1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only 2b5e95b48SJohn Johansen /* 3b5e95b48SJohn Johansen * AppArmor security module 4b5e95b48SJohn Johansen * 5b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 6b5e95b48SJohn Johansen * 7b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 8b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 9b5e95b48SJohn Johansen */ 10b5e95b48SJohn Johansen 113c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 12b5e95b48SJohn Johansen #include <linux/moduleparam.h> 13b5e95b48SJohn Johansen #include <linux/mm.h> 14b5e95b48SJohn Johansen #include <linux/mman.h> 15b5e95b48SJohn Johansen #include <linux/mount.h> 16b5e95b48SJohn Johansen #include <linux/namei.h> 17b5e95b48SJohn Johansen #include <linux/ptrace.h> 18b5e95b48SJohn Johansen #include <linux/ctype.h> 19b5e95b48SJohn Johansen #include <linux/sysctl.h> 20b5e95b48SJohn Johansen #include <linux/audit.h> 213486740aSSerge E. Hallyn #include <linux/user_namespace.h> 22ab9f2115SMatthew Garrett #include <linux/netfilter_ipv4.h> 23ab9f2115SMatthew Garrett #include <linux/netfilter_ipv6.h> 24f4d6b94bSJon Tourville #include <linux/zstd.h> 25b5e95b48SJohn Johansen #include <net/sock.h> 26e262e32dSDavid Howells #include <uapi/linux/mount.h> 27b5e95b48SJohn Johansen 28b5e95b48SJohn Johansen #include "include/apparmor.h" 29b5e95b48SJohn Johansen #include "include/apparmorfs.h" 30b5e95b48SJohn Johansen #include "include/audit.h" 31b5e95b48SJohn Johansen #include "include/capability.h" 32d8889d49SJohn Johansen #include "include/cred.h" 33b5e95b48SJohn Johansen #include "include/file.h" 34b5e95b48SJohn Johansen #include "include/ipc.h" 3556974a6fSJohn Johansen #include "include/net.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37637f688dSJohn Johansen #include "include/label.h" 38b5e95b48SJohn Johansen #include "include/policy.h" 39cff281f6SJohn Johansen #include "include/policy_ns.h" 40b5e95b48SJohn Johansen #include "include/procattr.h" 412ea3ffb7SJohn Johansen #include "include/mount.h" 42c0929212SJohn Johansen #include "include/secid.h" 43b5e95b48SJohn Johansen 44b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 45545de8feSJohn Johansen int apparmor_initialized; 46b5e95b48SJohn Johansen 47df323337SSebastian Andrzej Siewior union aa_buffer { 48df323337SSebastian Andrzej Siewior struct list_head list; 49ba808cb5SKees Cook DECLARE_FLEX_ARRAY(char, buffer); 50df323337SSebastian Andrzej Siewior }; 51d4669f0bSJohn Johansen 52341c1fdaSJohn Johansen #define RESERVE_COUNT 2 53341c1fdaSJohn Johansen static int reserve_count = RESERVE_COUNT; 54341c1fdaSJohn Johansen static int buffer_count; 55341c1fdaSJohn Johansen 56df323337SSebastian Andrzej Siewior static LIST_HEAD(aa_global_buffers); 57df323337SSebastian Andrzej Siewior static DEFINE_SPINLOCK(aa_buffers_lock); 58d4669f0bSJohn Johansen 59b5e95b48SJohn Johansen /* 60b5e95b48SJohn Johansen * LSM hook functions 61b5e95b48SJohn Johansen */ 62b5e95b48SJohn Johansen 63b5e95b48SJohn Johansen /* 64d9087c49SJohn Johansen * put the associated labels 65b5e95b48SJohn Johansen */ 66b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 67b5e95b48SJohn Johansen { 68d9087c49SJohn Johansen aa_put_label(cred_label(cred)); 6969b5a44aSCasey Schaufler set_cred_label(cred, NULL); 70b5e95b48SJohn Johansen } 71b5e95b48SJohn Johansen 72b5e95b48SJohn Johansen /* 73b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 74b5e95b48SJohn Johansen */ 75b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 76b5e95b48SJohn Johansen { 7769b5a44aSCasey Schaufler set_cred_label(cred, NULL); 78b5e95b48SJohn Johansen return 0; 79b5e95b48SJohn Johansen } 80b5e95b48SJohn Johansen 81b5e95b48SJohn Johansen /* 82d9087c49SJohn Johansen * prepare new cred label for modification by prepare_cred block 83b5e95b48SJohn Johansen */ 84b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 85b5e95b48SJohn Johansen gfp_t gfp) 86b5e95b48SJohn Johansen { 8769b5a44aSCasey Schaufler set_cred_label(new, aa_get_newest_label(cred_label(old))); 88b5e95b48SJohn Johansen return 0; 89b5e95b48SJohn Johansen } 90b5e95b48SJohn Johansen 91b5e95b48SJohn Johansen /* 92b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 93b5e95b48SJohn Johansen */ 94b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 95b5e95b48SJohn Johansen { 9669b5a44aSCasey Schaufler set_cred_label(new, aa_get_newest_label(cred_label(old))); 97b5e95b48SJohn Johansen } 98b5e95b48SJohn Johansen 993b529a76SJohn Johansen static void apparmor_task_free(struct task_struct *task) 1003b529a76SJohn Johansen { 1013b529a76SJohn Johansen 1023b529a76SJohn Johansen aa_free_task_ctx(task_ctx(task)); 1033b529a76SJohn Johansen } 1043b529a76SJohn Johansen 1053b529a76SJohn Johansen static int apparmor_task_alloc(struct task_struct *task, 1063b529a76SJohn Johansen unsigned long clone_flags) 1073b529a76SJohn Johansen { 108f4ad8f2cSCasey Schaufler struct aa_task_ctx *new = task_ctx(task); 1093b529a76SJohn Johansen 110de62de59SJohn Johansen aa_dup_task_ctx(new, task_ctx(current)); 1113b529a76SJohn Johansen 1123b529a76SJohn Johansen return 0; 113b5e95b48SJohn Johansen } 114b5e95b48SJohn Johansen 115b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 116b5e95b48SJohn Johansen unsigned int mode) 117b5e95b48SJohn Johansen { 118b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 119690f33e1SJohn Johansen const struct cred *cred; 120b2d09ae4SJohn Johansen int error; 121b2d09ae4SJohn Johansen 122690f33e1SJohn Johansen cred = get_task_cred(child); 123690f33e1SJohn Johansen tracee = cred_label(cred); /* ref count on cred */ 1241f8266ffSJann Horn tracer = __begin_current_label_crit_section(); 125690f33e1SJohn Johansen error = aa_may_ptrace(current_cred(), tracer, cred, tracee, 126338d0be4SJohn Johansen (mode & PTRACE_MODE_READ) ? AA_PTRACE_READ 127338d0be4SJohn Johansen : AA_PTRACE_TRACE); 1281f8266ffSJann Horn __end_current_label_crit_section(tracer); 129690f33e1SJohn Johansen put_cred(cred); 130b2d09ae4SJohn Johansen 131b2d09ae4SJohn Johansen return error; 132b5e95b48SJohn Johansen } 133b5e95b48SJohn Johansen 134b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 135b5e95b48SJohn Johansen { 136b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 137690f33e1SJohn Johansen const struct cred *cred; 138b2d09ae4SJohn Johansen int error; 139b2d09ae4SJohn Johansen 140ca3fde52SJann Horn tracee = __begin_current_label_crit_section(); 141690f33e1SJohn Johansen cred = get_task_cred(parent); 142690f33e1SJohn Johansen tracer = cred_label(cred); /* ref count on cred */ 143690f33e1SJohn Johansen error = aa_may_ptrace(cred, tracer, current_cred(), tracee, 144690f33e1SJohn Johansen AA_PTRACE_TRACE); 145690f33e1SJohn Johansen put_cred(cred); 146ca3fde52SJann Horn __end_current_label_crit_section(tracee); 147b2d09ae4SJohn Johansen 148b2d09ae4SJohn Johansen return error; 149b5e95b48SJohn Johansen } 150b5e95b48SJohn Johansen 151b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 1526672efbbSKhadija Kamran static int apparmor_capget(const struct task_struct *target, kernel_cap_t *effective, 153b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 154b5e95b48SJohn Johansen { 155637f688dSJohn Johansen struct aa_label *label; 156b5e95b48SJohn Johansen const struct cred *cred; 157b5e95b48SJohn Johansen 158b5e95b48SJohn Johansen rcu_read_lock(); 159b5e95b48SJohn Johansen cred = __task_cred(target); 160637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 161c70c86c4SJohn Johansen 162b1d9e6b0SCasey Schaufler /* 163b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 164b1d9e6b0SCasey Schaufler * initialize effective and permitted. 165b1d9e6b0SCasey Schaufler */ 166c70c86c4SJohn Johansen if (!unconfined(label)) { 167c70c86c4SJohn Johansen struct aa_profile *profile; 168c70c86c4SJohn Johansen struct label_it i; 169c70c86c4SJohn Johansen 170c70c86c4SJohn Johansen label_for_each_confined(i, label, profile) { 1711ad22fccSJohn Johansen struct aa_ruleset *rules; 172c70c86c4SJohn Johansen if (COMPLAIN_MODE(profile)) 173c70c86c4SJohn Johansen continue; 1741ad22fccSJohn Johansen rules = list_first_entry(&profile->rules, 1751ad22fccSJohn Johansen typeof(*rules), list); 176c70c86c4SJohn Johansen *effective = cap_intersect(*effective, 1771ad22fccSJohn Johansen rules->caps.allow); 178c70c86c4SJohn Johansen *permitted = cap_intersect(*permitted, 1791ad22fccSJohn Johansen rules->caps.allow); 180c70c86c4SJohn Johansen } 181b5e95b48SJohn Johansen } 182b5e95b48SJohn Johansen rcu_read_unlock(); 183637f688dSJohn Johansen aa_put_label(label); 184b5e95b48SJohn Johansen 185b5e95b48SJohn Johansen return 0; 186b5e95b48SJohn Johansen } 187b5e95b48SJohn Johansen 1886a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 189c1a85a00SMicah Morton int cap, unsigned int opts) 190b5e95b48SJohn Johansen { 191637f688dSJohn Johansen struct aa_label *label; 192b1d9e6b0SCasey Schaufler int error = 0; 193b1d9e6b0SCasey Schaufler 194637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 195637f688dSJohn Johansen if (!unconfined(label)) 196690f33e1SJohn Johansen error = aa_capable(cred, label, cap, opts); 197637f688dSJohn Johansen aa_put_label(label); 198cf797c0eSJohn Johansen 199b5e95b48SJohn Johansen return error; 200b5e95b48SJohn Johansen } 201b5e95b48SJohn Johansen 202b5e95b48SJohn Johansen /** 203b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 204b5e95b48SJohn Johansen * @op: operation being checked 205b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 206b5e95b48SJohn Johansen * @mask: requested permissions mask 207b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 208b5e95b48SJohn Johansen * 209b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 210b5e95b48SJohn Johansen */ 21147f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 212b5e95b48SJohn Johansen struct path_cond *cond) 213b5e95b48SJohn Johansen { 214637f688dSJohn Johansen struct aa_label *label; 215b5e95b48SJohn Johansen int error = 0; 216b5e95b48SJohn Johansen 217637f688dSJohn Johansen label = __begin_current_label_crit_section(); 218637f688dSJohn Johansen if (!unconfined(label)) 219690f33e1SJohn Johansen error = aa_path_perm(op, current_cred(), label, path, 0, mask, 220690f33e1SJohn Johansen cond); 221637f688dSJohn Johansen __end_current_label_crit_section(label); 222b5e95b48SJohn Johansen 223b5e95b48SJohn Johansen return error; 224b5e95b48SJohn Johansen } 225b5e95b48SJohn Johansen 226b5e95b48SJohn Johansen /** 22731f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 22831f75bfeSJohn Johansen * @op: operation being checked 22931f75bfeSJohn Johansen * @path: location to check (NOT NULL) 23031f75bfeSJohn Johansen * @mask: requested permissions mask 23131f75bfeSJohn Johansen * 23231f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 23331f75bfeSJohn Johansen */ 23431f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 23531f75bfeSJohn Johansen { 236e67fe633SChristian Brauner vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_idmap(path->mnt), 2375e26a01eSChristian Brauner d_backing_inode(path->dentry)); 2383cee6079SChristian Brauner struct path_cond cond = { 2395e26a01eSChristian Brauner vfsuid_into_kuid(vfsuid), 24031f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 24131f75bfeSJohn Johansen }; 24231f75bfeSJohn Johansen 24331f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 24431f75bfeSJohn Johansen return 0; 24531f75bfeSJohn Johansen 24631f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 24731f75bfeSJohn Johansen } 24831f75bfeSJohn Johansen 24931f75bfeSJohn Johansen /** 250b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 251b5e95b48SJohn Johansen * @op: operation being checked 252b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 253b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 254b5e95b48SJohn Johansen * @mask: requested permissions mask 255b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 256b5e95b48SJohn Johansen * 257b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 258b5e95b48SJohn Johansen */ 25947f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 260b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 261b5e95b48SJohn Johansen struct path_cond *cond) 262b5e95b48SJohn Johansen { 2638486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 264b5e95b48SJohn Johansen 265b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 266b5e95b48SJohn Johansen } 267b5e95b48SJohn Johansen 268b5e95b48SJohn Johansen /** 269b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 270b5e95b48SJohn Johansen * @op: operation being checked 271b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 272b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 273b5e95b48SJohn Johansen * @mask: requested permission mask 274b5e95b48SJohn Johansen * 275b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 276b5e95b48SJohn Johansen */ 27747f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 278b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 279b5e95b48SJohn Johansen { 280c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 281b5e95b48SJohn Johansen struct path_cond cond = { }; 2825e26a01eSChristian Brauner vfsuid_t vfsuid; 283b5e95b48SJohn Johansen 284efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 285b5e95b48SJohn Johansen return 0; 286b5e95b48SJohn Johansen 287e67fe633SChristian Brauner vfsuid = i_uid_into_vfsuid(mnt_idmap(dir->mnt), inode); 2885e26a01eSChristian Brauner cond.uid = vfsuid_into_kuid(vfsuid); 289b5e95b48SJohn Johansen cond.mode = inode->i_mode; 290b5e95b48SJohn Johansen 291b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 292b5e95b48SJohn Johansen } 293b5e95b48SJohn Johansen 294b5e95b48SJohn Johansen /** 295b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 296b5e95b48SJohn Johansen * @op: operation being checked 297b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 298b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 299b5e95b48SJohn Johansen * @mask: request permission mask 300b5e95b48SJohn Johansen * @mode: created file mode 301b5e95b48SJohn Johansen * 302b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 303b5e95b48SJohn Johansen */ 30447f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 305d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 306b5e95b48SJohn Johansen { 307b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 308b5e95b48SJohn Johansen 309efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 310b5e95b48SJohn Johansen return 0; 311b5e95b48SJohn Johansen 312b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 313b5e95b48SJohn Johansen } 314b5e95b48SJohn Johansen 315989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 316b5e95b48SJohn Johansen { 317b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 318b5e95b48SJohn Johansen } 319b5e95b48SJohn Johansen 320d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 3214572befeSAl Viro umode_t mode) 322b5e95b48SJohn Johansen { 323b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 324b5e95b48SJohn Johansen S_IFDIR); 325b5e95b48SJohn Johansen } 326b5e95b48SJohn Johansen 327989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 328b5e95b48SJohn Johansen { 329b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 330b5e95b48SJohn Johansen } 331b5e95b48SJohn Johansen 332d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 33304fc66e7SAl Viro umode_t mode, unsigned int dev) 334b5e95b48SJohn Johansen { 335b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 336b5e95b48SJohn Johansen } 337b5e95b48SJohn Johansen 33881f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 339b5e95b48SJohn Johansen { 340e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 341b5e95b48SJohn Johansen } 342b5e95b48SJohn Johansen 3433350607dSGünther Noack static int apparmor_file_truncate(struct file *file) 3443350607dSGünther Noack { 3453350607dSGünther Noack return apparmor_path_truncate(&file->f_path); 3463350607dSGünther Noack } 3473350607dSGünther Noack 348d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 349b5e95b48SJohn Johansen const char *old_name) 350b5e95b48SJohn Johansen { 351b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 352b5e95b48SJohn Johansen S_IFLNK); 353b5e95b48SJohn Johansen } 354b5e95b48SJohn Johansen 3553ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 356b5e95b48SJohn Johansen struct dentry *new_dentry) 357b5e95b48SJohn Johansen { 358637f688dSJohn Johansen struct aa_label *label; 359b5e95b48SJohn Johansen int error = 0; 360b5e95b48SJohn Johansen 361efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 362b5e95b48SJohn Johansen return 0; 363b5e95b48SJohn Johansen 364637f688dSJohn Johansen label = begin_current_label_crit_section(); 365637f688dSJohn Johansen if (!unconfined(label)) 366690f33e1SJohn Johansen error = aa_path_link(current_cred(), label, old_dentry, new_dir, 367690f33e1SJohn Johansen new_dentry); 368637f688dSJohn Johansen end_current_label_crit_section(label); 369cf797c0eSJohn Johansen 370b5e95b48SJohn Johansen return error; 371b5e95b48SJohn Johansen } 372b5e95b48SJohn Johansen 3733ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 374100f59d9SMickaël Salaün const struct path *new_dir, struct dentry *new_dentry, 375100f59d9SMickaël Salaün const unsigned int flags) 376b5e95b48SJohn Johansen { 377637f688dSJohn Johansen struct aa_label *label; 378b5e95b48SJohn Johansen int error = 0; 379b5e95b48SJohn Johansen 380efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 381b5e95b48SJohn Johansen return 0; 382100f59d9SMickaël Salaün if ((flags & RENAME_EXCHANGE) && !path_mediated_fs(new_dentry)) 383100f59d9SMickaël Salaün return 0; 384b5e95b48SJohn Johansen 385637f688dSJohn Johansen label = begin_current_label_crit_section(); 386637f688dSJohn Johansen if (!unconfined(label)) { 387e67fe633SChristian Brauner struct mnt_idmap *idmap = mnt_idmap(old_dir->mnt); 3885e26a01eSChristian Brauner vfsuid_t vfsuid; 3898486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3908486adf0SKees Cook .dentry = old_dentry }; 3918486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3928486adf0SKees Cook .dentry = new_dentry }; 3933cee6079SChristian Brauner struct path_cond cond = { 3945e26a01eSChristian Brauner .mode = d_backing_inode(old_dentry)->i_mode 395b5e95b48SJohn Johansen }; 396e67fe633SChristian Brauner vfsuid = i_uid_into_vfsuid(idmap, d_backing_inode(old_dentry)); 3975e26a01eSChristian Brauner cond.uid = vfsuid_into_kuid(vfsuid); 398b5e95b48SJohn Johansen 399100f59d9SMickaël Salaün if (flags & RENAME_EXCHANGE) { 400100f59d9SMickaël Salaün struct path_cond cond_exchange = { 4015e26a01eSChristian Brauner .mode = d_backing_inode(new_dentry)->i_mode, 402100f59d9SMickaël Salaün }; 403e67fe633SChristian Brauner vfsuid = i_uid_into_vfsuid(idmap, d_backing_inode(old_dentry)); 4045e26a01eSChristian Brauner cond_exchange.uid = vfsuid_into_kuid(vfsuid); 405100f59d9SMickaël Salaün 406690f33e1SJohn Johansen error = aa_path_perm(OP_RENAME_SRC, current_cred(), 407690f33e1SJohn Johansen label, &new_path, 0, 408100f59d9SMickaël Salaün MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 409100f59d9SMickaël Salaün AA_MAY_SETATTR | AA_MAY_DELETE, 410100f59d9SMickaël Salaün &cond_exchange); 411100f59d9SMickaël Salaün if (!error) 412690f33e1SJohn Johansen error = aa_path_perm(OP_RENAME_DEST, current_cred(), 413690f33e1SJohn Johansen label, &old_path, 414100f59d9SMickaël Salaün 0, MAY_WRITE | AA_MAY_SETATTR | 415100f59d9SMickaël Salaün AA_MAY_CREATE, &cond_exchange); 416100f59d9SMickaël Salaün } 417100f59d9SMickaël Salaün 418100f59d9SMickaël Salaün if (!error) 419690f33e1SJohn Johansen error = aa_path_perm(OP_RENAME_SRC, current_cred(), 420690f33e1SJohn Johansen label, &old_path, 0, 421e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 422e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 423b5e95b48SJohn Johansen &cond); 424b5e95b48SJohn Johansen if (!error) 425690f33e1SJohn Johansen error = aa_path_perm(OP_RENAME_DEST, current_cred(), 426690f33e1SJohn Johansen label, &new_path, 427e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 428b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 429b5e95b48SJohn Johansen 430b5e95b48SJohn Johansen } 431637f688dSJohn Johansen end_current_label_crit_section(label); 432cf797c0eSJohn Johansen 433b5e95b48SJohn Johansen return error; 434b5e95b48SJohn Johansen } 435b5e95b48SJohn Johansen 436be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 437b5e95b48SJohn Johansen { 43831f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 439b5e95b48SJohn Johansen } 440b5e95b48SJohn Johansen 4417fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 442b5e95b48SJohn Johansen { 44331f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 444b5e95b48SJohn Johansen } 445b5e95b48SJohn Johansen 4463f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 447b5e95b48SJohn Johansen { 448e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 449b5e95b48SJohn Johansen } 450b5e95b48SJohn Johansen 45194817692SAl Viro static int apparmor_file_open(struct file *file) 452b5e95b48SJohn Johansen { 453637f688dSJohn Johansen struct aa_file_ctx *fctx = file_ctx(file); 454637f688dSJohn Johansen struct aa_label *label; 455b5e95b48SJohn Johansen int error = 0; 456b5e95b48SJohn Johansen 457efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 458b5e95b48SJohn Johansen return 0; 459b5e95b48SJohn Johansen 460b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 461b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 462b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 463b5e95b48SJohn Johansen * actually execute the image. 464b5e95b48SJohn Johansen */ 465b5e95b48SJohn Johansen if (current->in_execve) { 46655a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 467b5e95b48SJohn Johansen return 0; 468b5e95b48SJohn Johansen } 469b5e95b48SJohn Johansen 47094817692SAl Viro label = aa_get_newest_cred_label(file->f_cred); 471637f688dSJohn Johansen if (!unconfined(label)) { 472e67fe633SChristian Brauner struct mnt_idmap *idmap = file_mnt_idmap(file); 473496ad9aaSAl Viro struct inode *inode = file_inode(file); 4745e26a01eSChristian Brauner vfsuid_t vfsuid; 4753cee6079SChristian Brauner struct path_cond cond = { 4765e26a01eSChristian Brauner .mode = inode->i_mode, 4773cee6079SChristian Brauner }; 478e67fe633SChristian Brauner vfsuid = i_uid_into_vfsuid(idmap, inode); 4795e26a01eSChristian Brauner cond.uid = vfsuid_into_kuid(vfsuid); 480b5e95b48SJohn Johansen 481690f33e1SJohn Johansen error = aa_path_perm(OP_OPEN, file->f_cred, 482690f33e1SJohn Johansen label, &file->f_path, 0, 483b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 484b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 48555a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 486b5e95b48SJohn Johansen } 487637f688dSJohn Johansen aa_put_label(label); 488b5e95b48SJohn Johansen 489b5e95b48SJohn Johansen return error; 490b5e95b48SJohn Johansen } 491b5e95b48SJohn Johansen 492b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 493b5e95b48SJohn Johansen { 49433bf60caSCasey Schaufler struct aa_file_ctx *ctx = file_ctx(file); 495637f688dSJohn Johansen struct aa_label *label = begin_current_label_crit_section(); 496b5e95b48SJohn Johansen 49733bf60caSCasey Schaufler spin_lock_init(&ctx->lock); 49833bf60caSCasey Schaufler rcu_assign_pointer(ctx->label, aa_get_label(label)); 49933bf60caSCasey Schaufler end_current_label_crit_section(label); 50033bf60caSCasey Schaufler return 0; 501b5e95b48SJohn Johansen } 502b5e95b48SJohn Johansen 503b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 504b5e95b48SJohn Johansen { 50533bf60caSCasey Schaufler struct aa_file_ctx *ctx = file_ctx(file); 50633bf60caSCasey Schaufler 50733bf60caSCasey Schaufler if (ctx) 50833bf60caSCasey Schaufler aa_put_label(rcu_access_pointer(ctx->label)); 509b5e95b48SJohn Johansen } 510b5e95b48SJohn Johansen 511341c1fdaSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask, 512341c1fdaSJohn Johansen bool in_atomic) 513b5e95b48SJohn Johansen { 514190a9518SJohn Johansen struct aa_label *label; 515b5e95b48SJohn Johansen int error = 0; 516b5e95b48SJohn Johansen 517192ca6b5SJohn Johansen /* don't reaudit files closed during inheritance */ 518192ca6b5SJohn Johansen if (file->f_path.dentry == aa_null.dentry) 519192ca6b5SJohn Johansen return -EACCES; 520192ca6b5SJohn Johansen 