xref: /linux/security/apparmor/lsm.c (revision fa84cf094ef9667e2b91c104b0a788fd1896f482)
1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor LSM hooks.
5  *
6  * Copyright (C) 1998-2008 Novell/SUSE
7  * Copyright 2009-2010 Canonical Ltd.
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License as
11  * published by the Free Software Foundation, version 2 of the
12  * License.
13  */
14 
15 #include <linux/lsm_hooks.h>
16 #include <linux/moduleparam.h>
17 #include <linux/mm.h>
18 #include <linux/mman.h>
19 #include <linux/mount.h>
20 #include <linux/namei.h>
21 #include <linux/ptrace.h>
22 #include <linux/ctype.h>
23 #include <linux/sysctl.h>
24 #include <linux/audit.h>
25 #include <linux/user_namespace.h>
26 #include <net/sock.h>
27 
28 #include "include/apparmor.h"
29 #include "include/apparmorfs.h"
30 #include "include/audit.h"
31 #include "include/capability.h"
32 #include "include/cred.h"
33 #include "include/file.h"
34 #include "include/ipc.h"
35 #include "include/net.h"
36 #include "include/path.h"
37 #include "include/label.h"
38 #include "include/policy.h"
39 #include "include/policy_ns.h"
40 #include "include/procattr.h"
41 #include "include/mount.h"
42 #include "include/secid.h"
43 
44 /* Flag indicating whether initialization completed */
45 int apparmor_initialized;
46 
47 DEFINE_PER_CPU(struct aa_buffers, aa_buffers);
48 
49 
50 /*
51  * LSM hook functions
52  */
53 
54 /*
55  * put the associated labels
56  */
57 static void apparmor_cred_free(struct cred *cred)
58 {
59 	aa_put_label(cred_label(cred));
60 	cred_label(cred) = NULL;
61 }
62 
63 /*
64  * allocate the apparmor part of blank credentials
65  */
66 static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
67 {
68 	cred_label(cred) = NULL;
69 	return 0;
70 }
71 
72 /*
73  * prepare new cred label for modification by prepare_cred block
74  */
75 static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
76 				 gfp_t gfp)
77 {
78 	cred_label(new) = aa_get_newest_label(cred_label(old));
79 	return 0;
80 }
81 
82 /*
83  * transfer the apparmor data to a blank set of creds
84  */
85 static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
86 {
87 	cred_label(new) = aa_get_newest_label(cred_label(old));
88 }
89 
90 static void apparmor_task_free(struct task_struct *task)
91 {
92 
93 	aa_free_task_ctx(task_ctx(task));
94 	task_ctx(task) = NULL;
95 }
96 
97 static int apparmor_task_alloc(struct task_struct *task,
98 			       unsigned long clone_flags)
99 {
100 	struct aa_task_ctx *new = aa_alloc_task_ctx(GFP_KERNEL);
101 
102 	if (!new)
103 		return -ENOMEM;
104 
105 	aa_dup_task_ctx(new, task_ctx(current));
106 	task_ctx(task) = new;
107 
108 	return 0;
109 }
110 
111 static int apparmor_ptrace_access_check(struct task_struct *child,
112 					unsigned int mode)
113 {
114 	struct aa_label *tracer, *tracee;
115 	int error;
116 
117 	tracer = begin_current_label_crit_section();
118 	tracee = aa_get_task_label(child);
119 	error = aa_may_ptrace(tracer, tracee,
120 			(mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
121 						  : AA_PTRACE_TRACE);
122 	aa_put_label(tracee);
123 	end_current_label_crit_section(tracer);
124 
125 	return error;
126 }
127 
128 static int apparmor_ptrace_traceme(struct task_struct *parent)
129 {
130 	struct aa_label *tracer, *tracee;
131 	int error;
132 
133 	tracee = begin_current_label_crit_section();
134 	tracer = aa_get_task_label(parent);
135 	error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE);
136 	aa_put_label(tracer);
137 	end_current_label_crit_section(tracee);
138 
139 	return error;
140 }
141 
142 /* Derived from security/commoncap.c:cap_capget */
143 static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
144 			   kernel_cap_t *inheritable, kernel_cap_t *permitted)
145 {
146 	struct aa_label *label;
147 	const struct cred *cred;
148 
149 	rcu_read_lock();
150 	cred = __task_cred(target);
151 	label = aa_get_newest_cred_label(cred);
152 
153 	/*
154 	 * cap_capget is stacked ahead of this and will
155 	 * initialize effective and permitted.
156 	 */
157 	if (!unconfined(label)) {
158 		struct aa_profile *profile;
159 		struct label_it i;
160 
161 		label_for_each_confined(i, label, profile) {
162 			if (COMPLAIN_MODE(profile))
163 				continue;
164 			*effective = cap_intersect(*effective,
165 						   profile->caps.allow);
166 			*permitted = cap_intersect(*permitted,
167 						   profile->caps.allow);
168 		}
169 	}
170 	rcu_read_unlock();
171 	aa_put_label(label);
172 
173 	return 0;
174 }
175 
176 static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
177 			    int cap, int audit)
178 {
179 	struct aa_label *label;
180 	int error = 0;
181 
182 	label = aa_get_newest_cred_label(cred);
183 	if (!unconfined(label))
184 		error = aa_capable(label, cap, audit);
185 	aa_put_label(label);
186 
187 	return error;
188 }
189 
190 /**
191  * common_perm - basic common permission check wrapper fn for paths
192  * @op: operation being checked
193  * @path: path to check permission of  (NOT NULL)
194  * @mask: requested permissions mask
195  * @cond: conditional info for the permission request  (NOT NULL)
196  *
197  * Returns: %0 else error code if error or permission denied
198  */
199 static int common_perm(const char *op, const struct path *path, u32 mask,
200 		       struct path_cond *cond)
201 {
202 	struct aa_label *label;
203 	int error = 0;
204 
205 	label = __begin_current_label_crit_section();
206 	if (!unconfined(label))
207 		error = aa_path_perm(op, label, path, 0, mask, cond);
208 	__end_current_label_crit_section(label);
209 
210 	return error;
211 }
212 
213 /**
214  * common_perm_cond - common permission wrapper around inode cond
215  * @op: operation being checked
216  * @path: location to check (NOT NULL)
217  * @mask: requested permissions mask
218  *
219  * Returns: %0 else error code if error or permission denied
220  */
221 static int common_perm_cond(const char *op, const struct path *path, u32 mask)
222 {
223 	struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
