[linux-block.git] / security / apparmor / include / perms.h

/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * AppArmor security module
 *
 * This file contains AppArmor basic permission sets definitions.
 *
 * Copyright 2017 Canonical Ltd.
 */

#ifndef __AA_PERM_H
#define __AA_PERM_H

#include <linux/fs.h>
#include "label.h"

#define AA_MAY_EXEC		MAY_EXEC
#define AA_MAY_WRITE		MAY_WRITE
#define AA_MAY_READ		MAY_READ
#define AA_MAY_APPEND		MAY_APPEND

#define AA_MAY_CREATE		0x0010
#define AA_MAY_DELETE		0x0020
#define AA_MAY_OPEN		0x0040
#define AA_MAY_RENAME		0x0080		/* pair */

#define AA_MAY_SETATTR		0x0100		/* meta write */
#define AA_MAY_GETATTR		0x0200		/* meta read */
#define AA_MAY_SETCRED		0x0400		/* security cred/attr */
#define AA_MAY_GETCRED		0x0800

#define AA_MAY_CHMOD		0x1000		/* pair */
#define AA_MAY_CHOWN		0x2000		/* pair */
#define AA_MAY_CHGRP		0x4000		/* pair */
#define AA_MAY_LOCK		0x8000		/* LINK_SUBSET overlaid */

#define AA_EXEC_MMAP		0x00010000
#define AA_MAY_MPROT		0x00020000	/* extend conditions */
#define AA_MAY_LINK		0x00040000	/* pair */
#define AA_MAY_SNAPSHOT		0x00080000	/* pair */

#define AA_MAY_DELEGATE
#define AA_CONT_MATCH		0x08000000

#define AA_MAY_STACK		0x10000000
#define AA_MAY_ONEXEC		0x20000000 /* either stack or change_profile */
#define AA_MAY_CHANGE_PROFILE	0x40000000
#define AA_MAY_CHANGEHAT	0x80000000

#define AA_LINK_SUBSET		AA_MAY_LOCK	/* overlaid */


#define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |		\
			 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |	\
			 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)

#define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
			  AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
			  AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
			  AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
			  AA_MAY_STACK | AA_MAY_ONEXEC |		\
			  AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)

extern const char aa_file_perm_chrs[];
extern const char *aa_file_perm_names[];

struct aa_perms {
	u32 allow;
	u32 audit;	/* set only when allow is set */

	u32 deny;	/* explicit deny, or conflict if allow also set */
	u32 quiet;	/* set only when ~allow | deny */
	u32 kill;	/* set only when ~allow | deny */
	u32 stop;	/* set only when ~allow | deny */

	u32 complain;	/* accumulates only used when ~allow & ~deny */
	u32 cond;	/* set only when ~allow and ~deny */

	u32 hide;	/* set only when  ~allow | deny */
	u32 prompt;	/* accumulates only used when ~allow & ~deny */

	/* Reserved:
	 * u32 subtree;	/ * set only when allow is set * /
	 */
	u16 xindex;
};

#define ALL_PERMS_MASK 0xffffffff
extern struct aa_perms nullperms;
extern struct aa_perms allperms;


#define xcheck(FN1, FN2)	\
({				\
	int e, error = FN1;	\
	e = FN2;		\
	if (e)			\
		error = e;	\
	error;			\
})


/*
 * TODO: update for labels pointing to labels instead of profiles
 * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
 * gah this doesn't allow for label compound check!!!!
 */
#define xcheck_ns_profile_profile(P1, P2, FN, args...)		\
({								\
	int ____e = 0;						\
	if (P1->ns == P2->ns)					\
		____e = FN((P1), (P2), args);			\
	(____e);						\
})

#define xcheck_ns_profile_label(P, L, FN, args...)		\
({								\
	struct aa_profile *__p2;				\
	fn_for_each((L), __p2,					\
		    xcheck_ns_profile_profile((P), __p2, (FN), args));	\
})

#define xcheck_ns_labels(L1, L2, FN, args...)			\
({								\
	struct aa_profile *__p1;				\
	fn_for_each((L1), __p1, FN(__p1, (L2), args));		\
})

/* Do the cross check but applying FN at the profiles level */
#define xcheck_labels_profiles(L1, L2, FN, args...)		\
	xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)

