^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * AppArmor security module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This file contains basic common functions used in AppArmor
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (C) 1998-2008 Novell/SUSE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Copyright 2009-2010 Canonical Ltd.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/ctype.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/vmalloc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include "include/audit.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include "include/apparmor.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include "include/lib.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include "include/perms.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include "include/policy.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) struct aa_perms nullperms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) .quiet = ALL_PERMS_MASK,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) .hide = ALL_PERMS_MASK };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * aa_split_fqname - split a fqname into a profile and namespace name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * @fqname: a full qualified name in namespace profile format (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * @ns_name: pointer to portion of the string containing the ns name (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) * Returns: profile name or NULL if one is not specified
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * Split a namespace name from a profile name (see policy.c for naming
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) * description). If a portion of the name is missing it returns NULL for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) * that portion.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) * NOTE: may modify the @fqname string. The pointers returned point
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) * into the @fqname string.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) char *aa_split_fqname(char *fqname, char **ns_name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) char *name = strim(fqname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) *ns_name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) if (name[0] == ':') {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) char *split = strchr(&name[1], ':');
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) *ns_name = skip_spaces(&name[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) if (split) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) /* overwrite ':' with \0 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) *split++ = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) if (strncmp(split, "//", 2) == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) split += 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) name = skip_spaces(split);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) /* a ns name without a following profile is allowed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) if (name && *name == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) return name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * skipn_spaces - Removes leading whitespace from @str.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) * @str: The string to be stripped.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * Returns a pointer to the first non-whitespace character in @str.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) * if all whitespace will return NULL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) const char *skipn_spaces(const char *str, size_t n)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) for (; n && isspace(*str); --n)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) ++str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) if (n)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) return (char *)str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) size_t *ns_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) const char *end = fqname + n;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) const char *name = skipn_spaces(fqname, n);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) *ns_name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) *ns_len = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (!name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) if (name[0] == ':') {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) char *split = strnchr(&name[1], end - &name[1], ':');
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) *ns_name = skipn_spaces(&name[1], end - &name[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) if (!*ns_name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) if (split) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) *ns_len = split - *ns_name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) if (*ns_len == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) *ns_name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) split++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) if (end - split > 1 && strncmp(split, "//", 2) == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) split += 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) name = skipn_spaces(split, end - split);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) /* a ns name without a following profile is allowed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) *ns_len = end - *ns_name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) if (name && *name == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) return name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) * aa_info_message - log a none profile related status message
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) * @str: message to log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) void aa_info_message(const char *str)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) if (audit_enabled) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) aad(&sa)->info = str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) printk(KERN_INFO "AppArmor: %s\n", str);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) __counted char *aa_str_alloc(int size, gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) struct counted_str *str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) str = kmalloc(sizeof(struct counted_str) + size, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) if (!str)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) kref_init(&str->count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) return str->name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) void aa_str_kref(struct kref *kref)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) kfree(container_of(kref, struct counted_str, count));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) const char aa_file_perm_chrs[] = "xwracd km l ";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) const char *aa_file_perm_names[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) "exec",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) "write",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) "read",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) "append",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) "create",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) "delete",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) "open",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) "rename",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) "setattr",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) "getattr",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) "setcred",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) "getcred",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) "chmod",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) "chown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) "chgrp",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) "lock",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) "mmap",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) "mprot",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) "link",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) "snapshot",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) "unknown",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) "stack",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) "change_onexec",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) "change_profile",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) "change_hat",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) * aa_perm_mask_to_str - convert a perm mask to its short string
