Commit | Line | Data |
---|---|---|
0ed3b28a JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor ipc mediation | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
b2d09ae4 | 7 | * Copyright 2009-2017 Canonical Ltd. |
0ed3b28a JJ |
8 | * |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #include <linux/gfp.h> | |
16 | #include <linux/ptrace.h> | |
17 | ||
18 | #include "include/audit.h" | |
19 | #include "include/capability.h" | |
20 | #include "include/context.h" | |
21 | #include "include/policy.h" | |
33f8bf58 | 22 | #include "include/ipc.h" |
0ed3b28a JJ |
23 | |
24 | /* call back to audit ptrace fields */ | |
637f688d | 25 | static void audit_ptrace_cb(struct audit_buffer *ab, void *va) |
0ed3b28a JJ |
26 | { |
27 | struct common_audit_data *sa = va; | |
b2d09ae4 | 28 | |
ef88a7ac | 29 | audit_log_format(ab, " peer="); |
637f688d JJ |
30 | aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, |
31 | FLAGS_NONE, GFP_ATOMIC); | |
0ed3b28a JJ |
32 | } |
33 | ||
b2d09ae4 JJ |
34 | static int cross_ptrace_perm(struct aa_profile *tracer, |
35 | struct aa_profile *tracee, u32 request, | |
36 | struct common_audit_data *sa) | |
0ed3b28a | 37 | { |
b2d09ae4 JJ |
38 | /* policy uses the old style capability check for ptrace */ |
39 | if (profile_unconfined(tracer) || tracer == tracee) | |
40 | return 0; | |
0ed3b28a | 41 | |
b2d09ae4 JJ |
42 | aad(sa)->label = &tracer->label; |
43 | aad(sa)->peer = &tracee->label; | |
44 | aad(sa)->request = 0; | |
45 | aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 1); | |
ef88a7ac | 46 | |
b2d09ae4 | 47 | return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb); |
0ed3b28a JJ |
48 | } |
49 | ||
50 | /** | |
51 | * aa_may_ptrace - test if tracer task can trace the tracee | |
b2d09ae4 JJ |
52 | * @tracer: label of the task doing the tracing (NOT NULL) |
53 | * @tracee: task label to be traced | |
54 | * @request: permission request | |
0ed3b28a JJ |
55 | * |
56 | * Returns: %0 else error code if permission denied or error | |
57 | */ | |
b2d09ae4 JJ |
58 | int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee, |
59 | u32 request) | |
0ed3b28a | 60 | { |
b2d09ae4 | 61 | DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE); |
0ed3b28a | 62 | |
b2d09ae4 JJ |
63 | return xcheck_labels_profiles(tracer, tracee, cross_ptrace_perm, |
64 | request, &sa); | |
0ed3b28a JJ |
65 | } |
66 | ||
0ed3b28a | 67 |