224 				  d_backing_inode(path->dentry)->i_mode
225 	};
226 
227 	if (!path_mediated_fs(path->dentry))
228 		return 0;
229 
230 	return common_perm(op, path, mask, &cond);
231 }
232 
233 /**
234  * common_perm_dir_dentry - common permission wrapper when path is dir, dentry
235  * @op: operation being checked
236  * @dir: directory of the dentry  (NOT NULL)
237  * @dentry: dentry to check  (NOT NULL)
238  * @mask: requested permissions mask
239  * @cond: conditional info for the permission request  (NOT NULL)
240  *
241  * Returns: %0 else error code if error or permission denied
242  */
243 static int common_perm_dir_dentry(const char *op, const struct path *dir,
244 				  struct dentry *dentry, u32 mask,
245 				  struct path_cond *cond)
246 {
247 	struct path path = { .mnt = dir->mnt, .dentry = dentry };
248 
249 	return common_perm(op, &path, mask, cond);
250 }
251 
252 /**
253  * common_perm_rm - common permission wrapper for operations doing rm
254  * @op: operation being checked
255  * @dir: directory that the dentry is in  (NOT NULL)
256  * @dentry: dentry being rm'd  (NOT NULL)
257  * @mask: requested permission mask
258  *
259  * Returns: %0 else error code if error or permission denied
260  */
261 static int common_perm_rm(const char *op, const struct path *dir,
262 			  struct dentry *dentry, u32 mask)
263 {
264 	struct inode *inode = d_backing_inode(dentry);
265 	struct path_cond cond = { };
266 
267 	if (!inode || !path_mediated_fs(dentry))
268 		return 0;
269 
270 	cond.uid = inode->i_uid;
271 	cond.mode = inode->i_mode;
272 
273 	return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
274 }
275 
276 /**
277  * common_perm_create - common permission wrapper for operations doing create
278  * @op: operation being checked
279  * @dir: directory that dentry will be created in  (NOT NULL)
280  * @dentry: dentry to create   (NOT NULL)
281  * @mask: request permission mask
282  * @mode: created file mode
283  *
284  * Returns: %0 else error code if error or permission denied
285  */
286 static int common_perm_create(const char *op, const struct path *dir,
287 			      struct dentry *dentry, u32 mask, umode_t mode)
288 {
289 	struct path_cond cond = { current_fsuid(), mode };
290 
291 	if (!path_mediated_fs(dir->dentry))
292 		return 0;
293 
294 	return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
295 }
296 
297 static int apparmor_path_unlink(const struct path *dir, struct dentry *dentry)
298 {
299 	return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE);
300 }
301 
302 static int apparmor_path_mkdir(const struct path *dir, struct dentry *dentry,
303 			       umode_t mode)
304 {
305 	return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE,
306 				  S_IFDIR);
307 }
308 
309 static int apparmor_path_rmdir(const struct path *dir, struct dentry *dentry)
310 {
311 	return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE);
312 }
313 
314 static int apparmor_path_mknod(const struct path *dir, struct dentry *dentry,
315 			       umode_t mode, unsigned int dev)
316 {
317 	return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode);
318 }
319 
320 static int apparmor_path_truncate(const struct path *path)
321 {
322 	return common_perm_cond(OP_TRUNC, path, MAY_WRITE | AA_MAY_SETATTR);
323 }
324 
325 static int apparmor_path_symlink(const struct path *dir, struct dentry *dentry,
326 				 const char *old_name)
327 {
328 	return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE,
329 				  S_IFLNK);
330 }
331 
332 static int apparmor_path_link(struct dentry *old_dentry, const struct path *new_dir,
333 			      struct dentry *new_dentry)
334 {
335 	struct aa_label *label;
336 	int error = 0;
337 
338 	if (!path_mediated_fs(old_dentry))
339 		return 0;
340 
341 	label = begin_current_label_crit_section();
342 	if (!unconfined(label))
343 		error = aa_path_link(label, old_dentry, new_dir, new_dentry);
344 	end_current_label_crit_section(label);
345 
346 	return error;
347 }
348 
349 static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_dentry,
350 				const struct path *new_dir, struct dentry *new_dentry)
351 {
352 	struct aa_label *label;
353 	int error = 0;
354 
355 	if (!path_mediated_fs(old_dentry))
356 		return 0;
357 
358 	label = begin_current_label_crit_section();
359 	if (!unconfined(label)) {
360 		struct path old_path = { .mnt = old_dir->mnt,
361 					 .dentry = old_dentry };
362 		struct path new_path = { .mnt = new_dir->mnt,
363 					 .dentry = new_dentry };
364 		struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
365 					  d_backing_inode(old_dentry)->i_mode
366 		};
367 
368 		error = aa_path_perm(OP_RENAME_SRC, label, &old_path, 0,
369 				     MAY_READ | AA_MAY_GETATTR | MAY_WRITE |
370 				     AA_MAY_SETATTR | AA_MAY_DELETE,
371 				     &cond);
372 		if (!error)
373 			error = aa_path_perm(OP_RENAME_DEST, label, &new_path,
374 					     0, MAY_WRITE | AA_MAY_SETATTR |
375 					     AA_MAY_CREATE, &cond);
376 
377 	}
378 	end_current_label_crit_section(label);
379 
380 	return error;
381 }
382 
383 static int apparmor_path_chmod(const struct path *path, umode_t mode)
384 {
385 	return common_perm_cond(OP_CHMOD, path, AA_MAY_CHMOD);
386 }
387 
388 static int apparmor_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
389 {
390 	return common_perm_cond(OP_CHOWN, path, AA_MAY_CHOWN);
391 }
392 
393 static int apparmor_inode_getattr(const struct path *path)
394 {
395 	return common_perm_cond(OP_GETATTR, path, AA_MAY_GETATTR);
396 }
397 
398 static int apparmor_file_open(struct file *file, const struct cred *cred)
399 {
400 	struct aa_file_ctx *fctx = file_ctx(file);
401 	struct aa_label *label;
402 	int error = 0;
403 
404 	if (!path_mediated_fs(file->f_path.dentry))
405 		return 0;
406 
407 	/* If in exec, permission is handled by bprm hooks.
408 	 * Cache permissions granted by the previous exec check, with
409 	 * implicit read and executable mmap which are required to
410 	 * actually execute the image.
