1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * AppArmor security module
4 *
5 * This file contains AppArmor functions for unpacking policy loaded
6 * from userspace.
7 *
8 * Copyright (C) 1998-2008 Novell/SUSE
9 * Copyright 2009-2022 Canonical Ltd.
10 *
11 * Code to provide backwards compatibility with older policy versions,
12 * by converting/mapping older policy formats into the newer internal
13 * formats.
14 */
15
16 #include <linux/ctype.h>
17 #include <linux/errno.h>
18
19 #include "include/lib.h"
20 #include "include/policy_unpack.h"
21 #include "include/policy_compat.h"
22
23 /* remap old accept table embedded permissions to separate permission table */
dfa_map_xindex(u16 mask)24 static u32 dfa_map_xindex(u16 mask)
25 {
26 u16 old_index = (mask >> 10) & 0xf;
27 u32 index = 0;
28
29 if (mask & 0x100)
30 index |= AA_X_UNSAFE;
31 if (mask & 0x200)
32 index |= AA_X_INHERIT;
33 if (mask & 0x80)
34 index |= AA_X_UNCONFINED;
35
36 if (old_index == 1) {
37 index |= AA_X_UNCONFINED;
38 } else if (old_index == 2) {
39 index |= AA_X_NAME;
40 } else if (old_index == 3) {
41 index |= AA_X_NAME | AA_X_CHILD;
42 } else if (old_index) {
43 index |= AA_X_TABLE;
44 index |= old_index - 4;
45 }
46
47 return index;
48 }
49
50 /*
51 * map old dfa inline permissions to new format
52 */
53 #define dfa_user_allow(dfa, state) (((ACCEPT_TABLE(dfa)[state]) & 0x7f) | \
54 ((ACCEPT_TABLE(dfa)[state]) & 0x80000000))
55 #define dfa_user_xbits(dfa, state) (((ACCEPT_TABLE(dfa)[state]) >> 7) & 0x7f)
56 #define dfa_user_audit(dfa, state) ((ACCEPT_TABLE2(dfa)[state]) & 0x7f)
57 #define dfa_user_quiet(dfa, state) (((ACCEPT_TABLE2(dfa)[state]) >> 7) & 0x7f)
58 #define dfa_user_xindex(dfa, state) \
59 (dfa_map_xindex(ACCEPT_TABLE(dfa)[state] & 0x3fff))
60
61 #define dfa_other_allow(dfa, state) ((((ACCEPT_TABLE(dfa)[state]) >> 14) & \
62 0x7f) | \
63 ((ACCEPT_TABLE(dfa)[state]) & 0x80000000))
64 #define dfa_other_xbits(dfa, state) \
65 ((((ACCEPT_TABLE(dfa)[state]) >> 7) >> 14) & 0x7f)
66 #define dfa_other_audit(dfa, state) (((ACCEPT_TABLE2(dfa)[state]) >> 14) & 0x7f)
67 #define dfa_other_quiet(dfa, state) \
68 ((((ACCEPT_TABLE2(dfa)[state]) >> 7) >> 14) & 0x7f)
69 #define dfa_other_xindex(dfa, state) \
70 dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
71
72 /**
73 * map_old_perms - map old file perms layout to the new layout
74 * @old: permission set in old mapping
75 *
76 * Returns: new permission mapping
77 */
map_old_perms(u32 old)78 static u32 map_old_perms(u32 old)
79 {
80 u32 new = old & 0xf;
81
82 if (old & MAY_READ)
83 new |= AA_MAY_GETATTR | AA_MAY_OPEN;
84 if (old & MAY_WRITE)
85 new |= AA_MAY_SETATTR | AA_MAY_CREATE | AA_MAY_DELETE |
86 AA_MAY_CHMOD | AA_MAY_CHOWN | AA_MAY_OPEN;
87 if (old & 0x10)
88 new |= AA_MAY_LINK;
89 /* the old mapping lock and link_subset flags where overlaid
90 * and use was determined by part of a pair that they were in
91 */
92 if (old & 0x20)
93 new |= AA_MAY_LOCK | AA_LINK_SUBSET;
94 if (old & 0x40) /* AA_EXEC_MMAP */
95 new |= AA_EXEC_MMAP;
96
97 return new;
98 }
99
compute_fperms_allow(struct aa_perms * perms,struct aa_dfa * dfa,aa_state_t state)100 static void compute_fperms_allow(struct aa_perms *perms, struct aa_dfa *dfa,
101 aa_state_t state)
102 {
103 perms->allow |= AA_MAY_GETATTR;
104
105 /* change_profile wasn't determined by ownership in old mapping */
106 if (ACCEPT_TABLE(dfa)[state] & 0x80000000)
107 perms->allow |= AA_MAY_CHANGE_PROFILE;
108 if (ACCEPT_TABLE(dfa)[state] & 0x40000000)
