apparmorfs.c 65 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor /sys/kernel/security/apparmor interface functions
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2010 Canonical Ltd.
  9. */
  10. #include <linux/ctype.h>
  11. #include <linux/security.h>
  12. #include <linux/vmalloc.h>
  13. #include <linux/init.h>
  14. #include <linux/seq_file.h>
  15. #include <linux/uaccess.h>
  16. #include <linux/mount.h>
  17. #include <linux/namei.h>
  18. #include <linux/capability.h>
  19. #include <linux/rcupdate.h>
  20. #include <linux/fs.h>
  21. #include <linux/fs_context.h>
  22. #include <linux/poll.h>
  23. #include <linux/zlib.h>
  24. #include <uapi/linux/major.h>
  25. #include <uapi/linux/magic.h>
  26. #include "include/apparmor.h"
  27. #include "include/apparmorfs.h"
  28. #include "include/audit.h"
  29. #include "include/cred.h"
  30. #include "include/crypto.h"
  31. #include "include/ipc.h"
  32. #include "include/label.h"
  33. #include "include/policy.h"
  34. #include "include/policy_ns.h"
  35. #include "include/resource.h"
  36. #include "include/policy_unpack.h"
  37. /*
  38. * The apparmor filesystem interface used for policy load and introspection
  39. * The interface is split into two main components based on their function
  40. * a securityfs component:
  41. * used for static files that are always available, and which allows
  42. * userspace to specificy the location of the security filesystem.
  43. *
  44. * fns and data are prefixed with
  45. * aa_sfs_
  46. *
  47. * an apparmorfs component:
  48. * used loaded policy content and introspection. It is not part of a
  49. * regular mounted filesystem and is available only through the magic
  50. * policy symlink in the root of the securityfs apparmor/ directory.
  51. * Tasks queries will be magically redirected to the correct portion
  52. * of the policy tree based on their confinement.
  53. *
  54. * fns and data are prefixed with
  55. * aafs_
  56. *
  57. * The aa_fs_ prefix is used to indicate the fn is used by both the
  58. * securityfs and apparmorfs filesystems.
  59. */
  60. /*
  61. * support fns
  62. */
  63. struct rawdata_f_data {
  64. struct aa_loaddata *loaddata;
  65. };
  66. #define RAWDATA_F_DATA_BUF(p) (char *)(p + 1)
  67. static void rawdata_f_data_free(struct rawdata_f_data *private)
  68. {
  69. if (!private)
  70. return;
  71. aa_put_loaddata(private->loaddata);
  72. kvfree(private);
  73. }
  74. static struct rawdata_f_data *rawdata_f_data_alloc(size_t size)
  75. {
  76. struct rawdata_f_data *ret;
  77. if (size > SIZE_MAX - sizeof(*ret))
  78. return ERR_PTR(-EINVAL);
  79. ret = kvzalloc(sizeof(*ret) + size, GFP_KERNEL);
  80. if (!ret)
  81. return ERR_PTR(-ENOMEM);
  82. return ret;
  83. }
  84. /**
  85. * aa_mangle_name - mangle a profile name to std profile layout form
  86. * @name: profile name to mangle (NOT NULL)
  87. * @target: buffer to store mangled name, same length as @name (MAYBE NULL)
  88. *
  89. * Returns: length of mangled name
  90. */
  91. static int mangle_name(const char *name, char *target)
  92. {
  93. char *t = target;
  94. while (*name == '/' || *name == '.')
  95. name++;
  96. if (target) {
  97. for (; *name; name++) {
  98. if (*name == '/')
  99. *(t)++ = '.';
  100. else if (isspace(*name))
  101. *(t)++ = '_';
  102. else if (isalnum(*name) || strchr("._-", *name))
  103. *(t)++ = *name;
  104. }
  105. *t = 0;
  106. } else {
  107. int len = 0;
  108. for (; *name; name++) {
  109. if (isalnum(*name) || isspace(*name) ||
  110. strchr("/._-", *name))
  111. len++;
  112. }
  113. return len;
  114. }
  115. return t - target;
  116. }
  117. /*
  118. * aafs - core fns and data for the policy tree
  119. */
  120. #define AAFS_NAME "apparmorfs"
  121. static struct vfsmount *aafs_mnt;
  122. static int aafs_count;
  123. static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
  124. {
  125. seq_printf(seq, "%s:[%lu]", AAFS_NAME, d_inode(dentry)->i_ino);
  126. return 0;
  127. }
  128. static void aafs_free_inode(struct inode *inode)
  129. {
  130. if (S_ISLNK(inode->i_mode))
  131. kfree(inode->i_link);
  132. free_inode_nonrcu(inode);
  133. }
  134. static const struct super_operations aafs_super_ops = {
  135. .statfs = simple_statfs,
  136. .free_inode = aafs_free_inode,
  137. .show_path = aafs_show_path,
  138. };
  139. static int apparmorfs_fill_super(struct super_block *sb, struct fs_context *fc)
  140. {
  141. static struct tree_descr files[] = { {""} };
  142. int error;
  143. error = simple_fill_super(sb, AAFS_MAGIC, files);
  144. if (error)
  145. return error;
  146. sb->s_op = &aafs_super_ops;
  147. return 0;
  148. }
  149. static int apparmorfs_get_tree(struct fs_context *fc)
  150. {
  151. return get_tree_single(fc, apparmorfs_fill_super);
  152. }
  153. static const struct fs_context_operations apparmorfs_context_ops = {
  154. .get_tree = apparmorfs_get_tree,
  155. };
  156. static int apparmorfs_init_fs_context(struct fs_context *fc)
  157. {
  158. fc->ops = &apparmorfs_context_ops;
  159. return 0;
  160. }
  161. static struct file_system_type aafs_ops = {
  162. .owner = THIS_MODULE,
  163. .name = AAFS_NAME,
  164. .init_fs_context = apparmorfs_init_fs_context,
  165. .kill_sb = kill_anon_super,
  166. };
  167. /**
  168. * __aafs_setup_d_inode - basic inode setup for apparmorfs
  169. * @dir: parent directory for the dentry
  170. * @dentry: dentry we are seting the inode up for
  171. * @mode: permissions the file should have
  172. * @data: data to store on inode.i_private, available in open()
  173. * @link: if symlink, symlink target string
  174. * @fops: struct file_operations that should be used
  175. * @iops: struct of inode_operations that should be used
  176. */
  177. static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
  178. umode_t mode, void *data, char *link,
  179. const struct file_operations *fops,
  180. const struct inode_operations *iops)
  181. {
  182. struct inode *inode = new_inode(dir->i_sb);
  183. AA_BUG(!dir);
  184. AA_BUG(!dentry);
  185. if (!inode)
  186. return -ENOMEM;
  187. inode->i_ino = get_next_ino();
  188. inode->i_mode = mode;
  189. inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
  190. inode->i_private = data;
  191. if (S_ISDIR(mode)) {
  192. inode->i_op = iops ? iops : &simple_dir_inode_operations;
  193. inode->i_fop = &simple_dir_operations;
  194. inc_nlink(inode);
  195. inc_nlink(dir);
  196. } else if (S_ISLNK(mode)) {
  197. inode->i_op = iops ? iops : &simple_symlink_inode_operations;
  198. inode->i_link = link;
  199. } else {
  200. inode->i_fop = fops;
  201. }
  202. d_instantiate(dentry, inode);
  203. dget(dentry);
  204. return 0;
  205. }
  206. /**
  207. * aafs_create - create a dentry in the apparmorfs filesystem
  208. *
  209. * @name: name of dentry to create
  210. * @mode: permissions the file should have
  211. * @parent: parent directory for this dentry
  212. * @data: data to store on inode.i_private, available in open()
  213. * @link: if symlink, symlink target string
  214. * @fops: struct file_operations that should be used for
  215. * @iops: struct of inode_operations that should be used
  216. *
  217. * This is the basic "create a xxx" function for apparmorfs.
  218. *
  219. * Returns a pointer to a dentry if it succeeds, that must be free with
  220. * aafs_remove(). Will return ERR_PTR on failure.
  221. */
  222. static struct dentry *aafs_create(const char *name, umode_t mode,
  223. struct dentry *parent, void *data, void *link,
  224. const struct file_operations *fops,
  225. const struct inode_operations *iops)
  226. {
  227. struct dentry *dentry;
  228. struct inode *dir;
  229. int error;
  230. AA_BUG(!name);
  231. AA_BUG(!parent);
  232. if (!(mode & S_IFMT))
  233. mode = (mode & S_IALLUGO) | S_IFREG;
  234. error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
  235. if (error)
  236. return ERR_PTR(error);
  237. dir = d_inode(parent);
  238. inode_lock(dir);
  239. dentry = lookup_one_len(name, parent, strlen(name));
  240. if (IS_ERR(dentry)) {
  241. error = PTR_ERR(dentry);
  242. goto fail_lock;
  243. }
  244. if (d_really_is_positive(dentry)) {
  245. error = -EEXIST;
  246. goto fail_dentry;
  247. }
  248. error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
  249. if (error)
  250. goto fail_dentry;
  251. inode_unlock(dir);
  252. return dentry;
  253. fail_dentry:
  254. dput(dentry);
  255. fail_lock:
  256. inode_unlock(dir);
  257. simple_release_fs(&aafs_mnt, &aafs_count);
  258. return ERR_PTR(error);
  259. }
  260. /**
  261. * aafs_create_file - create a file in the apparmorfs filesystem
  262. *
  263. * @name: name of dentry to create
  264. * @mode: permissions the file should have
  265. * @parent: parent directory for this dentry
  266. * @data: data to store on inode.i_private, available in open()
  267. * @fops: struct file_operations that should be used for
  268. *
  269. * see aafs_create
  270. */
  271. static struct dentry *aafs_create_file(const char *name, umode_t mode,
  272. struct dentry *parent, void *data,
  273. const struct file_operations *fops)
  274. {
  275. return aafs_create(name, mode, parent, data, NULL, fops, NULL);
  276. }
  277. /**
  278. * aafs_create_dir - create a directory in the apparmorfs filesystem
  279. *
  280. * @name: name of dentry to create
  281. * @parent: parent directory for this dentry
  282. *
  283. * see aafs_create
  284. */
  285. static struct dentry *aafs_create_dir(const char *name, struct dentry *parent)
  286. {
  287. return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL,
  288. NULL);
  289. }
  290. /**
  291. * aafs_remove - removes a file or directory from the apparmorfs filesystem
  292. *
  293. * @dentry: dentry of the file/directory/symlink to removed.
