Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor policy definitions.
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11#ifndef __AA_POLICY_H
12#define __AA_POLICY_H
13
14#include <linux/capability.h>
15#include <linux/cred.h>
16#include <linux/kref.h>
17#include <linux/rhashtable.h>
18#include <linux/sched.h>
19#include <linux/slab.h>
20#include <linux/socket.h>
21
22#include "apparmor.h"
23#include "audit.h"
24#include "capability.h"
25#include "domain.h"
26#include "file.h"
27#include "lib.h"
28#include "label.h"
29#include "net.h"
30#include "perms.h"
31#include "resource.h"
32
33
34struct aa_ns;
35
36extern int unprivileged_userns_apparmor_policy;
37extern int aa_unprivileged_unconfined_restricted;
38
39extern const char *const aa_profile_mode_names[];
40#define APPARMOR_MODE_NAMES_MAX_INDEX 4
41
42#define PROFILE_MODE(_profile, _mode) \
43 ((aa_g_profile_mode == (_mode)) || \
44 ((_profile)->mode == (_mode)))
45
46#define COMPLAIN_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_COMPLAIN)
47
48#define USER_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_USER)
49
50#define KILL_MODE(_profile) PROFILE_MODE((_profile), APPARMOR_KILL)
51
52#define PROFILE_IS_HAT(_profile) ((_profile)->label.flags & FLAG_HAT)
53
54#define CHECK_DEBUG1(_profile) ((_profile)->label.flags & FLAG_DEBUG1)
55
56#define CHECK_DEBUG2(_profile) ((_profile)->label.flags & FLAG_DEBUG2)
57
58#define profile_is_stale(_profile) (label_is_stale(&(_profile)->label))
59
60#define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)
61
62/* flags in the dfa accept2 table */
63enum dfa_accept_flags {
64 ACCEPT_FLAG_OWNER = 1,
65};
66
67/*
68 * FIXME: currently need a clean way to replace and remove profiles as a
69 * set. It should be done at the namespace level.
70 * Either, with a set of profiles loaded at the namespace level or via
71 * a mark and remove marked interface.
72 */
73enum profile_mode {
74 APPARMOR_ENFORCE, /* enforce access rules */
75 APPARMOR_COMPLAIN, /* allow and log access violations */
76 APPARMOR_KILL, /* kill task on access violation */
77 APPARMOR_UNCONFINED, /* profile set to unconfined */
78 APPARMOR_USER, /* modified complain mode to userspace */
79};
80
81
82struct aa_tags_header {
83 u32 mask; /* bit mask matching permissions */
84 u32 count; /* number of strings per entry */
85 u32 size; /* size of all strings covered by count */
86 u32 tags; /* index into string table */
87};
88
89struct aa_tags_struct {
90 struct {
91 u32 size; /* number of entries in tagsets */
92 u32 *table; /* indexes into headers & strs */
93 } sets;
94 struct {
95 u32 size; /* number of headers == num of strs */
96 struct aa_tags_header *table;
97 } hdrs;
98 struct aa_str_table strs;
99};
100
101/* struct aa_policydb - match engine for a policy
102 * @count: refcount for the pdb
103 * @dfa: dfa pattern match
104 * @perms: table of permissions
105 * @size: number of entries in @perms
106 * @trans: table of strings, index by x
107 * @tags: table of tags that perms->tag indexes
108 * @start:_states to start in for each class
109 * start: set of start states for the different classes of data
110 */
111struct aa_policydb {
112 struct kref count;
113 struct aa_dfa *dfa;
114 struct {
115 struct aa_perms *perms;
116 u32 size;
117 };
118 struct aa_str_table trans;
119 struct aa_tags_struct tags;
120 aa_state_t start[AA_CLASS_LAST + 1];
121};
122
123extern struct aa_policydb *nullpdb;
124
125void aa_destroy_tags(struct aa_tags_struct *tags);
126struct aa_policydb *aa_alloc_pdb(gfp_t gfp);
127void aa_pdb_free_kref(struct kref *kref);
128
129/**
130 * aa_get_pdb - increment refcount on @pdb
131 * @pdb: policydb (MAYBE NULL)
132 *
133 * Returns: pointer to @pdb if @pdb is NULL will return NULL
134 * Requires: @pdb must be held with valid refcount when called
135 */
136static inline struct aa_policydb *aa_get_pdb(struct aa_policydb *pdb)
137{
138 if (pdb)
139 kref_get(&(pdb->count));
140
141 return pdb;
142}
143
144/**
145 * aa_put_pdb - put a pdb refcount
146 * @pdb: pdb to put refcount (MAYBE NULL)
147 *
148 * Requires: if @pdb != NULL that a valid refcount be held
149 */
150static inline void aa_put_pdb(struct aa_policydb *pdb)
151{
152 if (pdb)
153 kref_put(&pdb->count, aa_pdb_free_kref);
154}
155
156/* lookup perm that doesn't have and object conditional */
157static inline struct aa_perms *aa_lookup_perms(struct aa_policydb *policy,
158 aa_state_t state)
159{
160 unsigned int index = ACCEPT_TABLE(policy->dfa)[state];
161
162 if (!(policy->perms))
163 return &default_perms;
164
165 return &(policy->perms[index]);
166}
167
168/* struct aa_data - generic data structure
169 * key: name for retrieving this data
170 * size: size of data in bytes
171 * data: binary data
172 * head: reserved for rhashtable
173 */
174struct aa_data {
175 char *key;
176 u32 size;
177 char *data;
178 struct rhash_head head;
179};
180
181/* struct aa_ruleset - data covering mediation rules
182 * @list: list the rule is on
183 * @size: the memory consumed by this ruleset
184 * @policy: general match rules governing policy
185 * @file: The set of rules governing basic file access and domain transitions
186 * @caps: capabilities for the profile
187 * @rlimits: rlimits for the profile
188 * @secmark_count: number of secmark entries
189 * @secmark: secmark label match info
190 */
191struct aa_ruleset {
192 int size;
193
194 /* TODO: merge policy and file */
195 struct aa_policydb *policy;
196 struct aa_policydb *file;
197 struct aa_caps caps;
198
199 struct aa_rlimit rlimits;
200
201 int secmark_count;
202 struct aa_secmark *secmark;
203};
204
205
206/* struct aa_attachment - data and rules for a profiles attachment
207 * @list:
208 * @xmatch_str: human readable attachment string
209 * @xmatch: optional extended matching for unconfined executables names
210 * @xmatch_len: xmatch prefix len, used to determine xmatch priority
211 * @xattr_count: number of xattrs in table
212 * @xattrs: table of xattrs
213 */
214struct aa_attachment {
215 const char *xmatch_str;
216 struct aa_policydb *xmatch;
217 unsigned int xmatch_len;
218 int xattr_count;
219 char **xattrs;
220};
221
222/* struct aa_profile - basic confinement data
223 * @base - base components of the profile (name, refcount, lists, lock ...)
224 * @parent: parent of profile
225 * @ns: namespace the profile is in
226 * @rename: optional profile name that this profile renamed
227 *
228 * @audit: the auditing mode of the profile
229 * @mode: the enforcement mode of the profile
230 * @path_flags: flags controlling path generation behavior
231 * @signal: the signal that should be used when kill is used
232 * @disconnected: what to prepend if attach_disconnected is specified
233 * @attach: attachment rules for the profile
234 * @rules: rules to be enforced
235 *
236 * learning_cache: the accesses learned in complain mode
237 * raw_data: rawdata of the loaded profile policy
238 * hash: cryptographic hash of the profile
239 * @dents: dentries for the profiles file entries in apparmorfs
240 * @dirname: name of the profile dir in apparmorfs
241 * @dents: set of dentries associated with the profile
242 * @data: hashtable for free-form policy aa_data
243 * @label - label this profile is an extension of
244 * @rules - label with the rule vec on its end
245 *
246 * The AppArmor profile contains the basic confinement data. Each profile
247 * has a name, and exists in a namespace. The @name and @exec_match are
248 * used to determine profile attachment against unconfined tasks. All other
249 * attachments are determined by profile X transition rules.
250 *
251 * Profiles have a hierarchy where hats and children profiles keep
252 * a reference to their parent.
253 *
254 * Profile names can not begin with a : and can not contain the \0
255 * character. If a profile name begins with / it will be considered when
256 * determining profile attachment on "unconfined" tasks.
