Updated AppArmor with a newer backported AppArmor release by UBports
This commit is contained in:
Nathan
@@ -4,7 +4,7 @@
|
||||
* This file contains AppArmor ipc mediation
|
||||
*
|
||||
* Copyright (C) 1998-2008 Novell/SUSE
|
||||
* Copyright 2009-2010 Canonical Ltd.
|
||||
* Copyright 2009-2013 Canonical Ltd.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License as
|
||||
@@ -20,98 +20,201 @@
|
||||
#include "include/context.h"
|
||||
#include "include/policy.h"
|
||||
#include "include/ipc.h"
|
||||
|
||||
/* call back to audit ptrace fields */
|
||||
static void audit_cb(struct audit_buffer *ab, void *va)
|
||||
{
|
||||
struct common_audit_data *sa = va;
|
||||
audit_log_format(ab, " target=");
|
||||
audit_log_untrustedstring(ab, sa->aad->target);
|
||||
}
|
||||
#include "include/sig_names.h"
|
||||
|
||||
/**
|
||||
* aa_audit_ptrace - do auditing for ptrace
|
||||
* @profile: profile being enforced (NOT NULL)
|
||||
* @target: profile being traced (NOT NULL)
|
||||
* @error: error condition
|
||||
*
|
||||
* Returns: %0 or error code
|
||||
* audit_ptrace_mask - convert mask to permission string
|
||||
* @buffer: buffer to write string to (NOT NULL)
|
||||
* @mask: permission mask to convert
|
||||
*/
|
||||
static int aa_audit_ptrace(struct aa_profile *profile,
|
||||
struct aa_profile *target, int error)
|
||||
static void audit_ptrace_mask(struct audit_buffer *ab, u32 mask)
|
||||
{
|
||||
struct common_audit_data sa;
|
||||
struct apparmor_audit_data aad = {0,};
|
||||
sa.type = LSM_AUDIT_DATA_NONE;
|
||||
sa.aad = &aad;
|
||||
aad.op = OP_PTRACE;
|
||||
aad.target = target;
|
||||
aad.error = error;
|
||||
switch (mask) {
|
||||
case MAY_READ:
|
||||
audit_log_string(ab, "read");
|
||||
break;
|
||||
case MAY_WRITE:
|
||||
audit_log_string(ab, "trace");
|
||||
break;
|
||||
case AA_MAY_BE_READ:
|
||||
audit_log_string(ab, "readby");
|
||||
break;
|
||||
case AA_MAY_BE_TRACED:
|
||||
audit_log_string(ab, "tracedby");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return aa_audit(AUDIT_APPARMOR_AUTO, profile, GFP_ATOMIC, &sa,
|
||||
audit_cb);
|
||||
/* call back to audit ptrace fields */
|
||||
static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
|
||||
{
|
||||
struct common_audit_data *sa = va;
|
||||
|
||||
if (aad(sa)->request & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " requested_mask=");
|
||||
audit_ptrace_mask(ab, aad(sa)->request);
|
||||
|
||||
if (aad(sa)->denied & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " denied_mask=");
|
||||
audit_ptrace_mask(ab, aad(sa)->denied);
|
||||
}
|
||||
}
|
||||
audit_log_format(ab, " peer=");
|
||||
audit_log_untrustedstring(ab, aad(sa)->target);
|
||||
}
|
||||
|
||||
/* TODO: conditionals */
|
||||
static int profile_ptrace_perm(struct aa_profile *profile,
|
||||
struct aa_profile *peer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
struct aa_perms perms;
|
||||
|
||||
/* need because of peer in cross check */
|
||||
if (profile_unconfined(profile) ||
|
||||
!PROFILE_MEDIATES(profile, AA_CLASS_PTRACE))
|
||||
return 0;
|
||||
|
||||
aad(sa)->target = peer->base.hname;
|
||||
aa_profile_match_label(profile, aa_peer_name(peer), AA_CLASS_PTRACE,
|
||||
&perms);
|
||||
aa_apply_modes_to_perms(profile, &perms);
|
||||
return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
static int cross_ptrace_perm(struct aa_profile *tracer,
