Thomas Gleixner | b886d83c | 2019-06-01 10:08:55 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0-only |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 2 | /* |
| 3 | * AppArmor security module |
| 4 | * |
| 5 | * This file contains AppArmor /proc/<pid>/attr/ interface functions |
| 6 | * |
| 7 | * Copyright (C) 1998-2008 Novell/SUSE |
| 8 | * Copyright 2009-2010 Canonical Ltd. |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 9 | */ |
| 10 | |
| 11 | #include "include/apparmor.h" |
John Johansen | d8889d4 | 2017-10-11 01:04:48 -0700 | [diff] [blame] | 12 | #include "include/cred.h" |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 13 | #include "include/policy.h" |
John Johansen | cff281f | 2017-01-16 00:42:15 -0800 | [diff] [blame] | 14 | #include "include/policy_ns.h" |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 15 | #include "include/domain.h" |
James Morris | cc7db09 | 2011-08-29 11:45:44 +1000 | [diff] [blame] | 16 | #include "include/procattr.h" |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 17 | |
| 18 | |
| 19 | /** |
| 20 | * aa_getprocattr - Return the profile information for @profile |
| 21 | * @profile: the profile to print profile info about (NOT NULL) |
| 22 | * @string: Returns - string containing the profile info (NOT NULL) |
| 23 | * |
| 24 | * Returns: length of @string on success else error on failure |
| 25 | * |
| 26 | * Requires: profile != NULL |
| 27 | * |
| 28 | * Creates a string containing the namespace_name://profile_name for |
| 29 | * @profile. |
| 30 | * |
| 31 | * Returns: size of string placed in @string else error code on failure |
| 32 | */ |
John Johansen | 76a1d26 | 2017-06-09 12:47:17 -0700 | [diff] [blame] | 33 | int aa_getprocattr(struct aa_label *label, char **string) |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 34 | { |
John Johansen | 76a1d26 | 2017-06-09 12:47:17 -0700 | [diff] [blame] | 35 | struct aa_ns *ns = labels_ns(label); |
John Johansen | cf797c0 | 2017-06-09 02:08:28 -0700 | [diff] [blame] | 36 | struct aa_ns *current_ns = aa_get_current_ns(); |
John Johansen | 76a1d26 | 2017-06-09 12:47:17 -0700 | [diff] [blame] | 37 | int len; |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 38 | |
John Johansen | 76a1d26 | 2017-06-09 12:47:17 -0700 | [diff] [blame] | 39 | if (!aa_ns_visible(current_ns, ns, true)) { |
| 40 | aa_put_ns(current_ns); |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 41 | return -EACCES; |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 42 | } |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 43 | |
John Johansen | 76a1d26 | 2017-06-09 12:47:17 -0700 | [diff] [blame] | 44 | len = aa_label_snxprint(NULL, 0, current_ns, label, |
| 45 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
| 46 | FLAG_HIDDEN_UNCONFINED); |
| 47 | AA_BUG(len < 0); |
| 48 | |
| 49 | *string = kmalloc(len + 2, GFP_KERNEL); |
| 50 | if (!*string) { |
| 51 | aa_put_ns(current_ns); |
| 52 | return -ENOMEM; |
| 53 | } |
| 54 | |
| 55 | len = aa_label_snxprint(*string, len + 2, current_ns, label, |
| 56 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
| 57 | FLAG_HIDDEN_UNCONFINED); |
| 58 | if (len < 0) { |
| 59 | aa_put_ns(current_ns); |
| 60 | return len; |
| 61 | } |
| 62 | |
| 63 | (*string)[len] = '\n'; |
| 64 | (*string)[len + 1] = 0; |
| 65 | |
| 66 | aa_put_ns(current_ns); |
| 67 | return len + 1; |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 68 | } |
| 69 | |
| 70 | /** |
| 71 | * split_token_from_name - separate a string of form <token>^<name> |
| 72 | * @op: operation being checked |
| 73 | * @args: string to parse (NOT NULL) |
| 74 | * @token: stores returned parsed token value (NOT NULL) |
| 75 | * |
| 76 | * Returns: start position of name after token else NULL on failure |
| 77 | */ |
John Johansen | 47f6e5c | 2017-01-16 00:43:01 -0800 | [diff] [blame] | 78 | static char *split_token_from_name(const char *op, char *args, u64 *token) |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 79 | { |
| 80 | char *name; |
| 81 | |
| 82 | *token = simple_strtoull(args, &name, 16); |
| 83 | if ((name == args) || *name != '^') { |
John Johansen | 47f6e5c | 2017-01-16 00:43:01 -0800 | [diff] [blame] | 84 | AA_ERROR("%s: Invalid input '%s'", op, args); |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 85 | return ERR_PTR(-EINVAL); |
| 86 | } |
| 87 | |
| 88 | name++; /* skip ^ */ |
| 89 | if (!*name) |
| 90 | name = NULL; |
| 91 | return name; |
| 92 | } |
| 93 | |
| 94 | /** |
| 95 | * aa_setprocattr_chagnehat - handle procattr interface to change_hat |
| 96 | * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL) |
| 97 | * @size: size of the args |
John Johansen | df8073c | 2017-06-09 11:36:48 -0700 | [diff] [blame] | 98 | * @flags: set of flags governing behavior |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 99 | * |
| 100 | * Returns: %0 or error code if change_hat fails |
| 101 | */ |
John Johansen | df8073c | 2017-06-09 11:36:48 -0700 | [diff] [blame] | 102 | int aa_setprocattr_changehat(char *args, size_t size, int flags) |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 103 | { |
| 104 | char *hat; |
| 105 | u64 token; |
| 106 | const char *hats[16]; /* current hard limit on # of names */ |
| 107 | int count = 0; |
| 108 | |
| 109 | hat = split_token_from_name(OP_CHANGE_HAT, args, &token); |
| 110 | if (IS_ERR(hat)) |
| 111 | return PTR_ERR(hat); |
| 112 | |
| 113 | if (!hat && !token) { |
| 114 | AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic"); |
| 115 | return -EINVAL; |
| 116 | } |
| 117 | |
| 118 | if (hat) { |
| 119 | /* set up hat name vector, args guaranteed null terminated |
| 120 | * at args[size] by setprocattr. |
| 121 | * |
| 122 | * If there are multiple hat names in the buffer each is |
| 123 | * separated by a \0. Ie. userspace writes them pre tokenized |
| 124 | */ |
| 125 | char *end = args + size; |
| 126 | for (count = 0; (hat < end) && count < 16; ++count) { |
| 127 | char *next = hat + strlen(hat) + 1; |
| 128 | hats[count] = hat; |
John Johansen | c3e1e58 | 2017-01-16 00:43:05 -0800 | [diff] [blame] | 129 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n" |
| 130 | , __func__, current->pid, token, count, hat); |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 131 | hat = next; |
| 132 | } |
John Johansen | c3e1e58 | 2017-01-16 00:43:05 -0800 | [diff] [blame] | 133 | } else |
| 134 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n", |
| 135 | __func__, current->pid, token, count, "<NULL>"); |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 136 | |
John Johansen | df8073c | 2017-06-09 11:36:48 -0700 | [diff] [blame] | 137 | return aa_change_hat(hats, count, token, flags); |
John Johansen | 63e2b42 | 2010-07-29 14:48:03 -0700 | [diff] [blame] | 138 | } |