  294. */
  295. static void aafs_remove(struct dentry *dentry)
  296. {
  297. struct inode *dir;
  298. if (!dentry || IS_ERR(dentry))
  299. return;
  300. dir = d_inode(dentry->d_parent);
  301. inode_lock(dir);
  302. if (simple_positive(dentry)) {
  303. if (d_is_dir(dentry))
  304. simple_rmdir(dir, dentry);
  305. else
  306. simple_unlink(dir, dentry);
  307. d_delete(dentry);
  308. dput(dentry);
  309. }
  310. inode_unlock(dir);
  311. simple_release_fs(&aafs_mnt, &aafs_count);
  312. }
  313. /*
  314. * aa_fs - policy load/replace/remove
  315. */
  316. /**
  317. * aa_simple_write_to_buffer - common routine for getting policy from user
  318. * @userbuf: user buffer to copy data from (NOT NULL)
  319. * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size)
  320. * @copy_size: size of data to copy from user buffer
  321. * @pos: position write is at in the file (NOT NULL)
  322. *
  323. * Returns: kernel buffer containing copy of user buffer data or an
  324. * ERR_PTR on failure.
  325. */
  326. static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
  327. size_t alloc_size,
  328. size_t copy_size,
  329. loff_t *pos)
  330. {
  331. struct aa_loaddata *data;
  332. AA_BUG(copy_size > alloc_size);
  333. if (*pos != 0)
  334. /* only writes from pos 0, that is complete writes */
  335. return ERR_PTR(-ESPIPE);
  336. /* freed by caller to simple_write_to_buffer */
  337. data = aa_loaddata_alloc(alloc_size);
  338. if (IS_ERR(data))
  339. return data;
  340. data->size = copy_size;
  341. if (copy_from_user(data->data, userbuf, copy_size)) {
  342. kvfree(data);
  343. return ERR_PTR(-EFAULT);
  344. }
  345. return data;
  346. }
  347. static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
  348. loff_t *pos, struct aa_ns *ns)
  349. {
  350. struct aa_loaddata *data;
  351. struct aa_label *label;
  352. ssize_t error;
  353. label = begin_current_label_crit_section();
  354. /* high level check about policy management - fine grained in
  355. * below after unpack
  356. */
  357. error = aa_may_manage_policy(label, ns, mask);
  358. if (error)
  359. goto end_section;
  360. data = aa_simple_write_to_buffer(buf, size, size, pos);
  361. error = PTR_ERR(data);
  362. if (!IS_ERR(data)) {
  363. error = aa_replace_profiles(ns, label, mask, data);
  364. aa_put_loaddata(data);
  365. }
  366. end_section:
  367. end_current_label_crit_section(label);
  368. return error;
  369. }
  370. /* .load file hook fn to load policy */
  371. static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
  372. loff_t *pos)
  373. {
  374. struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
  375. int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
  376. aa_put_ns(ns);
  377. return error;
  378. }
  379. static const struct file_operations aa_fs_profile_load = {
  380. .write = profile_load,
  381. .llseek = default_llseek,
  382. };
  383. /* .replace file hook fn to load and/or replace policy */
  384. static ssize_t profile_replace(struct file *f, const char __user *buf,
  385. size_t size, loff_t *pos)
  386. {
  387. struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
  388. int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
  389. buf, size, pos, ns);
  390. aa_put_ns(ns);
  391. return error;
  392. }
  393. static const struct file_operations aa_fs_profile_replace = {
  394. .write = profile_replace,
  395. .llseek = default_llseek,
  396. };
  397. /* .remove file hook fn to remove loaded policy */
  398. static ssize_t profile_remove(struct file *f, const char __user *buf,
  399. size_t size, loff_t *pos)
  400. {
  401. struct aa_loaddata *data;
  402. struct aa_label *label;
  403. ssize_t error;
  404. struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
  405. label = begin_current_label_crit_section();
  406. /* high level check about policy management - fine grained in
  407. * below after unpack
  408. */
  409. error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);
  410. if (error)
  411. goto out;
  412. /*
  413. * aa_remove_profile needs a null terminated string so 1 extra
  414. * byte is allocated and the copied data is null terminated.
  415. */
  416. data = aa_simple_write_to_buffer(buf, size + 1, size, pos);
  417. error = PTR_ERR(data);
  418. if (!IS_ERR(data)) {
  419. data->data[size] = 0;
  420. error = aa_remove_profiles(ns, label, data->data, size);
  421. aa_put_loaddata(data);
  422. }
  423. out:
  424. end_current_label_crit_section(label);
  425. aa_put_ns(ns);
  426. return error;
  427. }
  428. static const struct file_operations aa_fs_profile_remove = {
  429. .write = profile_remove,
  430. .llseek = default_llseek,
  431. };
  432. struct aa_revision {
  433. struct aa_ns *ns;
  434. long last_read;
  435. };
  436. /* revision file hook fn for policy loads */
  437. static int ns_revision_release(struct inode *inode, struct file *file)
  438. {
  439. struct aa_revision *rev = file->private_data;
  440. if (rev) {
  441. aa_put_ns(rev->ns);
  442. kfree(rev);
  443. }
  444. return 0;
  445. }
  446. static ssize_t ns_revision_read(struct file *file, char __user *buf,
  447. size_t size, loff_t *ppos)
  448. {
  449. struct aa_revision *rev = file->private_data;
  450. char buffer[32];
  451. long last_read;
  452. int avail;
  453. mutex_lock_nested(&rev->ns->lock, rev->ns->level);
  454. last_read = rev->last_read;
  455. if (last_read == rev->ns->revision) {
  456. mutex_unlock(&rev->ns->lock);
  457. if (file->f_flags & O_NONBLOCK)
  458. return -EAGAIN;
  459. if (wait_event_interruptible(rev->ns->wait,
  460. last_read !=
  461. READ_ONCE(rev->ns->revision)))
  462. return -ERESTARTSYS;
  463. mutex_lock_nested(&rev->ns->lock, rev->ns->level);
  464. }
  465. avail = sprintf(buffer, "%ld\n", rev->ns->revision);
  466. if (*ppos + size > avail) {
  467. rev->last_read = rev->ns->revision;
  468. *ppos = 0;
  469. }
  470. mutex_unlock(&rev->ns->lock);
  471. return simple_read_from_buffer(buf, size, ppos, buffer, avail);
  472. }
  473. static int ns_revision_open(struct inode *inode, struct file *file)
  474. {
  475. struct aa_revision *rev = kzalloc(sizeof(*rev), GFP_KERNEL);
  476. if (!rev)
  477. return -ENOMEM;
  478. rev->ns = aa_get_ns(inode->i_private);
  479. if (!rev->ns)
  480. rev->ns = aa_get_current_ns();
  481. file->private_data = rev;
  482. return 0;
  483. }
  484. static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
  485. {
  486. struct aa_revision *rev = file->private_data;
  487. __poll_t mask = 0;
  488. if (rev) {
  489. mutex_lock_nested(&rev->ns->lock, rev->ns->level);
  490. poll_wait(file, &rev->ns->wait, pt);
  491. if (rev->last_read < rev->ns->revision)
  492. mask |= EPOLLIN | EPOLLRDNORM;
  493. mutex_unlock(&rev->ns->lock);
  494. }
  495. return mask;
  496. }
  497. void __aa_bump_ns_revision(struct aa_ns *ns)
  498. {
  499. WRITE_ONCE(ns->revision, READ_ONCE(ns->revision) + 1);
  500. wake_up_interruptible(&ns->wait);
  501. }
  502. static const struct file_operations aa_fs_ns_revision_fops = {
  503. .owner = THIS_MODULE,
  504. .open = ns_revision_open,
  505. .poll = ns_revision_poll,
  506. .read = ns_revision_read,
  507. .llseek = generic_file_llseek,
  508. .release = ns_revision_release,
  509. };
  510. static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
  511. const char *match_str, size_t match_len)
  512. {
  513. struct aa_perms tmp = { };
  514. struct aa_dfa *dfa;
  515. unsigned int state = 0;
  516. if (profile_unconfined(profile))
  517. return;
  518. if (profile->file.dfa && *match_str == AA_CLASS_FILE) {
  519. dfa = profile->file.dfa;
  520. state = aa_dfa_match_len(dfa, profile->file.start,
  521. match_str + 1, match_len - 1);
  522. if (state) {
  523. struct path_cond cond = { };
  524. tmp = aa_compute_fperms(dfa, state, &cond);
  525. }
  526. } else if (profile->policy.dfa) {
  527. if (!PROFILE_MEDIATES(profile, *match_str))
  528. return; /* no change to current perms */
  529. dfa = profile->policy.dfa;
  530. state = aa_dfa_match_len(dfa, profile->policy.start[0],
  531. match_str, match_len);
  532. if (state)
  533. aa_compute_perms(dfa, state, &tmp);
  534. }
  535. aa_apply_modes_to_perms(profile, &tmp);
  536. aa_perms_accum_raw(perms, &tmp);
  537. }
  538. /**
  539. * query_data - queries a policy and writes its data to buf
  540. * @buf: the resulting data is stored here (NOT NULL)
  541. * @buf_len: size of buf
  542. * @query: query string used to retrieve data
  543. * @query_len: size of query including second NUL byte
  544. *
  545. * The buffers pointed to by buf and query may overlap. The query buffer is
  546. * parsed before buf is written to.
  547. *
  548. * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of
  549. * the security confinement context and <KEY> is the name of the data to
  550. * retrieve. <LABEL> and <KEY> must not be NUL-terminated.
  551. *
  552. * Don't expect the contents of buf to be preserved on failure.
  553. *
  554. * Returns: number of characters written to buf or -errno on failure
  555. */
  556. static ssize_t query_data(char *buf, size_t buf_len,
  557. char *query, size_t query_len)
  558. {
  559. char *out;
  560. const char *key;
  561. struct label_it i;
  562. struct aa_label *label, *curr;
  563. struct aa_profile *profile;
  564. struct aa_data *data;
  565. u32 bytes, blocks;
  566. __le32 outle32;
  567. if (!query_len)
  568. return -EINVAL; /* need a query */
  569. key = query + strnlen(query, query_len) + 1;
  570. if (key + 1 >= query + query_len)
  571. return -EINVAL; /* not enough space for a non-empty key */
  572. if (key + strnlen(key, query + query_len - key) >= query + query_len)
  573. return -EINVAL; /* must end with NUL */
  574. if (buf_len < sizeof(bytes) + sizeof(blocks))
  575. return -EINVAL; /* not enough space */
  576. curr = begin_current_label_crit_section();
  577. label = aa_label_parse(curr, query, GFP_KERNEL, false, false);
  578. end_current_label_crit_section(curr);
  579. if (IS_ERR(label))
  580. return PTR_ERR(label);
  581. /* We are going to leave space for two numbers. The first is the total
  582. * number of bytes we are writing after the first number. This is so
  583. * users can read the full output without reallocation.
  584. *
  585. * The second number is the number of data blocks we're writing. An
  586. * application might be confined by multiple policies having data in
  587. * the same key.
