lib.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains basic common functions used in AppArmor
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2010 Canonical Ltd.
  9. */
  10. #include <linux/ctype.h>
  11. #include <linux/mm.h>
  12. #include <linux/slab.h>
  13. #include <linux/string.h>
  14. #include <linux/vmalloc.h>
  15. #include "include/audit.h"
  16. #include "include/apparmor.h"
  17. #include "include/lib.h"
  18. #include "include/perms.h"
  19. #include "include/policy.h"
  20. struct aa_perms nullperms;
  21. struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
  22. .quiet = ALL_PERMS_MASK,
  23. .hide = ALL_PERMS_MASK };
  24. /**
  25. * aa_split_fqname - split a fqname into a profile and namespace name
  26. * @fqname: a full qualified name in namespace profile format (NOT NULL)
  27. * @ns_name: pointer to portion of the string containing the ns name (NOT NULL)
  28. *
  29. * Returns: profile name or NULL if one is not specified
  30. *
  31. * Split a namespace name from a profile name (see policy.c for naming
  32. * description). If a portion of the name is missing it returns NULL for
  33. * that portion.
  34. *
  35. * NOTE: may modify the @fqname string. The pointers returned point
  36. * into the @fqname string.
  37. */
  38. char *aa_split_fqname(char *fqname, char **ns_name)
  39. {
  40. char *name = strim(fqname);
  41. *ns_name = NULL;
  42. if (name[0] == ':') {
  43. char *split = strchr(&name[1], ':');
  44. *ns_name = skip_spaces(&name[1]);
  45. if (split) {
  46. /* overwrite ':' with \0 */
  47. *split++ = 0;
  48. if (strncmp(split, "//", 2) == 0)
  49. split += 2;
  50. name = skip_spaces(split);
  51. } else
  52. /* a ns name without a following profile is allowed */
  53. name = NULL;
  54. }
  55. if (name && *name == 0)
  56. name = NULL;
  57. return name;
  58. }
  59. /**
  60. * skipn_spaces - Removes leading whitespace from @str.
  61. * @str: The string to be stripped.
  62. *
  63. * Returns a pointer to the first non-whitespace character in @str.
  64. * if all whitespace will return NULL
  65. */
  66. const char *skipn_spaces(const char *str, size_t n)
  67. {
  68. for (; n && isspace(*str); --n)
  69. ++str;
  70. if (n)
  71. return (char *)str;
  72. return NULL;
  73. }
  74. const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
  75. size_t *ns_len)
  76. {
  77. const char *end = fqname + n;
  78. const char *name = skipn_spaces(fqname, n);
  79. *ns_name = NULL;
  80. *ns_len = 0;
  81. if (!name)
  82. return NULL;
  83. if (name[0] == ':') {
  84. char *split = strnchr(&name[1], end - &name[1], ':');
  85. *ns_name = skipn_spaces(&name[1], end - &name[1]);
  86. if (!*ns_name)
  87. return NULL;
  88. if (split) {
  89. *ns_len = split - *ns_name;
  90. if (*ns_len == 0)
  91. *ns_name = NULL;
  92. split++;
  93. if (end - split > 1 && strncmp(split, "//", 2) == 0)
  94. split += 2;
  95. name = skipn_spaces(split, end - split);
  96. } else {
  97. /* a ns name without a following profile is allowed */
  98. name = NULL;
  99. *ns_len = end - *ns_name;
  100. }
  101. }
  102. if (name && *name == 0)
  103. name = NULL;
  104. return name;
  105. }
  106. /**
  107. * aa_info_message - log a none profile related status message
  108. * @str: message to log
  109. */
  110. void aa_info_message(const char *str)
  111. {
  112. if (audit_enabled) {
  113. DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
  114. aad(&sa)->info = str;
  115. aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
  116. }
  117. printk(KERN_INFO "AppArmor: %s\n", str);
  118. }
  119. __counted char *aa_str_alloc(int size, gfp_t gfp)
  120. {
  121. struct counted_str *str;
  122. str = kmalloc(sizeof(struct counted_str) + size, gfp);
  123. if (!str)
  124. return NULL;
  125. kref_init(&str->count);
  126. return str->name;
  127. }
  128. void aa_str_kref(struct kref *kref)
  129. {
  130. kfree(container_of(kref, struct counted_str, count));
  131. }
  132. const char aa_file_perm_chrs[] = "xwracd km l ";
  133. const char *aa_file_perm_names[] = {
  134. "exec",
  135. "write",
