1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains basic common functions used in AppArmor
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
11 #include <linux/ctype.h>
13 #include <linux/slab.h>
14 #include <linux/string.h>
15 #include <linux/vmalloc.h>
17 #include "include/audit.h"
18 #include "include/apparmor.h"
19 #include "include/lib.h"
20 #include "include/perms.h"
21 #include "include/policy.h"
23 struct aa_perms nullperms;
24 struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
25 .quiet = ALL_PERMS_MASK,
26 .hide = ALL_PERMS_MASK };
29 * aa_split_fqname - split a fqname into a profile and namespace name
30 * @fqname: a full qualified name in namespace profile format (NOT NULL)
31 * @ns_name: pointer to portion of the string containing the ns name (NOT NULL)
33 * Returns: profile name or NULL if one is not specified
35 * Split a namespace name from a profile name (see policy.c for naming
36 * description). If a portion of the name is missing it returns NULL for
39 * NOTE: may modify the @fqname string. The pointers returned point
40 * into the @fqname string.
42 char *aa_split_fqname(char *fqname, char **ns_name)
44 char *name = strim(fqname);
48 char *split = strchr(&name[1], ':');
49 *ns_name = skip_spaces(&name[1]);
51 /* overwrite ':' with \0 */
53 if (strncmp(split, "//", 2) == 0)
55 name = skip_spaces(split);
57 /* a ns name without a following profile is allowed */
60 if (name && *name == 0)
67 * skipn_spaces - Removes leading whitespace from @str.
68 * @str: The string to be stripped.
70 * Returns a pointer to the first non-whitespace character in @str.
71 * if all whitespace will return NULL
74 const char *skipn_spaces(const char *str, size_t n)
76 for (; n && isspace(*str); --n)
83 const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
86 const char *end = fqname + n;
87 const char *name = skipn_spaces(fqname, n);
96 char *split = strnchr(&name[1], end - &name[1], ':');
97 *ns_name = skipn_spaces(&name[1], end - &name[1]);
101 *ns_len = split - *ns_name;
105 if (end - split > 1 && strncmp(split, "//", 2) == 0)
107 name = skipn_spaces(split, end - split);
109 /* a ns name without a following profile is allowed */
111 *ns_len = end - *ns_name;
114 if (name && *name == 0)
121 * aa_info_message - log a none profile related status message
122 * @str: message to log
124 void aa_info_message(const char *str)
127 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
129 aad(&sa)->info = str;
130 aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
132 printk(KERN_INFO "AppArmor: %s\n", str);
135 __counted char *aa_str_alloc(int size, gfp_t gfp)
137 struct counted_str *str;
139 str = kmalloc(struct_size(str, name, size), gfp);
143 kref_init(&str->count);
147 void aa_str_kref(struct kref *kref)
149 kfree(container_of(kref, struct counted_str, count));
153 const char aa_file_perm_chrs[] = "xwracd km l ";
154 const char *aa_file_perm_names[] = {
197 * aa_perm_mask_to_str - convert a perm mask to its short string
198 * @str: character buffer to store string in (at least 10 characters)
199 * @str_size: size of the @str buffer
200 * @chrs: NUL-terminated character buffer of permission characters
201 * @mask: permission mask to convert
203 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, u32 mask)
205 unsigned int i, perm = 1;
206 size_t num_chrs = strlen(chrs);
208 for (i = 0; i < num_chrs; perm <<= 1, i++) {
210 /* Ensure that one byte is left for NUL-termination */
211 if (WARN_ON_ONCE(str_size <= 1))
221 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
224 const char *fmt = "%s";
225 unsigned int i, perm = 1;
228 for (i = 0; i < 32; perm <<= 1, i++) {
230 audit_log_format(ab, fmt, names[i]);
239 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
240 u32 chrsmask, const char * const *names, u32 namesmask)
244 audit_log_format(ab, "\"");
245 if ((mask & chrsmask) && chrs) {
246 aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask);
248 audit_log_format(ab, "%s", str);
