2 * AppArmor security module
4 * This file contains AppArmor /sys/kernel/security/apparmor interface functions
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
15 #include <linux/ctype.h>
16 #include <linux/security.h>
17 #include <linux/vmalloc.h>
18 #include <linux/init.h>
19 #include <linux/seq_file.h>
20 #include <linux/uaccess.h>
21 #include <linux/mount.h>
22 #include <linux/namei.h>
23 #include <linux/capability.h>
24 #include <linux/rcupdate.h>
26 #include <linux/poll.h>
27 #include <uapi/linux/major.h>
28 #include <uapi/linux/magic.h>
30 #include "include/apparmor.h"
31 #include "include/apparmorfs.h"
32 #include "include/audit.h"
33 #include "include/cred.h"
34 #include "include/crypto.h"
35 #include "include/ipc.h"
36 #include "include/label.h"
37 #include "include/policy.h"
38 #include "include/policy_ns.h"
39 #include "include/resource.h"
40 #include "include/policy_unpack.h"
43 * The apparmor filesystem interface used for policy load and introspection
44 * The interface is split into two main components based on their function
45 * a securityfs component:
46 * used for static files that are always available, and which allows
47 * userspace to specificy the location of the security filesystem.
49 * fns and data are prefixed with
52 * an apparmorfs component:
53 * used loaded policy content and introspection. It is not part of a
54 * regular mounted filesystem and is available only through the magic
55 * policy symlink in the root of the securityfs apparmor/ directory.
56 * Tasks queries will be magically redirected to the correct portion
57 * of the policy tree based on their confinement.
59 * fns and data are prefixed with
62 * The aa_fs_ prefix is used to indicate the fn is used by both the
63 * securityfs and apparmorfs filesystems.
72 * aa_mangle_name - mangle a profile name to std profile layout form
73 * @name: profile name to mangle (NOT NULL)
74 * @target: buffer to store mangled name, same length as @name (MAYBE NULL)
76 * Returns: length of mangled name
78 static int mangle_name(const char *name, char *target)
82 while (*name == '/' || *name == '.')
86 for (; *name; name++) {
89 else if (isspace(*name))
91 else if (isalnum(*name) || strchr("._-", *name))
98 for (; *name; name++) {
99 if (isalnum(*name) || isspace(*name) ||
100 strchr("/._-", *name))
112 * aafs - core fns and data for the policy tree
115 #define AAFS_NAME "apparmorfs"
116 static struct vfsmount *aafs_mnt;
117 static int aafs_count;
120 static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
122 seq_printf(seq, "%s:[%lu]", AAFS_NAME, d_inode(dentry)->i_ino);
126 static void aafs_evict_inode(struct inode *inode)
128 truncate_inode_pages_final(&inode->i_data);
130 if (S_ISLNK(inode->i_mode))
131 kfree(inode->i_link);
134 static const struct super_operations aafs_super_ops = {
135 .statfs = simple_statfs,
136 .evict_inode = aafs_evict_inode,
137 .show_path = aafs_show_path,
140 static int fill_super(struct super_block *sb, void *data, int silent)
142 static struct tree_descr files[] = { {""} };
145 error = simple_fill_super(sb, AAFS_MAGIC, files);
148 sb->s_op = &aafs_super_ops;
153 static struct dentry *aafs_mount(struct file_system_type *fs_type,
154 int flags, const char *dev_name, void *data)
156 return mount_single(fs_type, flags, data, fill_super);
159 static struct file_system_type aafs_ops = {
160 .owner = THIS_MODULE,
163 .kill_sb = kill_anon_super,
167 * __aafs_setup_d_inode - basic inode setup for apparmorfs
168 * @dir: parent directory for the dentry
169 * @dentry: dentry we are seting the inode up for
170 * @mode: permissions the file should have
171 * @data: data to store on inode.i_private, available in open()
172 * @link: if symlink, symlink target string
173 * @fops: struct file_operations that should be used
174 * @iops: struct of inode_operations that should be used
176 static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
177 umode_t mode, void *data, char *link,
178 const struct file_operations *fops,
179 const struct inode_operations *iops)
181 struct inode *inode = new_inode(dir->i_sb);
189 inode->i_ino = get_next_ino();
190 inode->i_mode = mode;
191 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
192 inode->i_private = data;
194 inode->i_op = iops ? iops : &simple_dir_inode_operations;
195 inode->i_fop = &simple_dir_operations;
198 } else if (S_ISLNK(mode)) {
199 inode->i_op = iops ? iops : &simple_symlink_inode_operations;
200 inode->i_link = link;
204 d_instantiate(dentry, inode);
211 * aafs_create - create a dentry in the apparmorfs filesystem
213 * @name: name of dentry to create
214 * @mode: permissions the file should have
215 * @parent: parent directory for this dentry
216 * @data: data to store on inode.i_private, available in open()
217 * @link: if symlink, symlink target string
218 * @fops: struct file_operations that should be used for
219 * @iops: struct of inode_operations that should be used
221 * This is the basic "create a xxx" function for apparmorfs.
223 * Returns a pointer to a dentry if it succeeds, that must be free with
224 * aafs_remove(). Will return ERR_PTR on failure.
226 static struct dentry *aafs_create(const char *name, umode_t mode,
227 struct dentry *parent, void *data, void *link,
228 const struct file_operations *fops,
229 const struct inode_operations *iops)
231 struct dentry *dentry;
238 if (!(mode & S_IFMT))
239 mode = (mode & S_IALLUGO) | S_IFREG;
241 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
243 return ERR_PTR(error);
245 dir = d_inode(parent);
248 dentry = lookup_one_len(name, parent, strlen(name));
249 if (IS_ERR(dentry)) {
250 error = PTR_ERR(dentry);
254 if (d_really_is_positive(dentry)) {
259 error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
271 simple_release_fs(&aafs_mnt, &aafs_count);
273 return ERR_PTR(error);
277 * aafs_create_file - create a file in the apparmorfs filesystem
279 * @name: name of dentry to create
280 * @mode: permissions the file should have
281 * @parent: parent directory for this dentry
282 * @data: data to store on inode.i_private, available in open()
283 * @fops: struct file_operations that should be used for
287 static struct dentry *aafs_create_file(const char *name, umode_t mode,
288 struct dentry *parent, void *data,
289 const struct file_operations *fops)
291 return aafs_create(name, mode, parent, data, NULL, fops, NULL);
295 * aafs_create_dir - create a directory in the apparmorfs filesystem
297 * @name: name of dentry to create
298 * @parent: parent directory for this dentry
302 static struct dentry *aafs_create_dir(const char *name, struct dentry *parent)
304 return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL,
309 * aafs_create_symlink - create a symlink in the apparmorfs filesystem
310 * @name: name of dentry to create
311 * @parent: parent directory for this dentry
312 * @target: if symlink, symlink target string
313 * @private: private data
314 * @iops: struct of inode_operations that should be used
316 * If @target parameter is %NULL, then the @iops parameter needs to be
317 * setup to handle .readlink and .get_link inode_operations.
319 static struct dentry *aafs_create_symlink(const char *name,
320 struct dentry *parent,
323 const struct inode_operations *iops)
330 return ERR_PTR(-ENOMEM);
332 dent = aafs_create(name, S_IFLNK | 0444, parent, private, link, NULL,
341 * aafs_remove - removes a file or directory from the apparmorfs filesystem
343 * @dentry: dentry of the file/directory/symlink to removed.