  136. "read",
  137. "append",
  138. "create",
  139. "delete",
  140. "open",
  141. "rename",
  142. "setattr",
  143. "getattr",
  144. "setcred",
  145. "getcred",
  146. "chmod",
  147. "chown",
  148. "chgrp",
  149. "lock",
  150. "mmap",
  151. "mprot",
  152. "link",
  153. "snapshot",
  154. "unknown",
  155. "unknown",
  156. "unknown",
  157. "unknown",
  158. "unknown",
  159. "unknown",
  160. "unknown",
  161. "unknown",
  162. "stack",
  163. "change_onexec",
  164. "change_profile",
  165. "change_hat",
  166. };
  167. /**
  168. * aa_perm_mask_to_str - convert a perm mask to its short string
  169. * @str: character buffer to store string in (at least 10 characters)
  170. * @str_size: size of the @str buffer
  171. * @chrs: NUL-terminated character buffer of permission characters
  172. * @mask: permission mask to convert
  173. */
  174. void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, u32 mask)
  175. {
  176. unsigned int i, perm = 1;
  177. size_t num_chrs = strlen(chrs);
  178. for (i = 0; i < num_chrs; perm <<= 1, i++) {
  179. if (mask & perm) {
  180. /* Ensure that one byte is left for NUL-termination */
  181. if (WARN_ON_ONCE(str_size <= 1))
  182. break;
  183. *str++ = chrs[i];
  184. str_size--;
  185. }
  186. }
  187. *str = '\0';
  188. }
  189. void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
  190. u32 mask)
  191. {
  192. const char *fmt = "%s";
  193. unsigned int i, perm = 1;
  194. bool prev = false;
  195. for (i = 0; i < 32; perm <<= 1, i++) {
  196. if (mask & perm) {
  197. audit_log_format(ab, fmt, names[i]);
  198. if (!prev) {
  199. prev = true;
  200. fmt = " %s";
  201. }
  202. }
  203. }
  204. }
  205. void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
  206. u32 chrsmask, const char * const *names, u32 namesmask)
  207. {
  208. char str[33];
  209. audit_log_format(ab, "\"");
  210. if ((mask & chrsmask) && chrs) {
  211. aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask);
  212. mask &= ~chrsmask;
  213. audit_log_format(ab, "%s", str);
  214. if (mask & namesmask)
  215. audit_log_format(ab, " ");
  216. }
  217. if ((mask & namesmask) && names)
  218. aa_audit_perm_names(ab, names, mask & namesmask);
  219. audit_log_format(ab, "\"");
  220. }
  221. /**
  222. * aa_audit_perms_cb - generic callback fn for auditing perms
  223. * @ab: audit buffer (NOT NULL)
  224. * @va: audit struct to audit values of (NOT NULL)
  225. */
  226. static void aa_audit_perms_cb(struct audit_buffer *ab, void *va)
  227. {
  228. struct common_audit_data *sa = va;
  229. if (aad(sa)->request) {
  230. audit_log_format(ab, " requested_mask=");
  231. aa_audit_perm_mask(ab, aad(sa)->request, aa_file_perm_chrs,
  232. PERMS_CHRS_MASK, aa_file_perm_names,
  233. PERMS_NAMES_MASK);
  234. }
  235. if (aad(sa)->denied) {
  236. audit_log_format(ab, "denied_mask=");
  237. aa_audit_perm_mask(ab, aad(sa)->denied, aa_file_perm_chrs,
  238. PERMS_CHRS_MASK, aa_file_perm_names,
  239. PERMS_NAMES_MASK);
  240. }
  241. audit_log_format(ab, " peer=");
  242. aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
  243. FLAGS_NONE, GFP_ATOMIC);
  244. }
  245. /**
  246. * aa_apply_modes_to_perms - apply namespace and profile flags to perms
  247. * @profile: that perms where computed from
  248. * @perms: perms to apply mode modifiers to
  249. *
  250. * TODO: split into profile and ns based flags for when accumulating perms
  251. */
  252. void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
  253. {
  254. switch (AUDIT_MODE(profile)) {
  255. case AUDIT_ALL:
  256. perms->audit = ALL_PERMS_MASK;
  257. fallthrough;
  258. case AUDIT_NOQUIET:
  259. perms->quiet = 0;
  260. break;
  261. case AUDIT_QUIET:
  262. perms->audit = 0;
  263. fallthrough;
  264. case AUDIT_QUIET_DENIED:
  265. perms->quiet = ALL_PERMS_MASK;
  266. break;
  267. }
  268. if (KILL_MODE(profile))
  269. perms->kill = ALL_PERMS_MASK;
  270. else if (COMPLAIN_MODE(profile))
  271. perms->complain = ALL_PERMS_MASK;
  272. /*
  273. * TODO:
  274. * else if (PROMPT_MODE(profile))
  275. * perms->prompt = ALL_PERMS_MASK;
