Commit | Line | Data |
---|---|---|
c88d4c7b JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor policy definitions. | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #ifndef __AA_POLICY_H | |
16 | #define __AA_POLICY_H | |
17 | ||
18 | #include <linux/capability.h> | |
19 | #include <linux/cred.h> | |
20 | #include <linux/kref.h> | |
e025be0f | 21 | #include <linux/rhashtable.h> |
c88d4c7b JJ |
22 | #include <linux/sched.h> |
23 | #include <linux/slab.h> | |
24 | #include <linux/socket.h> | |
25 | ||
26 | #include "apparmor.h" | |
27 | #include "audit.h" | |
28 | #include "capability.h" | |
29 | #include "domain.h" | |
30 | #include "file.h" | |
12557dcb | 31 | #include "lib.h" |
637f688d | 32 | #include "label.h" |
fc7e0b26 | 33 | #include "perms.h" |
c88d4c7b JJ |
34 | #include "resource.h" |
35 | ||
cff281f6 | 36 | |
98849dff | 37 | struct aa_ns; |
cff281f6 | 38 | |
2bd8dbbf JJ |
39 | extern int unprivileged_userns_apparmor_policy; |
40 | ||
0d259f04 JJ |
41 | extern const char *const aa_profile_mode_names[]; |
42 | #define APPARMOR_MODE_NAMES_MAX_INDEX 4 | |
c88d4c7b | 43 | |
50c5ecd5 JJ |
44 | #define PROFILE_MODE(_profile, _mode) \ |
45 | ((aa_g_profile_mode == (_mode)) || \ | |
46 | ((_profile)->mode == (_mode))) | |
c88d4c7b | 47 | |
50c5ecd5 JJ |
48 | #define COMPLAIN_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_COMPLAIN) |
49 | ||
50 | #define KILL_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_KILL) | |
c88d4c7b | 51 | |
637f688d | 52 | #define PROFILE_IS_HAT(_profile) ((_profile)->label.flags & FLAG_HAT) |
c88d4c7b | 53 | |
637f688d | 54 | #define profile_is_stale(_profile) (label_is_stale(&(_profile)->label)) |
77b071b3 | 55 | |
01e2b670 JJ |
56 | #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2) |
57 | ||
c88d4c7b JJ |
58 | /* |
59 | * FIXME: currently need a clean way to replace and remove profiles as a | |
60 | * set. It should be done at the namespace level. | |
61 | * Either, with a set of profiles loaded at the namespace level or via | |
62 | * a mark and remove marked interface. | |
63 | */ | |
64 | enum profile_mode { | |
65 | APPARMOR_ENFORCE, /* enforce access rules */ | |
66 | APPARMOR_COMPLAIN, /* allow and log access violations */ | |
67 | APPARMOR_KILL, /* kill task on access violation */ | |
03816507 | 68 | APPARMOR_UNCONFINED, /* profile set to unconfined */ |
c88d4c7b JJ |
69 | }; |
70 | ||
c88d4c7b | 71 | |
ad5ff3db JJ |
72 | /* struct aa_policydb - match engine for a policy |
73 | * dfa: dfa pattern match | |
74 | * start: set of start states for the different classes of data | |
75 | */ | |
76 | struct aa_policydb { | |
77 | /* Generic policy DFA specific rule types will be subsections of it */ | |
78 | struct aa_dfa *dfa; | |
79 | unsigned int start[AA_CLASS_LAST + 1]; | |
80 | ||
81 | }; | |
82 | ||
e025be0f WH |
83 | /* struct aa_data - generic data structure |
84 | * key: name for retrieving this data | |
85 | * size: size of data in bytes | |
86 | * data: binary data | |
87 | * head: reserved for rhashtable | |
88 | */ | |
89 | struct aa_data { | |
90 | char *key; | |
91 | u32 size; | |
92 | char *data; | |
93 | struct rhash_head head; | |
94 | }; | |
95 | ||
77b071b3 | 96 | |
c88d4c7b JJ |
97 | /* struct aa_profile - basic confinement data |
98 | * @base - base components of the profile (name, refcount, lists, lock ...) | |
637f688d | 99 | * @label - label this profile is an extension of |
c88d4c7b JJ |
100 | * @parent: parent of profile |
101 | * @ns: namespace the profile is in | |
c88d4c7b | 102 | * @rename: optional profile name that this profile renamed |
556d0be7 | 103 | * @attach: human readable attachment string |
c88d4c7b JJ |
104 | * @xmatch: optional extended matching for unconfined executables names |
105 | * @xmatch_len: xmatch prefix len, used to determine xmatch priority | |
c88d4c7b JJ |
106 | * @audit: the auditing mode of the profile |
107 | * @mode: the enforcement mode of the profile | |
