1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * AppArmor security module 4 * 5 * This file contains AppArmor policy attachment and domain transitions 6 * 7 * Copyright (C) 2002-2008 Novell/SUSE 8 * Copyright 2009-2010 Canonical Ltd. 9 */ 10 11#include <linux/errno.h> 12#include <linux/fdtable.h> 13#include <linux/file.h> 14#include <linux/mount.h> 15#include <linux/syscalls.h> 16#include <linux/tracehook.h> 17#include <linux/personality.h> 18#include <linux/xattr.h> 19 20#include "include/audit.h" 21#include "include/apparmorfs.h" 22#include "include/cred.h" 23#include "include/domain.h" 24#include "include/file.h" 25#include "include/ipc.h" 26#include "include/match.h" 27#include "include/path.h" 28#include "include/policy.h" 29#include "include/policy_ns.h" 30 31/** 32 * aa_free_domain_entries - free entries in a domain table 33 * @domain: the domain table to free (MAYBE NULL) 34 */ 35void aa_free_domain_entries(struct aa_domain *domain) 36{ 37 int i; 38 if (domain) { 39 if (!domain->table) 40 return; 41 42 for (i = 0; i < domain->size; i++) 43 kfree_sensitive(domain->table[i]); 44 kfree_sensitive(domain->table); 45 domain->table = NULL; 46 } 47} 48 49/** 50 * may_change_ptraced_domain - check if can change profile on ptraced task 51 * @to_label: profile to change to (NOT NULL) 52 * @info: message if there is an error 53 * 54 * Check if current is ptraced and if so if the tracing task is allowed 55 * to trace the new domain 56 * 57 * Returns: %0 or error if change not allowed 58 */ 59static int may_change_ptraced_domain(struct aa_label *to_label, 60 const char **info) 61{ 62 struct task_struct *tracer; 63 struct aa_label *tracerl = NULL; 64 int error = 0; 65 66 rcu_read_lock(); 67 tracer = ptrace_parent(current); 68 if (tracer) 69 /* released below */ 70 tracerl = aa_get_task_label(tracer); 71 72 /* not ptraced */ 73 if (!tracer || unconfined(tracerl)) 74 goto out; 75 76 error = aa_may_ptrace(tracerl, to_label, PTRACE_MODE_ATTACH); 77 78out: 79 rcu_read_unlock(); 80 aa_put_label(tracerl); 81 82 if (error) 83 *info = "ptrace prevents transition"; 84 return error; 85} 86 87/**** TODO: dedup to aa_label_match - needs perm and dfa, merging 88 * specifically this is an exact copy of aa_label_match except 89 * aa_compute_perms is replaced with aa_compute_fperms 90 * and policy.dfa with file.dfa 91 ****/ 92/* match a profile and its associated ns component if needed 93 * Assumes visibility test has already been done. 94 * If a subns profile is not to be matched should be prescreened with 95 * visibility test. 96 */ 97static inline unsigned int match_component(struct aa_profile *profile, 98 struct aa_profile *tp, 99 bool stack, unsigned int state) 100{ 101 const char *ns_name; 102 103 if (stack) 104 state = aa_dfa_match(profile->file.dfa, state, "&"); 105 if (profile->ns == tp->ns) 106 return aa_dfa_match(profile->file.dfa, state, tp->base.hname); 107 108 /* try matching with namespace name and then profile */ 109 ns_name = aa_ns_name(profile->ns, tp->ns, true); 110 state = aa_dfa_match_len(profile->file.dfa, state, ":", 1); 111 state = aa_dfa_match(profile->file.dfa, state, ns_name); 112 state = aa_dfa_match_len(profile->file.dfa, state, ":", 1); 113 return aa_dfa_match(profile->file.dfa, state, tp->base.hname); 114} 115 116/** 117 * label_compound_match - find perms for full compound label 118 * @profile: profile to find perms for 119 * @label: label to check access permissions for 120 * @stack: whether this is a stacking request 121 * @start: state to start match in 122 * @subns: whether to do permission checks on components in a subns 123 * @request: permissions to request 124 * @perms: perms struct to set 125 * 126 * Returns: 0 on success else ERROR 127 * 128 * For the label A//&B//&C this does the perm match for A//&B//&C 129 * @perms should be preinitialized with allperms OR a previous permission 130 * check to be stacked. 131 */ 132static int label_compound_match(struct aa_profile *profile, 133 struct aa_label *label, bool stack, 134 unsigned int state, bool subns, u32 request, 135 struct aa_perms *perms) 136{ 137 struct aa_profile *tp; 138 struct label_it i; 139 struct path_cond cond = { }; 140 141 /* find first subcomponent that is visible */ 142 label_for_each(i, label, tp) { 143 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 144 continue; 145 state = match_component(profile, tp, stack, state); 146 if (!state) 147 goto fail; 148 goto next; 149 } 150 151 /* no component visible */ 152 *perms = allperms; 153 return 0; 154 155next: 156 label_for_each_cont(i, label, tp) { 157 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 158 continue; 159 state = aa_dfa_match(profile->file.dfa, state, "//&"); 160 state = match_component(profile, tp, false, state); 161 if (!state) 162 goto fail; 163 } 164 *perms = aa_compute_fperms(profile->file.dfa, state, &cond); 165 aa_apply_modes_to_perms(profile, perms); 166 if ((perms->allow & request) != request) 167 return -EACCES; 168 169 return 0; 170 171fail: 172 *perms = nullperms; 173 return -EACCES; 174} 175 176/** 177 * label_components_match - find perms for all subcomponents of a label 178 * @profile: profile to find perms for 179 * @label: label to check access permissions for 180 * @stack: whether this is a stacking request 181 * @start: state to start match in 182 * @subns: whether to do permission checks on components in a subns 183 * @request: permissions to request 184 * @perms: an initialized perms struct to add accumulation to 185 * 186 * Returns: 0 on success else ERROR 187 * 188 * For the label A//&B//&C this does the perm match for each of A and B and C 189 * @perms should be preinitialized with allperms OR a previous permission 190 * check to be stacked. 