  276. */
  277. }
  278. static u32 map_other(u32 x)
  279. {
  280. return ((x & 0x3) << 8) | /* SETATTR/GETATTR */
  281. ((x & 0x1c) << 18) | /* ACCEPT/BIND/LISTEN */
  282. ((x & 0x60) << 19); /* SETOPT/GETOPT */
  283. }
  284. void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
  285. struct aa_perms *perms)
  286. {
  287. *perms = (struct aa_perms) {
  288. .allow = dfa_user_allow(dfa, state),
  289. .audit = dfa_user_audit(dfa, state),
  290. .quiet = dfa_user_quiet(dfa, state),
  291. };
  292. /* for v5 perm mapping in the policydb, the other set is used
  293. * to extend the general perm set
  294. */
  295. perms->allow |= map_other(dfa_other_allow(dfa, state));
  296. perms->audit |= map_other(dfa_other_audit(dfa, state));
  297. perms->quiet |= map_other(dfa_other_quiet(dfa, state));
  298. // perms->xindex = dfa_user_xindex(dfa, state);
  299. }
  300. /**
  301. * aa_perms_accum_raw - accumulate perms with out masking off overlapping perms
  302. * @accum - perms struct to accumulate into
  303. * @addend - perms struct to add to @accum
  304. */
  305. void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend)
  306. {
  307. accum->deny |= addend->deny;
  308. accum->allow &= addend->allow & ~addend->deny;
  309. accum->audit |= addend->audit & addend->allow;
  310. accum->quiet &= addend->quiet & ~addend->allow;
  311. accum->kill |= addend->kill & ~addend->allow;
  312. accum->stop |= addend->stop & ~addend->allow;
  313. accum->complain |= addend->complain & ~addend->allow & ~addend->deny;
  314. accum->cond |= addend->cond & ~addend->allow & ~addend->deny;
  315. accum->hide &= addend->hide & ~addend->allow;
  316. accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny;
  317. }
  318. /**
  319. * aa_perms_accum - accumulate perms, masking off overlapping perms
  320. * @accum - perms struct to accumulate into
  321. * @addend - perms struct to add to @accum
  322. */
  323. void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend)
  324. {
  325. accum->deny |= addend->deny;
  326. accum->allow &= addend->allow & ~accum->deny;
  327. accum->audit |= addend->audit & accum->allow;
  328. accum->quiet &= addend->quiet & ~accum->allow;
  329. accum->kill |= addend->kill & ~accum->allow;
  330. accum->stop |= addend->stop & ~accum->allow;
  331. accum->complain |= addend->complain & ~accum->allow & ~accum->deny;
  332. accum->cond |= addend->cond & ~accum->allow & ~accum->deny;
  333. accum->hide &= addend->hide & ~accum->allow;
  334. accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny;
  335. }
  336. void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
  337. int type, u32 request, struct aa_perms *perms)
  338. {
  339. /* TODO: doesn't yet handle extended types */
  340. unsigned int state;
  341. state = aa_dfa_next(profile->policy.dfa,
  342. profile->policy.start[AA_CLASS_LABEL],
  343. type);
  344. aa_label_match(profile, label, state, false, request, perms);
  345. }
  346. /* currently unused */
  347. int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
  348. u32 request, int type, u32 *deny,
  349. struct common_audit_data *sa)
  350. {
  351. struct aa_perms perms;
  352. aad(sa)->label = &profile->label;
  353. aad(sa)->peer = &target->label;
  354. aad(sa)->request = request;
  355. aa_profile_match_label(profile, &target->label, type, request, &perms);
  356. aa_apply_modes_to_perms(profile, &perms);
  357. *deny |= request & perms.deny;
  358. return aa_check_perms(profile, &perms, request, sa, aa_audit_perms_cb);
  359. }
  360. /**
  361. * aa_check_perms - do audit mode selection based on perms set
  362. * @profile: profile being checked
  363. * @perms: perms computed for the request
  364. * @request: requested perms
  365. * @deny: Returns: explicit deny set
  366. * @sa: initialized audit structure (MAY BE NULL if not auditing)
  367. * @cb: callback fn for type specific fields (MAY BE NULL)
  368. *
  369. * Returns: 0 if permission else error code
  370. *
  371. * Note: profile audit modes need to be set before calling by setting the
  372. * perm masks appropriately.
