1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains AppArmor mediation of files
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
12 #include <linux/mount.h>
13 #include <linux/namei.h>
14 #include <uapi/linux/mount.h>
16 #include "include/apparmor.h"
17 #include "include/audit.h"
18 #include "include/cred.h"
19 #include "include/domain.h"
20 #include "include/file.h"
21 #include "include/match.h"
22 #include "include/mount.h"
23 #include "include/path.h"
24 #include "include/policy.h"
27 static void audit_mnt_flags(struct audit_buffer *ab, unsigned long flags)
29 if (flags & MS_RDONLY)
30 audit_log_format(ab, "ro");
32 audit_log_format(ab, "rw");
33 if (flags & MS_NOSUID)
34 audit_log_format(ab, ", nosuid");
36 audit_log_format(ab, ", nodev");
37 if (flags & MS_NOEXEC)
38 audit_log_format(ab, ", noexec");
39 if (flags & MS_SYNCHRONOUS)
40 audit_log_format(ab, ", sync");
41 if (flags & MS_REMOUNT)
42 audit_log_format(ab, ", remount");
43 if (flags & MS_MANDLOCK)
44 audit_log_format(ab, ", mand");
45 if (flags & MS_DIRSYNC)
46 audit_log_format(ab, ", dirsync");
47 if (flags & MS_NOATIME)
48 audit_log_format(ab, ", noatime");
49 if (flags & MS_NODIRATIME)
50 audit_log_format(ab, ", nodiratime");
52 audit_log_format(ab, flags & MS_REC ? ", rbind" : ", bind");
54 audit_log_format(ab, ", move");
55 if (flags & MS_SILENT)
56 audit_log_format(ab, ", silent");
57 if (flags & MS_POSIXACL)
58 audit_log_format(ab, ", acl");
59 if (flags & MS_UNBINDABLE)
60 audit_log_format(ab, flags & MS_REC ? ", runbindable" :
62 if (flags & MS_PRIVATE)
63 audit_log_format(ab, flags & MS_REC ? ", rprivate" :
66 audit_log_format(ab, flags & MS_REC ? ", rslave" :
68 if (flags & MS_SHARED)
69 audit_log_format(ab, flags & MS_REC ? ", rshared" :
71 if (flags & MS_RELATIME)
72 audit_log_format(ab, ", relatime");
73 if (flags & MS_I_VERSION)
74 audit_log_format(ab, ", iversion");
75 if (flags & MS_STRICTATIME)
76 audit_log_format(ab, ", strictatime");
77 if (flags & MS_NOUSER)
78 audit_log_format(ab, ", nouser");
82 * audit_cb - call back for mount specific audit fields
83 * @ab: audit_buffer (NOT NULL)
84 * @va: audit struct to audit values of (NOT NULL)
86 static void audit_cb(struct audit_buffer *ab, void *va)
88 struct common_audit_data *sa = va;
89 struct apparmor_audit_data *ad = aad(sa);
92 audit_log_format(ab, " fstype=");
93 audit_log_untrustedstring(ab, ad->mnt.type);
95 if (ad->mnt.src_name) {
96 audit_log_format(ab, " srcname=");
97 audit_log_untrustedstring(ab, ad->mnt.src_name);
100 audit_log_format(ab, " trans=");
101 audit_log_untrustedstring(ab, ad->mnt.trans);
104 audit_log_format(ab, " flags=\"");
105 audit_mnt_flags(ab, ad->mnt.flags);
106 audit_log_format(ab, "\"");
109 audit_log_format(ab, " options=");
110 audit_log_untrustedstring(ab, ad->mnt.data);
115 * audit_mount - handle the auditing of mount operations
116 * @profile: the profile being enforced (NOT NULL)
117 * @op: operation being mediated (NOT NULL)
118 * @name: name of object being mediated (MAYBE NULL)
119 * @src_name: src_name of object being mediated (MAYBE_NULL)
120 * @type: type of filesystem (MAYBE_NULL)
121 * @trans: name of trans (MAYBE NULL)
122 * @flags: filesystem independent mount flags
123 * @data: filesystem mount flags
124 * @request: permissions requested
125 * @perms: the permissions computed for the request (NOT NULL)
126 * @info: extra information message (MAYBE NULL)
127 * @error: 0 if operation allowed else failure error code
129 * Returns: %0 or error on failure
131 static int audit_mount(struct aa_profile *profile, const char *op,
132 const char *name, const char *src_name,
133 const char *type, const char *trans,
134 unsigned long flags, const void *data, u32 request,
135 struct aa_perms *perms, const char *info, int error)
137 int audit_type = AUDIT_APPARMOR_AUTO;
138 DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_MOUNT, op);
140 if (likely(!error)) {
141 u32 mask = perms->audit;
