^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * AppArmor security module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This file contains AppArmor ipc mediation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (C) 1998-2008 Novell/SUSE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Copyright 2009-2017 Canonical Ltd.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/gfp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/ptrace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include "include/audit.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include "include/capability.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include "include/cred.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include "include/policy.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include "include/ipc.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include "include/sig_names.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * audit_ptrace_mask - convert mask to permission string
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) * @mask: permission mask to convert
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * Returns: pointer to static string
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) static const char *audit_ptrace_mask(u32 mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) switch (mask) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) case MAY_READ:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) return "read";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) case MAY_WRITE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) return "trace";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) case AA_MAY_BE_READ:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) return "readby";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) case AA_MAY_BE_TRACED:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) return "tracedby";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) return "";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) /* call back to audit ptrace fields */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) struct common_audit_data *sa = va;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) if (aad(sa)->request & AA_PTRACE_PERM_MASK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) audit_log_format(ab, " requested_mask=\"%s\"",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) audit_ptrace_mask(aad(sa)->request));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) if (aad(sa)->denied & AA_PTRACE_PERM_MASK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) audit_log_format(ab, " denied_mask=\"%s\"",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) audit_ptrace_mask(aad(sa)->denied));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) audit_log_format(ab, " peer=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) FLAGS_NONE, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) /* assumes check for PROFILE_MEDIATES is already done */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) /* TODO: conditionals */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) static int profile_ptrace_perm(struct aa_profile *profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) struct aa_label *peer, u32 request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) struct aa_perms perms = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) aad(sa)->peer = peer;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) aa_profile_match_label(profile, peer, AA_CLASS_PTRACE, request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) aa_apply_modes_to_perms(profile, &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) static int profile_tracee_perm(struct aa_profile *tracee,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) struct aa_label *tracer, u32 request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) if (profile_unconfined(tracee) || unconfined(tracer) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) !PROFILE_MEDIATES(tracee, AA_CLASS_PTRACE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) return profile_ptrace_perm(tracee, tracer, request, sa);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) static int profile_tracer_perm(struct aa_profile *tracer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) struct aa_label *tracee, u32 request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) if (profile_unconfined(tracer))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) return profile_ptrace_perm(tracer, tracee, request, sa);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) /* profile uses the old style capability check for ptrace */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) if (&tracer->label == tracee)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) aad(sa)->label = &tracer->label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) aad(sa)->peer = tracee;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) aad(sa)->request = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) CAP_OPT_NONE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) * aa_may_ptrace - test if tracer task can trace the tracee
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) * @tracer: label of the task doing the tracing (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) * @tracee: task label to be traced
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) * @request: permission request
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) * Returns: %0 else error code if permission denied or error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) u32 request)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) struct aa_profile *profile;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) u32 xrequest = request << PTRACE_PERM_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) return xcheck_labels(tracer, tracee, profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) profile_tracer_perm(profile, tracee, request, &sa),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) profile_tracee_perm(profile, tracer, xrequest, &sa));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) static inline int map_signal_num(int sig)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) if (sig > SIGRTMAX)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) return SIGUNKNOWN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) else if (sig >= SIGRTMIN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) return sig - SIGRTMIN + SIGRT_BASE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) else if (sig < MAXMAPPED_SIG)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) return sig_map[sig];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) return SIGUNKNOWN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) * audit_signal_mask - convert mask to permission string
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) * @mask: permission mask to convert
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) * Returns: pointer to static string
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) static const char *audit_signal_mask(u32 mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) if (mask & MAY_READ)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) return "receive";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) if (mask & MAY_WRITE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) return "send";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) return "";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) * audit_cb - call back for signal specific audit fields
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) * @ab: audit_buffer (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) * @va: audit struct to audit values of (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) static void audit_signal_cb(struct audit_buffer *ab, void *va)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) struct common_audit_data *sa = va;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) if (aad(sa)->request & AA_SIGNAL_PERM_MASK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) audit_log_format(ab, " requested_mask=\"%s\"",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) audit_signal_mask(aad(sa)->request));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) if (aad(sa)->denied & AA_SIGNAL_PERM_MASK) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) audit_log_format(ab, " denied_mask=\"%s\"",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) audit_signal_mask(aad(sa)->denied));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) if (aad(sa)->signal == SIGUNKNOWN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) audit_log_format(ab, "signal=unknown(%d)",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) aad(sa)->unmappedsig);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) else if (aad(sa)->signal < MAXMAPPED_SIGNAME)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) audit_log_format(ab, " signal=rtmin+%d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) aad(sa)->signal - SIGRT_BASE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) audit_log_format(ab, " peer=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) FLAGS_NONE, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) static int profile_signal_perm(struct aa_profile *profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) struct aa_label *peer, u32 request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) struct aa_perms perms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) unsigned int state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) if (profile_unconfined(profile) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) !PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) aad(sa)->peer = peer;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) /* TODO: secondary cache check <profile, profile, perm> */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) state = aa_dfa_next(profile->policy.dfa,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) profile->policy.start[AA_CLASS_SIGNAL],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) aad(sa)->signal);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) aa_label_match(profile, peer, state, false, request, &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) aa_apply_modes_to_perms(profile, &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) return aa_check_perms(profile, &perms, request, sa, audit_signal_cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) struct aa_profile *profile;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SIGNAL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) aad(&sa)->signal = map_signal_num(sig);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) aad(&sa)->unmappedsig = sig;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) return xcheck_labels(sender, target, profile,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) profile_signal_perm(profile, target, MAY_WRITE, &sa),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) profile_signal_perm(profile, sender, MAY_READ, &sa));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags