Commit | Line | Data |
---|---|---|
6380bd8d JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor mediation of files | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #include "include/apparmor.h" | |
16 | #include "include/audit.h" | |
17 | #include "include/file.h" | |
18 | #include "include/match.h" | |
19 | #include "include/path.h" | |
20 | #include "include/policy.h" | |
21 | ||
e53cfe6c JJ |
22 | static u32 map_mask_to_chr_mask(u32 mask) |
23 | { | |
24 | u32 m = mask & PERMS_CHRS_MASK; | |
25 | ||
26 | if (mask & AA_MAY_GETATTR) | |
27 | m |= MAY_READ; | |
28 | if (mask & (AA_MAY_SETATTR | AA_MAY_CHMOD | AA_MAY_CHOWN)) | |
29 | m |= MAY_WRITE; | |
30 | ||
31 | return m; | |
32 | } | |
6380bd8d JJ |
33 | |
34 | /** | |
35 | * audit_file_mask - convert mask to permission string | |
36 | * @buffer: buffer to write string to (NOT NULL) | |
37 | * @mask: permission mask to convert | |
38 | */ | |
39 | static void audit_file_mask(struct audit_buffer *ab, u32 mask) | |
40 | { | |
41 | char str[10]; | |
42 | ||
e53cfe6c | 43 | aa_perm_mask_to_str(str, aa_file_perm_chrs, map_mask_to_chr_mask(mask)); |
6380bd8d JJ |
44 | audit_log_string(ab, str); |
45 | } | |
46 | ||
47 | /** | |
48 | * file_audit_cb - call back for file specific audit fields | |
49 | * @ab: audit_buffer (NOT NULL) | |
50 | * @va: audit struct to audit values of (NOT NULL) | |
51 | */ | |
52 | static void file_audit_cb(struct audit_buffer *ab, void *va) | |
53 | { | |
54 | struct common_audit_data *sa = va; | |
2db81452 | 55 | kuid_t fsuid = current_fsuid(); |
6380bd8d | 56 | |
aa9aeea8 | 57 | if (aad(sa)->request & AA_AUDIT_FILE_MASK) { |
6380bd8d | 58 | audit_log_format(ab, " requested_mask="); |
aa9aeea8 | 59 | audit_file_mask(ab, aad(sa)->request); |
6380bd8d | 60 | } |
aa9aeea8 | 61 | if (aad(sa)->denied & AA_AUDIT_FILE_MASK) { |
6380bd8d | 62 | audit_log_format(ab, " denied_mask="); |
aa9aeea8 | 63 | audit_file_mask(ab, aad(sa)->denied); |
6380bd8d | 64 | } |
aa9aeea8 | 65 | if (aad(sa)->request & AA_AUDIT_FILE_MASK) { |
2db81452 EB |
66 | audit_log_format(ab, " fsuid=%d", |
67 | from_kuid(&init_user_ns, fsuid)); | |
68 | audit_log_format(ab, " ouid=%d", | |
ef88a7ac | 69 | from_kuid(&init_user_ns, aad(sa)->fs.ouid)); |
6380bd8d JJ |
70 | } |
71 | ||
ef88a7ac | 72 | if (aad(sa)->fs.target) { |
6380bd8d | 73 | audit_log_format(ab, " target="); |
ef88a7ac | 74 | audit_log_untrustedstring(ab, aad(sa)->fs.target); |
6380bd8d JJ |
75 | } |
76 | } | |
77 | ||
78 | /** | |
79 | * aa_audit_file - handle the auditing of file operations | |
80 | * @profile: the profile being enforced (NOT NULL) | |
81 | * @perms: the permissions computed for the request (NOT NULL) | |
82 | * @gfp: allocation flags | |
83 | * @op: operation being mediated | |
84 | * @request: permissions requested | |
85 | * @name: name of object being mediated (MAYBE NULL) | |
86 | * @target: name of target (MAYBE NULL) | |
87 | * @ouid: object uid | |
88 | * @info: extra information message (MAYBE NULL) | |
89 | * @error: 0 if operation allowed else failure error code | |
90 | * | |
91 | * Returns: %0 or error on failure | |
92 | */ | |
2d679f3c | 93 | int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms, |
ef88a7ac | 94 | const char *op, u32 request, const char *name, |
2db81452 | 95 | const char *target, kuid_t ouid, const char *info, int error) |
6380bd8d JJ |
96 | { |
97 | int type = AUDIT_APPARMOR_AUTO; | |
ef88a7ac JJ |
98 | DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, op); |
99 | ||
100 | sa.u.tsk = NULL; | |
aa9aeea8 | 101 | aad(&sa)->request = request; |
ef88a7ac JJ |
102 | aad(&sa)->name = name; |
103 | aad(&sa)->fs.target = target; | |
104 | aad(&sa)->fs.ouid = ouid; | |
105 | aad(&sa)->info = info; | |
106 | aad(&sa)->error = error; | |
b6b1b81b | 107 | sa.u.tsk = NULL; |
ef88a7ac JJ |
108 | |
109 | if (likely(!aad(&sa)->error)) { | |
6380bd8d JJ |
110 | u32 mask = perms->audit; |
111 | ||
112 | if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL)) | |
113 | mask = 0xffff; | |
114 | ||
115 | /* mask off perms that are not being force audited */ | |
aa9aeea8 | 116 | aad(&sa)->request &= mask; |
6380bd8d | 117 | |
aa9aeea8 | 118 | if (likely(!aad(&sa)->request)) |
6380bd8d JJ |
119 | return 0; |
120 | type = AUDIT_APPARMOR_AUDIT; | |
121 | } else { | |
122 | /* only report permissions that were denied */ | |
aa9aeea8 JJ |
123 | aad(&sa)->request = aad(&sa)->request & ~perms->allow; |
124 | AA_BUG(!aad(&sa)->request); | |
6380bd8d | 125 | |
aa9aeea8 | 126 | if (aad(&sa)->request & perms->kill) |
6380bd8d JJ |
127 | type = AUDIT_APPARMOR_KILL; |
128 | ||
129 | /* quiet known rejects, assumes quiet and kill do not overlap */ | |
aa9aeea8 | 130 | if ((aad(&sa)->request & perms->quiet) && |
6380bd8d JJ |
131 | AUDIT_MODE(profile) != AUDIT_NOQUIET && |
132 | AUDIT_MODE(profile) != AUDIT_ALL) | |
aa9aeea8 | 133 | aad(&sa)->request &= ~perms->quiet; |
6380bd8d | 134 | |
aa9aeea8 | 135 | if (!aad(&sa)->request) |
ef88a7ac | 136 | return COMPLAIN_MODE(profile) ? 0 : aad(&sa)->error; |
6380bd8d JJ |
137 | } |
138 | ||
aa9aeea8 | 139 | aad(&sa)->denied = aad(&sa)->request & ~perms->allow; |
ef88a7ac | 140 | return aa_audit(type, profile, &sa, file_audit_cb); |
6380bd8d JJ |
141 | } |
142 | ||
143 | /** | |
144 | * map_old_perms - map old file perms layout to the new layout | |
145 | * @old: permission set in old mapping | |
146 | * | |
147 | * Returns: new permission mapping | |
148 | */ | |
149 | static u32 map_old_perms(u32 old) | |
150 | { | |
151 | u32 new = old & 0xf; | |
152 | if (old & MAY_READ) | |
e53cfe6c | 153 | new |= AA_MAY_GETATTR | AA_MAY_OPEN; |
6380bd8d | 154 | if (old & MAY_WRITE) |
e53cfe6c JJ |
155 | new |= AA_MAY_SETATTR | AA_MAY_CREATE | AA_MAY_DELETE | |
156 | AA_MAY_CHMOD | AA_MAY_CHOWN | AA_MAY_OPEN; | |
6380bd8d JJ |
157 | if (old & 0x10) |
158 | new |= AA_MAY_LINK; | |
159 | /* the old mapping lock and link_subset flags where overlaid | |
160 | * and use was determined by part of a pair that they were in | |
161 | */ | |
162 | if (old & 0x20) | |
163 | new |= AA_MAY_LOCK | AA_LINK_SUBSET; | |
164 | if (old & 0x40) /* AA_EXEC_MMAP */ | |
165 | new |= AA_EXEC_MMAP; | |
166 | ||
6380bd8d JJ |
167 | return new; |
168 | } | |
169 | ||
170 | /** | |
2d679f3c | 171 | * aa_compute_fperms - convert dfa compressed perms to internal perms |
6380bd8d JJ |
172 | * @dfa: dfa to compute perms for (NOT NULL) |
173 | * @state: state in dfa | |
174 | * @cond: conditions to consider (NOT NULL) | |
175 | * | |
176 | * TODO: convert from dfa + state to permission entry, do computation conversion | |
177 | * at load time. | |
178 | * | |
179 | * Returns: computed permission set | |
180 | */ | |
2d679f3c JJ |
181 | struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state, |
182 | struct path_cond *cond) | |
6380bd8d | 183 | { |
2d679f3c | 184 | struct aa_perms perms; |
6380bd8d JJ |
185 | |
186 | /* FIXME: change over to new dfa format | |
187 | * currently file perms are encoded in the dfa, new format | |