345 static void aafs_remove(struct dentry *dentry)
349 if (!dentry || IS_ERR(dentry))
352 dir = d_inode(dentry->d_parent);
354 if (simple_positive(dentry)) {
355 if (d_is_dir(dentry))
356 simple_rmdir(dir, dentry);
358 simple_unlink(dir, dentry);
363 simple_release_fs(&aafs_mnt, &aafs_count);
368 * aa_fs - policy load/replace/remove
372 * aa_simple_write_to_buffer - common routine for getting policy from user
373 * @userbuf: user buffer to copy data from (NOT NULL)
374 * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size)
375 * @copy_size: size of data to copy from user buffer
376 * @pos: position write is at in the file (NOT NULL)
378 * Returns: kernel buffer containing copy of user buffer data or an
379 * ERR_PTR on failure.
381 static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
386 struct aa_loaddata *data;
388 AA_BUG(copy_size > alloc_size);
391 /* only writes from pos 0, that is complete writes */
392 return ERR_PTR(-ESPIPE);
394 /* freed by caller to simple_write_to_buffer */
395 data = aa_loaddata_alloc(alloc_size);
399 data->size = copy_size;
400 if (copy_from_user(data->data, userbuf, copy_size)) {
402 return ERR_PTR(-EFAULT);
408 static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
409 loff_t *pos, struct aa_ns *ns)
411 struct aa_loaddata *data;
412 struct aa_label *label;
415 label = begin_current_label_crit_section();
417 /* high level check about policy management - fine grained in
420 error = aa_may_manage_policy(label, ns, mask);
424 data = aa_simple_write_to_buffer(buf, size, size, pos);
425 error = PTR_ERR(data);
427 error = aa_replace_profiles(ns, label, mask, data);
428 aa_put_loaddata(data);
430 end_current_label_crit_section(label);
435 /* .load file hook fn to load policy */
436 static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
439 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
440 int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
447 static const struct file_operations aa_fs_profile_load = {
448 .write = profile_load,
449 .llseek = default_llseek,
452 /* .replace file hook fn to load and/or replace policy */
453 static ssize_t profile_replace(struct file *f, const char __user *buf,
454 size_t size, loff_t *pos)
456 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
457 int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
464 static const struct file_operations aa_fs_profile_replace = {
465 .write = profile_replace,
466 .llseek = default_llseek,
469 /* .remove file hook fn to remove loaded policy */
470 static ssize_t profile_remove(struct file *f, const char __user *buf,
471 size_t size, loff_t *pos)
473 struct aa_loaddata *data;
474 struct aa_label *label;
476 struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
478 label = begin_current_label_crit_section();
479 /* high level check about policy management - fine grained in
482 error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);
487 * aa_remove_profile needs a null terminated string so 1 extra
488 * byte is allocated and the copied data is null terminated.
490 data = aa_simple_write_to_buffer(buf, size + 1, size, pos);
492 error = PTR_ERR(data);
494 data->data[size] = 0;
495 error = aa_remove_profiles(ns, label, data->data, size);
496 aa_put_loaddata(data);
499 end_current_label_crit_section(label);
504 static const struct file_operations aa_fs_profile_remove = {
505 .write = profile_remove,
506 .llseek = default_llseek,
514 /* revision file hook fn for policy loads */
515 static int ns_revision_release(struct inode *inode, struct file *file)
517 struct aa_revision *rev = file->private_data;
527 static ssize_t ns_revision_read(struct file *file, char __user *buf,
528 size_t size, loff_t *ppos)
530 struct aa_revision *rev = file->private_data;
535 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
536 last_read = rev->last_read;
537 if (last_read == rev->ns->revision) {
538 mutex_unlock(&rev->ns->lock);
539 if (file->f_flags & O_NONBLOCK)
541 if (wait_event_interruptible(rev->ns->wait,
543 READ_ONCE(rev->ns->revision)))
545 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
548 avail = sprintf(buffer, "%ld\n", rev->ns->revision);
549 if (*ppos + size > avail) {
550 rev->last_read = rev->ns->revision;
553 mutex_unlock(&rev->ns->lock);
555 return simple_read_from_buffer(buf, size, ppos, buffer, avail);
558 static int ns_revision_open(struct inode *inode, struct file *file)
560 struct aa_revision *rev = kzalloc(sizeof(*rev), GFP_KERNEL);
565 rev->ns = aa_get_ns(inode->i_private);
567 rev->ns = aa_get_current_ns();
568 file->private_data = rev;
573 static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
575 struct aa_revision *rev = file->private_data;
579 mutex_lock_nested(&rev->ns->lock, rev->ns->level);
580 poll_wait(file, &rev->ns->wait, pt);
581 if (rev->last_read < rev->ns->revision)
582 mask |= EPOLLIN | EPOLLRDNORM;
583 mutex_unlock(&rev->ns->lock);
589 void __aa_bump_ns_revision(struct aa_ns *ns)
592 wake_up_interruptible(&ns->wait);
595 static const struct file_operations aa_fs_ns_revision_fops = {
596 .owner = THIS_MODULE,
597 .open = ns_revision_open,
598 .poll = ns_revision_poll,
599 .read = ns_revision_read,
600 .llseek = generic_file_llseek,
601 .release = ns_revision_release,
604 static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
605 const char *match_str, size_t match_len)
607 struct aa_perms tmp = { };
609 unsigned int state = 0;
611 if (profile_unconfined(profile))
613 if (profile->file.dfa && *match_str == AA_CLASS_FILE) {
614 dfa = profile->file.dfa;
615 state = aa_dfa_match_len(dfa, profile->file.start,
616 match_str + 1, match_len - 1);
618 struct path_cond cond = { };
620 tmp = aa_compute_fperms(dfa, state, &cond);
622 } else if (profile->policy.dfa) {
623 if (!PROFILE_MEDIATES(profile, *match_str))
624 return; /* no change to current perms */
625 dfa = profile->policy.dfa;
626 state = aa_dfa_match_len(dfa, profile->policy.start[0],
627 match_str, match_len);
629 aa_compute_perms(dfa, state, &tmp);
631 aa_apply_modes_to_perms(profile, &tmp);
632 aa_perms_accum_raw(perms, &tmp);
637 * query_data - queries a policy and writes its data to buf
638 * @buf: the resulting data is stored here (NOT NULL)
639 * @buf_len: size of buf
640 * @query: query string used to retrieve data
641 * @query_len: size of query including second NUL byte
643 * The buffers pointed to by buf and query may overlap. The query buffer is
644 * parsed before buf is written to.
646 * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of
647 * the security confinement context and <KEY> is the name of the data to
648 * retrieve. <LABEL> and <KEY> must not be NUL-terminated.
650 * Don't expect the contents of buf to be preserved on failure.
652 * Returns: number of characters written to buf or -errno on failure
654 static ssize_t query_data(char *buf, size_t buf_len,
655 char *query, size_t query_len)
660 struct aa_label *label, *curr;
661 struct aa_profile *profile;
662 struct aa_data *data;
667 return -EINVAL; /* need a query */
669 key = query + strnlen(query, query_len) + 1;
670 if (key + 1 >= query + query_len)
671 return -EINVAL; /* not enough space for a non-empty key */
672 if (key + strnlen(key, query + query_len - key) >= query + query_len)
673 return -EINVAL; /* must end with NUL */
675 if (buf_len < sizeof(bytes) + sizeof(blocks))
676 return -EINVAL; /* not enough space */
678 curr = begin_current_label_crit_section();
679 label = aa_label_parse(curr, query, GFP_KERNEL, false, false);
680 end_current_label_crit_section(curr);
682 return PTR_ERR(label);
684 /* We are going to leave space for two numbers. The first is the total
685 * number of bytes we are writing after the first number. This is so
686 * users can read the full output without reallocation.
