1b5e95b48SJohn Johansen /* 2b5e95b48SJohn Johansen * AppArmor security module 3b5e95b48SJohn Johansen * 4b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 5b5e95b48SJohn Johansen * 6b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 7b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 8b5e95b48SJohn Johansen * 9b5e95b48SJohn Johansen * This program is free software; you can redistribute it and/or 10b5e95b48SJohn Johansen * modify it under the terms of the GNU General Public License as 11b5e95b48SJohn Johansen * published by the Free Software Foundation, version 2 of the 12b5e95b48SJohn Johansen * License. 13b5e95b48SJohn Johansen */ 14b5e95b48SJohn Johansen 153c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 16b5e95b48SJohn Johansen #include <linux/moduleparam.h> 17b5e95b48SJohn Johansen #include <linux/mm.h> 18b5e95b48SJohn Johansen #include <linux/mman.h> 19b5e95b48SJohn Johansen #include <linux/mount.h> 20b5e95b48SJohn Johansen #include <linux/namei.h> 21b5e95b48SJohn Johansen #include <linux/ptrace.h> 22b5e95b48SJohn Johansen #include <linux/ctype.h> 23b5e95b48SJohn Johansen #include <linux/sysctl.h> 24b5e95b48SJohn Johansen #include <linux/audit.h> 253486740aSSerge E. Hallyn #include <linux/user_namespace.h> 26e025be0fSWilliam Hua #include <linux/kmemleak.h> 27b5e95b48SJohn Johansen #include <net/sock.h> 28b5e95b48SJohn Johansen 29b5e95b48SJohn Johansen #include "include/apparmor.h" 30b5e95b48SJohn Johansen #include "include/apparmorfs.h" 31b5e95b48SJohn Johansen #include "include/audit.h" 32b5e95b48SJohn Johansen #include "include/capability.h" 33b5e95b48SJohn Johansen #include "include/context.h" 34b5e95b48SJohn Johansen #include "include/file.h" 35b5e95b48SJohn Johansen #include "include/ipc.h" 36b5e95b48SJohn Johansen #include "include/path.h" 37637f688dSJohn Johansen #include "include/label.h" 38b5e95b48SJohn Johansen #include "include/policy.h" 39cff281f6SJohn Johansen #include "include/policy_ns.h" 40b5e95b48SJohn Johansen #include "include/procattr.h" 412ea3ffb7SJohn Johansen #include "include/mount.h" 42b5e95b48SJohn Johansen 43b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 44545de8feSJohn Johansen int apparmor_initialized; 45b5e95b48SJohn Johansen 46d4669f0bSJohn Johansen DEFINE_PER_CPU(struct aa_buffers, aa_buffers); 47d4669f0bSJohn Johansen 48d4669f0bSJohn Johansen 49b5e95b48SJohn Johansen /* 50b5e95b48SJohn Johansen * LSM hook functions 51b5e95b48SJohn Johansen */ 52b5e95b48SJohn Johansen 53b5e95b48SJohn Johansen /* 54d9087c49SJohn Johansen * put the associated labels 55b5e95b48SJohn Johansen */ 56b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 57b5e95b48SJohn Johansen { 58d9087c49SJohn Johansen aa_put_label(cred_label(cred)); 59d9087c49SJohn Johansen cred_label(cred) = NULL; 60b5e95b48SJohn Johansen } 61b5e95b48SJohn Johansen 62b5e95b48SJohn Johansen /* 63b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 64b5e95b48SJohn Johansen */ 65b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 66b5e95b48SJohn Johansen { 67d9087c49SJohn Johansen cred_label(cred) = NULL; 68b5e95b48SJohn Johansen return 0; 69b5e95b48SJohn Johansen } 70b5e95b48SJohn Johansen 71b5e95b48SJohn Johansen /* 72d9087c49SJohn Johansen * prepare new cred label for modification by prepare_cred block 73b5e95b48SJohn Johansen */ 74b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 75b5e95b48SJohn Johansen gfp_t gfp) 76b5e95b48SJohn Johansen { 77d9087c49SJohn Johansen cred_label(new) = aa_get_newest_label(cred_label(old)); 78b5e95b48SJohn Johansen return 0; 79b5e95b48SJohn Johansen } 80b5e95b48SJohn Johansen 81b5e95b48SJohn Johansen /* 82b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 83b5e95b48SJohn Johansen */ 84b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 85b5e95b48SJohn Johansen { 86d9087c49SJohn Johansen cred_label(new) = aa_get_newest_label(cred_label(old)); 87b5e95b48SJohn Johansen } 88b5e95b48SJohn Johansen 893b529a76SJohn Johansen static void apparmor_task_free(struct task_struct *task) 903b529a76SJohn Johansen { 913b529a76SJohn Johansen 923b529a76SJohn Johansen aa_free_task_ctx(task_ctx(task)); 933b529a76SJohn Johansen task_ctx(task) = NULL; 943b529a76SJohn Johansen } 953b529a76SJohn Johansen 963b529a76SJohn Johansen static int apparmor_task_alloc(struct task_struct *task, 973b529a76SJohn Johansen unsigned long clone_flags) 983b529a76SJohn Johansen { 993b529a76SJohn Johansen struct aa_task_ctx *new = aa_alloc_task_ctx(GFP_KERNEL); 1003b529a76SJohn Johansen 1013b529a76SJohn Johansen if (!new) 1023b529a76SJohn Johansen return -ENOMEM; 1033b529a76SJohn Johansen 1043b529a76SJohn Johansen aa_dup_task_ctx(new, current_task_ctx()); 1053b529a76SJohn Johansen task_ctx(task) = new; 1063b529a76SJohn Johansen 1073b529a76SJohn Johansen return 0; 1083b529a76SJohn Johansen } 1093b529a76SJohn Johansen 110b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 111b5e95b48SJohn Johansen unsigned int mode) 112b5e95b48SJohn Johansen { 113b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 114b2d09ae4SJohn Johansen int error; 115b2d09ae4SJohn Johansen 116b2d09ae4SJohn Johansen tracer = begin_current_label_crit_section(); 117b2d09ae4SJohn Johansen tracee = aa_get_task_label(child); 118b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, 119b2d09ae4SJohn Johansen mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE); 120b2d09ae4SJohn Johansen aa_put_label(tracee); 121b2d09ae4SJohn Johansen end_current_label_crit_section(tracer); 122b2d09ae4SJohn Johansen 123b2d09ae4SJohn Johansen return error; 124b5e95b48SJohn Johansen } 125b5e95b48SJohn Johansen 126b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 127b5e95b48SJohn Johansen { 128b2d09ae4SJohn Johansen struct aa_label *tracer, *tracee; 129b2d09ae4SJohn Johansen int error; 130b2d09ae4SJohn Johansen 131b2d09ae4SJohn Johansen tracee = begin_current_label_crit_section(); 132b2d09ae4SJohn Johansen tracer = aa_get_task_label(parent); 133b2d09ae4SJohn Johansen error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE); 134b2d09ae4SJohn Johansen aa_put_label(tracer); 135b2d09ae4SJohn Johansen end_current_label_crit_section(tracee); 136b2d09ae4SJohn Johansen 137b2d09ae4SJohn Johansen return error; 138b5e95b48SJohn Johansen } 139b5e95b48SJohn Johansen 140b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 141b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 142b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 143b5e95b48SJohn Johansen { 144637f688dSJohn Johansen struct aa_label *label; 145b5e95b48SJohn Johansen const struct cred *cred; 146b5e95b48SJohn Johansen 147b5e95b48SJohn Johansen rcu_read_lock(); 148b5e95b48SJohn Johansen cred = __task_cred(target); 149637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 150c70c86c4SJohn Johansen 151b1d9e6b0SCasey Schaufler /* 152b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 153b1d9e6b0SCasey Schaufler * initialize effective and permitted. 