c88d4c7b | 108 | * @path_flags: flags controlling path generation behavior |
72c8a768 | 109 | * @disconnected: what to prepend if attach_disconnected is specified |
c88d4c7b | 110 | * @size: the memory consumed by this profiles rules |
ad5ff3db | 111 | * @policy: general match rules governing policy |
c88d4c7b JJ |
112 | * @file: The set of rules governing basic file access and domain transitions |
113 | * @caps: capabilities for the profile | |
114 | * @rlimits: rlimits for the profile | |
115 | * | |
0d259f04 JJ |
116 | * @dents: dentries for the profiles file entries in apparmorfs |
117 | * @dirname: name of the profile dir in apparmorfs | |
e025be0f | 118 | * @data: hashtable for free-form policy aa_data |
0d259f04 | 119 | * |
c88d4c7b JJ |
120 | * The AppArmor profile contains the basic confinement data. Each profile |
121 | * has a name, and exists in a namespace. The @name and @exec_match are | |
122 | * used to determine profile attachment against unconfined tasks. All other | |
123 | * attachments are determined by profile X transition rules. | |
124 | * | |
c88d4c7b JJ |
125 | * Profiles have a hierarchy where hats and children profiles keep |
126 | * a reference to their parent. | |
127 | * | |
128 | * Profile names can not begin with a : and can not contain the \0 | |
129 | * character. If a profile name begins with / it will be considered when | |
130 | * determining profile attachment on "unconfined" tasks. | |
131 | */ | |
132 | struct aa_profile { | |
133 | struct aa_policy base; | |
01e2b670 | 134 | struct aa_profile __rcu *parent; |
c88d4c7b | 135 | |
98849dff | 136 | struct aa_ns *ns; |
c88d4c7b JJ |
137 | const char *rename; |
138 | ||
556d0be7 | 139 | const char *attach; |
c88d4c7b JJ |
140 | struct aa_dfa *xmatch; |
141 | int xmatch_len; | |
c88d4c7b | 142 | enum audit_mode audit; |
03816507 | 143 | long mode; |
c88d4c7b | 144 | u32 path_flags; |
72c8a768 | 145 | const char *disconnected; |
c88d4c7b JJ |
146 | int size; |
147 | ||
ad5ff3db | 148 | struct aa_policydb policy; |
c88d4c7b JJ |
149 | struct aa_file_rules file; |
150 | struct aa_caps caps; | |
151 | struct aa_rlimit rlimits; | |
0d259f04 | 152 | |
5ac8c355 | 153 | struct aa_loaddata *rawdata; |
f8eb8a13 | 154 | unsigned char *hash; |
0d259f04 JJ |
155 | char *dirname; |
156 | struct dentry *dents[AAFS_PROF_SIZEOF]; | |
e025be0f | 157 | struct rhashtable *data; |
637f688d | 158 | struct aa_label label; |
c88d4c7b JJ |
159 | }; |
160 | ||
c88d4c7b JJ |
161 | extern enum profile_mode aa_g_profile_mode; |
162 | ||
18e99f19 JJ |
163 | #define AA_MAY_LOAD_POLICY AA_MAY_APPEND |
164 | #define AA_MAY_REPLACE_POLICY AA_MAY_WRITE | |
165 | #define AA_MAY_REMOVE_POLICY AA_MAY_DELETE | |
166 | ||
637f688d JJ |
167 | #define profiles_ns(P) ((P)->ns) |
168 | #define name_is_shared(A, B) ((A)->hname && (A)->hname == (B)->hname) | |
c88d4c7b | 169 | |
cff281f6 | 170 | void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); |
c88d4c7b | 171 | |
c88d4c7b | 172 | |
8399588a | 173 | void aa_free_proxy_kref(struct kref *kref); |
637f688d JJ |
174 | struct aa_profile *aa_alloc_profile(const char *name, struct aa_proxy *proxy, |
175 | gfp_t gfp); | |
181f7c97 JJ |
176 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat, |
177 | const char *base, gfp_t gfp); | |
8651e1d6 | 178 | void aa_free_profile(struct aa_profile *profile); |
c88d4c7b JJ |
179 | void aa_free_profile_kref(struct kref *kref); |
180 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); | |
1741e9eb JJ |
181 | struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname, |
182 | size_t n); | |
98849dff | 183 | struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *name); |
637f688d | 184 | struct aa_profile *aa_fqlookupn_profile(struct aa_label *base, |
31617ddf | 185 | const char *fqname, size_t n); |
98849dff | 186 | struct aa_profile *aa_match_profile(struct aa_ns *ns, const char *name); |
c88d4c7b | 187 | |
637f688d | 188 | ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_label *label, |
