Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ea3ffb7 authored by John Johansen's avatar John Johansen
Browse files

apparmor: add mount mediation 



Add basic mount mediation. That allows controlling based on basic
mount parameters. It does not include special mount parameters for
apparmor, super block labeling, or any triggers for apparmor namespace
parameter modifications on pivot root.

default userspace policy rules have the form of
  MOUNT RULE = ( MOUNT | REMOUNT | UMOUNT )

  MOUNT = [ QUALIFIERS ] 'mount' [ MOUNT CONDITIONS ] [ SOURCE FILEGLOB ]
          [ '->' MOUNTPOINT FILEGLOB ]

  REMOUNT = [ QUALIFIERS ] 'remount' [ MOUNT CONDITIONS ]
            MOUNTPOINT FILEGLOB

  UMOUNT = [ QUALIFIERS ] 'umount' [ MOUNT CONDITIONS ] MOUNTPOINT FILEGLOB

  MOUNT CONDITIONS = [ ( 'fstype' | 'vfstype' ) ( '=' | 'in' )
                       MOUNT FSTYPE EXPRESSION ]
		       [ 'options' ( '=' | 'in' ) MOUNT FLAGS EXPRESSION ]

  MOUNT FSTYPE EXPRESSION = ( MOUNT FSTYPE LIST | MOUNT EXPRESSION )

  MOUNT FSTYPE LIST = Comma separated list of valid filesystem and
                      virtual filesystem types (eg ext4, debugfs, etc)

  MOUNT FLAGS EXPRESSION = ( MOUNT FLAGS LIST | MOUNT EXPRESSION )

  MOUNT FLAGS LIST = Comma separated list of MOUNT FLAGS.

  MOUNT FLAGS = ( 'ro' | 'rw' | 'nosuid' | 'suid' | 'nodev' | 'dev' |
                  'noexec' | 'exec' | 'sync' | 'async' | 'remount' |
		  'mand' | 'nomand' | 'dirsync' | 'noatime' | 'atime' |
		  'nodiratime' | 'diratime' | 'bind' | 'rbind' | 'move' |
		  'verbose' | 'silent' | 'loud' | 'acl' | 'noacl' |
		  'unbindable' | 'runbindable' | 'private' | 'rprivate' |
		  'slave' | 'rslave' | 'shared' | 'rshared' |
		  'relatime' | 'norelatime' | 'iversion' | 'noiversion' |
		  'strictatime' | 'nouser' | 'user' )

  MOUNT EXPRESSION = ( ALPHANUMERIC | AARE ) ...

  PIVOT ROOT RULE = [ QUALIFIERS ] pivot_root [ oldroot=OLD PUT FILEGLOB ]
                    [ NEW ROOT FILEGLOB ]

  SOURCE FILEGLOB = FILEGLOB

  MOUNTPOINT FILEGLOB = FILEGLOB

eg.
  mount,
  mount /dev/foo,
  mount options=ro /dev/foo -> /mnt/,
  mount options in (ro,atime) /dev/foo -> /mnt/,
  mount options=ro options=atime,

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
parent cd1dbf76

security/apparmor/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o 


apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \

              path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \

              resource.o secid.o file.o policy_ns.o label.o

              resource.o secid.o file.o policy_ns.o label.o mount.o

apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o



clean-files := capability_names.h rlim_names.h

security/apparmor/apparmorfs.c

+7 −1
Original line number Diff line number Diff line
@@ -2159,9 +2159,14 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = { 
	{ }

};



static struct aa_sfs_entry aa_sfs_entry_mount[] = {

	AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),

	{ }

};



static struct aa_sfs_entry aa_sfs_entry_ns[] = {

	AA_SFS_FILE_BOOLEAN("profile",		1),

	AA_SFS_FILE_BOOLEAN("pivot_root",	1),

	AA_SFS_FILE_BOOLEAN("pivot_root",	0),

	{ }

};
@@ -2180,6 +2185,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = { 
	AA_SFS_DIR("policy",			aa_sfs_entry_policy),

	AA_SFS_DIR("domain",			aa_sfs_entry_domain),

	AA_SFS_DIR("file",			aa_sfs_entry_file),

	AA_SFS_DIR("mount",			aa_sfs_entry_mount),

	AA_SFS_DIR("namespaces",		aa_sfs_entry_ns),

	AA_SFS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),

	AA_SFS_DIR("rlimit",			aa_sfs_entry_rlimit),

security/apparmor/domain.c

+2 −2
Original line number Diff line number Diff line
@@ -374,7 +374,7 @@ static const char *next_name(int xtype, const char *name) 
 *

 * Returns: refcounted label, or NULL on failure (MAYBE NULL)

 */

static struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,

struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,

				const char **name)

{

	struct aa_label *label = NULL;

security/apparmor/include/apparmor.h

+1 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#define AA_CLASS_NET		4

#define AA_CLASS_RLIMITS	5

#define AA_CLASS_DOMAIN		6

#define AA_CLASS_MOUNT		7

#define AA_CLASS_PTRACE		9

#define AA_CLASS_SIGNAL		10

#define AA_CLASS_LABEL		16

security/apparmor/include/audit.h

+11 −0
Original line number Diff line number Diff line
@@ -71,6 +71,10 @@ enum audit_type { 
#define OP_FMPROT "file_mprotect"

#define OP_INHERIT "file_inherit"



#define OP_PIVOTROOT "pivotroot"

#define OP_MOUNT "mount"

#define OP_UMOUNT "umount"



#define OP_CREATE "create"

#define OP_POST_CREATE "post_create"

#define OP_BIND "bind"
@@ -132,6 +136,13 @@ struct apparmor_audit_data { 
			int rlim;

			unsigned long max;

		} rlim;

		struct {

			const char *src_name;

			const char *type;

			const char *trans;

			const char *data;

			unsigned long flags;

		} mnt;

	};

};