn Johansen 736b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 737b5e95b48SJohn Johansen 738b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 739101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 740b5e95b48SJohn Johansen { 741545de8feSJohn Johansen if (!apparmor_enabled) 742545de8feSJohn Johansen return -EINVAL; 743545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 744b5e95b48SJohn Johansen return -EPERM; 745b5e95b48SJohn Johansen return param_set_bool(val, kp); 746b5e95b48SJohn Johansen } 747b5e95b48SJohn Johansen 748101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 749b5e95b48SJohn Johansen { 750ca4bd5aeSJohn Johansen if (!apparmor_enabled) 751ca4bd5aeSJohn Johansen return -EINVAL; 752545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 753545de8feSJohn Johansen return -EPERM; 754b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 755b5e95b48SJohn Johansen } 756b5e95b48SJohn Johansen 757101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 758b5e95b48SJohn Johansen { 759ca4bd5aeSJohn Johansen if (!apparmor_enabled) 760ca4bd5aeSJohn Johansen return -EINVAL; 761545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 762545de8feSJohn Johansen return -EPERM; 763b5e95b48SJohn Johansen return param_set_bool(val, kp); 764b5e95b48SJohn Johansen } 765b5e95b48SJohn Johansen 766101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 767b5e95b48SJohn Johansen { 768ca4bd5aeSJohn Johansen if (!apparmor_enabled) 769ca4bd5aeSJohn Johansen return -EINVAL; 770545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 771545de8feSJohn Johansen return -EPERM; 772b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 773b5e95b48SJohn Johansen } 774b5e95b48SJohn Johansen 775101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 776b5e95b48SJohn Johansen { 777*39d84824SJohn Johansen int error; 778*39d84824SJohn Johansen 779ca4bd5aeSJohn Johansen if (!apparmor_enabled) 780ca4bd5aeSJohn Johansen return -EINVAL; 781*39d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 782*39d84824SJohn Johansen if (apparmor_initialized) 783545de8feSJohn Johansen return -EPERM; 784*39d84824SJohn Johansen 785*39d84824SJohn Johansen error = param_set_uint(val, kp); 786*39d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 787*39d84824SJohn Johansen 788*39d84824SJohn Johansen return error; 789b5e95b48SJohn Johansen } 790b5e95b48SJohn Johansen 791101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 792b5e95b48SJohn Johansen { 793ca4bd5aeSJohn Johansen if (!apparmor_enabled) 794ca4bd5aeSJohn Johansen return -EINVAL; 795545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 796545de8feSJohn Johansen return -EPERM; 797b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 798b5e95b48SJohn Johansen } 799b5e95b48SJohn Johansen 800b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp) 801b5e95b48SJohn Johansen { 802b5e95b48SJohn Johansen if (!apparmor_enabled) 803b5e95b48SJohn Johansen return -EINVAL; 804545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 805545de8feSJohn Johansen return -EPERM; 806b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 807b5e95b48SJohn Johansen } 808b5e95b48SJohn Johansen 809b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp) 810b5e95b48SJohn Johansen { 811b5e95b48SJohn Johansen int i; 812b5e95b48SJohn Johansen 813b5e95b48SJohn Johansen if (!apparmor_enabled) 814b5e95b48SJohn Johansen return -EINVAL; 815b5e95b48SJohn Johansen if (!val) 816b5e95b48SJohn Johansen return -EINVAL; 817545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 818545de8feSJohn Johansen return -EPERM; 819b5e95b48SJohn Johansen 820b5e95b48SJohn Johansen for (i = 0; i < AUDIT_MAX_INDEX; i++) { 821b5e95b48SJohn Johansen if (strcmp(val, audit_mode_names[i]) == 0) { 822b5e95b48SJohn Johansen aa_g_audit = i; 823b5e95b48SJohn Johansen return 0; 824b5e95b48SJohn Johansen } 825b5e95b48SJohn Johansen } 826b5e95b48SJohn Johansen 827b5e95b48SJohn Johansen return -EINVAL; 828b5e95b48SJohn Johansen } 829b5e95b48SJohn Johansen 830b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp) 831b5e95b48SJohn Johansen { 832b5e95b48SJohn Johansen if (!apparmor_enabled) 833b5e95b48SJohn