1b5e95b48SJohn Johansen /* 2b5e95b48SJohn Johansen * AppArmor security module 3b5e95b48SJohn Johansen * 4b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 5b5e95b48SJohn Johansen * 6b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 7b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 8b5e95b48SJohn Johansen * 9b5e95b48SJohn Johansen * This program is free software; you can redistribute it and/or 10b5e95b48SJohn Johansen * modify it under the terms of the GNU General Public License as 11b5e95b48SJohn Johansen * published by the Free Software Foundation, version 2 of the 12b5e95b48SJohn Johansen * License. 13b5e95b48SJohn Johansen */ 14b5e95b48SJohn Johansen 153c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 16b5e95b48SJohn Johansen #include <linux/moduleparam.h> 17b5e95b48SJohn Johansen #include <linux/mm.h> 18b5e95b48SJohn Johansen #include <linux/mman.h> 19b5e95b48SJohn Johansen #include <linux/mount.h> 20b5e95b48SJohn Johansen #include <linux/namei.h> 21b5e95b48SJohn Johansen #include <linux/ptrace.h> 22b5e95b48SJohn Johansen #include <linux/ctype.h> 23b5e95b48SJohn Johansen #include <linux/sysctl.h> 24b5e95b48SJohn Johansen #include <linux/audit.h> 253486740aSSerge E. Hallyn #include <linux/user_namespace.h> 26e025be0fSWilliam Hua #include <linux/kmemleak.h> 27b5e95b48SJohn Johansen #include <net/sock.h> 28b5e95b48SJohn Johansen 29b5e95b48SJohn Johansen #include "include/apparmor.h" 30b5e95b48SJohn Johansen #include "include/apparmorfs.h" 31b5e95b48SJohn Johansen #include "include/audit.h" 32b5e95b48SJohn Johansen #include "include/capability.h" 33b5e95b48SJohn Johansen #include "include/context.h" 34b5e95b48SJohn Johansen #include "include/file.h" 35b5e95b48SJohn Johansen #include "include/ipc.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37637f688dSJohn Johansen #include "include/label.h" 38b5e95b48SJohn Johansen #include "include/policy.h" 39cff281f6SJohn Johansen #include "include/policy_ns.h" 40b5e95b48SJohn Johansen #include "include/procattr.h" 41b5e95b48SJohn Johansen 42b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 43545de8feSJohn Johansen int apparmor_initialized; 44b5e95b48SJohn Johansen 45d4669f0bSJohn Johansen DEFINE_PER_CPU(struct aa_buffers, aa_buffers); 46d4669f0bSJohn Johansen 47d4669f0bSJohn Johansen 48b5e95b48SJohn Johansen /* 49b5e95b48SJohn Johansen * LSM hook functions 50b5e95b48SJohn Johansen */ 51b5e95b48SJohn Johansen 52b5e95b48SJohn Johansen /* 53637f688dSJohn Johansen * free the associated aa_task_ctx and put its labels 54b5e95b48SJohn Johansen */ 55b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 56b5e95b48SJohn Johansen { 5755a26ebfSJohn Johansen aa_free_task_context(cred_ctx(cred)); 5855a26ebfSJohn Johansen cred_ctx(cred) = NULL; 59b5e95b48SJohn Johansen } 60b5e95b48SJohn Johansen 61b5e95b48SJohn Johansen /* 62b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 63b5e95b48SJohn Johansen */ 64b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 65b5e95b48SJohn Johansen { 66b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 6755a26ebfSJohn Johansen struct aa_task_ctx *ctx = aa_alloc_task_context(gfp); 6855a26ebfSJohn Johansen 6955a26ebfSJohn Johansen if (!ctx) 70b5e95b48SJohn Johansen return -ENOMEM; 71b5e95b48SJohn Johansen 7255a26ebfSJohn Johansen cred_ctx(cred) = ctx; 73b5e95b48SJohn Johansen return 0; 74b5e95b48SJohn Johansen } 75b5e95b48SJohn Johansen 76b5e95b48SJohn Johansen /* 7755a26ebfSJohn Johansen * prepare new aa_task_ctx for modification by prepare_cred block 78b5e95b48SJohn Johansen */ 79b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 80b5e95b48SJohn Johansen gfp_t gfp) 81b5e95b48SJohn Johansen { 82b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 8355a26ebfSJohn Johansen struct aa_task_ctx *ctx = aa_alloc_task_context(gfp); 8455a26ebfSJohn Johansen 8555a26ebfSJohn Johansen if (!ctx) 86b5e95b48SJohn Johansen return -ENOMEM; 87b5e95b48SJohn Johansen 8855a26ebfSJohn Johansen aa_dup_task_context(ctx, cred_ctx(old)); 8955a26ebfSJohn Johansen cred_ctx(new) = ctx; 90b5e95b48SJohn Johansen return 0; 91b5e95b48SJohn Johansen } 92b5e95b48SJohn Johansen 93b5e95b48SJohn Johansen /* 94b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 95b5e95b48SJohn Johansen */ 96b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 97b5e95b48SJohn Johansen { 9855a26ebfSJohn Johansen const struct aa_task_ctx *old_ctx = cred_ctx(old); 9955a26ebfSJohn Johansen struct aa_task_ctx *new_ctx = cred_ctx(new); 100b5e95b48SJohn Johansen 10155a26ebfSJohn Johansen aa_dup_task_context(new_ctx, old_ctx); 102b5e95b48SJohn Johansen } 103b5e95b48SJohn Johansen 104b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 105b5e95b48SJohn Johansen unsigned int mode) 106b5e95b48SJohn Johansen { 107b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 108b2d09ae4SJohn Johansen int error; 109b2d09ae4SJohn Johansen 110b2d09ae4SJohn Johansen tracer = begin_current_label_crit_section(); 111b2d09ae4SJohn Johansen tracee = aa_get_task_label(child); 112b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, 113b2d09ae4SJohn Johansen mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE); 114b2d09ae4SJohn Johansen aa_put_label(tracee); 115b2d09ae4SJohn Johansen end_current_label_crit_section(tracer); 116b2d09ae4SJohn Johansen 117b2d09ae4SJohn Johansen return error; 118b5e95b48SJohn Johansen } 119b5e95b48SJohn Johansen 120b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 121b5e95b48SJohn Johansen { 122b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 123b2d09ae4SJohn Johansen int error; 124b2d09ae4SJohn Johansen 125b2d09ae4SJohn Johansen tracee = begin_current_label_crit_section(); 126b2d09ae4SJohn Johansen tracer = aa_get_task_label(parent); 127b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE); 128b2d09ae4SJohn Johansen aa_put_label(tracer); 129b2d09ae4SJohn Johansen end_current_label_crit_section(tracee); 130b2d09ae4SJohn Johansen 131b2d09ae4SJohn Johansen return error; 132b5e95b48SJohn Johansen } 133b5e95b48SJohn Johansen 134b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 135b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 136b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 137b5e95b48SJohn Johansen { 138637f688dSJohn Johansen struct aa_label *label; 139b5e95b48SJohn Johansen const struct cred *cred; 140b5e95b48SJohn Johansen 141b5e95b48SJohn Johansen rcu_read_lock(); 142b5e95b48SJohn Johansen cred = __task_cred(target); 143637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 144c70c86c4SJohn Johansen 145b1d9e6b0SCasey Schaufler /* 146b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 147b1d9e6b0SCasey Schaufler * initialize effective and permitted. 