1 // SPDX-License-Identifier: GPL-2.0-only
5  * This file contains AppArmor mediation of files
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
40  * file_audit_cb - call back for file specific audit fields
42  * @va: audit struct to audit values of  (NOT NULL)
48 	kuid_t fsuid = ad->subj_cred ? ad->subj_cred->fsuid : current_fsuid();  in file_audit_cb()
51 	if (ad->request & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
53 				    map_mask_to_chr_mask(ad->request));  in file_audit_cb()
56 	if (ad->denied & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
58 				    map_mask_to_chr_mask(ad->denied));  in file_audit_cb()
61 	if (ad->request & AA_AUDIT_FILE_MASK) {  in file_audit_cb()
65 				 from_kuid(&init_user_ns, ad->fs.ouid));  in file_audit_cb()
68 	if (ad->peer) {  in file_audit_cb()
70 		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,  in file_audit_cb()
72 	} else if (ad->fs.target) {  in file_audit_cb()
74 		audit_log_untrustedstring(ab, ad->fs.target);  in file_audit_cb()
79  * aa_audit_file - handle the auditing of file operations
80  * @subj_cred: cred of the subject
85  * @name: name of object being mediated (MAYBE NULL)
86  * @target: name of target (MAYBE NULL)
114 		u32 mask = perms->audit;  in aa_audit_file()
127 		ad.request = ad.request & ~perms->allow;  in aa_audit_file()
130 		if (ad.request & perms->kill)  in aa_audit_file()
134 		if ((ad.request & perms->quiet) &&  in aa_audit_file()
137 			ad.request &= ~perms->quiet;  in aa_audit_file()
143 	ad.denied = ad.request & ~perms->allow;  in aa_audit_file()
157 			     labels_profile(label)->disconnected);  in path_name()
162 				      NULL, NULL, cond->uid, info, error));  in path_name()
171  * aa_lookup_fperms - convert dfa compressed perms to internal perms
183 	unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state];  in aa_lookup_fperms()
185 	if (!(file_rules->perms))  in aa_lookup_fperms()
188 	if (uid_eq(current_fsuid(), cond->uid))  in aa_lookup_fperms()
189 		return &(file_rules->perms[index]);  in aa_lookup_fperms()
191 	return &(file_rules->perms[index + 1]);  in aa_lookup_fperms()
195  * aa_str_perms - find permission that match @name
200  * @perms: Returns - the permissions found when matching @name
209 	state = aa_dfa_match(file_rules->dfa, start, name);  in aa_str_perms()
220 	struct aa_ruleset *rules = list_first_entry(&profile->rules,  in __aa_path_perm()
226 	aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],  in __aa_path_perm()
228 	if (request & ~perms->allow)  in __aa_path_perm()
229 		e = -EACCES;  in __aa_path_perm()
232 			     cond->uid, NULL, e);  in __aa_path_perm()
248 	error = path_name(op, subj_cred, &profile->label, path,  in profile_path_perm()
249 			  flags | profile->path_flags, buffer, &name, cond,  in profile_path_perm()
258  * aa_path_perm - do permissions check & audit for @path
262  * @path: path to check permissions of  (NOT NULL)
279 	flags |= PATH_DELEGATE_DELETED | (S_ISDIR(cond->mode) ? PATH_IS_DIR :  in aa_path_perm()
283 		return -ENOMEM;  in aa_path_perm()
294  * xindex_is_subset - helper for aa_path_link
298  * test target x permissions are equal OR a subset of link x permissions
299  * this is done as part of the subset test, where a hardlink must have
300  * a subset of permissions that the target has.
302  * Returns: true if subset else false
319 	struct aa_ruleset *rules = list_first_entry(&profile->rules,  in profile_path_link()
328 	error = path_name(OP_LINK, subj_cred, &profile->label, link,  in profile_path_link()
329 			  profile->path_flags,  in profile_path_link()
335 	error = path_name(OP_LINK, subj_cred, &profile->label, target,  in profile_path_link()
336 			  profile->path_flags,  in profile_path_link()
341 	error = -EACCES;  in profile_path_link()
342 	/* aa_str_perms - handles the case of the dfa being NULL */  in profile_path_link()
343 	state = aa_str_perms(rules->file,  in profile_path_link()
344 			     rules->file->start[AA_CLASS_FILE], lname,  in profile_path_link()
351 	state = aa_dfa_null_transition(rules->file->dfa, state);  in profile_path_link()
352 	aa_str_perms(rules->file, state, tname, cond, &perms);  in profile_path_link()
367 	/* done if link subset test is not required */  in profile_path_link()
371 	/* Do link perm subset test requiring allowed permission on link are  in profile_path_link()
372 	 * a subset of the allowed permissions on target.  in profile_path_link()
374 	aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],  in profile_path_link()
377 	/* AA_MAY_LINK is not considered in the subset test */  in profile_path_link()
388 		info = "link not subset of target";  in profile_path_link()
398 			     NULL, cond->uid, info, error);  in profile_path_link()
402  * aa_path_link - Handle hard link permission check
412  * is done from the point of the link match (not start of DFA)
415  * The subset test if required forces that permissions granted
416  * on link are a subset of the permission granted to target.
424 	struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };  in aa_path_link()
425 	struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };  in aa_path_link()
427 		d_backing_inode(old_dentry)->i_uid,  in aa_path_link()
428 		d_backing_inode(old_dentry)->i_mode  in aa_path_link()
437 	error = -ENOMEM;  in aa_path_link()
455 	/* update caching of label on file_ctx */  in update_file_ctx()
456 	spin_lock(&fctx->lock);  in update_file_ctx()
457 	old = rcu_dereference_protected(fctx->label,  in update_file_ctx()
458 					lockdep_is_held(&fctx->lock));  in update_file_ctx()
462 			rcu_assign_pointer(fctx->label, l);  in update_file_ctx()
466 		fctx->allow |= request;  in update_file_ctx()
468 	spin_unlock(&fctx->lock);  in update_file_ctx()
482 		.mode = file_inode(file)->i_mode  in __file_path_perm()
487 	/* revalidation due to label out of date. No revocation at this time */  in __file_path_perm()
495 		return -ENOMEM;  in __file_path_perm()
500 					  &file->f_path, buffer,  in __file_path_perm()
507 		 * TODO: cache full perms so this only happens because of  in __file_path_perm()
514 						  profile, &file->f_path,  in __file_path_perm()
520 						  profile, &file->f_path,  in __file_path_perm()
537 	struct socket *sock = (struct socket *) file->private_data;  in __file_sock_perm()
542 	/* revalidation due to label out of date. No revocation at this time */  in __file_sock_perm()
561  * aa_file_perm - do permission revalidation check & audit for @file
586 	flabel  = rcu_dereference(fctx->label);  in aa_file_perm()
596 	denied = request & ~fctx->allow;  in aa_file_perm()
607 	if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry))  in aa_file_perm()
611 	else if (S_ISSOCK(file_inode(file)->i_mode))  in aa_file_perm()
629 	spin_lock(&tty->files_lock);  in revalidate_tty()
630 	if (!list_empty(&tty->tty_files)) {  in revalidate_tty()
634 		file_priv = list_first_entry(&tty->tty_files,  in revalidate_tty()
636 		file = file_priv->file;  in revalidate_tty()
642 	spin_unlock(&tty->files_lock);  in revalidate_tty()
658 	if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,  in match_file()
688 		replace_fd(n - 1, devnull, 0);  in aa_inherit_files()