18e99f19 | 189 | u32 mask, struct aa_loaddata *udata); |
637f688d JJ |
190 | ssize_t aa_remove_profiles(struct aa_ns *view, struct aa_label *label, |
191 | char *name, size_t size); | |
cff281f6 | 192 | void __aa_profile_list_release(struct list_head *head); |
c88d4c7b JJ |
193 | |
194 | #define PROF_ADD 1 | |
195 | #define PROF_REPLACE 0 | |
196 | ||
637f688d JJ |
197 | #define profile_unconfined(X) ((X)->mode == APPARMOR_UNCONFINED) |
198 | ||
199 | /** | |
200 | * aa_get_newest_profile - simple wrapper fn to wrap the label version | |
201 | * @p: profile (NOT NULL) | |
202 | * | |
203 | * Returns refcount to newest version of the profile (maybe @p) | |
204 | * | |
205 | * Requires: @p must be held with a valid refcount | |
206 | */ | |
207 | static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p) | |
208 | { | |
209 | return labels_profile(aa_get_newest_label(&p->label)); | |
210 | } | |
c88d4c7b | 211 | |
b5b2557c JJ |
212 | #define PROFILE_MEDIATES(P, T) ((P)->policy.start[(T)]) |
213 | /* safe version of POLICY_MEDIATES for full range input */ | |
214 | static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile *profile, | |
215 | unsigned char class) | |
216 | { | |
217 | if (profile->policy.dfa) | |
218 | return aa_dfa_match_len(profile->policy.dfa, | |
219 | profile->policy.start[0], &class, 1); | |
220 | return 0; | |
221 | } | |
c88d4c7b JJ |
222 | |
223 | /** | |
224 | * aa_get_profile - increment refcount on profile @p | |
225 | * @p: profile (MAYBE NULL) | |
226 | * | |
227 | * Returns: pointer to @p if @p is NULL will return NULL | |
228 | * Requires: @p must be held with valid refcount when called | |
229 | */ | |
230 | static inline struct aa_profile *aa_get_profile(struct aa_profile *p) | |
231 | { | |
232 | if (p) | |
637f688d | 233 | kref_get(&(p->label.count)); |
c88d4c7b JJ |
234 | |
235 | return p; | |
236 | } | |
237 | ||
01e2b670 JJ |
238 | /** |
239 | * aa_get_profile_not0 - increment refcount on profile @p found via lookup | |
240 | * @p: profile (MAYBE NULL) | |
241 | * | |
242 | * Returns: pointer to @p if @p is NULL will return NULL | |
243 | * Requires: @p must be held with valid refcount when called | |
244 | */ | |
245 | static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p) | |
246 | { | |
637f688d | 247 | if (p && kref_get_unless_zero(&p->label.count)) |
01e2b670 JJ |
248 | return p; |
249 | ||
250 | return NULL; | |
251 | } | |
252 | ||
253 | /** | |
254 | * aa_get_profile_rcu - increment a refcount profile that can be replaced | |
255 | * @p: pointer to profile that can be replaced (NOT NULL) | |
256 | * | |
257 | * Returns: pointer to a refcounted profile. | |
258 | * else NULL if no profile | |
259 | */ | |
260 | static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p) | |
261 | { | |
262 | struct aa_profile *c; | |
263 | ||
264 | rcu_read_lock(); | |
265 | do { | |
266 | c = rcu_dereference(*p); | |
637f688d | 267 | } while (c && !kref_get_unless_zero(&c->label.count)); |
01e2b670 JJ |
268 | rcu_read_unlock(); |
269 | ||
270 | return c; | |
271 | } | |
272 | ||
c88d4c7b JJ |
273 | /** |
274 | * aa_put_profile - decrement refcount on profile @p | |
275 | * @p: profile (MAYBE NULL) | |
276 | */ | |
277 | static inline void aa_put_profile(struct aa_profile *p) | |
278 | { | |
742058b0 | 279 | if (p) |
637f688d | 280 | kref_put(&p->label.count, aa_label_kref); |
fa2ac468 JJ |
281 | } |
282 | ||
c88d4c7b JJ |
283 | static inline int AUDIT_MODE(struct aa_profile *profile) |
284 | { | |
285 | if (aa_g_audit != AUDIT_NORMAL) | |
286 | return aa_g_audit; | |
287 | ||
288 | return profile->audit; | |
289 | } | |
290 | ||
2bd8dbbf | 291 | bool policy_view_capable(struct aa_ns *ns); |
fd2a8043 | 292 | bool policy_admin_capable(struct aa_ns *ns); |
637f688d | 293 | int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, |
18e99f19 | 294 | u32 mask); |
c88d4c7b JJ |
295 | |
296 | #endif /* __AA_POLICY_H */ |