perms.h 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156
  1. /* SPDX-License-Identifier: GPL-2.0-only */
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor basic permission sets definitions.
  6. *
  7. * Copyright 2017 Canonical Ltd.
  8. */
  9. #ifndef __AA_PERM_H
  10. #define __AA_PERM_H
  11. #include <linux/fs.h>
  12. #include "label.h"
  13. #define AA_MAY_EXEC MAY_EXEC
  14. #define AA_MAY_WRITE MAY_WRITE
  15. #define AA_MAY_READ MAY_READ
  16. #define AA_MAY_APPEND MAY_APPEND
  17. #define AA_MAY_CREATE 0x0010
  18. #define AA_MAY_DELETE 0x0020
  19. #define AA_MAY_OPEN 0x0040
  20. #define AA_MAY_RENAME 0x0080 /* pair */
  21. #define AA_MAY_SETATTR 0x0100 /* meta write */
  22. #define AA_MAY_GETATTR 0x0200 /* meta read */
  23. #define AA_MAY_SETCRED 0x0400 /* security cred/attr */
  24. #define AA_MAY_GETCRED 0x0800
  25. #define AA_MAY_CHMOD 0x1000 /* pair */
  26. #define AA_MAY_CHOWN 0x2000 /* pair */
  27. #define AA_MAY_CHGRP 0x4000 /* pair */
  28. #define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */
  29. #define AA_EXEC_MMAP 0x00010000
  30. #define AA_MAY_MPROT 0x00020000 /* extend conditions */
  31. #define AA_MAY_LINK 0x00040000 /* pair */
  32. #define AA_MAY_SNAPSHOT 0x00080000 /* pair */
  33. #define AA_MAY_DELEGATE
  34. #define AA_CONT_MATCH 0x08000000
  35. #define AA_MAY_STACK 0x10000000
  36. #define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */
  37. #define AA_MAY_CHANGE_PROFILE 0x40000000
  38. #define AA_MAY_CHANGEHAT 0x80000000
  39. #define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */
  40. #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE | \
  41. AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK | \
  42. AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
  43. #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME | \
  44. AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
  45. AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
  46. AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
  47. AA_MAY_STACK | AA_MAY_ONEXEC | \
  48. AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
  49. extern const char aa_file_perm_chrs[];
  50. extern const char *aa_file_perm_names[];
  51. struct aa_perms {
  52. u32 allow;
  53. u32 audit; /* set only when allow is set */
  54. u32 deny; /* explicit deny, or conflict if allow also set */
  55. u32 quiet; /* set only when ~allow | deny */
  56. u32 kill; /* set only when ~allow | deny */
  57. u32 stop; /* set only when ~allow | deny */
  58. u32 complain; /* accumulates only used when ~allow & ~deny */
  59. u32 cond; /* set only when ~allow and ~deny */
  60. u32 hide; /* set only when ~allow | deny */
  61. u32 prompt; /* accumulates only used when ~allow & ~deny */
  62. /* Reserved:
  63. * u32 subtree; / * set only when allow is set * /
  64. */
  65. u16 xindex;
  66. };
  67. #define ALL_PERMS_MASK 0xffffffff
  68. extern struct aa_perms nullperms;
  69. extern struct aa_perms allperms;
  70. #define xcheck(FN1, FN2) \
  71. ({ \
  72. int e, error = FN1; \
  73. e = FN2; \
  74. if (e) \
  75. error = e; \
  76. error; \
  77. })
  78. /*
  79. * TODO: update for labels pointing to labels instead of profiles
  80. * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
  81. * gah this doesn't allow for label compound check!!!!
  82. */
  83. #define xcheck_ns_profile_profile(P1, P2, FN, args...) \
  84. ({ \
  85. int ____e = 0; \
  86. if (P1->ns == P2->ns) \
  87. ____e = FN((P1), (P2), args); \
  88. (____e); \
  89. })
  90. #define xcheck_ns_profile_label(P, L, FN, args...) \
  91. ({ \
  92. struct aa_profile *__p2; \
  93. fn_for_each((L), __p2, \
  94. xcheck_ns_profile_profile((P), __p2, (FN), args)); \
  95. })
  96. #define xcheck_ns_labels(L1, L2, FN, args...) \
  97. ({ \
  98. struct aa_profile *__p1; \
  99. fn_for_each((L1), __p1, FN(__p1, (L2), args)); \
  100. })
  101. /* Do the cross check but applying FN at the profiles level */
  102. #define xcheck_labels_profiles(L1, L2, FN, args...) \
  103. xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
  104. #define xcheck_labels(L1, L2, P, FN1, FN2) \
  105. xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
  106. void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs,
  107. u32 mask);
  108. void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
  109. u32 mask);
  110. void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
  111. u32 chrsmask, const char * const *names, u32 namesmask);
  112. void aa_apply_modes_to_perms(struct aa_profile *profile,
  113. struct aa_perms *perms);
  114. void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
  115. struct aa_perms *perms);
  116. void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
  117. void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
  118. void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
  119. int type, u32 request, struct aa_perms *perms);
  120. int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
  121. u32 request, int type, u32 *deny,
  122. struct common_audit_data *sa);
  123. int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
  124. u32 request, struct common_audit_data *sa,
  125. void (*cb)(struct audit_buffer *, void *));
  126. #endif /* __AA_PERM_H */