688 * The second number is the number of data blocks we're writing. An
689 * application might be confined by multiple policies having data in
692 memset(buf, 0, sizeof(bytes) + sizeof(blocks));
693 out = buf + sizeof(bytes) + sizeof(blocks);
696 label_for_each_confined(i, label, profile) {
700 data = rhashtable_lookup_fast(profile->data, &key,
704 if (out + sizeof(outle32) + data->size > buf +
707 return -EINVAL; /* not enough space */
709 outle32 = __cpu_to_le32(data->size);
710 memcpy(out, &outle32, sizeof(outle32));
711 out += sizeof(outle32);
712 memcpy(out, data->data, data->size);
719 outle32 = __cpu_to_le32(out - buf - sizeof(bytes));
720 memcpy(buf, &outle32, sizeof(outle32));
721 outle32 = __cpu_to_le32(blocks);
722 memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32));
728 * query_label - queries a label and writes permissions to buf
729 * @buf: the resulting permissions string is stored here (NOT NULL)
730 * @buf_len: size of buf
731 * @query: binary query string to match against the dfa
732 * @query_len: size of query
733 * @view_only: only compute for querier's view
735 * The buffers pointed to by buf and query may overlap. The query buffer is
736 * parsed before buf is written to.
738 * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is
739 * the name of the label, in the current namespace, that is to be queried and
740 * DFA_STRING is a binary string to match against the label(s)'s DFA.
742 * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters
743 * but must *not* be NUL terminated.
745 * Returns: number of characters written to buf or -errno on failure
747 static ssize_t query_label(char *buf, size_t buf_len,
748 char *query, size_t query_len, bool view_only)
750 struct aa_profile *profile;
751 struct aa_label *label, *curr;
752 char *label_name, *match_str;
753 size_t label_name_len, match_len;
754 struct aa_perms perms;
761 label_name_len = strnlen(query, query_len);
762 if (!label_name_len || label_name_len == query_len)
766 * The extra byte is to account for the null byte between the
767 * profile name and dfa string. profile_name_len is greater
768 * than zero and less than query_len, so a byte can be safely
769 * added or subtracted.
771 match_str = label_name + label_name_len + 1;
772 match_len = query_len - label_name_len - 1;
774 curr = begin_current_label_crit_section();
775 label = aa_label_parse(curr, label_name, GFP_KERNEL, false, false);
776 end_current_label_crit_section(curr);
778 return PTR_ERR(label);
782 label_for_each_in_ns(i, labels_ns(label), label, profile) {
783 profile_query_cb(profile, &perms, match_str, match_len);
786 label_for_each(i, label, profile) {
787 profile_query_cb(profile, &perms, match_str, match_len);
792 return scnprintf(buf, buf_len,
793 "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n",
794 perms.allow, perms.deny, perms.audit, perms.quiet);
798 * Transaction based IO.
799 * The file expects a write which triggers the transaction, and then
800 * possibly a read(s) which collects the result - which is stored in a
801 * file-local buffer. Once a new write is performed, a new set of results
802 * are stored in the file-local buffer.
804 struct multi_transaction {
810 #define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction))
811 /* TODO: replace with per file lock */
812 static DEFINE_SPINLOCK(multi_transaction_lock);
814 static void multi_transaction_kref(struct kref *kref)
816 struct multi_transaction *t;
818 t = container_of(kref, struct multi_transaction, count);
819 free_page((unsigned long) t);
822 static struct multi_transaction *
823 get_multi_transaction(struct multi_transaction *t)
826 kref_get(&(t->count));
831 static void put_multi_transaction(struct multi_transaction *t)
834 kref_put(&(t->count), multi_transaction_kref);
837 /* does not increment @new's count */
838 static void multi_transaction_set(struct file *file,
839 struct multi_transaction *new, size_t n)
841 struct multi_transaction *old;
843 AA_BUG(n > MULTI_TRANSACTION_LIMIT);
846 spin_lock(&multi_transaction_lock);
847 old = (struct multi_transaction *) file->private_data;
848 file->private_data = new;
849 spin_unlock(&multi_transaction_lock);
850 put_multi_transaction(old);
853 static struct multi_transaction *multi_transaction_new(struct file *file,
854 const char __user *buf,
857 struct multi_transaction *t;
859 if (size > MULTI_TRANSACTION_LIMIT - 1)
860 return ERR_PTR(-EFBIG);
862 t = (struct multi_transaction *)get_zeroed_page(GFP_KERNEL);
864 return ERR_PTR(-ENOMEM);
865 kref_init(&t->count);
866 if (copy_from_user(t->data, buf, size))
867 return ERR_PTR(-EFAULT);
872 static ssize_t multi_transaction_read(struct file *file, char __user *buf,
873 size_t size, loff_t *pos)
875 struct multi_transaction *t;
878 spin_lock(&multi_transaction_lock);
879 t = get_multi_transaction(file->private_data);
880 spin_unlock(&multi_transaction_lock);
884 ret = simple_read_from_buffer(buf, size, pos, t->data, t->size);
885 put_multi_transaction(t);
890 static int multi_transaction_release(struct inode *inode, struct file *file)
892 put_multi_transaction(file->private_data);
897 #define QUERY_CMD_LABEL "label\0"
898 #define QUERY_CMD_LABEL_LEN 6
899 #define QUERY_CMD_PROFILE "profile\0"
900 #define QUERY_CMD_PROFILE_LEN 8
901 #define QUERY_CMD_LABELALL "labelall\0"
902 #define QUERY_CMD_LABELALL_LEN 9
903 #define QUERY_CMD_DATA "data\0"
904 #define QUERY_CMD_DATA_LEN 5
907 * aa_write_access - generic permissions and data query
908 * @file: pointer to open apparmorfs/access file
909 * @ubuf: user buffer containing the complete query string (NOT NULL)
910 * @count: size of ubuf
911 * @ppos: position in the file (MUST BE ZERO)
913 * Allows for one permissions or data query per open(), write(), and read()
914 * sequence. The only queries currently supported are label-based queries for
915 * permissions or data.
917 * For permissions queries, ubuf must begin with "label\0", followed by the
918 * profile query specific format described in the query_label() function
921 * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where
922 * <LABEL> is the name of the security confinement context and <KEY> is the
923 * name of the data to retrieve.
