Lines Matching +full:container +full:- +full:rules
1 // SPDX-License-Identifier: GPL-2.0-only
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
10 * AppArmor policy is based around profiles, which contain the rules a
13 * visible set of profiles or by following a profiles attachment rules.
15 * Each profile exists in a profile namespace which is a container of
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
29 * null-XXXX-YYYY - special automatically generated learning profiles
33 * user-XXXX - user defined profiles
44 * - it allows for sub profiles or hats, which allows an application to run
50 * - it allows for binary hierarchy of profiles, so that execution history
66 * - locking of profile lists is currently fairly coarse. All profile
102 * __add_profile - add a profiles to list and label tree
116 AA_BUG(!profile->ns); in __add_profile()
117 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __add_profile()
119 list_add_rcu(&profile->base.list, list); in __add_profile()
122 l = aa_label_insert(&profile->ns->labels, &profile->label); in __add_profile()
123 AA_BUG(l != &profile->label); in __add_profile()
128 * __list_remove_profile - remove a profile from the list it is on
142 AA_BUG(!profile->ns); in __list_remove_profile()
143 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __list_remove_profile()
145 list_del_rcu(&profile->base.list); in __list_remove_profile()
150 * __remove_profile - remove old profile, and children
158 AA_BUG(!profile->ns); in __remove_profile()
159 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __remove_profile()
162 __aa_profile_list_release(&profile->base.profiles); in __remove_profile()
164 aa_label_remove(&profile->label); in __remove_profile()
170 * __aa_profile_list_release - remove all profiles on the list and put refs
183 * aa_free_data - free a data blob
191 kfree_sensitive(data->data); in aa_free_data()
192 kfree_sensitive(data->key); in aa_free_data()
200 for (i = 0; i < attach->xattr_count; i++) in free_attachment()
201 kfree_sensitive(attach->xattrs[i]); in free_attachment()
202 kfree_sensitive(attach->xattrs); in free_attachment()
203 aa_destroy_policydb(&attach->xmatch); in free_attachment()
206 static void free_ruleset(struct aa_ruleset *rules) in free_ruleset() argument
210 aa_destroy_policydb(&rules->file); in free_ruleset()
211 aa_destroy_policydb(&rules->policy); in free_ruleset()
212 aa_free_cap_rules(&rules->caps); in free_ruleset()
213 aa_free_rlimit_rules(&rules->rlimits); in free_ruleset()
215 for (i = 0; i < rules->secmark_count; i++) in free_ruleset()
216 kfree_sensitive(rules->secmark[i].label); in free_ruleset()
217 kfree_sensitive(rules->secmark); in free_ruleset()
218 kfree_sensitive(rules); in free_ruleset()
223 struct aa_ruleset *rules; in aa_alloc_ruleset() local
225 rules = kzalloc(sizeof(*rules), gfp); in aa_alloc_ruleset()
226 if (rules) in aa_alloc_ruleset()
227 INIT_LIST_HEAD(&rules->list); in aa_alloc_ruleset()
229 return rules; in aa_alloc_ruleset()
233 * aa_free_profile - free a profile
253 aa_policy_destroy(&profile->base); in aa_free_profile()
254 aa_put_profile(rcu_access_pointer(profile->parent)); in aa_free_profile()
256 aa_put_ns(profile->ns); in aa_free_profile()
257 kfree_sensitive(profile->rename); in aa_free_profile()
259 free_attachment(&profile->attach); in aa_free_profile()
263 * to rules in aa_free_profile()
265 list_for_each_entry_safe(rule, tmp, &profile->rules, list) { in aa_free_profile()
266 list_del_init(&rule->list); in aa_free_profile()
269 kfree_sensitive(profile->dirname); in aa_free_profile()
271 if (profile->data) { in aa_free_profile()
272 rht = profile->data; in aa_free_profile()
273 profile->data = NULL; in aa_free_profile()
278 kfree_sensitive(profile->hash); in aa_free_profile()
279 aa_put_loaddata(profile->rawdata); in aa_free_profile()
280 aa_label_destroy(&profile->label); in aa_free_profile()
286 * aa_alloc_profile - allocate, initialize and return a new profile
296 struct aa_ruleset *rules; in aa_alloc_profile() local