  373. *
  374. * If not auditing then complain mode is not enabled and the
  375. * error code will indicate whether there was an explicit deny
  376. * with a positive value.
  377. */
  378. int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
  379. u32 request, struct common_audit_data *sa,
  380. void (*cb)(struct audit_buffer *, void *))
  381. {
  382. int type, error;
  383. u32 denied = request & (~perms->allow | perms->deny);
  384. if (likely(!denied)) {
  385. /* mask off perms that are not being force audited */
  386. request &= perms->audit;
  387. if (!request || !sa)
  388. return 0;
  389. type = AUDIT_APPARMOR_AUDIT;
  390. error = 0;
  391. } else {
  392. error = -EACCES;
  393. if (denied & perms->kill)
  394. type = AUDIT_APPARMOR_KILL;
  395. else if (denied == (denied & perms->complain))
  396. type = AUDIT_APPARMOR_ALLOWED;
  397. else
  398. type = AUDIT_APPARMOR_DENIED;
  399. if (denied == (denied & perms->hide))
  400. error = -ENOENT;
  401. denied &= ~perms->quiet;
  402. if (!sa || !denied)
  403. return error;
  404. }
  405. if (sa) {
  406. aad(sa)->label = &profile->label;
  407. aad(sa)->request = request;
  408. aad(sa)->denied = denied;
  409. aad(sa)->error = error;
  410. aa_audit_msg(type, sa, cb);
  411. }
  412. if (type == AUDIT_APPARMOR_ALLOWED)
  413. error = 0;
  414. return error;
  415. }
  416. /**
  417. * aa_policy_init - initialize a policy structure
  418. * @policy: policy to initialize (NOT NULL)
  419. * @prefix: prefix name if any is required. (MAYBE NULL)
  420. * @name: name of the policy, init will make a copy of it (NOT NULL)
  421. * @gfp: allocation mode
  422. *
  423. * Note: this fn creates a copy of strings passed in
  424. *
  425. * Returns: true if policy init successful
  426. */
  427. bool aa_policy_init(struct aa_policy *policy, const char *prefix,
  428. const char *name, gfp_t gfp)
  429. {
  430. char *hname;
  431. /* freed by policy_free */
  432. if (prefix) {
  433. hname = aa_str_alloc(strlen(prefix) + strlen(name) + 3, gfp);
  434. if (hname)
  435. sprintf(hname, "%s//%s", prefix, name);
  436. } else {
  437. hname = aa_str_alloc(strlen(name) + 1, gfp);
  438. if (hname)
  439. strcpy(hname, name);
  440. }
  441. if (!hname)
  442. return false;
  443. policy->hname = hname;
  444. /* base.name is a substring of fqname */
  445. policy->name = basename(policy->hname);
  446. INIT_LIST_HEAD(&policy->list);
  447. INIT_LIST_HEAD(&policy->profiles);
  448. return true;
  449. }
  450. /**
  451. * aa_policy_destroy - free the elements referenced by @policy
  452. * @policy: policy that is to have its elements freed (NOT NULL)
  453. */
  454. void aa_policy_destroy(struct aa_policy *policy)
  455. {
  456. AA_BUG(on_list_rcu(&policy->profiles));
  457. AA_BUG(on_list_rcu(&policy->list));
  458. /* don't free name as its a subset of hname */
  459. aa_put_str(policy->hname);
  460. }