AppArmor: userspace interfaces

/*

 * AppArmor security module

 *

 * This file contains AppArmor /sys/kernel/security/apparmor interface functions

 *

 * Copyright (C) 1998-2008 Novell/SUSE

 * Copyright 2009-2010 Canonical Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as

 * published by the Free Software Foundation, version 2 of the

 * License.

 */

#include <linux/security.h>

#include <linux/vmalloc.h>

#include <linux/module.h>

#include <linux/seq_file.h>

#include <linux/uaccess.h>

#include <linux/namei.h>

#include "include/apparmor.h"

#include "include/apparmorfs.h"

#include "include/audit.h"

#include "include/context.h"

#include "include/policy.h"

/**

 * aa_simple_write_to_buffer - common routine for getting policy from user

 * @op: operation doing the user buffer copy

 * @userbuf: user buffer to copy data from  (NOT NULL)

 * @alloc_size: size of user buffer

 * @copy_size: size of data to copy from user buffer

 * @pos: position write is at in the file (NOT NULL)

 *

 * Returns: kernel buffer containing copy of user buffer data or an

 *          ERR_PTR on failure.

 */

static char *aa_simple_write_to_buffer(int op, const char __user *userbuf,

				       size_t alloc_size, size_t copy_size,

				       loff_t *pos)

{

	char *data;

	if (*pos != 0)

		/* only writes from pos 0, that is complete writes */

		return ERR_PTR(-ESPIPE);

	/*

	 * Don't allow profile load/replace/remove from profiles that don't

	 * have CAP_MAC_ADMIN

	 */

	if (!aa_may_manage_policy(op))

		return ERR_PTR(-EACCES);

	/* freed by caller to simple_write_to_buffer */

	data = kvmalloc(alloc_size);

	if (data == NULL)

		return ERR_PTR(-ENOMEM);

	if (copy_from_user(data, userbuf, copy_size)) {

		kvfree(data);

		return ERR_PTR(-EFAULT);

	}

	return data;

}

/* .load file hook fn to load policy */

static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,

			    loff_t *pos)

{

	char *data;

	ssize_t error;

	data = aa_simple_write_to_buffer(OP_PROF_LOAD, buf, size, size, pos);

	error = PTR_ERR(data);

	if (!IS_ERR(data)) {

		error = aa_replace_profiles(data, size, PROF_ADD);

		kvfree(data);

	}

	return error;

}

static const struct file_operations aa_fs_profile_load = {

	.write = profile_load

};

/* .replace file hook fn to load and/or replace policy */

static ssize_t profile_replace(struct file *f, const char __user *buf,

			       size_t size, loff_t *pos)

{

	char *data;

	ssize_t error;

	data = aa_simple_write_to_buffer(OP_PROF_REPL, buf, size, size, pos);

	error = PTR_ERR(data);

	if (!IS_ERR(data)) {

		error = aa_replace_profiles(data, size, PROF_REPLACE);

		kvfree(data);

	}

	return error;

}

static const struct file_operations aa_fs_profile_replace = {

	.write = profile_replace

};

/* .remove file hook fn to remove loaded policy */

static ssize_t profile_remove(struct file *f, const char __user *buf,

			      size_t size, loff_t *pos)

{

	char *data;

	ssize_t error;

	/*

	 * aa_remove_profile needs a null terminated string so 1 extra

	 * byte is allocated and the copied data is null terminated.

	 */

	data = aa_simple_write_to_buffer(OP_PROF_RM, buf, size + 1, size, pos);

	error = PTR_ERR(data);

	if (!IS_ERR(data)) {

		data[size] = 0;

		error = aa_remove_profiles(data, size);

		kvfree(data);

	}

	return error;

}

static const struct file_operations aa_fs_profile_remove = {

	.write = profile_remove

};

/** Base file system setup **/

static struct dentry *aa_fs_dentry __initdata;

static void __init aafs_remove(const char *name)

{

	struct dentry *dentry;

	dentry = lookup_one_len(name, aa_fs_dentry, strlen(name));

	if (!IS_ERR(dentry)) {

		securityfs_remove(dentry);

		dput(dentry);

	}

}

/**

 * aafs_create - create an entry in the apparmor filesystem

 * @name: name of the entry (NOT NULL)

 * @mask: file permission mask of the file

 * @fops: file operations for the file (NOT NULL)

 *

 * Used aafs_remove to remove entries created with this fn.