154b1d9e6b0SCasey Schaufler */ 155c70c86c4SJohn Johansen if (!unconfined(label)) { 156c70c86c4SJohn Johansen struct aa_profile *profile; 157c70c86c4SJohn Johansen struct label_it i; 158c70c86c4SJohn Johansen 159c70c86c4SJohn Johansen label_for_each_confined(i, label, profile) { 160c70c86c4SJohn Johansen if (COMPLAIN_MODE(profile)) 161c70c86c4SJohn Johansen continue; 162c70c86c4SJohn Johansen *effective = cap_intersect(*effective, 163c70c86c4SJohn Johansen profile->caps.allow); 164c70c86c4SJohn Johansen *permitted = cap_intersect(*permitted, 165c70c86c4SJohn Johansen profile->caps.allow); 166c70c86c4SJohn Johansen } 167b5e95b48SJohn Johansen } 168b5e95b48SJohn Johansen rcu_read_unlock(); 169637f688dSJohn Johansen aa_put_label(label); 170b5e95b48SJohn Johansen 171b5e95b48SJohn Johansen return 0; 172b5e95b48SJohn Johansen } 173b5e95b48SJohn Johansen 1746a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 1756a9de491SEric Paris int cap, int audit) 176b5e95b48SJohn Johansen { 177637f688dSJohn Johansen struct aa_label *label; 178b1d9e6b0SCasey Schaufler int error = 0; 179b1d9e6b0SCasey Schaufler 180637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 181637f688dSJohn Johansen if (!unconfined(label)) 182c70c86c4SJohn Johansen error = aa_capable(label, cap, audit); 183637f688dSJohn Johansen aa_put_label(label); 184cf797c0eSJohn Johansen 185b5e95b48SJohn Johansen return error; 186b5e95b48SJohn Johansen } 187b5e95b48SJohn Johansen 188b5e95b48SJohn Johansen /** 189b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 190b5e95b48SJohn Johansen * @op: operation being checked 191b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 192b5e95b48SJohn Johansen * @mask: requested permissions mask 193b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 194b5e95b48SJohn Johansen * 195b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 196b5e95b48SJohn Johansen */ 19747f6e5ccSJohn Johansen static int common_perm(const char *op, const struct path *path, u32 mask, 198b5e95b48SJohn Johansen struct path_cond *cond) 199b5e95b48SJohn Johansen { 200637f688dSJohn Johansen struct aa_label *label; 201b5e95b48SJohn Johansen int error = 0; 202b5e95b48SJohn Johansen 203637f688dSJohn Johansen label = __begin_current_label_crit_section(); 204637f688dSJohn Johansen if (!unconfined(label)) 205aebd873eSJohn Johansen error = aa_path_perm(op, label, path, 0, mask, cond); 206637f688dSJohn Johansen __end_current_label_crit_section(label); 207b5e95b48SJohn Johansen 208b5e95b48SJohn Johansen return error; 209b5e95b48SJohn Johansen } 210b5e95b48SJohn Johansen 211b5e95b48SJohn Johansen /** 21231f75bfeSJohn Johansen * common_perm_cond - common permission wrapper around inode cond 21331f75bfeSJohn Johansen * @op: operation being checked 21431f75bfeSJohn Johansen * @path: location to check (NOT NULL) 21531f75bfeSJohn Johansen * @mask: requested permissions mask 21631f75bfeSJohn Johansen * 21731f75bfeSJohn Johansen * Returns: %0 else error code if error or permission denied 21831f75bfeSJohn Johansen */ 21931f75bfeSJohn Johansen static int common_perm_cond(const char *op, const struct path *path, u32 mask) 22031f75bfeSJohn Johansen { 22131f75bfeSJohn Johansen struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 22231f75bfeSJohn Johansen d_backing_inode(path->dentry)->i_mode 22331f75bfeSJohn Johansen }; 22431f75bfeSJohn Johansen 22531f75bfeSJohn Johansen if (!path_mediated_fs(path->dentry)) 22631f75bfeSJohn Johansen return 0; 22731f75bfeSJohn Johansen 22831f75bfeSJohn Johansen return common_perm(op, path, mask, &cond); 22931f75bfeSJohn Johansen } 23031f75bfeSJohn Johansen 23131f75bfeSJohn Johansen /** 232b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 233b5e95b48SJohn Johansen * @op: operation being checked 234b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 235b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 236b5e95b48SJohn Johansen * @mask: requested permissions mask 237b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 238b5e95b48SJohn Johansen * 239b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 240b5e95b48SJohn Johansen */ 24147f6e5ccSJohn Johansen static int common_perm_dir_dentry(const char *op, const struct path *dir, 242b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 243b5e95b48SJohn Johansen struct path_cond *cond) 244b5e95b48SJohn Johansen { 2458486adf0SKees Cook struct path path = { .mnt = dir->mnt, .dentry = dentry }; 246b5e95b48SJohn Johansen 247b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 248b5e95b48SJohn Johansen } 249b5e95b48SJohn Johansen 250b5e95b48SJohn Johansen /** 251b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 252b5e95b48SJohn Johansen * @op: operation being checked 253b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 254b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 255b5e95b48SJohn Johansen * @mask: requested permission mask 256b5e95b48SJohn Johansen * 257b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 258b5e95b48SJohn Johansen */ 25947f6e5ccSJohn Johansen static int common_perm_rm(const char *op, const struct path *dir, 260b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 261b5e95b48SJohn Johansen { 262c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 263b5e95b48SJohn Johansen struct path_cond cond = { }; 264b5e95b48SJohn Johansen 265efeee83aSJohn Johansen if (!inode || !path_mediated_fs(dentry)) 266b5e95b48SJohn Johansen return 0; 267b5e95b48SJohn Johansen 268b5e95b48SJohn Johansen cond.uid = inode->i_uid; 269b5e95b48SJohn Johansen cond.mode = inode->i_mode; 270b5e95b48SJohn Johansen 271b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 272b5e95b48SJohn Johansen } 273b5e95b48SJohn Johansen 274b5e95b48SJohn Johansen /** 275b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 276b5e95b48SJohn Johansen * @op: operation being checked 277b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 278b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 279b5e95b48SJohn Johansen * @mask: request permission mask 280b5e95b48SJohn Johansen * @mode: created file mode 281b5e95b48SJohn Johansen * 282b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 283b5e95b48SJohn Johansen */ 28447f6e5ccSJohn Johansen static int common_perm_create(const char *op, const struct path *dir, 285d6b49f7aSAl Viro struct dentry *dentry, u32 mask, umode_t mode) 286b5e95b48SJohn Johansen { 287b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 288b5e95b48SJohn Johansen 289efeee83aSJohn Johansen if (!path_mediated_fs(dir->dentry)) 290b5e95b48SJohn Johansen return 0; 291b5e95b48SJohn Johansen 292b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 293b5e95b48SJohn Johansen } 294b5e95b48SJohn Johansen 295989f74e0SAl Viro static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry) 296b5e95b48SJohn Johansen { 297b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 298b5e95b48SJohn Johansen } 299b5e95b48SJohn Johansen 300d3607752SAl Viro static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry, 3014572befeSAl Viro umode_t mode) 302b5e95b48SJohn Johansen { 303b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 304b5e95b48SJohn Johansen S_IFDIR); 305b5e95b48SJohn