411 	 */
412 	if (current->in_execve) {
413 		fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
414 		return 0;
415 	}
416 
417 	label = aa_get_newest_cred_label(cred);
418 	if (!unconfined(label)) {
419 		struct inode *inode = file_inode(file);
420 		struct path_cond cond = { inode->i_uid, inode->i_mode };
421 
422 		error = aa_path_perm(OP_OPEN, label, &file->f_path, 0,
423 				     aa_map_file_to_perms(file), &cond);
424 		/* todo cache full allowed permissions set and state */
425 		fctx->allow = aa_map_file_to_perms(file);
426 	}
427 	aa_put_label(label);
428 
429 	return error;
430 }
431 
432 static int apparmor_file_alloc_security(struct file *file)
433 {
434 	int error = 0;
435 
436 	/* freed by apparmor_file_free_security */
437 	struct aa_label *label = begin_current_label_crit_section();
438 	file->f_security = aa_alloc_file_ctx(label, GFP_KERNEL);
439 	if (!file_ctx(file))
440 		error = -ENOMEM;
441 	end_current_label_crit_section(label);
442 
443 	return error;
444 }
445 
446 static void apparmor_file_free_security(struct file *file)
447 {
448 	aa_free_file_ctx(file_ctx(file));
449 }
450 
451 static int common_file_perm(const char *op, struct file *file, u32 mask)
452 {
453 	struct aa_label *label;
454 	int error = 0;
455 
456 	/* don't reaudit files closed during inheritance */
457 	if (file->f_path.dentry == aa_null.dentry)
458 		return -EACCES;
459 
460 	label = __begin_current_label_crit_section();
461 	error = aa_file_perm(op, label, file, mask);
462 	__end_current_label_crit_section(label);
463 
464 	return error;
465 }
466 
467 static int apparmor_file_receive(struct file *file)
468 {
469 	return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file));
470 }
471 
472 static int apparmor_file_permission(struct file *file, int mask)
473 {
474 	return common_file_perm(OP_FPERM, file, mask);
475 }
476 
477 static int apparmor_file_lock(struct file *file, unsigned int cmd)
478 {
479 	u32 mask = AA_MAY_LOCK;
480 
481 	if (cmd == F_WRLCK)
482 		mask |= MAY_WRITE;
483 
484 	return common_file_perm(OP_FLOCK, file, mask);
485 }
486 
487 static int common_mmap(const char *op, struct file *file, unsigned long prot,
488 		       unsigned long flags)
489 {
490 	int mask = 0;
491 
492 	if (!file || !file_ctx(file))
493 		return 0;
494 
495 	if (prot & PROT_READ)
496 		mask |= MAY_READ;
497 	/*
498 	 * Private mappings don't require write perms since they don't
499 	 * write back to the files
500 	 */
501 	if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
502 		mask |= MAY_WRITE;
503 	if (prot & PROT_EXEC)
504 		mask |= AA_EXEC_MMAP;
505 
506 	return common_file_perm(op, file, mask);
507 }
508 
509 static int apparmor_mmap_file(struct file *file, unsigned long reqprot,
510 			      unsigned long prot, unsigned long flags)
511 {
512 	return common_mmap(OP_FMMAP, file, prot, flags);
513 }
514 
515 static int apparmor_file_mprotect(struct vm_area_struct *vma,
516 				  unsigned long reqprot, unsigned long prot)
517 {
518 	return common_mmap(OP_FMPROT, vma->vm_file, prot,
519 			   !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
520 }
521 
522 static int apparmor_sb_mount(const char *dev_name, const struct path *path,
523 			     const char *type, unsigned long flags, void *data)
524 {
525 	struct aa_label *label;
526 	int error = 0;
527 
528 	/* Discard magic */
529 	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
530 		flags &= ~MS_MGC_MSK;
531 
532 	flags &= ~AA_MS_IGNORE_MASK;
533 
534 	label = __begin_current_label_crit_section();
535 	if (!unconfined(label)) {
536 		if (flags & MS_REMOUNT)
537 			error = aa_remount(label, path, flags, data);
538 		else if (flags & MS_BIND)
539 			error = aa_bind_mount(label, path, dev_name, flags);
540 		else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE |
541 				  MS_UNBINDABLE))
542 			error = aa_mount_change_type(label, path, flags);
543 		else if (flags & MS_MOVE)
544 			error = aa_move_mount(label, path, dev_name);
545 		else
546 			error = aa_new_mount(label, dev_name, path, type,
547 					     flags, data);
548 	}
549 	__end_current_label_crit_section(label);
550 
551 	return error;
552 }
553 
554 static int apparmor_sb_umount(struct vfsmount *mnt, int flags)
555 {
556 	struct aa_label *label;
557 	int error = 0;
558 
559 	label = __begin_current_label_crit_section();
560 	if (!unconfined(label))
561 		error = aa_umount(label, mnt, flags);
562 	__end_current_label_crit_section(label);
563 
564 	return error;
565 }
566 
567 static int apparmor_sb_pivotroot(const struct path *old_path,
568 				 const struct path *new_path)
569 {
570 	struct aa_label *label;
571 	int error = 0;
572 
573 	label = aa_get_current_label();
574 	if (!unconfined(label))
575 		error = aa_pivotroot(label, old_path, new_path);
576 	aa_put_label(label);
577 
578 	return error;
579 }
580 
581 static int apparmor_getprocattr(struct task_struct *task, char *name,
582 				char **value)
583 {
584 	int error = -ENOENT;
585 	/* released below */
586 	const struct cred *cred = get_task_cred(task);
587 	struct aa_task_ctx *ctx = task_ctx(current);
588 	struct aa_label *label = NULL;
589 
590 	if (strcmp(name, "current") == 0)
591 		label = aa_get_newest_label(cred_label(cred));
592 	else if (strcmp(name, "prev") == 0  && ctx->previous)
593 		label = aa_get_newest_label(ctx->previous);
594 	else if (strcmp(name, "exec") == 0 && ctx->onexec)
595 		label = aa_get_newest_label(ctx->onexec);
596 	else
597 		error = -EINVAL;
598 
599 	if (label)
600 		error = aa_getprocattr(label, value);
601 
602 	aa_put_label(label);
603 	put_cred(cred);
604 
605 	return error;
606 }
607 
608 static int apparmor_setprocattr(const char *name, void *value,
609 				size_t size)
610 {
611 	char *command, *largs = NULL, *args = value;
612 	size_t arg_size;
613 	int error;
614 	DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR);
615 
616 	if (size == 0)
617 		return -EINVAL;
618 
619 	/* AppArmor requires that the buffer must be null terminated atm */
620 	if (args[size - 1] != '\0') {
621 		/* null terminate */
622 		largs = args = kmalloc(size + 1, GFP_KERNEL);
623 		if (!args)
624 			return -ENOMEM;