 */

static int __init aafs_create(const char *name, int mask,

			      const struct file_operations *fops)

{

	struct dentry *dentry;

	dentry = securityfs_create_file(name, S_IFREG | mask, aa_fs_dentry,

					NULL, fops);

	return IS_ERR(dentry) ? PTR_ERR(dentry) : 0;

}

/**

 * aa_destroy_aafs - cleanup and free aafs

 *

 * releases dentries allocated by aa_create_aafs

 */

void __init aa_destroy_aafs(void)

{

	if (aa_fs_dentry) {

		aafs_remove(".remove");

		aafs_remove(".replace");

		aafs_remove(".load");

		securityfs_remove(aa_fs_dentry);

		aa_fs_dentry = NULL;

	}

}

/**

 * aa_create_aafs - create the apparmor security filesystem

 *

 * dentries created here are released by aa_destroy_aafs

 *

 * Returns: error on failure

 */

int __init aa_create_aafs(void)

{

	int error;

	if (!apparmor_initialized)

		return 0;

	if (aa_fs_dentry) {

		AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);

		return -EEXIST;

	}

	aa_fs_dentry = securityfs_create_dir("apparmor", NULL);

	if (IS_ERR(aa_fs_dentry)) {

		error = PTR_ERR(aa_fs_dentry);

		aa_fs_dentry = NULL;

		goto error;

	}

	error = aafs_create(".load", 0640, &aa_fs_profile_load);

	if (error)

		goto error;

	error = aafs_create(".replace", 0640, &aa_fs_profile_replace);

	if (error)

		goto error;

	error = aafs_create(".remove", 0640, &aa_fs_profile_remove);

	if (error)

		goto error;

	/* TODO: add support for apparmorfs_null and apparmorfs_mnt */

	/* Report that AppArmor fs is enabled */

	aa_info_message("AppArmor Filesystem Enabled");

	return 0;

error:

	aa_destroy_aafs();

	AA_ERROR("Error creating AppArmor securityfs\n");

	return error;

}

fs_initcall(aa_create_aafs);

/*

 * AppArmor security module

 *

 * This file contains AppArmor filesystem definitions.

 *

 * Copyright (C) 1998-2008 Novell/SUSE

 * Copyright 2009-2010 Canonical Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as

 * published by the Free Software Foundation, version 2 of the

 * License.

 */

#ifndef __AA_APPARMORFS_H

#define __AA_APPARMORFS_H

extern void __init aa_destroy_aafs(void);

#endif /* __AA_APPARMORFS_H */

/*

 * AppArmor security module

 *

 * This file contains AppArmor /proc/<pid>/attr/ interface function definitions.

 *

 * Copyright (C) 1998-2008 Novell/SUSE

 * Copyright 2009-2010 Canonical Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as

 * published by the Free Software Foundation, version 2 of the

 * License.

 */

#ifndef __AA_PROCATTR_H

#define __AA_PROCATTR_H

#define AA_DO_TEST 1

#define AA_ONEXEC  1

int aa_getprocattr(struct aa_profile *profile, char **string);

int aa_setprocattr_changehat(char *args, size_t size, int test);

int aa_setprocattr_changeprofile(char *fqname, bool onexec, int test);

int aa_setprocattr_permipc(char *fqname);

#endif /* __AA_PROCATTR_H */

/*

 * AppArmor security module

 *

 * This file contains AppArmor /proc/<pid>/attr/ interface functions

 *

 * Copyright (C) 1998-2008 Novell/SUSE

 * Copyright 2009-2010 Canonical Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as

 * published by the Free Software Foundation, version 2 of the

 * License.

 */

#include "include/apparmor.h"

#include "include/context.h"

#include "include/policy.h"

#include "include/domain.h"

/**

 * aa_getprocattr - Return the profile information for @profile

 * @profile: the profile to print profile info about  (NOT NULL)

 * @string: Returns - string containing the profile info (NOT NULL)

 *

 * Returns: length of @string on success else error on failure

 *

 * Requires: profile != NULL

 *

 * Creates a string containing the namespace_name://profile_name for

 * @profile.