  588. */
  589. memset(buf, 0, sizeof(bytes) + sizeof(blocks));
  590. out = buf + sizeof(bytes) + sizeof(blocks);
  591. blocks = 0;
  592. label_for_each_confined(i, label, profile) {
  593. if (!profile->data)
  594. continue;
  595. data = rhashtable_lookup_fast(profile->data, &key,
  596. profile->data->p);
  597. if (data) {
  598. if (out + sizeof(outle32) + data->size > buf +
  599. buf_len) {
  600. aa_put_label(label);
  601. return -EINVAL; /* not enough space */
  602. }
  603. outle32 = __cpu_to_le32(data->size);
  604. memcpy(out, &outle32, sizeof(outle32));
  605. out += sizeof(outle32);
  606. memcpy(out, data->data, data->size);
  607. out += data->size;
  608. blocks++;
  609. }
  610. }
  611. aa_put_label(label);
  612. outle32 = __cpu_to_le32(out - buf - sizeof(bytes));
  613. memcpy(buf, &outle32, sizeof(outle32));
  614. outle32 = __cpu_to_le32(blocks);
  615. memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32));
  616. return out - buf;
  617. }
  618. /**
  619. * query_label - queries a label and writes permissions to buf
  620. * @buf: the resulting permissions string is stored here (NOT NULL)
  621. * @buf_len: size of buf
  622. * @query: binary query string to match against the dfa
  623. * @query_len: size of query
  624. * @view_only: only compute for querier's view
  625. *
  626. * The buffers pointed to by buf and query may overlap. The query buffer is
  627. * parsed before buf is written to.
  628. *
  629. * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is
  630. * the name of the label, in the current namespace, that is to be queried and
  631. * DFA_STRING is a binary string to match against the label(s)'s DFA.
  632. *
  633. * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters
  634. * but must *not* be NUL terminated.
  635. *
  636. * Returns: number of characters written to buf or -errno on failure
  637. */
  638. static ssize_t query_label(char *buf, size_t buf_len,
  639. char *query, size_t query_len, bool view_only)
  640. {
  641. struct aa_profile *profile;
  642. struct aa_label *label, *curr;
  643. char *label_name, *match_str;
  644. size_t label_name_len, match_len;
  645. struct aa_perms perms;
  646. struct label_it i;
  647. if (!query_len)
  648. return -EINVAL;
  649. label_name = query;
  650. label_name_len = strnlen(query, query_len);
  651. if (!label_name_len || label_name_len == query_len)
  652. return -EINVAL;
  653. /**
  654. * The extra byte is to account for the null byte between the
  655. * profile name and dfa string. profile_name_len is greater
  656. * than zero and less than query_len, so a byte can be safely
  657. * added or subtracted.
  658. */
  659. match_str = label_name + label_name_len + 1;
  660. match_len = query_len - label_name_len - 1;
  661. curr = begin_current_label_crit_section();
  662. label = aa_label_parse(curr, label_name, GFP_KERNEL, false, false);
  663. end_current_label_crit_section(curr);
  664. if (IS_ERR(label))
  665. return PTR_ERR(label);
  666. perms = allperms;
  667. if (view_only) {
  668. label_for_each_in_ns(i, labels_ns(label), label, profile) {
  669. profile_query_cb(profile, &perms, match_str, match_len);
  670. }
  671. } else {
  672. label_for_each(i, label, profile) {
  673. profile_query_cb(profile, &perms, match_str, match_len);
  674. }
  675. }
  676. aa_put_label(label);
  677. return scnprintf(buf, buf_len,
  678. "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n",
  679. perms.allow, perms.deny, perms.audit, perms.quiet);
  680. }
  681. /*
  682. * Transaction based IO.
  683. * The file expects a write which triggers the transaction, and then
  684. * possibly a read(s) which collects the result - which is stored in a
  685. * file-local buffer. Once a new write is performed, a new set of results
  686. * are stored in the file-local buffer.
  687. */
  688. struct multi_transaction {
  689. struct kref count;
  690. ssize_t size;
  691. char data[];
  692. };
  693. #define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction))
  694. /* TODO: replace with per file lock */
  695. static DEFINE_SPINLOCK(multi_transaction_lock);
  696. static void multi_transaction_kref(struct kref *kref)
  697. {
  698. struct multi_transaction *t;
  699. t = container_of(kref, struct multi_transaction, count);
  700. free_page((unsigned long) t);
  701. }
  702. static struct multi_transaction *
  703. get_multi_transaction(struct multi_transaction *t)
  704. {
  705. if (t)
  706. kref_get(&(t->count));
  707. return t;
  708. }
  709. static void put_multi_transaction(struct multi_transaction *t)
  710. {
  711. if (t)
  712. kref_put(&(t->count), multi_transaction_kref);
  713. }
  714. /* does not increment @new's count */
  715. static void multi_transaction_set(struct file *file,
  716. struct multi_transaction *new, size_t n)
  717. {
  718. struct multi_transaction *old;
  719. AA_BUG(n > MULTI_TRANSACTION_LIMIT);
  720. new->size = n;
  721. spin_lock(&multi_transaction_lock);
  722. old = (struct multi_transaction *) file->private_data;
  723. file->private_data = new;
  724. spin_unlock(&multi_transaction_lock);
  725. put_multi_transaction(old);
  726. }
  727. static struct multi_transaction *multi_transaction_new(struct file *file,
  728. const char __user *buf,
  729. size_t size)
  730. {
  731. struct multi_transaction *t;
  732. if (size > MULTI_TRANSACTION_LIMIT - 1)
  733. return ERR_PTR(-EFBIG);
  734. t = (struct multi_transaction *)get_zeroed_page(GFP_KERNEL);
  735. if (!t)
  736. return ERR_PTR(-ENOMEM);
  737. kref_init(&t->count);
  738. if (copy_from_user(t->data, buf, size))
  739. return ERR_PTR(-EFAULT);
  740. return t;
  741. }
  742. static ssize_t multi_transaction_read(struct file *file, char __user *buf,
  743. size_t size, loff_t *pos)
  744. {
  745. struct multi_transaction *t;
  746. ssize_t ret;
  747. spin_lock(&multi_transaction_lock);
  748. t = get_multi_transaction(file->private_data);
  749. spin_unlock(&multi_transaction_lock);
  750. if (!t)
  751. return 0;
  752. ret = simple_read_from_buffer(buf, size, pos, t->data, t->size);
  753. put_multi_transaction(t);
  754. return ret;
  755. }
  756. static int multi_transaction_release(struct inode *inode, struct file *file)
  757. {
  758. put_multi_transaction(file->private_data);
  759. return 0;
  760. }
  761. #define QUERY_CMD_LABEL "label\0"
  762. #define QUERY_CMD_LABEL_LEN 6
  763. #define QUERY_CMD_PROFILE "profile\0"
  764. #define QUERY_CMD_PROFILE_LEN 8
  765. #define QUERY_CMD_LABELALL "labelall\0"
  766. #define QUERY_CMD_LABELALL_LEN 9
  767. #define QUERY_CMD_DATA "data\0"
  768. #define QUERY_CMD_DATA_LEN 5
  769. /**
  770. * aa_write_access - generic permissions and data query
  771. * @file: pointer to open apparmorfs/access file
  772. * @ubuf: user buffer containing the complete query string (NOT NULL)
  773. * @count: size of ubuf
  774. * @ppos: position in the file (MUST BE ZERO)
  775. *
  776. * Allows for one permissions or data query per open(), write(), and read()
  777. * sequence. The only queries currently supported are label-based queries for
  778. * permissions or data.
  779. *
  780. * For permissions queries, ubuf must begin with "label\0", followed by the
  781. * profile query specific format described in the query_label() function
  782. * documentation.
  783. *
  784. * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where
  785. * <LABEL> is the name of the security confinement context and <KEY> is the
  786. * name of the data to retrieve.