188 | * splits the permissions from the dfa. This mapping can be | |
189 | * done at profile load | |
190 | */ | |
2d679f3c JJ |
191 | perms.deny = 0; |
192 | perms.kill = perms.stop = 0; | |
193 | perms.complain = perms.cond = 0; | |
194 | perms.hide = 0; | |
195 | perms.prompt = 0; | |
6380bd8d | 196 | |
2db81452 | 197 | if (uid_eq(current_fsuid(), cond->uid)) { |
6380bd8d JJ |
198 | perms.allow = map_old_perms(dfa_user_allow(dfa, state)); |
199 | perms.audit = map_old_perms(dfa_user_audit(dfa, state)); | |
200 | perms.quiet = map_old_perms(dfa_user_quiet(dfa, state)); | |
201 | perms.xindex = dfa_user_xindex(dfa, state); | |
202 | } else { | |
203 | perms.allow = map_old_perms(dfa_other_allow(dfa, state)); | |
204 | perms.audit = map_old_perms(dfa_other_audit(dfa, state)); | |
205 | perms.quiet = map_old_perms(dfa_other_quiet(dfa, state)); | |
206 | perms.xindex = dfa_other_xindex(dfa, state); | |
207 | } | |
e53cfe6c | 208 | perms.allow |= AA_MAY_GETATTR; |
6380bd8d JJ |
209 | |
210 | /* change_profile wasn't determined by ownership in old mapping */ | |
211 | if (ACCEPT_TABLE(dfa)[state] & 0x80000000) | |
212 | perms.allow |= AA_MAY_CHANGE_PROFILE; | |
0421ea91 JJ |
213 | if (ACCEPT_TABLE(dfa)[state] & 0x40000000) |
214 | perms.allow |= AA_MAY_ONEXEC; | |
6380bd8d JJ |
215 | |
216 | return perms; | |
217 | } | |
218 | ||
219 | /** | |
220 | * aa_str_perms - find permission that match @name | |
221 | * @dfa: to match against (MAYBE NULL) | |
222 | * @state: state to start matching in | |
223 | * @name: string to match against dfa (NOT NULL) | |
224 | * @cond: conditions to consider for permission set computation (NOT NULL) | |
225 | * @perms: Returns - the permissions found when matching @name | |
226 | * | |
227 | * Returns: the final state in @dfa when beginning @start and walking @name | |
228 | */ | |
229 | unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start, | |
230 | const char *name, struct path_cond *cond, | |
2d679f3c | 231 | struct aa_perms *perms) |
6380bd8d JJ |
232 | { |
233 | unsigned int state; | |
6380bd8d | 234 | state = aa_dfa_match(dfa, start, name); |
2d679f3c | 235 | *perms = aa_compute_fperms(dfa, state, cond); |
6380bd8d JJ |
236 | |
237 | return state; | |
238 | } | |
239 | ||
240 | /** | |
241 | * is_deleted - test if a file has been completely unlinked | |
242 | * @dentry: dentry of file to test for deletion (NOT NULL) | |
243 | * | |
244 | * Returns: %1 if deleted else %0 | |
245 | */ | |
246 | static inline bool is_deleted(struct dentry *dentry) | |
247 | { | |
c6f493d6 | 248 | if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0) |
6380bd8d JJ |
249 | return 1; |
250 | return 0; | |
251 | } | |
252 | ||
253 | /** | |
254 | * aa_path_perm - do permissions check & audit for @path | |
255 | * @op: operation being checked | |
256 | * @profile: profile being enforced (NOT NULL) | |
257 | * @path: path to check permissions of (NOT NULL) | |
258 | * @flags: any additional path flags beyond what the profile specifies | |
259 | * @request: requested permissions | |
260 | * @cond: conditional info for this request (NOT NULL) | |
261 | * | |
262 | * Returns: %0 else error if access denied or other error | |
263 | */ | |
47f6e5cc JJ |
264 | int aa_path_perm(const char *op, struct aa_profile *profile, |
265 | const struct path *path, int flags, u32 request, | |
266 | struct path_cond *cond) | |
6380bd8d JJ |
267 | { |
268 | char *buffer = NULL; | |
2d679f3c | 269 | struct aa_perms perms = {}; |
6380bd8d JJ |
270 | const char *name, *info = NULL; |