521637f688dSJohn Johansen label = __begin_current_label_crit_section(); 522690f33e1SJohn Johansen error = aa_file_perm(op, current_cred(), label, file, mask, in_atomic); 523637f688dSJohn Johansen __end_current_label_crit_section(label); 524b5e95b48SJohn Johansen 525b5e95b48SJohn Johansen return error; 526b5e95b48SJohn Johansen } 527b5e95b48SJohn Johansen 528064dc947SJohn Johansen static int apparmor_file_receive(struct file *file) 529064dc947SJohn Johansen { 530341c1fdaSJohn Johansen return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file), 531341c1fdaSJohn Johansen false); 532064dc947SJohn Johansen } 533064dc947SJohn Johansen 534b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 535b5e95b48SJohn Johansen { 536341c1fdaSJohn Johansen return common_file_perm(OP_FPERM, file, mask, false); 537b5e95b48SJohn Johansen } 538b5e95b48SJohn Johansen 539b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 540b5e95b48SJohn Johansen { 541b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 542b5e95b48SJohn Johansen 543b5e95b48SJohn Johansen if (cmd == F_WRLCK) 544b5e95b48SJohn Johansen mask |= MAY_WRITE; 545b5e95b48SJohn Johansen 546341c1fdaSJohn Johansen return common_file_perm(OP_FLOCK, file, mask, false); 547b5e95b48SJohn Johansen } 548b5e95b48SJohn Johansen 54947f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 550341c1fdaSJohn Johansen unsigned long flags, bool in_atomic) 551b5e95b48SJohn Johansen { 552b5e95b48SJohn Johansen int mask = 0; 553b5e95b48SJohn Johansen 554637f688dSJohn Johansen if (!file || !file_ctx(file)) 555b5e95b48SJohn Johansen return 0; 556b5e95b48SJohn Johansen 557b5e95b48SJohn Johansen if (prot & PROT_READ) 558b5e95b48SJohn Johansen mask |= MAY_READ; 559b5e95b48SJohn Johansen /* 560b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 561b5e95b48SJohn Johansen * write back to the files 562b5e95b48SJohn Johansen */ 563b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 564b5e95b48SJohn Johansen mask |= MAY_WRITE; 565b5e95b48SJohn Johansen if (prot & PROT_EXEC) 566b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 567b5e95b48SJohn Johansen 568341c1fdaSJohn Johansen return common_file_perm(op, file, mask, in_atomic); 569b5e95b48SJohn Johansen } 570b5e95b48SJohn Johansen 571e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 572e5467859SAl Viro unsigned long prot, unsigned long flags) 573b5e95b48SJohn Johansen { 574341c1fdaSJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags, GFP_ATOMIC); 575b5e95b48SJohn Johansen } 576b5e95b48SJohn Johansen 577b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 578b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 579b5e95b48SJohn Johansen { 580b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 581341c1fdaSJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0, 582341c1fdaSJohn Johansen false); 583b5e95b48SJohn Johansen } 584b5e95b48SJohn Johansen 5852ea3ffb7SJohn Johansen static int apparmor_sb_mount(const char *dev_name, const struct path *path, 5862ea3ffb7SJohn Johansen const char *type, unsigned long flags, void *data) 5872ea3ffb7SJohn Johansen { 5882ea3ffb7SJohn Johansen struct aa_label *label; 5892ea3ffb7SJohn Johansen int error = 0; 5902ea3ffb7SJohn Johansen 5912ea3ffb7SJohn Johansen /* Discard magic */ 5922ea3ffb7SJohn Johansen if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 5932ea3ffb7SJohn Johansen flags &= ~MS_MGC_MSK; 5942ea3ffb7SJohn Johansen 5952ea3ffb7SJohn Johansen flags &= ~AA_MS_IGNORE_MASK; 5962ea3ffb7SJohn Johansen 5972ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5982ea3ffb7SJohn Johansen if (!unconfined(label)) { 5992ea3ffb7SJohn Johansen if (flags & MS_REMOUNT) 600690f33e1SJohn Johansen error = aa_remount(current_cred(), label, path, flags, 601690f33e1SJohn Johansen data); 6022ea3ffb7SJohn Johansen else if (flags & MS_BIND) 603690f33e1SJohn Johansen error = aa_bind_mount(current_cred(), label, path, 604690f33e1SJohn Johansen dev_name, flags); 6052ea3ffb7SJohn Johansen else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | 6062ea3ffb7SJohn Johansen MS_UNBINDABLE)) 607690f33e1SJohn Johansen error = aa_mount_change_type(current_cred(), label, 608690f33e1SJohn Johansen path, flags); 6092ea3ffb7SJohn Johansen else if (flags & MS_MOVE) 610*96af4515SJohn Johansen error = aa_move_mount_old(current_cred(), label, path, 611690f33e1SJohn Johansen dev_name); 6122ea3ffb7SJohn Johansen else 613690f33e1SJohn Johansen error = aa_new_mount(current_cred(), label, dev_name, 614690f33e1SJohn Johansen path, type, flags, data); 6152ea3ffb7SJohn Johansen } 6162ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 6172ea3ffb7SJohn Johansen 6182ea3ffb7SJohn Johansen return error; 6192ea3ffb7SJohn Johansen } 6202ea3ffb7SJohn Johansen 621*96af4515SJohn Johansen static int apparmor_move_mount(const struct path *from_path, 622*96af4515SJohn Johansen const struct path *to_path) 623*96af4515SJohn Johansen { 624*96af4515SJohn Johansen struct aa_label *label; 625*96af4515SJohn Johansen int error = 0; 626*96af4515SJohn Johansen 627*96af4515SJohn Johansen label = __begin_current_label_crit_section(); 628*96af4515SJohn Johansen if (!unconfined(label)) 629*96af4515SJohn Johansen error = aa_move_mount(current_cred(), label, from_path, 630*96af4515SJohn Johansen to_path); 631*96af4515SJohn Johansen __end_current_label_crit_section(label); 632*96af4515SJohn Johansen 633*96af4515SJohn Johansen return error; 634*96af4515SJohn Johansen } 635*96af4515SJohn Johansen 6362ea3ffb7SJohn Johansen static int apparmor_sb_umount(struct vfsmount *mnt, int flags) 6372ea3ffb7SJohn Johansen { 6382ea3ffb7SJohn Johansen struct aa_label *label; 6392ea3ffb7SJohn Johansen int error = 0; 6402ea3ffb7SJohn Johansen 6412ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 6422ea3ffb7SJohn Johansen if (!unconfined(label)) 643690f33e1SJohn Johansen error = aa_umount(current_cred(), label, mnt, flags); 6442ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 6452ea3ffb7SJohn Johansen 6462ea3ffb7SJohn Johansen return error; 6472ea3ffb7SJohn Johansen } 6482ea3ffb7SJohn Johansen 6492ea3ffb7SJohn Johansen static int apparmor_sb_pivotroot(const struct path *old_path, 6502ea3ffb7SJohn Johansen const struct path *new_path) 6512ea3ffb7SJohn Johansen { 6522ea3ffb7SJohn Johansen struct aa_label *label; 6532ea3ffb7SJohn Johansen int error = 0; 6542ea3ffb7SJohn Johansen 6552ea3ffb7SJohn Johansen label = aa_get_current_label(); 6562ea3ffb7SJohn Johansen if (!unconfined(label)) 657690f33e1SJohn Johansen error = aa_pivotroot(current_cred(), label, old_path, new_path); 6582ea3ffb7SJohn Johansen aa_put_label(label); 6592ea3ffb7SJohn Johansen 6602ea3ffb7SJohn Johansen return error; 6612ea3ffb7SJohn Johansen } 6622ea3ffb7SJohn Johansen 663c8e477c6SAl Viro static int apparmor_getprocattr(struct task_struct *task, const char *name, 664b5e95b48SJohn Johansen char **value) 665b5e95b48SJohn Johansen { 666b5e95b48SJohn Johansen int error = -ENOENT; 667b5e95b48SJohn Johansen /* released below */ 668b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 669de62de59SJohn Johansen struct aa_task_ctx *ctx = task_ctx(current); 670637f688dSJohn Johansen struct aa_label *label = NULL; 671b5e95b48SJohn Johansen 672b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 673d9087c49SJohn Johansen label = aa_get_newest_label(cred_label(cred)); 67455a26ebfSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 675637f688dSJohn Johansen label = aa_get_newest_label(ctx->previous); 67655a26ebfSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 677637f688dSJohn Johansen label = aa_get_newest_label(ctx->onexec); 678b5e95b48SJohn Johansen else 679b5e95b48SJohn Johansen error = -EINVAL; 680b5e95b48SJohn Johansen 681637f688dSJohn Johansen if (label) 68276a1d263SJohn Johansen error = aa_getprocattr(label, value); 68377b071b3SJohn Johansen 684637f688dSJohn Johansen aa_put_label(label); 685b5e95b48SJohn Johansen put_cred(cred); 686b5e95b48SJohn Johansen 687b5e95b48SJohn Johansen return error; 688b5e95b48SJohn Johansen } 689b5e95b48SJohn Johansen 690b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 691b21507e2SStephen Smalley size_t size) 692b5e95b48SJohn Johansen { 693e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 694b5e95b48SJohn Johansen size_t arg_size; 695b5e95b48SJohn Johansen int error; 696c57bc80fSJohn Johansen DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, 6978c4b785aSJohn Johansen OP_SETPROCATTR); 698b5e95b48SJohn Johansen 699b5e95b48SJohn Johansen if (size == 0) 700b5e95b48SJohn Johansen return -EINVAL; 701b5e95b48SJohn Johansen 702e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 703e89b8081SVegard Nossum if (args[size - 1] != '\0') { 704e89b8081SVegard Nossum /* null terminate */ 705e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 706e89b8081SVegard Nossum if (!args) 707e89b8081SVegard Nossum return -ENOMEM; 708e89b8081SVegard Nossum memcpy(args, value, size); 709e89b8081SVegard Nossum args[size] = '\0'; 710e89b8081SVegard Nossum } 711e89b8081SVegard Nossum 712e89b8081SVegard Nossum error = -EINVAL; 713b5e95b48SJohn Johansen args = strim(args); 714b5e95b48SJohn Johansen command = strsep(&args, " "); 715b5e95b48SJohn Johansen if (!args) 716e89b8081SVegard Nossum goto out; 717b5e95b48SJohn Johansen args = skip_spaces(args); 718b5e95b48SJohn Johansen if (!*args) 719e89b8081SVegard Nossum goto out; 720b5e95b48SJohn Johansen 721d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 722b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 723b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 724b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 725df8073c6SJohn Johansen AA_CHANGE_NOFLAGS); 726b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 727b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 728df8073c6SJohn Johansen AA_CHANGE_TEST); 729b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 730df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_NOFLAGS); 731b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 732df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_TEST); 7336c5fc8f1SJohn Johansen } else if (strcmp(command, "stack") == 0) { 7346c5fc8f1SJohn Johansen error = aa_change_profile(args, AA_CHANGE_STACK); 7353eea57c2SJohn Johansen } else 7363eea57c2SJohn Johansen goto fail; 737b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 7383eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 739df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_ONEXEC); 7406c5fc8f1SJohn Johansen else if (strcmp(command, "stack") == 0) 7416c5fc8f1SJohn Johansen error = aa_change_profile(args, (AA_CHANGE_ONEXEC | 7426c5fc8f1SJohn Johansen AA_CHANGE_STACK)); 7433eea57c2SJohn Johansen else 7443eea57c2SJohn Johansen goto fail; 7453eea57c2SJohn Johansen } else 746b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 747e89b8081SVegard Nossum goto fail; 7483eea57c2SJohn Johansen 749b5e95b48SJohn Johansen if (!error) 750b5e95b48SJohn Johansen error = size; 751e89b8081SVegard Nossum out: 752e89b8081SVegard Nossum kfree(largs); 753b5e95b48SJohn Johansen return error; 7543eea57c2SJohn Johansen 7553eea57c2SJohn Johansen fail: 75630b3669dSJohn Johansen ad.subj_label = begin_current_label_crit_section(); 757c57bc80fSJohn Johansen ad.info = name; 758c57bc80fSJohn Johansen ad.error = error = -EINVAL; 759c57bc80fSJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &ad, NULL); 76030b3669dSJohn Johansen end_current_label_crit_section(ad.subj_label); 761e89b8081SVegard Nossum goto out; 762b5e95b48SJohn Johansen } 763b5e95b48SJohn Johansen 764fe864821SJohn Johansen /** 765fe864821SJohn Johansen * apparmor_bprm_committing_creds - do task cleanup on committing new creds 766fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 767fe864821SJohn Johansen */ 768fe864821SJohn Johansen static void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 769fe864821SJohn Johansen { 770637f688dSJohn Johansen struct aa_label *label = aa_current_raw_label(); 771d9087c49SJohn Johansen struct aa_label *new_label = cred_label(bprm->cred); 772fe864821SJohn Johansen 773fe864821SJohn Johansen /* bail out if unconfined or not changing profile */ 774d9087c49SJohn Johansen if ((new_label->proxy == label->proxy) || 775d9087c49SJohn Johansen (unconfined(new_label))) 776fe864821SJohn Johansen return; 777fe864821SJohn Johansen 778192ca6b5SJohn Johansen aa_inherit_files(bprm->cred, current->files); 779192ca6b5SJohn Johansen 780fe864821SJohn Johansen current->pdeath_signal = 0; 781fe864821SJohn Johansen 782637f688dSJohn Johansen /* reset soft limits and set hard limits for the new label */ 783d9087c49SJohn Johansen __aa_transition_rlimits(label, new_label); 784fe864821SJohn Johansen } 785fe864821SJohn Johansen 786fe864821SJohn Johansen /** 787391f1211SJiapeng Chong * apparmor_bprm_committed_creds() - do cleanup after new creds committed 788fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 789fe864821SJohn Johansen */ 790fe864821SJohn Johansen static void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 791fe864821SJohn Johansen { 7923b529a76SJohn Johansen /* clear out temporary/transitional state from the context */ 793de62de59SJohn Johansen aa_clear_task_ctx_trans(task_ctx(current)); 7943b529a76SJohn Johansen 795fe864821SJohn Johansen return; 796fe864821SJohn Johansen } 797fe864821SJohn Johansen 7986326948fSPaul Moore static void apparmor_current_getsecid_subj(u32 *secid) 7996326948fSPaul Moore { 8006326948fSPaul Moore struct aa_label *label = aa_get_current_label(); 8016326948fSPaul Moore *secid = label->secid; 8026326948fSPaul Moore aa_put_label(label); 8036326948fSPaul Moore } 8046326948fSPaul Moore 8056326948fSPaul Moore static void apparmor_task_getsecid_obj(struct task_struct *p, u32 *secid) 806a7ae3645SJohn Johansen { 807a7ae3645SJohn Johansen struct aa_label *label = aa_get_task_label(p); 808a7ae3645SJohn Johansen *secid = label->secid; 809a7ae3645SJohn Johansen aa_put_label(label); 810a7ae3645SJohn Johansen } 811a7ae3645SJohn Johansen 8127cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 8137cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 814b5e95b48SJohn Johansen { 815637f688dSJohn Johansen struct aa_label *label = __begin_current_label_crit_section(); 816b5e95b48SJohn Johansen int error = 0; 817b5e95b48SJohn Johansen 818637f688dSJohn Johansen if (!unconfined(label)) 819690f33e1SJohn Johansen error = aa_task_setrlimit(current_cred(), label, task, 820690f33e1SJohn Johansen resource, new_rlim); 821637f688dSJohn Johansen __end_current_label_crit_section(label); 822b5e95b48SJohn Johansen 823b5e95b48SJohn Johansen return error; 824b5e95b48SJohn Johansen } 825b5e95b48SJohn Johansen 826ae7795bcSEric W. Biederman static int apparmor_task_kill(struct task_struct *target, struct kernel_siginfo *info, 8276b4f3d01SStephen Smalley int sig, const struct cred *cred) 828cd1dbf76SJohn Johansen { 829690f33e1SJohn Johansen const struct cred *tc; 830cd1dbf76SJohn Johansen struct aa_label *cl, *tl; 831cd1dbf76SJohn Johansen int error; 832cd1dbf76SJohn Johansen 833690f33e1SJohn Johansen tc = get_task_cred(target); 834690f33e1SJohn Johansen tl = aa_get_newest_cred_label(tc); 8356b4f3d01SStephen Smalley if (cred) { 8366b4f3d01SStephen Smalley /* 837cd1dbf76SJohn Johansen * Dealing with USB IO specific behavior 838cd1dbf76SJohn Johansen */ 8396b4f3d01SStephen Smalley cl = aa_get_newest_cred_label(cred); 840690f33e1SJohn Johansen error = aa_may_signal(cred, cl, tc, tl, sig); 8416b4f3d01SStephen Smalley aa_put_label(cl); 8426b4f3d01SStephen Smalley return error; 843690f33e1SJohn Johansen } else { 844cd1dbf76SJohn Johansen cl = __begin_current_label_crit_section(); 845690f33e1SJohn Johansen error = aa_may_signal(current_cred(), cl, tc, tl, sig); 846cd1dbf76SJohn Johansen __end_current_label_crit_section(cl); 847690f33e1SJohn Johansen } 848690f33e1SJohn Johansen aa_put_label(tl); 849690f33e1SJohn Johansen put_cred(tc); 850cd1dbf76SJohn Johansen 851cd1dbf76SJohn Johansen return error; 852cd1dbf76SJohn Johansen } 853cd1dbf76SJohn Johansen 85456974a6fSJohn Johansen /** 85556974a6fSJohn Johansen * apparmor_sk_alloc_security - allocate and attach the sk_security field 85656974a6fSJohn Johansen */ 85756974a6fSJohn Johansen static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags) 85856974a6fSJohn Johansen { 85956974a6fSJohn Johansen struct aa_sk_ctx *ctx; 86056974a6fSJohn Johansen 86156974a6fSJohn Johansen ctx = kzalloc(sizeof(*ctx), flags); 86256974a6fSJohn Johansen if (!ctx) 86356974a6fSJohn Johansen return -ENOMEM; 86456974a6fSJohn Johansen 86556974a6fSJohn Johansen SK_CTX(sk) = ctx; 86656974a6fSJohn Johansen 86756974a6fSJohn Johansen return 0; 86856974a6fSJohn Johansen } 86956974a6fSJohn Johansen 87056974a6fSJohn Johansen /** 87156974a6fSJohn Johansen * apparmor_sk_free_security - free the sk_security field 87256974a6fSJohn Johansen */ 87356974a6fSJohn Johansen static void apparmor_sk_free_security(struct sock *sk) 87456974a6fSJohn Johansen { 87556974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 87656974a6fSJohn Johansen 87756974a6fSJohn Johansen SK_CTX(sk) = NULL; 87856974a6fSJohn Johansen aa_put_label(ctx->label); 87956974a6fSJohn Johansen aa_put_label(ctx->peer); 88056974a6fSJohn Johansen kfree(ctx); 88156974a6fSJohn Johansen } 88256974a6fSJohn Johansen 88356974a6fSJohn Johansen /** 8840fc6ab40SYang Li * apparmor_sk_clone_security - clone the sk_security field 88556974a6fSJohn Johansen */ 88656974a6fSJohn Johansen static void apparmor_sk_clone_security(const struct sock *sk, 88756974a6fSJohn Johansen struct sock *newsk) 88856974a6fSJohn Johansen { 88956974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 89056974a6fSJohn Johansen struct aa_sk_ctx *new = SK_CTX(newsk); 89156974a6fSJohn Johansen 8923b646abcSMauricio Faria de Oliveira if (new->label) 8933b646abcSMauricio Faria de Oliveira aa_put_label(new->label); 89456974a6fSJohn Johansen new->label = aa_get_label(ctx->label); 8953b646abcSMauricio Faria de Oliveira 8963b646abcSMauricio Faria de Oliveira if (new->peer) 8973b646abcSMauricio Faria de Oliveira aa_put_label(new->peer); 89856974a6fSJohn Johansen new->peer = aa_get_label(ctx->peer); 89956974a6fSJohn Johansen } 90056974a6fSJohn Johansen 90156974a6fSJohn Johansen /** 90256974a6fSJohn Johansen * apparmor_socket_create - check perms before creating a new socket 90356974a6fSJohn Johansen */ 90456974a6fSJohn Johansen static int apparmor_socket_create(int family, int type, int protocol, int kern) 90556974a6fSJohn Johansen { 90656974a6fSJohn Johansen struct aa_label *label; 90756974a6fSJohn Johansen int error = 0; 90856974a6fSJohn Johansen 90956974a6fSJohn Johansen AA_BUG(in_interrupt()); 91056974a6fSJohn Johansen 91156974a6fSJohn Johansen label = begin_current_label_crit_section(); 91256974a6fSJohn Johansen if (!(kern || unconfined(label))) 91356974a6fSJohn Johansen error = af_select(family, 91456974a6fSJohn Johansen create_perm(label, family, type, protocol), 915690f33e1SJohn Johansen aa_af_perm(current_cred(), label, 916690f33e1SJohn Johansen OP_CREATE, AA_MAY_CREATE, 91756974a6fSJohn Johansen family, type, protocol)); 91856974a6fSJohn Johansen end_current_label_crit_section(label); 91956974a6fSJohn Johansen 92056974a6fSJohn Johansen return error; 92156974a6fSJohn Johansen } 92256974a6fSJohn Johansen 92356974a6fSJohn Johansen /** 92456974a6fSJohn Johansen * apparmor_socket_post_create - setup the per-socket security struct 92556974a6fSJohn Johansen * 92656974a6fSJohn Johansen * Note: 92756974a6fSJohn Johansen * - kernel sockets currently labeled unconfined but we may want to 92856974a6fSJohn Johansen * move to a special kernel label 92956974a6fSJohn Johansen * - socket may not have sk here if created with sock_create_lite or 93056974a6fSJohn Johansen * sock_alloc. These should be accept cases which will be handled in 93156974a6fSJohn Johansen * sock_graft. 93256974a6fSJohn Johansen */ 93356974a6fSJohn Johansen static int apparmor_socket_post_create(struct socket *sock, int family, 93456974a6fSJohn Johansen int type, int protocol, int kern) 93556974a6fSJohn Johansen { 93656974a6fSJohn Johansen struct aa_label *label; 93756974a6fSJohn Johansen 93856974a6fSJohn Johansen if (kern) { 93995c0581fSJohn Johansen label = aa_get_label(kernel_t); 94056974a6fSJohn Johansen } else 94156974a6fSJohn Johansen label = aa_get_current_label(); 94256974a6fSJohn Johansen 94356974a6fSJohn Johansen if (sock->sk) { 94456974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sock->sk); 94556974a6fSJohn Johansen 94656974a6fSJohn Johansen aa_put_label(ctx->label); 94756974a6fSJohn Johansen ctx->label = aa_get_label(label); 94856974a6fSJohn Johansen } 94956974a6fSJohn Johansen aa_put_label(label); 95056974a6fSJohn Johansen 95156974a6fSJohn Johansen return 0; 95256974a6fSJohn Johansen } 95356974a6fSJohn Johansen 95456974a6fSJohn Johansen /** 95556974a6fSJohn Johansen * apparmor_socket_bind - check perms before bind addr to socket 95656974a6fSJohn Johansen */ 95756974a6fSJohn Johansen static int apparmor_socket_bind(struct socket *sock, 95856974a6fSJohn Johansen struct sockaddr *address, int addrlen) 95956974a6fSJohn Johansen { 96056974a6fSJohn Johansen AA_BUG(!sock); 96156974a6fSJohn Johansen AA_BUG(!sock->sk); 96256974a6fSJohn Johansen AA_BUG(!address); 96356974a6fSJohn Johansen AA_BUG(in_interrupt()); 96456974a6fSJohn Johansen 96556974a6fSJohn Johansen return af_select(sock->sk->sk_family, 96656974a6fSJohn Johansen bind_perm(sock, address, addrlen), 96756974a6fSJohn Johansen aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk)); 96856974a6fSJohn Johansen } 96956974a6fSJohn Johansen 97056974a6fSJohn Johansen /** 97156974a6fSJohn Johansen * apparmor_socket_connect - check perms before connecting @sock to @address 97256974a6fSJohn Johansen */ 97356974a6fSJohn Johansen static int apparmor_socket_connect(struct socket *sock, 97456974a6fSJohn Johansen struct sockaddr *address, int addrlen) 97556974a6fSJohn Johansen { 97656974a6fSJohn Johansen AA_BUG(!sock); 97756974a6fSJohn Johansen AA_BUG(!sock->sk); 97856974a6fSJohn Johansen AA_BUG(!address); 97956974a6fSJohn Johansen AA_BUG(in_interrupt()); 98056974a6fSJohn Johansen 98156974a6fSJohn Johansen return af_select(sock->sk->sk_family, 98256974a6fSJohn Johansen connect_perm(sock, address, addrlen), 98356974a6fSJohn Johansen aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk)); 98456974a6fSJohn Johansen } 98556974a6fSJohn Johansen 98656974a6fSJohn Johansen /** 9870fc6ab40SYang Li * apparmor_socket_listen - check perms before allowing listen 98856974a6fSJohn Johansen */ 98956974a6fSJohn Johansen static int apparmor_socket_listen(struct socket *sock, int backlog) 99056974a6fSJohn Johansen { 99156974a6fSJohn Johansen AA_BUG(!sock); 99256974a6fSJohn Johansen AA_BUG(!sock->sk); 99356974a6fSJohn Johansen AA_BUG(in_interrupt()); 99456974a6fSJohn Johansen 99556974a6fSJohn Johansen return af_select(sock->sk->sk_family, 99656974a6fSJohn Johansen listen_perm(sock, backlog), 99756974a6fSJohn Johansen aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk)); 99856974a6fSJohn Johansen } 99956974a6fSJohn Johansen 100056974a6fSJohn Johansen /** 100156974a6fSJohn Johansen * apparmor_socket_accept - check perms before accepting a new connection. 