191 */ 192static int label_components_match(struct aa_profile *profile, 193 struct aa_label *label, bool stack, 194 unsigned int start, bool subns, u32 request, 195 struct aa_perms *perms) 196{ 197 struct aa_profile *tp; 198 struct label_it i; 199 struct aa_perms tmp; 200 struct path_cond cond = { }; 201 unsigned int state = 0; 202 203 /* find first subcomponent to test */ 204 label_for_each(i, label, tp) { 205 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 206 continue; 207 state = match_component(profile, tp, stack, start); 208 if (!state) 209 goto fail; 210 goto next; 211 } 212 213 /* no subcomponents visible - no change in perms */ 214 return 0; 215 216next: 217 tmp = aa_compute_fperms(profile->file.dfa, state, &cond); 218 aa_apply_modes_to_perms(profile, &tmp); 219 aa_perms_accum(perms, &tmp); 220 label_for_each_cont(i, label, tp) { 221 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 222 continue; 223 state = match_component(profile, tp, stack, start); 224 if (!state) 225 goto fail; 226 tmp = aa_compute_fperms(profile->file.dfa, state, &cond); 227 aa_apply_modes_to_perms(profile, &tmp); 228 aa_perms_accum(perms, &tmp); 229 } 230 231 if ((perms->allow & request) != request) 232 return -EACCES; 233 234 return 0; 235 236fail: 237 *perms = nullperms; 238 return -EACCES; 239} 240 241/** 242 * label_match - do a multi-component label match 243 * @profile: profile to match against (NOT NULL) 244 * @label: label to match (NOT NULL) 245 * @stack: whether this is a stacking request 246 * @state: state to start in 247 * @subns: whether to match subns components 248 * @request: permission request 249 * @perms: Returns computed perms (NOT NULL) 250 * 251 * Returns: the state the match finished in, may be the none matching state 252 */ 253static int label_match(struct aa_profile *profile, struct aa_label *label, 254 bool stack, unsigned int state, bool subns, u32 request, 255 struct aa_perms *perms) 256{ 257 int error; 258 259 *perms = nullperms; 260 error = label_compound_match(profile, label, stack, state, subns, 261 request, perms); 262 if (!error) 263 return error; 264 265 *perms = allperms; 266 return label_components_match(profile, label, stack, state, subns, 267 request, perms); 268} 269 270/******* end TODO: dedup *****/ 271 272/** 273 * change_profile_perms - find permissions for change_profile 274 * @profile: the current profile (NOT NULL) 275 * @target: label to transition to (NOT NULL) 276 * @stack: whether this is a stacking request 277 * @request: requested perms 278 * @start: state to start matching in 279 * 280 * 281 * Returns: permission set 282 * 283 * currently only matches full label A//&B//&C or individual components A, B, C 284 * not arbitrary combinations. Eg. A//&B, C 285 */ 286static int change_profile_perms(struct aa_profile *profile, 287 struct aa_label *target, bool stack, 288 u32 request, unsigned int start, 289 struct aa_perms *perms) 290{ 291 if (profile_unconfined(profile)) { 292 perms->allow = AA_MAY_CHANGE_PROFILE | AA_MAY_ONEXEC; 293 perms->audit = perms->quiet = perms->kill = 0; 294 return 0; 295 } 296 297 /* TODO: add profile in ns screening */ 298 return label_match(profile, target, stack, start, true, request, perms); 299} 300 301/** 302 * aa_xattrs_match - check whether a file matches the xattrs defined in profile 303 * @bprm: binprm struct for the process to validate 304 * @profile: profile to match against (NOT NULL) 305 * @state: state to start match in 306 * 307 * Returns: number of extended attributes that matched, or < 0 on error 308 */ 309static int aa_xattrs_match(const struct linux_binprm *bprm, 310 struct aa_profile *profile, unsigned int state) 311{ 312 int i; 313 ssize_t size; 314 struct dentry *d; 315 char *value = NULL; 316 int value_size = 0, ret = profile->xattr_count; 317 318 if (!bprm || !profile->xattr_count) 319 return 0; 320 might_sleep(); 321 322 /* transition from exec match to xattr set */ 323 state = aa_dfa_outofband_transition(profile->xmatch, state); 324 d = bprm->file->f_path.dentry; 325 326 for (i = 0; i < profile->xattr_count; i++) { 327 size = vfs_getxattr_alloc(d, profile->xattrs[i], &value, 328 value_size, GFP_KERNEL); 329 if (size >= 0) { 330 u32 perm; 331 332 /* 333 * Check the xattr presence before value. This ensure 334 * that not present xattr can be distinguished from a 0 335 * length value or rule that matches any value 336 */ 337 state = aa_dfa_null_transition(profile->xmatch, state); 338 /* Check xattr value */ 339 state = aa_dfa_match_len(profile->xmatch, state, value, 340 size); 341 perm = dfa_user_allow(profile->xmatch, state); 342 if (!(perm & MAY_EXEC)) { 343 ret = -EINVAL; 344 goto out; 345 } 346 } 347 /* transition to next element */ 348 state = aa_dfa_outofband_transition(profile->xmatch, state); 349 if (size < 0) { 350 /* 351 * No xattr match, so verify if transition to 352 * next element was valid. IFF so the xattr 353 * was optional. 