  787. *
  788. * Returns: number of bytes written or -errno on failure
  789. */
  790. static ssize_t aa_write_access(struct file *file, const char __user *ubuf,
  791. size_t count, loff_t *ppos)
  792. {
  793. struct multi_transaction *t;
  794. ssize_t len;
  795. if (*ppos)
  796. return -ESPIPE;
  797. t = multi_transaction_new(file, ubuf, count);
  798. if (IS_ERR(t))
  799. return PTR_ERR(t);
  800. if (count > QUERY_CMD_PROFILE_LEN &&
  801. !memcmp(t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) {
  802. len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
  803. t->data + QUERY_CMD_PROFILE_LEN,
  804. count - QUERY_CMD_PROFILE_LEN, true);
  805. } else if (count > QUERY_CMD_LABEL_LEN &&
  806. !memcmp(t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) {
  807. len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
  808. t->data + QUERY_CMD_LABEL_LEN,
  809. count - QUERY_CMD_LABEL_LEN, true);
  810. } else if (count > QUERY_CMD_LABELALL_LEN &&
  811. !memcmp(t->data, QUERY_CMD_LABELALL,
  812. QUERY_CMD_LABELALL_LEN)) {
  813. len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
  814. t->data + QUERY_CMD_LABELALL_LEN,
  815. count - QUERY_CMD_LABELALL_LEN, false);
  816. } else if (count > QUERY_CMD_DATA_LEN &&
  817. !memcmp(t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) {
  818. len = query_data(t->data, MULTI_TRANSACTION_LIMIT,
  819. t->data + QUERY_CMD_DATA_LEN,
  820. count - QUERY_CMD_DATA_LEN);
  821. } else
  822. len = -EINVAL;
  823. if (len < 0) {
  824. put_multi_transaction(t);
  825. return len;
  826. }
  827. multi_transaction_set(file, t, len);
  828. return count;
  829. }
  830. static const struct file_operations aa_sfs_access = {
  831. .write = aa_write_access,
  832. .read = multi_transaction_read,
  833. .release = multi_transaction_release,
  834. .llseek = generic_file_llseek,
  835. };
  836. static int aa_sfs_seq_show(struct seq_file *seq, void *v)
  837. {
  838. struct aa_sfs_entry *fs_file = seq->private;
  839. if (!fs_file)
  840. return 0;
  841. switch (fs_file->v_type) {
  842. case AA_SFS_TYPE_BOOLEAN:
  843. seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
  844. break;
  845. case AA_SFS_TYPE_STRING:
  846. seq_printf(seq, "%s\n", fs_file->v.string);
  847. break;
  848. case AA_SFS_TYPE_U64:
  849. seq_printf(seq, "%#08lx\n", fs_file->v.u64);
  850. break;
  851. default:
  852. /* Ignore unpritable entry types. */
  853. break;
  854. }
  855. return 0;
  856. }
  857. static int aa_sfs_seq_open(struct inode *inode, struct file *file)
  858. {
  859. return single_open(file, aa_sfs_seq_show, inode->i_private);
  860. }
  861. const struct file_operations aa_sfs_seq_file_ops = {
  862. .owner = THIS_MODULE,
  863. .open = aa_sfs_seq_open,
  864. .read = seq_read,
  865. .llseek = seq_lseek,
  866. .release = single_release,
  867. };
  868. /*
  869. * profile based file operations
  870. * policy/profiles/XXXX/profiles/ *
  871. */
  872. #define SEQ_PROFILE_FOPS(NAME) \
  873. static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\
  874. { \
  875. return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show); \
  876. } \
  877. \
  878. static const struct file_operations seq_profile_ ##NAME ##_fops = { \
  879. .owner = THIS_MODULE, \
  880. .open = seq_profile_ ##NAME ##_open, \
  881. .read = seq_read, \
  882. .llseek = seq_lseek, \
  883. .release = seq_profile_release, \
  884. } \
  885. static int seq_profile_open(struct inode *inode, struct file *file,
  886. int (*show)(struct seq_file *, void *))
  887. {
  888. struct aa_proxy *proxy = aa_get_proxy(inode->i_private);
  889. int error = single_open(file, show, proxy);
  890. if (error) {
  891. file->private_data = NULL;
  892. aa_put_proxy(proxy);
  893. }
  894. return error;
  895. }
  896. static int seq_profile_release(struct inode *inode, struct file *file)
  897. {
  898. struct seq_file *seq = (struct seq_file *) file->private_data;
  899. if (seq)
  900. aa_put_proxy(seq->private);
  901. return single_release(inode, file);
  902. }
  903. static int seq_profile_name_show(struct seq_file *seq, void *v)
  904. {
  905. struct aa_proxy *proxy = seq->private;
  906. struct aa_label *label = aa_get_label_rcu(&proxy->label);
  907. struct aa_profile *profile = labels_profile(label);
  908. seq_printf(seq, "%s\n", profile->base.name);
  909. aa_put_label(label);
  910. return 0;
  911. }
  912. static int seq_profile_mode_show(struct seq_file *seq, void *v)
  913. {
  914. struct aa_proxy *proxy = seq->private;
  915. struct aa_label *label = aa_get_label_rcu(&proxy->label);
  916. struct aa_profile *profile = labels_profile(label);
  917. seq_printf(seq, "%s\n", aa_profile_mode_names[profile->mode]);
  918. aa_put_label(label);
  919. return 0;
  920. }
  921. static int seq_profile_attach_show(struct seq_file *seq, void *v)
  922. {
  923. struct aa_proxy *proxy = seq->private;
  924. struct aa_label *label = aa_get_label_rcu(&proxy->label);
  925. struct aa_profile *profile = labels_profile(label);
  926. if (profile->attach)
  927. seq_printf(seq, "%s\n", profile->attach);
  928. else if (profile->xmatch)
  929. seq_puts(seq, "<unknown>\n");
  930. else
  931. seq_printf(seq, "%s\n", profile->base.name);
  932. aa_put_label(label);
  933. return 0;
  934. }
  935. static int seq_profile_hash_show(struct seq_file *seq, void *v)
  936. {
  937. struct aa_proxy *proxy = seq->private;
  938. struct aa_label *label = aa_get_label_rcu(&proxy->label);
  939. struct aa_profile *profile = labels_profile(label);
  940. unsigned int i, size = aa_hash_size();
  941. if (profile->hash) {
  942. for (i = 0; i < size; i++)
  943. seq_printf(seq, "%.2x", profile->hash[i]);
  944. seq_putc(seq, '\n');
  945. }
  946. aa_put_label(label);
  947. return 0;
  948. }
  949. SEQ_PROFILE_FOPS(name);
  950. SEQ_PROFILE_FOPS(mode);
  951. SEQ_PROFILE_FOPS(attach);
  952. SEQ_PROFILE_FOPS(hash);
  953. /*
  954. * namespace based files
  955. * several root files and
  956. * policy/ *
  957. */
  958. #define SEQ_NS_FOPS(NAME) \
  959. static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file) \
  960. { \
  961. return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private); \
  962. } \
  963. \
  964. static const struct file_operations seq_ns_ ##NAME ##_fops = { \
  965. .owner = THIS_MODULE, \
  966. .open = seq_ns_ ##NAME ##_open, \
  967. .read = seq_read, \
  968. .llseek = seq_lseek, \
  969. .release = single_release, \
  970. } \
  971. static int seq_ns_stacked_show(struct seq_file *seq, void *v)
  972. {
  973. struct aa_label *label;
  974. label = begin_current_label_crit_section();
  975. seq_printf(seq, "%s\n", label->size > 1 ? "yes" : "no");
  976. end_current_label_crit_section(label);
  977. return 0;
  978. }
  979. static int seq_ns_nsstacked_show(struct seq_file *seq, void *v)
  980. {
  981. struct aa_label *label;
  982. struct aa_profile *profile;
  983. struct label_it it;
  984. int count = 1;
  985. label = begin_current_label_crit_section();
  986. if (label->size > 1) {
  987. label_for_each(it, label, profile)
  988. if (profile->ns != labels_ns(label)) {
  989. count++;
  990. break;
  991. }
  992. }
  993. seq_printf(seq, "%s\n", count > 1 ? "yes" : "no");
  994. end_current_label_crit_section(label);
  995. return 0;
  996. }
  997. static int seq_ns_level_show(struct seq_file *seq, void *v)
  998. {
  999. struct aa_label *label;
  1000. label = begin_current_label_crit_section();
  1001. seq_printf(seq, "%d\n", labels_ns(label)->level);
  1002. end_current_label_crit_section(label);
  1003. return 0;
  1004. }
  1005. static int seq_ns_name_show(struct seq_file *seq, void *v)
  1006. {
  1007. struct aa_label *label = begin_current_label_crit_section();
  1008. seq_printf(seq, "%s\n", labels_ns(label)->base.name);
  1009. end_current_label_crit_section(label);
  1010. return 0;
  1011. }
  1012. SEQ_NS_FOPS(stacked);
  1013. SEQ_NS_FOPS(nsstacked);
  1014. SEQ_NS_FOPS(level);
  1015. SEQ_NS_FOPS(name);
  1016. /* policy/raw_data/ * file ops */
  1017. #define SEQ_RAWDATA_FOPS(NAME) \
  1018. static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\
  1019. { \
  1020. return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show); \
  1021. } \
  1022. \
  1023. static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
  1024. .owner = THIS_MODULE, \
  1025. .open = seq_rawdata_ ##NAME ##_open, \
  1026. .read = seq_read, \
  1027. .llseek = seq_lseek, \
  1028. .release = seq_rawdata_release, \
  1029. } \
  1030. static int seq_rawdata_open(struct inode *inode, struct file *file,
  1031. int (*show)(struct seq_file *, void *))
  1032. {
  1033. struct aa_loaddata *data = __aa_get_loaddata(inode->i_private);
  1034. int error;
  1035. if (!data)
  1036. /* lost race this ent is being reaped */
  1037. return -ENOENT;
  1038. error = single_open(file, show, data);
  1039. if (error) {
  1040. AA_BUG(file->private_data &&
  1041. ((struct seq_file *)file->private_data)->private);
  1042. aa_put_loaddata(data);
  1043. }
  1044. return error;
  1045. }
  1046. static int seq_rawdata_release(struct inode *inode, struct file *file)
  1047. {
  1048. struct seq_file *seq = (struct seq_file *) file->private_data;
  1049. if (seq)
  1050. aa_put_loaddata(seq->private);
  1051. return single_release(inode, file);
  1052. }
  1053. static int seq_rawdata_abi_show(struct seq_file *seq, void *v)
  1054. {
  1055. struct aa_loaddata *data = seq->private;
  1056. seq_printf(seq, "v%d\n", data->abi);
  1057. return 0;
  1058. }
  1059. static int seq_rawdata_revision_show(struct seq_file *seq, void *v)
  1060. {
  1061. struct aa_loaddata *data = seq->private;
  1062. seq_printf(seq, "%ld\n", data->revision);
  1063. return 0;
  1064. }
  1065. static int seq_rawdata_hash_show(struct seq_file *seq, void *v)
  1066. {
  1067. struct aa_loaddata *data = seq->private;
  1068. unsigned int i, size = aa_hash_size();
  1069. if (data->hash) {
  1070. for (i = 0; i < size; i++)
  1071. seq_printf(seq, "%.2x", data->hash[i]);
  1072. seq_putc(seq, '\n');
  1073. }
  1074. return 0;
  1075. }
  1076. static int seq_rawdata_compressed_size_show(struct seq_file *seq, void *v)
  1077. {
  1078. struct aa_loaddata *data = seq->private;
  1079. seq_printf(seq, "%zu\n", data->compressed_size);
  1080. return 0;
  1081. }
  1082. SEQ_RAWDATA_FOPS(abi);
  1083. SEQ_RAWDATA_FOPS(revision);
  1084. SEQ_RAWDATA_FOPS(hash);
  1085. SEQ_RAWDATA_FOPS(compressed_size);
