Lines Matching +full:subset +full:- +full:of
1 // SPDX-License-Identifier: GPL-2.0-only
5 * This file contains AppArmor mediation of files
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
40 * file_audit_cb - call back for file specific audit fields
42 * @va: audit struct to audit values of (NOT NULL)
50 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { in file_audit_cb()
52 map_mask_to_chr_mask(aad(sa)->request)); in file_audit_cb()
55 if (aad(sa)->denied & AA_AUDIT_FILE_MASK) { in file_audit_cb()
57 map_mask_to_chr_mask(aad(sa)->denied)); in file_audit_cb()
60 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { in file_audit_cb()
64 from_kuid(&init_user_ns, aad(sa)->fs.ouid)); in file_audit_cb()
67 if (aad(sa)->peer) { in file_audit_cb()
69 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, in file_audit_cb()
71 } else if (aad(sa)->fs.target) { in file_audit_cb()
73 audit_log_untrustedstring(ab, aad(sa)->fs.target); in file_audit_cb()
78 * aa_audit_file - handle the auditing of file operations
83 * @name: name of object being mediated (MAYBE NULL)
84 * @target: name of target (MAYBE NULL)
101 aad(&sa)->request = request; in aa_audit_file()
102 aad(&sa)->name = name; in aa_audit_file()
103 aad(&sa)->fs.target = target; in aa_audit_file()
104 aad(&sa)->peer = tlabel; in aa_audit_file()
105 aad(&sa)->fs.ouid = ouid; in aa_audit_file()
106 aad(&sa)->info = info; in aa_audit_file()
107 aad(&sa)->error = error; in aa_audit_file()
110 if (likely(!aad(&sa)->error)) { in aa_audit_file()
111 u32 mask = perms->audit; in aa_audit_file()
117 aad(&sa)->request &= mask; in aa_audit_file()
119 if (likely(!aad(&sa)->request)) in aa_audit_file()
124 aad(&sa)->request = aad(&sa)->request & ~perms->allow; in aa_audit_file()
125 AA_BUG(!aad(&sa)->request); in aa_audit_file()
127 if (aad(&sa)->request & perms->kill) in aa_audit_file()
131 if ((aad(&sa)->request & perms->quiet) && in aa_audit_file()
134 aad(&sa)->request &= ~perms->quiet; in aa_audit_file()
136 if (!aad(&sa)->request) in aa_audit_file()
137 return aad(&sa)->error; in aa_audit_file()
140 aad(&sa)->denied = aad(&sa)->request & ~perms->allow; in aa_audit_file()
153 labels_profile(label)->disconnected); in path_name()
157 NULL, NULL, cond->uid, info, error)); in path_name()
166 * aa_lookup_fperms - convert dfa compressed perms to internal perms
178 unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state]; in aa_lookup_fperms()
180 if (!(file_rules->perms)) in aa_lookup_fperms()
183 if (uid_eq(current_fsuid(), cond->uid)) in aa_lookup_fperms()
184 return &(file_rules->perms[index]); in aa_lookup_fperms()
186 return &(file_rules->perms[index + 1]); in aa_lookup_fperms()
190 * aa_str_perms - find permission that match @name
195 * @perms: Returns - the permissions found when matching @name
204 state = aa_dfa_match(file_rules->dfa, start, name); in aa_str_perms()
215 struct aa_ruleset *rules = list_first_entry(&profile->rules, in __aa_path_perm()
221 aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE], in __aa_path_perm()
223 if (request & ~perms->allow) in __aa_path_perm()
224 e = -EACCES; in __aa_path_perm()
226 cond->uid, NULL, e); in __aa_path_perm()
241 error = path_name(op, &profile->label, path, in profile_path_perm()
242 flags | profile->path_flags, buffer, &name, cond, in profile_path_perm()
251 * aa_path_perm - do permissions check & audit for @path
254 * @path: path to check permissions of (NOT NULL)
270 flags |= PATH_DELEGATE_DELETED | (S_ISDIR(cond->mode) ? PATH_IS_DIR : in aa_path_perm()
274 return -ENOMEM; in aa_path_perm()
285 * xindex_is_subset - helper for aa_path_link
289 * test target x permissions are equal OR a subset of link x permissions
290 * this is done as part of the subset test, where a hardlink must have
291 * a subset of permissions that the target has.