298 /* freed by free_profile - usually through aa_put_profile */ in aa_alloc_profile()
303 if (!aa_policy_init(&profile->base, NULL, hname, gfp)) in aa_alloc_profile()
305 if (!aa_label_init(&profile->label, 1, gfp)) in aa_alloc_profile()
308 INIT_LIST_HEAD(&profile->rules); in aa_alloc_profile()
311 rules = aa_alloc_ruleset(gfp); in aa_alloc_profile()
312 if (!rules) in aa_alloc_profile()
314 list_add(&rules->list, &profile->rules); in aa_alloc_profile()
318 proxy = aa_alloc_proxy(&profile->label, gfp); in aa_alloc_profile()
323 profile->label.proxy = proxy; in aa_alloc_profile()
325 profile->label.hname = profile->base.hname; in aa_alloc_profile()
326 profile->label.flags |= FLAG_PROFILE; in aa_alloc_profile()
327 profile->label.vec[0] = profile; in aa_alloc_profile()
338 /* TODO: profile accounting - setup in remove */
341 * __strn_find_child - find a profile on @head list using substring of @name
357 * __find_child - find a profile on @head list with a name matching @name
371 * aa_find_child - find a profile by @name in @parent
383 profile = __find_child(&parent->base.profiles, name); in aa_find_child()
392 * __lookup_parent - lookup the parent of a profile of name @hname
411 policy = &ns->base; in __lookup_parent()
414 profile = __strn_find_child(&policy->profiles, hname, in __lookup_parent()
415 split - hname); in __lookup_parent()
418 policy = &profile->base; in __lookup_parent()
423 return &ns->base; in __lookup_parent()
424 return &profile->base; in __lookup_parent()
428 * __create_missing_ancestors - create place holders for missing ancestores
449 policy = &ns->base; in __create_missing_ancestors()
453 profile = __strn_find_child(&policy->profiles, hname, in __create_missing_ancestors()
454 split - hname); in __create_missing_ancestors()
456 const char *name = kstrndup(hname, split - hname, in __create_missing_ancestors()
465 profile->ns = aa_get_ns(ns); in __create_missing_ancestors()
467 policy = &profile->base; in __create_missing_ancestors()
472 return &ns->base; in __create_missing_ancestors()
473 return &profile->base; in __create_missing_ancestors()
477 * __lookupn_profile - lookup the profile matching @hname
496 profile = __strn_find_child(&base->profiles, hname, in __lookupn_profile()
497 split - hname); in __lookupn_profile()
501 base = &profile->base; in __lookupn_profile()
502 n -= split + 2 - hname; in __lookupn_profile()
507 return __strn_find_child(&base->profiles, hname, n); in __lookupn_profile()
518 * aa_lookupn_profile - find a profile by its full or partial name
532 profile = __lookupn_profile(&ns->base, hname, n); in aa_lookupn_profile()
538 profile = aa_get_newest_profile(ns->unconfined); in aa_lookupn_profile()
566 profile = aa_lookupn_profile(ns, name, n - (name - fqname)); in aa_fqlookupn_profile()
569 profile = aa_get_newest_profile(ns->unconfined); in aa_fqlookupn_profile()
582 struct aa_ruleset *rules; in aa_alloc_null() local
589 profile->label.flags |= FLAG_NULL; in aa_alloc_null()
590 rules = list_first_entry(&profile->rules, typeof(*rules), list); in aa_alloc_null()
591 rules->file.dfa = aa_get_dfa(nulldfa); in aa_alloc_null()
592 rules->file.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL); in aa_alloc_null()
593 if (!rules->file.perms) in aa_alloc_null()
595 rules->file.size = 2; in aa_alloc_null()
596 rules->policy.dfa = aa_get_dfa(nulldfa); in aa_alloc_null()
597 rules->policy.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL); in aa_alloc_null()
598 if (!rules->policy.perms) in aa_alloc_null()
600 rules->policy.size = 2; in aa_alloc_null()
603 profile->path_flags = parent->path_flags; in aa_alloc_null()
606 rcu_assign_pointer(profile->parent, aa_get_profile(parent)); in aa_alloc_null()
607 profile->ns = aa_get_ns(parent->ns); in aa_alloc_null()
619 * aa_new_learning_profile - create or find a null-X learning profile
621 * @hat: true if the null- learning profile is a hat
625 * Find/Create a null- complain mode profile used in learning mode. The
626 * name of the profile is unique and follows the format of parent//null-XXX.