Johansen return -EINVAL; 834545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 835545de8feSJohn Johansen return -EPERM; 836b5e95b48SJohn Johansen 8370d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 838b5e95b48SJohn Johansen } 839b5e95b48SJohn Johansen 840b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp) 841b5e95b48SJohn Johansen { 842b5e95b48SJohn Johansen int i; 843b5e95b48SJohn Johansen 844b5e95b48SJohn Johansen if (!apparmor_enabled) 845b5e95b48SJohn Johansen return -EINVAL; 846b5e95b48SJohn Johansen if (!val) 847b5e95b48SJohn Johansen return -EINVAL; 848545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 849545de8feSJohn Johansen return -EPERM; 850b5e95b48SJohn Johansen 8510d259f04SJohn Johansen for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) { 8520d259f04SJohn Johansen if (strcmp(val, aa_profile_mode_names[i]) == 0) { 853b5e95b48SJohn Johansen aa_g_profile_mode = i; 854b5e95b48SJohn Johansen return 0; 855b5e95b48SJohn Johansen } 856b5e95b48SJohn Johansen } 857b5e95b48SJohn Johansen 858b5e95b48SJohn Johansen return -EINVAL; 859b5e95b48SJohn Johansen } 860b5e95b48SJohn Johansen 861b5e95b48SJohn Johansen /* 862b5e95b48SJohn Johansen * AppArmor init functions 863b5e95b48SJohn Johansen */ 864b5e95b48SJohn Johansen 865b5e95b48SJohn Johansen /** 86655a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 867b5e95b48SJohn Johansen * 868b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 869b5e95b48SJohn Johansen */ 87055a26ebfSJohn Johansen static int __init set_init_ctx(void) 871b5e95b48SJohn Johansen { 872b5e95b48SJohn Johansen struct cred *cred = (struct cred *)current->real_cred; 87355a26ebfSJohn Johansen struct aa_task_ctx *ctx; 874b5e95b48SJohn Johansen 87555a26ebfSJohn Johansen ctx = aa_alloc_task_context(GFP_KERNEL); 87655a26ebfSJohn Johansen if (!ctx) 877b5e95b48SJohn Johansen return -ENOMEM; 878b5e95b48SJohn Johansen 87955a26ebfSJohn Johansen ctx->profile = aa_get_profile(root_ns->unconfined); 88055a26ebfSJohn Johansen cred_ctx(cred) = ctx; 881b5e95b48SJohn Johansen 882b5e95b48SJohn Johansen return 0; 883b5e95b48SJohn Johansen } 884b5e95b48SJohn Johansen 885d4669f0bSJohn Johansen static void destroy_buffers(void) 886d4669f0bSJohn Johansen { 887d4669f0bSJohn Johansen u32 i, j; 888d4669f0bSJohn Johansen 889d4669f0bSJohn Johansen for_each_possible_cpu(i) { 890d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 891d4669f0bSJohn Johansen kfree(per_cpu(aa_buffers, i).buf[j]); 892d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = NULL; 893d4669f0bSJohn Johansen } 894d4669f0bSJohn Johansen } 895d4669f0bSJohn Johansen } 896d4669f0bSJohn Johansen 897d4669f0bSJohn Johansen static int __init alloc_buffers(void) 898d4669f0bSJohn Johansen { 899d4669f0bSJohn Johansen u32 i, j; 900d4669f0bSJohn Johansen 901d4669f0bSJohn Johansen for_each_possible_cpu(i) { 902d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 903d4669f0bSJohn Johansen char *buffer; 904d4669f0bSJohn Johansen 905d4669f0bSJohn Johansen if (cpu_to_node(i) > num_online_nodes()) 906d4669f0bSJohn Johansen /* fallback to kmalloc for offline nodes */ 907d4669f0bSJohn Johansen buffer = kmalloc(aa_g_path_max, GFP_KERNEL); 908d4669f0bSJohn Johansen else 909d4669f0bSJohn Johansen buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL, 910d4669f0bSJohn Johansen cpu_to_node(i)); 911d4669f0bSJohn Johansen if (!buffer) { 912d4669f0bSJohn Johansen destroy_buffers(); 913d4669f0bSJohn Johansen return -ENOMEM; 914d4669f0bSJohn Johansen } 915d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = buffer; 916d4669f0bSJohn Johansen } 917d4669f0bSJohn Johansen } 918d4669f0bSJohn Johansen 919d4669f0bSJohn Johansen return 0; 920d4669f0bSJohn Johansen } 921d4669f0bSJohn Johansen 922e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 923e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 924e3ea1ca5STyler Hicks void __user *buffer, size_t *lenp, loff_t *ppos) 925e3ea1ca5STyler Hicks { 926e3ea1ca5STyler Hicks if (!policy_admin_capable(NULL)) 927e3ea1ca5STyler Hicks return -EPERM; 928e3ea1ca5STyler Hicks if (!apparmor_enabled) 929e3ea1ca5STyler Hicks return -EINVAL; 930e3ea1ca5STyler Hicks 