Commit | Line | Data |
---|---|---|
c88d4c7b JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor policy definitions. | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #ifndef __AA_POLICY_H | |
16 | #define __AA_POLICY_H | |
17 | ||
18 | #include <linux/capability.h> | |
19 | #include <linux/cred.h> | |
20 | #include <linux/kref.h> | |
e025be0f | 21 | #include <linux/rhashtable.h> |
c88d4c7b JJ |
22 | #include <linux/sched.h> |
23 | #include <linux/slab.h> | |
24 | #include <linux/socket.h> | |
25 | ||
26 | #include "apparmor.h" | |
27 | #include "audit.h" | |
28 | #include "capability.h" | |
29 | #include "domain.h" | |
30 | #include "file.h" | |
12557dcb | 31 | #include "lib.h" |
637f688d | 32 | #include "label.h" |
651e28c5 | 33 | #include "net.h" |
fc7e0b26 | 34 | #include "perms.h" |
c88d4c7b JJ |
35 | #include "resource.h" |
36 | ||
cff281f6 | 37 | |
98849dff | 38 | struct aa_ns; |
cff281f6 | 39 | |
2bd8dbbf JJ |
40 | extern int unprivileged_userns_apparmor_policy; |
41 | ||
0d259f04 JJ |
42 | extern const char *const aa_profile_mode_names[]; |
43 | #define APPARMOR_MODE_NAMES_MAX_INDEX 4 | |
c88d4c7b | 44 | |
50c5ecd5 JJ |
45 | #define PROFILE_MODE(_profile, _mode) \ |
46 | ((aa_g_profile_mode == (_mode)) || \ | |
47 | ((_profile)->mode == (_mode))) | |
c88d4c7b | 48 | |
50c5ecd5 JJ |
49 | #define COMPLAIN_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_COMPLAIN) |
50 | ||
51 | #define KILL_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_KILL) | |
c88d4c7b | 52 | |
637f688d | 53 | #define PROFILE_IS_HAT(_profile) ((_profile)->label.flags & FLAG_HAT) |
c88d4c7b | 54 | |
637f688d | 55 | #define profile_is_stale(_profile) (label_is_stale(&(_profile)->label)) |
77b071b3 | 56 | |
01e2b670 JJ |
57 | #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2) |
58 | ||
c88d4c7b JJ |
59 | /* |
60 | * FIXME: currently need a clean way to replace and remove profiles as a | |
61 | * set. It should be done at the namespace level. | |
62 | * Either, with a set of profiles loaded at the namespace level or via | |
63 | * a mark and remove marked interface. | |
64 | */ | |
65 | enum profile_mode { | |
66 | APPARMOR_ENFORCE, /* enforce access rules */ | |
67 | APPARMOR_COMPLAIN, /* allow and log access violations */ | |
68 | APPARMOR_KILL, /* kill task on access violation */ | |
03816507 | 69 | APPARMOR_UNCONFINED, /* profile set to unconfined */ |
c88d4c7b JJ |
70 | }; |
71 | ||
c88d4c7b | 72 | |
ad5ff3db JJ |
73 | /* struct aa_policydb - match engine for a policy |
74 | * dfa: dfa pattern match | |
75 | * start: set of start states for the different classes of data | |
76 | */ | |
77 | struct aa_policydb { | |
78 | /* Generic policy DFA specific rule types will be subsections of it */ | |
79 | struct aa_dfa *dfa; | |
80 | unsigned int start[AA_CLASS_LAST + 1]; | |
81 | ||
82 | }; | |
83 | ||
e025be0f WH |
84 | /* struct aa_data - generic data structure |
85 | * key: name for retrieving this data | |
86 | * size: size of data in bytes | |
87 | * data: binary data | |
88 | * head: reserved for rhashtable | |
89 | */ | |
90 | struct aa_data { | |
91 | char *key; | |
92 | u32 size; | |
93 | char *data; | |
94 | struct rhash_head head; | |
95 | }; | |
96 | ||
77b071b3 | 97 | |
c88d4c7b JJ |
98 | /* struct aa_profile - basic confinement data |
99 | * @base - base components of the profile (name, refcount, lists, lock ...) | |
637f688d | 100 | * @label - label this profile is an extension of |
c88d4c7b JJ |
101 | * @parent: parent of profile |
102 | * @ns: namespace the profile is in | |
c88d4c7b | 103 | * @rename: optional profile name that this profile renamed |
556d0be7 | 104 | * @attach: human readable attachment string |
c88d4c7b JJ |
105 | * @xmatch: optional extended matching for unconfined executables names |
106 | * @xmatch_len: xmatch prefix len, used to determine xmatch priority | |
c88d4c7b JJ |
107 | * @audit: the auditing mode of the profile |
108 | * @mode: the enforcement mode of the profile | |
c88d4c7b | 109 | * @path_flags: flags controlling path generation behavior |
72c8a768 | 110 | * @disconnected: what to prepend if attach_disconnected is specified |