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) * @str: character buffer to store string in (at least 10 characters)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) * @str_size: size of the @str buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) * @chrs: NUL-terminated character buffer of permission characters
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) * @mask: permission mask to convert
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, u32 mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) unsigned int i, perm = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) size_t num_chrs = strlen(chrs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) for (i = 0; i < num_chrs; perm <<= 1, i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) if (mask & perm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) /* Ensure that one byte is left for NUL-termination */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) if (WARN_ON_ONCE(str_size <= 1))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) *str++ = chrs[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) str_size--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) *str = '\0';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) u32 mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) const char *fmt = "%s";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) unsigned int i, perm = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) bool prev = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) for (i = 0; i < 32; perm <<= 1, i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) if (mask & perm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) audit_log_format(ab, fmt, names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) if (!prev) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) prev = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) fmt = " %s";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) u32 chrsmask, const char * const *names, u32 namesmask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) char str[33];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) audit_log_format(ab, "\"");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) if ((mask & chrsmask) && chrs) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) mask &= ~chrsmask;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) audit_log_format(ab, "%s", str);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) if (mask & namesmask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) audit_log_format(ab, " ");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) if ((mask & namesmask) && names)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) aa_audit_perm_names(ab, names, mask & namesmask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) audit_log_format(ab, "\"");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) * aa_audit_perms_cb - generic callback fn for auditing perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) * @ab: audit buffer (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) * @va: audit struct to audit values of (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) static void aa_audit_perms_cb(struct audit_buffer *ab, void *va)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) struct common_audit_data *sa = va;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) if (aad(sa)->request) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) audit_log_format(ab, " requested_mask=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) aa_audit_perm_mask(ab, aad(sa)->request, aa_file_perm_chrs,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) PERMS_CHRS_MASK, aa_file_perm_names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) PERMS_NAMES_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) if (aad(sa)->denied) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) audit_log_format(ab, "denied_mask=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) aa_audit_perm_mask(ab, aad(sa)->denied, aa_file_perm_chrs,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) PERMS_CHRS_MASK, aa_file_perm_names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) PERMS_NAMES_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) audit_log_format(ab, " peer=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) FLAGS_NONE, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) * aa_apply_modes_to_perms - apply namespace and profile flags to perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) * @profile: that perms where computed from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) * @perms: perms to apply mode modifiers to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) * TODO: split into profile and ns based flags for when accumulating perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) switch (AUDIT_MODE(profile)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) case AUDIT_ALL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) perms->audit = ALL_PERMS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) case AUDIT_NOQUIET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) perms->quiet = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) case AUDIT_QUIET:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) perms->audit = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) case AUDIT_QUIET_DENIED:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) perms->quiet = ALL_PERMS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) if (KILL_MODE(profile))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) perms->kill = ALL_PERMS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) else if (COMPLAIN_MODE(profile))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) perms->complain = ALL_PERMS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) * TODO:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) * else if (PROMPT_MODE(profile))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) * perms->prompt = ALL_PERMS_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) static u32 map_other(u32 x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) return ((x & 0x3) << 8) | /* SETATTR/GETATTR */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) ((x & 0x1c) << 18) | /* ACCEPT/BIND/LISTEN */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) ((x & 0x60) << 19); /* SETOPT/GETOPT */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) struct aa_perms *perms)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) *perms = (struct aa_perms) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) .allow = dfa_user_allow(dfa, state),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) .audit = dfa_user_audit(dfa, state),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) .quiet = dfa_user_quiet(dfa, state),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) /* for v5 perm mapping in the policydb, the other set is used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) * to extend the general perm set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) perms->allow |= map_other(dfa_other_allow(dfa, state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) perms->audit |= map_other(dfa_other_audit(dfa, state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) perms->quiet |= map_other(dfa_other_quiet(dfa, state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) // perms->xindex = dfa_user_xindex(dfa, state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) * aa_perms_accum_raw - accumulate perms with out masking off overlapping perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) * @accum - perms struct to accumulate into
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) * @addend - perms struct to add to @accum
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) accum->deny |= addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) accum->allow &= addend->allow & ~addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) accum->audit |= addend->audit & addend->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) accum->quiet &= addend->quiet & ~addend->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) accum->kill |= addend->kill & ~addend->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) accum->stop |= addend->stop & ~addend->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) accum->complain |= addend->complain & ~addend->allow & ~addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) accum->cond |= addend->cond & ~addend->allow & ~addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) accum->hide &= addend->hide & ~addend->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) * aa_perms_accum - accumulate perms, masking off overlapping perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) * @accum - perms struct to accumulate into
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) * @addend - perms struct to add to @accum