Johansen } 306b5e95b48SJohn Johansen 307989f74e0SAl Viro static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry) 308b5e95b48SJohn Johansen { 309b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 310b5e95b48SJohn Johansen } 311b5e95b48SJohn Johansen 312d3607752SAl Viro static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry, 31304fc66e7SAl Viro umode_t mode, unsigned int dev) 314b5e95b48SJohn Johansen { 315b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 316b5e95b48SJohn Johansen } 317b5e95b48SJohn Johansen 31881f4c506SAl Viro static int apparmor_path_truncate(const struct path *path) 319b5e95b48SJohn Johansen { 320e53cfe6cSJohn Johansen return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR); 321b5e95b48SJohn Johansen } 322b5e95b48SJohn Johansen 323d3607752SAl Viro static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry, 324b5e95b48SJohn Johansen const char *old_name) 325b5e95b48SJohn Johansen { 326b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 327b5e95b48SJohn Johansen S_IFLNK); 328b5e95b48SJohn Johansen } 329b5e95b48SJohn Johansen 3303ccee46aSAl Viro static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir, 331b5e95b48SJohn Johansen struct dentry *new_dentry) 332b5e95b48SJohn Johansen { 333637f688dSJohn Johansen struct aa_label *label; 334b5e95b48SJohn Johansen int error = 0; 335b5e95b48SJohn Johansen 336efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 337b5e95b48SJohn Johansen return 0; 338b5e95b48SJohn Johansen 339637f688dSJohn Johansen label = begin_current_label_crit_section(); 340637f688dSJohn Johansen if (!unconfined(label)) 3418014370fSJohn Johansen error = aa_path_link(label, old_dentry, new_dir, new_dentry); 342637f688dSJohn Johansen end_current_label_crit_section(label); 343cf797c0eSJohn Johansen 344b5e95b48SJohn Johansen return error; 345b5e95b48SJohn Johansen } 346b5e95b48SJohn Johansen 3473ccee46aSAl Viro static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry, 3483ccee46aSAl Viro const struct path *new_dir, struct dentry *new_dentry) 349b5e95b48SJohn Johansen { 350637f688dSJohn Johansen struct aa_label *label; 351b5e95b48SJohn Johansen int error = 0; 352b5e95b48SJohn Johansen 353efeee83aSJohn Johansen if (!path_mediated_fs(old_dentry)) 354b5e95b48SJohn Johansen return 0; 355b5e95b48SJohn Johansen 356637f688dSJohn Johansen label = begin_current_label_crit_section(); 357637f688dSJohn Johansen if (!unconfined(label)) { 3588486adf0SKees Cook struct path old_path = { .mnt = old_dir->mnt, 3598486adf0SKees Cook .dentry = old_dentry }; 3608486adf0SKees Cook struct path new_path = { .mnt = new_dir->mnt, 3618486adf0SKees Cook .dentry = new_dentry }; 362c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(old_dentry)->i_uid, 363c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 364b5e95b48SJohn Johansen }; 365b5e95b48SJohn Johansen 366aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0, 367e53cfe6cSJohn Johansen MAY_READ | AA_MAY_GETATTR | MAY_WRITE | 368e53cfe6cSJohn Johansen AA_MAY_SETATTR | AA_MAY_DELETE, 369b5e95b48SJohn Johansen &cond); 370b5e95b48SJohn Johansen if (!error) 371aebd873eSJohn Johansen error = aa_path_perm(OP_RENAME_DEST, label, &new_path, 372e53cfe6cSJohn Johansen 0, MAY_WRITE | AA_MAY_SETATTR | 373b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 374b5e95b48SJohn Johansen 375b5e95b48SJohn Johansen } 376637f688dSJohn Johansen end_current_label_crit_section(label); 377cf797c0eSJohn Johansen 378b5e95b48SJohn Johansen return error; 379b5e95b48SJohn Johansen } 380b5e95b48SJohn Johansen 381be01f9f2SAl Viro static int apparmor_path_chmod(const struct path *path, umode_t mode) 382b5e95b48SJohn Johansen { 38331f75bfeSJohn Johansen return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD); 384b5e95b48SJohn Johansen } 385b5e95b48SJohn Johansen 3867fd25dacSAl Viro static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 387b5e95b48SJohn Johansen { 38831f75bfeSJohn Johansen return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN); 389b5e95b48SJohn Johansen } 390b5e95b48SJohn Johansen 3913f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 392b5e95b48SJohn Johansen { 393e53cfe6cSJohn Johansen return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR); 394b5e95b48SJohn Johansen } 395b5e95b48SJohn Johansen 39683d49856SEric Paris static int apparmor_file_open(struct file *file, const struct cred *cred) 397b5e95b48SJohn Johansen { 398637f688dSJohn Johansen struct aa_file_ctx *fctx = file_ctx(file); 399637f688dSJohn Johansen struct aa_label *label; 400b5e95b48SJohn Johansen int error = 0; 401b5e95b48SJohn Johansen 402efeee83aSJohn Johansen if (!path_mediated_fs(file->f_path.dentry)) 403b5e95b48SJohn Johansen return 0; 404b5e95b48SJohn Johansen 405b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 406b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 407b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 408b5e95b48SJohn Johansen * actually execute the image. 409b5e95b48SJohn Johansen */ 410b5e95b48SJohn Johansen if (current->in_execve) { 41155a26ebfSJohn Johansen fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 412b5e95b48SJohn Johansen return 0; 413b5e95b48SJohn Johansen } 414b5e95b48SJohn Johansen 415637f688dSJohn Johansen label = aa_get_newest_cred_label(cred); 416637f688dSJohn Johansen if (!unconfined(label)) { 417496ad9aaSAl Viro struct inode *inode = file_inode(file); 418b5e95b48SJohn Johansen struct path_cond cond = { inode->i_uid, inode->i_mode }; 419b5e95b48SJohn Johansen 420aebd873eSJohn Johansen error = aa_path_perm(OP_OPEN, label, &file->f_path, 0, 421b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 422b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 42355a26ebfSJohn Johansen fctx->allow = aa_map_file_to_perms(file); 424b5e95b48SJohn Johansen } 425637f688dSJohn Johansen aa_put_label(label); 426b5e95b48SJohn Johansen 427b5e95b48SJohn Johansen return error; 428b5e95b48SJohn Johansen } 429b5e95b48SJohn Johansen 430b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 431b5e95b48SJohn Johansen { 432cf797c0eSJohn Johansen int error = 0; 433cf797c0eSJohn Johansen 434b5e95b48SJohn Johansen /* freed by apparmor_file_free_security */ 435637f688dSJohn Johansen struct aa_label *label = begin_current_label_crit_section(); 436190a9518SJohn Johansen file->f_security = aa_alloc_file_ctx(label, GFP_KERNEL); 4372835a13bSJohn Johansen if (!file_ctx(file)) 4382835a13bSJohn Johansen error = -ENOMEM; 439637f688dSJohn Johansen end_current_label_crit_section(label); 440b5e95b48SJohn Johansen 441cf797c0eSJohn Johansen return error; 442b5e95b48SJohn Johansen } 443b5e95b48SJohn Johansen 444b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 445b5e95b48SJohn Johansen { 4462835a13bSJohn Johansen aa_free_file_ctx(file_ctx(file)); 447b5e95b48SJohn Johansen } 448b5e95b48SJohn Johansen 44947f6e5ccSJohn Johansen static int common_file_perm(const char *op, struct file *file, u32 mask) 450b5e95b48SJohn Johansen { 451190a9518SJohn Johansen struct aa_label *label; 452b5e95b48SJohn Johansen int error = 0; 453b5e95b48SJohn Johansen 454192ca6b5SJohn Johansen /* don't reaudit files closed during inheritance */ 455192ca6b5SJohn Johansen if (file->f_path.dentry == aa_null.dentry) 456192ca6b5SJohn Johansen return -EACCES; 457192ca6b5SJohn Johansen 458637f688dSJohn Johansen label = __begin_current_label_crit_section(); 459190a9518SJohn Johansen error = aa_file_perm(op, label, file, mask); 460637f688dSJohn Johansen __end_current_label_crit_section(label); 461b5e95b48SJohn Johansen 462b5e95b48SJohn Johansen return error; 463b5e95b48SJohn Johansen } 464b5e95b48SJohn Johansen 465064dc947SJohn Johansen static int apparmor_file_receive(struct file *file) 466064dc947SJohn Johansen { 467064dc947SJohn Johansen return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file)); 468064dc947SJohn Johansen } 469064dc947SJohn Johansen 470b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 471b5e95b48SJohn Johansen { 472b5e95b48SJohn Johansen return common_file_perm(OP_FPERM, file, mask); 473b5e95b48SJohn Johansen } 474b5e95b48SJohn Johansen 475b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 476b5e95b48SJohn Johansen { 477b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 478b5e95b48SJohn Johansen 479b5e95b48SJohn Johansen if (cmd == F_WRLCK) 480b5e95b48SJohn Johansen mask |= MAY_WRITE; 481b5e95b48SJohn Johansen 482b5e95b48SJohn Johansen return common_file_perm(OP_FLOCK, file, mask); 483b5e95b48SJohn Johansen } 484b5e95b48SJohn Johansen 48547f6e5ccSJohn Johansen static int common_mmap(const char *op, struct file *file, unsigned long prot, 486b5e95b48SJohn Johansen unsigned long flags) 487b5e95b48SJohn Johansen { 488b5e95b48SJohn Johansen int mask = 0; 489b5e95b48SJohn Johansen 490637f688dSJohn Johansen if (!file || !file_ctx(file)) 491b5e95b48SJohn Johansen return 0; 492b5e95b48SJohn Johansen 493b5e95b48SJohn Johansen if (prot & PROT_READ) 494b5e95b48SJohn Johansen mask |= MAY_READ; 495b5e95b48SJohn Johansen /* 496b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 497b5e95b48SJohn Johansen * write back to the files 498b5e95b48SJohn Johansen */ 499b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 500b5e95b48SJohn Johansen mask |= MAY_WRITE; 501b5e95b48SJohn Johansen if (prot & PROT_EXEC) 502b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 503b5e95b48SJohn Johansen 504b5e95b48SJohn Johansen return common_file_perm(op, file, mask); 505b5e95b48SJohn Johansen } 506b5e95b48SJohn Johansen 507e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 508e5467859SAl Viro unsigned long prot, unsigned long flags) 509b5e95b48SJohn Johansen { 510b5e95b48SJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags); 511b5e95b48SJohn Johansen } 512b5e95b48SJohn Johansen 513b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 514b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 515b5e95b48SJohn Johansen { 516b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 517b5e95b48SJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); 518b5e95b48SJohn Johansen } 519b5e95b48SJohn Johansen 5202ea3ffb7SJohn Johansen static int apparmor_sb_mount(const char *dev_name, const struct path *path, 5212ea3ffb7SJohn Johansen const char *type, unsigned long flags, void *data) 5222ea3ffb7SJohn Johansen { 5232ea3ffb7SJohn Johansen struct aa_label *label; 5242ea3ffb7SJohn Johansen int error = 0; 5252ea3ffb7SJohn Johansen 5262ea3ffb7SJohn Johansen /* Discard magic */ 5272ea3ffb7SJohn Johansen if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 5282ea3ffb7SJohn Johansen flags &= ~MS_MGC_MSK; 5292ea3ffb7SJohn Johansen 5302ea3ffb7SJohn Johansen flags &= ~AA_MS_IGNORE_MASK; 5312ea3ffb7SJohn Johansen 5322ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5332ea3ffb7SJohn Johansen if (!unconfined(label)) { 5342ea3ffb7SJohn Johansen if (flags & MS_REMOUNT) 5352ea3ffb7SJohn Johansen error = aa_remount(label, path, flags, data); 5362ea3ffb7SJohn Johansen else if (flags & MS_BIND) 5372ea3ffb7SJohn Johansen error = aa_bind_mount(label, path, dev_name, flags); 5382ea3ffb7SJohn Johansen else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | 5392ea3ffb7SJohn Johansen MS_UNBINDABLE)) 5402ea3ffb7SJohn Johansen error = aa_mount_change_type(label, path, flags); 5412ea3ffb7SJohn Johansen else if (flags & MS_MOVE) 5422ea3ffb7SJohn Johansen error = aa_move_mount(label, path, dev_name); 5432ea3ffb7SJohn Johansen else 5442ea3ffb7SJohn Johansen error = aa_new_mount(label, dev_name, path, type, 5452ea3ffb7SJohn Johansen flags, data); 5462ea3ffb7SJohn Johansen } 5472ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5482ea3ffb7SJohn Johansen 5492ea3ffb7SJohn Johansen return error; 5502ea3ffb7SJohn Johansen } 5512ea3ffb7SJohn Johansen 5522ea3ffb7SJohn Johansen static int apparmor_sb_umount(struct vfsmount *mnt, int flags) 5532ea3ffb7SJohn Johansen { 5542ea3ffb7SJohn Johansen struct aa_label *label; 5552ea3ffb7SJohn Johansen int error = 0; 5562ea3ffb7SJohn Johansen 5572ea3ffb7SJohn Johansen label = __begin_current_label_crit_section(); 5582ea3ffb7SJohn Johansen if (!unconfined(label)) 5592ea3ffb7SJohn Johansen error = aa_umount(label, mnt, flags); 5602ea3ffb7SJohn Johansen __end_current_label_crit_section(label); 5612ea3ffb7SJohn Johansen 5622ea3ffb7SJohn Johansen return error; 5632ea3ffb7SJohn Johansen } 5642ea3ffb7SJohn Johansen 5652ea3ffb7SJohn Johansen static int apparmor_sb_pivotroot(const struct path *old_path, 5662ea3ffb7SJohn Johansen const struct path *new_path) 5672ea3ffb7SJohn Johansen { 5682ea3ffb7SJohn Johansen struct aa_label *label; 5692ea3ffb7SJohn Johansen int error = 0; 5702ea3ffb7SJohn Johansen 5712ea3ffb7SJohn Johansen label = aa_get_current_label(); 5722ea3ffb7SJohn Johansen if (!unconfined(label)) 5732ea3ffb7SJohn Johansen error = aa_pivotroot(label, old_path, new_path); 5742ea3ffb7SJohn Johansen aa_put_label(label); 5752ea3ffb7SJohn Johansen 5762ea3ffb7SJohn Johansen return error; 5772ea3ffb7SJohn Johansen } 5782ea3ffb7SJohn Johansen 579b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 580b5e95b48SJohn Johansen char **value) 581b5e95b48SJohn Johansen { 582b5e95b48SJohn Johansen int error = -ENOENT; 583b5e95b48SJohn Johansen /* released below */ 584b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 585*f175221aSJohn Johansen struct aa_task_ctx *ctx = current_task_ctx(); 586637f688dSJohn Johansen struct aa_label *label = NULL; 587b5e95b48SJohn Johansen 588b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 589d9087c49SJohn Johansen label = aa_get_newest_label(cred_label(cred)); 590*f175221aSJohn Johansen else if (strcmp(name, "prev") == 0 && ctx->previous) 591*f175221aSJohn Johansen label = aa_get_newest_label(ctx->previous); 592*f175221aSJohn Johansen else if (strcmp(name, "exec") == 0 && ctx->onexec) 593*f175221aSJohn Johansen label = aa_get_newest_label(ctx->onexec); 594b5e95b48SJohn Johansen else 595b5e95b48SJohn Johansen error = -EINVAL; 596b5e95b48SJohn Johansen 597637f688dSJohn Johansen if (label) 59876a1d263SJohn Johansen error = aa_getprocattr(label, value); 59977b071b3SJohn Johansen 600637f688dSJohn