^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * AppArmor security module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This file contains AppArmor capability mediation functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (C) 1998-2008 Novell/SUSE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Copyright 2009-2010 Canonical Ltd.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/capability.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/errno.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/gfp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include "include/apparmor.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include "include/capability.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include "include/cred.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include "include/policy.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include "include/audit.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) * Table of capability names: we generate it from capabilities.h.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include "capability_names.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) struct aa_sfs_entry aa_sfs_entry_caps[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) AA_SFS_FILE_STRING("mask", AA_SFS_CAPS_MASK),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) { }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) struct audit_cache {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) struct aa_profile *profile;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) kernel_cap_t caps;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) static DEFINE_PER_CPU(struct audit_cache, audit_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) * audit_cb - call back for capability components of audit struct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) * @ab - audit buffer (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) * @va - audit struct to audit data from (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) static void audit_cb(struct audit_buffer *ab, void *va)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) struct common_audit_data *sa = va;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) audit_log_format(ab, " capname=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) audit_log_untrustedstring(ab, capability_names[sa->u.cap]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) * audit_caps - audit a capability
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) * @sa: audit data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) * @profile: profile being tested for confinement (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) * @cap: capability tested
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) * @error: error code returned by test
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * Do auditing of capability and handle, audit/complain/kill modes switching
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * and duplicate message elimination.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * Returns: 0 or sa->error on success, error code on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) int cap, int error)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) struct audit_cache *ent;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) int type = AUDIT_APPARMOR_AUTO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) aad(sa)->error = error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) if (likely(!error)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) /* test if auditing is being forced */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) if (likely((AUDIT_MODE(profile) != AUDIT_ALL) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) !cap_raised(profile->caps.audit, cap)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) type = AUDIT_APPARMOR_AUDIT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) } else if (KILL_MODE(profile) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) cap_raised(profile->caps.kill, cap)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) type = AUDIT_APPARMOR_KILL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) } else if (cap_raised(profile->caps.quiet, cap) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) AUDIT_MODE(profile) != AUDIT_NOQUIET &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) AUDIT_MODE(profile) != AUDIT_ALL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) /* quiet auditing */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) /* Do simple duplicate message elimination */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) ent = &get_cpu_var(audit_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) if (profile == ent->profile && cap_raised(ent->caps, cap)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) put_cpu_var(audit_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (COMPLAIN_MODE(profile))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return complain_error(error);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) aa_put_profile(ent->profile);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) ent->profile = aa_get_profile(profile);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) cap_raise(ent->caps, cap);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) put_cpu_var(audit_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) return aa_audit(type, profile, sa, audit_cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) * profile_capable - test if profile allows use of capability @cap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) * @profile: profile being enforced (NOT NULL, NOT unconfined)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) * @cap: capability to test if allowed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) * @sa: audit data (MAY BE NULL indicating no auditing)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) * Returns: 0 if allowed else -EPERM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) static int profile_capable(struct aa_profile *profile, int cap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) unsigned int opts, struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) int error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) if (cap_raised(profile->caps.allow, cap) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) !cap_raised(profile->caps.denied, cap))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) error = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) error = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) if (opts & CAP_OPT_NOAUDIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) if (!COMPLAIN_MODE(profile))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) /* audit the cap request in complain mode but note that it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) * should be optional.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) aad(sa)->info = "optional: no audit";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) return audit_caps(sa, profile, cap, error);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) * aa_capable - test permission to use capability
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) * @label: label being tested for capability (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) * @cap: capability to be tested
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) * Look up capability in profile capability set.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) * Returns: 0 on success, or else an error code.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) int aa_capable(struct aa_label *label, int cap, unsigned int opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) struct aa_profile *profile;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) int error = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, OP_CAPABLE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) sa.u.cap = cap;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) error = fn_for_each_confined(label, profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) profile_capable(profile, cap, opts, &sa));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags