Commit | Line | Data |
---|---|---|
b886d83c | 1 | // SPDX-License-Identifier: GPL-2.0-only |
0ed3b28a JJ |
2 | /* |
3 | * AppArmor security module | |
4 | * | |
5 | * This file contains AppArmor capability mediation functions | |
6 | * | |
7 | * Copyright (C) 1998-2008 Novell/SUSE | |
8 | * Copyright 2009-2010 Canonical Ltd. | |
0ed3b28a JJ |
9 | */ |
10 | ||
11 | #include <linux/capability.h> | |
12 | #include <linux/errno.h> | |
13 | #include <linux/gfp.h> | |
12eb87d5 | 14 | #include <linux/security.h> |
0ed3b28a JJ |
15 | |
16 | #include "include/apparmor.h" | |
17 | #include "include/capability.h" | |
d8889d49 | 18 | #include "include/cred.h" |
0ed3b28a JJ |
19 | #include "include/policy.h" |
20 | #include "include/audit.h" | |
21 | ||
22 | /* | |
23 | * Table of capability names: we generate it from capabilities.h. | |
24 | */ | |
25 | #include "capability_names.h" | |
26 | ||
c97204ba JJ |
27 | struct aa_sfs_entry aa_sfs_entry_caps[] = { |
28 | AA_SFS_FILE_STRING("mask", AA_SFS_CAPS_MASK), | |
84f1f787 JJ |
29 | { } |
30 | }; | |
31 | ||
0ed3b28a JJ |
32 | struct audit_cache { |
33 | struct aa_profile *profile; | |
34 | kernel_cap_t caps; | |
35 | }; | |
36 | ||
37 | static DEFINE_PER_CPU(struct audit_cache, audit_cache); | |
38 | ||
39 | /** | |
40 | * audit_cb - call back for capability components of audit struct | |
41 | * @ab - audit buffer (NOT NULL) | |
42 | * @va - audit struct to audit data from (NOT NULL) | |
43 | */ | |
44 | static void audit_cb(struct audit_buffer *ab, void *va) | |
45 | { | |
46 | struct common_audit_data *sa = va; | |
c70c86c4 | 47 | |
0ed3b28a JJ |
48 | audit_log_format(ab, " capname="); |
49 | audit_log_untrustedstring(ab, capability_names[sa->u.cap]); | |
50 | } | |
51 | ||
52 | /** | |
53 | * audit_caps - audit a capability | |
c70c86c4 | 54 | * @sa: audit data |
dd0c6e86 | 55 | * @profile: profile being tested for confinement (NOT NULL) |
0ed3b28a JJ |
56 | * @cap: capability tested |
57 | * @error: error code returned by test | |
58 | * | |
59 | * Do auditing of capability and handle, audit/complain/kill modes switching | |
60 | * and duplicate message elimination. | |
61 | * | |
62 | * Returns: 0 or sa->error on success, error code on failure | |
63 | */ | |
c70c86c4 JJ |
64 | static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, |
65 | int cap, int error) | |
0ed3b28a | 66 | { |
1ad22fcc JJ |
67 | struct aa_ruleset *rules = list_first_entry(&profile->rules, |
68 | typeof(*rules), list); | |
0ed3b28a JJ |
69 | struct audit_cache *ent; |
70 | int type = AUDIT_APPARMOR_AUTO; | |
c70c86c4 JJ |
71 | |
72 | aad(sa)->error = error; | |
0ed3b28a JJ |
73 | |
74 | if (likely(!error)) { | |
75 | /* test if auditing is being forced */ | |
76 | if (likely((AUDIT_MODE(profile) != AUDIT_ALL) && | |
217af7e2 | 77 | !cap_raised(rules->caps.audit, cap))) |
0ed3b28a JJ |
78 | return 0; |
79 | type = AUDIT_APPARMOR_AUDIT; | |
80 | } else if (KILL_MODE(profile) || | |
217af7e2 | 81 | cap_raised(rules->caps.kill, cap)) { |
0ed3b28a | 82 | type = AUDIT_APPARMOR_KILL; |
217af7e2 | 83 | } else if (cap_raised(rules->caps.quiet, cap) && |