271 | int error; | |
272 | ||
273 | flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0); | |
4227c333 JJ |
274 | get_buffers(buffer); |
275 | error = aa_path_name(path, flags, buffer, &name, &info, | |
72c8a768 | 276 | profile->disconnected); |
6380bd8d JJ |
277 | if (error) { |
278 | if (error == -ENOENT && is_deleted(path->dentry)) { | |
279 | /* Access to open files that are deleted are | |
280 | * give a pass (implicit delegation) | |
281 | */ | |
282 | error = 0; | |
57fa1e18 | 283 | info = NULL; |
6380bd8d | 284 | perms.allow = request; |
57fa1e18 | 285 | } |
6380bd8d JJ |
286 | } else { |
287 | aa_str_perms(profile->file.dfa, profile->file.start, name, cond, | |
288 | &perms); | |
289 | if (request & ~perms.allow) | |
290 | error = -EACCES; | |
291 | } | |
ef88a7ac JJ |
292 | error = aa_audit_file(profile, &perms, op, request, name, NULL, |
293 | cond->uid, info, error); | |
4227c333 | 294 | put_buffers(buffer); |
6380bd8d JJ |
295 | |
296 | return error; | |
297 | } | |
298 | ||
299 | /** | |
300 | * xindex_is_subset - helper for aa_path_link | |
301 | * @link: link permission set | |
302 | * @target: target permission set | |
303 | * | |
304 | * test target x permissions are equal OR a subset of link x permissions | |
305 | * this is done as part of the subset test, where a hardlink must have | |
306 | * a subset of permissions that the target has. | |
307 | * | |
308 | * Returns: %1 if subset else %0 | |
309 | */ | |
310 | static inline bool xindex_is_subset(u32 link, u32 target) | |
311 | { | |
312 | if (((link & ~AA_X_UNSAFE) != (target & ~AA_X_UNSAFE)) || | |
313 | ((link & AA_X_UNSAFE) && !(target & AA_X_UNSAFE))) | |
314 | return 0; | |
315 | ||
316 | return 1; | |
317 | } | |
318 | ||
319 | /** | |
320 | * aa_path_link - Handle hard link permission check | |
321 | * @profile: the profile being enforced (NOT NULL) | |
322 | * @old_dentry: the target dentry (NOT NULL) | |
323 | * @new_dir: directory the new link will be created in (NOT NULL) | |
324 | * @new_dentry: the link being created (NOT NULL) | |
325 | * | |
326 | * Handle the permission test for a link & target pair. Permission | |
327 | * is encoded as a pair where the link permission is determined | |
328 | * first, and if allowed, the target is tested. The target test | |
329 | * is done from the point of the link match (not start of DFA) | |
330 | * making the target permission dependent on the link permission match. | |
331 | * | |
332 | * The subset test if required forces that permissions granted | |
333 | * on link are a subset of the permission granted to target. | |
334 | * | |
335 | * Returns: %0 if allowed else error | |
336 | */ | |
337 | int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry, | |
3539aaf6 | 338 | const struct path *new_dir, struct dentry *new_dentry) |
6380bd8d | 339 | { |
8486adf0 KC |
340 | struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry }; |
341 | struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry }; | |
6380bd8d | 342 | struct path_cond cond = { |
c6f493d6 DH |
343 | d_backing_inode(old_dentry)->i_uid, |
344 | d_backing_inode(old_dentry)->i_mode | |
6380bd8d JJ |
345 | }; |
346 | char *buffer = NULL, *buffer2 = NULL; | |
347 | const char *lname, *tname = NULL, *info = NULL; | |
2d679f3c | 348 | struct aa_perms lperms, perms; |
6380bd8d JJ |
349 | u32 request = AA_MAY_LINK; |
350 | unsigned int state; | |
351 | int error; | |
352 | ||
4227c333 | 353 | get_buffers(buffer, buffer2); |
6380bd8d JJ |
354 | lperms = nullperms; |