925 * Returns: number of bytes written or -errno on failure
927 static ssize_t aa_write_access(struct file *file, const char __user *ubuf,
928 size_t count, loff_t *ppos)
930 struct multi_transaction *t;
936 t = multi_transaction_new(file, ubuf, count);
940 if (count > QUERY_CMD_PROFILE_LEN &&
941 !memcmp(t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) {
942 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
943 t->data + QUERY_CMD_PROFILE_LEN,
944 count - QUERY_CMD_PROFILE_LEN, true);
945 } else if (count > QUERY_CMD_LABEL_LEN &&
946 !memcmp(t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) {
947 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
948 t->data + QUERY_CMD_LABEL_LEN,
949 count - QUERY_CMD_LABEL_LEN, true);
950 } else if (count > QUERY_CMD_LABELALL_LEN &&
951 !memcmp(t->data, QUERY_CMD_LABELALL,
952 QUERY_CMD_LABELALL_LEN)) {
953 len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
954 t->data + QUERY_CMD_LABELALL_LEN,
955 count - QUERY_CMD_LABELALL_LEN, false);
956 } else if (count > QUERY_CMD_DATA_LEN &&
957 !memcmp(t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) {
958 len = query_data(t->data, MULTI_TRANSACTION_LIMIT,
959 t->data + QUERY_CMD_DATA_LEN,
960 count - QUERY_CMD_DATA_LEN);
965 put_multi_transaction(t);
969 multi_transaction_set(file, t, len);
974 static const struct file_operations aa_sfs_access = {
975 .write = aa_write_access,
976 .read = multi_transaction_read,
977 .release = multi_transaction_release,
978 .llseek = generic_file_llseek,
981 static int aa_sfs_seq_show(struct seq_file *seq, void *v)
983 struct aa_sfs_entry *fs_file = seq->private;
988 switch (fs_file->v_type) {
989 case AA_SFS_TYPE_BOOLEAN:
990 seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
992 case AA_SFS_TYPE_STRING:
993 seq_printf(seq, "%s\n", fs_file->v.string);
995 case AA_SFS_TYPE_U64:
996 seq_printf(seq, "%#08lx\n", fs_file->v.u64);
999 /* Ignore unpritable entry types. */
1006 static int aa_sfs_seq_open(struct inode *inode, struct file *file)
1008 return single_open(file, aa_sfs_seq_show, inode->i_private);
1011 const struct file_operations aa_sfs_seq_file_ops = {
1012 .owner = THIS_MODULE,
1013 .open = aa_sfs_seq_open,
1015 .llseek = seq_lseek,
1016 .release = single_release,
1020 * profile based file operations
1021 * policy/profiles/XXXX/profiles/ *
1024 #define SEQ_PROFILE_FOPS(NAME) \
1025 static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\
1027 return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show); \
1030 static const struct file_operations seq_profile_ ##NAME ##_fops = { \
1031 .owner = THIS_MODULE, \
1032 .open = seq_profile_ ##NAME ##_open, \
1034 .llseek = seq_lseek, \
1035 .release = seq_profile_release, \
1038 static int seq_profile_open(struct inode *inode, struct file *file,
1039 int (*show)(struct seq_file *, void *))
1041 struct aa_proxy *proxy = aa_get_proxy(inode->i_private);
1042 int error = single_open(file, show, proxy);
1045 file->private_data = NULL;
1046 aa_put_proxy(proxy);
1052 static int seq_profile_release(struct inode *inode, struct file *file)
1054 struct seq_file *seq = (struct seq_file *) file->private_data;
1056 aa_put_proxy(seq->private);
1057 return single_release(inode, file);
1060 static int seq_profile_name_show(struct seq_file *seq, void *v)
1062 struct aa_proxy *proxy = seq->private;
1063 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1064 struct aa_profile *profile = labels_profile(label);
1065 seq_printf(seq, "%s\n", profile->base.name);
1066 aa_put_label(label);
1071 static int seq_profile_mode_show(struct seq_file *seq, void *v)
1073 struct aa_proxy *proxy = seq->private;
1074 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1075 struct aa_profile *profile = labels_profile(label);
1076 seq_printf(seq, "%s\n", aa_profile_mode_names[profile->mode]);
1077 aa_put_label(label);
1082 static int seq_profile_attach_show(struct seq_file *seq, void *v)
1084 struct aa_proxy *proxy = seq->private;
1085 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1086 struct aa_profile *profile = labels_profile(label);
1087 if (profile->attach)
1088 seq_printf(seq, "%s\n", profile->attach);
1089 else if (profile->xmatch)
1090 seq_puts(seq, "<unknown>\n");
1092 seq_printf(seq, "%s\n", profile->base.name);
1093 aa_put_label(label);
1098 static int seq_profile_hash_show(struct seq_file *seq, void *v)
1100 struct aa_proxy *proxy = seq->private;
1101 struct aa_label *label = aa_get_label_rcu(&proxy->label);
1102 struct aa_profile *profile = labels_profile(label);
1103 unsigned int i, size = aa_hash_size();
1105 if (profile->hash) {
1106 for (i = 0; i < size; i++)
1107 seq_printf(seq, "%.2x", profile->hash[i]);
1108 seq_putc(seq, '\n');
1110 aa_put_label(label);
1115 SEQ_PROFILE_FOPS(name);
1116 SEQ_PROFILE_FOPS(mode);
1117 SEQ_PROFILE_FOPS(attach);
1118 SEQ_PROFILE_FOPS(hash);
1121 * namespace based files
1122 * several root files and
1126 #define SEQ_NS_FOPS(NAME) \
1127 static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file) \
1129 return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private); \
1132 static const struct file_operations seq_ns_ ##NAME ##_fops = { \
1133 .owner = THIS_MODULE, \
1134 .open = seq_ns_ ##NAME ##_open, \
1136 .llseek = seq_lseek, \
1137 .release = single_release, \
1140 static int seq_ns_stacked_show(struct seq_file *seq, void *v)
1142 struct aa_label *label;
1144 label = begin_current_label_crit_section();
1145 seq_printf(seq, "%s\n", label->size > 1 ? "yes" : "no");
1146 end_current_label_crit_section(label);
1151 static int seq_ns_nsstacked_show(struct seq_file *seq, void *v)
1153 struct aa_label *label;
1154 struct aa_profile *profile;
1158 label = begin_current_label_crit_section();
1160 if (label->size > 1) {
1161 label_for_each(it, label, profile)
1162 if (profile->ns != labels_ns(label)) {
1168 seq_printf(seq, "%s\n", count > 1 ? "yes" : "no");
1169 end_current_label_crit_section(label);
1174 static int seq_ns_level_show(struct seq_file *seq, void *v)
1176 struct aa_label *label;
1178 label = begin_current_label_crit_section();
1179 seq_printf(seq, "%d\n", labels_ns(label)->level);
1180 end_current_label_crit_section(label);
1185 static int seq_ns_name_show(struct seq_file *seq, void *v)
1187 struct aa_label *label = begin_current_label_crit_section();
1188 seq_printf(seq, "%s\n", labels_ns(label)->base.name);
1189 end_current_label_crit_section(label);
1194 SEQ_NS_FOPS(stacked);
1195 SEQ_NS_FOPS(nsstacked);
1200 /* policy/raw_data/ * file ops */
1202 #define SEQ_RAWDATA_FOPS(NAME) \
1203 static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\
1205 return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show); \
1208 static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
1209 .owner = THIS_MODULE, \
1210 .open = seq_rawdata_ ##NAME ##_open, \
1212 .llseek = seq_lseek, \
1213 .release = seq_rawdata_release, \
1216 static int seq_rawdata_open(struct inode *inode, struct file *file,
1217 int (*show)(struct seq_file *, void *))
1219 struct aa_loaddata *data = __aa_get_loaddata(inode->i_private);
1223 /* lost race this ent is being reaped */
1226 error = single_open(file, show, data);
1228 AA_BUG(file->private_data &&
1229 ((struct seq_file *)file->private_data)->private);
1230 aa_put_loaddata(data);