249 if (mask & namesmask)
250 audit_log_format(ab, " ");
252 if ((mask & namesmask) && names)
253 aa_audit_perm_names(ab, names, mask & namesmask);
254 audit_log_format(ab, "\"");
258 * aa_audit_perms_cb - generic callback fn for auditing perms
259 * @ab: audit buffer (NOT NULL)
260 * @va: audit struct to audit values of (NOT NULL)
262 static void aa_audit_perms_cb(struct audit_buffer *ab, void *va)
264 struct common_audit_data *sa = va;
266 if (aad(sa)->request) {
267 audit_log_format(ab, " requested_mask=");
268 aa_audit_perm_mask(ab, aad(sa)->request, aa_file_perm_chrs,
269 PERMS_CHRS_MASK, aa_file_perm_names,
272 if (aad(sa)->denied) {
273 audit_log_format(ab, "denied_mask=");
274 aa_audit_perm_mask(ab, aad(sa)->denied, aa_file_perm_chrs,
275 PERMS_CHRS_MASK, aa_file_perm_names,
278 audit_log_format(ab, " peer=");
279 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
280 FLAGS_NONE, GFP_ATOMIC);
284 * aa_apply_modes_to_perms - apply namespace and profile flags to perms
285 * @profile: that perms where computed from
286 * @perms: perms to apply mode modifiers to
288 * TODO: split into profile and ns based flags for when accumulating perms
290 void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
292 switch (AUDIT_MODE(profile)) {
294 perms->audit = ALL_PERMS_MASK;
302 case AUDIT_QUIET_DENIED:
303 perms->quiet = ALL_PERMS_MASK;
307 if (KILL_MODE(profile))
308 perms->kill = ALL_PERMS_MASK;
309 else if (COMPLAIN_MODE(profile))
310 perms->complain = ALL_PERMS_MASK;
313 * else if (PROMPT_MODE(profile))
314 * perms->prompt = ALL_PERMS_MASK;
318 static u32 map_other(u32 x)
320 return ((x & 0x3) << 8) | /* SETATTR/GETATTR */
321 ((x & 0x1c) << 18) | /* ACCEPT/BIND/LISTEN */
322 ((x & 0x60) << 19); /* SETOPT/GETOPT */
325 static u32 map_xbits(u32 x)
327 return ((x & 0x1) << 7) |
331 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
332 struct aa_perms *perms)
334 /* This mapping is convulated due to history.
335 * v1-v4: only file perms
336 * v5: added policydb which dropped in perm user conditional to
337 * gain new perm bits, but had to map around the xbits because
338 * the userspace compiler was still munging them.
339 * v9: adds using the xbits in policydb because the compiler now
340 * supports treating policydb permission bits different.
341 * Unfortunately there is not way to force auditing on the
342 * perms represented by the xbits
344 *perms = (struct aa_perms) {
345 .allow = dfa_user_allow(dfa, state) |
346 map_xbits(dfa_user_xbits(dfa, state)),
347 .audit = dfa_user_audit(dfa, state),
348 .quiet = dfa_user_quiet(dfa, state) |
349 map_xbits(dfa_other_xbits(dfa, state)),
352 /* for v5-v9 perm mapping in the policydb, the other set is used
353 * to extend the general perm set
355 perms->allow |= map_other(dfa_other_allow(dfa, state));
356 perms->audit |= map_other(dfa_other_audit(dfa, state));
357 perms->quiet |= map_other(dfa_other_quiet(dfa, state));
361 * aa_perms_accum_raw - accumulate perms with out masking off overlapping perms
362 * @accum - perms struct to accumulate into
363 * @addend - perms struct to add to @accum
365 void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend)
367 accum->deny |= addend->deny;
368 accum->allow &= addend->allow & ~addend->deny;
369 accum->audit |= addend->audit & addend->allow;
370 accum->quiet &= addend->quiet & ~addend->allow;
371 accum->kill |= addend->kill & ~addend->allow;
372 accum->stop |= addend->stop & ~addend->allow;
373 accum->complain |= addend->complain & ~addend->allow & ~addend->deny;
374 accum->cond |= addend->cond & ~addend->allow & ~addend->deny;
375 accum->hide &= addend->hide & ~addend->allow;
376 accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny;
380 * aa_perms_accum - accumulate perms, masking off overlapping perms
381 * @accum - perms struct to accumulate into
382 * @addend - perms struct to add to @accum
384 void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend)
386 accum->deny |= addend->deny;
387 accum->allow &= addend->allow & ~accum->deny;
388 accum->audit |= addend->audit & accum->allow;
389 accum->quiet &= addend->quiet & ~accum->allow;
390 accum->kill |= addend->kill & ~accum->allow;
391 accum->stop |= addend->stop & ~accum->allow;
392 accum->complain |= addend->complain & ~accum->allow & ~accum->deny;
393 accum->cond |= addend->cond & ~accum->allow & ~accum->deny;
394 accum->hide &= addend->hide & ~accum->allow;
395 accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny;
398 void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
399 int type, u32 request, struct aa_perms *perms)
401 /* TODO: doesn't yet handle extended types */
404 state = aa_dfa_next(profile->policy.dfa,
405 profile->policy.start[AA_CLASS_LABEL],
407 aa_label_match(profile, label, state, false, request, perms);
411 /* currently unused */
412 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
413 u32 request, int type, u32 *deny,
414 struct common_audit_data *sa)
416 struct aa_perms perms;
418 aad(sa)->label = &profile->label;
419 aad(sa)->peer = &target->label;
420 aad(sa)->request = request;
422 aa_profile_match_label(profile, &target->label, type, request, &perms);
423 aa_apply_modes_to_perms(profile, &perms);
424 *deny |= request & perms.deny;
425 return aa_check_perms(profile, &perms, request, sa, aa_audit_perms_cb);
429 * aa_check_perms - do audit mode selection based on perms set
430 * @profile: profile being checked
431 * @perms: perms computed for the request
432 * @request: requested perms
433 * @deny: Returns: explicit deny set
434 * @sa: initialized audit structure (MAY BE NULL if not auditing)
435 * @cb: callback fn for type specific fields (MAY BE NULL)
437 * Returns: 0 if permission else error code
439 * Note: profile audit modes need to be set before calling by setting the
440 * perm masks appropriately.
442 * If not auditing then complain mode is not enabled and the
443 * error code will indicate whether there was an explicit deny
444 * with a positive value.
446 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
447 u32 request, struct common_audit_data *sa,
448 void (*cb)(struct audit_buffer *, void *))
451 u32 denied = request & (~perms->allow | perms->deny);
453 if (likely(!denied)) {
454 /* mask off perms that are not being force audited */
455 request &= perms->audit;
459 type = AUDIT_APPARMOR_AUDIT;
464 if (denied & perms->kill)
465 type = AUDIT_APPARMOR_KILL;
466 else if (denied == (denied & perms->complain))
467 type = AUDIT_APPARMOR_ALLOWED;
469 type = AUDIT_APPARMOR_DENIED;
471 if (denied == (denied & perms->hide))
474 denied &= ~perms->quiet;
480 aad(sa)->label = &profile->label;
481 aad(sa)->request = request;
482 aad(sa)->denied = denied;
483 aad(sa)->error = error;
484 aa_audit_msg(type, sa, cb);
487 if (type == AUDIT_APPARMOR_ALLOWED)
495 * aa_policy_init - initialize a policy structure
496 * @policy: policy to initialize (NOT NULL)
497 * @prefix: prefix name if any is required. (MAYBE NULL)
498 * @name: name of the policy, init will make a copy of it (NOT NULL)
499 * @gfp: allocation mode
501 * Note: this fn creates a copy of strings passed in
503 * Returns: true if policy init successful
505 bool aa_policy_init(struct aa_policy *policy, const char *prefix,
506 const char *name, gfp_t gfp)
510 /* freed by policy_free */
512 hname = aa_str_alloc(strlen(prefix) + strlen(name) + 3, gfp);
514 sprintf(hname, "%s//%s", prefix, name);
516 hname = aa_str_alloc(strlen(name) + 1, gfp);
522 policy->hname = hname;
523 /* base.name is a substring of fqname */
524 policy->name = basename(policy->hname);
525 INIT_LIST_HEAD(&policy->list);
526 INIT_LIST_HEAD(&policy->profiles);
532 * aa_policy_destroy - free the elements referenced by @policy
533 * @policy: policy that is to have its elements freed (NOT NULL)
535 void aa_policy_destroy(struct aa_policy *policy)
537 AA_BUG(on_list_rcu(&policy->profiles));
538 AA_BUG(on_list_rcu(&policy->list));
540 /* don't free name as its a subset of hname */
541 aa_put_str(policy->hname);