Commit | Line | Data |
---|---|---|
cdff2642 JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor function for pathnames | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #include <linux/magic.h> | |
16 | #include <linux/mnt_namespace.h> | |
17 | #include <linux/mount.h> | |
18 | #include <linux/namei.h> | |
19 | #include <linux/nsproxy.h> | |
20 | #include <linux/path.h> | |
21 | #include <linux/sched.h> | |
22 | #include <linux/slab.h> | |
23 | #include <linux/fs_struct.h> | |
24 | ||
25 | #include "include/apparmor.h" | |
26 | #include "include/path.h" | |
27 | #include "include/policy.h" | |
28 | ||
29 | ||
30 | /* modified from dcache.c */ | |
31 | static int prepend(char **buffer, int buflen, const char *str, int namelen) | |
32 | { | |
33 | buflen -= namelen; | |
34 | if (buflen < 0) | |
35 | return -ENAMETOOLONG; | |
36 | *buffer -= namelen; | |
37 | memcpy(*buffer, str, namelen); | |
38 | return 0; | |
39 | } | |
40 | ||
41 | #define CHROOT_NSCONNECT (PATH_CHROOT_REL | PATH_CHROOT_NSCONNECT) | |
42 | ||
43 | /** | |
44 | * d_namespace_path - lookup a name associated with a given path | |
45 | * @path: path to lookup (NOT NULL) | |
46 | * @buf: buffer to store path to (NOT NULL) | |
47 | * @buflen: length of @buf | |
48 | * @name: Returns - pointer for start of path name with in @buf (NOT NULL) | |
49 | * @flags: flags controlling path lookup | |
50 | * | |
51 | * Handle path name lookup. | |
52 | * | |
53 | * Returns: %0 else error code if path lookup fails | |
54 | * When no error the path name is returned in @name which points to | |
55 | * to a position in @buf | |
56 | */ | |
57 | static int d_namespace_path(struct path *path, char *buf, int buflen, | |
58 | char **name, int flags) | |
59 | { | |
60 | struct path root, tmp; | |
61 | char *res; | |
62 | int deleted, connected; | |
63 | int error = 0; | |
64 | ||
65 | /* Get the root we want to resolve too */ | |
66 | if (flags & PATH_CHROOT_REL) { | |
67 | /* resolve paths relative to chroot */ | |
68 | read_lock(¤t->fs->lock); | |
69 | root = current->fs->root; | |
70 | /* released below */ | |
71 | path_get(&root); | |
72 | read_unlock(¤t->fs->lock); | |
73 | } else { | |
74 | /* resolve paths relative to namespace */ | |
75 | root.mnt = current->nsproxy->mnt_ns->root; | |
76 | root.dentry = root.mnt->mnt_root; | |
77 | /* released below */ | |
78 | path_get(&root); | |
79 | } | |
80 | ||
81 | spin_lock(&dcache_lock); | |
82 | /* There is a race window between path lookup here and the | |
83 | * need to strip the " (deleted) string that __d_path applies | |
84 | * Detect the race and relookup the path | |
85 | * | |
86 | * The stripping of (deleted) is a hack that could be removed | |
87 | * with an updated __d_path | |
88 | */ | |
89 | do { | |
90 | tmp = root; | |
91 | deleted = d_unlinked(path->dentry); | |
92 | res = __d_path(path, &tmp, buf, buflen); | |
93 | ||
94 | } while (deleted != d_unlinked(path->dentry)); | |
95 | spin_unlock(&dcache_lock); | |
96 | ||
97 | *name = res; | |
98 | /* handle error conditions - and still allow a partial path to | |
99 | * be returned. | |
100 | */ | |
101 | if (IS_ERR(res)) { | |
102 | error = PTR_ERR(res); | |
103 | *name = buf; | |
104 | goto out; | |
105 | } | |
106 | if (deleted) { | |
107 | /* On some filesystems, newly allocated dentries appear to the | |
108 | * security_path hooks as a deleted dentry except without an | |
109 | * inode allocated. | |
110 | * | |
111 | * Remove the appended deleted text and return as string for | |
112 | * normal mediation, or auditing. The (deleted) string is | |
113 | * guaranteed to be added in this case, so just strip it. | |
114 | */ | |
115 | buf[buflen - 11] = 0; /* - (len(" (deleted)") +\0) */ | |
116 | ||
117 | if (path->dentry->d_inode && !(flags & PATH_MEDIATE_DELETED)) { | |
118 | error = -ENOENT; | |
119 | goto out; | |
120 | } | |
121 | } | |
122 | ||
123 | /* Determine if the path is connected to the expected root */ | |
124 | connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt; | |
125 | ||
126 | /* If the path is not connected, | |
