summaryrefslogtreecommitdiff
path: root/security/apparmor/policy.c
AgeCommit message (Collapse)AuthorFilesLines
2017-09-22apparmor: fix race condition in null profile creationJohn Johansen1-3/+11
There is a race when null- profile is being created between the initial lookup/creation of the profile and lock/addition of the profile. This could result in multiple version of a profile being added to the list which need to be removed/replaced. Since these are learning profile their is no affect on mediation. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-09-22apparmor: move new_null_profile to after profile lookup fns()John Johansen1-79/+79
new_null_profile will need to use some of the profile lookup fns() so move instead of doing forward fn declarations. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: switch from profiles to using labels on contextsJohn Johansen1-118/+90
Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: cleanup remove unused and not fully implemented profile renameJohn Johansen1-37/+2
Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: refactor updating profiles to the newest parentJohn Johansen1-4/+31
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: share profile name on replacementJohn Johansen1-0/+9
The profile names are the same, leverage this. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: fix policy load/remove semanticsJohn Johansen1-11/+11
The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add namespace lookup fns()John Johansen1-4/+6
Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: cleanup __find_child()John Johansen1-8/+8
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: provide finer control over policy managementJohn Johansen1-13/+22
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-08apparmor: rename apparmor file fns and data to indicate useJohn Johansen1-3/+3
prefixes are used for fns/data that are not static to apparmorfs.c with the prefixes being aafs - special magic apparmorfs for policy namespace data aa_sfs - for fns/data that go into securityfs aa_fs - for fns/data that may be used in the either of aafs or securityfs Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
2017-06-08apparmor: move to per loaddata files, instead of replicating in profilesJohn Johansen1-1/+45
The loaddata sets cover more than just a single profile and should be tracked at the ns level. Move the load data files under the namespace and reference the files from the profiles via a symlink. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
2017-04-07apparmor: fix invalid reference to index variable of iterator line 836John Johansen1-2/+4
Once the loop on lines 836-853 is complete and exits normally, ent is a pointer to the dummy list head value. The derefernces accessible from eg the goto fail on line 860 or the various goto fail_lock's afterwards thus seem incorrect. Reported-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-03-02sched/headers: Prepare to use <linux/rcuupdate.h> instead of ↵Ingo Molnar1-0/+1
<linux/rculist.h> in <linux/sched.h> We don't actually need the full rculist.h header in sched.h anymore, we will be able to include the smaller rcupdate.h header instead. But first update code that relied on the implicit header inclusion. Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-03-02sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>Ingo Molnar1-0/+1
Add #include <linux/cred.h> dependencies to all .c files rely on sched.h doing that for them. Note that even if the count where we need to add extra headers seems high, it's still a net win, because <linux/sched.h> is included in over 2,200 files ... Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mike Galbraith <efault@gmx.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-01-16apparmor: sysctl to enable unprivileged user ns AppArmor policy loadingTyler Hicks1-1/+0
If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: support querying extended trusted helper extra dataWilliam Hua1-0/+23
Allow a profile to carry extra data that can be queried via userspace. This provides a means to store extra data in a profile that a trusted helper can extract and use from live policy. Signed-off-by: William Hua <william.hua@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: change aad apparmor_audit_data macro to a fn macroJohn Johansen1-23/+19
The aad macro can replace aad strings when it is not intended to. Switch to a fn macro so it is only applied when intended. Also at the same time cleanup audit_data initialization by putting common boiler plate behind a macro, and dropping the gfp_t parameter which will become useless. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: change op from int to const char *John Johansen1-3/+4
Having ops be an integer that is an index into an op name table is awkward and brittle. Every op change requires an edit for both the op constant and a string in the table. Instead switch to using const strings directly, eliminating the need for the table that needs to be kept in sync. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename context abreviation cxt to the more standard ctxJohn Johansen1-1/+1
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: pass the subject profile into profile replace/removeJohn Johansen1-11/+14
This is just setup for new ns specific .load, .replace, .remove interface files. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: audit policy ns specified in policy loadJohn Johansen1-14/+40
Verify that profiles in a load set specify the same policy ns and audit the name of the policy ns that policy is being loaded for. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: allow introspecting the loaded policy pre internal transformJohn Johansen1-7/+7
Store loaded policy and allow introspecting it through apparmorfs. This has several uses from debugging, policy validation, and policy checkpoint and restore for containers. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add ns name to the audit data for policy loadsJohn Johansen1-10/+24
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add profile and ns params to aa_may_manage_policy()John Johansen1-12/+10
