Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409// SPDX-License-Identifier: GPL-2.0-only/* * AppArmor security module * * This file contains AppArmor network mediation * * Copyright (C) 1998-2008 Novell/SUSE * Copyright 2009-2017 Canonical Ltd. */
#include "include/af_unix.h"#include "include/apparmor.h"#include "include/audit.h"#include "include/cred.h"#include "include/label.h"#include "include/net.h"#include "include/policy.h"#include "include/secid.h"
#include "net_names.h"
struct aa_sfs_entry aa_sfs_entry_network[] = { AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK), AA_SFS_FILE_BOOLEAN("tcp-fast-open", 1), { }};
struct aa_sfs_entry aa_sfs_entry_networkv9[] = { AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK), AA_SFS_FILE_BOOLEAN("af_unix", 1), AA_SFS_FILE_BOOLEAN("tcp-fast-open", 1), { }};
static const char * const net_mask_names[] = { "unknown", "send", "receive", "unknown",
"create", "shutdown", "connect", "unknown",
"setattr", "getattr", "setcred", "getcred",
"chmod", "chown", "chgrp", "lock",
"mmap", "mprot", "unknown", "unknown",
"accept", "bind", "listen", "unknown",
"setopt", "getopt", "unknown", "unknown",
"unknown", "unknown", "unknown", "unknown",};
static void audit_unix_addr(struct audit_buffer *ab, const char *str, struct sockaddr_un *addr, int addrlen){ int len = unix_addr_len(addrlen);
if (!addr || len <= 0) { audit_log_format(ab, " %s=none", str); } else if (addr->sun_path[0]) { audit_log_format(ab, " %s=", str); audit_log_untrustedstring(ab, addr->sun_path); } else { audit_log_format(ab, " %s=\"@", str); if (audit_string_contains_control(&addr->sun_path[1], len - 1)) audit_log_n_hex(ab, &addr->sun_path[1], len - 1); else audit_log_format(ab, "%.*s", len - 1, &addr->sun_path[1]); audit_log_format(ab, "\""); }}
static void audit_unix_sk_addr(struct audit_buffer *ab, const char *str, const struct sock *sk){ const struct unix_sock *u = unix_sk(sk);
if (u && u->addr) { int addrlen; struct sockaddr_un *addr = aa_sunaddr(u, &addrlen);
audit_unix_addr(ab, str, addr, addrlen); } else { audit_unix_addr(ab, str, NULL, 0);
}}
/* audit callback for net specific fields */void audit_net_cb(struct audit_buffer *ab, void *va){ struct common_audit_data *sa = va; struct apparmor_audit_data *ad = aad(sa);
if (address_family_names[ad->common.u.net->family]) audit_log_format(ab, " family=\"%s\"", address_family_names[ad->common.u.net->family]); else audit_log_format(ab, " family=\"unknown(%d)\"", ad->common.u.net->family); if (sock_type_names[ad->net.type]) audit_log_format(ab, " sock_type=\"%s\"", sock_type_names[ad->net.type]); else audit_log_format(ab, " sock_type=\"unknown(%d)\"", ad->net.type); audit_log_format(ab, " protocol=%d", ad->net.protocol);
if (ad->request & NET_PERMS_MASK) { audit_log_format(ab, " requested_mask="); aa_audit_perm_mask(ab, ad->request, NULL, 0, net_mask_names, NET_PERMS_MASK);
if (ad->denied & NET_PERMS_MASK) { audit_log_format(ab, " denied_mask="); aa_audit_perm_mask(ab, ad->denied, NULL, 0, net_mask_names, NET_PERMS_MASK); } } if (ad->common.u.net->family == PF_UNIX) { if (ad->net.addr || !ad->common.u.net->sk) audit_unix_addr(ab, "addr", unix_addr(ad->net.addr), ad->net.addrlen); else audit_unix_sk_addr(ab, "addr", ad->common.u.net->sk); if (ad->request & NET_PEER_MASK) { audit_unix_addr(ab, "peer_addr", unix_addr(ad->net.peer.addr), ad->net.peer.addrlen); } } if (ad->peer) { audit_log_format(ab, " peer="); aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer, FLAGS_NONE, GFP_ATOMIC); }}
/* standard permission lookup pattern - supports early bailout */int aa_do_perms(struct aa_profile *profile, struct aa_policydb *policy, aa_state_t state, u32 request, struct aa_perms *p, struct apparmor_audit_data *ad){ struct aa_perms perms;
AA_BUG(!profile); AA_BUG(!policy);
if (state || !p) p = aa_lookup_perms(policy, state); perms = *p; aa_apply_modes_to_perms(profile, &perms); return aa_check_perms(profile, &perms, request, ad, audit_net_cb);}
/* only continue match if * insufficient current perms at current state * indicates there are more perms in later state * Returns: perms struct if early match */static struct aa_perms *early_match(struct aa_policydb *policy, aa_state_t state, u32 request){ struct aa_perms *p;
p = aa_lookup_perms(policy, state); if (((p->allow & request) != request) && (p->allow & AA_CONT_MATCH)) return NULL; return p;}
static aa_state_t aa_dfa_match_be16(struct aa_dfa *dfa, aa_state_t state, u16 data){ __be16 buffer = cpu_to_be16(data);
return aa_dfa_match_len(dfa, state, (char *) &buffer, 2);}