100256974a6fSJohn Johansen * 100356974a6fSJohn Johansen * Note: while @newsock is created and has some information, the accept 100456974a6fSJohn Johansen * has not been done. 100556974a6fSJohn Johansen */ 100656974a6fSJohn Johansen static int apparmor_socket_accept(struct socket *sock, struct socket *newsock) 100756974a6fSJohn Johansen { 100856974a6fSJohn Johansen AA_BUG(!sock); 100956974a6fSJohn Johansen AA_BUG(!sock->sk); 101056974a6fSJohn Johansen AA_BUG(!newsock); 101156974a6fSJohn Johansen AA_BUG(in_interrupt()); 101256974a6fSJohn Johansen 101356974a6fSJohn Johansen return af_select(sock->sk->sk_family, 101456974a6fSJohn Johansen accept_perm(sock, newsock), 101556974a6fSJohn Johansen aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk)); 101656974a6fSJohn Johansen } 101756974a6fSJohn Johansen 101856974a6fSJohn Johansen static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock, 101956974a6fSJohn Johansen struct msghdr *msg, int size) 102056974a6fSJohn Johansen { 102156974a6fSJohn Johansen AA_BUG(!sock); 102256974a6fSJohn Johansen AA_BUG(!sock->sk); 102356974a6fSJohn Johansen AA_BUG(!msg); 102456974a6fSJohn Johansen AA_BUG(in_interrupt()); 102556974a6fSJohn Johansen 102656974a6fSJohn Johansen return af_select(sock->sk->sk_family, 102756974a6fSJohn Johansen msg_perm(op, request, sock, msg, size), 102856974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 102956974a6fSJohn Johansen } 103056974a6fSJohn Johansen 103156974a6fSJohn Johansen /** 103256974a6fSJohn Johansen * apparmor_socket_sendmsg - check perms before sending msg to another socket 103356974a6fSJohn Johansen */ 103456974a6fSJohn Johansen static int apparmor_socket_sendmsg(struct socket *sock, 103556974a6fSJohn Johansen struct msghdr *msg, int size) 103656974a6fSJohn Johansen { 103756974a6fSJohn Johansen return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size); 103856974a6fSJohn Johansen } 103956974a6fSJohn Johansen 104056974a6fSJohn Johansen /** 104156974a6fSJohn Johansen * apparmor_socket_recvmsg - check perms before receiving a message 104256974a6fSJohn Johansen */ 104356974a6fSJohn Johansen static int apparmor_socket_recvmsg(struct socket *sock, 104456974a6fSJohn Johansen struct msghdr *msg, int size, int flags) 104556974a6fSJohn Johansen { 104656974a6fSJohn Johansen return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size); 104756974a6fSJohn Johansen } 104856974a6fSJohn Johansen 104956974a6fSJohn Johansen /* revaliation, get/set attr, shutdown */ 105056974a6fSJohn Johansen static int aa_sock_perm(const char *op, u32 request, struct socket *sock) 105156974a6fSJohn Johansen { 105256974a6fSJohn Johansen AA_BUG(!sock); 105356974a6fSJohn Johansen AA_BUG(!sock->sk); 105456974a6fSJohn Johansen AA_BUG(in_interrupt()); 105556974a6fSJohn Johansen 105656974a6fSJohn Johansen return af_select(sock->sk->sk_family, 105756974a6fSJohn Johansen sock_perm(op, request, sock), 105856974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 105956974a6fSJohn Johansen } 106056974a6fSJohn Johansen 106156974a6fSJohn Johansen /** 106256974a6fSJohn Johansen * apparmor_socket_getsockname - check perms before getting the local address 106356974a6fSJohn Johansen */ 106456974a6fSJohn Johansen static int apparmor_socket_getsockname(struct socket *sock) 106556974a6fSJohn Johansen { 106656974a6fSJohn Johansen return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock); 106756974a6fSJohn Johansen } 106856974a6fSJohn Johansen 106956974a6fSJohn Johansen /** 107056974a6fSJohn Johansen * apparmor_socket_getpeername - check perms before getting remote address 107156974a6fSJohn Johansen */ 107256974a6fSJohn Johansen static int apparmor_socket_getpeername(struct socket *sock) 107356974a6fSJohn Johansen { 107456974a6fSJohn Johansen return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock); 107556974a6fSJohn Johansen } 107656974a6fSJohn Johansen 107756974a6fSJohn Johansen /* revaliation, get/set attr, opt */ 107856974a6fSJohn Johansen static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock, 107956974a6fSJohn Johansen int level, int optname) 108056974a6fSJohn Johansen { 108156974a6fSJohn Johansen AA_BUG(!sock); 108256974a6fSJohn Johansen AA_BUG(!sock->sk); 108356974a6fSJohn Johansen AA_BUG(in_interrupt()); 108456974a6fSJohn Johansen 108556974a6fSJohn Johansen return af_select(sock->sk->sk_family, 108656974a6fSJohn Johansen opt_perm(op, request, sock, level, optname), 108756974a6fSJohn Johansen aa_sk_perm(op, request, sock->sk)); 108856974a6fSJohn Johansen } 108956974a6fSJohn Johansen 109056974a6fSJohn Johansen /** 10910fc6ab40SYang Li * apparmor_socket_getsockopt - check perms before getting socket options 109256974a6fSJohn Johansen */ 109356974a6fSJohn Johansen static int apparmor_socket_getsockopt(struct socket *sock, int level, 109456974a6fSJohn Johansen int optname) 109556974a6fSJohn Johansen { 109656974a6fSJohn Johansen return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock, 109756974a6fSJohn Johansen level, optname); 109856974a6fSJohn Johansen } 109956974a6fSJohn Johansen 110056974a6fSJohn Johansen /** 11010fc6ab40SYang Li * apparmor_socket_setsockopt - check perms before setting socket options 110256974a6fSJohn Johansen */ 110356974a6fSJohn Johansen static int apparmor_socket_setsockopt(struct socket *sock, int level, 110456974a6fSJohn Johansen int optname) 110556974a6fSJohn Johansen { 110656974a6fSJohn Johansen return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock, 110756974a6fSJohn Johansen level, optname); 110856974a6fSJohn Johansen } 110956974a6fSJohn Johansen 111056974a6fSJohn Johansen /** 111156974a6fSJohn Johansen * apparmor_socket_shutdown - check perms before shutting down @sock conn 111256974a6fSJohn Johansen */ 111356974a6fSJohn Johansen static int apparmor_socket_shutdown(struct socket *sock, int how) 111456974a6fSJohn Johansen { 111556974a6fSJohn Johansen return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock); 111656974a6fSJohn Johansen } 111756974a6fSJohn Johansen 1118e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 111956974a6fSJohn Johansen /** 11200fc6ab40SYang Li * apparmor_socket_sock_rcv_skb - check perms before associating skb to sk 112156974a6fSJohn Johansen * 112256974a6fSJohn Johansen * Note: can not sleep may be called with locks held 112356974a6fSJohn Johansen * 112456974a6fSJohn Johansen * dont want protocol specific in __skb_recv_datagram() 112556974a6fSJohn Johansen * to deny an incoming connection socket_sock_rcv_skb() 112656974a6fSJohn Johansen */ 112756974a6fSJohn Johansen static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 112856974a6fSJohn Johansen { 1129ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx = SK_CTX(sk); 1130ab9f2115SMatthew Garrett 1131ab9f2115SMatthew Garrett if (!skb->secmark) 113256974a6fSJohn Johansen return 0; 1133ab9f2115SMatthew Garrett 1134ab9f2115SMatthew Garrett return apparmor_secmark_check(ctx->label, OP_RECVMSG, AA_MAY_RECEIVE, 1135ab9f2115SMatthew Garrett skb->secmark, sk); 113656974a6fSJohn Johansen } 1137e1af4779SArnd Bergmann #endif 113856974a6fSJohn Johansen 113956974a6fSJohn Johansen 114056974a6fSJohn Johansen static struct aa_label *sk_peer_label(struct sock *sk) 114156974a6fSJohn Johansen { 114256974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 114356974a6fSJohn Johansen 114456974a6fSJohn Johansen if (ctx->peer) 114556974a6fSJohn Johansen return ctx->peer; 114656974a6fSJohn Johansen 114756974a6fSJohn Johansen return ERR_PTR(-ENOPROTOOPT); 114856974a6fSJohn Johansen } 114956974a6fSJohn Johansen 115056974a6fSJohn Johansen /** 115156974a6fSJohn Johansen * apparmor_socket_getpeersec_stream - get security context of peer 115256974a6fSJohn Johansen * 115356974a6fSJohn Johansen * Note: for tcp only valid if using ipsec or cipso on lan 115456974a6fSJohn Johansen */ 115556974a6fSJohn Johansen static int apparmor_socket_getpeersec_stream(struct socket *sock, 1156b10b9c34SPaul Moore sockptr_t optval, sockptr_t optlen, 115756974a6fSJohn Johansen unsigned int len) 115856974a6fSJohn Johansen { 1159b10b9c34SPaul Moore char *name = NULL; 116056974a6fSJohn Johansen int slen, error = 0; 116156974a6fSJohn Johansen struct aa_label *label; 116256974a6fSJohn Johansen struct aa_label *peer; 116356974a6fSJohn Johansen 116456974a6fSJohn Johansen label = begin_current_label_crit_section(); 116556974a6fSJohn Johansen peer = sk_peer_label(sock->sk); 116656974a6fSJohn Johansen if (IS_ERR(peer)) { 116756974a6fSJohn Johansen error = PTR_ERR(peer); 116856974a6fSJohn Johansen goto done; 116956974a6fSJohn Johansen } 117056974a6fSJohn Johansen slen = aa_label_asxprint(&name, labels_ns(label), peer, 117156974a6fSJohn Johansen FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 117256974a6fSJohn Johansen FLAG_HIDDEN_UNCONFINED, GFP_KERNEL); 117356974a6fSJohn Johansen /* don't include terminating \0 in slen, it breaks some apps */ 117456974a6fSJohn Johansen if (slen < 0) { 117556974a6fSJohn Johansen error = -ENOMEM; 1176b10b9c34SPaul Moore goto done; 1177b10b9c34SPaul Moore } 117856974a6fSJohn Johansen if (slen > len) { 117956974a6fSJohn Johansen error = -ERANGE; 1180b10b9c34SPaul Moore goto done_len; 118156974a6fSJohn Johansen } 118256974a6fSJohn Johansen 1183b10b9c34SPaul Moore if (copy_to_sockptr(optval, name, slen)) 1184b10b9c34SPaul Moore error = -EFAULT; 1185b10b9c34SPaul Moore done_len: 1186b10b9c34SPaul Moore if (copy_to_sockptr(optlen, &slen, sizeof(slen))) 1187b10b9c34SPaul Moore error = -EFAULT; 118856974a6fSJohn Johansen done: 118956974a6fSJohn Johansen end_current_label_crit_section(label); 1190b10b9c34SPaul Moore kfree(name); 119156974a6fSJohn Johansen return error; 119256974a6fSJohn Johansen } 119356974a6fSJohn Johansen 119456974a6fSJohn Johansen /** 119556974a6fSJohn Johansen * apparmor_socket_getpeersec_dgram - get security label of packet 119656974a6fSJohn Johansen * @sock: the peer socket 119756974a6fSJohn Johansen * @skb: packet data 119856974a6fSJohn Johansen * @secid: pointer to where to put the secid of the packet 119956974a6fSJohn Johansen * 120056974a6fSJohn Johansen * Sets the netlabel socket state on sk from parent 120156974a6fSJohn Johansen */ 120256974a6fSJohn Johansen static int apparmor_socket_getpeersec_dgram(struct socket *sock, 120356974a6fSJohn Johansen struct sk_buff *skb, u32 *secid) 120456974a6fSJohn Johansen 120556974a6fSJohn Johansen { 120656974a6fSJohn Johansen /* TODO: requires secid support */ 120756974a6fSJohn Johansen return -ENOPROTOOPT; 120856974a6fSJohn Johansen } 120956974a6fSJohn Johansen 121056974a6fSJohn Johansen /** 121156974a6fSJohn Johansen * apparmor_sock_graft - Initialize newly created socket 121256974a6fSJohn Johansen * @sk: child sock 121356974a6fSJohn Johansen * @parent: parent socket 121456974a6fSJohn Johansen * 121556974a6fSJohn Johansen * Note: could set off of SOCK_CTX(parent) but need to track inode and we can 121656974a6fSJohn Johansen * just set sk security information off of current creating process label 121756974a6fSJohn Johansen * Labeling of sk for accept case - probably should be sock based 121856974a6fSJohn Johansen * instead of task, because of the case where an implicitly labeled 121956974a6fSJohn Johansen * socket is shared by different tasks. 122056974a6fSJohn Johansen */ 122156974a6fSJohn Johansen static void apparmor_sock_graft(struct sock *sk, struct socket *parent) 122256974a6fSJohn Johansen { 122356974a6fSJohn Johansen struct aa_sk_ctx *ctx = SK_CTX(sk); 122456974a6fSJohn Johansen 122556974a6fSJohn Johansen if (!ctx->label) 122656974a6fSJohn Johansen ctx->label = aa_get_current_label(); 122756974a6fSJohn Johansen } 122856974a6fSJohn Johansen 1229e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 123041dd9596SFlorian Westphal static int apparmor_inet_conn_request(const struct sock *sk, struct sk_buff *skb, 1231ab9f2115SMatthew Garrett struct request_sock *req) 1232ab9f2115SMatthew Garrett { 1233ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx = SK_CTX(sk); 1234ab9f2115SMatthew Garrett 1235ab9f2115SMatthew Garrett if (!skb->secmark) 1236ab9f2115SMatthew Garrett return 0; 1237ab9f2115SMatthew Garrett 1238ab9f2115SMatthew Garrett return apparmor_secmark_check(ctx->label, OP_CONNECT, AA_MAY_CONNECT, 1239ab9f2115SMatthew Garrett skb->secmark, sk); 1240ab9f2115SMatthew Garrett } 1241e1af4779SArnd Bergmann #endif 1242ab9f2115SMatthew Garrett 1243bbd3662aSCasey Schaufler /* 124437923d43SXiu Jianfeng * The cred blob is a pointer to, not an instance of, an aa_label. 