148b1d9e6b0SCasey Schaufler */ 149c70c86c4SJohn Johansen if (!unconfined(label)) { 150c70c86c4SJohn Johansen struct aa_profile *profile; 151c70c86c4SJohn Johansen struct label_it i; 152c70c86c4SJohn Johansen 153c70c86c4SJohn Johansen label_for_each_confined(i, label, profile) { 154c70c86c4SJohn Johansen if (COMPLAIN_MODE(profile)) 155c70c86c4SJohn Johansen continue; 156c70c86c4SJohn Johansen *effective = cap_intersect(*effective, 157c70c86c4SJohn Johansen profile->caps.allow); 158c70c86c4SJohn Johansen *permitted = cap_intersect(*permitted, 159c70c86c4SJohn Johansen profile->caps.allow); 160c70c86c4SJohn Johansen } 161b5e95b48SJohn Johansen } 162b5e95b48SJohn Johansen rcu_read_unlock(); 163637f688dSJohn Johansen aa_put_label(label); 164b5e95b48SJohn Johansen 165b5e95b48SJohn Johansen return 0; 166b5e95b48SJohn Johansen } 167b5e95b48SJohn Johansen 1686a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 1696a9de491SEric Paris int cap, int audit) 170b5e95b48SJohn Johansen { 171637f688dSJohn Johansen struct aa_label *label; 172b1d9e6b0SCasey Schaufler int error = 0; 173b1d9e6b0SCasey Schaufler 174637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 175637f688dSJohn Johansen if (!unconfined(label)) 176c70c86c4SJohn Johansen error = aa_capable(label, cap, audit); 177637f688dSJohn Johansen aa_put_label(label); 178cf797c0eSJohn Johansen 179b5e95b48SJohn Johansen return error; 180b5e95b48SJohn Johansen } 181b5e95b48SJohn Johansen 182b5e95b48SJohn Johansen /** 183b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 184b5e95b48SJohn Johansen * @op: operation being checked 185b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 186b5e95b48SJohn Johansen * @mask: requested permissions mask 187b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 188b5e95b48SJohn Johansen * 189b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 190b5e95b48SJohn Johansen */ 19147f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 192b5e95b48SJohn Johansen struct path_cond *cond) 193b5e95b48SJohn Johansen { 194637f688dSJohn Johansen struct aa_label *label; 195b5e95b48SJohn Johansen int error = 0; 196b5e95b48SJohn Johansen 197637f688dSJohn Johansen label = __begin_current_label_crit_section(); 198637f688dSJohn Johansen if (!unconfined(label)) 199aebd873eSJohn Johansen error = aa_path_perm(op, label, path, 0, mask, cond); 200637f688dSJohn Johansen __end_current_label_crit_section(label); 201b5e95b48SJohn Johansen 202b5e95b48SJohn Johansen return error; 203b5e95b48SJohn Johansen } 204b5e95b48SJohn Johansen 205b5e95b48SJohn Johansen /** 20631f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 20731f75bfeSJohn Johansen * @op: operation being checked 20831f75bfeSJohn Johansen * @path: location to check (NOT NULL) 20931f75bfeSJohn Johansen * @mask: requested permissions mask 21031f75bfeSJohn Johansen * 21131f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 21231f75bfeSJohn Johansen */ 21331f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 21431f75bfeSJohn Johansen { 21531f75bfeSJohn Johansen struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 21631f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 21731f75bfeSJohn Johansen }; 21831f75bfeSJohn Johansen 21931f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 22031f75bfeSJohn Johansen return 0; 22131f75bfeSJohn Johansen 22231f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 22331f75bfeSJohn Johansen } 22431f75bfeSJohn Johansen 22531f75bfeSJohn Johansen /** 226b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 227b5e95b48SJohn Johansen * @op: operation being checked 228b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 229b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 230b5e95b48SJohn Johansen * @mask: requested permissions mask 231b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 232b5e95b48SJohn Johansen * 233b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 234b5e95b48SJohn Johansen */ 23547f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 236b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 237b5e95b48SJohn Johansen struct path_cond *cond) 238b5e95b48SJohn Johansen { 2398486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 240b5e95b48SJohn Johansen 241b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 242b5e95b48SJohn Johansen } 243b5e95b48SJohn Johansen 244b5e95b48SJohn Johansen /** 245b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 246b5e95b48SJohn Johansen * @op: operation being checked 247b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 248b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 249b5e95b48SJohn Johansen * @mask: requested permission mask 250b5e95b48SJohn Johansen * 251b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 252b5e95b48SJohn Johansen */ 25347f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 254b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 255b5e95b48SJohn Johansen { 256c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 257b5e95b48SJohn Johansen struct path_cond cond = { }; 258b5e95b48SJohn Johansen 259efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 260b5e95b48SJohn Johansen return 0; 261b5e95b48SJohn Johansen 262b5e95b48SJohn Johansen cond.uid = inode->i_uid; 263b5e95b48SJohn Johansen cond.mode = inode->i_mode; 264b5e95b48SJohn Johansen 265b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 266b5e95b48SJohn Johansen } 267b5e95b48SJohn Johansen 268b5e95b48SJohn Johansen /** 269b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 270b5e95b48SJohn Johansen * @op: operation being checked 271b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 272b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 273b5e95b48SJohn Johansen * @mask: request permission mask 274b5e95b48SJohn Johansen * @mode: created file mode 275b5e95b48SJohn Johansen * 