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) accum->deny |= addend->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) accum->allow &= addend->allow & ~accum->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) accum->audit |= addend->audit & accum->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) accum->quiet &= addend->quiet & ~accum->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) accum->kill |= addend->kill & ~accum->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) accum->stop |= addend->stop & ~accum->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) accum->complain |= addend->complain & ~accum->allow & ~accum->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) accum->cond |= addend->cond & ~accum->allow & ~accum->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) accum->hide &= addend->hide & ~accum->allow;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) int type, u32 request, struct aa_perms *perms)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) /* TODO: doesn't yet handle extended types */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) unsigned int state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) state = aa_dfa_next(profile->policy.dfa,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) profile->policy.start[AA_CLASS_LABEL],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) aa_label_match(profile, label, state, false, request, perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) /* currently unused */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) u32 request, int type, u32 *deny,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) struct common_audit_data *sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) struct aa_perms perms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) aad(sa)->label = &profile->label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) aad(sa)->peer = &target->label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) aad(sa)->request = request;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) aa_profile_match_label(profile, &target->label, type, request, &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) aa_apply_modes_to_perms(profile, &perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) *deny |= request & perms.deny;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) return aa_check_perms(profile, &perms, request, sa, aa_audit_perms_cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) * aa_check_perms - do audit mode selection based on perms set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) * @profile: profile being checked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) * @perms: perms computed for the request
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) * @request: requested perms
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) * @deny: Returns: explicit deny set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) * @sa: initialized audit structure (MAY BE NULL if not auditing)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) * @cb: callback fn for type specific fields (MAY BE NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) * Returns: 0 if permission else error code
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) * Note: profile audit modes need to be set before calling by setting the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) * perm masks appropriately.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) * If not auditing then complain mode is not enabled and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) * error code will indicate whether there was an explicit deny
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) * with a positive value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) u32 request, struct common_audit_data *sa,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) void (*cb)(struct audit_buffer *, void *))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) int type, error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) u32 denied = request & (~perms->allow | perms->deny);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) if (likely(!denied)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) /* mask off perms that are not being force audited */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) request &= perms->audit;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) if (!request || !sa)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) type = AUDIT_APPARMOR_AUDIT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) error = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) error = -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) if (denied & perms->kill)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) type = AUDIT_APPARMOR_KILL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) else if (denied == (denied & perms->complain))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) type = AUDIT_APPARMOR_ALLOWED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) type = AUDIT_APPARMOR_DENIED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) if (denied == (denied & perms->hide))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) error = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) denied &= ~perms->quiet;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) if (!sa || !denied)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) if (sa) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) aad(sa)->label = &profile->label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) aad(sa)->request = request;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) aad(sa)->denied = denied;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) aad(sa)->error = error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) aa_audit_msg(type, sa, cb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) if (type == AUDIT_APPARMOR_ALLOWED)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) error = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) return error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) * aa_policy_init - initialize a policy structure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) * @policy: policy to initialize (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) * @prefix: prefix name if any is required. (MAYBE NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) * @name: name of the policy, init will make a copy of it (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) * @gfp: allocation mode
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) * Note: this fn creates a copy of strings passed in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) * Returns: true if policy init successful
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) bool aa_policy_init(struct aa_policy *policy, const char *prefix,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) const char *name, gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) char *hname;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) /* freed by policy_free */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) if (prefix) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) hname = aa_str_alloc(strlen(prefix) + strlen(name) + 3, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) if (hname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) sprintf(hname, "%s//%s", prefix, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) hname = aa_str_alloc(strlen(name) + 1, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) if (hname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) strcpy(hname, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) if (!hname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) policy->hname = hname;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) /* base.name is a substring of fqname */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) policy->name = basename(policy->hname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) INIT_LIST_HEAD(&policy->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) INIT_LIST_HEAD(&policy->profiles);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) * aa_policy_destroy - free the elements referenced by @policy
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) * @policy: policy that is to have its elements freed (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) void aa_policy_destroy(struct aa_policy *policy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) AA_BUG(on_list_rcu(&policy->profiles));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) AA_BUG(on_list_rcu(&policy->list));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) /* don't free name as its a subset of hname */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) aa_put_str(policy->hname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags