1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor policy manipulation functions 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2017 Canonical Ltd. 9 * 10 * AppArmor policy namespaces, allow for different sets of policies 11 * to be loaded for tasks within the namespace. 12 */ 13 14 #include <linux/list.h> 15 #include <linux/mutex.h> 16 #include <linux/slab.h> 17 #include <linux/string.h> 18 19 #include "include/apparmor.h" 20 #include "include/cred.h" 21 #include "include/policy_ns.h" 22 #include "include/label.h" 23 #include "include/policy.h" 24 25 /* kernel label */ 26 struct aa_label *kernel_t; 27 28 /* root profile namespace */ 29 struct aa_ns *root_ns; 30 const char *aa_hidden_ns_name = "---"; 31 32 /** 33 * aa_ns_visible - test if @view is visible from @curr 34 * @curr: namespace to treat as the parent (NOT NULL) 35 * @view: namespace to test if visible from @curr (NOT NULL) 36 * @subns: whether view of a subns is allowed 37 * 38 * Returns: true if @view is visible from @curr else false 39 */ 40 bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns) 41 { 42 if (curr == view) 43 return true; 44 45 if (!subns) 46 return false; 47 48 for ( ; view; view = view->parent) { 49 if (view->parent == curr) 50 return true; 51 } 52 53 return false; 54 } 55 56 /** 57 * aa_ns_name - Find the ns name to display for @view from @curr 58 * @curr: current namespace (NOT NULL) 59 * @view: namespace attempting to view (NOT NULL) 60 * @subns: are subns visible 61 * 62 * Returns: name of @view visible from @curr 63 */ 64 const char *aa_ns_name(struct aa_ns *curr, struct aa_ns *view, bool subns) 65 { 66 /* if view == curr then the namespace name isn't displayed */ 67 if (curr == view) 68 return ""; 69 70 if (aa_ns_visible(curr, view, subns)) { 71 /* at this point if a ns is visible it is in a view ns 72 * thus the curr ns.hname is a prefix of its name. 73 * Only output the virtualized portion of the name 74 * Add + 2 to skip over // separating curr hname prefix 75 * from the visible tail of the views hname 76 */ 77 return view->base.hname + strlen(curr->base.hname) + 2; 78 } 79 80 return aa_hidden_ns_name; 81 } 82 83 static struct aa_profile *alloc_unconfined(const char *name) 84 { 85 struct aa_profile *profile; 86 87 profile = aa_alloc_profile(name, NULL, GFP_KERNEL); 88 if (!profile) 89 return NULL; 90 91 profile->label.flags |= FLAG_IX_ON_NAME_ERROR | 92 FLAG_IMMUTIBLE | FLAG_NS_COUNT | FLAG_UNCONFINED; 93 profile->mode = APPARMOR_UNCONFINED; 94 profile->file.dfa = aa_get_dfa(nulldfa); 95 profile->policy.dfa = aa_get_dfa(nulldfa); 96 97 return profile; 98 } 99 100 /** 101 * alloc_ns - allocate, initialize and return a new namespace 102 * @prefix: parent namespace name (MAYBE NULL) 103 * @name: a preallocated name (NOT NULL) 104 * 105 * Returns: refcounted namespace or NULL on failure. 106 */ 107 static struct aa_ns *alloc_ns(const char *prefix, const char *name) 108 { 109 struct aa_ns *ns; 110 111 ns = kzalloc(sizeof(*ns), GFP_KERNEL); 112 AA_DEBUG("%s(%p)\n", __func__, ns); 113 if (!ns) 114 return NULL; 115 if (!aa_policy_init(&ns->base, prefix, name, GFP_KERNEL)) 116 goto fail_ns; 117 118 INIT_LIST_HEAD(&ns->sub_ns); 119 INIT_LIST_HEAD(&ns->rawdata_list); 120 mutex_init(&ns->lock); 121 init_waitqueue_head(&ns->wait); 122 123 /* released by aa_free_ns() */ 124 ns->unconfined = alloc_unconfined("unconfined"); 125 if (!ns->unconfined) 126 goto fail_unconfined; 127 /* ns and ns->unconfined share ns->unconfined refcount */ 128 ns->unconfined->ns = ns; 129 130 atomic_set(&ns->uniq_null, 0); 131 132 aa_labelset_init(&ns->labels); 133 134 return ns; 135 136 fail_unconfined: 137 kfree_sensitive(ns->base.hname); 138 fail_ns: 139 kfree_sensitive(ns); 140 return NULL; 141 } 142 143 /** 144 * aa_free_ns - free a profile namespace 145 * @ns: the namespace to free (MAYBE NULL) 146 * 147 * Requires: All references to the namespace must have been put, if the 148 * namespace was referenced by a profile confining a task, 149 */ 150 void aa_free_ns(struct aa_ns *ns) 151 { 152 if (!ns) 153 return; 154 155 aa_policy_destroy(&ns->base); 156 aa_labelset_destroy(&ns->labels); 157 aa_put_ns(ns->parent); 158 159 ns->unconfined->ns = NULL; 160 aa_free_profile(ns->unconfined); 161 kfree_sensitive(ns); 162 } 163 164 /** 165 * aa_findn_ns - look up a profile namespace on the namespace list 166 * @root: namespace to search in (NOT NULL) 167 * @name: name of namespace to find (NOT NULL) 168 * @n: length of @name 169 * 170 * Returns: a refcounted namespace on the list, or NULL if no namespace 171 * called @name exists. 172 * 173 * refcount released by caller 174 */ 175 struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n) 176 { 177 struct aa_ns *ns = NULL; 178 179 rcu_read_lock(); 180 ns = aa_get_ns(__aa_findn_ns(&root->sub_ns, name, n)); 181 rcu_read_unlock(); 182 183 return ns; 184 } 185 186 /** 187 * aa_find_ns - look up a profile namespace on the namespace list 188 * @root: namespace to search in (NOT NULL) 189 * @name: name of namespace to find (NOT NULL) 190 * 191 * Returns: a refcounted namespace on the list, or NULL if no namespace 192 * called @name exists. 193 * 194 * refcount released by caller 195 */ 196 struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name) 197 { 198 return aa_findn_ns(root, name, strlen(name)); 199 } 200 201 /** 202 * __aa_lookupn_ns - lookup the namespace matching @hname 203 * @view: namespace to search in (NOT NULL) 204 * @hname: hierarchical ns name (NOT NULL) 205 * @n: length of @hname 206 * 207 * Requires: rcu_read_lock be held 208 * 209 * Returns: unrefcounted ns pointer or NULL if not found 210 * 211 * Do a relative name lookup, recursing through profile tree. 212 */ 213 struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n) 214 { 215 struct aa_ns *ns = view; 216 const char *split; 217 218 for (split = strnstr(hname, "//", n); split; 219 split = strnstr(hname, "//", n)) { 220 ns = __aa_findn_ns(&ns->sub_ns, hname, split - hname); 221 if (!ns) 222 return NULL; 223 224 n -= split + 2 - hname; 225 hname = split + 2; 226 } 227 228 if (n) 229 return __aa_findn_ns(&ns->sub_ns, hname, n); 230 return NULL; 231 } 232 233 /** 234 * aa_lookupn_ns - look up a policy namespace relative to @view 235 * @view: namespace to search in (NOT NULL) 236 * @name: name of namespace to find (NOT NULL) 237 * @n: length of @name 238 * 239 * Returns: a refcounted namespace on the list, or NULL if no namespace 240 * called @name exists. 241 * 242 * refcount released by caller 243 */ 244 struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n) 245 { 246 struct aa_ns *ns = NULL; 247 248 rcu_read_lock(); 249 ns = aa_get_ns(__aa_lookupn_ns(view, name, n)); 250 rcu_read_unlock(); 251 252 return ns; 253 } 254 255 static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name, 256 struct dentry *dir) 257 { 258 struct aa_ns *ns; 259 int error; 260 261 AA_BUG(!parent); 262 AA_BUG(!name); 263 AA_BUG(!mutex_is_locked(&parent->lock)); 264 265 ns = alloc_ns(parent->base.hname, name); 266 if (!ns) 267 return ERR_PTR(-ENOMEM); 268 ns->level = parent->level + 1; 269 mutex_lock_nested(&ns->lock, ns->level); 270 error = __aafs_ns_mkdir(ns, ns_subns_dir(parent), name, dir); 271 if (error) { 272 AA_ERROR("Failed to create interface for ns %s\n", 273 ns->base.name); 274 mutex_unlock(&ns->lock); 275 aa_free_ns(ns); 276 return ERR_PTR(error); 277 } 278 ns->parent = aa_get_ns(parent); 279 list_add_rcu(&ns->base.list, &parent->sub_ns); 280 /* add list ref */ 281 aa_get_ns(ns); 282 mutex_unlock(&ns->lock); 283 284 return ns; 285 } 286 287 /** 288 * __aa_find_or_create_ns - create an ns, fail if it