  1086. static int deflate_decompress(char *src, size_t slen, char *dst, size_t dlen)
  1087. {
  1088. int error;
  1089. struct z_stream_s strm;
  1090. if (aa_g_rawdata_compression_level == 0) {
  1091. if (dlen < slen)
  1092. return -EINVAL;
  1093. memcpy(dst, src, slen);
  1094. return 0;
  1095. }
  1096. memset(&strm, 0, sizeof(strm));
  1097. strm.workspace = kvzalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
  1098. if (!strm.workspace)
  1099. return -ENOMEM;
  1100. strm.next_in = src;
  1101. strm.avail_in = slen;
  1102. error = zlib_inflateInit(&strm);
  1103. if (error != Z_OK) {
  1104. error = -ENOMEM;
  1105. goto fail_inflate_init;
  1106. }
  1107. strm.next_out = dst;
  1108. strm.avail_out = dlen;
  1109. error = zlib_inflate(&strm, Z_FINISH);
  1110. if (error != Z_STREAM_END)
  1111. error = -EINVAL;
  1112. else
  1113. error = 0;
  1114. zlib_inflateEnd(&strm);
  1115. fail_inflate_init:
  1116. kvfree(strm.workspace);
  1117. return error;
  1118. }
  1119. static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
  1120. loff_t *ppos)
  1121. {
  1122. struct rawdata_f_data *private = file->private_data;
  1123. return simple_read_from_buffer(buf, size, ppos,
  1124. RAWDATA_F_DATA_BUF(private),
  1125. private->loaddata->size);
  1126. }
  1127. static int rawdata_release(struct inode *inode, struct file *file)
  1128. {
  1129. rawdata_f_data_free(file->private_data);
  1130. return 0;
  1131. }
  1132. static int rawdata_open(struct inode *inode, struct file *file)
  1133. {
  1134. int error;
  1135. struct aa_loaddata *loaddata;
  1136. struct rawdata_f_data *private;
  1137. if (!policy_view_capable(NULL))
  1138. return -EACCES;
  1139. loaddata = __aa_get_loaddata(inode->i_private);
  1140. if (!loaddata)
  1141. /* lost race: this entry is being reaped */
  1142. return -ENOENT;
  1143. private = rawdata_f_data_alloc(loaddata->size);
  1144. if (IS_ERR(private)) {
  1145. error = PTR_ERR(private);
  1146. goto fail_private_alloc;
  1147. }
  1148. private->loaddata = loaddata;
  1149. error = deflate_decompress(loaddata->data, loaddata->compressed_size,
  1150. RAWDATA_F_DATA_BUF(private),
  1151. loaddata->size);
  1152. if (error)
  1153. goto fail_decompress;
  1154. file->private_data = private;
  1155. return 0;
  1156. fail_decompress:
  1157. rawdata_f_data_free(private);
  1158. return error;
  1159. fail_private_alloc:
  1160. aa_put_loaddata(loaddata);
  1161. return error;
  1162. }
  1163. static const struct file_operations rawdata_fops = {
  1164. .open = rawdata_open,
  1165. .read = rawdata_read,
  1166. .llseek = generic_file_llseek,
  1167. .release = rawdata_release,
  1168. };
  1169. static void remove_rawdata_dents(struct aa_loaddata *rawdata)
  1170. {
  1171. int i;
  1172. for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
  1173. if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
  1174. /* no refcounts on i_private */
  1175. aafs_remove(rawdata->dents[i]);
  1176. rawdata->dents[i] = NULL;
  1177. }
  1178. }
  1179. }
  1180. void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata)
  1181. {
  1182. AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock));
  1183. if (rawdata->ns) {
  1184. remove_rawdata_dents(rawdata);
  1185. list_del_init(&rawdata->list);
  1186. aa_put_ns(rawdata->ns);
  1187. rawdata->ns = NULL;
  1188. }
  1189. }
  1190. int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
  1191. {
  1192. struct dentry *dent, *dir;
  1193. AA_BUG(!ns);
  1194. AA_BUG(!rawdata);
  1195. AA_BUG(!mutex_is_locked(&ns->lock));
  1196. AA_BUG(!ns_subdata_dir(ns));
  1197. /*
  1198. * just use ns revision dir was originally created at. This is
  1199. * under ns->lock and if load is successful revision will be
  1200. * bumped and is guaranteed to be unique
  1201. */
  1202. rawdata->name = kasprintf(GFP_KERNEL, "%ld", ns->revision);
  1203. if (!rawdata->name)
  1204. return -ENOMEM;
  1205. dir = aafs_create_dir(rawdata->name, ns_subdata_dir(ns));
  1206. if (IS_ERR(dir))
  1207. /* ->name freed when rawdata freed */
  1208. return PTR_ERR(dir);
  1209. rawdata->dents[AAFS_LOADDATA_DIR] = dir;
  1210. dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
  1211. &seq_rawdata_abi_fops);
  1212. if (IS_ERR(dent))
  1213. goto fail;
  1214. rawdata->dents[AAFS_LOADDATA_ABI] = dent;
  1215. dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
  1216. &seq_rawdata_revision_fops);
  1217. if (IS_ERR(dent))
  1218. goto fail;
  1219. rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
  1220. if (aa_g_hash_policy) {
  1221. dent = aafs_create_file("sha1", S_IFREG | 0444, dir,
  1222. rawdata, &seq_rawdata_hash_fops);
  1223. if (IS_ERR(dent))
  1224. goto fail;
  1225. rawdata->dents[AAFS_LOADDATA_HASH] = dent;
  1226. }
  1227. dent = aafs_create_file("compressed_size", S_IFREG | 0444, dir,
  1228. rawdata,
  1229. &seq_rawdata_compressed_size_fops);
  1230. if (IS_ERR(dent))
  1231. goto fail;
  1232. rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
  1233. dent = aafs_create_file("raw_data", S_IFREG | 0444,
  1234. dir, rawdata, &rawdata_fops);
  1235. if (IS_ERR(dent))
  1236. goto fail;
  1237. rawdata->dents[AAFS_LOADDATA_DATA] = dent;
  1238. d_inode(dent)->i_size = rawdata->size;
  1239. rawdata->ns = aa_get_ns(ns);
  1240. list_add(&rawdata->list, &ns->rawdata_list);
  1241. /* no refcount on inode rawdata */
  1242. return 0;
  1243. fail:
  1244. remove_rawdata_dents(rawdata);
  1245. return PTR_ERR(dent);
  1246. }
  1247. /** fns to setup dynamic per profile/namespace files **/
  1248. /**
  1249. *
  1250. * Requires: @profile->ns->lock held
  1251. */
  1252. void __aafs_profile_rmdir(struct aa_profile *profile)
  1253. {
  1254. struct aa_profile *child;
  1255. int i;
  1256. if (!profile)
  1257. return;
  1258. list_for_each_entry(child, &profile->base.profiles, base.list)
  1259. __aafs_profile_rmdir(child);
  1260. for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
  1261. struct aa_proxy *proxy;
  1262. if (!profile->dents[i])
  1263. continue;
  1264. proxy = d_inode(profile->dents[i])->i_private;
  1265. aafs_remove(profile->dents[i]);
  1266. aa_put_proxy(proxy);
  1267. profile->dents[i] = NULL;
  1268. }
  1269. }
  1270. /**
  1271. *
  1272. * Requires: @old->ns->lock held
  1273. */
  1274. void __aafs_profile_migrate_dents(struct aa_profile *old,
  1275. struct aa_profile *new)
  1276. {
  1277. int i;
  1278. AA_BUG(!old);
  1279. AA_BUG(!new);
  1280. AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
  1281. for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
  1282. new->dents[i] = old->dents[i];
  1283. if (new->dents[i])
  1284. new->dents[i]->d_inode->i_mtime = current_time(new->dents[i]->d_inode);
  1285. old->dents[i] = NULL;
  1286. }
  1287. }
  1288. static struct dentry *create_profile_file(struct dentry *dir, const char *name,
  1289. struct aa_profile *profile,
  1290. const struct file_operations *fops)
  1291. {
  1292. struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy);
  1293. struct dentry *dent;
  1294. dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops);
  1295. if (IS_ERR(dent))
  1296. aa_put_proxy(proxy);
  1297. return dent;
  1298. }
  1299. static int profile_depth(struct aa_profile *profile)
  1300. {
  1301. int depth = 0;
  1302. rcu_read_lock();
  1303. for (depth = 0; profile; profile = rcu_access_pointer(profile->parent))
  1304. depth++;
  1305. rcu_read_unlock();
  1306. return depth;
  1307. }
  1308. static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
  1309. {
  1310. char *buffer, *s;
  1311. int error;
  1312. int size = depth * 6 + strlen(dirname) + strlen(fname) + 11;
  1313. s = buffer = kmalloc(size, GFP_KERNEL);
  1314. if (!buffer)
  1315. return ERR_PTR(-ENOMEM);
  1316. for (; depth > 0; depth--) {
  1317. strcpy(s, "../../");
  1318. s += 6;
  1319. size -= 6;
  1320. }
  1321. error = snprintf(s, size, "raw_data/%s/%s", dirname, fname);
  1322. if (error >= size || error < 0) {
  1323. kfree(buffer);
  1324. return ERR_PTR(-ENAMETOOLONG);
  1325. }
  1326. return buffer;
  1327. }
  1328. static void rawdata_link_cb(void *arg)
  1329. {
  1330. kfree(arg);
  1331. }
  1332. static const char *rawdata_get_link_base(struct dentry *dentry,
  1333. struct inode *inode,
  1334. struct delayed_call *done,
  1335. const char *name)
  1336. {
  1337. struct aa_proxy *proxy = inode->i_private;
  1338. struct aa_label *label;
  1339. struct aa_profile *profile;
  1340. char *target;
  1341. int depth;
  1342. if (!dentry)
  1343. return ERR_PTR(-ECHILD);
  1344. label = aa_get_label_rcu(&proxy->label);
  1345. profile = labels_profile(label);
  1346. depth = profile_depth(profile);
  1347. target = gen_symlink_name(depth, profile->rawdata->name, name);
  1348. aa_put_label(label);
  1349. if (IS_ERR(target))
  1350. return target;
  1351. set_delayed_call(done, rawdata_link_cb, target);
  1352. return target;
  1353. }
  1354. static const char *rawdata_get_link_sha1(struct dentry *dentry,
  1355. struct inode *inode,
  1356. struct delayed_call *done)
  1357. {
  1358. return rawdata_get_link_base(dentry, inode, done, "sha1");
  1359. }
  1360. static const char *rawdata_get_link_abi(struct dentry *dentry,
  1361. struct inode *inode,
  1362. struct delayed_call *done)
  1363. {
  1364. return rawdata_get_link_base(dentry, inode, done, "abi");
  1365. }
  1366. static const char *rawdata_get_link_data(struct dentry *dentry,
  1367. struct inode *inode,
  1368. struct delayed_call *done)
  1369. {
  1370. return rawdata_get_link_base(dentry, inode, done, "raw_data");
  1371. }
  1372. static const struct inode_operations rawdata_link_sha1_iops = {
  1373. .get_link = rawdata_get_link_sha1,
  1374. };
  1375. static const struct inode_operations rawdata_link_abi_iops = {
  1376. .get_link = rawdata_get_link_abi,
  1377. };
  1378. static const struct inode_operations rawdata_link_data_iops = {
  1379. .get_link = rawdata_get_link_data,
  1380. };
  1381. /*
  1382. * Requires: @profile->ns->lock held
  1383. */
  1384. int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
  1385. {
  1386. struct aa_profile *child;
  1387. struct dentry *dent = NULL, *dir;
  1388. int error;
  1389. AA_BUG(!profile);
  1390. AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
  1391. if (!parent) {
  1392. struct aa_profile *p;
  1393. p = aa_deref_parent(profile);
  1394. dent = prof_dir(p);
  1395. /* adding to parent that previously didn't have children */
