apparmor: handle idmapped mounts

The i_uid and i_gid are mostly used when logging for AppArmor. This is
broken in a bunch of places where the global root id is reported instead
of the i_uid or i_gid of the file. Nonetheless, be kind and log the
mapped inode if we're coming from an idmapped mount. If the initial user
namespace is passed nothing changes so non-idmapped mounts will see
identical behavior as before.

Link: https://lore.kernel.org/r/20210121131959.646623-26-christian.brauner@ubuntu.com
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 16f184b..583680f 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -10,12 +10,14 @@
 
 #include <linux/errno.h>
 #include <linux/fdtable.h>
+#include <linux/fs.h>
 #include <linux/file.h>
 #include <linux/mount.h>
 #include <linux/syscalls.h>
 #include <linux/tracehook.h>
 #include <linux/personality.h>
 #include <linux/xattr.h>
+#include <linux/user_namespace.h>
 
 #include "include/audit.h"
 #include "include/apparmorfs.h"
@@ -858,8 +860,10 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm)
        const char *info = NULL;
        int error = 0;
        bool unsafe = false;
+       kuid_t i_uid = i_uid_into_mnt(file_mnt_user_ns(bprm->file),
+                                     file_inode(bprm->file));
        struct path_cond cond = {
-               file_inode(bprm->file)->i_uid,
+               i_uid,
                file_inode(bprm->file)->i_mode
        };
 
@@ -967,8 +971,7 @@ audit:
        error = fn_for_each(label, profile,
                        aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,
                                      bprm->filename, NULL, new,
-                                     file_inode(bprm->file)->i_uid, info,
-                                     error));
+                                     i_uid, info, error));
        aa_put_label(new);
        goto done;
 }

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 92acf9a..e1b7e93 100644 (file)
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -11,6 +11,8 @@
 #include <linux/tty.h>
 #include <linux/fdtable.h>
 #include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
 
 #include "include/apparmor.h"
 #include "include/audit.h"
@@ -509,7 +511,7 @@ static int __file_path_perm(const char *op, struct aa_label *label,
        struct aa_profile *profile;
        struct aa_perms perms = {};
        struct path_cond cond = {
-               .uid = file_inode(file)->i_uid,
+               .uid = i_uid_into_mnt(file_mnt_user_ns(file), file_inode(file)),
                .mode = file_inode(file)->i_mode
        };
        char *buffer;

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 1b0aba8..240a533 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -224,8 +224,10 @@ static int common_perm(const char *op, const struct path *path, u32 mask,
  */
 static int common_perm_cond(const char *op, const struct path *path, u32 mask)
 {
-       struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
-                                 d_backing_inode(path->dentry)->i_mode
+       struct user_namespace *mnt_userns = mnt_user_ns(path->mnt);
+       struct path_cond cond = {
+               i_uid_into_mnt(mnt_userns, d_backing_inode(path->dentry)),
+               d_backing_inode(path->dentry)->i_mode
        };
 
        if (!path_mediated_fs(path->dentry))
@@ -266,12 +268,13 @@ static int common_perm_rm(const char *op, const struct path *dir,
                          struct dentry *dentry, u32 mask)
 {
        struct inode *inode = d_backing_inode(dentry);
+       struct user_namespace *mnt_userns = mnt_user_ns(dir->mnt);
        struct path_cond cond = { };
 
        if (!inode || !path_mediated_fs(dentry))
                return 0;
 
-       cond.uid = inode->i_uid;
+       cond.uid = i_uid_into_mnt(mnt_userns, inode);
        cond.mode = inode->i_mode;
 
        return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
@@ -361,12 +364,14 @@ static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_d
 
        label = begin_current_label_crit_section();
        if (!unconfined(label)) {
+               struct user_namespace *mnt_userns = mnt_user_ns(old_dir->mnt);
                struct path old_path = { .mnt = old_dir->mnt,
                                         .dentry = old_dentry };
                struct path new_path = { .mnt = new_dir->mnt,
                                         .dentry = new_dentry };
-               struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
-                                         d_backing_inode(old_dentry)->i_mode
+               struct path_cond cond = {
+                       i_uid_into_mnt(mnt_userns, d_backing_inode(old_dentry)),
+                       d_backing_inode(old_dentry)->i_mode
                };
 
                error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0,
@@ -420,8 +425,12 @@ static int apparmor_file_open(struct file *file)
 
        label = aa_get_newest_cred_label(file->f_cred);
        if (!unconfined(label)) {
+               struct user_namespace *mnt_userns = file_mnt_user_ns(file);
                struct inode *inode = file_inode(file);
-               struct path_cond cond = { inode->i_uid, inode->i_mode };
+               struct path_cond cond = {
+                       i_uid_into_mnt(mnt_userns, inode),
+                       inode->i_mode
+               };
 
                error = aa_path_perm(OP_OPEN, label, &file->f_path, 0,
                                     aa_map_file_to_perms(file), &cond);