354 */ 355 if (!state) { 356 ret = -EINVAL; 357 goto out; 358 } 359 /* don't count missing optional xattr as matched */ 360 ret--; 361 } 362 } 363 364out: 365 kfree(value); 366 return ret; 367} 368 369/** 370 * find_attach - do attachment search for unconfined processes 371 * @bprm - binprm structure of transitioning task 372 * @ns: the current namespace (NOT NULL) 373 * @head - profile list to walk (NOT NULL) 374 * @name - to match against (NOT NULL) 375 * @info - info message if there was an error (NOT NULL) 376 * 377 * Do a linear search on the profiles in the list. There is a matching 378 * preference where an exact match is preferred over a name which uses 379 * expressions to match, and matching expressions with the greatest 380 * xmatch_len are preferred. 381 * 382 * Requires: @head not be shared or have appropriate locks held 383 * 384 * Returns: label or NULL if no match found 385 */ 386static struct aa_label *find_attach(const struct linux_binprm *bprm, 387 struct aa_ns *ns, struct list_head *head, 388 const char *name, const char **info) 389{ 390 int candidate_len = 0, candidate_xattrs = 0; 391 bool conflict = false; 392 struct aa_profile *profile, *candidate = NULL; 393 394 AA_BUG(!name); 395 AA_BUG(!head); 396 397 rcu_read_lock(); 398restart: 399 list_for_each_entry_rcu(profile, head, base.list) { 400 if (profile->label.flags & FLAG_NULL && 401 &profile->label == ns_unconfined(profile->ns)) 402 continue; 403 404 /* Find the "best" matching profile. Profiles must 405 * match the path and extended attributes (if any) 406 * associated with the file. A more specific path 407 * match will be preferred over a less specific one, 408 * and a match with more matching extended attributes 409 * will be preferred over one with fewer. If the best 410 * match has both the same level of path specificity 411 * and the same number of matching extended attributes 412 * as another profile, signal a conflict and refuse to 413 * match. 414 */ 415 if (profile->xmatch) { 416 unsigned int state, count; 417 u32 perm; 418 419 state = aa_dfa_leftmatch(profile->xmatch, DFA_START, 420 name, &count); 421 perm = dfa_user_allow(profile->xmatch, state); 422 /* any accepting state means a valid match. */ 423 if (perm & MAY_EXEC) { 424 int ret = 0; 425 426 if (count < candidate_len) 427 continue; 428 429 if (bprm && profile->xattr_count) { 430 long rev = READ_ONCE(ns->revision); 431 432 if (!aa_get_profile_not0(profile)) 433 goto restart; 434 rcu_read_unlock(); 435 ret = aa_xattrs_match(bprm, profile, 436 state); 437 rcu_read_lock(); 438 aa_put_profile(profile); 439 if (rev != 440 READ_ONCE(ns->revision)) 441 /* policy changed */ 442 goto restart; 443 /* 444 * Fail matching if the xattrs don't 445 * match 446 */ 447 if (ret < 0) 448 continue; 449 } 450 /* 451 * TODO: allow for more flexible best match 452 * 453 * The new match isn't more specific 454 * than the current best match 455 */ 456 if (count == candidate_len && 457 ret <= candidate_xattrs) { 458 /* Match is equivalent, so conflict */ 459 if (ret == candidate_xattrs) 460 conflict = true; 461 continue; 462 } 463 464 /* Either the same length with more matching 465 * xattrs, or a longer match 466 */ 467 candidate = profile; 468 candidate_len = max(count, profile->xmatch_len); 469 candidate_xattrs = ret; 470 conflict = false; 471 } 472 } else if (!strcmp(profile->base.name, name)) { 473 /* 474 * old exact non-re match, without conditionals such 475 * as xattrs. no more searching required 476 */ 477 candidate = profile; 478 goto out; 479 } 480 } 481 482 if (!candidate || conflict) { 483 if (conflict) 484 *info = "conflicting profile attachments"; 485 rcu_read_unlock(); 486 return NULL; 487 } 488 489out: 490 candidate = aa_get_newest_profile(candidate); 491 rcu_read_unlock(); 492 493 return &candidate->label; 494} 495 496static const char *next_name(int xtype, const char *name) 497{ 498 return NULL; 499} 500 501/** 502 * x_table_lookup - lookup an x transition name via transition table 503 * @profile: current profile (NOT NULL) 504 * @xindex: index into x transition table 505 * @name: returns: name tested to find label (NOT NULL) 506 * 507 * Returns: refcounted label, or NULL on failure (MAYBE NULL) 508 */ 509struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex, 510 const char **name) 511{ 512 struct aa_label *label = NULL; 513 u32 xtype = xindex & AA_X_TYPE_MASK; 514 int index = xindex & AA_X_INDEX_MASK; 515 516 AA_BUG(!name); 517 518 /* index is guaranteed to be in range, validated at load time */ 519 /* TODO: move lookup parsing to unpack time so this is a straight 520 * index into the resultant label 521 */ 522 for (*name = profile->file.trans.table[index]; !label && *name; 523 *name = next_name(xtype, *name)) { 524 if (xindex & AA_X_CHILD) { 525 struct aa_profile *new_profile; 526 /* release by caller */ 527 new_profile = aa_find_child(profile, *name); 528 if (new_profile) 529 label = &new_profile->label; 530 continue; 531 } 532 label = aa_label_parse(&profile->label, *name, GFP_KERNEL, 533 true, false); 534 if (IS_ERR(label)) 535 label = NULL; 536 } 537 538 /* released by caller */ 539 540 return label; 541} 542 543/** 544 * x_to_label - get target label for a given xindex 545 * @profile: current profile (NOT NULL) 546 * @bprm: binprm structure of transitioning task 547 * @name: name to lookup (NOT NULL) 548 * @xindex: index into x transition table 549 * @lookupname: returns: name used in lookup if one was specified (NOT NULL) 550 * 551 * find label for a transition index 552 * 553 * Returns: refcounted label or NULL if not found available 554 */ 555static struct aa_label *x_to_label(struct aa_profile *profile, 556 const struct linux_binprm *bprm, 557 const char *name, u32 xindex, 558 const char **lookupname, 559 const char **info) 560{ 561 struct aa_label *new = NULL; 562 struct aa_ns *ns = profile->ns; 563 u32 xtype = xindex & AA_X_TYPE_MASK; 564 const char *stack = NULL; 565 566 switch (xtype) { 567 case AA_X_NONE: 568 /* fail exec unless ix || ux fallback - handled by caller */ 569 *lookupname = NULL; 570 break; 571 case AA_X_TABLE: 572 /* TODO: fix when perm mapping done at unload */ 573 stack = profile->file.trans.table[xindex & AA_X_INDEX_MASK]; 574 if (*stack != '&') { 575 /* released by caller */ 576 new = x_table_lookup(profile, xindex, lookupname); 577 stack = NULL; 578 break; 579 } 580 fallthrough; /* to X_NAME */ 581 case AA_X_NAME: 582 if (xindex & AA_X_CHILD) 583 /* released by caller */ 584 new = find_attach(bprm, ns, &profile->base.profiles, 585 name, info); 586 else 587 /* released by caller */ 588 new = find_attach(bprm, ns, &ns->base.profiles, 589 name, info); 590 *lookupname = name; 591 break; 592 } 593 594 if (!new) { 595 if (xindex & AA_X_INHERIT) { 596 /* (p|c|n)ix - don't change profile but do 597 * use the newest version 598 */ 599 *info = "ix fallback"; 600 /* no profile && no error */ 601 new = aa_get_newest_label(&profile->label); 602 } else if (xindex & AA_X_UNCONFINED) { 603 new = aa_get_newest_label(ns_unconfined(profile->ns)); 604 *info = "ux fallback"; 605 } 606 } 607 608 if (new && stack) { 609 /* base the stack on post domain transition */ 610 struct aa_label *base = new; 611 612 new = aa_label_parse(base, stack, GFP_KERNEL, true, false); 613 if (IS_ERR(new)) 614 new = NULL; 615 aa_put_label(base); 616 } 617 618 /* released by caller */ 619 return new; 620} 621 622static struct aa_label *profile_transition(struct aa_profile *profile, 623 const struct linux_binprm *bprm, 624 char *buffer, struct path_cond *cond, 625 bool *secure_exec) 626{ 627 struct aa_label *new = NULL; 628 const char *info = NULL, *name = NULL, *target = NULL; 629 unsigned int state = profile->file.start; 630 struct aa_perms perms = {}; 631 bool nonewprivs = false; 632 int error = 0; 633 634 AA_BUG(!profile); 635 AA_BUG(!bprm); 636 AA_BUG(!buffer); 637 638 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, 639 &name, &info, profile->disconnected); 640 if (error) { 641 if (profile_unconfined(profile) || 642 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { 643 AA_DEBUG("name lookup ix on error"); 644 error = 0; 645 new = aa_get_newest_label(&profile->label); 646 } 647 name = bprm->filename; 648 goto audit; 649 } 650 651 if (profile_unconfined(profile)) { 652 new = find_attach(bprm, profile->ns, 653 &profile->ns->base.profiles, name, &info); 654 if (new) { 655 AA_DEBUG("unconfined attached to new label"); 656 return new; 657 } 658 AA_DEBUG("unconfined exec no attachment"); 659 return aa_get_newest_label(&profile->label); 660 } 661 662 /* find exec permissions for name */ 663 state = aa_str_perms(profile->file.dfa, state, name, cond, &perms); 664 if (perms.allow & MAY_EXEC) { 665 /* exec permission determine how to transition */ 666 new = x_to_label(profile, bprm, name, perms.xindex, &target, 667 &info); 668 if (new && new->proxy == profile->label.proxy && info) { 669 /* hack ix fallback - improve how this is detected */ 670 goto audit; 671 } else if (!new) { 672 error = -EACCES; 673 info = "profile transition not found"; 674 /* remove MAY_EXEC to audit as failure */ 675 perms.allow &= ~MAY_EXEC; 676 } 677 } else if (COMPLAIN_MODE(profile)) { 678 /* no exec permission - learning mode */ 679 struct aa_profile *new_profile = NULL; 680 681 new_profile = aa_new_null_profile(profile, false, name, 682 GFP_KERNEL); 683 if (!new_profile) { 684 error = -ENOMEM; 685 info = "could not create null profile"; 686 } else { 687 error = -EACCES; 688 new = &new_profile->label; 689 } 690 perms.xindex |= AA_X_UNSAFE; 691 } else 692 /* fail exec */ 693 error = -EACCES; 694 695 if (!new) 696 goto audit; 697 698 699 if (!(perms.xindex & AA_X_UNSAFE)) { 700 if (DEBUG_ON) { 701 dbg_printk("apparmor: scrubbing environment variables" 702 " for %s profile=", name); 703 aa_label_printk(new, GFP_KERNEL); 704 dbg_printk("\n"); 705 } 706 *secure_exec = true; 707 } 708 709audit: 710 aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name, target, new, 711 cond->uid, info, error); 712 if (!new || nonewprivs) { 713 aa_put_label(new); 714 return ERR_PTR(error); 715 } 716 717 return new; 718} 719 720static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec, 721 bool stack, const struct linux_binprm *bprm, 722 char *buffer, struct path_cond *cond, 723 bool *secure_exec) 724{ 725 unsigned int state = profile->file.start; 726 struct aa_perms perms = {}; 727 const char *xname = NULL, *info = "change_profile onexec"; 728 int error = -EACCES; 729 730 AA_BUG(!profile); 731 AA_BUG(!onexec); 732 AA_BUG(!bprm); 733 AA_BUG(!buffer); 734 735 if (profile_unconfined(profile)) { 736 /* change_profile on exec already granted */ 737 /* 738 * NOTE: Domain transitions from unconfined are allowed 739 * even when no_new_privs is set because this aways results 740 * in a further reduction of permissions. 