Commit | Line | Data |
---|---|---|
b886d83c | 1 | // SPDX-License-Identifier: GPL-2.0-only |
0ed3b28a JJ |
2 | /* |
3 | * AppArmor security module | |
4 | * | |
5 | * This file contains AppArmor resource mediation and attachment | |
6 | * | |
7 | * Copyright (C) 1998-2008 Novell/SUSE | |
8 | * Copyright 2009-2010 Canonical Ltd. | |
0ed3b28a JJ |
9 | */ |
10 | ||
11 | #include <linux/audit.h> | |
86b92cb7 | 12 | #include <linux/security.h> |
0ed3b28a JJ |
13 | |
14 | #include "include/audit.h" | |
d8889d49 | 15 | #include "include/cred.h" |
0ed3b28a JJ |
16 | #include "include/resource.h" |
17 | #include "include/policy.h" | |
18 | ||
19 | /* | |
20 | * Table of rlimit names: we generate it from resource.h. | |
21 | */ | |
22 | #include "rlim_names.h" | |
23 | ||
c97204ba JJ |
24 | struct aa_sfs_entry aa_sfs_entry_rlimit[] = { |
25 | AA_SFS_FILE_STRING("mask", AA_SFS_RLIMIT_MASK), | |
d384b0a1 KC |
26 | { } |
27 | }; | |
28 | ||
0ed3b28a JJ |
29 | /* audit callback for resource specific fields */ |
30 | static void audit_cb(struct audit_buffer *ab, void *va) | |
31 | { | |
32 | struct common_audit_data *sa = va; | |
33 | ||
34 | audit_log_format(ab, " rlimit=%s value=%lu", | |
ef88a7ac | 35 | rlim_names[aad(sa)->rlim.rlim], aad(sa)->rlim.max); |
86b92cb7 JJ |
36 | if (aad(sa)->peer) { |
37 | audit_log_format(ab, " peer="); | |
38 | aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, | |
39 | FLAGS_NONE, GFP_ATOMIC); | |
40 | } | |
0ed3b28a JJ |
41 | } |
42 | ||
43 | /** | |
44 | * audit_resource - audit setting resource limit | |
45 | * @profile: profile being enforced (NOT NULL) | |
5933a627 | 46 | * @resource: rlimit being auditing |
0ed3b28a | 47 | * @value: value being set |
1f2bc06a GC |
48 | * @peer: aa_albel of the task being set |
49 | * @info: info being auditing | |
0ed3b28a JJ |
50 | * @error: error value |
51 | * | |
52 | * Returns: 0 or sa->error else other error code on failure | |
53 | */ | |
54 | static int audit_resource(struct aa_profile *profile, unsigned int resource, | |
86b92cb7 JJ |
55 | unsigned long value, struct aa_label *peer, |
56 | const char *info, int error) | |
0ed3b28a | 57 | { |
8c4b785a JJ |
58 | DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_RLIMITS, |
59 | OP_SETRLIMIT); | |
0ed3b28a | 60 | |
ef88a7ac JJ |
61 | aad(&sa)->rlim.rlim = resource; |
62 | aad(&sa)->rlim.max = value; | |
86b92cb7 JJ |
63 | aad(&sa)->peer = peer; |
64 | aad(&sa)->info = info; | |
ef88a7ac | 65 | aad(&sa)->error = error; |
86b92cb7 | 66 | |
ef88a7ac | 67 | return aa_audit(AUDIT_APPARMOR_AUTO, profile, &sa, audit_cb); |
0ed3b28a JJ |
68 | } |
69 | ||
70 | /** | |
71 | * aa_map_resouce - map compiled policy resource to internal # | |
72 | * @resource: flattened policy resource number | |
73 | * | |
74 | * Returns: resource # for the current architecture. | |
75 | * | |
76 | * rlimit resource can vary based on architecture, map the compiled policy | |
77 | * resource # to the internal representation for the architecture. | |
78 | */ | |
79 | int aa_map_resource(int resource) | |
80 | { | |
81 | return rlim_map[resource]; | |
82 | } | |
83 | ||
86b92cb7 JJ |
84 | static int profile_setrlimit(struct aa_profile *profile, unsigned int resource, |
85 | struct rlimit *new_rlim) | |
86 | { | |
1ad22fcc JJ |
87 | struct aa_ruleset *rules = list_first_entry(&profile->rules, |
88 | typeof(*rules), list); | |
86b92cb7 JJ |
89 | int e = 0; |
90 | ||
217af7e2 JJ |
91 | if (rules->rlimits.mask & (1 << resource) && new_rlim->rlim_max > |
92 | rules->rlimits.limits[resource].rlim_max) | |
86b92cb7 JJ |
93 | e = -EACCES; |
94 | return audit_resource(profile, resource, new_rlim->rlim_max, NULL, NULL, | |
95 | e); | |
96 | } | |
97 | ||
0ed3b28a JJ |
98 | /** |
99 | * aa_task_setrlimit - test permission to set an rlimit | |
86b92cb7 | 100 | * @label - label confining the task (NOT NULL) |
3a2dc838 | 101 | * @task - task the resource is being set on |
0ed3b28a JJ |