646 name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base), in aa_new_learning_profile()
649 sprintf(name, "%s//null-%s", parent->base.hname, base); in aa_new_learning_profile()
655 name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp); in aa_new_learning_profile()
658 sprintf(name, "%s//null-%x", parent->base.hname, in aa_new_learning_profile()
659 atomic_inc_return(&parent->ns->uniq_null)); in aa_new_learning_profile()
671 profile->mode = APPARMOR_COMPLAIN; in aa_new_learning_profile()
673 profile->label.flags |= FLAG_HAT; in aa_new_learning_profile()
675 mutex_lock_nested(&profile->ns->lock, profile->ns->level); in aa_new_learning_profile()
676 p = __find_child(&parent->base.profiles, bname); in aa_new_learning_profile()
681 __add_profile(&parent->base.profiles, profile); in aa_new_learning_profile()
683 mutex_unlock(&profile->ns->lock); in aa_new_learning_profile()
698 * replacement_allowed - test to see if replacement is allowed
701 * @info: Returns - info about why replacement failed (NOT NULL)
709 if (profile->label.flags & FLAG_IMMUTIBLE) { in replacement_allowed()
711 return -EPERM; in replacement_allowed()
714 return -EEXIST; in replacement_allowed()
725 if (aad(sa)->iface.ns) { in audit_cb()
727 audit_log_untrustedstring(ab, aad(sa)->iface.ns); in audit_cb()
732 * audit_policy - Do auditing of policy changes
748 aad(&sa)->iface.ns = ns_name; in audit_policy()
749 aad(&sa)->name = name; in audit_policy()
750 aad(&sa)->info = info; in audit_policy()
751 aad(&sa)->error = error; in audit_policy()
752 aad(&sa)->label = label; in audit_policy()
776 * aa_policy_view_capable - check if viewing policy in at @ns is allowed
797 user_ns->level == view_ns->level))) in aa_policy_view_capable()
840 * aa_may_manage_policy - can the current task manage policy
860 -EACCES); in aa_may_manage_policy()
864 -EACCES); in aa_may_manage_policy()
873 const char *base = basename(profile->base.hname); in __list_lookup_parent()
874 long len = base - profile->base.hname; in __list_lookup_parent()
880 len -= 2; in __list_lookup_parent()
883 if (ent->new == profile) in __list_lookup_parent()
885 if (strncmp(ent->new->base.hname, profile->base.hname, len) == in __list_lookup_parent()
886 0 && ent->new->base.hname[len] == 0) in __list_lookup_parent()
887 return ent->new; in __list_lookup_parent()
894 * __replace_profile - replace @old with @new on a list
909 if (!list_empty(&old->base.profiles)) { in __replace_profile()
911 list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu); in __replace_profile()
916 list_del_init(&child->base.list); in __replace_profile()
917 p = __find_child(&new->base.profiles, child->base.name); in __replace_profile()
928 rcu_assign_pointer(child->parent, aa_get_profile(new)); in __replace_profile()
929 list_add_rcu(&child->base.list, &new->base.profiles); in __replace_profile()
934 if (!rcu_access_pointer(new->parent)) { in __replace_profile()
936 rcu_assign_pointer(new->parent, aa_get_profile(parent)); in __replace_profile()
938 aa_label_replace(&old->label, &new->label); in __replace_profile()
942 if (list_empty(&new->base.list)) { in __replace_profile()
944 list_replace_rcu(&old->base.list, &new->base.list); in __replace_profile()
952 * __lookup_replace - lookup replacement information for a profile
953 * @ns - namespace the lookup occurs in
954 * @hname - name of profile to lookup
955 * @noreplace - true if not replacing an existing profile
956 * @p - Returns: profile to be replaced
957 * @info - Returns: info string on why lookup failed
965 *p = aa_get_profile(__lookup_profile(&ns->base, hname)); in __lookup_replace()
979 aa_put_str(new->base.hname); in share_name()
980 aa_get_str(old->base.hname); in share_name()
981 new->base.hname = old->base.hname; in share_name()
982 new->base.name = old->base.name; in share_name()
983 new->label.hname = old->label.hname; in share_name()
993 parent = rcu_dereference_protected(new->parent, in update_to_newest_parent()
994 mutex_is_locked(&new->ns->lock)); in update_to_newest_parent()
1000 rcu_assign_pointer(new->parent, newest); in update_to_newest_parent()
1008 * aa_replace_profiles - replace profile(s) on the profile list
1047 if (ent->ns_name && in aa_replace_profiles()
1048 strcmp(ent->ns_name, ns_name) != 0) { in aa_replace_profiles()