Johansen aa_put_label(label); 601b5e95b48SJohn Johansen put_cred(cred); 602b5e95b48SJohn Johansen 603b5e95b48SJohn Johansen return error; 604b5e95b48SJohn Johansen } 605b5e95b48SJohn Johansen 606b21507e2SStephen Smalley static int apparmor_setprocattr(const char *name, void *value, 607b21507e2SStephen Smalley size_t size) 608b5e95b48SJohn Johansen { 609e89b8081SVegard Nossum char *command, *largs = NULL, *args = value; 610b5e95b48SJohn Johansen size_t arg_size; 611b5e95b48SJohn Johansen int error; 612ef88a7acSJohn Johansen DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR); 613b5e95b48SJohn Johansen 614b5e95b48SJohn Johansen if (size == 0) 615b5e95b48SJohn Johansen return -EINVAL; 616b5e95b48SJohn Johansen 617e89b8081SVegard Nossum /* AppArmor requires that the buffer must be null terminated atm */ 618e89b8081SVegard Nossum if (args[size - 1] != '\0') { 619e89b8081SVegard Nossum /* null terminate */ 620e89b8081SVegard Nossum largs = args = kmalloc(size + 1, GFP_KERNEL); 621e89b8081SVegard Nossum if (!args) 622e89b8081SVegard Nossum return -ENOMEM; 623e89b8081SVegard Nossum memcpy(args, value, size); 624e89b8081SVegard Nossum args[size] = '\0'; 625e89b8081SVegard Nossum } 626e89b8081SVegard Nossum 627e89b8081SVegard Nossum error = -EINVAL; 628b5e95b48SJohn Johansen args = strim(args); 629b5e95b48SJohn Johansen command = strsep(&args, " "); 630b5e95b48SJohn Johansen if (!args) 631e89b8081SVegard Nossum goto out; 632b5e95b48SJohn Johansen args = skip_spaces(args); 633b5e95b48SJohn Johansen if (!*args) 634e89b8081SVegard Nossum goto out; 635b5e95b48SJohn Johansen 636d4d03f74SJohn Johansen arg_size = size - (args - (largs ? largs : (char *) value)); 637b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 638b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 639b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 640df8073c6SJohn Johansen AA_CHANGE_NOFLAGS); 641b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 642b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 643df8073c6SJohn Johansen AA_CHANGE_TEST); 644b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 645df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_NOFLAGS); 646b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 647df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_TEST); 6486c5fc8f1SJohn Johansen } else if (strcmp(command, "stack") == 0) { 6496c5fc8f1SJohn Johansen error = aa_change_profile(args, AA_CHANGE_STACK); 6503eea57c2SJohn Johansen } else 6513eea57c2SJohn Johansen goto fail; 652b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 6533eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 654df8073c6SJohn Johansen error = aa_change_profile(args, AA_CHANGE_ONEXEC); 6556c5fc8f1SJohn Johansen else if (strcmp(command, "stack") == 0) 6566c5fc8f1SJohn Johansen error = aa_change_profile(args, (AA_CHANGE_ONEXEC | 6576c5fc8f1SJohn Johansen AA_CHANGE_STACK)); 6583eea57c2SJohn Johansen else 6593eea57c2SJohn Johansen goto fail; 6603eea57c2SJohn Johansen } else 661b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 662e89b8081SVegard Nossum goto fail; 6633eea57c2SJohn Johansen 664b5e95b48SJohn Johansen if (!error) 665b5e95b48SJohn Johansen error = size; 666e89b8081SVegard Nossum out: 667e89b8081SVegard Nossum kfree(largs); 668b5e95b48SJohn Johansen return error; 6693eea57c2SJohn Johansen 6703eea57c2SJohn Johansen fail: 671637f688dSJohn Johansen aad(&sa)->label = begin_current_label_crit_section(); 672ef88a7acSJohn Johansen aad(&sa)->info = name; 673ef88a7acSJohn Johansen aad(&sa)->error = error = -EINVAL; 6743eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 675637f688dSJohn Johansen end_current_label_crit_section(aad(&sa)->label); 676e89b8081SVegard Nossum goto out; 677b5e95b48SJohn Johansen } 678b5e95b48SJohn Johansen 679fe864821SJohn Johansen /** 680fe864821SJohn Johansen * apparmor_bprm_committing_creds - do task cleanup on committing new creds 681fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 682fe864821SJohn Johansen */ 683fe864821SJohn Johansen static void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 684fe864821SJohn Johansen { 685637f688dSJohn Johansen struct aa_label *label = aa_current_raw_label(); 686d9087c49SJohn Johansen struct aa_label *new_label = cred_label(bprm->cred); 687fe864821SJohn Johansen 688fe864821SJohn Johansen /* bail out if unconfined or not changing profile */ 689d9087c49SJohn Johansen if ((new_label->proxy == label->proxy) || 690d9087c49SJohn Johansen (unconfined(new_label))) 691fe864821SJohn Johansen return; 692fe864821SJohn Johansen 693192ca6b5SJohn Johansen aa_inherit_files(bprm->cred, current->files); 694192ca6b5SJohn Johansen 695fe864821SJohn Johansen current->pdeath_signal = 0; 696fe864821SJohn Johansen 697637f688dSJohn Johansen /* reset soft limits and set hard limits for the new label */ 698d9087c49SJohn Johansen __aa_transition_rlimits(label, new_label); 699fe864821SJohn Johansen } 700fe864821SJohn Johansen 701fe864821SJohn Johansen /** 702fe864821SJohn Johansen * apparmor_bprm_committed_cred - do cleanup after new creds committed 703fe864821SJohn Johansen * @bprm: binprm for the exec (NOT NULL) 704fe864821SJohn Johansen */ 705fe864821SJohn Johansen static void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 706fe864821SJohn Johansen { 7073b529a76SJohn Johansen /* clear out temporary/transitional state from the context */ 7083b529a76SJohn Johansen aa_clear_task_ctx_trans(current_task_ctx()); 7093b529a76SJohn Johansen 710fe864821SJohn Johansen return; 711fe864821SJohn Johansen } 712fe864821SJohn Johansen 7137cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 7147cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 715b5e95b48SJohn Johansen { 716637f688dSJohn Johansen struct aa_label *label = __begin_current_label_crit_section(); 717b5e95b48SJohn Johansen int error = 0; 718b5e95b48SJohn Johansen 719637f688dSJohn Johansen if (!unconfined(label)) 72086b92cb7SJohn Johansen error = aa_task_setrlimit(label, task, resource, new_rlim); 721637f688dSJohn Johansen __end_current_label_crit_section(label); 722b5e95b48SJohn Johansen 723b5e95b48SJohn Johansen return error; 724b5e95b48SJohn Johansen } 725b5e95b48SJohn Johansen 726cd1dbf76SJohn Johansen static int apparmor_task_kill(struct task_struct *target, struct siginfo *info, 727cd1dbf76SJohn Johansen int sig, u32 secid) 728cd1dbf76SJohn Johansen { 729cd1dbf76SJohn Johansen struct aa_label *cl, *tl; 730cd1dbf76SJohn Johansen int error; 731cd1dbf76SJohn Johansen 732cd1dbf76SJohn Johansen if (secid) 733cd1dbf76SJohn Johansen /* TODO: after secid to label mapping is done. 734cd1dbf76SJohn Johansen * Dealing with USB IO specific behavior 735cd1dbf76SJohn Johansen */ 736cd1dbf76SJohn Johansen return 0; 737cd1dbf76SJohn Johansen cl = __begin_current_label_crit_section(); 738cd1dbf76SJohn Johansen tl = aa_get_task_label(target); 739cd1dbf76SJohn Johansen error = aa_may_signal(cl, tl, sig); 740cd1dbf76SJohn Johansen aa_put_label(tl); 741cd1dbf76SJohn Johansen __end_current_label_crit_section(cl); 742cd1dbf76SJohn