355 | ||
356 | /* buffer freed below, lname is pointer in buffer */ | |
4227c333 | 357 | error = aa_path_name(&link, profile->path_flags, buffer, &lname, |
72c8a768 | 358 | &info, profile->disconnected); |
6380bd8d JJ |
359 | if (error) |
360 | goto audit; | |
361 | ||
362 | /* buffer2 freed below, tname is pointer in buffer2 */ | |
4227c333 | 363 | error = aa_path_name(&target, profile->path_flags, buffer2, &tname, |
72c8a768 | 364 | &info, profile->disconnected); |
6380bd8d JJ |
365 | if (error) |
366 | goto audit; | |
367 | ||
368 | error = -EACCES; | |
369 | /* aa_str_perms - handles the case of the dfa being NULL */ | |
370 | state = aa_str_perms(profile->file.dfa, profile->file.start, lname, | |
371 | &cond, &lperms); | |
372 | ||
373 | if (!(lperms.allow & AA_MAY_LINK)) | |
374 | goto audit; | |
375 | ||
376 | /* test to see if target can be paired with link */ | |
377 | state = aa_dfa_null_transition(profile->file.dfa, state); | |
378 | aa_str_perms(profile->file.dfa, state, tname, &cond, &perms); | |
379 | ||
380 | /* force audit/quiet masks for link are stored in the second entry | |
381 | * in the link pair. | |
382 | */ | |
383 | lperms.audit = perms.audit; | |
384 | lperms.quiet = perms.quiet; | |
385 | lperms.kill = perms.kill; | |
386 | ||
387 | if (!(perms.allow & AA_MAY_LINK)) { | |
388 | info = "target restricted"; | |
389 | goto audit; | |
390 | } | |
391 | ||
392 | /* done if link subset test is not required */ | |
393 | if (!(perms.allow & AA_LINK_SUBSET)) | |
394 | goto done_tests; | |
395 | ||
396 | /* Do link perm subset test requiring allowed permission on link are a | |
397 | * subset of the allowed permissions on target. | |
398 | */ | |
399 | aa_str_perms(profile->file.dfa, profile->file.start, tname, &cond, | |
400 | &perms); | |
401 | ||
402 | /* AA_MAY_LINK is not considered in the subset test */ | |
403 | request = lperms.allow & ~AA_MAY_LINK; | |
404 | lperms.allow &= perms.allow | AA_MAY_LINK; | |
405 | ||
406 | request |= AA_AUDIT_FILE_MASK & (lperms.allow & ~perms.allow); | |
407 | if (request & ~lperms.allow) { | |
408 | goto audit; | |
409 | } else if ((lperms.allow & MAY_EXEC) && | |
410 | !xindex_is_subset(lperms.xindex, perms.xindex)) { | |
411 | lperms.allow &= ~MAY_EXEC; | |
412 | request |= MAY_EXEC; | |
413 | info = "link not subset of target"; | |
414 | goto audit; | |
415 | } | |
416 | ||
417 | done_tests: | |
418 | error = 0; | |
419 | ||
420 | audit: | |
ef88a7ac | 421 | error = aa_audit_file(profile, &lperms, OP_LINK, request, |
6380bd8d | 422 | lname, tname, cond.uid, info, error); |
4227c333 | 423 | put_buffers(buffer, buffer2); |
6380bd8d JJ |
424 | |
425 | return error; | |
426 | } | |
427 | ||
428 | /** | |
429 | * aa_file_perm - do permission revalidation check & audit for @file | |
430 | * @op: operation being checked | |
431 | * @profile: profile being enforced (NOT NULL) | |
432 | * @file: file to revalidate access permissions on (NOT NULL) | |
433 | * @request: requested permissions | |
434 | * | |
435 | * Returns: %0 if access allowed else error | |
436 | */ | |
47f6e5cc | 437 | int aa_file_perm(const char *op, struct aa_profile *profile, struct file *file, |
6380bd8d JJ |
438 | u32 request) |
439 | { | |
440 | struct path_cond cond = { | |
496ad9aa AV |
441 | .uid = file_inode(file)->i_uid, |
442 | .mode = file_inode(file)->i_mode | |
6380bd8d JJ |
443 | }; |
444 | ||
445 | return aa_path_perm(op, profile, &file->f_path, PATH_DELEGATE_DELETED, | |
446 | request, &cond); | |
447 | } |