^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * AppArmor security module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This file contains AppArmor /proc/<pid>/attr/ interface functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (C) 1998-2008 Novell/SUSE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Copyright 2009-2010 Canonical Ltd.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include "include/apparmor.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include "include/cred.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include "include/policy.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include "include/policy_ns.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include "include/domain.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include "include/procattr.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * aa_getprocattr - Return the profile information for @profile
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * @profile: the profile to print profile info about (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * @string: Returns - string containing the profile info (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * Returns: length of @string on success else error on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * Requires: profile != NULL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) * Creates a string containing the namespace_name://profile_name for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * @profile.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * Returns: size of string placed in @string else error code on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) int aa_getprocattr(struct aa_label *label, char **string)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) struct aa_ns *ns = labels_ns(label);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) struct aa_ns *current_ns = aa_get_current_ns();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) int len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) if (!aa_ns_visible(current_ns, ns, true)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) aa_put_ns(current_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) return -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) len = aa_label_snxprint(NULL, 0, current_ns, label,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) FLAG_HIDDEN_UNCONFINED);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) AA_BUG(len < 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) *string = kmalloc(len + 2, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) if (!*string) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) aa_put_ns(current_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) len = aa_label_snxprint(*string, len + 2, current_ns, label,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) FLAG_HIDDEN_UNCONFINED);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) if (len < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) aa_put_ns(current_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) return len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) (*string)[len] = '\n';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) (*string)[len + 1] = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) aa_put_ns(current_ns);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) return len + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) * split_token_from_name - separate a string of form <token>^<name>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * @op: operation being checked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) * @args: string to parse (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) * @token: stores returned parsed token value (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) * Returns: start position of name after token else NULL on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) static char *split_token_from_name(const char *op, char *args, u64 *token)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) char *name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) *token = simple_strtoull(args, &name, 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) if ((name == args) || *name != '^') {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) AA_ERROR("%s: Invalid input '%s'", op, args);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) return ERR_PTR(-EINVAL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) name++; /* skip ^ */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) if (!*name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) name = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) return name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) * aa_setprocattr_chagnehat - handle procattr interface to change_hat
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) * @size: size of the args
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) * @flags: set of flags governing behavior
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) * Returns: %0 or error code if change_hat fails
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) int aa_setprocattr_changehat(char *args, size_t size, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) char *hat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) u64 token;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) const char *hats[16]; /* current hard limit on # of names */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) int count = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) hat = split_token_from_name(OP_CHANGE_HAT, args, &token);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) if (IS_ERR(hat))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return PTR_ERR(hat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) if (!hat && !token) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) if (hat) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) /* set up hat name vector, args guaranteed null terminated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) * at args[size] by setprocattr.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) * If there are multiple hat names in the buffer each is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) * separated by a \0. Ie. userspace writes them pre tokenized
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) char *end = args + size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) for (count = 0; (hat < end) && count < 16; ++count) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) char *next = hat + strlen(hat) + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) hats[count] = hat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) , __func__, current->pid, token, count, hat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) hat = next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) __func__, current->pid, token, count, "<NULL>");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) return aa_change_hat(hats, count, token, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags