Lines Matching +full:container +full:- +full:rules
1 // SPDX-License-Identifier: GPL-2.0-only
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
10 * AppArmor policy is based around profiles, which contain the rules a
13 * visible set of profiles or by following a profiles attachment rules.
15 * Each profile exists in a profile namespace which is a container of
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
29 * null-XXXX-YYYY - special automatically generated learning profiles
33 * user-XXXX - user defined profiles
44 * - it allows for sub profiles or hats, which allows an application to run
50 * - it allows for binary hierarchy of profiles, so that execution history
66 * - locking of profile lists is currently fairly coarse. All profile
105 aa_put_dfa(pdb->dfa); in aa_free_pdb()
106 kvfree(pdb->perms); in aa_free_pdb()
107 aa_free_str_table(&pdb->trans); in aa_free_pdb()
113 * aa_pdb_free_kref - free aa_policydb by kref (called by aa_put_pdb)
131 kref_init(&pdb->count); in aa_alloc_pdb()
138 * __add_profile - add a profiles to list and label tree
152 AA_BUG(!profile->ns); in __add_profile()
153 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __add_profile()
155 list_add_rcu(&profile->base.list, list); in __add_profile()
158 l = aa_label_insert(&profile->ns->labels, &profile->label); in __add_profile()
159 AA_BUG(l != &profile->label); in __add_profile()
164 * __list_remove_profile - remove a profile from the list it is on
178 AA_BUG(!profile->ns); in __list_remove_profile()
179 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __list_remove_profile()
181 list_del_rcu(&profile->base.list); in __list_remove_profile()
186 * __remove_profile - remove old profile, and children
194 AA_BUG(!profile->ns); in __remove_profile()
195 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __remove_profile()
198 __aa_profile_list_release(&profile->base.profiles); in __remove_profile()
200 aa_label_remove(&profile->label); in __remove_profile()
206 * __aa_profile_list_release - remove all profiles on the list and put refs
219 * aa_free_data - free a data blob
227 kvfree_sensitive(data->data, data->size); in aa_free_data()
228 kfree_sensitive(data->key); in aa_free_data()
236 for (i = 0; i < attach->xattr_count; i++) in free_attachment()
237 kfree_sensitive(attach->xattrs[i]); in free_attachment()
238 kfree_sensitive(attach->xattrs); in free_attachment()
239 aa_put_pdb(attach->xmatch); in free_attachment()
242 static void free_ruleset(struct aa_ruleset *rules) in free_ruleset() argument
246 if (!rules) in free_ruleset()
249 aa_put_pdb(rules->file); in free_ruleset()
250 aa_put_pdb(rules->policy); in free_ruleset()
251 aa_free_cap_rules(&rules->caps); in free_ruleset()
252 aa_free_rlimit_rules(&rules->rlimits); in free_ruleset()
254 for (i = 0; i < rules->secmark_count; i++) in free_ruleset()
255 kfree_sensitive(rules->secmark[i].label); in free_ruleset()
256 kfree_sensitive(rules->secmark); in free_ruleset()
257 kfree_sensitive(rules); in free_ruleset()
262 struct aa_ruleset *rules; in aa_alloc_ruleset() local
264 rules = kzalloc(sizeof(*rules), gfp); in aa_alloc_ruleset()
266 return rules; in aa_alloc_ruleset()
270 * aa_free_profile - free a profile
289 aa_policy_destroy(&profile->base); in aa_free_profile()
290 aa_put_profile(rcu_access_pointer(profile->parent)); in aa_free_profile()
292 aa_put_ns(profile->ns); in aa_free_profile()
293 kfree_sensitive(profile->rename); in aa_free_profile()
294 kfree_sensitive(profile->disconnected); in aa_free_profile()
296 free_attachment(&profile->attach); in aa_free_profile()
300 * to rules in aa_free_profile()
302 for (int i = 0; i < profile->n_rules; i++) in aa_free_profile()
303 free_ruleset(profile->label.rules[i]); in aa_free_profile()
305 kfree_sensitive(profile->dirname); in aa_free_profile()
307 if (profile->data) { in aa_free_profile()
308 rht = profile->data; in aa_free_profile()
309 profile->data = NULL; in aa_free_profile()
314 kfree_sensitive(profile->hash); in aa_free_profile()
315 aa_put_loaddata(profile->rawdata); in aa_free_profile()
316 aa_label_destroy(&profile->label); in aa_free_profile()
322 * aa_alloc_profile - allocate, initialize and return a new profile
334 /* freed by free_profile - usually through aa_put_profile in aa_alloc_profile()
335 * this adds space for a single ruleset in the rules section of the in aa_alloc_profile()
338 profile = kzalloc(struct_size(profile, label.rules, 1), gfp); in aa_alloc_profile()
342 if (!aa_policy_init(&profile->base, NULL, hname, gfp)) in aa_alloc_profile()
344 if (!aa_label_init(&profile->label, 1, gfp)) in aa_alloc_profile()
348 profile->label.rules[0] = aa_alloc_ruleset(gfp); in aa_alloc_profile()
349 if (!profile->label.rules[0]) in aa_alloc_profile()
351 profile->n_rules = 1; in aa_alloc_profile()
355 proxy = aa_alloc_proxy(&profile->label, gfp); in aa_alloc_profile()
360 profile->label.proxy = proxy; in aa_alloc_profile()
362 profile->label.hname = profile->base.hname; in aa_alloc_profile()
363 profile->label.flags |= FLAG_PROFILE; in aa_alloc_profile()
364 profile->label.vec[0] = profile; in aa_alloc_profile()
366 profile->signal = SIGKILL; in aa_alloc_profile()
381 for (i = 0; i < profile->n_rules; i++) { in ANY_RULE_MEDIATES()
382 if (RULE_MEDIATES(profile->label.rules[i], class)) in ANY_RULE_MEDIATES()
388 /* set of rules that are mediated by unconfined */
401 profile->label.mediates |= ((u64) 1) << AA_CLASS_NS; in aa_compute_profile_mediates()
407 profile->label.mediates |= ((u64) 1) << c; in aa_compute_profile_mediates()
411 /* TODO: profile accounting - setup in remove */
414 * __strn_find_child - find a profile on @head list using substring of @name
430 * __find_child - find a profile on @head list with a name matching @name
444 * aa_find_child - find a profile by @name in @parent
456 profile = __find_child(&parent->base.profiles, name); in aa_find_child()
465 * __lookup_parent - lookup the parent of a profile of name @hname
484 policy = &ns->base; in __lookup_parent()
487 profile = __strn_find_child(&policy->profiles, hname, in __lookup_parent()
488 split - hname); in __lookup_parent()
491 policy = &profile->base; in __lookup_parent()
496 return &ns->base; in __lookup_parent()
497 return &profile->base; in __lookup_parent()
501 * __create_missing_ancestors - create place holders for missing ancestors
522 policy = &ns->base; in __create_missing_ancestors()
526 profile = __strn_find_child(&policy->profiles, hname, in __create_missing_ancestors()
527 split - hname); in __create_missing_ancestors()
529 const char *name = kstrndup(hname, split - hname, in __create_missing_ancestors()
538 profile->ns = aa_get_ns(ns); in __create_missing_ancestors()
540 policy = &profile->base; in __create_missing_ancestors()
545 return &ns->base; in __create_missing_ancestors()
546 return &profile->base; in __create_missing_ancestors()
550 * __lookupn_profile - lookup the profile matching @hname
569 profile = __strn_find_child(&base->profiles, hname, in __lookupn_profile()
570 split - hname); in __lookupn_profile()
574 base = &profile->base; in __lookupn_profile()
575 n -= split + 2 - hname; in __lookupn_profile()
580 return __strn_find_child(&base->profiles, hname, n); in __lookupn_profile()
591 * aa_lookupn_profile - find a profile by its full or partial name
605 profile = __lookupn_profile(&ns->base, hname, n); in aa_lookupn_profile()
611 profile = aa_get_newest_profile(ns->unconfined); in aa_lookupn_profile()
634 profile = aa_lookupn_profile(ns, name, n - (name - fqname)); in aa_fqlookupn_profile()
637 profile = aa_get_newest_profile(ns->unconfined); in aa_fqlookupn_profile()
650 struct aa_ruleset *rules; in aa_alloc_null() local
657 profile->label.flags |= FLAG_NULL; in aa_alloc_null()
658 profile->attach.xmatch = aa_get_pdb(nullpdb); in aa_alloc_null()
659 rules = profile->label.rules[0]; in aa_alloc_null()
660 rules->file = aa_get_pdb(nullpdb); in aa_alloc_null()
661 rules->policy = aa_get_pdb(nullpdb); in aa_alloc_null()
665 profile->path_flags = parent->path_flags; in aa_alloc_null()
667 profile->label.mediates = parent->label.mediates; in aa_alloc_null()
669 rcu_assign_pointer(profile->parent, aa_get_profile(parent)); in aa_alloc_null()
670 profile->ns = aa_get_ns(parent->ns); in aa_alloc_null()
677 * aa_new_learning_profile - create or find a null-X learning profile
679 * @hat: true if the null- learning profile is a hat
683 * Find/Create a null- complain mode profile used in learning mode. The
684 * name of the profile is unique and follows the format of parent//null-XXX.