276b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 277b5e95b48SJohn Johansen */ 27847f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 279d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 280b5e95b48SJohn Johansen { 281b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 282b5e95b48SJohn Johansen 283efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 284b5e95b48SJohn Johansen return 0; 285b5e95b48SJohn Johansen 286b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 287b5e95b48SJohn Johansen } 288b5e95b48SJohn Johansen 289989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 290b5e95b48SJohn Johansen { 291b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 292b5e95b48SJohn Johansen } 293b5e95b48SJohn Johansen 294d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 2954572befeSAl Viro umode_t mode) 296b5e95b48SJohn Johansen { 297b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 298b5e95b48SJohn Johansen S_IFDIR); 299b5e95b48SJohn Johansen } 300b5e95b48SJohn Johansen 301989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 302b5e95b48SJohn Johansen { 303b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 304b5e95b48SJohn Johansen } 305b5e95b48SJohn Johansen 306d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 30704fc66e7SAl Viro umode_t mode, unsigned int dev) 308b5e95b48SJohn Johansen { 309b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 310b5e95b48SJohn Johansen } 311b5e95b48SJohn Johansen 31281f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 313b5e95b48SJohn Johansen { 314e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 315b5e95b48SJohn Johansen } 316b5e95b48SJohn Johansen 317d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 318b5e95b48SJohn Johansen const char *old_name) 319b5e95b48SJohn Johansen { 320b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 321b5e95b48SJohn Johansen S_IFLNK); 322b5e95b48SJohn Johansen } 323b5e95b48SJohn Johansen 3243ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 325b5e95b48SJohn Johansen struct dentry *new_dentry) 326b5e95b48SJohn Johansen { 327637f688dSJohn Johansen struct aa_label *label; 328b5e95b48SJohn Johansen int error = 0; 329b5e95b48SJohn Johansen 330efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 331b5e95b48SJohn Johansen return 0; 332b5e95b48SJohn Johansen 333637f688dSJohn Johansen label = begin_current_label_crit_section(); 334637f688dSJohn Johansen if (!unconfined(label)) 3358014370fSJohn Johansen error = aa_path_link(label, old_dentry, new_dir, new_dentry); 336637f688dSJohn Johansen end_current_label_crit_section(label); 337cf797c0eSJohn Johansen 338b5e95b48SJohn Johansen return error; 339b5e95b48SJohn Johansen } 340b5e95b48SJohn Johansen 3413ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 3423ccee46aSAl Viro const struct path *new_dir, struct dentry *new_dentry) 343b5e95b48SJohn Johansen { 344637f688dSJohn Johansen struct aa_label *label; 345b5e95b48SJohn Johansen int error = 0; 346b5e95b48SJohn Johansen 347efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 348b5e95b48SJohn Johansen return 0; 349b5e95b48SJohn Johansen 350637f688dSJohn Johansen label = begin_current_label_crit_section(); 351637f688dSJohn Johansen if (!unconfined(label)) { 3528486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3538486adf0SKees Cook .dentry = old_dentry }; 3548486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3558486adf0SKees Cook .dentry = new_dentry }; 356c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(old_dentry)->i_uid, 357c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 358b5e95b48SJohn Johansen }; 359b5e95b48SJohn Johansen 360aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0, 361e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 362e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 363b5e95b48SJohn Johansen &cond); 364b5e95b48SJohn Johansen if (!error) 365aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_DEST, label, &new_path, 366e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 367b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 368b5e95b48SJohn Johansen 369b5e95b48SJohn Johansen } 370637f688dSJohn Johansen end_current_label_crit_section(label); 371cf797c0eSJohn Johansen 372b5e95b48SJohn Johansen return error; 373b5e95b48SJohn Johansen } 374b5e95b48SJohn Johansen 375be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 376b5e95b48SJohn Johansen { 37731f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 378b5e95b48SJohn Johansen } 379b5e95b48SJohn Johansen 3807fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 381b5e95b48SJohn Johansen { 38231f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 383b5e95b48SJohn Johansen } 384b5e95b48SJohn Johansen 3853f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 386b5e95b48SJohn Johansen { 387e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 388b5e95b48SJohn Johansen } 389b5e95b48SJohn Johansen 39083d49856SEric Paris static int apparmor_file_open(struct file *file, const struct cred *cred) 391b5e95b48SJohn Johansen { 392637f688dSJohn Johansen struct aa_file_ctx *fctx = file_ctx(file); 393637f688dSJohn Johansen struct aa_label *label; 394b5e95b48SJohn Johansen int error = 0; 395b5e95b48SJohn Johansen 396efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 397b5e95b48SJohn Johansen return 0; 398b5e95b48SJohn Johansen 399b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 400b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 401b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 402b5e95b48SJohn Johansen * actually execute the image. 