1245bbd3662aSCasey Schaufler */ 1246f22f9aafSPaul Moore struct lsm_blob_sizes apparmor_blob_sizes __ro_after_init = { 124737923d43SXiu Jianfeng .lbs_cred = sizeof(struct aa_label *), 124833bf60caSCasey Schaufler .lbs_file = sizeof(struct aa_file_ctx), 1249f4ad8f2cSCasey Schaufler .lbs_task = sizeof(struct aa_task_ctx), 1250bbd3662aSCasey Schaufler }; 1251bbd3662aSCasey Schaufler 1252f22f9aafSPaul Moore static struct security_hook_list apparmor_hooks[] __ro_after_init = { 1253e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 1254e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 1255e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 1256e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 1257b5e95b48SJohn Johansen 1258*96af4515SJohn Johansen LSM_HOOK_INIT(move_mount, apparmor_move_mount), 12592ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), 12602ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), 12612ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), 12622ea3ffb7SJohn Johansen 1263e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 1264e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 1265e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 1266e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 1267e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 1268e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 1269e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 1270e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 1271e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 1272e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 1273e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 1274b5e95b48SJohn Johansen 1275e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 1276064dc947SJohn Johansen LSM_HOOK_INIT(file_receive, apparmor_file_receive), 1277e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 1278e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 1279e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 1280e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 1281e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 1282e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 12833350607dSGünther Noack LSM_HOOK_INIT(file_truncate, apparmor_file_truncate), 1284b5e95b48SJohn Johansen 1285e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 1286e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 1287b5e95b48SJohn Johansen 128856974a6fSJohn Johansen LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security), 128956974a6fSJohn Johansen LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security), 129056974a6fSJohn Johansen LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security), 129156974a6fSJohn Johansen 129256974a6fSJohn Johansen LSM_HOOK_INIT(socket_create, apparmor_socket_create), 129356974a6fSJohn Johansen LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create), 129456974a6fSJohn Johansen LSM_HOOK_INIT(socket_bind, apparmor_socket_bind), 129556974a6fSJohn Johansen LSM_HOOK_INIT(socket_connect, apparmor_socket_connect), 129656974a6fSJohn Johansen LSM_HOOK_INIT(socket_listen, apparmor_socket_listen), 129756974a6fSJohn Johansen LSM_HOOK_INIT(socket_accept, apparmor_socket_accept), 129856974a6fSJohn Johansen LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg), 129956974a6fSJohn Johansen LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg), 130056974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname), 130156974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername), 130256974a6fSJohn Johansen LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), 130356974a6fSJohn Johansen LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), 130456974a6fSJohn Johansen LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), 1305e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 130656974a6fSJohn Johansen LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), 1307e1af4779SArnd Bergmann #endif 130856974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_stream, 130956974a6fSJohn Johansen apparmor_socket_getpeersec_stream), 131056974a6fSJohn Johansen LSM_HOOK_INIT(socket_getpeersec_dgram, 131156974a6fSJohn Johansen apparmor_socket_getpeersec_dgram), 131256974a6fSJohn Johansen LSM_HOOK_INIT(sock_graft, apparmor_sock_graft), 1313e1af4779SArnd Bergmann #ifdef CONFIG_NETWORK_SECMARK 1314ab9f2115SMatthew Garrett LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request), 1315e1af4779SArnd Bergmann #endif 131656974a6fSJohn Johansen 1317e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 1318e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 1319e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 1320e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 1321b5e95b48SJohn Johansen 1322b8bff599SEric W. Biederman LSM_HOOK_INIT(bprm_creds_for_exec, apparmor_bprm_creds_for_exec), 1323e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 1324e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 1325b5e95b48SJohn Johansen 13263b529a76SJohn Johansen LSM_HOOK_INIT(task_free, apparmor_task_free), 13273b529a76SJohn Johansen LSM_HOOK_INIT(task_alloc, apparmor_task_alloc), 13286326948fSPaul Moore LSM_HOOK_INIT(current_getsecid_subj, apparmor_current_getsecid_subj), 13296326948fSPaul Moore LSM_HOOK_INIT(task_getsecid_obj, apparmor_task_getsecid_obj), 1330e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 1331cd1dbf76SJohn Johansen LSM_HOOK_INIT(task_kill, apparmor_task_kill), 1332c0929212SJohn Johansen 1333e79c26d0SMatthew Garrett #ifdef CONFIG_AUDIT 1334e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init), 1335e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known), 1336e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match), 1337e79c26d0SMatthew Garrett LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free), 1338e79c26d0SMatthew Garrett #endif 1339e79c26d0SMatthew Garrett 1340c0929212SJohn Johansen LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx), 1341c0929212SJohn Johansen LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid), 1342c0929212SJohn Johansen LSM_HOOK_INIT(release_secctx, apparmor_release_secctx), 1343b5e95b48SJohn Johansen }; 1344b5e95b48SJohn Johansen 1345b5e95b48SJohn Johansen /* 1346b5e95b48SJohn Johansen * AppArmor sysfs module parameters 1347b5e95b48SJohn Johansen */ 1348b5e95b48SJohn Johansen 1349101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 1350101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 1351b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 13529c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 13536a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1354101d6c82SStephen Rothwell .set = param_set_aabool, 1355101d6c82SStephen Rothwell .get = param_get_aabool 1356101d6c82SStephen Rothwell }; 1357b5e95b48SJohn Johansen 1358101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 1359101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 1360b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 13619c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 1362101d6c82SStephen Rothwell .set = param_set_aauint, 1363101d6c82SStephen Rothwell .get = param_get_aauint 1364101d6c82SStephen Rothwell }; 1365b5e95b48SJohn Johansen 136663c16c3aSChris Coulson static int param_set_aacompressionlevel(const char *val, 136763c16c3aSChris Coulson const struct kernel_param *kp); 136863c16c3aSChris Coulson static int param_get_aacompressionlevel(char *buffer, 136963c16c3aSChris Coulson const struct kernel_param *kp); 137063c16c3aSChris Coulson #define param_check_aacompressionlevel param_check_int 137163c16c3aSChris Coulson static const struct kernel_param_ops param_ops_aacompressionlevel = { 137263c16c3aSChris Coulson .set = param_set_aacompressionlevel, 137363c16c3aSChris Coulson .get = param_get_aacompressionlevel 137463c16c3aSChris Coulson }; 137563c16c3aSChris Coulson 1376101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 1377101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 1378b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 13799c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 13806a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 1381101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 1382101d6c82SStephen Rothwell .get = param_get_aalockpolicy 1383101d6c82SStephen Rothwell }; 1384b5e95b48SJohn Johansen 1385e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp); 1386e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp); 1387b5e95b48SJohn Johansen 1388e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp); 1389e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp); 1390b5e95b48SJohn Johansen 1391b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 1392b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 1393b5e95b48SJohn Johansen */ 1394b5e95b48SJohn Johansen 1395b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 1396b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 1397b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 1398b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 1399b5e95b48SJohn Johansen 14006059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 14017616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 14023ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 14036059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 14047616ac70SArnd Bergmann #endif 14056059f71fSJohn Johansen 1406d61c57fdSJohn Johansen /* whether policy exactly as loaded is retained for debug and checkpointing */ 1407d61c57fdSJohn Johansen bool aa_g_export_binary = IS_ENABLED(CONFIG_SECURITY_APPARMOR_EXPORT_BINARY); 1408d61c57fdSJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY 1409d61c57fdSJohn Johansen module_param_named(export_binary, aa_g_export_binary, aabool, 0600); 1410d61c57fdSJohn Johansen #endif 1411d61c57fdSJohn Johansen 141263c16c3aSChris Coulson /* policy loaddata compression level */ 141370f24a9fSJohn Johansen int aa_g_rawdata_compression_level = AA_DEFAULT_CLEVEL; 141463c16c3aSChris Coulson module_param_named(rawdata_compression_level, aa_g_rawdata_compression_level, 141563c16c3aSChris Coulson aacompressionlevel, 0400); 141663c16c3aSChris Coulson 1417b5e95b48SJohn Johansen /* Debug mode */ 1418eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 1419b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 1420b5e95b48SJohn Johansen 1421b5e95b48SJohn Johansen /* Audit mode */ 1422b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 1423b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 1424b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 1425b5e95b48SJohn Johansen 1426b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 1427b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 1428b5e95b48SJohn Johansen */ 1429954317feSThomas Meyer bool aa_g_audit_header = true; 1430b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 1431b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1432b5e95b48SJohn Johansen 1433b5e95b48SJohn Johansen /* lock out loading/removal of policy 1434b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 1435b5e95b48SJohn Johansen * load policy, if lock_policy is set 1436b5e95b48SJohn Johansen */ 143790ab5ee9SRusty Russell bool aa_g_lock_policy; 1438b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 1439b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 1440b5e95b48SJohn Johansen 1441b5e95b48SJohn Johansen /* Syscall logging mode */ 144290ab5ee9SRusty Russell bool aa_g_logsyscall; 1443b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 1444b5e95b48SJohn Johansen 1445b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 1446b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 1447622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 1448b5e95b48SJohn Johansen 1449b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 1450b5e95b48SJohn Johansen * on the loaded policy is done. 1451abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 1452abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 1453b5e95b48SJohn Johansen */ 145479eb2711SLukas Bulwahn bool aa_g_paranoid_load = IS_ENABLED(CONFIG_SECURITY_APPARMOR_PARANOID_LOAD); 1455abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 1456b5e95b48SJohn Johansen 1457e33c1b99SKees Cook static int param_get_aaintbool(char *buffer, const struct kernel_param *kp); 1458e33c1b99SKees Cook static int param_set_aaintbool(const char *val, const struct kernel_param *kp); 1459e33c1b99SKees Cook #define param_check_aaintbool param_check_int 1460e33c1b99SKees Cook static const struct kernel_param_ops param_ops_aaintbool = { 1461e33c1b99SKees Cook .set = param_set_aaintbool, 1462e33c1b99SKees Cook .get = param_get_aaintbool 1463e33c1b99SKees Cook }; 1464b5e95b48SJohn Johansen /* Boot time disable flag */ 1465f22f9aafSPaul Moore static int apparmor_enabled __ro_after_init = 1; 1466e33c1b99SKees Cook module_param_named(enabled, apparmor_enabled, aaintbool, 0444); 1467b5e95b48SJohn Johansen 1468b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 1469b5e95b48SJohn Johansen { 1470b5e95b48SJohn Johansen unsigned long enabled; 147129707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 1472b5e95b48SJohn Johansen if (!error) 1473b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 1474b5e95b48SJohn Johansen return 1; 1475b5e95b48SJohn Johansen } 1476b5e95b48SJohn Johansen 1477b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 1478b5e95b48SJohn Johansen 1479b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 1480101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 1481b5e95b48SJohn Johansen { 1482545de8feSJohn Johansen if (!apparmor_enabled) 1483545de8feSJohn Johansen return -EINVAL; 148492de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1485b5e95b48SJohn Johansen return -EPERM; 1486b5e95b48SJohn Johansen return param_set_bool(val, kp); 1487b5e95b48SJohn Johansen } 1488b5e95b48SJohn Johansen 1489101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 1490b5e95b48SJohn Johansen { 1491ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1492ca4bd5aeSJohn Johansen return -EINVAL; 149392de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1494545de8feSJohn Johansen return -EPERM; 1495b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1496b5e95b48SJohn Johansen } 1497b5e95b48SJohn Johansen 1498101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 1499b5e95b48SJohn Johansen { 1500ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1501ca4bd5aeSJohn Johansen return -EINVAL; 150292de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1503545de8feSJohn Johansen return -EPERM; 1504b5e95b48SJohn Johansen return param_set_bool(val, kp); 1505b5e95b48SJohn Johansen } 1506b5e95b48SJohn Johansen 1507101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 1508b5e95b48SJohn Johansen { 1509ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1510ca4bd5aeSJohn Johansen return -EINVAL; 151192de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1512545de8feSJohn Johansen return -EPERM; 1513b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 1514b5e95b48SJohn Johansen } 1515b5e95b48SJohn Johansen 1516101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 1517b5e95b48SJohn Johansen { 151839d84824SJohn Johansen int error; 151939d84824SJohn Johansen 1520ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1521ca4bd5aeSJohn Johansen return -EINVAL; 152239d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 152339d84824SJohn Johansen if (apparmor_initialized) 1524545de8feSJohn Johansen return -EPERM; 152539d84824SJohn Johansen 152639d84824SJohn Johansen error = param_set_uint(val, kp); 1527df323337SSebastian Andrzej Siewior aa_g_path_max = max_t(uint32_t, aa_g_path_max, sizeof(union aa_buffer)); 152839d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 152939d84824SJohn Johansen 153039d84824SJohn Johansen return error; 1531b5e95b48SJohn Johansen } 1532b5e95b48SJohn Johansen 1533101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 1534b5e95b48SJohn Johansen { 1535ca4bd5aeSJohn Johansen if (!apparmor_enabled) 1536ca4bd5aeSJohn Johansen return -EINVAL; 153792de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1538545de8feSJohn Johansen return -EPERM; 1539b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 1540b5e95b48SJohn Johansen } 1541b5e95b48SJohn Johansen 1542e33c1b99SKees Cook /* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */ 1543e33c1b99SKees Cook static int param_set_aaintbool(const char *val, const struct kernel_param *kp) 1544e33c1b99SKees Cook { 1545e33c1b99SKees Cook struct kernel_param kp_local; 1546e33c1b99SKees Cook bool value; 1547e33c1b99SKees Cook int error; 1548e33c1b99SKees Cook 1549e33c1b99SKees Cook if (apparmor_initialized) 1550e33c1b99SKees Cook return -EPERM; 1551e33c1b99SKees Cook 1552e33c1b99SKees Cook /* Create local copy, with arg pointing to bool type. */ 1553e33c1b99SKees Cook value = !!*((int *)kp->arg); 1554e33c1b99SKees Cook memcpy(&kp_local, kp, sizeof(kp_local)); 1555e33c1b99SKees Cook kp_local.arg = &value; 1556e33c1b99SKees Cook 1557e33c1b99SKees Cook error = param_set_bool(val, &kp_local); 1558e33c1b99SKees Cook if (!error) 1559e33c1b99SKees Cook *((int *)kp->arg) = *((bool *)kp_local.arg); 1560e33c1b99SKees Cook return error; 1561e33c1b99SKees Cook } 1562e33c1b99SKees Cook 1563e33c1b99SKees Cook /* 1564e33c1b99SKees Cook * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to 1565e33c1b99SKees Cook * 1/0, this converts the "int that is actually bool" back to bool for 1566e33c1b99SKees Cook * display in the /sys filesystem, while keeping it "int" for the LSM 1567e33c1b99SKees Cook * infrastructure. 1568e33c1b99SKees Cook */ 1569e33c1b99SKees Cook static int param_get_aaintbool(char *buffer, const struct kernel_param *kp) 1570e33c1b99SKees Cook { 1571e33c1b99SKees Cook struct kernel_param kp_local; 1572e33c1b99SKees Cook bool value; 1573e33c1b99SKees Cook 1574e33c1b99SKees Cook /* Create local copy, with arg pointing to bool type. */ 1575e33c1b99SKees Cook value = !!*((int *)kp->arg); 1576e33c1b99SKees Cook memcpy(&kp_local, kp, sizeof(kp_local)); 1577e33c1b99SKees Cook kp_local.arg = &value; 1578e33c1b99SKees Cook 1579e33c1b99SKees Cook return param_get_bool(buffer, &kp_local); 1580e33c1b99SKees Cook } 1581e33c1b99SKees Cook 158263c16c3aSChris Coulson static int param_set_aacompressionlevel(const char *val, 158363c16c3aSChris Coulson const struct kernel_param *kp) 158463c16c3aSChris Coulson { 158563c16c3aSChris Coulson int error; 158663c16c3aSChris Coulson 158763c16c3aSChris Coulson if (!apparmor_enabled) 158863c16c3aSChris Coulson return -EINVAL; 158963c16c3aSChris Coulson if (apparmor_initialized) 159063c16c3aSChris Coulson return -EPERM; 159163c16c3aSChris Coulson 159263c16c3aSChris Coulson error = param_set_int(val, kp); 159363c16c3aSChris Coulson 159463c16c3aSChris Coulson aa_g_rawdata_compression_level = clamp(aa_g_rawdata_compression_level, 159570f24a9fSJohn Johansen AA_MIN_CLEVEL, AA_MAX_CLEVEL); 1596f4d6b94bSJon Tourville pr_info("AppArmor: policy rawdata compression level set to %d\n", 159763c16c3aSChris Coulson aa_g_rawdata_compression_level); 159863c16c3aSChris Coulson 159963c16c3aSChris Coulson return error; 160063c16c3aSChris Coulson } 160163c16c3aSChris Coulson 160263c16c3aSChris Coulson static int param_get_aacompressionlevel(char *buffer, 160363c16c3aSChris Coulson const struct kernel_param *kp) 160463c16c3aSChris Coulson { 160563c16c3aSChris Coulson if (!apparmor_enabled) 160663c16c3aSChris Coulson return -EINVAL; 160792de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 160863c16c3aSChris Coulson return -EPERM; 160963c16c3aSChris Coulson return param_get_int(buffer, kp); 161063c16c3aSChris Coulson } 161163c16c3aSChris Coulson 1612e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp) 1613b5e95b48SJohn Johansen { 1614b5e95b48SJohn Johansen if (!apparmor_enabled) 1615b5e95b48SJohn Johansen return -EINVAL; 161692de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1617545de8feSJohn Johansen return -EPERM; 1618b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 1619b5e95b48SJohn Johansen } 1620b5e95b48SJohn Johansen 1621e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp) 1622b5e95b48SJohn Johansen { 1623b5e95b48SJohn Johansen int i; 1624b5e95b48SJohn Johansen 1625b5e95b48SJohn Johansen if (!apparmor_enabled) 1626b5e95b48SJohn Johansen return -EINVAL; 1627b5e95b48SJohn Johansen if (!val) 1628b5e95b48SJohn Johansen return -EINVAL; 162992de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1630545de8feSJohn Johansen return -EPERM; 1631b5e95b48SJohn Johansen 16325d8779a5SAndy Shevchenko i = match_string(audit_mode_names, AUDIT_MAX_INDEX, val); 16335d8779a5SAndy Shevchenko if (i < 0) 16345d8779a5SAndy Shevchenko return -EINVAL; 16355d8779a5SAndy Shevchenko 1636b5e95b48SJohn Johansen aa_g_audit = i; 1637b5e95b48SJohn Johansen return 0; 1638b5e95b48SJohn Johansen } 1639b5e95b48SJohn Johansen 1640e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp) 1641b5e95b48SJohn Johansen { 1642b5e95b48SJohn Johansen if (!apparmor_enabled) 1643b5e95b48SJohn Johansen return -EINVAL; 164492de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_view_capable(NULL)) 1645545de8feSJohn Johansen return -EPERM; 1646b5e95b48SJohn Johansen 16470d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 1648b5e95b48SJohn Johansen } 1649b5e95b48SJohn Johansen 1650e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp) 1651b5e95b48SJohn Johansen { 1652b5e95b48SJohn Johansen int i; 1653b5e95b48SJohn Johansen 1654b5e95b48SJohn Johansen if (!apparmor_enabled) 1655b5e95b48SJohn Johansen return -EINVAL; 1656b5e95b48SJohn Johansen if (!val) 1657b5e95b48SJohn Johansen return -EINVAL; 165892de220aSJohn Johansen if (apparmor_initialized && !aa_current_policy_admin_capable(NULL)) 1659545de8feSJohn Johansen return -EPERM; 1660b5e95b48SJohn Johansen 16615d8779a5SAndy Shevchenko i = match_string(aa_profile_mode_names, APPARMOR_MODE_NAMES_MAX_INDEX, 16625d8779a5SAndy Shevchenko val); 16635d8779a5SAndy Shevchenko if (i < 0) 16645d8779a5SAndy Shevchenko return -EINVAL; 16655d8779a5SAndy Shevchenko 1666b5e95b48SJohn Johansen aa_g_profile_mode = i; 1667b5e95b48SJohn Johansen return 0; 1668b5e95b48SJohn Johansen } 1669b5e95b48SJohn Johansen 1670341c1fdaSJohn Johansen char *aa_get_buffer(bool in_atomic) 1671df323337SSebastian Andrzej Siewior { 1672df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1673df323337SSebastian Andrzej Siewior bool try_again = true; 1674341c1fdaSJohn Johansen gfp_t flags = (GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_NOWARN); 1675df323337SSebastian Andrzej Siewior 1676df323337SSebastian Andrzej Siewior retry: 1677df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1678341c1fdaSJohn Johansen if (buffer_count > reserve_count || 1679341c1fdaSJohn Johansen (in_atomic && !list_empty(&aa_global_buffers))) { 1680df323337SSebastian Andrzej Siewior aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer, 1681df323337SSebastian Andrzej Siewior list); 1682df323337SSebastian Andrzej Siewior list_del(&aa_buf->list); 1683341c1fdaSJohn Johansen buffer_count--; 1684df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1685ba808cb5SKees Cook return aa_buf->buffer; 1686df323337SSebastian Andrzej Siewior } 1687341c1fdaSJohn Johansen if (in_atomic) { 1688341c1fdaSJohn Johansen /* 1689341c1fdaSJohn Johansen * out of reserve buffers and in atomic context so increase 1690341c1fdaSJohn Johansen * how many buffers to keep in reserve 1691341c1fdaSJohn Johansen */ 1692341c1fdaSJohn Johansen reserve_count++; 1693341c1fdaSJohn Johansen flags = GFP_ATOMIC; 1694341c1fdaSJohn Johansen } 1695df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1696df323337SSebastian Andrzej Siewior 1697341c1fdaSJohn Johansen if (!in_atomic) 1698341c1fdaSJohn Johansen might_sleep(); 1699341c1fdaSJohn Johansen aa_buf = kmalloc(aa_g_path_max, flags); 1700df323337SSebastian Andrzej Siewior if (!aa_buf) { 1701df323337SSebastian Andrzej Siewior if (try_again) { 1702df323337SSebastian Andrzej Siewior try_again = false; 1703df323337SSebastian Andrzej Siewior goto retry; 1704df323337SSebastian Andrzej Siewior } 1705df323337SSebastian Andrzej Siewior pr_warn_once("AppArmor: Failed to allocate a memory buffer.