931e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 932e3ea1ca5STyler Hicks } 933e3ea1ca5STyler Hicks 934e3ea1ca5STyler Hicks static struct ctl_path apparmor_sysctl_path[] = { 935e3ea1ca5STyler Hicks { .procname = "kernel", }, 936e3ea1ca5STyler Hicks { } 937e3ea1ca5STyler Hicks }; 938e3ea1ca5STyler Hicks 939e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 940e3ea1ca5STyler Hicks { 941e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 942e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 943e3ea1ca5STyler Hicks .maxlen = sizeof(int), 944e3ea1ca5STyler Hicks .mode = 0600, 945e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 946e3ea1ca5STyler Hicks }, 947e3ea1ca5STyler Hicks { } 948e3ea1ca5STyler Hicks }; 949e3ea1ca5STyler Hicks 950e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 951e3ea1ca5STyler Hicks { 952e3ea1ca5STyler Hicks return register_sysctl_paths(apparmor_sysctl_path, 953e3ea1ca5STyler Hicks apparmor_sysctl_table) ? 0 : -ENOMEM; 954e3ea1ca5STyler Hicks } 955e3ea1ca5STyler Hicks #else 956e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 957e3ea1ca5STyler Hicks { 958e3ea1ca5STyler Hicks return 0; 959e3ea1ca5STyler Hicks } 960e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 961e3ea1ca5STyler Hicks 962b5e95b48SJohn Johansen static int __init apparmor_init(void) 963b5e95b48SJohn Johansen { 964b5e95b48SJohn Johansen int error; 965b5e95b48SJohn Johansen 966b1d9e6b0SCasey Schaufler if (!apparmor_enabled || !security_module_enable("apparmor")) { 967b5e95b48SJohn Johansen aa_info_message("AppArmor disabled by boot time parameter"); 968b5e95b48SJohn Johansen apparmor_enabled = 0; 969b5e95b48SJohn Johansen return 0; 970b5e95b48SJohn Johansen } 971b5e95b48SJohn Johansen 97211c236b8SJohn Johansen error = aa_setup_dfa_engine(); 97311c236b8SJohn Johansen if (error) { 97411c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 97511c236b8SJohn Johansen goto alloc_out; 97611c236b8SJohn Johansen } 97711c236b8SJohn Johansen 978b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 979b5e95b48SJohn Johansen if (error) { 980b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 981b5e95b48SJohn Johansen goto alloc_out; 982b5e95b48SJohn Johansen } 983b5e95b48SJohn Johansen 984e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 985e3ea1ca5STyler Hicks if (error) { 986e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 987e3ea1ca5STyler Hicks goto alloc_out; 988e3ea1ca5STyler Hicks 989e3ea1ca5STyler Hicks } 990e3ea1ca5STyler Hicks 991d4669f0bSJohn Johansen error = alloc_buffers(); 992d4669f0bSJohn Johansen if (error) { 993d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 994d4669f0bSJohn Johansen goto buffers_out; 995d4669f0bSJohn Johansen } 996d4669f0bSJohn Johansen 99755a26ebfSJohn Johansen error = set_init_ctx(); 998b5e95b48SJohn Johansen if (error) { 999b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1000b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1001d4669f0bSJohn Johansen goto buffers_out; 1002b5e95b48SJohn Johansen } 1003d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1004d69dece5SCasey Schaufler "apparmor"); 1005b5e95b48SJohn Johansen 1006b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1007b5e95b48SJohn Johansen apparmor_initialized = 1; 1008b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1009b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1010b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1011b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1012b5e95b48SJohn Johansen else 1013b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1014b5e95b48SJohn Johansen 1015b5e95b48SJohn Johansen return error; 1016b5e95b48SJohn Johansen 1017d4669f0bSJohn Johansen buffers_out: 1018d4669f0bSJohn Johansen destroy_buffers(); 1019d4669f0bSJohn Johansen 1020b5e95b48SJohn Johansen alloc_out: 1021b5e95b48SJohn Johansen aa_destroy_aafs(); 102211c236b8SJohn Johansen aa_teardown_dfa_engine(); 1023b5e95b48SJohn Johansen 1024b5e95b48SJohn Johansen apparmor_enabled = 0; 1025b5e95b48SJohn Johansen return error; 1026b5e95b48SJohn Johansen } 1027b5e95b48SJohn Johansen 1028b5e95b48SJohn Johansen security_initcall(apparmor_init); 1029