143 if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
146 /* mask off perms that are not being force audited */
149 if (likely(!request))
151 audit_type = AUDIT_APPARMOR_AUDIT;
153 /* only report permissions that were denied */
154 request = request & ~perms->allow;
156 if (request & perms->kill)
157 audit_type = AUDIT_APPARMOR_KILL;
159 /* quiet known rejects, assumes quiet and kill do not overlap */
160 if ((request & perms->quiet) &&
161 AUDIT_MODE(profile) != AUDIT_NOQUIET &&
162 AUDIT_MODE(profile) != AUDIT_ALL)
163 request &= ~perms->quiet;
170 ad.mnt.src_name = src_name;
172 ad.mnt.trans = trans;
173 ad.mnt.flags = flags;
174 if (data && (perms->audit & AA_AUDIT_DATA))
179 return aa_audit(audit_type, profile, &ad, audit_cb);
183 * match_mnt_flags - Do an ordered match on mount flags
184 * @dfa: dfa to match against
185 * @state: state to start in
186 * @flags: mount flags to match against
188 * Mount flags are encoded as an ordered match. This is done instead of
189 * checking against a simple bitmask, to allow for logical operations
192 * Returns: next state after flags match
194 static aa_state_t match_mnt_flags(struct aa_dfa *dfa, aa_state_t state,
199 for (i = 0; i <= 31 ; ++i) {
200 if ((1 << i) & flags)
201 state = aa_dfa_next(dfa, state, i + 1);
207 static const char * const mnt_info_table[] = {
209 "failed mntpnt match",
210 "failed srcname match",
212 "failed flags match",
218 * Returns 0 on success else element that match failed in, this is the
219 * index into the mnt_info_table above
221 static int do_match_mnt(struct aa_policydb *policy, aa_state_t start,
222 const char *mntpnt, const char *devname,
223 const char *type, unsigned long flags,
224 void *data, bool binary, struct aa_perms *perms)
229 AA_BUG(!policy->dfa);
230 AA_BUG(!policy->perms);
233 state = aa_dfa_match(policy->dfa, start, mntpnt);
234 state = aa_dfa_null_transition(policy->dfa, state);
239 state = aa_dfa_match(policy->dfa, state, devname);
240 state = aa_dfa_null_transition(policy->dfa, state);
245 state = aa_dfa_match(policy->dfa, state, type);
246 state = aa_dfa_null_transition(policy->dfa, state);
250 state = match_mnt_flags(policy->dfa, state, flags);
253 *perms = *aa_lookup_perms(policy, state);
254 if (perms->allow & AA_MAY_MOUNT)
257 /* only match data if not binary and the DFA flags data is expected */
258 if (data && !binary && (perms->allow & AA_MNT_CONT_MATCH)) {
259 state = aa_dfa_null_transition(policy->dfa, state);
263 state = aa_dfa_match(policy->dfa, state, data);
266 *perms = *aa_lookup_perms(policy, state);
267 if (perms->allow & AA_MAY_MOUNT)
271 /* failed at perms check, don't confuse with flags match */
276 static int path_flags(struct aa_profile *profile, const struct path *path)
281 return profile->path_flags |
282 (S_ISDIR(path->dentry->d_inode->i_mode) ? PATH_IS_DIR : 0);
286 * match_mnt_path_str - handle path matching for mount
287 * @profile: the confining profile
288 * @mntpath: for the mntpnt (NOT NULL)
289 * @buffer: buffer to be used to lookup mntpath
290 * @devname: string for the devname/src_name (MAY BE NULL OR ERRPTR)
291 * @type: string for the dev type (MAYBE NULL)
292 * @flags: mount flags to match
293 * @data: fs mount data (MAYBE NULL)
294 * @binary: whether @data is binary
295 * @devinfo: error str if (IS_ERR(@devname))
297 * Returns: 0 on success else error
299 static int match_mnt_path_str(struct aa_profile *profile,
300 const struct path *mntpath, char *buffer,
301 const char *devname, const char *type,
302 unsigned long flags, void *data, bool binary,
305 struct aa_perms perms = { };
306 const char *mntpnt = NULL, *info = NULL;
307 struct aa_ruleset *rules = list_first_entry(&profile->rules,
308 typeof(*rules), list);
315 if (!RULE_MEDIATES(rules, AA_CLASS_MOUNT))
318 error = aa_path_name(mntpath, path_flags(profile, mntpath), buffer,
319 &mntpnt, &info, profile->disconnected);
322 if (IS_ERR(devname)) {
323 error = PTR_ERR(devname);
330 pos = do_match_mnt(&rules->policy,