625 		memcpy(args, value, size);
626 		args[size] = '\0';
627 	}
628 
629 	error = -EINVAL;
630 	args = strim(args);
631 	command = strsep(&args, " ");
632 	if (!args)
633 		goto out;
634 	args = skip_spaces(args);
635 	if (!*args)
636 		goto out;
637 
638 	arg_size = size - (args - (largs ? largs : (char *) value));
639 	if (strcmp(name, "current") == 0) {
640 		if (strcmp(command, "changehat") == 0) {
641 			error = aa_setprocattr_changehat(args, arg_size,
642 							 AA_CHANGE_NOFLAGS);
643 		} else if (strcmp(command, "permhat") == 0) {
644 			error = aa_setprocattr_changehat(args, arg_size,
645 							 AA_CHANGE_TEST);
646 		} else if (strcmp(command, "changeprofile") == 0) {
647 			error = aa_change_profile(args, AA_CHANGE_NOFLAGS);
648 		} else if (strcmp(command, "permprofile") == 0) {
649 			error = aa_change_profile(args, AA_CHANGE_TEST);
650 		} else if (strcmp(command, "stack") == 0) {
651 			error = aa_change_profile(args, AA_CHANGE_STACK);
652 		} else
653 			goto fail;
654 	} else if (strcmp(name, "exec") == 0) {
655 		if (strcmp(command, "exec") == 0)
656 			error = aa_change_profile(args, AA_CHANGE_ONEXEC);
657 		else if (strcmp(command, "stack") == 0)
658 			error = aa_change_profile(args, (AA_CHANGE_ONEXEC |
659 							 AA_CHANGE_STACK));
660 		else
661 			goto fail;
662 	} else
663 		/* only support the "current" and "exec" process attributes */
664 		goto fail;
665 
666 	if (!error)
667 		error = size;
668 out:
669 	kfree(largs);
670 	return error;
671 
672 fail:
673 	aad(&sa)->label = begin_current_label_crit_section();
674 	aad(&sa)->info = name;
675 	aad(&sa)->error = error = -EINVAL;
676 	aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
677 	end_current_label_crit_section(aad(&sa)->label);
678 	goto out;
679 }
680 
681 /**
682  * apparmor_bprm_committing_creds - do task cleanup on committing new creds
683  * @bprm: binprm for the exec  (NOT NULL)
684  */
685 static void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
686 {
687 	struct aa_label *label = aa_current_raw_label();
688 	struct aa_label *new_label = cred_label(bprm->cred);
689 
690 	/* bail out if unconfined or not changing profile */
691 	if ((new_label->proxy == label->proxy) ||
692 	    (unconfined(new_label)))
693 		return;
694 
695 	aa_inherit_files(bprm->cred, current->files);
696 
697 	current->pdeath_signal = 0;
698 
699 	/* reset soft limits and set hard limits for the new label */
700 	__aa_transition_rlimits(label, new_label);
701 }
702 
703 /**
704  * apparmor_bprm_committed_cred - do cleanup after new creds committed
705  * @bprm: binprm for the exec  (NOT NULL)
706  */
707 static void apparmor_bprm_committed_creds(struct linux_binprm *bprm)
708 {
709 	/* clear out temporary/transitional state from the context */
710 	aa_clear_task_ctx_trans(task_ctx(current));
711 
712 	return;
713 }
714 
715 static void apparmor_task_getsecid(struct task_struct *p, u32 *secid)
716 {
717 	struct aa_label *label = aa_get_task_label(p);
718 	*secid = label->secid;
719 	aa_put_label(label);
720 }
721 
722 static int apparmor_task_setrlimit(struct task_struct *task,
723 		unsigned int resource, struct rlimit *new_rlim)
724 {
725 	struct aa_label *label = __begin_current_label_crit_section();
726 	int error = 0;
727 
728 	if (!unconfined(label))
729 		error = aa_task_setrlimit(label, task, resource, new_rlim);
730 	__end_current_label_crit_section(label);
731 
732 	return error;
733 }
734 
735 static int apparmor_task_kill(struct task_struct *target, struct siginfo *info,
736 			      int sig, const struct cred *cred)
737 {
738 	struct aa_label *cl, *tl;
739 	int error;
740 
741 	if (cred) {
742 		/*
743 		 * Dealing with USB IO specific behavior
744 		 */
745 		cl = aa_get_newest_cred_label(cred);
746 		tl = aa_get_task_label(target);
747 		error = aa_may_signal(cl, tl, sig);
748 		aa_put_label(cl);
749 		aa_put_label(tl);
750 		return error;
751 	}
752 
753 	cl = __begin_current_label_crit_section();
754 	tl = aa_get_task_label(target);
755 	error = aa_may_signal(cl, tl, sig);
756 	aa_put_label(tl);
757 	__end_current_label_crit_section(cl);
758 
759 	return error;
760 }
761 
762 /**
763  * apparmor_sk_alloc_security - allocate and attach the sk_security field
764  */
765 static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
766 {
767 	struct aa_sk_ctx *ctx;
768 
769 	ctx = kzalloc(sizeof(*ctx), flags);
770 	if (!ctx)
771 		return -ENOMEM;
772 
773 	SK_CTX(sk) = ctx;
774 
775 	return 0;
776 }
777 
778 /**
779  * apparmor_sk_free_security - free the sk_security field
780  */
781 static void apparmor_sk_free_security(struct sock *sk)
782 {
783 	struct aa_sk_ctx *ctx = SK_CTX(sk);
784 
785 	SK_CTX(sk) = NULL;
786 	aa_put_label(ctx->label);
787 	aa_put_label(ctx->peer);
788 	kfree(ctx);
789 }
790 
791 /**
792  * apparmor_clone_security - clone the sk_security field
793  */
794 static void apparmor_sk_clone_security(const struct sock *sk,
795 				       struct sock *newsk)
796 {
797 	struct aa_sk_ctx *ctx = SK_CTX(sk);
798 	struct aa_sk_ctx *new = SK_CTX(newsk);
799 
800 	new->label = aa_get_label(ctx->label);
801 	new->peer = aa_get_label(ctx->peer);
802 }
803 
804 /**
805  * apparmor_socket_create - check perms before creating a new socket
806  */
807 static int apparmor_socket_create(int family, int type, int protocol, int kern)
808 {
809 	struct aa_label *label;
810 	int error = 0;
811 
812 	AA_BUG(in_interrupt());
813 
814 	label = begin_current_label_crit_section();
815 	if (!(kern || unconfined(label)))
816 		error = af_select(family,
817 				  create_perm(label, family, type, protocol),
818 				  aa_af_perm(label, OP_CREATE, AA_MAY_CREATE,
819 					     family, type, protocol));
820 	end_current_label_crit_section(label);
821 
822 	return error;
823 }
824 
825 /**
826  * apparmor_socket_post_create - setup the per-socket security struct
827  *
828  * Note:
829  * -   kernel sockets currently labeled unconfined but we may want to
830  *     move to a special kernel label
831  * -   socket may not have sk here if created with sock_create_lite or
832  *     sock_alloc. These should be accept cases which will be handled in
833  *     sock_graft.
834  */
835 static int apparmor_socket_post_create(struct socket *sock, int family,
836 				       int type, int protocol, int kern)
837 {
838 	struct aa_label *label;
839 
840 	if (kern) {
841 		struct aa_ns *ns = aa_get_current_ns();
842 
843 		label = aa_get_label(ns_unconfined(ns));
844 		aa_put_ns(ns);
845 	} else
846 		label = aa_get_current_label();
847 
848 	if (sock->sk) {
849 		struct aa_sk_ctx *ctx = SK_CTX(sock->sk);
850 
851 		aa_put_label(ctx->label);
852 		ctx->label = aa_get_label(label);
853 	}
854 	aa_put_label(label);
855 
856 	return 0;
857 }
858 
859 /**
860  * apparmor_socket_bind - check perms before bind addr to socket
861  */
862 static int apparmor_socket_bind(struct socket *sock,
863 				struct sockaddr *address, int addrlen)
864 {
865 	AA_BUG(!sock);
866 	AA_BUG(!sock->sk);
867 	AA_BUG(!address);
868 	AA_BUG(in_interrupt());
869 
870 	return af_select(sock->sk->sk_family,
871 			 bind_perm(sock, address, addrlen),
872 			 aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk));
873 }
874 
875 /**
876  * apparmor_socket_connect - check perms before connecting @sock to @address
877  */
878 static int apparmor_socket_connect(struct socket *sock,
879 				   struct sockaddr *address, int addrlen)
880 {
881 	AA_BUG(!sock);
882 	AA_BUG(!sock->sk);
883 	AA_BUG(!address);
884 	AA_BUG(in_interrupt());
885 
886 	return af_select(sock->sk->sk_family,
887 			 connect_perm(sock, address, addrlen),
888 			 aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk));
889 }
890 
891 /**
892  * apparmor_socket_list - check perms before allowing listen
893  */
894 static int apparmor_socket_listen(struct socket *sock, int backlog)
895 {
896 	AA_BUG(!sock);
897 	AA_BUG(!sock->sk);
898 	AA_BUG(in_interrupt());
899 
900 	return af_select(sock->sk->sk_family,
901 			 listen_perm(sock, backlog),
902 			 aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk));
903 }
904 
905 /**
906  * apparmor_socket_accept - check perms before accepting a new connection.
907  *
908  * Note: while @newsock is created and has some information, the accept
909  *       has not been done.
910  */
911 static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
912 {
913 	AA_BUG(!sock);
914 	AA_BUG(!sock->sk);
915 	AA_BUG(!newsock);
916 	AA_BUG(in_interrupt());
917 
918 	return af_select(sock->sk->sk_family,
919 			 accept_perm(sock, newsock),
920 			 aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk));
921 }
922 
923 static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock,
924 			    struct msghdr *msg, int size)
925 {
926 	AA_BUG(!sock);
927 	AA_BUG(!sock->sk);
928 	AA_BUG(!msg);
929 	AA_BUG(in_interrupt());
930 
931 	return af_select(sock->sk->sk_family,
932 			 msg_perm(op, request, sock, msg, size),
933 			 aa_sk_perm(op, request, sock->sk));
934 }
935 
936 /**
937  * apparmor_socket_sendmsg - check perms before sending msg to another socket
938  */
939 static int apparmor_socket_sendmsg(struct socket *sock,
940 				   struct msghdr *msg, int size)
941 {
942 	return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
943 }
944 
945 /**
946  * apparmor_socket_recvmsg - check perms before receiving a message
947  */
948 static int apparmor_socket_recvmsg(struct socket *sock,
949 				   struct msghdr *msg, int size, int flags)
950 {
951 	return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size);
952 }
953 
954 /* revaliation, get/set attr, shutdown */
955 static int aa_sock_perm(const char *op, u32 request, struct socket *sock)
956 {
957 	AA_BUG(!sock);
958 	AA_BUG(!sock->sk);
959 	AA_BUG(in_interrupt());
960 
961 	return af_select(sock->sk->sk_family,
962 			 sock_perm(op, request, sock),
963 			 aa_sk_perm(op, request, sock->sk));
964 }
965 
966 /**
967  * apparmor_socket_getsockname - check perms before getting the local address
968  */
969 static int apparmor_socket_getsockname(struct socket *sock)
970 {
971 	return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock);
972 }
973 
974 /**
975  * apparmor_socket_getpeername - check perms before getting remote address
976  */
977 static int apparmor_socket_getpeername(struct socket *sock)
978 {
979 	return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock);
980 }
981 
982 /* revaliation, get/set attr, opt */
983 static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock,
984 			    int level, int optname)
985 {
986 	AA_BUG(!sock);
987 	AA_BUG(!sock->sk);
988 	AA_BUG(in_interrupt());
989 
990 	return af_select(sock->sk->sk_family,
991 			 opt_perm(op, request, sock, level, optname),
992 			 aa_sk_perm(op, request, sock->sk));
993 }
994 
995 /**
996  * apparmor_getsockopt - check perms before getting socket options
997  */
998 static int apparmor_socket_getsockopt(struct socket *sock, int level,
999 				      int optname)
1000 {
1001 	return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock,
1002 				level, optname);
1003 }
1004 
1005 /**
1006  * apparmor_setsockopt - check perms before setting socket options
1007  */
1008 static int apparmor_socket_setsockopt(struct socket *sock, int level,
1009 				      int optname)
1010 {
1011 	return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock,
1012 				level, optname);
1013 }
1014 
1015 /**
1016  * apparmor_socket_shutdown - check perms before shutting down @sock conn
1017  */
1018 static int apparmor_socket_shutdown(struct socket *sock, int how)
1019 {
1020 	return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock);
1021 }
1022 
1023 /**
1024  * apparmor_socket_sock_recv_skb - check perms before associating skb to sk
1025  *
1026  * Note: can not sleep may be called with locks held
1027  *
1028  * dont want protocol specific in __skb_recv_datagram()
1029  * to deny an incoming connection  socket_sock_rcv_skb()
1030  */
1031 static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
1032 {
1033 	return 0;
1034 }
1035 
1036 
1037 static struct aa_label *sk_peer_label(struct sock *sk)
1038 {
1039 	struct aa_sk_ctx *ctx = SK_CTX(sk);
1040 
1041 	if (ctx->peer)
1042 		return ctx->peer;
1043 
1044 	return ERR_PTR(-ENOPROTOOPT);
1045 }
1046 
1047 /**
1048  * apparmor_socket_getpeersec_stream - get security context of peer
1049  *
1050  * Note: for tcp only valid if using ipsec or cipso on lan
1051  */
1052 static int apparmor_socket_getpeersec_stream(struct socket *sock,
1053 					     char __user *optval,
1054 					     int __user *optlen,
1055 					     unsigned int len)
1056 {
1057 	char *name;
1058 	int slen, error = 0;
1059 	struct aa_label *label;
1060 	struct aa_label *peer;
1061 
1062 	label = begin_current_label_crit_section();
1063 	peer = sk_peer_label(sock->sk);
1064 	if (IS_ERR(peer)) {
1065 		error = PTR_ERR(peer);
1066 		goto done;
1067 	}
1068 	slen = aa_label_asxprint(&name, labels_ns(label), peer,
1069 				 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
1070 				 FLAG_HIDDEN_UNCONFINED, GFP_KERNEL);
1071 	/* don't include terminating \0 in slen, it breaks some apps */
1072 	if (slen < 0) {
1073 		error = -ENOMEM;
1074 	} else {
1075 		if (slen > len) {
1076 			error = -ERANGE;
1077 		} else if (copy_to_user(optval, name, slen)) {
1078 			error = -EFAULT;
1079 			goto out;
1080 		}
1081 		if (put_user(slen, optlen))
1082 			error = -EFAULT;
1083 out:
1084 		kfree(name);