0ed3b28a JJ |
84 | AUDIT_MODE(profile) != AUDIT_NOQUIET && |
85 | AUDIT_MODE(profile) != AUDIT_ALL) { | |
86 | /* quiet auditing */ | |
87 | return error; | |
88 | } | |
89 | ||
90 | /* Do simple duplicate message elimination */ | |
91 | ent = &get_cpu_var(audit_cache); | |
92 | if (profile == ent->profile && cap_raised(ent->caps, cap)) { | |
93 | put_cpu_var(audit_cache); | |
94 | if (COMPLAIN_MODE(profile)) | |
95 | return complain_error(error); | |
96 | return error; | |
97 | } else { | |
98 | aa_put_profile(ent->profile); | |
99 | ent->profile = aa_get_profile(profile); | |
100 | cap_raise(ent->caps, cap); | |
101 | } | |
102 | put_cpu_var(audit_cache); | |
103 | ||
c70c86c4 | 104 | return aa_audit(type, profile, sa, audit_cb); |
0ed3b28a JJ |
105 | } |
106 | ||
107 | /** | |
108 | * profile_capable - test if profile allows use of capability @cap | |
109 | * @profile: profile being enforced (NOT NULL, NOT unconfined) | |
110 | * @cap: capability to test if allowed | |
c1a85a00 | 111 | * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated |
c70c86c4 | 112 | * @sa: audit data (MAY BE NULL indicating no auditing) |
0ed3b28a JJ |
113 | * |
114 | * Returns: 0 if allowed else -EPERM | |
115 | */ | |
c1a85a00 MM |
116 | static int profile_capable(struct aa_profile *profile, int cap, |
117 | unsigned int opts, struct common_audit_data *sa) | |
0ed3b28a | 118 | { |
1ad22fcc JJ |
119 | struct aa_ruleset *rules = list_first_entry(&profile->rules, |
120 | typeof(*rules), list); | |
c70c86c4 JJ |
121 | int error; |
122 | ||
217af7e2 JJ |
123 | if (cap_raised(rules->caps.allow, cap) && |
124 | !cap_raised(rules->caps.denied, cap)) | |
c70c86c4 JJ |
125 | error = 0; |
126 | else | |
127 | error = -EPERM; | |
128 | ||
c1a85a00 | 129 | if (opts & CAP_OPT_NOAUDIT) { |
c70c86c4 JJ |
130 | if (!COMPLAIN_MODE(profile)) |
131 | return error; | |
132 | /* audit the cap request in complain mode but note that it | |
133 | * should be optional. | |
134 | */ | |
135 | aad(sa)->info = "optional: no audit"; | |
136 | } | |
137 | ||
138 | return audit_caps(sa, profile, cap, error); | |
0ed3b28a JJ |
139 | } |
140 | ||
141 | /** | |
142 | * aa_capable - test permission to use capability | |
c70c86c4 | 143 | * @label: label being tested for capability (NOT NULL) |
0ed3b28a | 144 | * @cap: capability to be tested |
c1a85a00 | 145 | * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated |
0ed3b28a JJ |
146 | * |
147 | * Look up capability in profile capability set. | |
148 | * | |
149 | * Returns: 0 on success, or else an error code. | |
150 | */ | |
c1a85a00 | 151 | int aa_capable(struct aa_label *label, int cap, unsigned int opts) |
0ed3b28a | 152 | { |
c70c86c4 JJ |
153 | struct aa_profile *profile; |
154 | int error = 0; | |
8c4b785a | 155 | DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE); |
0ed3b28a | 156 | |
c70c86c4 JJ |
157 | sa.u.cap = cap; |
158 | error = fn_for_each_confined(label, profile, | |
c1a85a00 | 159 | profile_capable(profile, cap, opts, &sa)); |
0ed3b28a | 160 | |
c70c86c4 | 161 | return error; |
0ed3b28a | 162 | } |