  1396. dent = aafs_create_dir("profiles", dent);
  1397. if (IS_ERR(dent))
  1398. goto fail;
  1399. prof_child_dir(p) = parent = dent;
  1400. }
  1401. if (!profile->dirname) {
  1402. int len, id_len;
  1403. len = mangle_name(profile->base.name, NULL);
  1404. id_len = snprintf(NULL, 0, ".%ld", profile->ns->uniq_id);
  1405. profile->dirname = kmalloc(len + id_len + 1, GFP_KERNEL);
  1406. if (!profile->dirname) {
  1407. error = -ENOMEM;
  1408. goto fail2;
  1409. }
  1410. mangle_name(profile->base.name, profile->dirname);
  1411. sprintf(profile->dirname + len, ".%ld", profile->ns->uniq_id++);
  1412. }
  1413. dent = aafs_create_dir(profile->dirname, parent);
  1414. if (IS_ERR(dent))
  1415. goto fail;
  1416. prof_dir(profile) = dir = dent;
  1417. dent = create_profile_file(dir, "name", profile,
  1418. &seq_profile_name_fops);
  1419. if (IS_ERR(dent))
  1420. goto fail;
  1421. profile->dents[AAFS_PROF_NAME] = dent;
  1422. dent = create_profile_file(dir, "mode", profile,
  1423. &seq_profile_mode_fops);
  1424. if (IS_ERR(dent))
  1425. goto fail;
  1426. profile->dents[AAFS_PROF_MODE] = dent;
  1427. dent = create_profile_file(dir, "attach", profile,
  1428. &seq_profile_attach_fops);
  1429. if (IS_ERR(dent))
  1430. goto fail;
  1431. profile->dents[AAFS_PROF_ATTACH] = dent;
  1432. if (profile->hash) {
  1433. dent = create_profile_file(dir, "sha1", profile,
  1434. &seq_profile_hash_fops);
  1435. if (IS_ERR(dent))
  1436. goto fail;
  1437. profile->dents[AAFS_PROF_HASH] = dent;
  1438. }
  1439. if (profile->rawdata) {
  1440. dent = aafs_create("raw_sha1", S_IFLNK | 0444, dir,
  1441. profile->label.proxy, NULL, NULL,
  1442. &rawdata_link_sha1_iops);
  1443. if (IS_ERR(dent))
  1444. goto fail;
  1445. aa_get_proxy(profile->label.proxy);
  1446. profile->dents[AAFS_PROF_RAW_HASH] = dent;
  1447. dent = aafs_create("raw_abi", S_IFLNK | 0444, dir,
  1448. profile->label.proxy, NULL, NULL,
  1449. &rawdata_link_abi_iops);
  1450. if (IS_ERR(dent))
  1451. goto fail;
  1452. aa_get_proxy(profile->label.proxy);
  1453. profile->dents[AAFS_PROF_RAW_ABI] = dent;
  1454. dent = aafs_create("raw_data", S_IFLNK | 0444, dir,
  1455. profile->label.proxy, NULL, NULL,
  1456. &rawdata_link_data_iops);
  1457. if (IS_ERR(dent))
  1458. goto fail;
  1459. aa_get_proxy(profile->label.proxy);
  1460. profile->dents[AAFS_PROF_RAW_DATA] = dent;
  1461. }
  1462. list_for_each_entry(child, &profile->base.profiles, base.list) {
  1463. error = __aafs_profile_mkdir(child, prof_child_dir(profile));
  1464. if (error)
  1465. goto fail2;
  1466. }
  1467. return 0;
  1468. fail:
  1469. error = PTR_ERR(dent);
  1470. fail2:
  1471. __aafs_profile_rmdir(profile);
  1472. return error;
  1473. }
  1474. static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
  1475. {
  1476. struct aa_ns *ns, *parent;
  1477. /* TODO: improve permission check */
  1478. struct aa_label *label;
  1479. int error;
  1480. label = begin_current_label_crit_section();
  1481. error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
  1482. end_current_label_crit_section(label);
  1483. if (error)
  1484. return error;
  1485. parent = aa_get_ns(dir->i_private);
  1486. AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
  1487. /* we have to unlock and then relock to get locking order right
  1488. * for pin_fs
  1489. */
  1490. inode_unlock(dir);
  1491. error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
  1492. mutex_lock_nested(&parent->lock, parent->level);
  1493. inode_lock_nested(dir, I_MUTEX_PARENT);
  1494. if (error)
  1495. goto out;
  1496. error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR, NULL,
  1497. NULL, NULL, NULL);
  1498. if (error)
  1499. goto out_pin;
  1500. ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name),
  1501. dentry);
  1502. if (IS_ERR(ns)) {
  1503. error = PTR_ERR(ns);
  1504. ns = NULL;
  1505. }
  1506. aa_put_ns(ns); /* list ref remains */
  1507. out_pin:
  1508. if (error)
  1509. simple_release_fs(&aafs_mnt, &aafs_count);
  1510. out:
  1511. mutex_unlock(&parent->lock);
  1512. aa_put_ns(parent);
  1513. return error;
  1514. }
  1515. static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
  1516. {
  1517. struct aa_ns *ns, *parent;
  1518. /* TODO: improve permission check */
  1519. struct aa_label *label;
  1520. int error;
  1521. label = begin_current_label_crit_section();
  1522. error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
  1523. end_current_label_crit_section(label);
  1524. if (error)
  1525. return error;
  1526. parent = aa_get_ns(dir->i_private);
  1527. /* rmdir calls the generic securityfs functions to remove files
  1528. * from the apparmor dir. It is up to the apparmor ns locking
  1529. * to avoid races.
  1530. */
  1531. inode_unlock(dir);
  1532. inode_unlock(dentry->d_inode);
  1533. mutex_lock_nested(&parent->lock, parent->level);
  1534. ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name,
  1535. dentry->d_name.len));
  1536. if (!ns) {
  1537. error = -ENOENT;
  1538. goto out;
  1539. }
  1540. AA_BUG(ns_dir(ns) != dentry);
  1541. __aa_remove_ns(ns);
  1542. aa_put_ns(ns);
  1543. out:
  1544. mutex_unlock(&parent->lock);
  1545. inode_lock_nested(dir, I_MUTEX_PARENT);
  1546. inode_lock(dentry->d_inode);
  1547. aa_put_ns(parent);
  1548. return error;
  1549. }
  1550. static const struct inode_operations ns_dir_inode_operations = {
  1551. .lookup = simple_lookup,
  1552. .mkdir = ns_mkdir_op,
  1553. .rmdir = ns_rmdir_op,
  1554. };
  1555. static void __aa_fs_list_remove_rawdata(struct aa_ns *ns)
  1556. {
  1557. struct aa_loaddata *ent, *tmp;
  1558. AA_BUG(!mutex_is_locked(&ns->lock));
  1559. list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list)
  1560. __aa_fs_remove_rawdata(ent);
  1561. }
  1562. /**
  1563. *
  1564. * Requires: @ns->lock held
  1565. */
  1566. void __aafs_ns_rmdir(struct aa_ns *ns)
  1567. {
  1568. struct aa_ns *sub;
  1569. struct aa_profile *child;
  1570. int i;
  1571. if (!ns)
  1572. return;
  1573. AA_BUG(!mutex_is_locked(&ns->lock));
  1574. list_for_each_entry(child, &ns->base.profiles, base.list)
  1575. __aafs_profile_rmdir(child);
  1576. list_for_each_entry(sub, &ns->sub_ns, base.list) {
  1577. mutex_lock_nested(&sub->lock, sub->level);
  1578. __aafs_ns_rmdir(sub);
  1579. mutex_unlock(&sub->lock);
  1580. }
  1581. __aa_fs_list_remove_rawdata(ns);
  1582. if (ns_subns_dir(ns)) {
  1583. sub = d_inode(ns_subns_dir(ns))->i_private;
  1584. aa_put_ns(sub);
  1585. }
  1586. if (ns_subload(ns)) {
  1587. sub = d_inode(ns_subload(ns))->i_private;
  1588. aa_put_ns(sub);
  1589. }
  1590. if (ns_subreplace(ns)) {
  1591. sub = d_inode(ns_subreplace(ns))->i_private;
  1592. aa_put_ns(sub);
  1593. }
  1594. if (ns_subremove(ns)) {
  1595. sub = d_inode(ns_subremove(ns))->i_private;
  1596. aa_put_ns(sub);
  1597. }
  1598. if (ns_subrevision(ns)) {
  1599. sub = d_inode(ns_subrevision(ns))->i_private;
  1600. aa_put_ns(sub);
  1601. }
  1602. for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
  1603. aafs_remove(ns->dents[i]);
  1604. ns->dents[i] = NULL;
  1605. }
  1606. }
  1607. /* assumes cleanup in caller */
  1608. static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
  1609. {
  1610. struct dentry *dent;
  1611. AA_BUG(!ns);
  1612. AA_BUG(!dir);
  1613. dent = aafs_create_dir("profiles", dir);
  1614. if (IS_ERR(dent))
  1615. return PTR_ERR(dent);
  1616. ns_subprofs_dir(ns) = dent;
  1617. dent = aafs_create_dir("raw_data", dir);
  1618. if (IS_ERR(dent))
  1619. return PTR_ERR(dent);
  1620. ns_subdata_dir(ns) = dent;
  1621. dent = aafs_create_file("revision", 0444, dir, ns,
  1622. &aa_fs_ns_revision_fops);
  1623. if (IS_ERR(dent))
  1624. return PTR_ERR(dent);
  1625. aa_get_ns(ns);
  1626. ns_subrevision(ns) = dent;
  1627. dent = aafs_create_file(".load", 0640, dir, ns,
  1628. &aa_fs_profile_load);
  1629. if (IS_ERR(dent))
  1630. return PTR_ERR(dent);
  1631. aa_get_ns(ns);
  1632. ns_subload(ns) = dent;
  1633. dent = aafs_create_file(".replace", 0640, dir, ns,
  1634. &aa_fs_profile_replace);
  1635. if (IS_ERR(dent))
  1636. return PTR_ERR(dent);
  1637. aa_get_ns(ns);
  1638. ns_subreplace(ns) = dent;
  1639. dent = aafs_create_file(".remove", 0640, dir, ns,
  1640. &aa_fs_profile_remove);
  1641. if (IS_ERR(dent))
  1642. return PTR_ERR(dent);
  1643. aa_get_ns(ns);
  1644. ns_subremove(ns) = dent;
  1645. /* use create_dentry so we can supply private data */
  1646. dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL,
  1647. &ns_dir_inode_operations);
  1648. if (IS_ERR(dent))
  1649. return PTR_ERR(dent);
  1650. aa_get_ns(ns);
  1651. ns_subns_dir(ns) = dent;
  1652. return 0;
  1653. }
  1654. /*
  1655. * Requires: @ns->lock held
  1656. */
  1657. int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
  1658. struct dentry *dent)
  1659. {
  1660. struct aa_ns *sub;
  1661. struct aa_profile *child;
  1662. struct dentry *dir;
  1663. int error;
  1664. AA_BUG(!ns);
  1665. AA_BUG(!parent);
  1666. AA_BUG(!mutex_is_locked(&ns->lock));
  1667. if (!name)
  1668. name = ns->base.name;
  1669. if (!dent) {
  1670. /* create ns dir if it doesn't already exist */
  1671. dent = aafs_create_dir(name, parent);
  1672. if (IS_ERR(dent))
  1673. goto fail;
  1674. } else
  1675. dget(dent);
  1676. ns_dir(ns) = dir = dent;
  1677. error = __aafs_ns_mkdir_entries(ns, dir);
  1678. if (error)
  1679. goto fail2;
  1680. /* profiles */
  1681. list_for_each_entry(child, &ns->base.profiles, base.list) {
  1682. error = __aafs_profile_mkdir(child, ns_subprofs_dir(ns));
  1683. if (error)
  1684. goto fail2;
  1685. }
  1686. /* subnamespaces */
  1687. list_for_each_entry(sub, &ns->sub_ns, base.list) {
  1688. mutex_lock_nested(&sub->lock, sub->level);
  1689. error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL);
  1690. mutex_unlock(&sub->lock);
  1691. if (error)
  1692. goto fail2;
  1693. }
  1694. return 0;
  1695. fail:
  1696. error = PTR_ERR(dent);
  1697. fail2:
  1698. __aafs_ns_rmdir(ns);
  1699. return error;
  1700. }
  1701. #define list_entry_is_head(pos, head, member) (&pos->member == (head))
  1702. /**
  1703. * __next_ns - find the next namespace to list
  1704. * @root: root namespace to stop search at (NOT NULL)
  1705. * @ns: current ns position (NOT NULL)
  1706. *
  1707. * Find the next namespace from @ns under @root and handle all locking needed
  1708. * while switching current namespace.