331 rules->policy.start[AA_CLASS_MOUNT],
332 mntpnt, devname, type, flags, data, binary, &perms);
334 info = mnt_info_table[pos];
340 return audit_mount(profile, OP_MOUNT, mntpnt, devname, type, NULL,
341 flags, data, AA_MAY_MOUNT, &perms, info, error);
345 * match_mnt - handle path matching for mount
346 * @profile: the confining profile
347 * @path: for the mntpnt (NOT NULL)
348 * @buffer: buffer to be used to lookup mntpath
349 * @devpath: path devname/src_name (MAYBE NULL)
350 * @devbuffer: buffer to be used to lookup devname/src_name
351 * @type: string for the dev type (MAYBE NULL)
352 * @flags: mount flags to match
353 * @data: fs mount data (MAYBE NULL)
354 * @binary: whether @data is binary
356 * Returns: 0 on success else error
358 static int match_mnt(struct aa_profile *profile, const struct path *path,
359 char *buffer, const struct path *devpath, char *devbuffer,
360 const char *type, unsigned long flags, void *data,
363 const char *devname = NULL, *info = NULL;
364 struct aa_ruleset *rules = list_first_entry(&profile->rules,
365 typeof(*rules), list);
369 AA_BUG(devpath && !devbuffer);
371 if (!RULE_MEDIATES(rules, AA_CLASS_MOUNT))
375 error = aa_path_name(devpath, path_flags(profile, devpath),
376 devbuffer, &devname, &info,
377 profile->disconnected);
379 devname = ERR_PTR(error);
382 return match_mnt_path_str(profile, path, buffer, devname, type, flags,
386 int aa_remount(struct aa_label *label, const struct path *path,
387 unsigned long flags, void *data)
389 struct aa_profile *profile;
397 binary = path->dentry->d_sb->s_type->fs_flags & FS_BINARY_MOUNTDATA;
399 buffer = aa_get_buffer(false);
402 error = fn_for_each_confined(label, profile,
403 match_mnt(profile, path, buffer, NULL, NULL, NULL,
404 flags, data, binary));
405 aa_put_buffer(buffer);
410 int aa_bind_mount(struct aa_label *label, const struct path *path,
411 const char *dev_name, unsigned long flags)
413 struct aa_profile *profile;
414 char *buffer = NULL, *old_buffer = NULL;
415 struct path old_path;
421 if (!dev_name || !*dev_name)
424 flags &= MS_REC | MS_BIND;
426 error = kern_path(dev_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
430 buffer = aa_get_buffer(false);
431 old_buffer = aa_get_buffer(false);
433 if (!buffer || !old_buffer)
436 error = fn_for_each_confined(label, profile,
437 match_mnt(profile, path, buffer, &old_path, old_buffer,
438 NULL, flags, NULL, false));
440 aa_put_buffer(buffer);
441 aa_put_buffer(old_buffer);
447 int aa_mount_change_type(struct aa_label *label, const struct path *path,
450 struct aa_profile *profile;
457 /* These are the flags allowed by do_change_type() */
458 flags &= (MS_REC | MS_SILENT | MS_SHARED | MS_PRIVATE | MS_SLAVE |
461 buffer = aa_get_buffer(false);
464 error = fn_for_each_confined(label, profile,
465 match_mnt(profile, path, buffer, NULL, NULL, NULL,
466 flags, NULL, false));
467 aa_put_buffer(buffer);
472 int aa_move_mount(struct aa_label *label, const struct path *path,
473 const char *orig_name)
475 struct aa_profile *profile;
476 char *buffer = NULL, *old_buffer = NULL;
477 struct path old_path;
483 if (!orig_name || !*orig_name)
486 error = kern_path(orig_name, LOOKUP_FOLLOW, &old_path);
490 buffer = aa_get_buffer(false);
491 old_buffer = aa_get_buffer(false);
493 if (!buffer || !old_buffer)
495 error = fn_for_each_confined(label, profile,
496 match_mnt(profile, path, buffer, &old_path, old_buffer,
497 NULL, MS_MOVE, NULL, false));
499 aa_put_buffer(buffer);
500 aa_put_buffer(old_buffer);
506 int aa_new_mount(struct aa_label *label, const char *dev_name,
507 const struct path *path, const char *type, unsigned long flags,
510 struct aa_profile *profile;
511 char *buffer = NULL, *dev_buffer = NULL;
514 int requires_dev = 0;
515 struct path tmp_path, *dev_path = NULL;
521 struct file_system_type *fstype;
523 fstype = get_fs_type(type);
526 binary = fstype->fs_flags & FS_BINARY_MOUNTDATA;
527 requires_dev = fstype->fs_flags & FS_REQUIRES_DEV;