1085 
1086 	}
1087 
1088 done:
1089 	end_current_label_crit_section(label);
1090 
1091 	return error;
1092 }
1093 
1094 /**
1095  * apparmor_socket_getpeersec_dgram - get security label of packet
1096  * @sock: the peer socket
1097  * @skb: packet data
1098  * @secid: pointer to where to put the secid of the packet
1099  *
1100  * Sets the netlabel socket state on sk from parent
1101  */
1102 static int apparmor_socket_getpeersec_dgram(struct socket *sock,
1103 					    struct sk_buff *skb, u32 *secid)
1104 
1105 {
1106 	/* TODO: requires secid support */
1107 	return -ENOPROTOOPT;
1108 }
1109 
1110 /**
1111  * apparmor_sock_graft - Initialize newly created socket
1112  * @sk: child sock
1113  * @parent: parent socket
1114  *
1115  * Note: could set off of SOCK_CTX(parent) but need to track inode and we can
1116  *       just set sk security information off of current creating process label
1117  *       Labeling of sk for accept case - probably should be sock based
1118  *       instead of task, because of the case where an implicitly labeled
1119  *       socket is shared by different tasks.
1120  */
1121 static void apparmor_sock_graft(struct sock *sk, struct socket *parent)
1122 {
1123 	struct aa_sk_ctx *ctx = SK_CTX(sk);
1124 
1125 	if (!ctx->label)
1126 		ctx->label = aa_get_current_label();
1127 }
1128 
1129 static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
1130 	LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
1131 	LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
1132 	LSM_HOOK_INIT(capget, apparmor_capget),
1133 	LSM_HOOK_INIT(capable, apparmor_capable),
1134 
1135 	LSM_HOOK_INIT(sb_mount, apparmor_sb_mount),
1136 	LSM_HOOK_INIT(sb_umount, apparmor_sb_umount),
1137 	LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot),
1138 
1139 	LSM_HOOK_INIT(path_link, apparmor_path_link),
1140 	LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
1141 	LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
1142 	LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
1143 	LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
1144 	LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
1145 	LSM_HOOK_INIT(path_rename, apparmor_path_rename),
1146 	LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
1147 	LSM_HOOK_INIT(path_chown, apparmor_path_chown),
1148 	LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
1149 	LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
1150 
1151 	LSM_HOOK_INIT(file_open, apparmor_file_open),
1152 	LSM_HOOK_INIT(file_receive, apparmor_file_receive),
1153 	LSM_HOOK_INIT(file_permission, apparmor_file_permission),
1154 	LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
1155 	LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
1156 	LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
1157 	LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
1158 	LSM_HOOK_INIT(file_lock, apparmor_file_lock),
1159 
1160 	LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
1161 	LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
1162 
1163 	LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
1164 	LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
1165 	LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
1166 
1167 	LSM_HOOK_INIT(socket_create, apparmor_socket_create),
1168 	LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
1169 	LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
1170 	LSM_HOOK_INIT(socket_connect, apparmor_socket_connect),
1171 	LSM_HOOK_INIT(socket_listen, apparmor_socket_listen),
1172 	LSM_HOOK_INIT(socket_accept, apparmor_socket_accept),
1173 	LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg),
1174 	LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg),
1175 	LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname),
1176 	LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername),
1177 	LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
1178 	LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
1179 	LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
1180 	LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
1181 	LSM_HOOK_INIT(socket_getpeersec_stream,
1182 		      apparmor_socket_getpeersec_stream),
1183 	LSM_HOOK_INIT(socket_getpeersec_dgram,
1184 		      apparmor_socket_getpeersec_dgram),
1185 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
1186 
1187 	LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
1188 	LSM_HOOK_INIT(cred_free, apparmor_cred_free),
1189 	LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
1190 	LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
1191 
1192 	LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
1193 	LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
1194 	LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
1195 
1196 	LSM_HOOK_INIT(task_free, apparmor_task_free),
1197 	LSM_HOOK_INIT(task_alloc, apparmor_task_alloc),
1198 	LSM_HOOK_INIT(task_getsecid, apparmor_task_getsecid),
1199 	LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
1200 	LSM_HOOK_INIT(task_kill, apparmor_task_kill),
1201 
1202 #ifdef CONFIG_AUDIT
1203 	LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init),
1204 	LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known),
1205 	LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match),
1206 	LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free),
1207 #endif
1208 
1209 	LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),
1210 	LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),
1211 	LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),
1212 };
1213 
1214 /*
1215  * AppArmor sysfs module parameters
1216  */
1217 
1218 static int param_set_aabool(const char *val, const struct kernel_param *kp);
1219 static int param_get_aabool(char *buffer, const struct kernel_param *kp);
1220 #define param_check_aabool param_check_bool
1221 static const struct kernel_param_ops param_ops_aabool = {
1222 	.flags = KERNEL_PARAM_OPS_FL_NOARG,
1223 	.set = param_set_aabool,
1224 	.get = param_get_aabool
1225 };
1226 
1227 static int param_set_aauint(const char *val, const struct kernel_param *kp);
1228 static int param_get_aauint(char *buffer, const struct kernel_param *kp);
1229 #define param_check_aauint param_check_uint
1230 static const struct kernel_param_ops param_ops_aauint = {
1231 	.set = param_set_aauint,
1232 	.get = param_get_aauint
1233 };
1234 
1235 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp);
1236 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp);
1237 #define param_check_aalockpolicy param_check_bool
1238 static const struct kernel_param_ops param_ops_aalockpolicy = {
1239 	.flags = KERNEL_PARAM_OPS_FL_NOARG,
1240 	.set = param_set_aalockpolicy,
1241 	.get = param_get_aalockpolicy
1242 };
1243 
1244 static int param_set_audit(const char *val, const struct kernel_param *kp);
1245 static int param_get_audit(char *buffer, const struct kernel_param *kp);
1246 
1247 static int param_set_mode(const char *val, const struct kernel_param *kp);
1248 static int param_get_mode(char *buffer, const struct kernel_param *kp);
1249 
1250 /* Flag values, also controllable via /sys/module/apparmor/parameters
1251  * We define special types as we want to do additional mediation.