127 | * check if it is a sysctl and handle specially else remove any | |
128 | * leading / that __d_path may have returned. | |
129 | * Unless | |
130 | * specifically directed to connect the path, | |
131 | * OR | |
132 | * if in a chroot and doing chroot relative paths and the path | |
133 | * resolves to the namespace root (would be connected outside | |
134 | * of chroot) and specifically directed to connect paths to | |
135 | * namespace root. | |
136 | */ | |
137 | if (!connected) { | |
138 | /* is the disconnect path a sysctl? */ | |
139 | if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC && | |
140 | strncmp(*name, "/sys/", 5) == 0) { | |
141 | /* TODO: convert over to using a per namespace | |
142 | * control instead of hard coded /proc | |
143 | */ | |
144 | error = prepend(name, *name - buf, "/proc", 5); | |
145 | } else if (!(flags & PATH_CONNECT_PATH) && | |
146 | !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) && | |
147 | (tmp.mnt == current->nsproxy->mnt_ns->root && | |
148 | tmp.dentry == tmp.mnt->mnt_root))) { | |
149 | /* disconnected path, don't return pathname starting | |
150 | * with '/' | |
151 | */ | |
152 | error = -ESTALE; | |
153 | if (*res == '/') | |
154 | *name = res + 1; | |
155 | } | |
156 | } | |
157 | ||
158 | out: | |
159 | path_put(&root); | |
160 | ||
161 | return error; | |
162 | } | |
163 | ||
164 | /** | |
165 | * get_name_to_buffer - get the pathname to a buffer ensure dir / is appended | |
166 | * @path: path to get name for (NOT NULL) | |
167 | * @flags: flags controlling path lookup | |
168 | * @buffer: buffer to put name in (NOT NULL) | |
169 | * @size: size of buffer | |
170 | * @name: Returns - contains position of path name in @buffer (NOT NULL) | |
171 | * | |
172 | * Returns: %0 else error on failure | |
173 | */ | |
174 | static int get_name_to_buffer(struct path *path, int flags, char *buffer, | |
175 | int size, char **name) | |
176 | { | |
177 | int adjust = (flags & PATH_IS_DIR) ? 1 : 0; | |
178 | int error = d_namespace_path(path, buffer, size - adjust, name, flags); | |
179 | ||
180 | if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0') | |
181 | /* | |
182 | * Append "/" to the pathname. The root directory is a special | |
183 | * case; it already ends in slash. | |
184 | */ | |
185 | strcpy(&buffer[size - 2], "/"); | |
186 | ||
187 | return error; | |
188 | } | |
189 | ||
190 | /** | |
191 | * aa_get_name - compute the pathname of a file | |
192 | * @path: path the file (NOT NULL) | |
193 | * @flags: flags controlling path name generation | |
194 | * @buffer: buffer that aa_get_name() allocated (NOT NULL) | |
195 | * @name: Returns - the generated path name if !error (NOT NULL) | |
196 | * | |
197 | * @name is a pointer to the beginning of the pathname (which usually differs | |
198 | * from the beginning of the buffer), or NULL. If there is an error @name | |
199 | * may contain a partial or invalid name that can be used for audit purposes, | |
200 | * but it can not be used for mediation. | |
201 | * | |
202 | * We need PATH_IS_DIR to indicate whether the file is a directory or not | |
203 | * because the file may not yet exist, and so we cannot check the inode's | |
204 | * file type. | |
205 | * | |
206 | * Returns: %0 else error code if could retrieve name | |
207 | */ | |
208 | int aa_get_name(struct path *path, int flags, char **buffer, const char **name) | |
209 | { | |
210 | char *buf, *str = NULL; | |
211 | int size = 256; | |
212 | int error; | |
213 | ||
214 | *name = NULL; | |
215 | *buffer = NULL; | |
216 | for (;;) { | |
217 | /* freed by caller */ | |
218 | buf = kmalloc(size, GFP_KERNEL); | |
219 | if (!buf) | |
220 | return -ENOMEM; | |
221 | ||
222 | error = get_name_to_buffer(path, flags, buf, size, &str); | |
223 | if (error != -ENAMETOOLONG) | |
224 | break; | |
225 | ||
226 | kfree(buf); | |
227 | size <<= 1; | |
228 | if (size > aa_g_path_max) | |
229 | return -ENAMETOOLONG; | |
230 | } | |
231 | *buffer = buf; | |
232 | *name = str; | |
233 | ||
234 | return error; | |
235 | } |