Johansen 743cd1dbf76SJohn Johansen return error; 744cd1dbf76SJohn Johansen } 745cd1dbf76SJohn Johansen 746ca97d939SJames Morris static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 747e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 748e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 749e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 750e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 751b5e95b48SJohn Johansen 7522ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), 7532ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), 7542ea3ffb7SJohn Johansen LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), 7552ea3ffb7SJohn Johansen 756e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 757e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 758e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 759e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 760e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 761e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 762e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 763e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 764e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 765e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 766e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 767b5e95b48SJohn Johansen 768e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 769064dc947SJohn Johansen LSM_HOOK_INIT(file_receive, apparmor_file_receive), 770e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 771e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 772e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 773e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 774e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 775e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 776b5e95b48SJohn Johansen 777e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 778e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 779b5e95b48SJohn Johansen 780e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 781e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 782e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 783e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 784b5e95b48SJohn Johansen 785e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds), 786e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 787e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 788b5e95b48SJohn Johansen 7893b529a76SJohn Johansen LSM_HOOK_INIT(task_free, apparmor_task_free), 7903b529a76SJohn Johansen LSM_HOOK_INIT(task_alloc, apparmor_task_alloc), 791e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 792cd1dbf76SJohn Johansen LSM_HOOK_INIT(task_kill, apparmor_task_kill), 793b5e95b48SJohn Johansen }; 794b5e95b48SJohn Johansen 795b5e95b48SJohn Johansen /* 796b5e95b48SJohn Johansen * AppArmor sysfs module parameters 797b5e95b48SJohn Johansen */ 798b5e95b48SJohn Johansen 799101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 800101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 801b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 8029c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 8036a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 804101d6c82SStephen Rothwell .set = param_set_aabool, 805101d6c82SStephen Rothwell .get = param_get_aabool 806101d6c82SStephen Rothwell }; 807b5e95b48SJohn Johansen 808101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 809101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 810b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 8119c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 812101d6c82SStephen Rothwell .set = param_set_aauint, 813101d6c82SStephen Rothwell .get = param_get_aauint 814101d6c82SStephen Rothwell }; 815b5e95b48SJohn Johansen 816101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 817101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 818b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 8199c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 8206a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 821101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 822101d6c82SStephen Rothwell .get = param_get_aalockpolicy 823101d6c82SStephen Rothwell }; 824b5e95b48SJohn Johansen 825e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp); 826e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp); 827b5e95b48SJohn Johansen 828e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp); 829e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp); 830b5e95b48SJohn Johansen 831b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 832b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 833b5e95b48SJohn Johansen */ 834b5e95b48SJohn Johansen 835b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 836b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 837b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 838b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 839b5e95b48SJohn Johansen 8406059f71fSJohn Johansen /* whether policy verification hashing is enabled */ 8417616ac70SArnd Bergmann bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); 8423ccb76c5SJohn Johansen #ifdef CONFIG_SECURITY_APPARMOR_HASH 8436059f71fSJohn Johansen module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); 8447616ac70SArnd Bergmann #endif 8456059f71fSJohn Johansen 846b5e95b48SJohn Johansen /* Debug mode */ 847eea7a05fSValentin Rothberg bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES); 848b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 849b5e95b48SJohn Johansen 850b5e95b48SJohn Johansen /* Audit mode */ 851b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 852b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 853b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 854b5e95b48SJohn Johansen 855b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 856b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 857b5e95b48SJohn Johansen */ 858954317feSThomas Meyer bool aa_g_audit_header = true; 859b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 860b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 861b5e95b48SJohn Johansen 862b5e95b48SJohn Johansen /* lock out loading/removal of policy 863b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 864b5e95b48SJohn Johansen * load policy, if lock_policy is set 865b5e95b48SJohn Johansen */ 86690ab5ee9SRusty Russell bool aa_g_lock_policy; 867b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 868b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 869b5e95b48SJohn Johansen 870b5e95b48SJohn Johansen /* Syscall logging mode */ 87190ab5ee9SRusty Russell bool aa_g_logsyscall; 872b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 873b5e95b48SJohn Johansen 874b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 875b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 876622f6e32SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); 877b5e95b48SJohn Johansen 878b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 879b5e95b48SJohn Johansen * on the loaded policy is done. 880abbf8734SJohn Johansen * DEPRECATED: read only as strict checking of load is always done now 881abbf8734SJohn Johansen * that none root users (user namespaces) can load policy. 