293 * Returns: true if subset else false
309 struct aa_ruleset *rules = list_first_entry(&profile->rules, in profile_path_link()
318 error = path_name(OP_LINK, &profile->label, link, profile->path_flags, in profile_path_link()
324 error = path_name(OP_LINK, &profile->label, target, profile->path_flags, in profile_path_link()
329 error = -EACCES; in profile_path_link()
330 /* aa_str_perms - handles the case of the dfa being NULL */ in profile_path_link()
331 state = aa_str_perms(&(rules->file), in profile_path_link()
332 rules->file.start[AA_CLASS_FILE], lname, in profile_path_link()
339 state = aa_dfa_null_transition(rules->file.dfa, state); in profile_path_link()
340 aa_str_perms(&(rules->file), state, tname, cond, &perms); in profile_path_link()
355 /* done if link subset test is not required */ in profile_path_link()
359 /* Do link perm subset test requiring allowed permission on link are in profile_path_link()
360 * a subset of the allowed permissions on target. in profile_path_link()
362 aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE], in profile_path_link()
365 /* AA_MAY_LINK is not considered in the subset test */ in profile_path_link()
376 info = "link not subset of target"; in profile_path_link()
385 NULL, cond->uid, info, error); in profile_path_link()
389 * aa_path_link - Handle hard link permission check
398 * is done from the point of the link match (not start of DFA)
401 * The subset test if required forces that permissions granted
402 * on link are a subset of the permission granted to target.
409 struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry }; in aa_path_link()
410 struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry }; in aa_path_link()
412 d_backing_inode(old_dentry)->i_uid, in aa_path_link()
413 d_backing_inode(old_dentry)->i_mode in aa_path_link()
422 error = -ENOMEM; in aa_path_link()
440 /* update caching of label on file_ctx */ in update_file_ctx()
441 spin_lock(&fctx->lock); in update_file_ctx()
442 old = rcu_dereference_protected(fctx->label, in update_file_ctx()
443 lockdep_is_held(&fctx->lock)); in update_file_ctx()
447 rcu_assign_pointer(fctx->label, l); in update_file_ctx()
451 fctx->allow |= request; in update_file_ctx()
453 spin_unlock(&fctx->lock); in update_file_ctx()
466 .mode = file_inode(file)->i_mode in __file_path_perm()
471 /* revalidation due to label out of date. No revocation at this time */ in __file_path_perm()
479 return -ENOMEM; in __file_path_perm()
483 profile_path_perm(op, profile, &file->f_path, buffer, in __file_path_perm()
490 * TODO: cache full perms so this only happens because of in __file_path_perm()
496 profile_path_perm(op, profile, &file->f_path, in __file_path_perm()
501 profile_path_perm(op, profile, &file->f_path, in __file_path_perm()
517 struct socket *sock = (struct socket *) file->private_data; in __file_sock_perm()
522 /* revalidation due to label out of date. No revocation at this time */ in __file_sock_perm()
540 * aa_file_perm - do permission revalidation check & audit for @file
563 flabel = rcu_dereference(fctx->label); in aa_file_perm()
573 denied = request & ~fctx->allow; in aa_file_perm()
584 if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry)) in aa_file_perm()
588 else if (S_ISSOCK(file_inode(file)->i_mode)) in aa_file_perm()
606 spin_lock(&tty->files_lock); in revalidate_tty()
607 if (!list_empty(&tty->tty_files)) { in revalidate_tty()
611 file_priv = list_first_entry(&tty->tty_files, in revalidate_tty()
613 file = file_priv->file; in revalidate_tty()
619 spin_unlock(&tty->files_lock); in revalidate_tty()
656 replace_fd(n - 1, devnull, 0); in aa_inherit_files()