1252  */
1253 
1254 /* AppArmor global enforcement switch - complain, enforce, kill */
1255 enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
1256 module_param_call(mode, param_set_mode, param_get_mode,
1257 		  &aa_g_profile_mode, S_IRUSR | S_IWUSR);
1258 
1259 /* whether policy verification hashing is enabled */
1260 bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);
1261 #ifdef CONFIG_SECURITY_APPARMOR_HASH
1262 module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
1263 #endif
1264 
1265 /* Debug mode */
1266 bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES);
1267 module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
1268 
1269 /* Audit mode */
1270 enum audit_mode aa_g_audit;
1271 module_param_call(audit, param_set_audit, param_get_audit,
1272 		  &aa_g_audit, S_IRUSR | S_IWUSR);
1273 
1274 /* Determines if audit header is included in audited messages.  This
1275  * provides more context if the audit daemon is not running
1276  */
1277 bool aa_g_audit_header = true;
1278 module_param_named(audit_header, aa_g_audit_header, aabool,
1279 		   S_IRUSR | S_IWUSR);
1280 
1281 /* lock out loading/removal of policy
1282  * TODO: add in at boot loading of policy, which is the only way to
1283  *       load policy, if lock_policy is set
1284  */
1285 bool aa_g_lock_policy;
1286 module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
1287 		   S_IRUSR | S_IWUSR);
1288 
1289 /* Syscall logging mode */
1290 bool aa_g_logsyscall;
1291 module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
1292 
1293 /* Maximum pathname length before accesses will start getting rejected */
1294 unsigned int aa_g_path_max = 2 * PATH_MAX;
1295 module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
1296 
1297 /* Determines how paranoid loading of policy is and how much verification
1298  * on the loaded policy is done.
1299  * DEPRECATED: read only as strict checking of load is always done now
1300  * that none root users (user namespaces) can load policy.
1301  */
1302 bool aa_g_paranoid_load = true;
1303 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
1304 
1305 /* Boot time disable flag */
1306 static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
1307 module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
1308 
1309 static int __init apparmor_enabled_setup(char *str)
1310 {
1311 	unsigned long enabled;
1312 	int error = kstrtoul(str, 0, &enabled);
1313 	if (!error)
1314 		apparmor_enabled = enabled ? 1 : 0;
1315 	return 1;
1316 }
1317 
1318 __setup("apparmor=", apparmor_enabled_setup);
1319 
1320 /* set global flag turning off the ability to load policy */
1321 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
1322 {
1323 	if (!apparmor_enabled)
1324 		return -EINVAL;
1325 	if (apparmor_initialized && !policy_admin_capable(NULL))
1326 		return -EPERM;
1327 	return param_set_bool(val, kp);
1328 }
1329 
1330 static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
1331 {
1332 	if (!apparmor_enabled)
1333 		return -EINVAL;
1334 	if (apparmor_initialized && !policy_view_capable(NULL))
1335 		return -EPERM;
1336 	return param_get_bool(buffer, kp);
1337 }
1338 
1339 static int param_set_aabool(const char *val, const struct kernel_param *kp)
1340 {
1341 	if (!apparmor_enabled)
1342 		return -EINVAL;
1343 	if (apparmor_initialized && !policy_admin_capable(NULL))
1344 		return -EPERM;
1345 	return param_set_bool(val, kp);
1346 }
1347 
1348 static int param_get_aabool(char *buffer, const struct kernel_param *kp)
1349 {
1350 	if (!apparmor_enabled)
1351 		return -EINVAL;
1352 	if (apparmor_initialized && !policy_view_capable(NULL))
1353 		return -EPERM;
1354 	return param_get_bool(buffer, kp);
1355 }
1356 
1357 static int param_set_aauint(const char *val, const struct kernel_param *kp)
1358 {
1359 	int error;
1360 
1361 	if (!apparmor_enabled)
1362 		return -EINVAL;
1363 	/* file is ro but enforce 2nd line check */
1364 	if (apparmor_initialized)
1365 		return -EPERM;
1366 
1367 	error = param_set_uint(val, kp);
1368 	pr_info("AppArmor: buffer size set to %d bytes\n", aa_g_path_max);
1369 
1370 	return error;
1371 }
1372 
1373 static int param_get_aauint(char *buffer, const struct kernel_param *kp)
1374 {
1375 	if (!apparmor_enabled)
1376 		return -EINVAL;
1377 	if (apparmor_initialized && !policy_view_capable(NULL))
1378 		return -EPERM;
1379 	return param_get_uint(buffer, kp);
1380 }
1381 
1382 static int param_get_audit(char *buffer, const struct kernel_param *kp)
1383 {
1384 	if (!apparmor_enabled)
1385 		return -EINVAL;
1386 	if (apparmor_initialized && !policy_view_capable(NULL))
1387 		return -EPERM;
1388 	return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
1389 }
1390 
1391 static int param_set_audit(const char *val, const struct kernel_param *kp)
1392 {
1393 	int i;
1394 
1395 	if (!apparmor_enabled)
1396 		return -EINVAL;
1397 	if (!val)
1398 		return -EINVAL;
1399 	if (apparmor_initialized && !policy_admin_capable(NULL))
1400 		return -EPERM;
1401 
1402 	i = match_string(audit_mode_names, AUDIT_MAX_INDEX, val);
1403 	if (i < 0)
1404 		return -EINVAL;
1405 
1406 	aa_g_audit = i;
1407 	return 0;
1408 }
1409 
1410 static int param_get_mode(char *buffer, const struct kernel_param *kp)
1411 {
1412 	if (!apparmor_enabled)
1413 		return -EINVAL;
1414 	if (apparmor_initialized && !policy_view_capable(NULL))
1415 		return -EPERM;
1416 
1417 	return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
1418 }
1419 
1420 static int param_set_mode(const char *val, const struct kernel_param *kp)
1421 {
1422 	int i;
1423 
1424 	if (!apparmor_enabled)
1425 		return -EINVAL;
1426 	if (!val)
1427 		return -EINVAL;
1428 	if (apparmor_initialized && !policy_admin_capable(NULL))
1429 		return -EPERM;
1430 
1431 	i = match_string(aa_profile_mode_names, APPARMOR_MODE_NAMES_MAX_INDEX,
1432 			 val);
1433 	if (i < 0)
1434 		return -EINVAL;
1435 
1436 	aa_g_profile_mode = i;
1437 	return 0;
1438 }
1439 
1440 /*
1441  * AppArmor init functions
1442  */
1443 
1444 /**
1445  * set_init_ctx - set a task context and profile on the first task.