882b5e95b48SJohn Johansen */ 883954317feSThomas Meyer bool aa_g_paranoid_load = true; 884abbf8734SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); 885b5e95b48SJohn Johansen 886b5e95b48SJohn Johansen /* Boot time disable flag */ 88790ab5ee9SRusty Russell static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE; 888c611616cSJohn Johansen module_param_named(enabled, apparmor_enabled, bool, S_IRUGO); 889b5e95b48SJohn Johansen 890b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 891b5e95b48SJohn Johansen { 892b5e95b48SJohn Johansen unsigned long enabled; 89329707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 894b5e95b48SJohn Johansen if (!error) 895b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 896b5e95b48SJohn Johansen return 1; 897b5e95b48SJohn Johansen } 898b5e95b48SJohn Johansen 899b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 900b5e95b48SJohn Johansen 901b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 902101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 903b5e95b48SJohn Johansen { 904545de8feSJohn Johansen if (!apparmor_enabled) 905545de8feSJohn Johansen return -EINVAL; 906545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 907b5e95b48SJohn Johansen return -EPERM; 908b5e95b48SJohn Johansen return param_set_bool(val, kp); 909b5e95b48SJohn Johansen } 910b5e95b48SJohn Johansen 911101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 912b5e95b48SJohn Johansen { 913ca4bd5aeSJohn Johansen if (!apparmor_enabled) 914ca4bd5aeSJohn Johansen return -EINVAL; 915545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 916545de8feSJohn Johansen return -EPERM; 917b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 918b5e95b48SJohn Johansen } 919b5e95b48SJohn Johansen 920101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 921b5e95b48SJohn Johansen { 922ca4bd5aeSJohn Johansen if (!apparmor_enabled) 923ca4bd5aeSJohn Johansen return -EINVAL; 924545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 925545de8feSJohn Johansen return -EPERM; 926b5e95b48SJohn Johansen return param_set_bool(val, kp); 927b5e95b48SJohn Johansen } 928b5e95b48SJohn Johansen 929101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 930b5e95b48SJohn Johansen { 931ca4bd5aeSJohn Johansen if (!apparmor_enabled) 932ca4bd5aeSJohn Johansen return -EINVAL; 933545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 934545de8feSJohn Johansen return -EPERM; 935b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 936b5e95b48SJohn Johansen } 937b5e95b48SJohn Johansen 938101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 939b5e95b48SJohn Johansen { 94039d84824SJohn Johansen int error; 94139d84824SJohn Johansen 942ca4bd5aeSJohn Johansen if (!apparmor_enabled) 943ca4bd5aeSJohn Johansen return -EINVAL; 94439d84824SJohn Johansen /* file is ro but enforce 2nd line check */ 94539d84824SJohn Johansen if (apparmor_initialized) 946545de8feSJohn Johansen return -EPERM; 94739d84824SJohn Johansen 94839d84824SJohn Johansen error = param_set_uint(val, kp); 94939d84824SJohn Johansen pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max); 95039d84824SJohn Johansen 95139d84824SJohn Johansen return error; 952b5e95b48SJohn Johansen } 953b5e95b48SJohn Johansen 954101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 955b5e95b48SJohn Johansen { 956ca4bd5aeSJohn Johansen if (!apparmor_enabled) 957ca4bd5aeSJohn Johansen return -EINVAL; 958545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 959545de8feSJohn Johansen return -EPERM; 960b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 961b5e95b48SJohn Johansen } 962b5e95b48SJohn Johansen 963e4dca7b7SKees Cook static int param_get_audit(char *buffer, const struct kernel_param *kp) 964b5e95b48SJohn Johansen { 965b5e95b48SJohn Johansen if (!apparmor_enabled) 966b5e95b48SJohn Johansen return -EINVAL; 967545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 968545de8feSJohn Johansen return -EPERM; 969b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 970b5e95b48SJohn Johansen } 971b5e95b48SJohn Johansen 972e4dca7b7SKees Cook static int param_set_audit(const char *val, const struct kernel_param *kp) 973b5e95b48SJohn Johansen { 974b5e95b48SJohn Johansen int i; 975b5e95b48SJohn Johansen 976b5e95b48SJohn Johansen if (!apparmor_enabled) 977b5e95b48SJohn Johansen return -EINVAL; 978b5e95b48SJohn Johansen if (!val) 979b5e95b48SJohn Johansen return -EINVAL; 980545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 981545de8feSJohn Johansen return -EPERM; 982b5e95b48SJohn Johansen 983b5e95b48SJohn Johansen for (i = 0; i < AUDIT_MAX_INDEX; i++) { 984b5e95b48SJohn Johansen if (strcmp(val, audit_mode_names[i]) == 0) { 985b5e95b48SJohn Johansen aa_g_audit = i; 986b5e95b48SJohn Johansen return 0; 987b5e95b48SJohn Johansen } 988b5e95b48SJohn Johansen } 989b5e95b48SJohn Johansen 990b5e95b48SJohn Johansen return -EINVAL; 991b5e95b48SJohn Johansen } 992b5e95b48SJohn Johansen 993e4dca7b7SKees Cook static int param_get_mode(char *buffer, const struct kernel_param *kp) 994b5e95b48SJohn Johansen { 995b5e95b48SJohn Johansen if (!apparmor_enabled) 996b5e95b48SJohn Johansen return -EINVAL; 997545de8feSJohn Johansen if (apparmor_initialized && !policy_view_capable(NULL)) 998545de8feSJohn Johansen return -EPERM; 999b5e95b48SJohn Johansen 10000d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 1001b5e95b48SJohn Johansen } 1002b5e95b48SJohn Johansen 1003e4dca7b7SKees Cook static int param_set_mode(const char *val, const struct kernel_param *kp) 1004b5e95b48SJohn Johansen { 1005b5e95b48SJohn Johansen int i; 1006b5e95b48SJohn Johansen 1007b5e95b48SJohn Johansen if (!apparmor_enabled) 1008b5e95b48SJohn Johansen return -EINVAL; 1009b5e95b48SJohn Johansen if (!val) 1010b5e95b48SJohn Johansen return -EINVAL; 1011545de8feSJohn Johansen if (apparmor_initialized && !policy_admin_capable(NULL)) 1012545de8feSJohn Johansen return -EPERM; 1013b5e95b48SJohn Johansen 10140d259f04SJohn Johansen for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) { 10150d259f04SJohn Johansen if (strcmp(val, aa_profile_mode_names[i]) == 0) { 1016b5e95b48SJohn Johansen aa_g_profile_mode = i; 1017b5e95b48SJohn Johansen return 0; 1018b5e95b48SJohn Johansen } 1019b5e95b48SJohn Johansen } 1020b5e95b48SJohn Johansen 1021b5e95b48SJohn Johansen return -EINVAL; 1022b5e95b48SJohn Johansen } 1023b5e95b48SJohn Johansen 1024b5e95b48SJohn Johansen /* 1025b5e95b48SJohn Johansen * AppArmor init functions 1026b5e95b48SJohn Johansen */ 1027b5e95b48SJohn Johansen 1028b5e95b48SJohn Johansen /** 102955a26ebfSJohn Johansen * set_init_ctx - set a task context and profile on the first task. 1030b5e95b48SJohn Johansen * 1031b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 1032b5e95b48SJohn Johansen */ 103355a26ebfSJohn Johansen static int __init set_init_ctx(void) 1034b5e95b48SJohn Johansen { 1035b5e95b48SJohn Johansen struct cred *cred = (struct cred *)current->real_cred; 1036*f175221aSJohn Johansen struct aa_task_ctx *ctx; 1037b5e95b48SJohn Johansen 1038*f175221aSJohn Johansen ctx = aa_alloc_task_ctx(GFP_KERNEL); 1039*f175221aSJohn Johansen if (!ctx) 1040d9087c49SJohn Johansen return -ENOMEM; 1041b5e95b48SJohn Johansen 1042d9087c49SJohn Johansen cred_label(cred) = aa_get_label(ns_unconfined(root_ns)); 1043*f175221aSJohn Johansen task_ctx(current) = ctx; 1044b5e95b48SJohn Johansen 1045b5e95b48SJohn Johansen return 0; 1046b5e95b48SJohn Johansen } 1047b5e95b48SJohn Johansen 1048d4669f0bSJohn Johansen static void destroy_buffers(void) 1049d4669f0bSJohn Johansen { 1050d4669f0bSJohn Johansen u32 i, j; 1051d4669f0bSJohn Johansen 1052d4669f0bSJohn Johansen for_each_possible_cpu(i) { 1053d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 1054d4669f0bSJohn Johansen kfree(per_cpu(aa_buffers, i).buf[j]); 1055d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = NULL; 1056d4669f0bSJohn Johansen } 1057d4669f0bSJohn Johansen } 1058d4669f0bSJohn Johansen } 1059d4669f0bSJohn Johansen 1060d4669f0bSJohn Johansen static int __init alloc_buffers(void) 1061d4669f0bSJohn Johansen { 1062d4669f0bSJohn Johansen u32 i, j; 1063d4669f0bSJohn Johansen 1064d4669f0bSJohn Johansen for_each_possible_cpu(i) { 1065d4669f0bSJohn Johansen for_each_cpu_buffer(j) { 1066d4669f0bSJohn Johansen char *buffer; 1067d4669f0bSJohn Johansen 1068d4669f0bSJohn Johansen if (cpu_to_node(i) > num_online_nodes()) 1069d4669f0bSJohn Johansen /* fallback to kmalloc for offline nodes */ 1070d4669f0bSJohn Johansen buffer = kmalloc(aa_g_path_max, GFP_KERNEL); 1071d4669f0bSJohn Johansen else 1072d4669f0bSJohn Johansen buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL, 1073d4669f0bSJohn Johansen cpu_to_node(i)); 1074d4669f0bSJohn Johansen if (!buffer) { 1075d4669f0bSJohn Johansen destroy_buffers(); 1076d4669f0bSJohn Johansen return -ENOMEM; 1077d4669f0bSJohn Johansen } 1078d4669f0bSJohn Johansen per_cpu(aa_buffers, i).buf[j] = buffer; 1079d4669f0bSJohn Johansen } 1080d4669f0bSJohn Johansen } 1081d4669f0bSJohn Johansen 1082d4669f0bSJohn Johansen return 0; 1083d4669f0bSJohn Johansen } 1084d4669f0bSJohn Johansen 1085e3ea1ca5STyler Hicks #ifdef CONFIG_SYSCTL 1086e3ea1ca5STyler Hicks static int apparmor_dointvec(struct ctl_table *table, int write, 1087e3ea1ca5STyler Hicks void __user *buffer, size_t *lenp, loff_t *ppos) 1088e3ea1ca5STyler Hicks { 1089e3ea1ca5STyler Hicks if (!policy_admin_capable(NULL)) 1090e3ea1ca5STyler Hicks return -EPERM; 1091e3ea1ca5STyler Hicks if (!apparmor_enabled) 1092e3ea1ca5STyler Hicks return -EINVAL; 1093e3ea1ca5STyler Hicks 1094e3ea1ca5STyler Hicks return proc_dointvec(table, write, buffer, lenp, ppos); 1095e3ea1ca5STyler Hicks } 1096e3ea1ca5STyler Hicks 1097e3ea1ca5STyler Hicks static struct ctl_path apparmor_sysctl_path[] = { 1098e3ea1ca5STyler Hicks { .procname = "kernel", }, 1099e3ea1ca5STyler Hicks { } 1100e3ea1ca5STyler Hicks }; 1101e3ea1ca5STyler Hicks 1102e3ea1ca5STyler Hicks static struct ctl_table apparmor_sysctl_table[] = { 1103e3ea1ca5STyler Hicks { 1104e3ea1ca5STyler Hicks .procname = "unprivileged_userns_apparmor_policy", 1105e3ea1ca5STyler Hicks .data = &unprivileged_userns_apparmor_policy, 1106e3ea1ca5STyler Hicks .maxlen = sizeof(int), 1107e3ea1ca5STyler Hicks .mode = 0600, 1108e3ea1ca5STyler Hicks .proc_handler = apparmor_dointvec, 1109e3ea1ca5STyler Hicks }, 1110e3ea1ca5STyler Hicks { } 1111e3ea1ca5STyler Hicks }; 1112e3ea1ca5STyler Hicks 1113e3ea1ca5STyler Hicks static int __init apparmor_init_sysctl(void) 1114e3ea1ca5STyler Hicks { 1115e3ea1ca5STyler Hicks return register_sysctl_paths(apparmor_sysctl_path, 1116e3ea1ca5STyler Hicks apparmor_sysctl_table) ? 0 : -ENOMEM; 1117e3ea1ca5STyler Hicks } 1118e3ea1ca5STyler Hicks #else 1119e3ea1ca5STyler Hicks static inline int apparmor_init_sysctl(void) 1120e3ea1ca5STyler Hicks { 1121e3ea1ca5STyler Hicks return 0; 1122e3ea1ca5STyler Hicks } 1123e3ea1ca5STyler Hicks #endif /* CONFIG_SYSCTL */ 1124e3ea1ca5STyler Hicks 1125b5e95b48SJohn Johansen static int __init apparmor_init(void) 1126b5e95b48SJohn Johansen { 1127b5e95b48SJohn Johansen int error; 1128b5e95b48SJohn Johansen 1129b1d9e6b0SCasey Schaufler if (!apparmor_enabled || !security_module_enable("apparmor")) { 1130b5e95b48SJohn Johansen aa_info_message("AppArmor disabled by boot time parameter"); 1131954317feSThomas Meyer apparmor_enabled = false; 1132b5e95b48SJohn Johansen return 0; 1133b5e95b48SJohn Johansen } 1134b5e95b48SJohn Johansen 113511c236b8SJohn Johansen error = aa_setup_dfa_engine(); 113611c236b8SJohn Johansen if (error) { 113711c236b8SJohn Johansen AA_ERROR("Unable to setup dfa engine\n"); 113811c236b8SJohn Johansen goto alloc_out; 113911c236b8SJohn Johansen } 114011c236b8SJohn Johansen 1141b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 1142b5e95b48SJohn Johansen if (error) { 1143b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 1144b5e95b48SJohn Johansen goto alloc_out; 1145b5e95b48SJohn Johansen } 1146b5e95b48SJohn Johansen 1147e3ea1ca5STyler Hicks error = apparmor_init_sysctl(); 1148e3ea1ca5STyler Hicks if (error) { 1149e3ea1ca5STyler Hicks AA_ERROR("Unable to register sysctls\n"); 1150e3ea1ca5STyler Hicks goto alloc_out; 1151e3ea1ca5STyler Hicks 1152e3ea1ca5STyler Hicks } 1153e3ea1ca5STyler Hicks 1154d4669f0bSJohn Johansen error = alloc_buffers(); 1155d4669f0bSJohn Johansen if (error) { 1156d4669f0bSJohn Johansen AA_ERROR("Unable to allocate work buffers\n"); 1157d4669f0bSJohn Johansen goto buffers_out; 1158d4669f0bSJohn Johansen } 1159d4669f0bSJohn Johansen 116055a26ebfSJohn Johansen error = set_init_ctx(); 1161b5e95b48SJohn Johansen if (error) { 1162b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 1163b1d9e6b0SCasey Schaufler aa_free_root_ns(); 1164d4669f0bSJohn Johansen goto buffers_out; 1165b5e95b48SJohn Johansen } 1166d69dece5SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), 1167d69dece5SCasey Schaufler "apparmor"); 1168b5e95b48SJohn Johansen 1169b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 1170b5e95b48SJohn Johansen apparmor_initialized = 1; 1171b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 1172b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 1173b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 1174b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 1175b5e95b48SJohn Johansen else 1176b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 1177b5e95b48SJohn Johansen 1178b5e95b48SJohn Johansen return error; 1179b5e95b48SJohn Johansen 1180d4669f0bSJohn Johansen buffers_out: 1181d4669f0bSJohn Johansen destroy_buffers(); 1182d4669f0bSJohn Johansen 1183b5e95b48SJohn Johansen alloc_out: 1184b5e95b48SJohn Johansen aa_destroy_aafs(); 118511c236b8SJohn Johansen aa_teardown_dfa_engine(); 1186b5e95b48SJohn Johansen 1187954317feSThomas Meyer apparmor_enabled = false; 1188b5e95b48SJohn Johansen return error; 1189b5e95b48SJohn Johansen } 1190b5e95b48SJohn Johansen 1191b5e95b48SJohn Johansen security_initcall(apparmor_init); 1192