741 */ 742 return 0; 743 } 744 745 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, 746 &xname, &info, profile->disconnected); 747 if (error) { 748 if (profile_unconfined(profile) || 749 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { 750 AA_DEBUG("name lookup ix on error"); 751 error = 0; 752 } 753 xname = bprm->filename; 754 goto audit; 755 } 756 757 /* find exec permissions for name */ 758 state = aa_str_perms(profile->file.dfa, state, xname, cond, &perms); 759 if (!(perms.allow & AA_MAY_ONEXEC)) { 760 info = "no change_onexec valid for executable"; 761 goto audit; 762 } 763 /* test if this exec can be paired with change_profile onexec. 764 * onexec permission is linked to exec with a standard pairing 765 * exec\0change_profile 766 */ 767 state = aa_dfa_null_transition(profile->file.dfa, state); 768 error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC, 769 state, &perms); 770 if (error) { 771 perms.allow &= ~AA_MAY_ONEXEC; 772 goto audit; 773 } 774 775 if (!(perms.xindex & AA_X_UNSAFE)) { 776 if (DEBUG_ON) { 777 dbg_printk("apparmor: scrubbing environment " 778 "variables for %s label=", xname); 779 aa_label_printk(onexec, GFP_KERNEL); 780 dbg_printk("\n"); 781 } 782 *secure_exec = true; 783 } 784 785audit: 786 return aa_audit_file(profile, &perms, OP_EXEC, AA_MAY_ONEXEC, xname, 787 NULL, onexec, cond->uid, info, error); 788} 789 790/* ensure none ns domain transitions are correctly applied with onexec */ 791 792static struct aa_label *handle_onexec(struct aa_label *label, 793 struct aa_label *onexec, bool stack, 794 const struct linux_binprm *bprm, 795 char *buffer, struct path_cond *cond, 796 bool *unsafe) 797{ 798 struct aa_profile *profile; 799 struct aa_label *new; 800 int error; 801 802 AA_BUG(!label); 803 AA_BUG(!onexec); 804 AA_BUG(!bprm); 805 AA_BUG(!buffer); 806 807 if (!stack) { 808 error = fn_for_each_in_ns(label, profile, 809 profile_onexec(profile, onexec, stack, 810 bprm, buffer, cond, unsafe)); 811 if (error) 812 return ERR_PTR(error); 813 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, 814 aa_get_newest_label(onexec), 815 profile_transition(profile, bprm, buffer, 816 cond, unsafe)); 817 818 } else { 819 /* TODO: determine how much we want to loosen this */ 820 error = fn_for_each_in_ns(label, profile, 821 profile_onexec(profile, onexec, stack, bprm, 822 buffer, cond, unsafe)); 823 if (error) 824 return ERR_PTR(error); 825 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, 826 aa_label_merge(&profile->label, onexec, 827 GFP_KERNEL), 828 profile_transition(profile, bprm, buffer, 829 cond, unsafe)); 830 } 831 832 if (new) 833 return new; 834 835 /* TODO: get rid of GLOBAL_ROOT_UID */ 836 error = fn_for_each_in_ns(label, profile, 837 aa_audit_file(profile, &nullperms, OP_CHANGE_ONEXEC, 838 AA_MAY_ONEXEC, bprm->filename, NULL, 839 onexec, GLOBAL_ROOT_UID, 840 "failed to build target label", -ENOMEM)); 841 return ERR_PTR(error); 842} 843 844/** 845 * apparmor_bprm_creds_for_exec - Update the new creds on the bprm struct 846 * @bprm: binprm for the exec (NOT NULL) 847 * 848 * Returns: %0 or error on failure 849 * 850 * TODO: once the other paths are done see if we can't refactor into a fn 851 */ 852int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm) 853{ 854 struct aa_task_ctx *ctx; 855 struct aa_label *label, *new = NULL; 856 struct aa_profile *profile; 857 char *buffer = NULL; 858 const char *info = NULL; 859 int error = 0; 860 bool unsafe = false; 861 struct path_cond cond = { 862 file_inode(bprm->file)->i_uid, 863 file_inode(bprm->file)->i_mode 864 }; 865 866 ctx = task_ctx(current); 867 AA_BUG(!cred_label(bprm->cred)); 868 AA_BUG(!ctx); 869 870 label = aa_get_newest_label(cred_label(bprm->cred)); 871 872 /* 873 * Detect no new privs being set, and store the label it 874 * occurred under. Ideally this would happen when nnp 875 * is set but there isn't a good way to do that yet. 876 * 877 * Testing for unconfined must be done before the subset test 878 */ 879 if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) && !unconfined(label) && 880 !ctx->nnp) 881 ctx->nnp = aa_get_label(label); 882 883 /* buffer freed below, name is pointer into buffer */ 884 buffer = aa_get_buffer(false); 885 if (!buffer) { 886 error = -ENOMEM; 887 goto done; 888 } 889 890 /* Test for onexec first as onexec override other x transitions. */ 891 if (ctx->onexec) 892 new = handle_onexec(label, ctx->onexec, ctx->token, 893 bprm, buffer, &cond, &unsafe); 894 else 895 new = fn_label_build(label, profile, GFP_KERNEL, 896 profile_transition(profile, bprm, buffer, 897 &cond, &unsafe)); 898 899 AA_BUG(!new); 900 if (IS_ERR(new)) { 901 error = PTR_ERR(new); 902 goto done; 903 } else if (!new) { 904 error = -ENOMEM; 905 goto done; 906 } 907 908 /* Policy has specified a domain transitions. If no_new_privs and 909 * confined ensure the transition is to confinement that is subset 910 * of the confinement when the task entered no new privs. 