c88d4c7b | 111 | * @size: the memory consumed by this profiles rules |
ad5ff3db | 112 | * @policy: general match rules governing policy |
c88d4c7b JJ |
113 | * @file: The set of rules governing basic file access and domain transitions |
114 | * @caps: capabilities for the profile | |
651e28c5 | 115 | * @net: network controls for the profile |
c88d4c7b JJ |
116 | * @rlimits: rlimits for the profile |
117 | * | |
0d259f04 JJ |
118 | * @dents: dentries for the profiles file entries in apparmorfs |
119 | * @dirname: name of the profile dir in apparmorfs | |
e025be0f | 120 | * @data: hashtable for free-form policy aa_data |
0d259f04 | 121 | * |
c88d4c7b JJ |
122 | * The AppArmor profile contains the basic confinement data. Each profile |
123 | * has a name, and exists in a namespace. The @name and @exec_match are | |
124 | * used to determine profile attachment against unconfined tasks. All other | |
125 | * attachments are determined by profile X transition rules. | |
126 | * | |
c88d4c7b JJ |
127 | * Profiles have a hierarchy where hats and children profiles keep |
128 | * a reference to their parent. | |
129 | * | |
130 | * Profile names can not begin with a : and can not contain the \0 | |
131 | * character. If a profile name begins with / it will be considered when | |
132 | * determining profile attachment on "unconfined" tasks. | |
133 | */ | |
134 | struct aa_profile { | |
135 | struct aa_policy base; | |
01e2b670 | 136 | struct aa_profile __rcu *parent; |
c88d4c7b | 137 | |
98849dff | 138 | struct aa_ns *ns; |
c88d4c7b JJ |
139 | const char *rename; |
140 | ||
556d0be7 | 141 | const char *attach; |
c88d4c7b JJ |
142 | struct aa_dfa *xmatch; |
143 | int xmatch_len; | |
c88d4c7b | 144 | enum audit_mode audit; |
03816507 | 145 | long mode; |
c88d4c7b | 146 | u32 path_flags; |
72c8a768 | 147 | const char *disconnected; |
c88d4c7b JJ |
148 | int size; |
149 | ||
ad5ff3db | 150 | struct aa_policydb policy; |
c88d4c7b JJ |
151 | struct aa_file_rules file; |
152 | struct aa_caps caps; | |
651e28c5 | 153 | struct aa_net net; |
c88d4c7b | 154 | struct aa_rlimit rlimits; |
0d259f04 | 155 | |
5ac8c355 | 156 | struct aa_loaddata *rawdata; |
f8eb8a13 | 157 | unsigned char *hash; |
0d259f04 JJ |
158 | char *dirname; |
159 | struct dentry *dents[AAFS_PROF_SIZEOF]; | |
e025be0f | 160 | struct rhashtable *data; |
637f688d | 161 | struct aa_label label; |
c88d4c7b JJ |
162 | }; |
163 | ||
c88d4c7b JJ |
164 | extern enum profile_mode aa_g_profile_mode; |
165 | ||
18e99f19 JJ |
166 | #define AA_MAY_LOAD_POLICY AA_MAY_APPEND |
167 | #define AA_MAY_REPLACE_POLICY AA_MAY_WRITE | |
168 | #define AA_MAY_REMOVE_POLICY AA_MAY_DELETE | |
169 | ||
637f688d JJ |
170 | #define profiles_ns(P) ((P)->ns) |
171 | #define name_is_shared(A, B) ((A)->hname && (A)->hname == (B)->hname) | |
c88d4c7b | 172 | |
cff281f6 | 173 | void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); |
c88d4c7b | 174 | |
c88d4c7b | 175 | |
8399588a | 176 | void aa_free_proxy_kref(struct kref *kref); |
637f688d JJ |
177 | struct aa_profile *aa_alloc_profile(const char *name, struct aa_proxy *proxy, |
178 | gfp_t gfp); | |
181f7c97 JJ |
179 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat, |
180 | const char *base, gfp_t gfp); | |
8651e1d6 | 181 | void aa_free_profile(struct aa_profile *profile); |
c88d4c7b JJ |
182 | void aa_free_profile_kref(struct kref *kref); |
183 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); | |
1741e9eb JJ |
184 | struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname, |
185 | size_t n); | |
98849dff | 186 | struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *name); |
637f688d | 187 | struct aa_profile *aa_fqlookupn_profile(struct aa_label *base, |
31617ddf | 188 | const char *fqname, size_t n); |
98849dff | 189 | struct aa_profile *aa_match_profile(struct aa_ns *ns, const char *name); |
c88d4c7b | 190 | |
637f688d | 191 | ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_label *label, |
18e99f19 | 192 | u32 mask, struct aa_loaddata *udata); |
637f688d JJ |
193 | ssize_t aa_remove_profiles(struct aa_ns *view, struct aa_label *label, |
