xref: /linux/security/apparmor/net.c (revision 4f0cafcb2850a08d9081eea3ac8bec17b9a9881c) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor network mediation
6  *
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2017 Canonical Ltd.
9  */
10 
11 #include "include/af_unix.h"
12 #include "include/af_inet.h"
13 #include "include/apparmor.h"
14 #include "include/audit.h"
15 #include "include/cred.h"
16 #include "include/label.h"
17 #include "include/net.h"
18 #include "include/policy.h"
19 #include "include/secid.h"
20 
21 #include "net_names.h"
22 
23 
24 struct aa_sfs_entry aa_sfs_entry_network[] = {
25 	AA_SFS_FILE_STRING("af_mask",	AA_SFS_AF_MASK),
26 	AA_SFS_FILE_BOOLEAN("tcp-fast-open",		1),
27 	{ }
28 };
29 
30 struct aa_sfs_entry aa_sfs_entry_networkv9[] = {
31 	AA_SFS_FILE_STRING("af_mask",	AA_SFS_AF_MASK),
32 	AA_SFS_FILE_BOOLEAN("af_unix",	1),
33 	AA_SFS_FILE_BOOLEAN("tcp-fast-open",		1),
34 	{ }
35 };
36 
37 static const char * const net_mask_names[] = {
38 	"unknown",
39 	"send",
40 	"receive",
41 	"unknown",
42 
43 	"create",
44 	"shutdown",
45 	"connect",
46 	"unknown",
47 
48 	"setattr",
49 	"getattr",
50 	"setcred",
51 	"getcred",
52 
53 	"chmod",
54 	"chown",
55 	"chgrp",
56 	"lock",
57 
58 	"mmap",
59 	"mprot",
60 	"unknown",
61 	"unknown",
62 
63 	"accept",
64 	"bind",
65 	"listen",
66 	"unknown",
67 
68 	"setopt",
69 	"getopt",
70 	"unknown",
71 	"unknown",
72 
73 	"unknown",
74 	"unknown",
75 	"unknown",
76 	"unknown",
77 };
78 
79 static void audit_unix_addr(struct audit_buffer *ab, const char *str,
80 			    struct sockaddr_un *addr, int addrlen)
81 {
82 	int len = unix_addr_len(addrlen);
83 
84 	if (!addr || len <= 0) {
85 		audit_log_format(ab, " %s=none", str);
86 	} else if (addr->sun_path[0]) {
87 		audit_log_format(ab, " %s=", str);
88 		audit_log_untrustedstring(ab, addr->sun_path);
89 	} else {
90 		audit_log_format(ab, " %s=\"@", str);
91 		if (audit_string_contains_control(&addr->sun_path[1], len - 1))
92 			audit_log_n_hex(ab, &addr->sun_path[1], len - 1);
93 		else
94 			audit_log_format(ab, "%.*s", len - 1,
95 					 &addr->sun_path[1]);
96 		audit_log_format(ab, "\"");
97 	}
98 }
99 
100 static void audit_unix_sk_addr(struct audit_buffer *ab, const char *str,
101 			       const struct sock *sk)
102 {
103 	const struct unix_sock *u = unix_sk(sk);
104 
105 	if (u && u->addr) {
106 		int addrlen;
107 		struct sockaddr_un *addr = aa_sunaddr(u, &addrlen);
108 
109 		audit_unix_addr(ab, str, addr, addrlen);
110 	} else {
111 		audit_unix_addr(ab, str, NULL, 0);
112 
113 	}
114 }
115 
116 /* audit callback for net specific fields */
117 void audit_net_cb(struct audit_buffer *ab, void *va)
118 {
119 	struct common_audit_data *sa = va;
120 	struct apparmor_audit_data *ad = aad(sa);
121 
122 	if (address_family_names[ad->common.u.net->family])
123 		audit_log_format(ab, " family=\"%s\"",
124 				 address_family_names[ad->common.u.net->family]);
125 	else
126 		audit_log_format(ab, " family=\"unknown(%d)\"",
127 				 ad->common.u.net->family);
128 	if (sock_type_names[ad->net.type])
129 		audit_log_format(ab, " sock_type=\"%s\"",
130 				 sock_type_names[ad->net.type]);
131 	else
132 		audit_log_format(ab, " sock_type=\"unknown(%d)\"",
133 				 ad->net.type);
134 	audit_log_format(ab, " protocol=%d", ad->net.protocol);
135 
136 	if (ad->request & NET_PERMS_MASK) {
137 		audit_log_format(ab, " requested=");
138 		aa_audit_perm_mask(ab, ad->request, NULL, 0,
139 				   net_mask_names, NET_PERMS_MASK);
140 
141 		if (ad->denied & NET_PERMS_MASK) {
142 			audit_log_format(ab, " denied=");
143 			aa_audit_perm_mask(ab, ad->denied, NULL, 0,
144 					   net_mask_names, NET_PERMS_MASK);
145 		}
146 	}
147 	if (ad->common.u.net->family == PF_UNIX) {
148 		if (ad->net.addr || !ad->common.u.net->sk)
149 			audit_unix_addr(ab, "addr",
150 					unix_addr(ad->net.addr),
151 					ad->net.addrlen);
152 		else
153 			audit_unix_sk_addr(ab, "addr", ad->common.u.net->sk);
154 		if (ad->request & NET_PEER_MASK) {
155 			audit_unix_addr(ab, "peer_addr",
156 					unix_addr(ad->net.peer.addr),
157 					ad->net.peer.addrlen);
158 		}
159 	}
160 	if (ad->peer) {
161 		audit_log_format(ab, " peer=");
162 		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
163 				FLAGS_NONE, GFP_ATOMIC);
164 	}
165 }
166 
167 /* standard permission lookup pattern - supports early bailout */
168 int aa_do_perms(struct aa_profile *profile, struct aa_policydb *policy,
169 		aa_state_t state, u32 request,
170 		struct aa_perms *p, struct apparmor_audit_data *ad)
171 {
172 	struct aa_perms perms;
173 
174 	AA_BUG(!profile);
175 	AA_BUG(!policy);
176 
177 
178 	if (state || !p)
179 		p = aa_lookup_perms(policy, state);
180 	perms = *p;
181 	aa_apply_modes_to_perms(profile, &perms);
182 	return aa_check_perms(profile, &perms, request, ad,
183 			      audit_net_cb);
184 }
185 
186 /* only continue match if
187  *   insufficient current perms at current state
188  *   indicates there are more perms in later state
189  * Returns: perms struct if early match
190  */
191 static struct aa_perms *early_match(struct aa_policydb *policy,
192 				    aa_state_t state, u32 request)
193 {
194 	struct aa_perms *p;
195 
196 	p = aa_lookup_perms(policy, state);
197 	if (((p->allow & request) != request) && (p->allow & AA_CONT_MATCH))
198 		return NULL;
199 	return p;
200 }
201 
202 static aa_state_t aa_dfa_match_be16(struct aa_dfa *dfa, aa_state_t state,
203 					  u16 data)
204 {
205 	__be16 buffer = cpu_to_be16(data);
206 
207 	return aa_dfa_match_len(dfa, state, (char *) &buffer, 2);
208 }
209 
210 /**
211  * aa_match_to_prot - match the af, type, protocol triplet
212  * @policy: policy being matched
213  * @state: state to start in
214  * @request: permissions being requested, ignored if @p == NULL
215  * @af: socket address family
216  * @type: socket type
217  * @protocol: socket protocol
218  * @p: output - pointer to permission associated with match
219  * @info: output - pointer to string describing failure
220  *
221  * RETURNS: state match stopped in.
222  *
223  * If @(p) is assigned a value the returned state will be the
224  * corresponding state. Will not set @p on failure or if match completes
225  * only if an early match occurs
226  */
227 aa_state_t aa_match_to_prot(struct aa_policydb *policy, aa_state_t state,
228 			    u32 request, u16 af, int type, int protocol,
229 			    struct aa_perms **p, const char **info)
230 {
231 	state = aa_dfa_match_be16(policy->dfa, state, (u16)af);
232 	if (!state) {
233 		*info = "failed af match";
234 		return state;
235 	}
236 	state = aa_dfa_match_be16(policy->dfa, state, (u16)type);
237 	if (state) {
238 		if (p)
239 			*p = early_match(policy, state, request);
240 		if (!p || !*p) {
241 			state = aa_dfa_match_be16(policy->dfa, state, (u16)protocol);
242 			if (!state)
243 				*info = "failed protocol match";
244 		}
245 	} else {
246 		*info = "failed type match";
247 	}
248 
249 	return state;
250 }
251 
252 /* Generic af perm */
253 int aa_profile_af_perm(struct aa_profile *profile,
254 		       struct apparmor_audit_data *ad, u32 request, u16 family,
255 		       int type, int protocol)
256 {
257 	struct aa_ruleset *rules = profile->label.rules[0];
258 	struct aa_perms *p = NULL;
259 	aa_state_t state;
260 
261 	AA_BUG(family >= AF_MAX);
262 	AA_BUG(type < 0 || type >= SOCK_MAX);
263 	AA_BUG(profile_unconfined(profile));
264 
265 	if (profile_unconfined(profile))
266 		return 0;
267 	state = RULE_MEDIATES_NET(rules);
268 	if (!state)
269 		return 0;
270 	state = aa_match_to_prot(rules->policy, state, request, family, type,
271 				 protocol, &p, &ad->info);
272 	return aa_do_perms(profile, rules->policy, state, request, p, ad);
273 }
274 
275 int aa_af_perm(const struct cred *subj_cred, struct aa_label *label,
