capability.c 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor capability mediation functions
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2010 Canonical Ltd.
  9. */
  10. #include <linux/capability.h>
  11. #include <linux/errno.h>
  12. #include <linux/gfp.h>
  13. #include <linux/security.h>
  14. #include "include/apparmor.h"
  15. #include "include/capability.h"
  16. #include "include/cred.h"
  17. #include "include/policy.h"
  18. #include "include/audit.h"
  19. /*
  20. * Table of capability names: we generate it from capabilities.h.
  21. */
  22. #include "capability_names.h"
  23. struct aa_sfs_entry aa_sfs_entry_caps[] = {
  24. AA_SFS_FILE_STRING("mask", AA_SFS_CAPS_MASK),
  25. { }
  26. };
  27. struct audit_cache {
  28. struct aa_profile *profile;
  29. kernel_cap_t caps;
  30. };
  31. static DEFINE_PER_CPU(struct audit_cache, audit_cache);
  32. /**
  33. * audit_cb - call back for capability components of audit struct
  34. * @ab - audit buffer (NOT NULL)
  35. * @va - audit struct to audit data from (NOT NULL)
  36. */
  37. static void audit_cb(struct audit_buffer *ab, void *va)
  38. {
  39. struct common_audit_data *sa = va;
  40. audit_log_format(ab, " capname=");
  41. audit_log_untrustedstring(ab, capability_names[sa->u.cap]);
  42. }
  43. /**
  44. * audit_caps - audit a capability
  45. * @sa: audit data
  46. * @profile: profile being tested for confinement (NOT NULL)
  47. * @cap: capability tested
  48. * @error: error code returned by test
  49. *
  50. * Do auditing of capability and handle, audit/complain/kill modes switching
  51. * and duplicate message elimination.
  52. *
  53. * Returns: 0 or sa->error on success, error code on failure
  54. */
  55. static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,
  56. int cap, int error)
  57. {
  58. struct audit_cache *ent;
  59. int type = AUDIT_APPARMOR_AUTO;
  60. aad(sa)->error = error;
  61. if (likely(!error)) {
  62. /* test if auditing is being forced */
  63. if (likely((AUDIT_MODE(profile) != AUDIT_ALL) &&
  64. !cap_raised(profile->caps.audit, cap)))
  65. return 0;
  66. type = AUDIT_APPARMOR_AUDIT;
  67. } else if (KILL_MODE(profile) ||
  68. cap_raised(profile->caps.kill, cap)) {
  69. type = AUDIT_APPARMOR_KILL;
  70. } else if (cap_raised(profile->caps.quiet, cap) &&
  71. AUDIT_MODE(profile) != AUDIT_NOQUIET &&
  72. AUDIT_MODE(profile) != AUDIT_ALL) {
  73. /* quiet auditing */
  74. return error;
  75. }
  76. /* Do simple duplicate message elimination */
  77. ent = &get_cpu_var(audit_cache);
  78. if (profile == ent->profile && cap_raised(ent->caps, cap)) {
  79. put_cpu_var(audit_cache);
  80. if (COMPLAIN_MODE(profile))
  81. return complain_error(error);
  82. return error;
  83. } else {
  84. aa_put_profile(ent->profile);
  85. ent->profile = aa_get_profile(profile);
  86. cap_raise(ent->caps, cap);
  87. }
  88. put_cpu_var(audit_cache);
  89. return aa_audit(type, profile, sa, audit_cb);
  90. }
  91. /**
  92. * profile_capable - test if profile allows use of capability @cap
  93. * @profile: profile being enforced (NOT NULL, NOT unconfined)
  94. * @cap: capability to test if allowed
  95. * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
  96. * @sa: audit data (MAY BE NULL indicating no auditing)
  97. *
  98. * Returns: 0 if allowed else -EPERM
  99. */
  100. static int profile_capable(struct aa_profile *profile, int cap,
  101. unsigned int opts, struct common_audit_data *sa)
  102. {
  103. int error;
  104. if (cap_raised(profile->caps.allow, cap) &&
  105. !cap_raised(profile->caps.denied, cap))
  106. error = 0;
  107. else
  108. error = -EPERM;
  109. if (opts & CAP_OPT_NOAUDIT) {
  110. if (!COMPLAIN_MODE(profile))
  111. return error;
  112. /* audit the cap request in complain mode but note that it
  113. * should be optional.
  114. */
  115. aad(sa)->info = "optional: no audit";
  116. }
  117. return audit_caps(sa, profile, cap, error);
  118. }
  119. /**
  120. * aa_capable - test permission to use capability
  121. * @label: label being tested for capability (NOT NULL)
  122. * @cap: capability to be tested
  123. * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
  124. *
  125. * Look up capability in profile capability set.
  126. *
  127. * Returns: 0 on success, or else an error code.
  128. */
  129. int aa_capable(struct aa_label *label, int cap, unsigned int opts)
  130. {
  131. struct aa_profile *profile;
  132. int error = 0;
  133. DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, OP_CAPABLE);
  134. sa.u.cap = cap;
  135. error = fn_for_each_confined(label, profile,
  136. profile_capable(profile, cap, opts, &sa));
  137. return error;
  138. }