Policy management will be expanded beyond traditional unconfined root. This will require knowning the profile of the task doing the management and the ns view. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add ns being viewed as a param to policy_admin_capable()John Johansen1-3/+9
Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add ns being viewed as a param to policy_view_capable()John Johansen1-3/+22
Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available and checking that the user namespace level is the same as the policy ns level. This strict pairing will be relaxed once true support of user namespaces lands. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: allow specifying the profile doing the managementJohn Johansen1-11/+21
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: Make aa_remove_profile() callable from a different viewJohn Johansen1-3/+4
This is prep work for fs operations being able to remove namespaces. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add a default null dfaJohn Johansen1-0/+2
Instead of testing whether a given dfa exists in every code path, have a default null dfa that is used when loaded policy doesn't provide a dfa. This will let us get rid of special casing and avoid dereference bugs when special casing is missed. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: name null-XXX profiles after the executableJohn Johansen1-13/+40
When possible its better to name a learning profile after the missing profile in question. This allows for both more informative names and for profile reuse. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: pass gfp_t parameter into profile allocationJohn Johansen1-5/+6
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: refactor prepare_ns() and make usable from different viewsJohn Johansen1-2/+4
prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: pass gfp param into aa_policy_init()John Johansen1-1/+1
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename hname_tail to basenameJohn Johansen1-1/+1
Rename to the shorter and more familiar shell cmd name Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add fn to lookup profiles by fqnameJohn Johansen1-0/+29
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add strn version of lookup_profile fnJohn Johansen1-11/+25
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename replacedby to proxyJohn Johansen1-35/+35
Proxy is shorter and a better fit than replaceby, so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename PFLAG_INVALID to PFLAG_STALEJohn Johansen1-1/+1
Invalid does not convey the meaning of the flag anymore so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename namespace to ns to improve code line lengthsJohn Johansen1-16/+16
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: split apparmor policy namespaces code into its own fileJohn Johansen1-284/+14
Policy namespaces will be diverging from profile management and expanding so put it in its own file. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: split out shared policy_XXX fns to libJohn Johansen1-119/+4
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix module parameters can be changed after policy is lockedJohn Johansen1-1/+17
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement. split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter. Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix refcount race when finding a child profileJohn Johansen1-1/+3
When finding a child profile via an rcu critical section, the profile may be put and scheduled for deletion after the child is found but before its refcount is incremented. Protect against this by repeating the lookup if the profiles refcount is 0 and is one its way to deletion. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix audit full profile hname on successful loadJohn Johansen1-1/+1
Currently logging of a successful profile load only logs the basename of the profile. This can result in confusion when a child profile has the same name as the another profile in the set. Logging the hname will ensure there is no confusion. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix log failures for all profiles in a setJohn Johansen1-10/+19
currently only the profile that is causing the failure is logged. This makes it more confusing than necessary about which profiles loaded and which didn't. So make sure to log success and failure messages for all profiles in the set being loaded. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix put() parent ref after updating the active refJohn Johansen1-1/+1
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix replacement bug that adds new child to old parentJohn Johansen1-1/+1
When set atomic replacement is used and the parent is updated before the child, and the child did not exist in the old parent so there is no direct replacement then the new child is incorrectly added to the old parent. This results in the new parent not having the child(ren) that it should and the old parent when being destroyed asserting the following error. AppArmor: policy_destroy: internal error, policy '<profile/name>' still contains profiles Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix refcount bug in profile replacementJohn Johansen1-2/+2
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-10-16apparmor: fix memleak of the profile hashJohn Johansen1-0/+1
BugLink: http://bugs.launchpad.net/bugs/1235523 This fixes the following kmemleak trace: unreferenced object 0xffff8801e8c35680 (size 32): comm "apparmor_parser", pid 691, jiffies 4294895667 (age 13230.876s) hex dump (first 32 bytes): e0 d3 4e b5 ac 6d f4 ed 3f cb ee 48 1c fd 40 cf ..N..m..?..H..@. 5b cc e9 93 00 00 00 00 00 00 00 00 00 00 00 00 [............... backtrace: [<ffffffff817a97ee>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811ca9f3>] __kmalloc+0x103/0x290 [<ffffffff8138acbc>] aa_calc_profile_hash+0x6c/0x150 [<ffffffff8138074d>] aa_unpack+0x39d/0xd50 [<ffffffff8137eced>] aa_replace_profiles+0x3d/0xd80 [<ffffffff81376937>] profile_replace+0x37/0x50 [<ffffffff811e9f2d>] vfs_write+0xbd/0x1e0 [<ffffffff811ea96c>] SyS_write+0x4c/0xa0 [<ffffffff817ccb1d>] system_call_fastpath+0x1a/0x1f [<ffffffffffffffff>] 0xffffffffffffffff Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
generated by cgit v1.2.3 (git 2.39.0) at 2024-07-23 05:27:31 +0300