1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains AppArmor network mediation
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
11 #include "include/apparmor.h"
12 #include "include/audit.h"
13 #include "include/cred.h"
14 #include "include/label.h"
15 #include "include/net.h"
16 #include "include/policy.h"
17 #include "include/secid.h"
19 #include "net_names.h"
22 struct aa_sfs_entry aa_sfs_entry_network[] = {
23 AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK),
27 static const char * const net_mask_names[] = {
70 /* audit callback for net specific fields */
71 void audit_net_cb(struct audit_buffer *ab, void *va)
73 struct common_audit_data *sa = va;
74 struct apparmor_audit_data *ad = aad(sa);
76 if (address_family_names[sa->u.net->family])
77 audit_log_format(ab, " family=\"%s\"",
78 address_family_names[sa->u.net->family]);
80 audit_log_format(ab, " family=\"unknown(%d)\"",
82 if (sock_type_names[ad->net.type])
83 audit_log_format(ab, " sock_type=\"%s\"",
84 sock_type_names[ad->net.type]);
86 audit_log_format(ab, " sock_type=\"unknown(%d)\"",
88 audit_log_format(ab, " protocol=%d", ad->net.protocol);
90 if (ad->request & NET_PERMS_MASK) {
91 audit_log_format(ab, " requested_mask=");
92 aa_audit_perm_mask(ab, ad->request, NULL, 0,
93 net_mask_names, NET_PERMS_MASK);
95 if (ad->denied & NET_PERMS_MASK) {
96 audit_log_format(ab, " denied_mask=");
97 aa_audit_perm_mask(ab, ad->denied, NULL, 0,
98 net_mask_names, NET_PERMS_MASK);
102 audit_log_format(ab, " peer=");
103 aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
104 FLAGS_NONE, GFP_ATOMIC);
108 /* Generic af perm */
109 int aa_profile_af_perm(struct aa_profile *profile,
110 struct apparmor_audit_data *ad, u32 request, u16 family,
113 struct aa_ruleset *rules = list_first_entry(&profile->rules,
114 typeof(*rules), list);
115 struct aa_perms perms = { };
119 AA_BUG(family >= AF_MAX);
120 AA_BUG(type < 0 || type >= SOCK_MAX);
122 if (profile_unconfined(profile))
124 state = RULE_MEDIATES(rules, AA_CLASS_NET);
128 buffer[0] = cpu_to_be16(family);
129 buffer[1] = cpu_to_be16((u16) type);
130 state = aa_dfa_match_len(rules->policy.dfa, state, (char *) &buffer,
132 perms = *aa_lookup_perms(&rules->policy, state);
133 aa_apply_modes_to_perms(profile, &perms);
135 return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
138 int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
139 int type, int protocol)
141 struct aa_profile *profile;
142 DEFINE_AUDIT_NET(ad, op, NULL, family, type, protocol);
144 return fn_for_each_confined(label, profile,
145 aa_profile_af_perm(profile, &ad, request, family,
149 static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
152 struct aa_sk_ctx *ctx = SK_CTX(sk);
158 if (ctx->label != kernel_t && !unconfined(label)) {
159 struct aa_profile *profile;
160 DEFINE_AUDIT_SK(ad, op, sk);
162 error = fn_for_each_confined(label, profile,
163 aa_profile_af_sk_perm(profile, &ad, request, sk));
169 int aa_sk_perm(const char *op, u32 request, struct sock *sk)
171 struct aa_label *label;
175 AA_BUG(in_interrupt());
177 /* TODO: switch to begin_current_label ???? */
178 label = begin_current_label_crit_section();
179 error = aa_label_sk_perm(label, op, request, sk);
180 end_current_label_crit_section(label);
186 int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
193 return aa_label_sk_perm(label, op, request, sock->sk);
196 #ifdef CONFIG_NETWORK_SECMARK
197 static int apparmor_secmark_init(struct aa_secmark *secmark)
199 struct aa_label *label;
201 if (secmark->label[0] == '*') {
202 secmark->secid = AA_SECID_WILDCARD;
206 label = aa_label_strn_parse(&root_ns->unconfined->label,
207 secmark->label, strlen(secmark->label),
208 GFP_ATOMIC, false, false);
211 return PTR_ERR(label);
213 secmark->secid = label->secid;
218 static int aa_secmark_perm(struct aa_profile *profile, u32 request, u32 secid,
219 struct apparmor_audit_data *ad)
222 struct aa_perms perms = { };
223 struct aa_ruleset *rules = list_first_entry(&profile->rules,
224 typeof(*rules), list);
226 if (rules->secmark_count == 0)
229 for (i = 0; i < rules->secmark_count; i++) {
230 if (!rules->secmark[i].secid) {
231 ret = apparmor_secmark_init(&rules->secmark[i]);
236 if (rules->secmark[i].secid == secid ||
237 rules->secmark[i].secid == AA_SECID_WILDCARD) {
238 if (rules->secmark[i].deny)
239 perms.deny = ALL_PERMS_MASK;
241 perms.allow = ALL_PERMS_MASK;
243 if (rules->secmark[i].audit)
244 perms.audit = ALL_PERMS_MASK;
248 aa_apply_modes_to_perms(profile, &perms);
250 return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
253 int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
254 u32 secid, const struct sock *sk)
256 struct aa_profile *profile;
257 DEFINE_AUDIT_SK(ad, op, sk);
259 return fn_for_each_confined(label, profile,
260 aa_secmark_perm(profile, request, secid,