194 | char *name, size_t size); | |
cff281f6 | 195 | void __aa_profile_list_release(struct list_head *head); |
c88d4c7b JJ |
196 | |
197 | #define PROF_ADD 1 | |
198 | #define PROF_REPLACE 0 | |
199 | ||
637f688d JJ |
200 | #define profile_unconfined(X) ((X)->mode == APPARMOR_UNCONFINED) |
201 | ||
202 | /** | |
203 | * aa_get_newest_profile - simple wrapper fn to wrap the label version | |
204 | * @p: profile (NOT NULL) | |
205 | * | |
206 | * Returns refcount to newest version of the profile (maybe @p) | |
207 | * | |
208 | * Requires: @p must be held with a valid refcount | |
209 | */ | |
210 | static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p) | |
211 | { | |
212 | return labels_profile(aa_get_newest_label(&p->label)); | |
213 | } | |
c88d4c7b | 214 | |
b5b2557c JJ |
215 | #define PROFILE_MEDIATES(P, T) ((P)->policy.start[(T)]) |
216 | /* safe version of POLICY_MEDIATES for full range input */ | |
217 | static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile *profile, | |
218 | unsigned char class) | |
219 | { | |
220 | if (profile->policy.dfa) | |
221 | return aa_dfa_match_len(profile->policy.dfa, | |
222 | profile->policy.start[0], &class, 1); | |
223 | return 0; | |
224 | } | |
c88d4c7b | 225 | |
651e28c5 JJ |
226 | static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile, |
227 | u16 AF) { | |
228 | unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET); | |
229 | u16 be_af = cpu_to_be16(AF); | |
230 | ||
231 | if (!state) | |
232 | return 0; | |
233 | return aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2); | |
234 | } | |
235 | ||
c88d4c7b JJ |
236 | /** |
237 | * aa_get_profile - increment refcount on profile @p | |
238 | * @p: profile (MAYBE NULL) | |
239 | * | |
240 | * Returns: pointer to @p if @p is NULL will return NULL | |
241 | * Requires: @p must be held with valid refcount when called | |
242 | */ | |
243 | static inline struct aa_profile *aa_get_profile(struct aa_profile *p) | |
244 | { | |
245 | if (p) | |
637f688d | 246 | kref_get(&(p->label.count)); |
c88d4c7b JJ |
247 | |
248 | return p; | |
249 | } | |
250 | ||
01e2b670 JJ |
251 | /** |
252 | * aa_get_profile_not0 - increment refcount on profile @p found via lookup | |
253 | * @p: profile (MAYBE NULL) | |
254 | * | |
255 | * Returns: pointer to @p if @p is NULL will return NULL | |
256 | * Requires: @p must be held with valid refcount when called | |
257 | */ | |
258 | static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p) | |
259 | { | |
637f688d | 260 | if (p && kref_get_unless_zero(&p->label.count)) |
01e2b670 JJ |
261 | return p; |
262 | ||
263 | return NULL; | |
264 | } | |
265 | ||
266 | /** | |
267 | * aa_get_profile_rcu - increment a refcount profile that can be replaced | |
268 | * @p: pointer to profile that can be replaced (NOT NULL) | |
269 | * | |
270 | * Returns: pointer to a refcounted profile. | |
271 | * else NULL if no profile | |
272 | */ | |
273 | static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p) | |
274 | { | |
275 | struct aa_profile *c; | |
276 | ||
277 | rcu_read_lock(); | |
278 | do { | |
279 | c = rcu_dereference(*p); | |
637f688d | 280 | } while (c && !kref_get_unless_zero(&c->label.count)); |
01e2b670 JJ |
281 | rcu_read_unlock(); |
282 | ||
283 | return c; | |
284 | } | |
285 | ||
c88d4c7b JJ |
286 | /** |
287 | * aa_put_profile - decrement refcount on profile @p | |
288 | * @p: profile (MAYBE NULL) | |
289 | */ | |
290 | static inline void aa_put_profile(struct aa_profile *p) | |
291 | { | |
742058b0 | 292 | if (p) |
637f688d | 293 | kref_put(&p->label.count, aa_label_kref); |
fa2ac468 JJ |
294 | } |
295 | ||
c88d4c7b JJ |
296 | static inline int AUDIT_MODE(struct aa_profile *profile) |
297 | { | |
298 | if (aa_g_audit != AUDIT_NORMAL) | |
299 | return aa_g_audit; | |
300 | ||
301 | return profile->audit; | |
302 | } | |
303 | ||
2bd8dbbf | 304 | bool policy_view_capable(struct aa_ns *ns); |
fd2a8043 | 305 | bool policy_admin_capable(struct aa_ns *ns); |
637f688d | 306 | int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, |
18e99f19 | 307 | u32 mask); |
c88d4c7b JJ |
308 | |
309 | #endif /* __AA_POLICY_H */ |