1236 static int seq_rawdata_release(struct inode *inode, struct file *file)
1238 struct seq_file *seq = (struct seq_file *) file->private_data;
1241 aa_put_loaddata(seq->private);
1243 return single_release(inode, file);
1246 static int seq_rawdata_abi_show(struct seq_file *seq, void *v)
1248 struct aa_loaddata *data = seq->private;
1250 seq_printf(seq, "v%d\n", data->abi);
1255 static int seq_rawdata_revision_show(struct seq_file *seq, void *v)
1257 struct aa_loaddata *data = seq->private;
1259 seq_printf(seq, "%ld\n", data->revision);
1264 static int seq_rawdata_hash_show(struct seq_file *seq, void *v)
1266 struct aa_loaddata *data = seq->private;
1267 unsigned int i, size = aa_hash_size();
1270 for (i = 0; i < size; i++)
1271 seq_printf(seq, "%.2x", data->hash[i]);
1272 seq_putc(seq, '\n');
1278 SEQ_RAWDATA_FOPS(abi);
1279 SEQ_RAWDATA_FOPS(revision);
1280 SEQ_RAWDATA_FOPS(hash);
1282 static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
1285 struct aa_loaddata *rawdata = file->private_data;
1287 return simple_read_from_buffer(buf, size, ppos, rawdata->data,
1291 static int rawdata_release(struct inode *inode, struct file *file)
1293 aa_put_loaddata(file->private_data);
1298 static int rawdata_open(struct inode *inode, struct file *file)
1300 if (!policy_view_capable(NULL))
1302 file->private_data = __aa_get_loaddata(inode->i_private);
1303 if (!file->private_data)
1304 /* lost race: this entry is being reaped */
1310 static const struct file_operations rawdata_fops = {
1311 .open = rawdata_open,
1312 .read = rawdata_read,
1313 .llseek = generic_file_llseek,
1314 .release = rawdata_release,
1317 static void remove_rawdata_dents(struct aa_loaddata *rawdata)
1321 for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
1322 if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
1323 /* no refcounts on i_private */
1324 aafs_remove(rawdata->dents[i]);
1325 rawdata->dents[i] = NULL;
1330 void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata)
1332 AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock));
1335 remove_rawdata_dents(rawdata);
1336 list_del_init(&rawdata->list);
1337 aa_put_ns(rawdata->ns);
1342 int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
1344 struct dentry *dent, *dir;
1348 AA_BUG(!mutex_is_locked(&ns->lock));
1349 AA_BUG(!ns_subdata_dir(ns));
1352 * just use ns revision dir was originally created at. This is
1353 * under ns->lock and if load is successful revision will be
1354 * bumped and is guaranteed to be unique
1356 rawdata->name = kasprintf(GFP_KERNEL, "%ld", ns->revision);
1360 dir = aafs_create_dir(rawdata->name, ns_subdata_dir(ns));
1362 /* ->name freed when rawdata freed */
1363 return PTR_ERR(dir);
1364 rawdata->dents[AAFS_LOADDATA_DIR] = dir;
1366 dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
1367 &seq_rawdata_abi_fops);
1370 rawdata->dents[AAFS_LOADDATA_ABI] = dent;
1372 dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
1373 &seq_rawdata_revision_fops);
1376 rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
1378 if (aa_g_hash_policy) {
1379 dent = aafs_create_file("sha1", S_IFREG | 0444, dir,
1380 rawdata, &seq_rawdata_hash_fops);
1383 rawdata->dents[AAFS_LOADDATA_HASH] = dent;
1386 dent = aafs_create_file("raw_data", S_IFREG | 0444,
1387 dir, rawdata, &rawdata_fops);
1390 rawdata->dents[AAFS_LOADDATA_DATA] = dent;
1391 d_inode(dent)->i_size = rawdata->size;
1393 rawdata->ns = aa_get_ns(ns);
1394 list_add(&rawdata->list, &ns->rawdata_list);
1395 /* no refcount on inode rawdata */
1400 remove_rawdata_dents(rawdata);
1402 return PTR_ERR(dent);
1405 /** fns to setup dynamic per profile/namespace files **/
1409 * Requires: @profile->ns->lock held
1411 void __aafs_profile_rmdir(struct aa_profile *profile)
1413 struct aa_profile *child;
1419 list_for_each_entry(child, &profile->base.profiles, base.list)
1420 __aafs_profile_rmdir(child);
1422 for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
1423 struct aa_proxy *proxy;
1424 if (!profile->dents[i])
1427 proxy = d_inode(profile->dents[i])->i_private;
1428 aafs_remove(profile->dents[i]);
1429 aa_put_proxy(proxy);
1430 profile->dents[i] = NULL;
1436 * Requires: @old->ns->lock held
1438 void __aafs_profile_migrate_dents(struct aa_profile *old,
1439 struct aa_profile *new)
1445 AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
1447 for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
1448 new->dents[i] = old->dents[i];
1450 new->dents[i]->d_inode->i_mtime = current_time(new->dents[i]->d_inode);
1451 old->dents[i] = NULL;
1455 static struct dentry *create_profile_file(struct dentry *dir, const char *name,
1456 struct aa_profile *profile,
1457 const struct file_operations *fops)
1459 struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy);
1460 struct dentry *dent;
1462 dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops);
1464 aa_put_proxy(proxy);
1469 static int profile_depth(struct aa_profile *profile)
1474 for (depth = 0; profile; profile = rcu_access_pointer(profile->parent))
1481 static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
1485 int size = depth * 6 + strlen(dirname) + strlen(fname) + 11;
1487 s = buffer = kmalloc(size, GFP_KERNEL);
1489 return ERR_PTR(-ENOMEM);
1491 for (; depth > 0; depth--) {
1492 strcpy(s, "../../");
1497 error = snprintf(s, size, "raw_data/%s/%s", dirname, fname);
1498 if (error >= size || error < 0) {
1500 return ERR_PTR(-ENAMETOOLONG);
1506 static void rawdata_link_cb(void *arg)
1511 static const char *rawdata_get_link_base(struct dentry *dentry,
1512 struct inode *inode,
1513 struct delayed_call *done,
1516 struct aa_proxy *proxy = inode->i_private;
1517 struct aa_label *label;
1518 struct aa_profile *profile;
1523 return ERR_PTR(-ECHILD);
1525 label = aa_get_label_rcu(&proxy->label);
1526 profile = labels_profile(label);
1527 depth = profile_depth(profile);
1528 target = gen_symlink_name(depth, profile->rawdata->name, name);
1529 aa_put_label(label);
1534 set_delayed_call(done, rawdata_link_cb, target);
1539 static const char *rawdata_get_link_sha1(struct dentry *dentry,
1540 struct inode *inode,
1541 struct delayed_call *done)
1543 return rawdata_get_link_base(dentry, inode, done, "sha1");
1546 static const char *rawdata_get_link_abi(struct dentry *dentry,
1547 struct inode *inode,
1548 struct delayed_call *done)
1550 return rawdata_get_link_base(dentry, inode, done, "abi");
1553 static const char *rawdata_get_link_data(struct dentry *dentry,
1554 struct inode *inode,
1555 struct delayed_call *done)
1557 return rawdata_get_link_base(dentry, inode, done, "raw_data");
1560 static const struct inode_operations rawdata_link_sha1_iops = {
1561 .get_link = rawdata_get_link_sha1,
1564 static const struct inode_operations rawdata_link_abi_iops = {
1565 .get_link = rawdata_get_link_abi,
1567 static const struct inode_operations rawdata_link_data_iops = {
1568 .get_link = rawdata_get_link_data,
1573 * Requires: @profile->ns->lock held
1575 int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
1577 struct aa_profile *child;
1578 struct dentry *dent = NULL, *dir;
1582 AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
1585 struct aa_profile *p;
1586 p = aa_deref_parent(profile);
1588 /* adding to parent that previously didn't have children */