403b5e95b48SJohn Johansen */ 404b5e95b48SJohn Johansen if (current->in_execve) { 40555a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 406b5e95b48SJohn Johansen return 0; 407b5e95b48SJohn Johansen } 408b5e95b48SJohn Johansen 409637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 410637f688dSJohn Johansen if (!unconfined(label)) { 411496ad9aaSAl Viro struct inode *inode = file_inode(file); 412b5e95b48SJohn Johansen struct path_cond cond = { inode->i_uid, inode->i_mode }; 413b5e95b48SJohn Johansen 414aebd873eSJohn Johansen error = aa_path_perm(OP_OPEN, label, &file->f_path, 0, 415b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 416b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 41755a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 418b5e95b48SJohn Johansen } 419637f688dSJohn Johansen aa_put_label(label); 420b5e95b48SJohn Johansen 421b5e95b48SJohn Johansen return error; 422b5e95b48SJohn Johansen } 423b5e95b48SJohn Johansen 424b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 425b5e95b48SJohn Johansen { 426cf797c0eSJohn Johansen int error = 0; 427cf797c0eSJohn Johansen 428b5e95b48SJohn Johansen /* freed by apparmor_file_free_security */ 429637f688dSJohn Johansen struct aa_label *label = begin_current_label_crit_section(); 430190a9518SJohn Johansen file->f_security = aa_alloc_file_ctx(label, GFP_KERNEL); 4312835a13bSJohn Johansen if (!file_ctx(file)) 4322835a13bSJohn Johansen error = -ENOMEM; 433637f688dSJohn Johansen end_current_label_crit_section(label); 434b5e95b48SJohn Johansen 435cf797c0eSJohn Johansen return error; 436b5e95b48SJohn Johansen } 437b5e95b48SJohn Johansen 438b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 439b5e95b48SJohn Johansen { 4402835a13bSJohn Johansen aa_free_file_ctx(file_ctx(file)); 441b5e95b48SJohn Johansen } 442b5e95b48SJohn Johansen 44347f6e5ccSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask) 444b5e95b48SJohn Johansen { 445190a9518SJohn Johansen struct aa_label *label; 446b5e95b48SJohn Johansen int error = 0; 447b5e95b48SJohn Johansen 448192ca6b5SJohn Johansen /* don't reaudit files closed during inheritance */ 449192ca6b5SJohn Johansen if (file->f_path.dentry == aa_null.dentry) 450192ca6b5SJohn Johansen return -EACCES; 451192ca6b5SJohn Johansen 452637f688dSJohn Johansen label = __begin_current_label_crit_section(); 453190a9518SJohn Johansen error = aa_file_perm(op, label, file, mask); 454637f688dSJohn Johansen __end_current_label_crit_section(label); 455b5e95b48SJohn Johansen 456b5e95b48SJohn Johansen return error; 457b5e95b48SJohn Johansen } 458b5e95b48SJohn Johansen 459064dc947SJohn Johansen static int apparmor_file_receive(struct file *file) 460064dc947SJohn Johansen { 461064dc947SJohn Johansen return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file)); 462064dc947SJohn Johansen } 463064dc947SJohn Johansen 464b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 465b5e95b48SJohn Johansen { 466b5e95b48SJohn Johansen return common_file_perm(OP_FPERM, file, mask); 467b5e95b48SJohn Johansen } 468b5e95b48SJohn Johansen 469b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 470b5e95b48SJohn Johansen { 471b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 472b5e95b48SJohn Johansen 473b5e95b48SJohn Johansen if (cmd == F_WRLCK) 474b5e95b48SJohn Johansen mask |= MAY_WRITE; 475b5e95b48SJohn Johansen 476b5e95b48SJohn Johansen return common_file_perm(OP_FLOCK, file, mask); 477b5e95b48SJohn Johansen } 478b5e95b48SJohn Johansen 47947f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 480b5e95b48SJohn Johansen unsigned long flags) 481b5e95b48SJohn Johansen { 482b5e95b48SJohn Johansen int mask = 0; 483b5e95b48SJohn Johansen 484637f688dSJohn Johansen if (!file || !file_ctx(file)) 485b5e95b48SJohn Johansen return 0; 486b5e95b48SJohn Johansen 487b5e95b48SJohn Johansen if (prot & PROT_READ) 488b5e95b48SJohn Johansen mask |= MAY_READ; 489b5e95b48SJohn Johansen /* 490b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 491b5e95b48SJohn Johansen * write back to the files 492b5e95b48SJohn Johansen */ 493b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 494b5e95b48SJohn Johansen mask |= MAY_WRITE; 495b5e95b48SJohn Johansen if (prot & PROT_EXEC) 496b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 497b5e95b48SJohn Johansen 498b5e95b48SJohn Johansen return common_file_perm(op, file, mask); 499b5e95b48SJohn Johansen } 500b5e95b48SJohn Johansen 501e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 502e5467859SAl Viro unsigned long prot, unsigned long flags) 503b5e95b48SJohn Johansen { 504b5e95b48SJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags); 505b5e95b48SJohn Johansen } 506b5e95b48SJohn Johansen 507b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 508b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 509b5e95b48SJohn Johansen { 510b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 511b5e95b48SJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); 512b5e95b48SJohn Johansen } 513b5e95b48SJohn Johansen 514b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 515b5e95b48SJohn Johansen char **value) 516b5e95b48SJohn Johansen { 517b5e95b48SJohn Johansen int error = -ENOENT; 518b5e95b48SJohn Johansen /* released below */ 519b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 52055a26ebfSJohn Johansen struct aa_task_ctx *ctx = cred_ctx(cred); 521637f688dSJohn Johansen struct aa_label *label = NULL; 522b5e95b48SJohn Johansen 523b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 524637f688dSJohn Johansen label = aa_get_newest_label(ctx->label); 52555a26ebfSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 526637f688dSJohn Johansen label = aa_get_newest_label(ctx->previous); 52755a26ebfSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 528637f688dSJohn Johansen label = aa_get_newest_label(ctx->onexec); 529b5e95b48SJohn Johansen else 530b5e95b48SJohn Johansen error = -EINVAL; 531b5e95b48SJohn Johansen 532637f688dSJohn Johansen if (label) 53376a1d263SJohn Johansen error = aa_getprocattr(label, value); 53477b071b3SJohn Johansen 535637f688dSJohn Johansen aa_put_label(label); 536b5e95b48SJohn Johansen put_cred(cred); 537b5e95b48SJohn Johansen 538b5e95b48SJohn Johansen return error; 539b5e95b48SJohn Johansen } 540b5e95b48SJohn Johansen 541b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 542b21507e2SStephen Smalley size_t size) 543b5e95b48SJohn Johansen { 544e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 545b5e95b48SJohn Johansen size_t arg_size; 546b5e95b48SJohn Johansen int error; 547ef88a7acSJohn Johansen DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR); 548b5e95b48SJohn Johansen 549b5e95b48SJohn Johansen if (size == 0) 550b5e95b48SJohn Johansen return -EINVAL; 551b5e95b48SJohn Johansen 552e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 553e89b8081SVegard Nossum if (args[size - 1] != '\0') { 554e89b8081SVegard Nossum /* null terminate */ 555e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 556e89b8081SVegard Nossum if (!args) 557e89b8081SVegard Nossum return -ENOMEM; 558e89b8081SVegard Nossum memcpy(args, value, size); 559e89b8081SVegard Nossum args[size] = '\0'; 560e89b8081SVegard Nossum } 561e89b8081SVegard Nossum 562e89b8081SVegard Nossum error = -EINVAL; 563b5e95b48SJohn Johansen args = strim(args); 564b5e95b48SJohn Johansen command = strsep(&args, " "); 565b5e95b48SJohn Johansen if (!args) 566e89b8081SVegard Nossum goto out; 567b5e95b48SJohn Johansen args = skip_spaces(args); 568b5e95b48SJohn Johansen if (!