704 name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base), in aa_new_learning_profile()
707 sprintf(name, "%s//null-%s", parent->base.hname, base); in aa_new_learning_profile()
713 name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp); in aa_new_learning_profile()
716 sprintf(name, "%s//null-%x", parent->base.hname, in aa_new_learning_profile()
717 atomic_inc_return(&parent->ns->uniq_null)); in aa_new_learning_profile()
729 profile->mode = APPARMOR_COMPLAIN; in aa_new_learning_profile()
731 profile->label.flags |= FLAG_HAT; in aa_new_learning_profile()
733 mutex_lock_nested(&profile->ns->lock, profile->ns->level); in aa_new_learning_profile()
734 p = __find_child(&parent->base.profiles, bname); in aa_new_learning_profile()
739 __add_profile(&parent->base.profiles, profile); in aa_new_learning_profile()
741 mutex_unlock(&profile->ns->lock); in aa_new_learning_profile()
756 * replacement_allowed - test to see if replacement is allowed
759 * @info: Returns - info about why replacement failed (NOT NULL)
767 if (profile->label.flags & FLAG_IMMUTIBLE) { in replacement_allowed()
769 return -EPERM; in replacement_allowed()
772 return -EEXIST; in replacement_allowed()
784 if (ad->iface.ns) { in audit_cb()
786 audit_log_untrustedstring(ab, ad->iface.ns); in audit_cb()
791 * audit_policy - Do auditing of policy changes
836 * aa_policy_view_capable - check if viewing policy in at @ns is allowed
849 struct user_namespace *user_ns = subj_cred->user_ns; in aa_policy_view_capable()
860 user_ns->level == view_ns->level))) in aa_policy_view_capable()
869 struct user_namespace *user_ns = subj_cred->user_ns; in aa_policy_admin_capable()
905 * aa_may_manage_policy - can the current task manage policy
928 -EACCES); in aa_may_manage_policy()
932 -EACCES); in aa_may_manage_policy()
941 const char *base = basename(profile->base.hname); in __list_lookup_parent()
942 long len = base - profile->base.hname; in __list_lookup_parent()
948 len -= 2; in __list_lookup_parent()
951 if (ent->new == profile) in __list_lookup_parent()
953 if (strncmp(ent->new->base.hname, profile->base.hname, len) == in __list_lookup_parent()
954 0 && ent->new->base.hname[len] == 0) in __list_lookup_parent()
955 return ent->new; in __list_lookup_parent()
962 * __replace_profile - replace @old with @new on a list
977 if (!list_empty(&old->base.profiles)) { in __replace_profile()
979 list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu); in __replace_profile()
984 list_del_init(&child->base.list); in __replace_profile()
985 p = __find_child(&new->base.profiles, child->base.name); in __replace_profile()
996 rcu_assign_pointer(child->parent, aa_get_profile(new)); in __replace_profile()
997 list_add_rcu(&child->base.list, &new->base.profiles); in __replace_profile()
1002 if (!rcu_access_pointer(new->parent)) { in __replace_profile()
1004 rcu_assign_pointer(new->parent, aa_get_profile(parent)); in __replace_profile()
1006 aa_label_replace(&old->label, &new->label); in __replace_profile()
1010 if (list_empty(&new->base.list)) { in __replace_profile()
1012 list_replace_rcu(&old->base.list, &new->base.list); in __replace_profile()
1020 * __lookup_replace - lookup replacement information for a profile
1024 * @p: Returns - profile to be replaced
1025 * @info: Returns - info string on why lookup failed
1033 *p = aa_get_profile(__lookup_profile(&ns->base, hname)); in __lookup_replace()
1047 aa_put_str(new->base.hname); in share_name()
1048 aa_get_str(old->base.hname); in share_name()
1049 new->base.hname = old->base.hname; in share_name()
1050 new->base.name = old->base.name; in share_name()
1051 new->label.hname = old->label.hname; in share_name()
1061 parent = rcu_dereference_protected(new->parent, in update_to_newest_parent()
1062 mutex_is_locked(&new->ns->lock)); in update_to_newest_parent()
1068 rcu_assign_pointer(new->parent, newest); in update_to_newest_parent()
1076 * aa_replace_profiles - replace profile(s) on the profile list
1115 if (ent->ns_name && in aa_replace_profiles()
1116 strcmp(ent->ns_name, ns_name) != 0) { in aa_replace_profiles()
1118 error = -EACCES; in aa_replace_profiles()