  1709. *
  1710. * Returns: next namespace or NULL if at last namespace under @root
  1711. * Requires: ns->parent->lock to be held
  1712. * NOTE: will not unlock root->lock
  1713. */
  1714. static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
  1715. {
  1716. struct aa_ns *parent, *next;
  1717. AA_BUG(!root);
  1718. AA_BUG(!ns);
  1719. AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
  1720. /* is next namespace a child */
  1721. if (!list_empty(&ns->sub_ns)) {
  1722. next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
  1723. mutex_lock_nested(&next->lock, next->level);
  1724. return next;
  1725. }
  1726. /* check if the next ns is a sibling, parent, gp, .. */
  1727. parent = ns->parent;
  1728. while (ns != root) {
  1729. mutex_unlock(&ns->lock);
  1730. next = list_next_entry(ns, base.list);
  1731. if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
  1732. mutex_lock_nested(&next->lock, next->level);
  1733. return next;
  1734. }
  1735. ns = parent;
  1736. parent = parent->parent;
  1737. }
  1738. return NULL;
  1739. }
  1740. /**
  1741. * __first_profile - find the first profile in a namespace
  1742. * @root: namespace that is root of profiles being displayed (NOT NULL)
  1743. * @ns: namespace to start in (NOT NULL)
  1744. *
  1745. * Returns: unrefcounted profile or NULL if no profile
  1746. * Requires: profile->ns.lock to be held
  1747. */
  1748. static struct aa_profile *__first_profile(struct aa_ns *root,
  1749. struct aa_ns *ns)
  1750. {
  1751. AA_BUG(!root);
  1752. AA_BUG(ns && !mutex_is_locked(&ns->lock));
  1753. for (; ns; ns = __next_ns(root, ns)) {
  1754. if (!list_empty(&ns->base.profiles))
  1755. return list_first_entry(&ns->base.profiles,
  1756. struct aa_profile, base.list);
  1757. }
  1758. return NULL;
  1759. }
  1760. /**
  1761. * __next_profile - step to the next profile in a profile tree
  1762. * @profile: current profile in tree (NOT NULL)
  1763. *
  1764. * Perform a depth first traversal on the profile tree in a namespace
  1765. *
  1766. * Returns: next profile or NULL if done
  1767. * Requires: profile->ns.lock to be held
  1768. */
  1769. static struct aa_profile *__next_profile(struct aa_profile *p)
  1770. {
  1771. struct aa_profile *parent;
  1772. struct aa_ns *ns = p->ns;
  1773. AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
  1774. /* is next profile a child */
  1775. if (!list_empty(&p->base.profiles))
  1776. return list_first_entry(&p->base.profiles, typeof(*p),
  1777. base.list);
  1778. /* is next profile a sibling, parent sibling, gp, sibling, .. */
  1779. parent = rcu_dereference_protected(p->parent,
  1780. mutex_is_locked(&p->ns->lock));
  1781. while (parent) {
  1782. p = list_next_entry(p, base.list);
  1783. if (!list_entry_is_head(p, &parent->base.profiles, base.list))
  1784. return p;
  1785. p = parent;
  1786. parent = rcu_dereference_protected(parent->parent,
  1787. mutex_is_locked(&parent->ns->lock));
  1788. }
  1789. /* is next another profile in the namespace */
  1790. p = list_next_entry(p, base.list);
  1791. if (!list_entry_is_head(p, &ns->base.profiles, base.list))
  1792. return p;
  1793. return NULL;
  1794. }
  1795. /**
  1796. * next_profile - step to the next profile in where ever it may be
  1797. * @root: root namespace (NOT NULL)
  1798. * @profile: current profile (NOT NULL)
  1799. *
  1800. * Returns: next profile or NULL if there isn't one
  1801. */
  1802. static struct aa_profile *next_profile(struct aa_ns *root,
  1803. struct aa_profile *profile)
  1804. {
  1805. struct aa_profile *next = __next_profile(profile);
  1806. if (next)
  1807. return next;
  1808. /* finished all profiles in namespace move to next namespace */
  1809. return __first_profile(root, __next_ns(root, profile->ns));
  1810. }
  1811. /**
  1812. * p_start - start a depth first traversal of profile tree
  1813. * @f: seq_file to fill
  1814. * @pos: current position
  1815. *
  1816. * Returns: first profile under current namespace or NULL if none found
  1817. *
  1818. * acquires first ns->lock
  1819. */
  1820. static void *p_start(struct seq_file *f, loff_t *pos)
  1821. {
  1822. struct aa_profile *profile = NULL;
  1823. struct aa_ns *root = aa_get_current_ns();
  1824. loff_t l = *pos;
  1825. f->private = root;
  1826. /* find the first profile */
  1827. mutex_lock_nested(&root->lock, root->level);
  1828. profile = __first_profile(root, root);
  1829. /* skip to position */
  1830. for (; profile && l > 0; l--)
  1831. profile = next_profile(root, profile);
  1832. return profile;
  1833. }
  1834. /**
  1835. * p_next - read the next profile entry
  1836. * @f: seq_file to fill
  1837. * @p: profile previously returned
  1838. * @pos: current position
  1839. *
  1840. * Returns: next profile after @p or NULL if none
  1841. *
  1842. * may acquire/release locks in namespace tree as necessary
  1843. */
  1844. static void *p_next(struct seq_file *f, void *p, loff_t *pos)
  1845. {
  1846. struct aa_profile *profile = p;
  1847. struct aa_ns *ns = f->private;
  1848. (*pos)++;
  1849. return next_profile(ns, profile);
  1850. }
  1851. /**
  1852. * p_stop - stop depth first traversal
  1853. * @f: seq_file we are filling
  1854. * @p: the last profile writen
  1855. *
  1856. * Release all locking done by p_start/p_next on namespace tree
  1857. */
  1858. static void p_stop(struct seq_file *f, void *p)
  1859. {
  1860. struct aa_profile *profile = p;
  1861. struct aa_ns *root = f->private, *ns;
  1862. if (profile) {
  1863. for (ns = profile->ns; ns && ns != root; ns = ns->parent)
  1864. mutex_unlock(&ns->lock);
  1865. }
  1866. mutex_unlock(&root->lock);
  1867. aa_put_ns(root);
  1868. }
  1869. /**
  1870. * seq_show_profile - show a profile entry
  1871. * @f: seq_file to file
  1872. * @p: current position (profile) (NOT NULL)
  1873. *
  1874. * Returns: error on failure
  1875. */
  1876. static int seq_show_profile(struct seq_file *f, void *p)
  1877. {
  1878. struct aa_profile *profile = (struct aa_profile *)p;
  1879. struct aa_ns *root = f->private;
  1880. aa_label_seq_xprint(f, root, &profile->label,
  1881. FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL);
  1882. seq_putc(f, '\n');
  1883. return 0;
  1884. }
  1885. static const struct seq_operations aa_sfs_profiles_op = {
  1886. .start = p_start,
  1887. .next = p_next,
  1888. .stop = p_stop,
  1889. .show = seq_show_profile,
  1890. };
  1891. static int profiles_open(struct inode *inode, struct file *file)
  1892. {
  1893. if (!policy_view_capable(NULL))
  1894. return -EACCES;
  1895. return seq_open(file, &aa_sfs_profiles_op);
  1896. }
  1897. static int profiles_release(struct inode *inode, struct file *file)
  1898. {
  1899. return seq_release(inode, file);
  1900. }
  1901. static const struct file_operations aa_sfs_profiles_fops = {
  1902. .open = profiles_open,
  1903. .read = seq_read,
  1904. .llseek = seq_lseek,
  1905. .release = profiles_release,
  1906. };
  1907. /** Base file system setup **/
  1908. static struct aa_sfs_entry aa_sfs_entry_file[] = {
  1909. AA_SFS_FILE_STRING("mask",
  1910. "create read write exec append mmap_exec link lock"),
  1911. { }
  1912. };
  1913. static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
  1914. AA_SFS_FILE_STRING("mask", "read trace"),
  1915. { }
  1916. };
  1917. static struct aa_sfs_entry aa_sfs_entry_signal[] = {
  1918. AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
  1919. { }
  1920. };
  1921. static struct aa_sfs_entry aa_sfs_entry_attach[] = {
  1922. AA_SFS_FILE_BOOLEAN("xattr", 1),
  1923. { }
  1924. };
  1925. static struct aa_sfs_entry aa_sfs_entry_domain[] = {
  1926. AA_SFS_FILE_BOOLEAN("change_hat", 1),
  1927. AA_SFS_FILE_BOOLEAN("change_hatv", 1),
  1928. AA_SFS_FILE_BOOLEAN("change_onexec", 1),
  1929. AA_SFS_FILE_BOOLEAN("change_profile", 1),
  1930. AA_SFS_FILE_BOOLEAN("stack", 1),
  1931. AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap", 1),
  1932. AA_SFS_FILE_BOOLEAN("post_nnp_subset", 1),
  1933. AA_SFS_FILE_BOOLEAN("computed_longest_left", 1),
  1934. AA_SFS_DIR("attach_conditions", aa_sfs_entry_attach),
  1935. AA_SFS_FILE_STRING("version", "1.2"),
  1936. { }
  1937. };
  1938. static struct aa_sfs_entry aa_sfs_entry_versions[] = {
  1939. AA_SFS_FILE_BOOLEAN("v5", 1),
  1940. AA_SFS_FILE_BOOLEAN("v6", 1),
  1941. AA_SFS_FILE_BOOLEAN("v7", 1),
  1942. AA_SFS_FILE_BOOLEAN("v8", 1),
  1943. { }
  1944. };
  1945. static struct aa_sfs_entry aa_sfs_entry_policy[] = {
  1946. AA_SFS_DIR("versions", aa_sfs_entry_versions),
  1947. AA_SFS_FILE_BOOLEAN("set_load", 1),
  1948. /* number of out of band transitions supported */
  1949. AA_SFS_FILE_U64("outofband", MAX_OOB_SUPPORTED),
  1950. { }
  1951. };
  1952. static struct aa_sfs_entry aa_sfs_entry_mount[] = {
  1953. AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
  1954. { }
  1955. };
  1956. static struct aa_sfs_entry aa_sfs_entry_ns[] = {
  1957. AA_SFS_FILE_BOOLEAN("profile", 1),
  1958. AA_SFS_FILE_BOOLEAN("pivot_root", 0),
  1959. { }
  1960. };
  1961. static struct aa_sfs_entry aa_sfs_entry_query_label[] = {
  1962. AA_SFS_FILE_STRING("perms", "allow deny audit quiet"),
  1963. AA_SFS_FILE_BOOLEAN("data", 1),
  1964. AA_SFS_FILE_BOOLEAN("multi_transaction", 1),
  1965. { }
  1966. };
  1967. static struct aa_sfs_entry aa_sfs_entry_query[] = {
  1968. AA_SFS_DIR("label", aa_sfs_entry_query_label),
  1969. { }
  1970. };
  1971. static struct aa_sfs_entry aa_sfs_entry_features[] = {
  1972. AA_SFS_DIR("policy", aa_sfs_entry_policy),
  1973. AA_SFS_DIR("domain", aa_sfs_entry_domain),
  1974. AA_SFS_DIR("file", aa_sfs_entry_file),
  1975. AA_SFS_DIR("network_v8", aa_sfs_entry_network),
  1976. AA_SFS_DIR("mount", aa_sfs_entry_mount),
  1977. AA_SFS_DIR("namespaces", aa_sfs_entry_ns),
  1978. AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
  1979. AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit),
  1980. AA_SFS_DIR("caps", aa_sfs_entry_caps),
  1981. AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace),
  1982. AA_SFS_DIR("signal", aa_sfs_entry_signal),
  1983. AA_SFS_DIR("query", aa_sfs_entry_query),
  1984. { }
  1985. };
  1986. static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
  1987. AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
  1988. AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
  1989. AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
  1990. AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
  1991. AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
  1992. AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
  1993. AA_SFS_DIR("features", aa_sfs_entry_features),
  1994. { }
  1995. };
  1996. static struct aa_sfs_entry aa_sfs_entry =
  1997. AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor);
  1998. /**
  1999. * entry_create_file - create a file entry in the apparmor securityfs
  2000. * @fs_file: aa_sfs_entry to build an entry for (NOT NULL)
  2001. * @parent: the parent dentry in the securityfs
  2002. *
  2003. * Use entry_remove_file to remove entries created with this fn.