109 perms->allow |= AA_MAY_ONEXEC;
110 }
111
compute_fperms_user(struct aa_dfa * dfa,aa_state_t state)112 static struct aa_perms compute_fperms_user(struct aa_dfa *dfa,
113 aa_state_t state)
114 {
115 struct aa_perms perms = { };
116
117 perms.allow = map_old_perms(dfa_user_allow(dfa, state));
118 perms.audit = map_old_perms(dfa_user_audit(dfa, state));
119 perms.quiet = map_old_perms(dfa_user_quiet(dfa, state));
120 perms.xindex = dfa_user_xindex(dfa, state);
121
122 compute_fperms_allow(&perms, dfa, state);
123
124 return perms;
125 }
126
compute_fperms_other(struct aa_dfa * dfa,aa_state_t state)127 static struct aa_perms compute_fperms_other(struct aa_dfa *dfa,
128 aa_state_t state)
129 {
130 struct aa_perms perms = { };
131
132 perms.allow = map_old_perms(dfa_other_allow(dfa, state));
133 perms.audit = map_old_perms(dfa_other_audit(dfa, state));
134 perms.quiet = map_old_perms(dfa_other_quiet(dfa, state));
135 perms.xindex = dfa_other_xindex(dfa, state);
136
137 compute_fperms_allow(&perms, dfa, state);
138
139 return perms;
140 }
141
142 /**
143 * compute_fperms - convert dfa compressed perms to internal perms and store
144 * them so they can be retrieved later.
145 * @dfa: a dfa using fperms to remap to internal permissions
146 *
147 * Returns: remapped perm table
148 */
compute_fperms(struct aa_dfa * dfa,u32 * size)149 static struct aa_perms *compute_fperms(struct aa_dfa *dfa,
150 u32 *size)
151 {
152 aa_state_t state;
153 unsigned int state_count;
154 struct aa_perms *table;
155
156 AA_BUG(!dfa);
157
158 state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
159 /* DFAs are restricted from having a state_count of less than 2 */
160 table = kvcalloc(state_count * 2, sizeof(struct aa_perms), GFP_KERNEL);
161 if (!table)
162 return NULL;
163 *size = state_count * 2;
164
165 for (state = 0; state < state_count; state++) {
166 table[state * 2] = compute_fperms_user(dfa, state);
167 table[state * 2 + 1] = compute_fperms_other(dfa, state);
168 }
169
170 return table;
171 }
172
compute_xmatch_perms(struct aa_dfa * xmatch,u32 * size)173 static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch,
174 u32 *size)
175 {
176 struct aa_perms *perms;
177 int state;
178 int state_count;
179
180 AA_BUG(!xmatch);
181
182 state_count = xmatch->tables[YYTD_ID_BASE]->td_lolen;
183 /* DFAs are restricted from having a state_count of less than 2 */
184 perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);
185 if (!perms)
186 return NULL;
187 *size = state_count;
188
189 /* zero init so skip the trap state (state == 0) */
190 for (state = 1; state < state_count; state++)
191 perms[state].allow = dfa_user_allow(xmatch, state);
192
193 return perms;
194 }
195
map_other(u32 x)196 static u32 map_other(u32 x)
197 {
198 return ((x & 0x3) << 8) | /* SETATTR/GETATTR */
199 ((x & 0x1c) << 18) | /* ACCEPT/BIND/LISTEN */
200 ((x & 0x60) << 19); /* SETOPT/GETOPT */
201 }
202
map_xbits(u32 x)203 static u32 map_xbits(u32 x)
204 {
205 return ((x & 0x1) << 7) |
206 ((x & 0x7e) << 9);
207 }
208
compute_perms_entry(struct aa_dfa * dfa,aa_state_t state,u32 version)209 static struct aa_perms compute_perms_entry(struct aa_dfa *dfa,
210 aa_state_t state,
211 u32 version)
212 {
213 struct aa_perms perms = { };
214
215 perms.allow = dfa_user_allow(dfa, state);
216 perms.audit = dfa_user_audit(dfa, state);
217 perms.quiet = dfa_user_quiet(dfa, state);
218
219 /*
220 * This mapping is convulated due to history.