911 * 912 * NOTE: Domain transitions from unconfined and to stacked 913 * subsets are allowed even when no_new_privs is set because this 914 * aways results in a further reduction of permissions. 915 */ 916 if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) && 917 !unconfined(label) && 918 !aa_label_is_unconfined_subset(new, ctx->nnp)) { 919 error = -EPERM; 920 info = "no new privs"; 921 goto audit; 922 } 923 924 if (bprm->unsafe & LSM_UNSAFE_SHARE) { 925 /* FIXME: currently don't mediate shared state */ 926 ; 927 } 928 929 if (bprm->unsafe & (LSM_UNSAFE_PTRACE)) { 930 /* TODO: test needs to be profile of label to new */ 931 error = may_change_ptraced_domain(new, &info); 932 if (error) 933 goto audit; 934 } 935 936 if (unsafe) { 937 if (DEBUG_ON) { 938 dbg_printk("scrubbing environment variables for %s " 939 "label=", bprm->filename); 940 aa_label_printk(new, GFP_KERNEL); 941 dbg_printk("\n"); 942 } 943 bprm->secureexec = 1; 944 } 945 946 if (label->proxy != new->proxy) { 947 /* when transitioning clear unsafe personality bits */ 948 if (DEBUG_ON) { 949 dbg_printk("apparmor: clearing unsafe personality " 950 "bits. %s label=", bprm->filename); 951 aa_label_printk(new, GFP_KERNEL); 952 dbg_printk("\n"); 953 } 954 bprm->per_clear |= PER_CLEAR_ON_SETID; 955 } 956 aa_put_label(cred_label(bprm->cred)); 957 /* transfer reference, released when cred is freed */ 958 set_cred_label(bprm->cred, new); 959 960done: 961 aa_put_label(label); 962 aa_put_buffer(buffer); 963 964 return error; 965 966audit: 967 error = fn_for_each(label, profile, 968 aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC, 969 bprm->filename, NULL, new, 970 file_inode(bprm->file)->i_uid, info, 971 error)); 972 aa_put_label(new); 973 goto done; 974} 975 976/* 977 * Functions for self directed profile change 978 */ 979 980 981/* helper fn for change_hat 982 * 983 * Returns: label for hat transition OR ERR_PTR. Does NOT return NULL 984 */ 985static struct aa_label *build_change_hat(struct aa_profile *profile, 986 const char *name, bool sibling) 987{ 988 struct aa_profile *root, *hat = NULL; 989 const char *info = NULL; 990 int error = 0; 991 992 if (sibling && PROFILE_IS_HAT(profile)) { 993 root = aa_get_profile_rcu(&profile->parent); 994 } else if (!sibling && !PROFILE_IS_HAT(profile)) { 995 root = aa_get_profile(profile); 996 } else { 997 info = "conflicting target types"; 998 error = -EPERM; 999 goto audit; 1000 } 1001 1002 hat = aa_find_child(root, name); 1003 if (!hat) { 1004 error = -ENOENT; 1005 if (COMPLAIN_MODE(profile)) { 1006 hat = aa_new_null_profile(profile, true, name, 1007 GFP_KERNEL); 1008 if (!hat) { 1009 info = "failed null profile create"; 1010 error = -ENOMEM; 1011 } 1012 } 1013 } 1014 aa_put_profile(root); 1015 1016audit: 1017 aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, AA_MAY_CHANGEHAT, 1018 name, hat ? hat->base.hname : NULL, 1019 hat ? &hat->label : NULL, GLOBAL_ROOT_UID, info, 1020 error); 1021 if (!hat || (error && error != -ENOENT)) 1022 return ERR_PTR(error); 1023 /* if hat && error - complain mode, already audited and we adjust for 1024 * complain mode allow by returning hat->label 1025 */ 1026 return &hat->label; 1027} 1028 1029/* helper fn for changing into a hat 1030 * 1031 * Returns: label for hat transition or ERR_PTR. Does not return NULL 1032 */ 1033static struct aa_label *change_hat(struct aa_label *label, const char *hats[], 1034 int count, int flags) 1035{ 1036 struct aa_profile *profile, *root, *hat = NULL; 1037 struct aa_label *new; 1038 struct label_it it; 1039 bool sibling = false; 1040 const char *name, *info = NULL; 1041 int i, error; 1042 1043 AA_BUG(!label); 1044 AA_BUG(!hats); 1045 AA_BUG(count < 1); 1046 1047 if (PROFILE_IS_HAT(labels_profile(label))) 1048 sibling = true; 1049 1050 /*find first matching hat */ 1051 for (i = 0; i < count && !hat; i++) { 1052 name = hats[i]; 1053 label_for_each_in_ns(it, labels_ns(label), label, profile) { 1054 if (sibling && PROFILE_IS_HAT(profile)) { 1055 root = aa_get_profile_rcu(&profile->parent); 1056 } else if (!sibling && !PROFILE_IS_HAT(profile)) { 1057 root = aa_get_profile(profile); 1058 } else { /* conflicting change type */ 1059 info = "conflicting targets types"; 1060 error = -EPERM; 1061 goto fail; 1062 } 1063 hat = aa_find_child(root, name); 1064 aa_put_profile(root); 1065 if (!hat) { 1066 if (!COMPLAIN_MODE(profile)) 1067 goto outer_continue; 1068 /* complain mode succeed as if hat */ 1069 } else if (!PROFILE_IS_HAT(hat)) { 1070 info = "target not hat"; 1071 error = -EPERM; 1072 aa_put_profile(hat); 1073 goto fail; 1074 } 1075 aa_put_profile(hat); 1076 } 1077 /* found a hat for all profiles in ns */ 1078 goto build; 1079outer_continue: 1080 ; 1081 } 1082 /* no hats that match, find appropriate error 1083 * 1084 * In complain mode audit of the failure is based off of the first 1085 * hat supplied. This is done due how userspace interacts with 1086 * change_hat. 1087 */ 1088 name = NULL; 1089 label_for_each_in_ns(it, labels_ns(label), label, profile) { 1090 if (!list_empty(&profile->base.profiles)) { 1091 info = "hat not found"; 1092 error = -ENOENT; 1093 goto fail; 1094 } 1095 } 1096 info = "no hats defined"; 1097 error = -ECHILD; 1098 1099fail: 