528 put_filesystem(fstype);
531 if (!dev_name || !*dev_name)
534 error = kern_path(dev_name, LOOKUP_FOLLOW, &tmp_path);
537 dev_path = &tmp_path;
541 buffer = aa_get_buffer(false);
547 dev_buffer = aa_get_buffer(false);
552 error = fn_for_each_confined(label, profile,
553 match_mnt(profile, path, buffer, dev_path, dev_buffer,
554 type, flags, data, binary));
556 error = fn_for_each_confined(label, profile,
557 match_mnt_path_str(profile, path, buffer, dev_name,
558 type, flags, data, binary, NULL));
562 aa_put_buffer(buffer);
563 aa_put_buffer(dev_buffer);
570 static int profile_umount(struct aa_profile *profile, const struct path *path,
573 struct aa_ruleset *rules = list_first_entry(&profile->rules,
574 typeof(*rules), list);
575 struct aa_perms perms = { };
576 const char *name = NULL, *info = NULL;
583 if (!RULE_MEDIATES(rules, AA_CLASS_MOUNT))
586 error = aa_path_name(path, path_flags(profile, path), buffer, &name,
587 &info, profile->disconnected);
591 state = aa_dfa_match(rules->policy.dfa,
592 rules->policy.start[AA_CLASS_MOUNT],
594 perms = *aa_lookup_perms(&rules->policy, state);
595 if (AA_MAY_UMOUNT & ~perms.allow)
599 return audit_mount(profile, OP_UMOUNT, name, NULL, NULL, NULL, 0, NULL,
600 AA_MAY_UMOUNT, &perms, info, error);
603 int aa_umount(struct aa_label *label, struct vfsmount *mnt, int flags)
605 struct aa_profile *profile;
608 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
613 buffer = aa_get_buffer(false);
617 error = fn_for_each_confined(label, profile,
618 profile_umount(profile, &path, buffer));
619 aa_put_buffer(buffer);
624 /* helper fn for transition on pivotroot
626 * Returns: label for transition or ERR_PTR. Does not return NULL
628 static struct aa_label *build_pivotroot(struct aa_profile *profile,
629 const struct path *new_path,
631 const struct path *old_path,
634 struct aa_ruleset *rules = list_first_entry(&profile->rules,
635 typeof(*rules), list);
636 const char *old_name, *new_name = NULL, *info = NULL;
637 const char *trans_name = NULL;
638 struct aa_perms perms = { };
646 if (profile_unconfined(profile) ||
647 !RULE_MEDIATES(rules, AA_CLASS_MOUNT))
648 return aa_get_newest_label(&profile->label);
650 error = aa_path_name(old_path, path_flags(profile, old_path),
651 old_buffer, &old_name, &info,
652 profile->disconnected);
655 error = aa_path_name(new_path, path_flags(profile, new_path),
656 new_buffer, &new_name, &info,
657 profile->disconnected);
662 state = aa_dfa_match(rules->policy.dfa,
663 rules->policy.start[AA_CLASS_MOUNT],
665 state = aa_dfa_null_transition(rules->policy.dfa, state);
666 state = aa_dfa_match(rules->policy.dfa, state, old_name);
667 perms = *aa_lookup_perms(&rules->policy, state);
669 if (AA_MAY_PIVOTROOT & perms.allow)
673 error = audit_mount(profile, OP_PIVOTROOT, new_name, old_name,
674 NULL, trans_name, 0, NULL, AA_MAY_PIVOTROOT,
675 &perms, info, error);
677 return ERR_PTR(error);
679 return aa_get_newest_label(&profile->label);
682 int aa_pivotroot(struct aa_label *label, const struct path *old_path,
683 const struct path *new_path)
685 struct aa_profile *profile;
686 struct aa_label *target = NULL;
687 char *old_buffer = NULL, *new_buffer = NULL, *info = NULL;
694 old_buffer = aa_get_buffer(false);
695 new_buffer = aa_get_buffer(false);
697 if (!old_buffer || !new_buffer)
699 target = fn_label_build(label, profile, GFP_KERNEL,
700 build_pivotroot(profile, new_path, new_buffer,
701 old_path, old_buffer));
703 info = "label build failed";
706 } else if (!IS_ERR(target)) {
707 error = aa_replace_current_label(target);
709 /* TODO: audit target */
710 aa_put_label(target);
713 aa_put_label(target);
715 /* already audited error */
716 error = PTR_ERR(target);
718 aa_put_buffer(old_buffer);
719 aa_put_buffer(new_buffer);
724 /* TODO: add back in auditing of new_name and old_name */
725 error = fn_for_each(label, profile,
726 audit_mount(profile, OP_PIVOTROOT, NULL /*new_name */,
729 0, NULL, AA_MAY_PIVOTROOT, &nullperms, info,