276 	       const char *op, u32 request, u16 family, int type, int protocol)
277 {
278 	struct aa_profile *profile;
279 	DEFINE_AUDIT_NET(ad, op, subj_cred, NULL, family, type, protocol);
280 
281 	return fn_for_each_confined(label, profile,
282 			aa_profile_af_perm(profile, &ad, request, family,
283 					   type, protocol));
284 }
285 
286 int aa_label_sk_perm(const struct cred *subj_cred, struct aa_label *label,
287 		     const char *op, u32 request, const struct sock *sk)
288 {
289 	struct aa_sk_ctx *ctx = aa_sock(sk);
290 	int error = 0;
291 
292 	AA_BUG(!label);
293 	AA_BUG(!sk);
294 
295 	if (rcu_access_pointer(ctx->label) != kernel_t && !unconfined(label)) {
296 		struct aa_profile *profile;
297 		DEFINE_AUDIT_SK(ad, op, subj_cred, sk);
298 
299 		ad.subj_cred = subj_cred;
300 		error = fn_for_each_confined(label, profile,
301 			    aa_profile_af_sk_perm(profile, &ad, request, sk));
302 	}
303 
304 	return error;
305 }
306 
307 int aa_sk_perm(const char *op, u32 request, const struct sock *sk)
308 {
309 	struct aa_label *label;
310 	bool needput;
311 	int error;
312 
313 	AA_BUG(!sk);
314 	AA_BUG(in_interrupt());
315 
316 	/* TODO: switch to begin_current_label ???? */
317 	label = begin_current_label_crit_section(&needput);
318 	error = aa_label_sk_perm(current_cred(), label, op, request, sk);
319 	end_current_label_crit_section(label, needput);
320 
321 	return error;
322 }
323 
324 
325 int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label,
326 		      const char *op, u32 request, struct file *file)
327 {
328 	struct socket *sock = (struct socket *) file->private_data;
329 
330 	AA_BUG(!label);
331 
332 	/* sock && sock->sk can be NULL for sockets being set up or torn down */
333 	if (!sock || !sock->sk)
334 		return 0;
335 
336 	switch (sock->sk->sk_family) {
337 	case PF_UNIX:
338 		return aa_unix_file_perm(subj_cred, label, op, request, file);
339 	case PF_INET:
340 	case PF_INET6:
341 		return aa_inet_file_perm(subj_cred, label, op, request, sock);
342 	}
343 	return aa_label_sk_perm(subj_cred, label, op, request, sock->sk);
344 }
345 
346 #ifdef CONFIG_NETWORK_SECMARK
347 static int apparmor_secmark_init(struct aa_secmark *secmark)
348 {
349 	struct aa_label *label;
350 
351 	if (secmark->label[0] == '*') {
352 		secmark->secid = AA_SECID_WILDCARD;
353 		return 0;
354 	}
355 
356 	label = aa_label_strn_parse(&root_ns->unconfined->label,
357 				    secmark->label, strlen(secmark->label),
358 				    GFP_ATOMIC, false, false);
359 
360 	if (IS_ERR(label))
361 		return PTR_ERR(label);
362 
363 	secmark->secid = label->secid;
364 	aa_put_label(label);
365 
366 	return 0;
367 }
368 
369 static int aa_secmark_perm(struct aa_profile *profile, u32 request, u32 secid,
370 			   struct apparmor_audit_data *ad)
371 {
372 	int i, ret;
373 	struct aa_perms perms = { };
374 	struct aa_ruleset *rules = profile->label.rules[0];
375 
376 	if (rules->secmark_count == 0)
377 		return 0;
378 
379 	for (i = 0; i < rules->secmark_count; i++) {
380 		if (!rules->secmark[i].secid) {
381 			ret = apparmor_secmark_init(&rules->secmark[i]);
382 			if (ret)
383 				return ret;
384 		}
385 
386 		if (rules->secmark[i].secid == secid ||
387 		    rules->secmark[i].secid == AA_SECID_WILDCARD) {
388 			if (rules->secmark[i].deny)
389 				perms.deny = ALL_PERMS_MASK;
390 			else
391 				perms.allow = ALL_PERMS_MASK;
392 
393 			if (rules->secmark[i].audit)
394 				perms.audit = ALL_PERMS_MASK;
395 		}
396 	}
397 
398 	aa_apply_modes_to_perms(profile, &perms);
399 
400 	return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
401 }
402 
403 int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
404 			   u32 secid, const struct sock *sk)
405 {
406 	struct aa_profile *profile;
407 	DEFINE_AUDIT_SK(ad, op, NULL, sk);
408 
409 	return fn_for_each_confined(label, profile,
410 				    aa_secmark_perm(profile, request, secid,
411 						    &ad));
412 }
413 #endif
414