1100 label_for_each_in_ns(it, labels_ns(label), label, profile) { 1101 /* 1102 * no target as it has failed to be found or built 1103 * 1104 * change_hat uses probing and should not log failures 1105 * related to missing hats 1106 */ 1107 /* TODO: get rid of GLOBAL_ROOT_UID */ 1108 if (count > 1 || COMPLAIN_MODE(profile)) { 1109 aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, 1110 AA_MAY_CHANGEHAT, name, NULL, NULL, 1111 GLOBAL_ROOT_UID, info, error); 1112 } 1113 } 1114 return ERR_PTR(error); 1115 1116build: 1117 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, 1118 build_change_hat(profile, name, sibling), 1119 aa_get_label(&profile->label)); 1120 if (!new) { 1121 info = "label build failed"; 1122 error = -ENOMEM; 1123 goto fail; 1124 } /* else if (IS_ERR) build_change_hat has logged error so return new */ 1125 1126 return new; 1127} 1128 1129/** 1130 * aa_change_hat - change hat to/from subprofile 1131 * @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0) 1132 * @count: number of hat names in @hats 1133 * @token: magic value to validate the hat change 1134 * @flags: flags affecting behavior of the change 1135 * 1136 * Returns %0 on success, error otherwise. 1137 * 1138 * Change to the first profile specified in @hats that exists, and store 1139 * the @hat_magic in the current task context. If the count == 0 and the 1140 * @token matches that stored in the current task context, return to the 1141 * top level profile. 1142 * 1143 * change_hat only applies to profiles in the current ns, and each profile 1144 * in the ns must make the same transition otherwise change_hat will fail. 1145 */ 1146int aa_change_hat(const char *hats[], int count, u64 token, int flags) 1147{ 1148 const struct cred *cred; 1149 struct aa_task_ctx *ctx = task_ctx(current); 1150 struct aa_label *label, *previous, *new = NULL, *target = NULL; 1151 struct aa_profile *profile; 1152 struct aa_perms perms = {}; 1153 const char *info = NULL; 1154 int error = 0; 1155 1156 /* released below */ 1157 cred = get_current_cred(); 1158 label = aa_get_newest_cred_label(cred); 1159 previous = aa_get_newest_label(ctx->previous); 1160 1161 /* 1162 * Detect no new privs being set, and store the label it 1163 * occurred under. Ideally this would happen when nnp 1164 * is set but there isn't a good way to do that yet. 1165 * 1166 * Testing for unconfined must be done before the subset test 1167 */ 1168 if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp) 1169 ctx->nnp = aa_get_label(label); 1170 1171 if (unconfined(label)) { 1172 info = "unconfined can not change_hat"; 1173 error = -EPERM; 1174 goto fail; 1175 } 1176 1177 if (count) { 1178 new = change_hat(label, hats, count, flags); 1179 AA_BUG(!new); 1180 if (IS_ERR(new)) { 1181 error = PTR_ERR(new); 1182 new = NULL; 1183 /* already audited */ 1184 goto out; 1185 } 1186 1187 error = may_change_ptraced_domain(new, &info); 1188 if (error) 1189 goto fail; 1190 1191 /* 1192 * no new privs prevents domain transitions that would 1193 * reduce restrictions. 1194 */ 1195 if (task_no_new_privs(current) && !unconfined(label) && 1196 !aa_label_is_unconfined_subset(new, ctx->nnp)) { 1197 /* not an apparmor denial per se, so don't log it */ 1198 AA_DEBUG("no_new_privs - change_hat denied"); 1199 error = -EPERM; 1200 goto out; 1201 } 1202 1203 if (flags & AA_CHANGE_TEST) 1204 goto out; 1205 1206 target = new; 1207 error = aa_set_current_hat(new, token); 1208 if (error == -EACCES) 1209 /* kill task in case of brute force attacks */ 1210 goto kill; 1211 } else if (previous && !(flags & AA_CHANGE_TEST)) { 1212 /* 1213 * no new privs prevents domain transitions that would 1214 * reduce restrictions. 1215 */ 1216 if (task_no_new_privs(current) && !unconfined(label) && 1217 !aa_label_is_unconfined_subset(previous, ctx->nnp)) { 1218 /* not an apparmor denial per se, so don't log it */ 1219 AA_DEBUG("no_new_privs - change_hat denied"); 1220 error = -EPERM; 1221 goto out; 1222 } 1223 1224 /* Return to saved label. Kill task if restore fails 1225 * to avoid brute force attacks 1226 */ 1227 target = previous; 1228 error = aa_restore_previous_label(token); 1229 if (error) { 1230 if (error == -EACCES) 1231 goto kill; 1232 goto fail; 1233 } 1234 } /* else ignore @flags && restores when there is no saved profile */ 1235 1236out: 1237 aa_put_label(new); 1238 aa_put_label(previous); 1239 aa_put_label(label); 1240 put_cred(cred); 1241 1242 return error; 1243 1244kill: 1245 info = "failed token match"; 1246 perms.kill = AA_MAY_CHANGEHAT; 1247 1248fail: 1249 fn_for_each_in_ns(label, profile, 1250 aa_audit_file(profile, &perms, OP_CHANGE_HAT, 1251 AA_MAY_CHANGEHAT, NULL, NULL, target, 1252 GLOBAL_ROOT_UID, info, error)); 1253 1254 goto out; 1255} 1256 1257 1258static int change_profile_perms_wrapper(const char *op, const char *name, 1259 struct aa_profile *profile, 1260 struct aa_label *target, bool stack, 1261 u32 request, struct aa_perms *perms) 1262{ 1263 const char *info = NULL; 1264 int error = 0; 1265 1266 if (!error) 1267 error = change_profile_perms(profile, target, stack, request, 1268 profile->file.start, perms); 1269 if (error) 1270 error = aa_audit_file(profile, perms, op, request, name, 1271 NULL, target, GLOBAL_ROOT_UID, info, 1272 error); 1273 1274 return error; 1275} 1276 1277/** 1278 * aa_change_profile - perform a one-way profile transition 1279 * @fqname: name of profile may include namespace (NOT NULL) 1280 * @onexec: whether this transition is to take place immediately or at exec 1281 * @flags: flags affecting change behavior 1282 * 1283 * Change to new profile @name. Unlike with hats, there is no way 1284 * to change back. If @name isn't specified the current profile name is 1285 * used. 1286 * If @onexec then the transition is delayed until 1287 * the next exec. 1288 * 1289 * Returns %0 on success, error otherwise. 