\n"); 1706df323337SSebastian Andrzej Siewior return NULL; 1707df323337SSebastian Andrzej Siewior } 1708ba808cb5SKees Cook return aa_buf->buffer; 1709df323337SSebastian Andrzej Siewior } 1710df323337SSebastian Andrzej Siewior 1711df323337SSebastian Andrzej Siewior void aa_put_buffer(char *buf) 1712df323337SSebastian Andrzej Siewior { 1713df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1714df323337SSebastian Andrzej Siewior 1715df323337SSebastian Andrzej Siewior if (!buf) 1716df323337SSebastian Andrzej Siewior return; 1717df323337SSebastian Andrzej Siewior aa_buf = container_of(buf, union aa_buffer, buffer[0]); 1718df323337SSebastian Andrzej Siewior 1719df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1720df323337SSebastian Andrzej Siewior list_add(&aa_buf->list, &aa_global_buffers); 1721341c1fdaSJohn Johansen buffer_count++; 1722df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1723df323337SSebastian Andrzej Siewior } 1724df323337SSebastian Andrzej Siewior 1725b5e95b48SJohn Johansen /* 1726b5e95b48SJohn Johansen * AppArmor init functions 1727b5e95b48SJohn Johansen */ 1728b5e95b48SJohn Johansen 1729b5e95b48SJohn Johansen /** 173055a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 1731b5e95b48SJohn Johansen * 1732b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 1733b5e95b48SJohn Johansen */ 173455a26ebfSJohn Johansen static int __init set_init_ctx(void) 1735b5e95b48SJohn Johansen { 1736bf1d2ee7SBharath Vedartham struct cred *cred = (__force struct cred *)current->real_cred; 1737b5e95b48SJohn Johansen 173869b5a44aSCasey Schaufler set_cred_label(cred, aa_get_label(ns_unconfined(root_ns))); 1739b5e95b48SJohn Johansen 1740b5e95b48SJohn Johansen return 0; 1741b5e95b48SJohn Johansen } 1742b5e95b48SJohn Johansen 1743d4669f0bSJohn Johansen static void destroy_buffers(void) 1744d4669f0bSJohn Johansen { 1745df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1746d4669f0bSJohn Johansen 1747df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1748df323337SSebastian Andrzej Siewior while (!list_empty(&aa_global_buffers)) { 1749df323337SSebastian Andrzej Siewior aa_buf = list_first_entry(&aa_global_buffers, union aa_buffer, 1750df323337SSebastian Andrzej Siewior list); 1751df323337SSebastian Andrzej Siewior list_del(&aa_buf->list); 1752df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1753df323337SSebastian Andrzej Siewior kfree(aa_buf); 1754df323337SSebastian Andrzej Siewior spin_lock(&aa_buffers_lock); 1755d4669f0bSJohn Johansen } 1756df323337SSebastian Andrzej Siewior spin_unlock(&aa_buffers_lock); 1757d4669f0bSJohn Johansen } 1758d4669f0bSJohn Johansen 1759d4669f0bSJohn Johansen static int __init alloc_buffers(void) 1760d4669f0bSJohn Johansen { 1761df323337SSebastian Andrzej Siewior union aa_buffer *aa_buf; 1762df323337SSebastian Andrzej Siewior int i, num; 1763d4669f0bSJohn Johansen 1764df323337SSebastian Andrzej Siewior /* 1765df323337SSebastian Andrzej Siewior * A function may require two buffers at once. Usually the buffers are 1766df323337SSebastian Andrzej Siewior * used for a short period of time and are shared. On UP kernel buffers 1767df323337SSebastian Andrzej Siewior * two should be enough, with more CPUs it is possible that more 1768df323337SSebastian Andrzej Siewior * buffers will be used simultaneously. The preallocated pool may grow. 1769df323337SSebastian Andrzej Siewior * This preallocation has also the side-effect that AppArmor will be 1770df323337SSebastian Andrzej Siewior * disabled early at boot if aa_g_path_max is extremly high. 1771df323337SSebastian Andrzej Siewior */ 1772df323337SSebastian Andrzej Siewior if (num_online_cpus() > 1) 1773341c1fdaSJohn Johansen num = 4 + RESERVE_COUNT; 1774d4669f0bSJohn Johansen else 1775341c1fdaSJohn Johansen num = 2 + RESERVE_COUNT; 1776df323337SSebastian Andrzej Siewior 1777df323337SSebastian Andrzej Siewior for (i = 0; i < num; i++) { 1778df323337SSebastian Andrzej Siewior 1779df323337SSebastian Andrzej Siewior aa_buf = kmalloc(aa_g_path_max, GFP_KERNEL | 1780df323337SSebastian Andrzej Siewior __GFP_RETRY_MAYFAIL | __GFP_NOWARN); 1781df323337SSebastian Andrzej Siewior if (!aa_buf) { 1782d4669f0bSJohn Johansen destroy_buffers(); 1783d4669f0bSJohn Johansen return -ENOMEM; 1784d4669f0bSJohn Johansen } 1785ba808cb5SKees Cook aa_put_buffer(aa_buf->buffer); 1786d4669f0bSJohn Johansen } 1787d4669f0bSJohn Johansen return 0; 1788d4669f0bSJohn Johansen } 1789d4669f0bSJohn Johansen 1790e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 1791e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 179232927393SChristoph Hellwig void *buffer, size_t *lenp, loff_t *ppos) 1793e3ea1ca5STyler Hicks { 179492de220aSJohn Johansen if (!aa_current_policy_admin_capable(NULL)) 1795e3ea1ca5STyler Hicks return -EPERM; 1796e3ea1ca5STyler Hicks if (!apparmor_enabled) 1797e3ea1ca5STyler Hicks return -EINVAL; 1798e3ea1ca5STyler Hicks 1799e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 1800e3ea1ca5STyler Hicks } 1801e3ea1ca5STyler Hicks 1802e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 1803e3ea1ca5STyler Hicks { 1804e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 1805e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 1806e3ea1ca5STyler Hicks .maxlen = sizeof(int), 1807e3ea1ca5STyler Hicks .mode = 0600, 1808e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 1809e3ea1ca5STyler Hicks }, 1810524d8e14SJohn Johansen { 1811524d8e14SJohn Johansen .procname = "apparmor_display_secid_mode", 1812524d8e14SJohn Johansen .data = &apparmor_display_secid_mode, 1813524d8e14SJohn Johansen .maxlen = sizeof(int), 1814524d8e14SJohn Johansen .mode = 0600, 1815524d8e14SJohn Johansen .proc_handler = apparmor_dointvec, 1816524d8e14SJohn Johansen }, 1817524d8e14SJohn Johansen 1818e3ea1ca5STyler Hicks { } 1819e3ea1ca5STyler Hicks }; 1820e3ea1ca5STyler Hicks 1821e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 1822e3ea1ca5STyler Hicks { 182396200952SLuis Chamberlain return register_sysctl("kernel", apparmor_sysctl_table) ? 0 : -ENOMEM; 1824e3ea1ca5STyler Hicks } 1825e3ea1ca5STyler Hicks #else 1826e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 1827e3ea1ca5STyler Hicks { 1828e3ea1ca5STyler Hicks return 0; 1829e3ea1ca5STyler Hicks } 1830e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 1831e3ea1ca5STyler Hicks 1832e1af4779SArnd Bergmann #if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK) 1833ab9f2115SMatthew Garrett static unsigned int apparmor_ip_postroute(void *priv, 1834ab9f2115SMatthew Garrett struct sk_buff *skb, 1835ab9f2115SMatthew Garrett const struct nf_hook_state *state) 1836ab9f2115SMatthew Garrett { 1837ab9f2115SMatthew Garrett struct aa_sk_ctx *ctx; 1838ab9f2115SMatthew Garrett struct sock *sk; 1839ab9f2115SMatthew Garrett 1840ab9f2115SMatthew Garrett if (!skb->secmark) 1841ab9f2115SMatthew Garrett return NF_ACCEPT; 1842ab9f2115SMatthew Garrett 1843ab9f2115SMatthew Garrett sk = skb_to_full_sk(skb); 1844ab9f2115SMatthew Garrett if (sk == NULL) 1845ab9f2115SMatthew Garrett return NF_ACCEPT; 1846ab9f2115SMatthew Garrett 1847ab9f2115SMatthew Garrett ctx = SK_CTX(sk); 1848ab9f2115SMatthew Garrett if (!apparmor_secmark_check(ctx->label, OP_SENDMSG, AA_MAY_SEND, 1849ab9f2115SMatthew Garrett skb->secmark, sk)) 1850ab9f2115SMatthew Garrett return NF_ACCEPT; 1851ab9f2115SMatthew Garrett 1852ab9f2115SMatthew Garrett return NF_DROP_ERR(-ECONNREFUSED); 1853ab9f2115SMatthew Garrett 1854ab9f2115SMatthew Garrett } 1855ab9f2115SMatthew Garrett 1856ab9f2115SMatthew Garrett static const struct nf_hook_ops apparmor_nf_ops[] = { 1857ab9f2115SMatthew Garrett { 18587b721124SFlorian Westphal .hook = apparmor_ip_postroute, 1859ab9f2115SMatthew Garrett .pf = NFPROTO_IPV4, 1860ab9f2115SMatthew Garrett .hooknum = NF_INET_POST_ROUTING, 1861ab9f2115SMatthew Garrett .priority = NF_IP_PRI_SELINUX_FIRST, 1862ab9f2115SMatthew Garrett }, 1863ab9f2115SMatthew Garrett #if IS_ENABLED(CONFIG_IPV6) 1864ab9f2115SMatthew Garrett { 18657b721124SFlorian Westphal .hook = apparmor_ip_postroute, 1866ab9f2115SMatthew Garrett .pf = NFPROTO_IPV6, 1867ab9f2115SMatthew Garrett .hooknum = NF_INET_POST_ROUTING, 1868ab9f2115SMatthew Garrett .priority = NF_IP6_PRI_SELINUX_FIRST, 1869ab9f2115SMatthew Garrett }, 1870ab9f2115SMatthew Garrett #endif 1871ab9f2115SMatthew Garrett }; 1872ab9f2115SMatthew Garrett 1873ab9f2115SMatthew Garrett static int __net_init apparmor_nf_register(struct net *net) 1874ab9f2115SMatthew Garrett { 187584117994SMinghao Chi return nf_register_net_hooks(net, apparmor_nf_ops, 1876ab9f2115SMatthew Garrett ARRAY_SIZE(apparmor_nf_ops)); 1877ab9f2115SMatthew Garrett } 1878ab9f2115SMatthew Garrett 1879ab9f2115SMatthew Garrett static void __net_exit apparmor_nf_unregister(struct net *net) 1880ab9f2115SMatthew Garrett { 1881ab9f2115SMatthew Garrett nf_unregister_net_hooks(net, apparmor_nf_ops, 1882ab9f2115SMatthew Garrett ARRAY_SIZE(apparmor_nf_ops)); 1883ab9f2115SMatthew Garrett } 1884ab9f2115SMatthew Garrett 1885ab9f2115SMatthew Garrett static struct pernet_operations apparmor_net_ops = { 1886ab9f2115SMatthew Garrett .init = apparmor_nf_register, 1887ab9f2115SMatthew Garrett .exit = apparmor_nf_unregister, 1888ab9f2115SMatthew Garrett }; 1889ab9f2115SMatthew Garrett 1890ab9f2115SMatthew Garrett static int __init apparmor_nf_ip_init(void) 1891ab9f2115SMatthew Garrett { 1892ab9f2115SMatthew Garrett int err; 1893ab9f2115SMatthew Garrett 1894ab9f2115SMatthew Garrett if (!apparmor_enabled) 1895ab9f2115SMatthew Garrett return 0; 1896ab9f2115SMatthew Garrett 1897ab9f2115SMatthew Garrett err = register_pernet_subsys(&apparmor_net_ops); 1898ab9f2115SMatthew Garrett if (err) 1899ab9f2115SMatthew Garrett panic("Apparmor: register_pernet_subsys: error %d\n", err); 1900ab9f2115SMatthew Garrett 1901ab9f2115SMatthew Garrett return 0; 1902ab9f2115SMatthew Garrett } 1903ab9f2115SMatthew Garrett __initcall(apparmor_nf_ip_init); 1904e1af4779SArnd Bergmann #endif 1905ab9f2115SMatthew Garrett 1906b5e95b48SJohn Johansen static int __init apparmor_init(void) 1907b5e95b48SJohn Johansen { 1908b5e95b48SJohn Johansen int error; 1909b5e95b48SJohn Johansen 191011c236b8SJohn Johansen error = aa_setup_dfa_engine(); 191111c236b8SJohn Johansen if (error) { 191211c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 191311c236b8SJohn Johansen goto alloc_out; 191411c236b8SJohn Johansen } 191511c236b8SJohn Johansen 1916b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 1917b5e95b48SJohn Johansen if (error) { 1918b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 1919b5e95b48SJohn Johansen goto alloc_out; 1920b5e95b48SJohn Johansen } 1921b5e95b48SJohn Johansen 1922e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 1923e3ea1ca5STyler Hicks if (error) { 1924e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 1925e3ea1ca5STyler Hicks goto alloc_out; 1926e3ea1ca5STyler Hicks 1927e3ea1ca5STyler Hicks } 1928e3ea1ca5STyler Hicks 1929d4669f0bSJohn Johansen error = alloc_buffers(); 1930d4669f0bSJohn Johansen if (error) { 1931d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 1932df323337SSebastian Andrzej Siewior goto alloc_out; 1933d4669f0bSJohn Johansen } 1934d4669f0bSJohn Johansen 193555a26ebfSJohn Johansen error = set_init_ctx(); 1936b5e95b48SJohn Johansen if (error) { 1937b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1938b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1939d4669f0bSJohn Johansen goto buffers_out; 1940b5e95b48SJohn Johansen } 1941d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1942d69dece5SCasey Schaufler "apparmor"); 1943b5e95b48SJohn Johansen 1944b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1945b5e95b48SJohn Johansen apparmor_initialized = 1; 1946b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1947b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1948b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1949b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1950b5e95b48SJohn Johansen else 1951b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1952b5e95b48SJohn Johansen 1953b5e95b48SJohn Johansen return error; 1954b5e95b48SJohn Johansen 1955d4669f0bSJohn Johansen buffers_out: 1956d4669f0bSJohn Johansen destroy_buffers(); 1957b5e95b48SJohn Johansen alloc_out: 1958b5e95b48SJohn Johansen aa_destroy_aafs(); 195911c236b8SJohn Johansen aa_teardown_dfa_engine(); 1960b5e95b48SJohn Johansen 1961954317feSThomas Meyer apparmor_enabled = false; 1962b5e95b48SJohn Johansen return error; 1963b5e95b48SJohn Johansen } 1964b5e95b48SJohn Johansen 19653d6e5f6dSKees Cook DEFINE_LSM(apparmor) = { 196607aed2f2SKees Cook .name = "apparmor", 196714bd99c8SKees Cook .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, 1968c5459b82SKees Cook .enabled = &apparmor_enabled, 1969bbd3662aSCasey Schaufler .blobs = &apparmor_blob_sizes, 19703d6e5f6dSKees Cook .init = apparmor_init, 19713d6e5f6dSKees Cook }; 1972