#define xcheck_labels(L1, L2, P, FN1, FN2)			\
	xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))


void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs,
			 u32 mask);
void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
			 u32 mask);
void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
			u32 chrsmask, const char * const *names, u32 namesmask);
void aa_apply_modes_to_perms(struct aa_profile *profile,
			     struct aa_perms *perms);
void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
		      struct aa_perms *perms);
void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
			    int type, u32 request, struct aa_perms *perms);
int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
			  u32 request, int type, u32 *deny,
			  struct common_audit_data *sa);
int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
		   u32 request, struct common_audit_data *sa,
		   void (*cb)(struct audit_buffer *, void *));
#endif /* __AA_PERM_H */
Commit	Line	Data
b886d83c	1	/* SPDX-License-Identifier: GPL-2.0-only */
fc7e0b26 JJ	2	/*
	3	* AppArmor security module
	4	*
	5	* This file contains AppArmor basic permission sets definitions.
	6	*
	7	* Copyright 2017 Canonical Ltd.
fc7e0b26 JJ	8	*/
	9
	10	#ifndef __AA_PERM_H
	11	#define __AA_PERM_H
	12
	13	#include <linux/fs.h>
637f688d	14	#include "label.h"
fc7e0b26	15
e53cfe6c JJ	16	#define AA_MAY_EXEC MAY_EXEC
	17	#define AA_MAY_WRITE MAY_WRITE
	18	#define AA_MAY_READ MAY_READ
	19	#define AA_MAY_APPEND MAY_APPEND
	20
	21	#define AA_MAY_CREATE 0x0010
	22	#define AA_MAY_DELETE 0x0020
	23	#define AA_MAY_OPEN 0x0040
	24	#define AA_MAY_RENAME 0x0080 /* pair */
	25
	26	#define AA_MAY_SETATTR 0x0100 /* meta write */
	27	#define AA_MAY_GETATTR 0x0200 /* meta read */
	28	#define AA_MAY_SETCRED 0x0400 /* security cred/attr */
	29	#define AA_MAY_GETCRED 0x0800
	30
	31	#define AA_MAY_CHMOD 0x1000 /* pair */
	32	#define AA_MAY_CHOWN 0x2000 /* pair */
	33	#define AA_MAY_CHGRP 0x4000 /* pair */
	34	#define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */
	35
	36	#define AA_EXEC_MMAP 0x00010000
	37	#define AA_MAY_MPROT 0x00020000 /* extend conditions */
	38	#define AA_MAY_LINK 0x00040000 /* pair */
	39	#define AA_MAY_SNAPSHOT 0x00080000 /* pair */
	40
	41	#define AA_MAY_DELEGATE
	42	#define AA_CONT_MATCH 0x08000000
	43
	44	#define AA_MAY_STACK 0x10000000
	45	#define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */
	46	#define AA_MAY_CHANGE_PROFILE 0x40000000
	47	#define AA_MAY_CHANGEHAT 0x80000000
	48
	49	#define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */
	50
	51
	52	#define PERMS_CHRS_MASK (MAY_READ \| MAY_WRITE \| AA_MAY_CREATE \| \
	53	AA_MAY_DELETE \| AA_MAY_LINK \| AA_MAY_LOCK \| \
	54	AA_MAY_EXEC \| AA_EXEC_MMAP \| AA_MAY_APPEND)
	55
	56	#define PERMS_NAMES_MASK (PERMS_CHRS_MASK \| AA_MAY_OPEN \| AA_MAY_RENAME \| \
	57	AA_MAY_SETATTR \| AA_MAY_GETATTR \| AA_MAY_SETCRED \| \
	58	AA_MAY_GETCRED \| AA_MAY_CHMOD \| AA_MAY_CHOWN \| \
	59	AA_MAY_CHGRP \| AA_MAY_MPROT \| AA_MAY_SNAPSHOT \| \
	60	AA_MAY_STACK \| AA_MAY_ONEXEC \| \
	61	AA_MAY_CHANGE_PROFILE \| AA_MAY_CHANGEHAT)
	62
	63	extern const char aa_file_perm_chrs[];
	64	extern const char *aa_file_perm_names[];
fc7e0b26	65
aa9aeea8 JJ	66	struct aa_perms {
	67	u32 allow;