/** * aa_match_to_prot - match the af, type, protocol triplet * @policy: policy being matched * @state: state to start in * @request: permissions being requested, ignored if @p == NULL * @af: socket address family * @type: socket type * @protocol: socket protocol * @p: output - pointer to permission associated with match * @info: output - pointer to string describing failure * * RETURNS: state match stopped in. * * If @(p) is assigned a value the returned state will be the * corresponding state. Will not set @p on failure or if match completes * only if an early match occurs */aa_state_t aa_match_to_prot(struct aa_policydb *policy, aa_state_t state, u32 request, u16 af, int type, int protocol, struct aa_perms **p, const char **info){ state = aa_dfa_match_be16(policy->dfa, state, (u16)af); if (!state) { *info = "failed af match"; return state; } state = aa_dfa_match_be16(policy->dfa, state, (u16)type); if (state) { if (p) *p = early_match(policy, state, request); if (!p || !*p) { state = aa_dfa_match_be16(policy->dfa, state, (u16)protocol); if (!state) *info = "failed protocol match"; } } else { *info = "failed type match"; }
return state;}
/* Generic af perm */int aa_profile_af_perm(struct aa_profile *profile, struct apparmor_audit_data *ad, u32 request, u16 family, int type, int protocol){ struct aa_ruleset *rules = profile->label.rules[0]; struct aa_perms *p = NULL; aa_state_t state;
AA_BUG(family >= AF_MAX); AA_BUG(type < 0 || type >= SOCK_MAX); AA_BUG(profile_unconfined(profile));
if (profile_unconfined(profile)) return 0; state = RULE_MEDIATES_NET(rules); if (!state) return 0; state = aa_match_to_prot(rules->policy, state, request, family, type, protocol, &p, &ad->info); return aa_do_perms(profile, rules->policy, state, request, p, ad);}
int aa_af_perm(const struct cred *subj_cred, struct aa_label *label, const char *op, u32 request, u16 family, int type, int protocol){ struct aa_profile *profile; DEFINE_AUDIT_NET(ad, op, subj_cred, NULL, family, type, protocol);
return fn_for_each_confined(label, profile, aa_profile_af_perm(profile, &ad, request, family, type, protocol));}
static int aa_label_sk_perm(const struct cred *subj_cred, struct aa_label *label, const char *op, u32 request, struct sock *sk){ struct aa_sk_ctx *ctx = aa_sock(sk); int error = 0;
AA_BUG(!label); AA_BUG(!sk);
if (rcu_access_pointer(ctx->label) != kernel_t && !unconfined(label)) { struct aa_profile *profile; DEFINE_AUDIT_SK(ad, op, subj_cred, sk);
ad.subj_cred = subj_cred; error = fn_for_each_confined(label, profile, aa_profile_af_sk_perm(profile, &ad, request, sk)); }
return error;}
int aa_sk_perm(const char *op, u32 request, struct sock *sk){ struct aa_label *label; int error;
AA_BUG(!sk); AA_BUG(in_interrupt());
/* TODO: switch to begin_current_label ???? */ label = begin_current_label_crit_section(); error = aa_label_sk_perm(current_cred(), label, op, request, sk); end_current_label_crit_section(label);
return error;}
int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label, const char *op, u32 request, struct file *file){ struct socket *sock = (struct socket *) file->private_data;
AA_BUG(!label);
/* sock && sock->sk can be NULL for sockets being set up or torn down */ if (!sock || !sock->sk) return 0;
if (sock->sk->sk_family == PF_UNIX) return aa_unix_file_perm(subj_cred, label, op, request, file); return aa_label_sk_perm(subj_cred, label, op, request, sock->sk);}
#ifdef CONFIG_NETWORK_SECMARKstatic int apparmor_secmark_init(struct aa_secmark *secmark){ struct aa_label *label;
if (secmark->label[0] == '*') { secmark->secid = AA_SECID_WILDCARD; return 0; }
label = aa_label_strn_parse(&root_ns->unconfined->label, secmark->label, strlen(secmark->label), GFP_ATOMIC, false, false);
if (IS_ERR(label)) return PTR_ERR(label);
secmark->secid = label->secid; aa_put_label(label);
return 0;}
static int aa_secmark_perm(struct aa_profile *profile, u32 request, u32 secid, struct apparmor_audit_data *ad){ int i, ret; struct aa_perms perms = { }; struct aa_ruleset *rules = profile->label.rules[0];
if (rules->secmark_count == 0) return 0;
for (i = 0; i < rules->secmark_count; i++) { if (!rules->secmark[i].secid) { ret = apparmor_secmark_init(&rules->secmark[i]); if (ret) return ret; }
if (rules->secmark[i].secid == secid || rules->secmark[i].secid == AA_SECID_WILDCARD) { if (rules->secmark[i].deny) perms.deny = ALL_PERMS_MASK; else perms.allow = ALL_PERMS_MASK;
if (rules->secmark[i].audit) perms.audit = ALL_PERMS_MASK; } }
aa_apply_modes_to_perms(profile, &perms);
return aa_check_perms(profile, &perms, request, ad, audit_net_cb);}
int apparmor_secmark_check(struct aa_label *label, char *op, u32 request, u32 secid, const struct sock *sk){ struct aa_profile *profile; DEFINE_AUDIT_SK(ad, op, NULL, sk);
return fn_for_each_confined(label, profile, aa_secmark_perm(profile, request, secid, &ad));}#endif