| domain.c (d9087c49d4388e3f35f09a5cf7ed6e09c9106604) | domain.c (f175221af35bedf99b201d861a0fe54e19ef36c2) |
|---|---|
| 1/* 2 * AppArmor security module 3 * 4 * This file contains AppArmor policy attachment and domain transitions 5 * 6 * Copyright (C) 2002-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * --- 765 unchanged lines hidden (view full) --- 774 * @bprm: binprm for the exec (NOT NULL) 775 * 776 * Returns: %0 or error on failure 777 * 778 * TODO: once the other paths are done see if we can't refactor into a fn 779 */ 780int apparmor_bprm_set_creds(struct linux_binprm *bprm) 781{ | 1/* 2 * AppArmor security module 3 * 4 * This file contains AppArmor policy attachment and domain transitions 5 * 6 * Copyright (C) 2002-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * --- 765 unchanged lines hidden (view full) --- 774 * @bprm: binprm for the exec (NOT NULL) 775 * 776 * Returns: %0 or error on failure 777 * 778 * TODO: once the other paths are done see if we can't refactor into a fn 779 */ 780int apparmor_bprm_set_creds(struct linux_binprm *bprm) 781{ |
| 782 struct aa_task_ctx *tctx; | 782 struct aa_task_ctx *ctx; |
| 783 struct aa_label *label, *new = NULL; 784 struct aa_profile *profile; 785 char *buffer = NULL; 786 const char *info = NULL; 787 int error = 0; 788 bool unsafe = false; 789 struct path_cond cond = { 790 file_inode(bprm->file)->i_uid, 791 file_inode(bprm->file)->i_mode 792 }; 793 794 if (bprm->called_set_creds) 795 return 0; 796 | 783 struct aa_label *label, *new = NULL; 784 struct aa_profile *profile; 785 char *buffer = NULL; 786 const char *info = NULL; 787 int error = 0; 788 bool unsafe = false; 789 struct path_cond cond = { 790 file_inode(bprm->file)->i_uid, 791 file_inode(bprm->file)->i_mode 792 }; 793 794 if (bprm->called_set_creds) 795 return 0; 796 |
| 797 tctx = current_task_ctx(); | 797 ctx = current_task_ctx(); |
| 798 AA_BUG(!cred_label(bprm->cred)); | 798 AA_BUG(!cred_label(bprm->cred)); |
| 799 AA_BUG(!tctx); | 799 AA_BUG(!ctx); |
| 800 801 label = aa_get_newest_label(cred_label(bprm->cred)); 802 803 /* buffer freed below, name is pointer into buffer */ 804 get_buffers(buffer); 805 /* Test for onexec first as onexec override other x transitions. */ | 800 801 label = aa_get_newest_label(cred_label(bprm->cred)); 802 803 /* buffer freed below, name is pointer into buffer */ 804 get_buffers(buffer); 805 /* Test for onexec first as onexec override other x transitions. */ |
| 806 if (tctx->onexec) 807 new = handle_onexec(label, tctx->onexec, tctx->token, | 806 if (ctx->onexec) 807 new = handle_onexec(label, ctx->onexec, ctx->token, |
| 808 bprm, buffer, &cond, &unsafe); 809 else 810 new = fn_label_build(label, profile, GFP_ATOMIC, 811 profile_transition(profile, bprm, buffer, 812 &cond, &unsafe)); 813 814 AA_BUG(!new); 815 if (IS_ERR(new)) { --- 226 unchanged lines hidden (view full) --- 1042 * top level profile. 1043 * 1044 * change_hat only applies to profiles in the current ns, and each profile 1045 * in the ns must make the same transition otherwise change_hat will fail. 1046 */ 1047int aa_change_hat(const char *hats[], int count, u64 token, int flags) 1048{ 1049 const struct cred *cred; | 808 bprm, buffer, &cond, &unsafe); 809 else 810 new = fn_label_build(label, profile, GFP_ATOMIC, 811 profile_transition(profile, bprm, buffer, 812 &cond, &unsafe)); 813 814 AA_BUG(!new); 815 if (IS_ERR(new)) { --- 226 unchanged lines hidden (view full) --- 1042 * top level profile. 1043 * 1044 * change_hat only applies to profiles in the current ns, and each profile 1045 * in the ns must make the same transition otherwise change_hat will fail. 1046 */ 1047int aa_change_hat(const char *hats[], int count, u64 token, int flags) 1048{ 1049 const struct cred *cred; |
| 1050 struct aa_task_ctx *tctx; | 1050 struct aa_task_ctx *ctx; |
| 1051 struct aa_label *label, *previous, *new = NULL, *target = NULL; 1052 struct aa_profile *profile; 1053 struct aa_perms perms = {}; 1054 const char *info = NULL; 1055 int error = 0; 1056 1057 /* 1058 * Fail explicitly requested domain transitions if no_new_privs. 1059 * There is no exception for unconfined as change_hat is not 1060 * available. 1061 */ 1062 if (task_no_new_privs(current)) { 1063 /* not an apparmor denial per se, so don't log it */ 1064 AA_DEBUG("no_new_privs - change_hat denied"); 1065 return -EPERM; 1066 } 1067 1068 /* released below */ 1069 cred = get_current_cred(); | 1051 struct aa_label *label, *previous, *new = NULL, *target = NULL; 1052 struct aa_profile *profile; 1053 struct aa_perms perms = {}; 1054 const char *info = NULL; 1055 int error = 0; 1056 1057 /* 1058 * Fail explicitly requested domain transitions if no_new_privs. 1059 * There is no exception for unconfined as change_hat is not 1060 * available. 1061 */ 1062 if (task_no_new_privs(current)) { 1063 /* not an apparmor denial per se, so don't log it */ 1064 AA_DEBUG("no_new_privs - change_hat denied"); 1065 return -EPERM; 1066 } 1067 1068 /* released below */ 1069 cred = get_current_cred(); |
| 1070 tctx = current_task_ctx(); | 1070 ctx = current_task_ctx(); |
| 1071 label = aa_get_newest_cred_label(cred); | 1071 label = aa_get_newest_cred_label(cred); |
| 1072 previous = aa_get_newest_label(tctx->previous); | 1072 previous = aa_get_newest_label(ctx->previous); |
| 1073 1074 if (unconfined(label)) { 1075 info = "unconfined can not change_hat"; 1076 error = -EPERM; 1077 goto fail; 1078 } 1079 1080 if (count) { --- 236 unchanged lines hidden --- | 1073 1074 if (unconfined(label)) { 1075 info = "unconfined can not change_hat"; 1076 error = -EPERM; 1077 goto fail; 1078 } 1079 1080 if (count) { --- 236 unchanged lines hidden --- |