1290 */ 1291int aa_change_profile(const char *fqname, int flags) 1292{ 1293 struct aa_label *label, *new = NULL, *target = NULL; 1294 struct aa_profile *profile; 1295 struct aa_perms perms = {}; 1296 const char *info = NULL; 1297 const char *auditname = fqname; /* retain leading & if stack */ 1298 bool stack = flags & AA_CHANGE_STACK; 1299 struct aa_task_ctx *ctx = task_ctx(current); 1300 int error = 0; 1301 char *op; 1302 u32 request; 1303 1304 label = aa_get_current_label(); 1305 1306 /* 1307 * Detect no new privs being set, and store the label it 1308 * occurred under. Ideally this would happen when nnp 1309 * is set but there isn't a good way to do that yet. 1310 * 1311 * Testing for unconfined must be done before the subset test 1312 */ 1313 if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp) 1314 ctx->nnp = aa_get_label(label); 1315 1316 if (!fqname || !*fqname) { 1317 aa_put_label(label); 1318 AA_DEBUG("no profile name"); 1319 return -EINVAL; 1320 } 1321 1322 if (flags & AA_CHANGE_ONEXEC) { 1323 request = AA_MAY_ONEXEC; 1324 if (stack) 1325 op = OP_STACK_ONEXEC; 1326 else 1327 op = OP_CHANGE_ONEXEC; 1328 } else { 1329 request = AA_MAY_CHANGE_PROFILE; 1330 if (stack) 1331 op = OP_STACK; 1332 else 1333 op = OP_CHANGE_PROFILE; 1334 } 1335 1336 if (*fqname == '&') { 1337 stack = true; 1338 /* don't have label_parse() do stacking */ 1339 fqname++; 1340 } 1341 target = aa_label_parse(label, fqname, GFP_KERNEL, true, false); 1342 if (IS_ERR(target)) { 1343 struct aa_profile *tprofile; 1344 1345 info = "label not found"; 1346 error = PTR_ERR(target); 1347 target = NULL; 1348 /* 1349 * TODO: fixme using labels_profile is not right - do profile 1350 * per complain profile 1351 */ 1352 if ((flags & AA_CHANGE_TEST) || 1353 !COMPLAIN_MODE(labels_profile(label))) 1354 goto audit; 1355 /* released below */ 1356 tprofile = aa_new_null_profile(labels_profile(label), false, 1357 fqname, GFP_KERNEL); 1358 if (!tprofile) { 1359 info = "failed null profile create"; 1360 error = -ENOMEM; 1361 goto audit; 1362 } 1363 target = &tprofile->label; 1364 goto check; 1365 } 1366 1367 /* 1368 * self directed transitions only apply to current policy ns 1369 * TODO: currently requiring perms for stacking and straight change 1370 * stacking doesn't strictly need this. Determine how much 1371 * we want to loosen this restriction for stacking 1372 * 1373 * if (!stack) { 1374 */ 1375 error = fn_for_each_in_ns(label, profile, 1376 change_profile_perms_wrapper(op, auditname, 1377 profile, target, stack, 1378 request, &perms)); 1379 if (error) 1380 /* auditing done in change_profile_perms_wrapper */ 1381 goto out; 1382 1383 /* } */ 1384 1385check: 1386 /* check if tracing task is allowed to trace target domain */ 1387 error = may_change_ptraced_domain(target, &info); 1388 if (error && !fn_for_each_in_ns(label, profile, 1389 COMPLAIN_MODE(profile))) 1390 goto audit; 1391 1392 /* TODO: add permission check to allow this 1393 * if ((flags & AA_CHANGE_ONEXEC) && !current_is_single_threaded()) { 1394 * info = "not a single threaded task"; 1395 * error = -EACCES; 1396 * goto audit; 1397 * } 1398 */ 1399 if (flags & AA_CHANGE_TEST) 1400 goto out; 1401 1402 /* stacking is always a subset, so only check the nonstack case */ 1403 if (!stack) { 1404 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, 1405 aa_get_label(target), 1406 aa_get_label(&profile->label)); 1407 /* 1408 * no new privs prevents domain transitions that would 1409 * reduce restrictions. 1410 */ 1411 if (task_no_new_privs(current) && !unconfined(label) && 1412 !aa_label_is_unconfined_subset(new, ctx->nnp)) { 1413 /* not an apparmor denial per se, so don't log it */ 1414 AA_DEBUG("no_new_privs - change_hat denied"); 1415 error = -EPERM; 1416 goto out; 1417 } 1418 } 1419 1420 if (!(flags & AA_CHANGE_ONEXEC)) { 1421 /* only transition profiles in the current ns */ 1422 if (stack) 1423 new = aa_label_merge(label, target, GFP_KERNEL); 1424 if (IS_ERR_OR_NULL(new)) { 1425 info = "failed to build target label"; 1426 if (!new) 1427 error = -ENOMEM; 1428 else 1429 error = PTR_ERR(new); 1430 new = NULL; 1431 perms.allow = 0; 1432 goto audit; 1433 } 1434 error = aa_replace_current_label(new); 1435 } else { 1436 if (new) { 1437 aa_put_label(new); 1438 new = NULL; 1439 } 1440 1441 /* full transition will be built in exec path */ 1442 error = aa_set_current_onexec(target, stack); 1443 } 1444 1445audit: 1446 error = fn_for_each_in_ns(label, profile, 1447 aa_audit_file(profile, &perms, op, request, auditname, 1448 NULL, new ? new : target, 1449 GLOBAL_ROOT_UID, info, error)); 1450 1451out: 1452 aa_put_label(new); 1453 aa_put_label(target); 1454 aa_put_label(label); 1455 1456 return error; 1457} 1458