*args) 569e89b8081SVegard Nossum goto out; 570b5e95b48SJohn Johansen 571d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 572b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 573b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 574b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 575df8073c6SJohn Johansen AA_CHANGE_NOFLAGS); 576b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 577b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 578df8073c6SJohn Johansen AA_CHANGE_TEST); 579b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 580df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_NOFLAGS); 581b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 582df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_TEST); 583*6c5fc8f1SJohn Johansen } else if (strcmp(command, "stack") == 0) { 584*6c5fc8f1SJohn Johansen error = aa_change_profile(args, AA_CHANGE_STACK); 5853eea57c2SJohn Johansen } else 5863eea57c2SJohn Johansen goto fail; 587b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 5883eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 589df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_ONEXEC); 590*6c5fc8f1SJohn Johansen else if (strcmp(command, "stack") == 0) 591*6c5fc8f1SJohn Johansen error = aa_change_profile(args, (AA_CHANGE_ONEXEC | 592*6c5fc8f1SJohn Johansen AA_CHANGE_STACK)); 5933eea57c2SJohn Johansen else 5943eea57c2SJohn Johansen goto fail; 5953eea57c2SJohn Johansen } else 596b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 597e89b8081SVegard Nossum goto fail; 5983eea57c2SJohn Johansen 599b5e95b48SJohn Johansen if (!error) 600b5e95b48SJohn Johansen error = size; 601e89b8081SVegard Nossum out: 602e89b8081SVegard Nossum kfree(largs); 603b5e95b48SJohn Johansen return error; 6043eea57c2SJohn Johansen 6053eea57c2SJohn Johansen fail: 606637f688dSJohn Johansen aad(&sa)->label = begin_current_label_crit_section(); 607ef88a7acSJohn Johansen aad(&sa)->info = name; 608ef88a7acSJohn Johansen aad(&sa)->error = error = -EINVAL; 6093eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 610637f688dSJohn Johansen end_current_label_crit_section(aad(&sa)->label); 611e89b8081SVegard Nossum goto out; 612b5e95b48SJohn Johansen } 613b5e95b48SJohn Johansen 614fe864821SJohn Johansen /** 615fe864821SJohn Johansen * apparmor_bprm_committing_creds - do task cleanup on committing new creds 616fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 617fe864821SJohn Johansen */ 618fe864821SJohn Johansen static void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 619fe864821SJohn Johansen { 620637f688dSJohn Johansen struct aa_label *label = aa_current_raw_label(); 621fe864821SJohn Johansen struct aa_task_ctx *new_ctx = cred_ctx(bprm->cred); 622fe864821SJohn Johansen 623fe864821SJohn Johansen /* bail out if unconfined or not changing profile */ 624637f688dSJohn Johansen if ((new_ctx->label->proxy == label->proxy) || 625637f688dSJohn Johansen (unconfined(new_ctx->label))) 626fe864821SJohn Johansen return; 627fe864821SJohn Johansen 628192ca6b5SJohn Johansen aa_inherit_files(bprm->cred, current->files); 629192ca6b5SJohn Johansen 630fe864821SJohn Johansen current->pdeath_signal = 0; 631fe864821SJohn Johansen 632637f688dSJohn Johansen /* reset soft limits and set hard limits for the new label */ 63386b92cb7SJohn Johansen __aa_transition_rlimits(label, new_ctx->label); 634fe864821SJohn Johansen } 635fe864821SJohn Johansen 636fe864821SJohn Johansen /** 637fe864821SJohn Johansen * apparmor_bprm_committed_cred - do cleanup after new creds committed 638fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 639fe864821SJohn Johansen */ 640fe864821SJohn Johansen static void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 641fe864821SJohn Johansen { 642fe864821SJohn Johansen /* TODO: cleanup signals - ipc mediation */ 643fe864821SJohn Johansen return; 644fe864821SJohn Johansen } 645fe864821SJohn Johansen 6467cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 6477cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 648b5e95b48SJohn Johansen { 649637f688dSJohn Johansen struct aa_label *label = __begin_current_label_crit_section(); 650b5e95b48SJohn Johansen int error = 0; 651b5e95b48SJohn Johansen 652637f688dSJohn Johansen if (!unconfined(label)) 65386b92cb7SJohn Johansen error = aa_task_setrlimit(label, task, resource, new_rlim); 654637f688dSJohn Johansen __end_current_label_crit_section(label); 655b5e95b48SJohn Johansen 656b5e95b48SJohn Johansen return error; 657b5e95b48SJohn Johansen } 658b5e95b48SJohn Johansen 659ca97d939SJames Morris static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 660e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 661e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 662e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 663e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 664b5e95b48SJohn Johansen 665e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 666e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 667e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 668e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 669e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 670e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 671e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 672e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 673e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 674e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 675e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 676b5e95b48SJohn Johansen 677e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 678064dc947SJohn Johansen LSM_HOOK_INIT(file_receive, apparmor_file_receive), 