1589 dent = aafs_create_dir("profiles", dent);
1592 prof_child_dir(p) = parent = dent;
1595 if (!profile->dirname) {
1597 len = mangle_name(profile->base.name, NULL);
1598 id_len = snprintf(NULL, 0, ".%ld", profile->ns->uniq_id);
1600 profile->dirname = kmalloc(len + id_len + 1, GFP_KERNEL);
1601 if (!profile->dirname) {
1606 mangle_name(profile->base.name, profile->dirname);
1607 sprintf(profile->dirname + len, ".%ld", profile->ns->uniq_id++);
1610 dent = aafs_create_dir(profile->dirname, parent);
1613 prof_dir(profile) = dir = dent;
1615 dent = create_profile_file(dir, "name", profile,
1616 &seq_profile_name_fops);
1619 profile->dents[AAFS_PROF_NAME] = dent;
1621 dent = create_profile_file(dir, "mode", profile,
1622 &seq_profile_mode_fops);
1625 profile->dents[AAFS_PROF_MODE] = dent;
1627 dent = create_profile_file(dir, "attach", profile,
1628 &seq_profile_attach_fops);
1631 profile->dents[AAFS_PROF_ATTACH] = dent;
1633 if (profile->hash) {
1634 dent = create_profile_file(dir, "sha1", profile,
1635 &seq_profile_hash_fops);
1638 profile->dents[AAFS_PROF_HASH] = dent;
1641 if (profile->rawdata) {
1642 dent = aafs_create_symlink("raw_sha1", dir, NULL,
1643 profile->label.proxy,
1644 &rawdata_link_sha1_iops);
1647 aa_get_proxy(profile->label.proxy);
1648 profile->dents[AAFS_PROF_RAW_HASH] = dent;
1650 dent = aafs_create_symlink("raw_abi", dir, NULL,
1651 profile->label.proxy,
1652 &rawdata_link_abi_iops);
1655 aa_get_proxy(profile->label.proxy);
1656 profile->dents[AAFS_PROF_RAW_ABI] = dent;
1658 dent = aafs_create_symlink("raw_data", dir, NULL,
1659 profile->label.proxy,
1660 &rawdata_link_data_iops);
1663 aa_get_proxy(profile->label.proxy);
1664 profile->dents[AAFS_PROF_RAW_DATA] = dent;
1667 list_for_each_entry(child, &profile->base.profiles, base.list) {
1668 error = __aafs_profile_mkdir(child, prof_child_dir(profile));
1676 error = PTR_ERR(dent);
1679 __aafs_profile_rmdir(profile);
1684 static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
1686 struct aa_ns *ns, *parent;
1687 /* TODO: improve permission check */
1688 struct aa_label *label;
1691 label = begin_current_label_crit_section();
1692 error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
1693 end_current_label_crit_section(label);
1697 parent = aa_get_ns(dir->i_private);
1698 AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
1700 /* we have to unlock and then relock to get locking order right
1704 error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
1705 mutex_lock_nested(&parent->lock, parent->level);
1706 inode_lock_nested(dir, I_MUTEX_PARENT);
1710 error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR, NULL,
1715 ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name),
1718 error = PTR_ERR(ns);
1722 aa_put_ns(ns); /* list ref remains */
1725 simple_release_fs(&aafs_mnt, &aafs_count);
1727 mutex_unlock(&parent->lock);
1733 static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
1735 struct aa_ns *ns, *parent;
1736 /* TODO: improve permission check */
1737 struct aa_label *label;
1740 label = begin_current_label_crit_section();
1741 error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
1742 end_current_label_crit_section(label);
1746 parent = aa_get_ns(dir->i_private);
1747 /* rmdir calls the generic securityfs functions to remove files
1748 * from the apparmor dir. It is up to the apparmor ns locking
1752 inode_unlock(dentry->d_inode);
1754 mutex_lock_nested(&parent->lock, parent->level);
1755 ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name,
1756 dentry->d_name.len));
1761 AA_BUG(ns_dir(ns) != dentry);
1767 mutex_unlock(&parent->lock);
1768 inode_lock_nested(dir, I_MUTEX_PARENT);
1769 inode_lock(dentry->d_inode);
1775 static const struct inode_operations ns_dir_inode_operations = {
1776 .lookup = simple_lookup,
1777 .mkdir = ns_mkdir_op,
1778 .rmdir = ns_rmdir_op,
1781 static void __aa_fs_list_remove_rawdata(struct aa_ns *ns)
1783 struct aa_loaddata *ent, *tmp;
1785 AA_BUG(!mutex_is_locked(&ns->lock));
1787 list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list)
1788 __aa_fs_remove_rawdata(ent);
1793 * Requires: @ns->lock held
1795 void __aafs_ns_rmdir(struct aa_ns *ns)
1798 struct aa_profile *child;
1803 AA_BUG(!mutex_is_locked(&ns->lock));
1805 list_for_each_entry(child, &ns->base.profiles, base.list)
1806 __aafs_profile_rmdir(child);
1808 list_for_each_entry(sub, &ns->sub_ns, base.list) {
1809 mutex_lock_nested(&sub->lock, sub->level);
1810 __aafs_ns_rmdir(sub);
1811 mutex_unlock(&sub->lock);
1814 __aa_fs_list_remove_rawdata(ns);
1816 if (ns_subns_dir(ns)) {
1817 sub = d_inode(ns_subns_dir(ns))->i_private;
1820 if (ns_subload(ns)) {
1821 sub = d_inode(ns_subload(ns))->i_private;
1824 if (ns_subreplace(ns)) {
1825 sub = d_inode(ns_subreplace(ns))->i_private;
1828 if (ns_subremove(ns)) {
1829 sub = d_inode(ns_subremove(ns))->i_private;
1832 if (ns_subrevision(ns)) {
1833 sub = d_inode(ns_subrevision(ns))->i_private;
1837 for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
1838 aafs_remove(ns->dents[i]);
1839 ns->dents[i] = NULL;
1843 /* assumes cleanup in caller */
1844 static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
1846 struct dentry *dent;
1851 dent = aafs_create_dir("profiles", dir);
1853 return PTR_ERR(dent);
1854 ns_subprofs_dir(ns) = dent;
1856 dent = aafs_create_dir("raw_data", dir);
1858 return PTR_ERR(dent);
1859 ns_subdata_dir(ns) = dent;
1861 dent = aafs_create_file("revision", 0444, dir, ns,
1862 &aa_fs_ns_revision_fops);
1864 return PTR_ERR(dent);
1866 ns_subrevision(ns) = dent;
1868 dent = aafs_create_file(".load", 0640, dir, ns,
1869 &aa_fs_profile_load);
1871 return PTR_ERR(dent);
1873 ns_subload(ns) = dent;
1875 dent = aafs_create_file(".replace", 0640, dir, ns,
1876 &aa_fs_profile_replace);
1878 return PTR_ERR(dent);
1880 ns_subreplace(ns) = dent;
1882 dent = aafs_create_file(".remove", 0640, dir, ns,
1883 &aa_fs_profile_remove);
1885 return PTR_ERR(dent);
1887 ns_subremove(ns) = dent;
1889 /* use create_dentry so we can supply private data */
1890 dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL,
1891 &ns_dir_inode_operations);
1893 return PTR_ERR(dent);
1895 ns_subns_dir(ns) = dent;
1901 * Requires: @ns->lock held
1903 int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
1904 struct dentry *dent)
1907 struct aa_profile *child;
1913 AA_BUG(!mutex_is_locked(&ns->lock));
1916 name = ns->base.name;
1919 /* create ns dir if it doesn't already exist */
1920 dent = aafs_create_dir(name, parent);
1925 ns_dir(ns) = dir = dent;
1926 error = __aafs_ns_mkdir_entries(ns, dir);
1931 list_for_each_entry(child, &ns->base.profiles, base.list) {
1932 error = __aafs_profile_mkdir(child, ns_subprofs_dir(ns));
1938 list_for_each_entry(sub, &ns->sub_ns, base.list) {
1939 mutex_lock_nested(&sub->lock, sub->level);
1940 error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL);
1941 mutex_unlock(&sub->lock);
1949 error = PTR_ERR(dent);
1952 __aafs_ns_rmdir(ns);
1958 #define list_entry_is_head(pos, head, member) (&pos->member == (head))
1961 * __next_ns - find the next namespace to list
1962 * @root: root namespace to stop search at (NOT NULL)
1963 * @ns: current ns position (NOT NULL)
1965 * Find the next namespace from @ns under @root and handle all locking needed
1966 * while switching current namespace.