221 * v1-v4: only file perms, which are handled by compute_fperms
222 * v5: added policydb which dropped user conditional to gain new
223 * perm bits, but had to map around the xbits because the
224 * userspace compiler was still munging them.
225 * v9: adds using the xbits in policydb because the compiler now
226 * supports treating policydb permission bits different.
227 * Unfortunately there is no way to force auditing on the
228 * perms represented by the xbits
229 */
230 perms.allow |= map_other(dfa_other_allow(dfa, state));
231 if (VERSION_LE(version, v8))
232 perms.allow |= AA_MAY_LOCK;
233 else
234 perms.allow |= map_xbits(dfa_user_xbits(dfa, state));
235
236 /*
237 * for v5-v9 perm mapping in the policydb, the other set is used
238 * to extend the general perm set
239 */
240 perms.audit |= map_other(dfa_other_audit(dfa, state));
241 perms.quiet |= map_other(dfa_other_quiet(dfa, state));
242 if (VERSION_GT(version, v8))
243 perms.quiet |= map_xbits(dfa_other_xbits(dfa, state));
244
245 return perms;
246 }
247
compute_perms(struct aa_dfa * dfa,u32 version,u32 * size)248 static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version,
249 u32 *size)
250 {
251 unsigned int state;
252 unsigned int state_count;
253 struct aa_perms *table;
254
255 AA_BUG(!dfa);
256
257 state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
258 /* DFAs are restricted from having a state_count of less than 2 */
259 table = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);
260 if (!table)
261 return NULL;
262 *size = state_count;
263
264 /* zero init so skip the trap state (state == 0) */
265 for (state = 1; state < state_count; state++)
266 table[state] = compute_perms_entry(dfa, state, version);
267
268 return table;
269 }
270
271 /**
272 * remap_dfa_accept - remap old dfa accept table to be an index
273 * @dfa: dfa to do the remapping on
274 * @factor: scaling factor for the index conversion.
275 *
276 * Used in conjunction with compute_Xperms, it converts old style perms
277 * that are encoded in the dfa accept tables to the new style where
278 * there is a permission table and the accept table is an index into
279 * the permission table.
280 */
remap_dfa_accept(struct aa_dfa * dfa,unsigned int factor)281 static void remap_dfa_accept(struct aa_dfa *dfa, unsigned int factor)
282 {
283 unsigned int state;
284 unsigned int state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
285
286 AA_BUG(!dfa);
287
288 for (state = 0; state < state_count; state++)
289 ACCEPT_TABLE(dfa)[state] = state * factor;
290 kvfree(dfa->tables[YYTD_ID_ACCEPT2]);
291 dfa->tables[YYTD_ID_ACCEPT2] = NULL;
292 }
293
294 /* TODO: merge different dfa mappings into single map_policy fn */
aa_compat_map_xmatch(struct aa_policydb * policy)295 int aa_compat_map_xmatch(struct aa_policydb *policy)
296 {
297 policy->perms = compute_xmatch_perms(policy->dfa, &policy->size);
298 if (!policy->perms)
299 return -ENOMEM;
300
301 remap_dfa_accept(policy->dfa, 1);
302
303 return 0;
304 }
305
aa_compat_map_policy(struct aa_policydb * policy,u32 version)306 int aa_compat_map_policy(struct aa_policydb *policy, u32 version)
307 {
308 policy->perms = compute_perms(policy->dfa, version, &policy->size);
309 if (!policy->perms)
310 return -ENOMEM;
311
312 remap_dfa_accept(policy->dfa, 1);
313
314 return 0;
315 }
316
aa_compat_map_file(struct aa_policydb * policy)317 int aa_compat_map_file(struct aa_policydb *policy)
318 {
319 policy->perms = compute_fperms(policy->dfa, &policy->size);
320 if (!policy->perms)
321 return -ENOMEM;
322
323 remap_dfa_accept(policy->dfa, 2);
324
325 return 0;
326 }
327