1050 error = -EACCES; in aa_replace_profiles()
1053 } else if (ent->ns_name) { in aa_replace_profiles()
1056 error = -EACCES; in aa_replace_profiles()
1059 ns_name = ent->ns_name; in aa_replace_profiles()
1077 mutex_lock_nested(&ns->lock, ns->level); in aa_replace_profiles()
1079 if (!list_empty(&ns->rawdata_list)) { in aa_replace_profiles()
1080 list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) { in aa_replace_profiles()
1100 ent->new->rawdata = aa_get_loaddata(udata); in aa_replace_profiles()
1101 error = __lookup_replace(ns, ent->new->base.hname, in aa_replace_profiles()
1103 &ent->old, &info); in aa_replace_profiles()
1107 if (ent->new->rename) { in aa_replace_profiles()
1108 error = __lookup_replace(ns, ent->new->rename, in aa_replace_profiles()
1110 &ent->rename, &info); in aa_replace_profiles()
1116 ent->new->ns = aa_get_ns(ns); in aa_replace_profiles()
1118 if (ent->old || ent->rename) in aa_replace_profiles()
1123 policy = __lookup_parent(ns, ent->new->base.hname); in aa_replace_profiles()
1126 p = __list_lookup_parent(&lh, ent->new); in aa_replace_profiles()
1141 ent->new->base.hname, in aa_replace_profiles()
1144 error = -ENOENT; in aa_replace_profiles()
1150 if (!p && policy != &ns->base) in aa_replace_profiles()
1153 rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); in aa_replace_profiles()
1157 if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) { in aa_replace_profiles()
1166 if (!ent->old) { in aa_replace_profiles()
1168 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1170 p = aa_deref_parent(ent->new); in aa_replace_profiles()
1173 parent = ns_subprofs_dir(ent->new->ns); in aa_replace_profiles()
1174 error = __aafs_profile_mkdir(ent->new, parent); in aa_replace_profiles()
1183 /* Done with checks that may fail - do actual replacement */ in aa_replace_profiles()
1186 __aa_loaddata_update(udata, ns->revision); in aa_replace_profiles()
1188 list_del_init(&ent->list); in aa_replace_profiles()
1189 op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1191 if (ent->old && ent->old->rawdata == ent->new->rawdata && in aa_replace_profiles()
1192 ent->new->rawdata) { in aa_replace_profiles()
1194 audit_policy(label, op, ns_name, ent->new->base.hname, in aa_replace_profiles()
1198 aa_put_proxy(ent->new->label.proxy); in aa_replace_profiles()
1199 ent->new->label.proxy = NULL; in aa_replace_profiles()
1207 audit_policy(label, op, ns_name, ent->new->base.hname, NULL, in aa_replace_profiles()
1210 if (ent->old) { in aa_replace_profiles()
1211 share_name(ent->old, ent->new); in aa_replace_profiles()
1212 __replace_profile(ent->old, ent->new); in aa_replace_profiles()
1216 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1219 parent = update_to_newest_parent(ent->new); in aa_replace_profiles()
1220 lh = &parent->base.profiles; in aa_replace_profiles()
1222 lh = &ns->base.profiles; in aa_replace_profiles()
1223 __add_profile(lh, ent->new); in aa_replace_profiles()
1229 mutex_unlock(&ns->lock); in aa_replace_profiles()
1238 return udata->size; in aa_replace_profiles()
1241 mutex_unlock(&ns->lock); in aa_replace_profiles()
1244 op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1246 audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL, in aa_replace_profiles()
1256 op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1257 audit_policy(label, op, ns_name, tmp->new->base.hname, info, in aa_replace_profiles()
1261 list_del_init(&ent->list); in aa_replace_profiles()
1269 * aa_remove_profiles - remove profile(s) from the system
1293 error = -ENOENT; in aa_remove_profiles()
1306 error = -ENOENT; in aa_remove_profiles()
1314 /* remove namespace - can only happen if fqname[0] == ':' */ in aa_remove_profiles()
1315 mutex_lock_nested(&ns->parent->lock, ns->parent->level); in aa_remove_profiles()
1318 mutex_unlock(&ns->parent->lock); in aa_remove_profiles()
1321 mutex_lock_nested(&ns->lock, ns->level); in aa_remove_profiles()
1322 profile = aa_get_profile(__lookup_profile(&ns->base, name)); in aa_remove_profiles()
1324 error = -ENOENT; in aa_remove_profiles()
1328 name = profile->base.hname; in aa_remove_profiles()
1332 mutex_unlock(&ns->lock); in aa_remove_profiles()
1343 mutex_unlock(&ns->lock); in aa_remove_profiles()