679e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 680e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 681e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 682e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 683e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 684e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 685b5e95b48SJohn Johansen 686e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 687e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 688b5e95b48SJohn Johansen 689e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 690e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 691e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 692e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 693b5e95b48SJohn Johansen 694e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds), 695e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 696e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 697e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec), 698b5e95b48SJohn Johansen 699e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 700b5e95b48SJohn Johansen }; 701b5e95b48SJohn Johansen 702b5e95b48SJohn Johansen /* 703b5e95b48SJohn Johansen * AppArmor sysfs module parameters 704b5e95b48SJohn Johansen */ 705b5e95b48SJohn Johansen 706101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 707101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 708b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 7099c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 7106a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 711101d6c82SStephen Rothwell .set = param_set_aabool, 712101d6c82SStephen Rothwell .get = param_get_aabool 713101d6c82SStephen Rothwell }; 714b5e95b48SJohn Johansen 715101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 716101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 717b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 7189c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 719101d6c82SStephen Rothwell .set = param_set_aauint, 720101d6c82SStephen Rothwell .get = param_get_aauint 721101d6c82SStephen Rothwell }; 722b5e95b48SJohn Johansen 723101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 724101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 725b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 7269c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 7276a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 728101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 729101d6c82SStephen Rothwell .get = param_get_aalockpolicy 730101d6c82SStephen Rothwell }; 731b5e95b48SJohn Johansen 732b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp); 733b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp); 734b5e95b48SJohn Johansen 735b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp); 736b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp); 737b5e95b48SJohn Johansen 738b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 739b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 740b5e95b48SJohn Johansen */ 741b5e95b48SJohn Johansen 742b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 743b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 744b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 745b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 746b5e95b48SJohn Johansen 7476059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 7487616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 7493ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 7506059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 7517616ac70SArnd Bergmann #endif 7526059f71fSJohn Johansen 753b5e95b48SJohn Johansen /* Debug mode */ 754eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 755b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 756b5e95b48SJohn Johansen 757b5e95b48SJohn Johansen /* Audit mode */ 758b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 759b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 760b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 761b5e95b48SJohn Johansen 762b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 763b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 764b5e95b48SJohn Johansen */ 76590ab5ee9SRusty Russell bool aa_g_audit_header = 1; 766b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 767b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 768b5e95b48SJohn Johansen 769b5e95b48SJohn Johansen /* lock out loading/removal of policy 770b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 771b5e95b48SJohn Johansen * load policy, if lock_policy is set 772b5e95b48SJohn Johansen */ 77390ab5ee9SRusty Russell bool aa_g_lock_policy; 774b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 775b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 776b5e95b48SJohn Johansen 777b5e95b48SJohn Johansen /* Syscall logging mode */ 77890ab5ee9SRusty Russell bool aa_g_logsyscall; 779b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 780b5e95b48SJohn Johansen 781b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 782b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 783622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 784b5e95b48SJohn Johansen 785b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 786b5e95b48SJohn Johansen * on the loaded policy is done. 787abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 788abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 789b5e95b48SJohn Johansen */ 79090ab5ee9SRusty Russell bool aa_g_paranoid_load = 1; 791abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 792b5e95b48SJohn Johansen 793b5e95b48SJohn Johansen /* Boot time disable flag */ 79490ab5ee9SRusty Russell static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE; 795c611616cSJohn Johansen module_param_named(enabled, apparmor_enabled, bool, S_IRUGO); 796b5e95b48SJohn Johansen 797b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 798b5e95b48SJohn Johansen { 799b5e95b48SJohn Johansen unsigned long enabled; 80029707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 801b5e95b48SJohn Johansen if (!error) 802b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 803b5e95b48SJohn Johansen return 1; 804b5e95b48SJohn Johansen } 805b5e95b48SJohn Johansen 