1968 * Returns: next namespace or NULL if at last namespace under @root
1969 * Requires: ns->parent->lock to be held
1970 * NOTE: will not unlock root->lock
1972 static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
1974 struct aa_ns *parent, *next;
1978 AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
1980 /* is next namespace a child */
1981 if (!list_empty(&ns->sub_ns)) {
1982 next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
1983 mutex_lock_nested(&next->lock, next->level);
1987 /* check if the next ns is a sibling, parent, gp, .. */
1988 parent = ns->parent;
1989 while (ns != root) {
1990 mutex_unlock(&ns->lock);
1991 next = list_next_entry(ns, base.list);
1992 if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
1993 mutex_lock_nested(&next->lock, next->level);
1997 parent = parent->parent;
2004 * __first_profile - find the first profile in a namespace
2005 * @root: namespace that is root of profiles being displayed (NOT NULL)
2006 * @ns: namespace to start in (NOT NULL)
2008 * Returns: unrefcounted profile or NULL if no profile
2009 * Requires: profile->ns.lock to be held
2011 static struct aa_profile *__first_profile(struct aa_ns *root,
2015 AA_BUG(ns && !mutex_is_locked(&ns->lock));
2017 for (; ns; ns = __next_ns(root, ns)) {
2018 if (!list_empty(&ns->base.profiles))
2019 return list_first_entry(&ns->base.profiles,
2020 struct aa_profile, base.list);
2026 * __next_profile - step to the next profile in a profile tree
2027 * @profile: current profile in tree (NOT NULL)
2029 * Perform a depth first traversal on the profile tree in a namespace
2031 * Returns: next profile or NULL if done
2032 * Requires: profile->ns.lock to be held
2034 static struct aa_profile *__next_profile(struct aa_profile *p)
2036 struct aa_profile *parent;
2037 struct aa_ns *ns = p->ns;
2039 AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
2041 /* is next profile a child */
2042 if (!list_empty(&p->base.profiles))
2043 return list_first_entry(&p->base.profiles, typeof(*p),
2046 /* is next profile a sibling, parent sibling, gp, sibling, .. */
2047 parent = rcu_dereference_protected(p->parent,
2048 mutex_is_locked(&p->ns->lock));
2050 p = list_next_entry(p, base.list);
2051 if (!list_entry_is_head(p, &parent->base.profiles, base.list))
2054 parent = rcu_dereference_protected(parent->parent,
2055 mutex_is_locked(&parent->ns->lock));
2058 /* is next another profile in the namespace */
2059 p = list_next_entry(p, base.list);
2060 if (!list_entry_is_head(p, &ns->base.profiles, base.list))
2067 * next_profile - step to the next profile in where ever it may be
2068 * @root: root namespace (NOT NULL)
2069 * @profile: current profile (NOT NULL)
2071 * Returns: next profile or NULL if there isn't one
2073 static struct aa_profile *next_profile(struct aa_ns *root,
2074 struct aa_profile *profile)
2076 struct aa_profile *next = __next_profile(profile);
2080 /* finished all profiles in namespace move to next namespace */
2081 return __first_profile(root, __next_ns(root, profile->ns));
2085 * p_start - start a depth first traversal of profile tree
2086 * @f: seq_file to fill
2087 * @pos: current position
2089 * Returns: first profile under current namespace or NULL if none found
2091 * acquires first ns->lock
2093 static void *p_start(struct seq_file *f, loff_t *pos)
2095 struct aa_profile *profile = NULL;
2096 struct aa_ns *root = aa_get_current_ns();
2100 /* find the first profile */
2101 mutex_lock_nested(&root->lock, root->level);
2102 profile = __first_profile(root, root);
2104 /* skip to position */
2105 for (; profile && l > 0; l--)
2106 profile = next_profile(root, profile);
2112 * p_next - read the next profile entry
2113 * @f: seq_file to fill
2114 * @p: profile previously returned
2115 * @pos: current position
2117 * Returns: next profile after @p or NULL if none
2119 * may acquire/release locks in namespace tree as necessary
2121 static void *p_next(struct seq_file *f, void *p, loff_t *pos)
2123 struct aa_profile *profile = p;
2124 struct aa_ns *ns = f->private;
2127 return next_profile(ns, profile);
2131 * p_stop - stop depth first traversal
2132 * @f: seq_file we are filling
2133 * @p: the last profile writen
2135 * Release all locking done by p_start/p_next on namespace tree
2137 static void p_stop(struct seq_file *f, void *p)
2139 struct aa_profile *profile = p;
2140 struct aa_ns *root = f->private, *ns;
2143 for (ns = profile->ns; ns && ns != root; ns = ns->parent)
2144 mutex_unlock(&ns->lock);
2146 mutex_unlock(&root->lock);
2151 * seq_show_profile - show a profile entry
2152 * @f: seq_file to file
2153 * @p: current position (profile) (NOT NULL)
2155 * Returns: error on failure
2157 static int seq_show_profile(struct seq_file *f, void *p)
2159 struct aa_profile *profile = (struct aa_profile *)p;
2160 struct aa_ns *root = f->private;
2162 aa_label_seq_xprint(f, root, &profile->label,
2163 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL);
2169 static const struct seq_operations aa_sfs_profiles_op = {
2173 .show = seq_show_profile,
2176 static int profiles_open(struct inode *inode, struct file *file)
2178 if (!policy_view_capable(NULL))
2181 return seq_open(file, &aa_sfs_profiles_op);
2184 static int profiles_release(struct inode *inode, struct file *file)
2186 return seq_release(inode, file);
2189 static const struct file_operations aa_sfs_profiles_fops = {
2190 .open = profiles_open,
2192 .llseek = seq_lseek,
2193 .release = profiles_release,
2197 /** Base file system setup **/
2198 static struct aa_sfs_entry aa_sfs_entry_file[] = {
2199 AA_SFS_FILE_STRING("mask",
2200 "create read write exec append mmap_exec link lock"),
2204 static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
2205 AA_SFS_FILE_STRING("mask", "read trace"),
2209 static struct aa_sfs_entry aa_sfs_entry_signal[] = {
2210 AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
2214 static struct aa_sfs_entry aa_sfs_entry_attach[] = {
2215 AA_SFS_FILE_BOOLEAN("xattr", 1),
2218 static struct aa_sfs_entry aa_sfs_entry_domain[] = {
2219 AA_SFS_FILE_BOOLEAN("change_hat", 1),
2220 AA_SFS_FILE_BOOLEAN("change_hatv", 1),
2221 AA_SFS_FILE_BOOLEAN("change_onexec", 1),
2222 AA_SFS_FILE_BOOLEAN("change_profile", 1),
2223 AA_SFS_FILE_BOOLEAN("stack", 1),
2224 AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap", 1),
2225 AA_SFS_FILE_BOOLEAN("post_nnp_subset", 1),
2226 AA_SFS_FILE_BOOLEAN("computed_longest_left", 1),
2227 AA_SFS_DIR("attach_conditions", aa_sfs_entry_attach),
2228 AA_SFS_FILE_STRING("version", "1.2"),
2232 static struct aa_sfs_entry aa_sfs_entry_versions[] = {
2233 AA_SFS_FILE_BOOLEAN("v5", 1),
2234 AA_SFS_FILE_BOOLEAN("v6", 1),
2235 AA_SFS_FILE_BOOLEAN("v7", 1),
2236 AA_SFS_FILE_BOOLEAN("v8", 1),
2240 static struct aa_sfs_entry aa_sfs_entry_policy[] = {
2241 AA_SFS_DIR("versions", aa_sfs_entry_versions),
2242 AA_SFS_FILE_BOOLEAN("set_load", 1),
2246 static struct aa_sfs_entry aa_sfs_entry_mount[] = {
2247 AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
2251 static struct aa_sfs_entry aa_sfs_entry_ns[] = {
2252 AA_SFS_FILE_BOOLEAN("profile", 1),
2253 AA_SFS_FILE_BOOLEAN("pivot_root", 0),
2257 static struct aa_sfs_entry aa_sfs_entry_query_label[] = {
2258 AA_SFS_FILE_STRING("perms", "allow deny audit quiet"),
2259 AA_SFS_FILE_BOOLEAN("data", 1),
2260 AA_SFS_FILE_BOOLEAN("multi_transaction", 1),
2264 static struct aa_sfs_entry aa_sfs_entry_query[] = {
2265 AA_SFS_DIR("label", aa_sfs_entry_query_label),
2268 static struct aa_sfs_entry aa_sfs_entry_features[] = {
2269 AA_SFS_DIR("policy", aa_sfs_entry_policy),
2270 AA_SFS_DIR("domain", aa_sfs_entry_domain),
2271 AA_SFS_DIR("file", aa_sfs_entry_file),
2272 AA_SFS_DIR("network_v8", aa_sfs_entry_network),
2273 AA_SFS_DIR("mount", aa_sfs_entry_mount),
2274 AA_SFS_DIR("namespaces", aa_sfs_entry_ns),
2275 AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
2276 AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit),
2277 AA_SFS_DIR("caps", aa_sfs_entry_caps),
2278 AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace),
2279 AA_SFS_DIR("signal", aa_sfs_entry_signal),
2280 AA_SFS_DIR("query", aa_sfs_entry_query),
2284 static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
2285 AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
2286 AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
2287 AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
2288 AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
2289 AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
2290 AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
2291 AA_SFS_DIR("features", aa_sfs_entry_features),
2295 static struct aa_sfs_entry aa_sfs_entry =
2296 AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor);
2299 * entry_create_file - create a file entry in the apparmor securityfs
2300 * @fs_file: aa_sfs_entry to build an entry for (NOT NULL)
2301 * @parent: the parent dentry in the securityfs
2303 * Use entry_remove_file to remove entries created with this fn.