	68	u32 audit; /* set only when allow is set */
	69
	70	u32 deny; /* explicit deny, or conflict if allow also set */
	71	u32 quiet; /* set only when ~allow \| deny */
	72	u32 kill; /* set only when ~allow \| deny */
	73	u32 stop; /* set only when ~allow \| deny */
	74
	75	u32 complain; /* accumulates only used when ~allow & ~deny */
	76	u32 cond; /* set only when ~allow and ~deny */
	77
	78	u32 hide; /* set only when ~allow \| deny */
	79	u32 prompt; /* accumulates only used when ~allow & ~deny */
	80
	81	/* Reserved:
	82	* u32 subtree; / * set only when allow is set * /
	83	*/
	84	u16 xindex;
	85	};
	86
	87	#define ALL_PERMS_MASK 0xffffffff
2d679f3c	88	extern struct aa_perms nullperms;
aa9aeea8 JJ	89	extern struct aa_perms allperms;
aa9aeea8 JJ	90
ca916e8e JJ	91
	92	#define xcheck(FN1, FN2) \
	93	({ \
	94	int e, error = FN1; \
	95	e = FN2; \
	96	if (e) \
	97	error = e; \
	98	error; \
	99	})
	100
	101
	102	/*
	103	* TODO: update for labels pointing to labels instead of profiles
	104	* TODO: optimize the walk, currently does subwalk of L2 for each P in L1
	105	* gah this doesn't allow for label compound check!!!!
	106	*/
	107	#define xcheck_ns_profile_profile(P1, P2, FN, args...) \
	108	({ \
	109	int ____e = 0; \
	110	if (P1->ns == P2->ns) \
	111	____e = FN((P1), (P2), args); \
	112	(____e); \
	113	})
	114
	115	#define xcheck_ns_profile_label(P, L, FN, args...) \
	116	({ \
	117	struct aa_profile *__p2; \
	118	fn_for_each((L), __p2, \
	119	xcheck_ns_profile_profile((P), __p2, (FN), args)); \
	120	})
	121
	122	#define xcheck_ns_labels(L1, L2, FN, args...) \
	123	({ \
	124	struct aa_profile *__p1; \
	125	fn_for_each((L1), __p1, FN(__p1, (L2), args)); \
	126	})
	127
	128	/* Do the cross check but applying FN at the profiles level */
	129	#define xcheck_labels_profiles(L1, L2, FN, args...) \
	130	xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
	131
0dda0b3f JJ	132	#define xcheck_labels(L1, L2, P, FN1, FN2) \
	133	xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
	134
aa9aeea8	135
7f3ebcf2 TH	136	void aa_perm_mask_to_str(char str, size_t str_size, const char chrs,
7f3ebcf2 TH	137	u32 mask);
56974a6f JJ	138	void aa_audit_perm_names(struct audit_buffer ab, const char const *names,
56974a6f JJ	139	u32 mask);
aa9aeea8	140	void aa_audit_perm_mask(struct audit_buffer ab, u32 mask, const char chrs,
56974a6f	141	u32 chrsmask, const char * const *names, u32 namesmask);
aa9aeea8 JJ	142	void aa_apply_modes_to_perms(struct aa_profile *profile,
	143	struct aa_perms *perms);
	144	void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
	145	struct aa_perms *perms);
637f688d JJ	146	void aa_perms_accum(struct aa_perms accum, struct aa_perms addend);
	147	void aa_perms_accum_raw(struct aa_perms accum, struct aa_perms addend);
	148	void aa_profile_match_label(struct aa_profile profile, struct aa_label label,
	149	int type, u32 request, struct aa_perms *perms);
	150	int aa_profile_label_perm(struct aa_profile profile, struct aa_profile target,
	151	u32 request, int type, u32 *deny,
	152	struct common_audit_data *sa);
	153	int aa_check_perms(struct aa_profile profile, struct aa_perms perms,
	154	u32 request, struct common_audit_data *sa,
	155	void (cb)(struct audit_buffer , void *));
fc7e0b26	156	#endif /* __AA_PERM_H */