already exists 289 * @parent: the parent of the namespace being created 290 * @name: the name of the namespace 291 * @dir: if not null the dir to put the ns entries in 292 * 293 * Returns: the a refcounted ns that has been add or an ERR_PTR 294 */ 295 struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name, 296 struct dentry *dir) 297 { 298 struct aa_ns *ns; 299 300 AA_BUG(!mutex_is_locked(&parent->lock)); 301 302 /* try and find the specified ns */ 303 /* released by caller */ 304 ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name)); 305 if (!ns) 306 ns = __aa_create_ns(parent, name, dir); 307 else 308 ns = ERR_PTR(-EEXIST); 309 310 /* return ref */ 311 return ns; 312 } 313 314 /** 315 * aa_prepare_ns - find an existing or create a new namespace of @name 316 * @parent: ns to treat as parent 317 * @name: the namespace to find or add (NOT NULL) 318 * 319 * Returns: refcounted namespace or PTR_ERR if failed to create one 320 */ 321 struct aa_ns *aa_prepare_ns(struct aa_ns *parent, const char *name) 322 { 323 struct aa_ns *ns; 324 325 mutex_lock_nested(&parent->lock, parent->level); 326 /* try and find the specified ns and if it doesn't exist create it */ 327 /* released by caller */ 328 ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name)); 329 if (!ns) 330 ns = __aa_create_ns(parent, name, NULL); 331 mutex_unlock(&parent->lock); 332 333 /* return ref */ 334 return ns; 335 } 336 337 static void __ns_list_release(struct list_head *head); 338 339 /** 340 * destroy_ns - remove everything contained by @ns 341 * @ns: namespace to have it contents removed (NOT NULL) 342 */ 343 static void destroy_ns(struct aa_ns *ns) 344 { 345 if (!ns) 346 return; 347 348 mutex_lock_nested(&ns->lock, ns->level); 349 /* release all profiles in this namespace */ 350 __aa_profile_list_release(&ns->base.profiles); 351 352 /* release all sub namespaces */ 353 __ns_list_release(&ns->sub_ns); 354 355 if (ns->parent) { 356 unsigned long flags; 357 358 write_lock_irqsave(&ns->labels.lock, flags); 359 __aa_proxy_redirect(ns_unconfined(ns), 360 ns_unconfined(ns->parent)); 361 write_unlock_irqrestore(&ns->labels.lock, flags); 362 } 363 __aafs_ns_rmdir(ns); 364 mutex_unlock(&ns->lock); 365 } 366 367 /** 368 * __aa_remove_ns - remove a namespace and all its children 369 * @ns: namespace to be removed (NOT NULL) 370 * 371 * Requires: ns->parent->lock be held and ns removed from parent. 372 */ 373 void __aa_remove_ns(struct aa_ns *ns) 374 { 375 /* remove ns from namespace list */ 376 list_del_rcu(&ns->base.list); 377 destroy_ns(ns); 378 aa_put_ns(ns); 379 } 380 381 /** 382 * __ns_list_release - remove all profile namespaces on the list put refs 383 * @head: list of profile namespaces (NOT NULL) 384 * 385 * Requires: namespace lock be held 386 */ 387 static void __ns_list_release(struct list_head *head) 388 { 389 struct aa_ns *ns, *tmp; 390 391 list_for_each_entry_safe(ns, tmp, head, base.list) 392 __aa_remove_ns(ns); 393 394 } 395 396 /** 397 * aa_alloc_root_ns - allocate the root profile namespace 398 * 399 * Returns: %0 on success else error 400 * 401 */ 402 int __init aa_alloc_root_ns(void) 403 { 404 struct aa_profile *kernel_p; 405 406 /* released by aa_free_root_ns - used as list ref*/ 407 root_ns = alloc_ns(NULL, "root"); 408 if (!root_ns) 409 return -ENOMEM; 410 411 kernel_p = alloc_unconfined("kernel_t"); 412 if (!kernel_p) { 413 destroy_ns(root_ns); 414 aa_free_ns(root_ns); 415 return -ENOMEM; 416 } 417 kernel_t = &kernel_p->label; 418 root_ns->unconfined->ns = aa_get_ns(root_ns); 419 420 return 0; 421 } 422 423 /** 424 * aa_free_root_ns - free the root profile namespace 425 */ 426 void __init aa_free_root_ns(void) 427 { 428 struct aa_ns *ns = root_ns; 429 430 root_ns = NULL; 431 432 aa_label_free(kernel_t); 433 destroy_ns(ns); 434 aa_put_ns(ns); 435 } 436