806b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 807b5e95b48SJohn Johansen 808b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 809101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 810b5e95b48SJohn Johansen { 811545de8feSJohn Johansen if (!apparmor_enabled) 812545de8feSJohn Johansen return -EINVAL; 813545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 814b5e95b48SJohn Johansen return -EPERM; 815b5e95b48SJohn Johansen return param_set_bool(val, kp); 816b5e95b48SJohn Johansen } 817b5e95b48SJohn Johansen 818101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 819b5e95b48SJohn Johansen { 820ca4bd5aeSJohn Johansen if (!apparmor_enabled) 821ca4bd5aeSJohn Johansen return -EINVAL; 822545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 823545de8feSJohn Johansen return -EPERM; 824b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 825b5e95b48SJohn Johansen } 826b5e95b48SJohn Johansen 827101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 828b5e95b48SJohn Johansen { 829ca4bd5aeSJohn Johansen if (!apparmor_enabled) 830ca4bd5aeSJohn Johansen return -EINVAL; 831545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 832545de8feSJohn Johansen return -EPERM; 833b5e95b48SJohn Johansen return param_set_bool(val, kp); 834b5e95b48SJohn Johansen } 835b5e95b48SJohn Johansen 836101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 837b5e95b48SJohn Johansen { 838ca4bd5aeSJohn Johansen if (!apparmor_enabled) 839ca4bd5aeSJohn Johansen return -EINVAL; 840545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 841545de8feSJohn Johansen return -EPERM; 842b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 843b5e95b48SJohn Johansen } 844b5e95b48SJohn Johansen 845101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 846b5e95b48SJohn Johansen { 84739d84824SJohn Johansen int error; 84839d84824SJohn Johansen 849ca4bd5aeSJohn Johansen if (!apparmor_enabled) 850ca4bd5aeSJohn Johansen return -EINVAL; 85139d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 85239d84824SJohn Johansen if (apparmor_initialized) 853545de8feSJohn Johansen return -EPERM; 85439d84824SJohn Johansen 85539d84824SJohn Johansen error = param_set_uint(val, kp); 85639d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 85739d84824SJohn Johansen 85839d84824SJohn Johansen return error; 859b5e95b48SJohn Johansen } 860b5e95b48SJohn Johansen 861101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 862b5e95b48SJohn Johansen { 863ca4bd5aeSJohn Johansen if (!apparmor_enabled) 864ca4bd5aeSJohn Johansen return -EINVAL; 865545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 866545de8feSJohn Johansen return -EPERM; 867b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 868b5e95b48SJohn Johansen } 869b5e95b48SJohn Johansen 870b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp) 871b5e95b48SJohn Johansen { 872b5e95b48SJohn Johansen if (!apparmor_enabled) 873b5e95b48SJohn Johansen return -EINVAL; 874545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 875545de8feSJohn Johansen return -EPERM; 876b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 877b5e95b48SJohn Johansen } 878b5e95b48SJohn Johansen 879b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp) 880b5e95b48SJohn Johansen { 881b5e95b48SJohn Johansen int i; 882b5e95b48SJohn Johansen 883b5e95b48SJohn Johansen if (!apparmor_enabled) 884b5e95b48SJohn Johansen return -EINVAL; 885b5e95b48SJohn Johansen if (!val) 886b5e95b48SJohn Johansen return -EINVAL; 887545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 888545de8feSJohn Johansen return -EPERM; 889b5e95b48SJohn Johansen 890b5e95b48SJohn Johansen for (i = 0; i < AUDIT_MAX_INDEX; i++) { 891b5e95b48SJohn Johansen if (strcmp(val, audit_mode_names[i]) == 0) { 892b5e95b48SJohn Johansen aa_g_audit = i; 893b5e95b48SJohn Johansen return 0; 894b5e95b48SJohn Johansen } 895b5e95b48SJohn Johansen } 896b5e95b48SJohn Johansen 897b5e95b48SJohn Johansen return -EINVAL; 898b5e95b48SJohn Johansen } 899b5e95b48SJohn Johansen 900b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp) 901b5e95b48SJohn Johansen { 902b5e95b48SJohn Johansen if (!apparmor_enabled) 903b5e95b48SJohn Johansen return -EINVAL; 904545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 905545de8feSJohn Johansen return -EPERM; 906b5e95b48SJohn Johansen 9070d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 908b5e95b48SJohn Johansen } 909b5e95b48SJohn Johansen 910b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp) 911b5e95b48SJohn Johansen { 912b5e95b48SJohn Johansen int i; 913b5e95b48SJohn Johansen 914b5e95b48SJohn Johansen if (!apparmor_enabled) 915b5e95b48SJohn Johansen return -EINVAL; 916b5e95b48SJohn Johansen if (!val) 917b5e95b48SJohn Johansen return -EINVAL; 918545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 919545de8feSJohn Johansen return -EPERM; 920b5e95b48SJohn Johansen 9210d259f04SJohn Johansen for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) { 9220d259f04SJohn Johansen if (strcmp(val, aa_profile_mode_names[i]) == 0) { 923b5e95b48SJohn Johansen aa_g_profile_mode = i; 924b5e95b48SJohn Johansen return 0; 925b5e95b48SJohn Johansen } 926b5e95b48SJohn Johansen } 927b5e95b48SJohn Johansen 928b5e95b48SJohn Johansen return -EINVAL; 929b5e95b48SJohn Johansen } 930b5e95b48SJohn Johansen 931b5e95b48SJohn Johansen /* 932b5e95b48SJohn Johansen * AppArmor init functions 933b5e95b48SJohn Johansen */ 934b5e95b48SJohn Johansen 935b5e95b48SJohn Johansen /** 93655a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 937b5e95b48SJohn Johansen * 938b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 939b5e95b48SJohn Johansen */ 94055a26ebfSJohn Johansen static int __init set_init_ctx(void) 941b5e95b48SJohn Johansen { 942b5e95b48SJohn Johansen struct cred *cred = (struct cred *)current->real_cred; 94355a26ebfSJohn Johansen struct aa_task_ctx *ctx; 944b5e95b48SJohn Johansen 94555a26ebfSJohn Johansen ctx = aa_alloc_task_context(GFP_KERNEL); 94655a26ebfSJohn Johansen if (!ctx) 947b5e95b48SJohn Johansen return -ENOMEM; 948b5e95b48SJohn Johansen 949637f688dSJohn Johansen ctx->label = aa_get_label(ns_unconfined(root_ns)); 95055a26ebfSJohn Johansen cred_ctx(cred) = ctx; 951b5e95b48SJohn Johansen 952b5e95b48SJohn Johansen return 0; 953b5e95b48SJohn Johansen } 954b5e95b48SJohn Johansen 