 *

 * Returns: size of string placed in @string else error code on failure

 */

int aa_getprocattr(struct aa_profile *profile, char **string)

{

	char *str;

	int len = 0, mode_len = 0, ns_len = 0, name_len;

	const char *mode_str = profile_mode_names[profile->mode];

	const char *ns_name = NULL;

	struct aa_namespace *ns = profile->ns;

	struct aa_namespace *current_ns = __aa_current_profile()->ns;

	char *s;

	if (!aa_ns_visible(current_ns, ns))

		return -EACCES;

	ns_name = aa_ns_name(current_ns, ns);

	ns_len = strlen(ns_name);

	/* if the visible ns_name is > 0 increase size for : :// seperator */

	if (ns_len)

		ns_len += 4;

	/* unconfined profiles don't have a mode string appended */

	if (!unconfined(profile))

		mode_len = strlen(mode_str) + 3;	/* + 3 for _() */

	name_len = strlen(profile->base.hname);

	len = mode_len + ns_len + name_len + 1;	    /* + 1 for \n */

	s = str = kmalloc(len + 1, GFP_KERNEL);	    /* + 1 \0 */

	if (!str)

		return -ENOMEM;

	if (ns_len) {

		/* skip over prefix current_ns->base.hname and separating // */

		sprintf(s, ":%s://", ns_name);

		s += ns_len;

	}

	if (unconfined(profile))

		/* mode string not being appended */

		sprintf(s, "%s\n", profile->base.hname);

	else

		sprintf(s, "%s (%s)\n", profile->base.hname, mode_str);

	*string = str;

	/* NOTE: len does not include \0 of string, not saved as part of file */

	return len;

}

/**

 * split_token_from_name - separate a string of form  <token>^<name>

 * @op: operation being checked

 * @args: string to parse  (NOT NULL)

 * @token: stores returned parsed token value  (NOT NULL)

 *

 * Returns: start position of name after token else NULL on failure

 */

static char *split_token_from_name(int op, char *args, u64 * token)

{

	char *name;

	*token = simple_strtoull(args, &name, 16);

	if ((name == args) || *name != '^') {

		AA_ERROR("%s: Invalid input '%s'", op_table[op], args);

		return ERR_PTR(-EINVAL);

	}

	name++;			/* skip ^ */

	if (!*name)

		name = NULL;

	return name;

}

/**

 * aa_setprocattr_chagnehat - handle procattr interface to change_hat

 * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL)

 * @size: size of the args

 * @test: true if this is a test of change_hat permissions

 *

 * Returns: %0 or error code if change_hat fails

 */

int aa_setprocattr_changehat(char *args, size_t size, int test)

{

	char *hat;

	u64 token;

	const char *hats[16];		/* current hard limit on # of names */

	int count = 0;

	hat = split_token_from_name(OP_CHANGE_HAT, args, &token);

	if (IS_ERR(hat))

		return PTR_ERR(hat);

	if (!hat && !token) {

		AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic");

		return -EINVAL;

	}

	if (hat) {

		/* set up hat name vector, args guaranteed null terminated

		 * at args[size] by setprocattr.

		 *

		 * If there are multiple hat names in the buffer each is

		 * separated by a \0.  Ie. userspace writes them pre tokenized

		 */

		char *end = args + size;

		for (count = 0; (hat < end) && count < 16; ++count) {

			char *next = hat + strlen(hat) + 1;

			hats[count] = hat;

			hat = next;

		}

	}

	AA_DEBUG("%s: Magic 0x%llx Hat '%s'\n",

		 __func__, token, hat ? hat : NULL);

	return aa_change_hat(hats, count, token, test);

}

/**

 * aa_setprocattr_changeprofile - handle procattr interface to changeprofile

 * @fqname: args received from writting to /proc/<pid>/attr/current (NOT NULL)

 * @onexec: true if change_profile should be delayed until exec

 * @test: true if this is a test of change_profile permissions

 *

 * Returns: %0 or error code if change_profile fails

 */

int aa_setprocattr_changeprofile(char *fqname, bool onexec, int test)

{

	char *name, *ns_name;

	name = aa_split_fqname(fqname, &ns_name);

	return aa_change_profile(ns_name, name, onexec, test);

}

int aa_setprocattr_permipc(char *fqname)

{

	/* TODO: add ipc permission querying */

	return -ENOTSUPP;

}