1446  *
1447  * TODO: allow setting an alternate profile than unconfined
1448  */
1449 static int __init set_init_ctx(void)
1450 {
1451 	struct cred *cred = (struct cred *)current->real_cred;
1452 	struct aa_task_ctx *ctx;
1453 
1454 	ctx = aa_alloc_task_ctx(GFP_KERNEL);
1455 	if (!ctx)
1456 		return -ENOMEM;
1457 
1458 	cred_label(cred) = aa_get_label(ns_unconfined(root_ns));
1459 	task_ctx(current) = ctx;
1460 
1461 	return 0;
1462 }
1463 
1464 static void destroy_buffers(void)
1465 {
1466 	u32 i, j;
1467 
1468 	for_each_possible_cpu(i) {
1469 		for_each_cpu_buffer(j) {
1470 			kfree(per_cpu(aa_buffers, i).buf[j]);
1471 			per_cpu(aa_buffers, i).buf[j] = NULL;
1472 		}
1473 	}
1474 }
1475 
1476 static int __init alloc_buffers(void)
1477 {
1478 	u32 i, j;
1479 
1480 	for_each_possible_cpu(i) {
1481 		for_each_cpu_buffer(j) {
1482 			char *buffer;
1483 
1484 			if (cpu_to_node(i) > num_online_nodes())
1485 				/* fallback to kmalloc for offline nodes */
1486 				buffer = kmalloc(aa_g_path_max, GFP_KERNEL);
1487 			else
1488 				buffer = kmalloc_node(aa_g_path_max, GFP_KERNEL,
1489 						      cpu_to_node(i));
1490 			if (!buffer) {
1491 				destroy_buffers();
1492 				return -ENOMEM;
1493 			}
1494 			per_cpu(aa_buffers, i).buf[j] = buffer;
1495 		}
1496 	}
1497 
1498 	return 0;
1499 }
1500 
1501 #ifdef CONFIG_SYSCTL
1502 static int apparmor_dointvec(struct ctl_table *table, int write,
1503 			     void __user *buffer, size_t *lenp, loff_t *ppos)
1504 {
1505 	if (!policy_admin_capable(NULL))
1506 		return -EPERM;
1507 	if (!apparmor_enabled)
1508 		return -EINVAL;
1509 
1510 	return proc_dointvec(table, write, buffer, lenp, ppos);
1511 }
1512 
1513 static struct ctl_path apparmor_sysctl_path[] = {
1514 	{ .procname = "kernel", },
1515 	{ }
1516 };
1517 
1518 static struct ctl_table apparmor_sysctl_table[] = {
1519 	{
1520 		.procname       = "unprivileged_userns_apparmor_policy",
1521 		.data           = &unprivileged_userns_apparmor_policy,
1522 		.maxlen         = sizeof(int),
1523 		.mode           = 0600,
1524 		.proc_handler   = apparmor_dointvec,
1525 	},
1526 	{ }
1527 };
1528 
1529 static int __init apparmor_init_sysctl(void)
1530 {
1531 	return register_sysctl_paths(apparmor_sysctl_path,
1532 				     apparmor_sysctl_table) ? 0 : -ENOMEM;
1533 }
1534 #else
1535 static inline int apparmor_init_sysctl(void)
1536 {
1537 	return 0;
1538 }
1539 #endif /* CONFIG_SYSCTL */
1540 
1541 static int __init apparmor_init(void)
1542 {
1543 	int error;
1544 
1545 	if (!apparmor_enabled || !security_module_enable("apparmor")) {
1546 		aa_info_message("AppArmor disabled by boot time parameter");
1547 		apparmor_enabled = false;
1548 		return 0;
1549 	}
1550 
1551 	aa_secids_init();
1552 
1553 	error = aa_setup_dfa_engine();
1554 	if (error) {
1555 		AA_ERROR("Unable to setup dfa engine\n");
1556 		goto alloc_out;
1557 	}
1558 
1559 	error = aa_alloc_root_ns();
1560 	if (error) {
1561 		AA_ERROR("Unable to allocate default profile namespace\n");
1562 		goto alloc_out;
1563 	}
1564 
1565 	error = apparmor_init_sysctl();
1566 	if (error) {
1567 		AA_ERROR("Unable to register sysctls\n");
1568 		goto alloc_out;
1569 
1570 	}
1571 
1572 	error = alloc_buffers();
1573 	if (error) {
1574 		AA_ERROR("Unable to allocate work buffers\n");
1575 		goto buffers_out;
1576 	}
1577 
1578 	error = set_init_ctx();
1579 	if (error) {
1580 		AA_ERROR("Failed to set context on init task\n");
1581 		aa_free_root_ns();
1582 		goto buffers_out;
1583 	}
1584 	security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
1585 				"apparmor");
1586 
1587 	/* Report that AppArmor successfully initialized */
1588 	apparmor_initialized = 1;
1589 	if (aa_g_profile_mode == APPARMOR_COMPLAIN)
1590 		aa_info_message("AppArmor initialized: complain mode enabled");
1591 	else if (aa_g_profile_mode == APPARMOR_KILL)
1592 		aa_info_message("AppArmor initialized: kill mode enabled");
1593 	else
1594 		aa_info_message("AppArmor initialized");
1595 
1596 	return error;
1597 
1598 buffers_out:
1599 	destroy_buffers();
1600 
1601 alloc_out:
1602 	aa_destroy_aafs();
1603 	aa_teardown_dfa_engine();
1604 
1605 	apparmor_enabled = false;
1606 	return error;
1607 }
1608 
1609 security_initcall(apparmor_init);
1610