955d4669f0bSJohn Johansen static void destroy_buffers(void) 956d4669f0bSJohn Johansen { 957d4669f0bSJohn Johansen u32 i, j; 958d4669f0bSJohn Johansen 959d4669f0bSJohn Johansen for_each_possible_cpu(i) { 960d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 961d4669f0bSJohn Johansen kfree(per_cpu(aa_buffers, i).buf[j]); 962d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = NULL; 963d4669f0bSJohn Johansen } 964d4669f0bSJohn Johansen } 965d4669f0bSJohn Johansen } 966d4669f0bSJohn Johansen 967d4669f0bSJohn Johansen static int __init alloc_buffers(void) 968d4669f0bSJohn Johansen { 969d4669f0bSJohn Johansen u32 i, j; 970d4669f0bSJohn Johansen 971d4669f0bSJohn Johansen for_each_possible_cpu(i) { 972d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 973d4669f0bSJohn Johansen char *buffer; 974d4669f0bSJohn Johansen 975d4669f0bSJohn Johansen if (cpu_to_node(i) > num_online_nodes()) 976d4669f0bSJohn Johansen /* fallback to kmalloc for offline nodes */ 977d4669f0bSJohn Johansen buffer = kmalloc(aa_g_path_max, GFP_KERNEL); 978d4669f0bSJohn Johansen else 979d4669f0bSJohn Johansen buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL, 980d4669f0bSJohn Johansen cpu_to_node(i)); 981d4669f0bSJohn Johansen if (!buffer) { 982d4669f0bSJohn Johansen destroy_buffers(); 983d4669f0bSJohn Johansen return -ENOMEM; 984d4669f0bSJohn Johansen } 985d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = buffer; 986d4669f0bSJohn Johansen } 987d4669f0bSJohn Johansen } 988d4669f0bSJohn Johansen 989d4669f0bSJohn Johansen return 0; 990d4669f0bSJohn Johansen } 991d4669f0bSJohn Johansen 992e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 993e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 994e3ea1ca5STyler Hicks void __user *buffer, size_t *lenp, loff_t *ppos) 995e3ea1ca5STyler Hicks { 996e3ea1ca5STyler Hicks if (!policy_admin_capable(NULL)) 997e3ea1ca5STyler Hicks return -EPERM; 998e3ea1ca5STyler Hicks if (!apparmor_enabled) 999e3ea1ca5STyler Hicks return -EINVAL; 1000e3ea1ca5STyler Hicks 1001e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 1002e3ea1ca5STyler Hicks } 1003e3ea1ca5STyler Hicks 1004e3ea1ca5STyler Hicks static struct ctl_path apparmor_sysctl_path[] = { 1005e3ea1ca5STyler Hicks { .procname = "kernel", }, 1006e3ea1ca5STyler Hicks { } 1007e3ea1ca5STyler Hicks }; 1008e3ea1ca5STyler Hicks 1009e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 1010e3ea1ca5STyler Hicks { 1011e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 1012e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 1013e3ea1ca5STyler Hicks .maxlen = sizeof(int), 1014e3ea1ca5STyler Hicks .mode = 0600, 1015e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 1016e3ea1ca5STyler Hicks }, 1017e3ea1ca5STyler Hicks { } 1018e3ea1ca5STyler Hicks }; 1019e3ea1ca5STyler Hicks 1020e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 1021e3ea1ca5STyler Hicks { 1022e3ea1ca5STyler Hicks return register_sysctl_paths(apparmor_sysctl_path, 1023e3ea1ca5STyler Hicks apparmor_sysctl_table) ? 0 : -ENOMEM; 1024e3ea1ca5STyler Hicks } 1025e3ea1ca5STyler Hicks #else 1026e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 1027e3ea1ca5STyler Hicks { 1028e3ea1ca5STyler Hicks return 0; 1029e3ea1ca5STyler Hicks } 1030e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 1031e3ea1ca5STyler Hicks 1032b5e95b48SJohn Johansen static int __init apparmor_init(void) 1033b5e95b48SJohn Johansen { 1034b5e95b48SJohn Johansen int error; 1035b5e95b48SJohn Johansen 1036b1d9e6b0SCasey Schaufler if (!apparmor_enabled || !security_module_enable("apparmor")) { 1037b5e95b48SJohn Johansen aa_info_message("AppArmor disabled by boot time parameter"); 1038b5e95b48SJohn Johansen apparmor_enabled = 0; 1039b5e95b48SJohn Johansen return 0; 1040b5e95b48SJohn Johansen } 1041b5e95b48SJohn Johansen 104211c236b8SJohn Johansen error = aa_setup_dfa_engine(); 104311c236b8SJohn Johansen if (error) { 104411c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 104511c236b8SJohn Johansen goto alloc_out; 104611c236b8SJohn Johansen } 104711c236b8SJohn Johansen 1048b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 1049b5e95b48SJohn Johansen if (error) { 1050b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 1051b5e95b48SJohn Johansen goto alloc_out; 1052b5e95b48SJohn Johansen } 1053b5e95b48SJohn Johansen 1054e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 1055e3ea1ca5STyler Hicks if (error) { 1056e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 1057e3ea1ca5STyler Hicks goto alloc_out; 1058e3ea1ca5STyler Hicks 1059e3ea1ca5STyler Hicks } 1060e3ea1ca5STyler Hicks 1061d4669f0bSJohn Johansen error = alloc_buffers(); 1062d4669f0bSJohn Johansen if (error) { 1063d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 1064d4669f0bSJohn Johansen goto buffers_out; 1065d4669f0bSJohn Johansen } 1066d4669f0bSJohn Johansen 106755a26ebfSJohn Johansen error = set_init_ctx(); 1068b5e95b48SJohn Johansen if (error) { 1069b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1070b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1071d4669f0bSJohn Johansen goto buffers_out; 1072b5e95b48SJohn Johansen } 1073d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1074d69dece5SCasey Schaufler "apparmor"); 1075b5e95b48SJohn Johansen 1076b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1077b5e95b48SJohn Johansen apparmor_initialized = 1; 1078b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1079b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1080b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1081b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1082b5e95b48SJohn Johansen else 1083b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1084b5e95b48SJohn Johansen 1085b5e95b48SJohn Johansen return error; 1086b5e95b48SJohn Johansen 1087d4669f0bSJohn Johansen buffers_out: 1088d4669f0bSJohn Johansen destroy_buffers(); 1089d4669f0bSJohn Johansen 1090b5e95b48SJohn Johansen alloc_out: 1091b5e95b48SJohn Johansen aa_destroy_aafs(); 109211c236b8SJohn Johansen aa_teardown_dfa_engine(); 1093b5e95b48SJohn Johansen 1094b5e95b48SJohn Johansen apparmor_enabled = 0; 1095b5e95b48SJohn Johansen return error; 1096b5e95b48SJohn Johansen } 1097b5e95b48SJohn Johansen 1098b5e95b48SJohn Johansen security_initcall(apparmor_init); 1099