1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains AppArmor task related definitions and mediation
7 * Copyright 2017 Canonical Ltd.
10 * If a task uses change_hat it currently does not return to the old
11 * cred or task context but instead creates a new one. Ideally the task
12 * should return to the previous cred if it has not been modified.
15 #include <linux/gfp.h>
16 #include <linux/ptrace.h>
18 #include "include/audit.h"
19 #include "include/cred.h"
20 #include "include/policy.h"
21 #include "include/task.h"
24 * aa_get_task_label - Get another task's label
25 * @task: task to query (NOT NULL)
27 * Returns: counted reference to @task's label
29 struct aa_label *aa_get_task_label(struct task_struct *task)
34 p = aa_get_newest_cred_label(__task_cred(task));
41 * aa_replace_current_label - replace the current tasks label
42 * @label: new label (NOT NULL)
44 * Returns: 0 or error on failure
46 int aa_replace_current_label(struct aa_label *label)
48 struct aa_label *old = aa_current_raw_label();
49 struct aa_task_ctx *ctx = task_ctx(current);
57 if (current_cred() != current_real_cred())
60 new = prepare_creds();
64 if (ctx->nnp && label_is_stale(ctx->nnp)) {
65 struct aa_label *tmp = ctx->nnp;
67 ctx->nnp = aa_get_newest_label(tmp);
70 if (unconfined(label) || (labels_ns(old) != labels_ns(label)))
72 * if switching to unconfined or a different label namespace
73 * clear out context state
75 aa_clear_task_ctx_trans(task_ctx(current));
78 * be careful switching cred label, when racing replacement it
79 * is possible that the cred labels's->proxy->label is the reference
80 * keeping @label valid, so make sure to get its reference before
81 * dropping the reference on the cred's label
84 aa_put_label(cred_label(new));
85 set_cred_label(new, label);
93 * aa_set_current_onexec - set the tasks change_profile to happen onexec
94 * @label: system label to set at exec (MAYBE NULL to clear value)
95 * @stack: whether stacking should be done
96 * Returns: 0 or error on failure
98 int aa_set_current_onexec(struct aa_label *label, bool stack)
100 struct aa_task_ctx *ctx = task_ctx(current);
103 aa_put_label(ctx->onexec);
111 * aa_set_current_hat - set the current tasks hat
112 * @label: label to set as the current hat (NOT NULL)
113 * @token: token value that must be specified to change from the hat
115 * Do switch of tasks hat. If the task is currently in a hat
116 * validate the token to match.
118 * Returns: 0 or error on failure
120 int aa_set_current_hat(struct aa_label *label, u64 token)
122 struct aa_task_ctx *ctx = task_ctx(current);
125 new = prepare_creds();
130 if (!ctx->previous) {
131 /* transfer refcount */
132 ctx->previous = cred_label(new);
134 } else if (ctx->token == token) {
135 aa_put_label(cred_label(new));
137 /* previous_profile && ctx->token != token */
142 set_cred_label(new, aa_get_newest_label(label));
143 /* clear exec on switching context */
144 aa_put_label(ctx->onexec);
152 * aa_restore_previous_label - exit from hat context restoring previous label
153 * @token: the token that must be matched to exit hat context
155 * Attempt to return out of a hat to the previous label. The token
156 * must match the stored token value.
158 * Returns: 0 or error of failure
160 int aa_restore_previous_label(u64 token)
162 struct aa_task_ctx *ctx = task_ctx(current);
165 if (ctx->token != token)
167 /* ignore restores when there is no saved label */
171 new = prepare_creds();
175 aa_put_label(cred_label(new));
176 set_cred_label(new, aa_get_newest_label(ctx->previous));
177 AA_BUG(!cred_label(new));
178 /* clear exec && prev information when restoring to previous context */
179 aa_clear_task_ctx_trans(ctx);
187 * audit_ptrace_mask - convert mask to permission string
188 * @mask: permission mask to convert
190 * Returns: pointer to static string
192 static const char *audit_ptrace_mask(u32 mask)
201 case AA_MAY_BE_TRACED:
207 /* call back to audit ptrace fields */
208 static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
210 struct common_audit_data *sa = va;
211 struct apparmor_audit_data *ad = aad(sa);
213 if (ad->request & AA_PTRACE_PERM_MASK) {
214 audit_log_format(ab, " requested_mask=\"%s\"",
215 audit_ptrace_mask(ad->request));
217 if (ad->denied & AA_PTRACE_PERM_MASK) {
218 audit_log_format(ab, " denied_mask=\"%s\"",
219 audit_ptrace_mask(ad->denied));
222 audit_log_format(ab, " peer=");
223 aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
224 FLAGS_NONE, GFP_ATOMIC);
227 /* assumes check for RULE_MEDIATES is already done */
228 /* TODO: conditionals */
229 static int profile_ptrace_perm(const struct cred *cred,
230 struct aa_profile *profile,
231 struct aa_label *peer, u32 request,
232 struct apparmor_audit_data *ad)
234 struct aa_ruleset *rules = list_first_entry(&profile->rules,
235 typeof(*rules), list);
236 struct aa_perms perms = { };
238 ad->subj_cred = cred;
240 aa_profile_match_label(profile, rules, peer, AA_CLASS_PTRACE, request,
242 aa_apply_modes_to_perms(profile, &perms);
243 return aa_check_perms(profile, &perms, request, ad, audit_ptrace_cb);
246 static int profile_tracee_perm(const struct cred *cred,
247 struct aa_profile *tracee,
248 struct aa_label *tracer, u32 request,
249 struct apparmor_audit_data *ad)
251 if (profile_unconfined(tracee) || unconfined(tracer) ||
252 !ANY_RULE_MEDIATES(&tracee->rules, AA_CLASS_PTRACE))
255 return profile_ptrace_perm(cred, tracee, tracer, request, ad);
258 static int profile_tracer_perm(const struct cred *cred,
259 struct aa_profile *tracer,
260 struct aa_label *tracee, u32 request,
261 struct apparmor_audit_data *ad)
263 if (profile_unconfined(tracer))
266 if (ANY_RULE_MEDIATES(&tracer->rules, AA_CLASS_PTRACE))
267 return profile_ptrace_perm(cred, tracer, tracee, request, ad);
269 /* profile uses the old style capability check for ptrace */
270 if (&tracer->label == tracee)
273 ad->subj_label = &tracer->label;
276 ad->error = aa_capable(cred, &tracer->label, CAP_SYS_PTRACE,
279 return aa_audit(AUDIT_APPARMOR_AUTO, tracer, ad, audit_ptrace_cb);
283 * aa_may_ptrace - test if tracer task can trace the tracee
284 * @tracer: label of the task doing the tracing (NOT NULL)
285 * @tracee: task label to be traced
286 * @request: permission request
288 * Returns: %0 else error code if permission denied or error
290 int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer,
291 const struct cred *tracee_cred, struct aa_label *tracee,
294 struct aa_profile *profile;
295 u32 xrequest = request << PTRACE_PERM_SHIFT;
296 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_PTRACE, OP_PTRACE);
298 return xcheck_labels(tracer, tracee, profile,
299 profile_tracer_perm(tracer_cred, profile, tracee,
301 profile_tracee_perm(tracee_cred, profile, tracer,