|
||||
struct aa_profile *tracee, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE))
|
||||
return xcheck(profile_ptrace_perm(tracer, tracee, request, sa),
|
||||
profile_ptrace_perm(tracee, tracer,
|
||||
request << PTRACE_PERM_SHIFT,
|
||||
sa));
|
||||
/* policy uses the old style capability check for ptrace */
|
||||
if (profile_unconfined(tracer) || tracer == tracee)
|
||||
return 0;
|
||||
|
||||
aad(sa)->label = &tracer->label;
|
||||
aad(sa)->target = tracee->base.hname;
|
||||
aad(sa)->request = 0;
|
||||
aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE, 1);
|
||||
return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
/**
|
||||
* aa_may_ptrace - test if tracer task can trace the tracee
|
||||
* @tracer_task: task who will do the tracing (NOT NULL)
|
||||
* @tracer: profile of the task doing the tracing (NOT NULL)
|
||||
* @tracee: task to be traced
|
||||
* @mode: whether PTRACE_MODE_READ || PTRACE_MODE_ATTACH
|
||||
* @tracer: label of the task doing the tracing (NOT NULL)
|
||||
* @tracee: task label to be traced
|
||||
* @request: permission request
|
||||
*
|
||||
* Returns: %0 else error code if permission denied or error
|
||||
*/
|
||||
int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
|
||||
struct aa_profile *tracee, unsigned int mode)
|
||||
int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
|
||||
u32 request)
|
||||
{
|
||||
/* TODO: currently only based on capability, not extended ptrace
|
||||
* rules,
|
||||
* Test mode for PTRACE_MODE_READ || PTRACE_MODE_ATTACH
|
||||
*/
|
||||
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
|
||||
|
||||
if (unconfined(tracer) || tracer == tracee)
|
||||
return 0;
|
||||
/* log this capability request */
|
||||
return aa_capable(tracer_task, tracer, CAP_SYS_PTRACE, 1);
|
||||
return xcheck_labels_profiles(tracer, tracee, cross_ptrace_perm,
|
||||
request, &sa);
|
||||
}
|
||||
|
||||
|
||||
static inline int map_signal_num(int sig)
|
||||
{
|
||||
if (sig > SIGRTMAX)
|
||||
return SIGUNKNOWN;
|
||||
else if (sig >= SIGRTMIN)
|
||||
return sig - SIGRTMIN + 128; /* rt sigs mapped to 128 */
|
||||
else if (sig <= MAXMAPPED_SIG)
|
||||
return sig_map[sig];
|
||||
return SIGUNKNOWN;
|
||||
}
|
||||
|
||||
/**
|
||||
* aa_ptrace - do ptrace permission check and auditing
|
||||
* @tracer: task doing the tracing (NOT NULL)
|
||||
* @tracee: task being traced (NOT NULL)
|
||||
* @mode: ptrace mode either PTRACE_MODE_READ || PTRACE_MODE_ATTACH
|
||||
*
|
||||
* Returns: %0 else error code if permission denied or error
|
||||
* audit_file_mask - convert mask to permission string
|
||||
* @buffer: buffer to write string to (NOT NULL)
|
||||
* @mask: permission mask to convert
|
||||
*/
|
||||
int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
|
||||
unsigned int mode)
|
||||
static void audit_signal_mask(struct audit_buffer *ab, u32 mask)
|
||||
{
|
||||
/*
|
||||
* tracer can ptrace tracee when
|
||||
* - tracer is unconfined ||
|
||||
* - tracer is in complain mode
|
||||
* - tracer has rules allowing it to trace tracee currently this is:
|
||||
* - confined by the same profile ||
|
||||
* - tracer profile has CAP_SYS_PTRACE
|
||||
*/
|
||||
|
||||
struct aa_profile *tracer_p;
|
||||
/* cred released below */
|
||||
const struct cred *cred = get_task_cred(tracer);
|
||||
int error = 0;
|
||||