  2004. */
  2005. static int __init entry_create_file(struct aa_sfs_entry *fs_file,
  2006. struct dentry *parent)
  2007. {
  2008. int error = 0;
  2009. fs_file->dentry = securityfs_create_file(fs_file->name,
  2010. S_IFREG | fs_file->mode,
  2011. parent, fs_file,
  2012. fs_file->file_ops);
  2013. if (IS_ERR(fs_file->dentry)) {
  2014. error = PTR_ERR(fs_file->dentry);
  2015. fs_file->dentry = NULL;
  2016. }
  2017. return error;
  2018. }
  2019. static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir);
  2020. /**
  2021. * entry_create_dir - recursively create a directory entry in the securityfs
  2022. * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL)
  2023. * @parent: the parent dentry in the securityfs
  2024. *
  2025. * Use entry_remove_dir to remove entries created with this fn.
  2026. */
  2027. static int __init entry_create_dir(struct aa_sfs_entry *fs_dir,
  2028. struct dentry *parent)
  2029. {
  2030. struct aa_sfs_entry *fs_file;
  2031. struct dentry *dir;
  2032. int error;
  2033. dir = securityfs_create_dir(fs_dir->name, parent);
  2034. if (IS_ERR(dir))
  2035. return PTR_ERR(dir);
  2036. fs_dir->dentry = dir;
  2037. for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
  2038. if (fs_file->v_type == AA_SFS_TYPE_DIR)
  2039. error = entry_create_dir(fs_file, fs_dir->dentry);
  2040. else
  2041. error = entry_create_file(fs_file, fs_dir->dentry);
  2042. if (error)
  2043. goto failed;
  2044. }
  2045. return 0;
  2046. failed:
  2047. entry_remove_dir(fs_dir);
  2048. return error;
  2049. }
  2050. /**
  2051. * entry_remove_file - drop a single file entry in the apparmor securityfs
  2052. * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL)
  2053. */
  2054. static void __init entry_remove_file(struct aa_sfs_entry *fs_file)
  2055. {
  2056. if (!fs_file->dentry)
  2057. return;
  2058. securityfs_remove(fs_file->dentry);
  2059. fs_file->dentry = NULL;
  2060. }
  2061. /**
  2062. * entry_remove_dir - recursively drop a directory entry from the securityfs
  2063. * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL)
  2064. */
  2065. static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir)
  2066. {
  2067. struct aa_sfs_entry *fs_file;
  2068. for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
  2069. if (fs_file->v_type == AA_SFS_TYPE_DIR)
  2070. entry_remove_dir(fs_file);
  2071. else
  2072. entry_remove_file(fs_file);
  2073. }
  2074. entry_remove_file(fs_dir);
  2075. }
  2076. /**
  2077. * aa_destroy_aafs - cleanup and free aafs
  2078. *
  2079. * releases dentries allocated by aa_create_aafs
  2080. */
  2081. void __init aa_destroy_aafs(void)
  2082. {
  2083. entry_remove_dir(&aa_sfs_entry);
  2084. }
  2085. #define NULL_FILE_NAME ".null"
  2086. struct path aa_null;
  2087. static int aa_mk_null_file(struct dentry *parent)
  2088. {
  2089. struct vfsmount *mount = NULL;
  2090. struct dentry *dentry;
  2091. struct inode *inode;
  2092. int count = 0;
  2093. int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count);
  2094. if (error)
  2095. return error;
  2096. inode_lock(d_inode(parent));
  2097. dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME));
  2098. if (IS_ERR(dentry)) {
  2099. error = PTR_ERR(dentry);
  2100. goto out;
  2101. }
  2102. inode = new_inode(parent->d_inode->i_sb);
  2103. if (!inode) {
  2104. error = -ENOMEM;
  2105. goto out1;
  2106. }
  2107. inode->i_ino = get_next_ino();
  2108. inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO;
  2109. inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
  2110. init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO,
  2111. MKDEV(MEM_MAJOR, 3));
  2112. d_instantiate(dentry, inode);
  2113. aa_null.dentry = dget(dentry);
  2114. aa_null.mnt = mntget(mount);
  2115. error = 0;
  2116. out1:
  2117. dput(dentry);
  2118. out:
  2119. inode_unlock(d_inode(parent));
  2120. simple_release_fs(&mount, &count);
  2121. return error;
  2122. }
  2123. static const char *policy_get_link(struct dentry *dentry,
  2124. struct inode *inode,
  2125. struct delayed_call *done)
  2126. {
  2127. struct aa_ns *ns;
  2128. struct path path;
  2129. int error;
  2130. if (!dentry)
  2131. return ERR_PTR(-ECHILD);
  2132. ns = aa_get_current_ns();
  2133. path.mnt = mntget(aafs_mnt);
  2134. path.dentry = dget(ns_dir(ns));
  2135. error = nd_jump_link(&path);
  2136. aa_put_ns(ns);
  2137. return ERR_PTR(error);
  2138. }
  2139. static int policy_readlink(struct dentry *dentry, char __user *buffer,
  2140. int buflen)
  2141. {
  2142. char name[32];
  2143. int res;
  2144. res = snprintf(name, sizeof(name), "%s:[%lu]", AAFS_NAME,
  2145. d_inode(dentry)->i_ino);
  2146. if (res > 0 && res < sizeof(name))
  2147. res = readlink_copy(buffer, buflen, name);
  2148. else
  2149. res = -ENOENT;
  2150. return res;
  2151. }
  2152. static const struct inode_operations policy_link_iops = {
  2153. .readlink = policy_readlink,
  2154. .get_link = policy_get_link,
  2155. };
  2156. /**
  2157. * aa_create_aafs - create the apparmor security filesystem
  2158. *
  2159. * dentries created here are released by aa_destroy_aafs
  2160. *
  2161. * Returns: error on failure
  2162. */
  2163. static int __init aa_create_aafs(void)
  2164. {
  2165. struct dentry *dent;
  2166. int error;
  2167. if (!apparmor_initialized)
  2168. return 0;
  2169. if (aa_sfs_entry.dentry) {
  2170. AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
  2171. return -EEXIST;
  2172. }
  2173. /* setup apparmorfs used to virtualize policy/ */
  2174. aafs_mnt = kern_mount(&aafs_ops);
  2175. if (IS_ERR(aafs_mnt))
  2176. panic("can't set apparmorfs up\n");
  2177. aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
  2178. /* Populate fs tree. */
  2179. error = entry_create_dir(&aa_sfs_entry, NULL);
  2180. if (error)
  2181. goto error;
  2182. dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry,
  2183. NULL, &aa_fs_profile_load);
  2184. if (IS_ERR(dent))
  2185. goto dent_error;
  2186. ns_subload(root_ns) = dent;
  2187. dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry,
  2188. NULL, &aa_fs_profile_replace);
  2189. if (IS_ERR(dent))
  2190. goto dent_error;
  2191. ns_subreplace(root_ns) = dent;
  2192. dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry,
  2193. NULL, &aa_fs_profile_remove);
  2194. if (IS_ERR(dent))
  2195. goto dent_error;
  2196. ns_subremove(root_ns) = dent;
  2197. dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry,
  2198. NULL, &aa_fs_ns_revision_fops);
  2199. if (IS_ERR(dent))
  2200. goto dent_error;
  2201. ns_subrevision(root_ns) = dent;
  2202. /* policy tree referenced by magic policy symlink */
  2203. mutex_lock_nested(&root_ns->lock, root_ns->level);
  2204. error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy",
  2205. aafs_mnt->mnt_root);
  2206. mutex_unlock(&root_ns->lock);
  2207. if (error)
  2208. goto error;
  2209. /* magic symlink similar to nsfs redirects based on task policy */
  2210. dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry,
  2211. NULL, &policy_link_iops);
  2212. if (IS_ERR(dent))
  2213. goto dent_error;
  2214. error = aa_mk_null_file(aa_sfs_entry.dentry);
  2215. if (error)
  2216. goto error;
  2217. /* TODO: add default profile to apparmorfs */
  2218. /* Report that AppArmor fs is enabled */
  2219. aa_info_message("AppArmor Filesystem Enabled");
  2220. return 0;
  2221. dent_error:
  2222. error = PTR_ERR(dent);
  2223. error:
  2224. aa_destroy_aafs();
  2225. AA_ERROR("Error creating AppArmor securityfs\n");
  2226. return error;
  2227. }
  2228. fs_initcall(aa_create_aafs);