1121 } else if (ent->ns_name) { in aa_replace_profiles()
1124 error = -EACCES; in aa_replace_profiles()
1127 ns_name = ent->ns_name; in aa_replace_profiles()
1145 mutex_lock_nested(&ns->lock, ns->level); in aa_replace_profiles()
1147 if (!list_empty(&ns->rawdata_list)) { in aa_replace_profiles()
1148 list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) { in aa_replace_profiles()
1168 ent->new->rawdata = aa_get_loaddata(udata); in aa_replace_profiles()
1169 error = __lookup_replace(ns, ent->new->base.hname, in aa_replace_profiles()
1171 &ent->old, &info); in aa_replace_profiles()
1175 if (ent->new->rename) { in aa_replace_profiles()
1176 error = __lookup_replace(ns, ent->new->rename, in aa_replace_profiles()
1178 &ent->rename, &info); in aa_replace_profiles()
1184 ent->new->ns = aa_get_ns(ns); in aa_replace_profiles()
1186 if (ent->old || ent->rename) in aa_replace_profiles()
1191 policy = __lookup_parent(ns, ent->new->base.hname); in aa_replace_profiles()
1194 p = __list_lookup_parent(&lh, ent->new); in aa_replace_profiles()
1209 ent->new->base.hname, in aa_replace_profiles()
1212 error = -ENOENT; in aa_replace_profiles()
1218 if (!p && policy != &ns->base) in aa_replace_profiles()
1221 rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); in aa_replace_profiles()
1225 if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) { in aa_replace_profiles()
1234 if (!ent->old) { in aa_replace_profiles()
1236 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1238 p = aa_deref_parent(ent->new); in aa_replace_profiles()
1241 parent = ns_subprofs_dir(ent->new->ns); in aa_replace_profiles()
1242 error = __aafs_profile_mkdir(ent->new, parent); in aa_replace_profiles()
1251 /* Done with checks that may fail - do actual replacement */ in aa_replace_profiles()
1254 __aa_loaddata_update(udata, ns->revision); in aa_replace_profiles()
1256 list_del_init(&ent->list); in aa_replace_profiles()
1257 op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1259 if (ent->old && ent->old->rawdata == ent->new->rawdata && in aa_replace_profiles()
1260 ent->new->rawdata) { in aa_replace_profiles()
1262 audit_policy(label, op, ns_name, ent->new->base.hname, in aa_replace_profiles()
1266 aa_put_proxy(ent->new->label.proxy); in aa_replace_profiles()
1267 ent->new->label.proxy = NULL; in aa_replace_profiles()
1275 audit_policy(label, op, ns_name, ent->new->base.hname, NULL, in aa_replace_profiles()
1278 if (ent->old) { in aa_replace_profiles()
1279 share_name(ent->old, ent->new); in aa_replace_profiles()
1280 __replace_profile(ent->old, ent->new); in aa_replace_profiles()
1284 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1287 parent = update_to_newest_parent(ent->new); in aa_replace_profiles()
1288 lh = &parent->base.profiles; in aa_replace_profiles()
1290 lh = &ns->base.profiles; in aa_replace_profiles()
1291 __add_profile(lh, ent->new); in aa_replace_profiles()
1297 mutex_unlock(&ns->lock); in aa_replace_profiles()
1306 return udata->size; in aa_replace_profiles()
1309 mutex_unlock(&ns->lock); in aa_replace_profiles()
1312 op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1314 audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL, in aa_replace_profiles()
1324 op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1325 audit_policy(label, op, ns_name, tmp->new->base.hname, info, in aa_replace_profiles()
1329 list_del_init(&ent->list); in aa_replace_profiles()
1337 * aa_remove_profiles - remove profile(s) from the system
1361 error = -ENOENT; in aa_remove_profiles()
1374 error = -ENOENT; in aa_remove_profiles()
1382 /* remove namespace - can only happen if fqname[0] == ':' */ in aa_remove_profiles()
1383 mutex_lock_nested(&ns->parent->lock, ns->parent->level); in aa_remove_profiles()
1386 mutex_unlock(&ns->parent->lock); in aa_remove_profiles()
1389 mutex_lock_nested(&ns->lock, ns->level); in aa_remove_profiles()
1390 profile = aa_get_profile(__lookup_profile(&ns->base, name)); in aa_remove_profiles()
1392 error = -ENOENT; in aa_remove_profiles()
1396 name = profile->base.hname; in aa_remove_profiles()
1400 mutex_unlock(&ns->lock); in aa_remove_profiles()
1411 mutex_unlock(&ns->lock); in aa_remove_profiles()