257 */
258struct aa_profile {
259 struct aa_policy base;
260 struct aa_profile __rcu *parent;
261
262 struct aa_ns *ns;
263 const char *rename;
264
265 enum audit_mode audit;
266 long mode;
267 u32 path_flags;
268 int signal;
269 const char *disconnected;
270
271 struct aa_attachment attach;
272
273 struct aa_loaddata *rawdata;
274 unsigned char *hash;
275 char *dirname;
276 struct dentry *dents[AAFS_PROF_SIZEOF];
277 struct rhashtable *data;
278
279 int n_rules;
280 /* special - variable length must be last entry in profile */
281 struct aa_label label;
282};
283
284extern enum profile_mode aa_g_profile_mode;
285
286#define AA_MAY_LOAD_POLICY AA_MAY_APPEND
287#define AA_MAY_REPLACE_POLICY AA_MAY_WRITE
288#define AA_MAY_REMOVE_POLICY AA_MAY_DELETE
289
290#define profiles_ns(P) ((P)->ns)
291#define name_is_shared(A, B) ((A)->hname && (A)->hname == (B)->hname)
292
293struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp);
294struct aa_profile *aa_alloc_profile(const char *name, struct aa_proxy *proxy,
295 gfp_t gfp);
296struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
297 gfp_t gfp);
298struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
299 const char *base, gfp_t gfp);
300void aa_free_profile(struct aa_profile *profile);
301struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name);
302struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
303 size_t n);
304struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
305 const char *fqname, size_t n);
306
307ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_label *label,
308 u32 mask, struct aa_loaddata *udata);
309ssize_t aa_remove_profiles(struct aa_ns *view, struct aa_label *label,
310 char *name, size_t size);
311void __aa_profile_list_release(struct list_head *head);
312
313#define profile_unconfined(X) ((X)->mode == APPARMOR_UNCONFINED)
314
315/**
316 * aa_get_newest_profile - simple wrapper fn to wrap the label version
317 * @p: profile (NOT NULL)
318 *
319 * Returns refcount to newest version of the profile (maybe @p)
320 *
321 * Requires: @p must be held with a valid refcount
322 */
323static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p)
324{
325 return labels_profile(aa_get_newest_label(&p->label));
326}
327
328static inline aa_state_t RULE_MEDIATES(struct aa_ruleset *rules,
329 unsigned char class)
330{
331 if (class <= AA_CLASS_LAST)
332 return rules->policy->start[class];
333 else
334 return aa_dfa_match_len(rules->policy->dfa,
335 rules->policy->start[0], &class, 1);
336}
337
338static inline aa_state_t RULE_MEDIATES_v9NET(struct aa_ruleset *rules)
339{
340 return RULE_MEDIATES(rules, AA_CLASS_NETV9);
341}
342
343static inline aa_state_t RULE_MEDIATES_NET(struct aa_ruleset *rules)
344{
345 /* can not use RULE_MEDIATE_v9AF here, because AF match fail
346 * can not be distiguished from class match fail, and we only
347 * fallback to checking older class on class match failure
348 */
349 aa_state_t state = RULE_MEDIATES(rules, AA_CLASS_NETV9);
350
351 /* fallback and check v7/8 if v9 is NOT mediated */
352 if (!state)
353 state = RULE_MEDIATES(rules, AA_CLASS_NET);
354
355 return state;
356}
357
358
359void aa_compute_profile_mediates(struct aa_profile *profile);
360static inline bool profile_mediates(struct aa_profile *profile,
361 unsigned char class)
362{
363 return label_mediates(&profile->label, class);
364}
365
366static inline bool profile_mediates_safe(struct aa_profile *profile,
367 unsigned char class)
368{
369 return label_mediates_safe(&profile->label, class);
370}
371
372/**
373 * aa_get_profile - increment refcount on profile @p
374 * @p: profile (MAYBE NULL)
375 *
376 * Returns: pointer to @p if @p is NULL will return NULL
377 * Requires: @p must be held with valid refcount when called
378 */
379static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
380{
381 if (p)
382 kref_get(&(p->label.count.count));
383
384 return p;
385}
386
387/**
388 * aa_get_profile_not0 - increment refcount on profile @p found via lookup
389 * @p: profile (MAYBE NULL)
390 *
391 * Returns: pointer to @p if @p is NULL will return NULL
392 * Requires: @p must be held with valid refcount when called
393 */
394static inline struct aa_profile *aa_get_profile_not0(struct aa_profile *p)
395{
396 if (p && kref_get_unless_zero(&p->label.count.count))
397 return p;
398
399 return NULL;
400}
401
402/**
403 * aa_get_profile_rcu - increment a refcount profile that can be replaced
404 * @p: pointer to profile that can be replaced (NOT NULL)
405 *
406 * Returns: pointer to a refcounted profile.
407 * else NULL if no profile
408 */
409static inline struct aa_profile *aa_get_profile_rcu(struct aa_profile __rcu **p)
410{
411 struct aa_profile *c;
412
413 rcu_read_lock();
414 do {
415 c = rcu_dereference(*p);
416 } while (c && !kref_get_unless_zero(&c->label.count.count));
417 rcu_read_unlock();
418
419 return c;
420}
421
422/**
423 * aa_put_profile - decrement refcount on profile @p
424 * @p: profile (MAYBE NULL)
425 */
426static inline void aa_put_profile(struct aa_profile *p)
427{
428 if (p)
429 kref_put(&p->label.count.count, aa_label_kref);
430}
431
432static inline int AUDIT_MODE(struct aa_profile *profile)
433{
434 if (aa_g_audit != AUDIT_NORMAL)
435 return aa_g_audit;
436
437 return profile->audit;
438}
439
440bool aa_policy_view_capable(const struct cred *subj_cred,
441 struct aa_label *label, struct aa_ns *ns);
442bool aa_policy_admin_capable(const struct cred *subj_cred,
443 struct aa_label *label, struct aa_ns *ns);
444int aa_may_manage_policy(const struct cred *subj_cred,
445 struct aa_label *label, struct aa_ns *ns,
446 const struct cred *ocred, u32 mask);
447bool aa_current_policy_view_capable(struct aa_ns *ns);
448bool aa_current_policy_admin_capable(struct aa_ns *ns);
449
450#endif /* __AA_POLICY_H */