102 | * @resource - the resource being set |
103 | * @new_rlim - the new resource limit (NOT NULL) | |
104 | * | |
105 | * Control raising the processes hard limit. | |
106 | * | |
107 | * Returns: 0 or error code if setting resource failed | |
108 | */ | |
86b92cb7 | 109 | int aa_task_setrlimit(struct aa_label *label, struct task_struct *task, |
3a2dc838 | 110 | unsigned int resource, struct rlimit *new_rlim) |
0ed3b28a | 111 | { |
86b92cb7 JJ |
112 | struct aa_profile *profile; |
113 | struct aa_label *peer; | |
0ed3b28a JJ |
114 | int error = 0; |
115 | ||
cf47aede | 116 | rcu_read_lock(); |
86b92cb7 | 117 | peer = aa_get_newest_cred_label(__task_cred(task)); |
cf47aede JJ |
118 | rcu_read_unlock(); |
119 | ||
3a2dc838 | 120 | /* TODO: extend resource control to handle other (non current) |
cf47aede JJ |
121 | * profiles. AppArmor rules currently have the implicit assumption |
122 | * that the task is setting the resource of a task confined with | |
ff118479 JM |
123 | * the same profile or that the task setting the resource of another |
124 | * task has CAP_SYS_RESOURCE. | |
3a2dc838 | 125 | */ |
0ed3b28a | 126 | |
86b92cb7 | 127 | if (label != peer && |
c1a85a00 | 128 | aa_capable(label, CAP_SYS_RESOURCE, CAP_OPT_NOAUDIT) != 0) |
86b92cb7 JJ |
129 | error = fn_for_each(label, profile, |
130 | audit_resource(profile, resource, | |
131 | new_rlim->rlim_max, peer, | |
5933a627 | 132 | "cap_sys_resource", -EACCES)); |
86b92cb7 JJ |
133 | else |
134 | error = fn_for_each_confined(label, profile, | |
135 | profile_setrlimit(profile, resource, new_rlim)); | |
136 | aa_put_label(peer); | |
137 | ||
138 | return error; | |
0ed3b28a JJ |
139 | } |
140 | ||
141 | /** | |
142 | * __aa_transition_rlimits - apply new profile rlimits | |
86b92cb7 JJ |
143 | * @old_l: old label on task (NOT NULL) |
144 | * @new_l: new label with rlimits to apply (NOT NULL) | |
0ed3b28a | 145 | */ |
86b92cb7 | 146 | void __aa_transition_rlimits(struct aa_label *old_l, struct aa_label *new_l) |
0ed3b28a JJ |
147 | { |
148 | unsigned int mask = 0; | |
149 | struct rlimit *rlim, *initrlim; | |
86b92cb7 JJ |
150 | struct aa_profile *old, *new; |
151 | struct label_it i; | |
152 | ||
153 | old = labels_profile(old_l); | |
154 | new = labels_profile(new_l); | |
0ed3b28a | 155 | |
86b92cb7 JJ |
156 | /* for any rlimits the profile controlled, reset the soft limit |
157 | * to the lesser of the tasks hard limit and the init tasks soft limit | |
0ed3b28a | 158 | */ |
86b92cb7 | 159 | label_for_each_confined(i, old_l, old) { |
1ad22fcc JJ |
160 | struct aa_ruleset *rules = list_first_entry(&old->rules, |
161 | typeof(*rules), | |
162 | list); | |
163 | if (rules->rlimits.mask) { | |
86b92cb7 JJ |
164 | int j; |
165 | ||
166 | for (j = 0, mask = 1; j < RLIM_NLIMITS; j++, | |
167 | mask <<= 1) { | |
1ad22fcc | 168 | if (rules->rlimits.mask & mask) { |
86b92cb7 JJ |
169 | rlim = current->signal->rlim + j; |
170 | initrlim = init_task.signal->rlim + j; | |
171 | rlim->rlim_cur = min(rlim->rlim_max, | |
172 | initrlim->rlim_cur); | |
173 | } | |
0ed3b28a JJ |
174 | } |
175 | } | |
176 | } | |
177 | ||
178 | /* set any new hard limits as dictated by the new profile */ | |
86b92cb7 | 179 | label_for_each_confined(i, new_l, new) { |
1ad22fcc JJ |
180 | struct aa_ruleset *rules = list_first_entry(&new->rules, |
181 | typeof(*rules), | |
182 | list); | |
86b92cb7 | 183 | int j; |
0ed3b28a | 184 | |
1ad22fcc | 185 | if (!rules->rlimits.mask) |
86b92cb7 JJ |
186 | continue; |
187 | for (j = 0, mask = 1; j < RLIM_NLIMITS; j++, mask <<= 1) { | |
1ad22fcc | 188 | if (!(rules->rlimits.mask & mask)) |
86b92cb7 JJ |
189 | continue; |
190 | ||
191 | rlim = current->signal->rlim + j; | |
192 | rlim->rlim_max = min(rlim->rlim_max, | |
1ad22fcc | 193 | rules->rlimits.limits[j].rlim_max); |
86b92cb7 JJ |
194 | /* soft limit should not exceed hard limit */ |
195 | rlim->rlim_cur = min(rlim->rlim_cur, rlim->rlim_max); | |
196 | } | |
0ed3b28a JJ |
197 | } |
198 | } |