2305 static int __init entry_create_file(struct aa_sfs_entry *fs_file,
2306 struct dentry *parent)
2310 fs_file->dentry = securityfs_create_file(fs_file->name,
2311 S_IFREG | fs_file->mode,
2314 if (IS_ERR(fs_file->dentry)) {
2315 error = PTR_ERR(fs_file->dentry);
2316 fs_file->dentry = NULL;
2321 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir);
2323 * entry_create_dir - recursively create a directory entry in the securityfs
2324 * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL)
2325 * @parent: the parent dentry in the securityfs
2327 * Use entry_remove_dir to remove entries created with this fn.
2329 static int __init entry_create_dir(struct aa_sfs_entry *fs_dir,
2330 struct dentry *parent)
2332 struct aa_sfs_entry *fs_file;
2336 dir = securityfs_create_dir(fs_dir->name, parent);
2338 return PTR_ERR(dir);
2339 fs_dir->dentry = dir;
2341 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2342 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2343 error = entry_create_dir(fs_file, fs_dir->dentry);
2345 error = entry_create_file(fs_file, fs_dir->dentry);
2353 entry_remove_dir(fs_dir);
2359 * entry_remove_file - drop a single file entry in the apparmor securityfs
2360 * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL)
2362 static void __init entry_remove_file(struct aa_sfs_entry *fs_file)
2364 if (!fs_file->dentry)
2367 securityfs_remove(fs_file->dentry);
2368 fs_file->dentry = NULL;
2372 * entry_remove_dir - recursively drop a directory entry from the securityfs
2373 * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL)
2375 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir)
2377 struct aa_sfs_entry *fs_file;
2379 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2380 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2381 entry_remove_dir(fs_file);
2383 entry_remove_file(fs_file);
2386 entry_remove_file(fs_dir);
2390 * aa_destroy_aafs - cleanup and free aafs
2392 * releases dentries allocated by aa_create_aafs
2394 void __init aa_destroy_aafs(void)
2396 entry_remove_dir(&aa_sfs_entry);
2400 #define NULL_FILE_NAME ".null"
2401 struct path aa_null;
2403 static int aa_mk_null_file(struct dentry *parent)
2405 struct vfsmount *mount = NULL;
2406 struct dentry *dentry;
2407 struct inode *inode;
2409 int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count);
2414 inode_lock(d_inode(parent));
2415 dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME));
2416 if (IS_ERR(dentry)) {
2417 error = PTR_ERR(dentry);
2420 inode = new_inode(parent->d_inode->i_sb);
2426 inode->i_ino = get_next_ino();
2427 inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO;
2428 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
2429 init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO,
2430 MKDEV(MEM_MAJOR, 3));
2431 d_instantiate(dentry, inode);
2432 aa_null.dentry = dget(dentry);
2433 aa_null.mnt = mntget(mount);
2440 inode_unlock(d_inode(parent));
2441 simple_release_fs(&mount, &count);
2447 static const char *policy_get_link(struct dentry *dentry,
2448 struct inode *inode,
2449 struct delayed_call *done)
2455 return ERR_PTR(-ECHILD);
2456 ns = aa_get_current_ns();
2457 path.mnt = mntget(aafs_mnt);
2458 path.dentry = dget(ns_dir(ns));
2459 nd_jump_link(&path);
2465 static int policy_readlink(struct dentry *dentry, char __user *buffer,
2471 res = snprintf(name, sizeof(name), "%s:[%lu]", AAFS_NAME,
2472 d_inode(dentry)->i_ino);
2473 if (res > 0 && res < sizeof(name))
2474 res = readlink_copy(buffer, buflen, name);
2481 static const struct inode_operations policy_link_iops = {
2482 .readlink = policy_readlink,
2483 .get_link = policy_get_link,
2488 * aa_create_aafs - create the apparmor security filesystem
2490 * dentries created here are released by aa_destroy_aafs
2492 * Returns: error on failure
2494 static int __init aa_create_aafs(void)
2496 struct dentry *dent;
2499 if (!apparmor_initialized)
2502 if (aa_sfs_entry.dentry) {
2503 AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
2507 /* setup apparmorfs used to virtualize policy/ */
2508 aafs_mnt = kern_mount(&aafs_ops);
2509 if (IS_ERR(aafs_mnt))
2510 panic("can't set apparmorfs up\n");
2511 aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
2513 /* Populate fs tree. */
2514 error = entry_create_dir(&aa_sfs_entry, NULL);
2518 dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry,
2519 NULL, &aa_fs_profile_load);
2522 ns_subload(root_ns) = dent;
2524 dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry,
2525 NULL, &aa_fs_profile_replace);
2528 ns_subreplace(root_ns) = dent;
2530 dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry,
2531 NULL, &aa_fs_profile_remove);
2534 ns_subremove(root_ns) = dent;
2536 dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry,
2537 NULL, &aa_fs_ns_revision_fops);
2540 ns_subrevision(root_ns) = dent;
2542 /* policy tree referenced by magic policy symlink */
2543 mutex_lock_nested(&root_ns->lock, root_ns->level);
2544 error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy",
2545 aafs_mnt->mnt_root);
2546 mutex_unlock(&root_ns->lock);
2550 /* magic symlink similar to nsfs redirects based on task policy */
2551 dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry,
2552 NULL, &policy_link_iops);
2556 error = aa_mk_null_file(aa_sfs_entry.dentry);
2560 /* TODO: add default profile to apparmorfs */
2562 /* Report that AppArmor fs is enabled */
2563 aa_info_message("AppArmor Filesystem Enabled");
2567 error = PTR_ERR(dent);
2570 AA_ERROR("Error creating AppArmor securityfs\n");
2574 fs_initcall(aa_create_aafs);