tracer_p = aa_cred_profile(cred);
|
||||
|
||||
if (!unconfined(tracer_p)) {
|
||||
/* lcred released below */
|
||||
const struct cred *lcred = get_task_cred(tracee);
|
||||
struct aa_profile *tracee_p = aa_cred_profile(lcred);
|
||||
|
||||
error = aa_may_ptrace(tracer, tracer_p, tracee_p, mode);
|
||||
error = aa_audit_ptrace(tracer_p, tracee_p, error);
|
||||
|
||||
put_cred(lcred);
|
||||
}
|
||||
put_cred(cred);
|
||||
|
||||
return error;
|
||||
if (mask & MAY_READ)
|
||||
audit_log_string(ab, "receive");
|
||||
if (mask & MAY_WRITE)
|
||||
audit_log_string(ab, "send");
|
||||
}
|
||||
|
||||
/**
|
||||
* audit_cb - call back for signal specific audit fields
|
||||
* @ab: audit_buffer (NOT NULL)
|
||||
* @va: audit struct to audit values of (NOT NULL)
|
||||
*/
|
||||
static void audit_signal_cb(struct audit_buffer *ab, void *va)
|
||||
{
|
||||
struct common_audit_data *sa = va;
|
||||
|
||||
if (aad(sa)->request & AA_SIGNAL_PERM_MASK) {
|
||||
audit_log_format(ab, " requested_mask=");
|
||||
audit_signal_mask(ab, aad(sa)->request);
|
||||
if (aad(sa)->denied & AA_SIGNAL_PERM_MASK) {
|
||||
audit_log_format(ab, " denied_mask=");
|
||||
audit_signal_mask(ab, aad(sa)->denied);
|
||||
}
|
||||
}
|
||||
if (aad(sa)->signal <= MAXMAPPED_SIG)
|
||||
audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]);
|
||||
else
|
||||
audit_log_format(ab, " signal=rtmin+%d",
|
||||
aad(sa)->signal - 128);
|
||||
audit_log_format(ab, " peer=");
|
||||
audit_log_untrustedstring(ab, aad(sa)->target);
|
||||
}
|
||||
|
||||
/* TODO: update to handle compound name&name2, conditionals */
|
||||
static void profile_match_signal(struct aa_profile *profile, const char *label,
|
||||
int signal, struct aa_perms *perms)
|
||||
{
|
||||
unsigned int state;
|
||||
if (profile->policy.dfa) {
|
||||
/* TODO: secondary cache check <profile, profile, perm> */
|
||||
state = aa_dfa_next(profile->policy.dfa,
|
||||
profile->policy.start[AA_CLASS_SIGNAL],
|
||||
signal);
|
||||
state = aa_dfa_match(profile->policy.dfa, state, label);
|
||||
aa_compute_perms(profile->policy.dfa, state, perms);
|
||||
} else
|
||||
memset(perms, 0, sizeof(*perms));
|
||||
}
|
||||
|
||||
static int profile_signal_perm(struct aa_profile *profile,
|
||||
struct aa_profile *peer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
struct aa_perms perms;
|
||||
|
||||
if (profile_unconfined(profile) ||
|
||||
!PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL))
|
||||
return 0;
|
||||
|
||||
aad(sa)->target = peer->base.hname;
|
||||
profile_match_signal(profile, aa_peer_name(peer), aad(sa)->signal,
|
||||
&perms);
|
||||
aa_apply_modes_to_perms(profile, &perms);
|
||||
return aa_check_perms(profile, &perms, request, sa, audit_signal_cb);
|
||||
}
|
||||
|
||||
static int aa_signal_cross_perm(struct aa_profile *sender,
|
||||
struct aa_profile *target,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
return xcheck(profile_signal_perm(sender, target, MAY_WRITE, sa),
|
||||
profile_signal_perm(target, sender, MAY_READ, sa));
|
||||
}
|
||||
|
||||
int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig)
|
||||
{
|
||||
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SIGNAL);
|
||||
aad(&sa)->signal = map_signal_num(sig);
|
||||
return xcheck_labels_profiles(sender, target, aa_signal_cross_perm,
|
||||
&sa);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user