Lines Matching +full:container +full:- +full:rules
1 // SPDX-License-Identifier: GPL-2.0-only
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
10 * AppArmor policy is based around profiles, which contain the rules a
13 * visible set of profiles or by following a profiles attachment rules.
15 * Each profile exists in a profile namespace which is a container of
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
29 * null-XXXX-YYYY - special automatically generated learning profiles
33 * user-XXXX - user defined profiles
44 * - it allows for sub profiles or hats, which allows an application to run
50 * - it allows for binary hierarchy of profiles, so that execution history
66 * - locking of profile lists is currently fairly coarse. All profile
105 aa_put_dfa(pdb->dfa); in aa_free_pdb()
106 kvfree(pdb->perms); in aa_free_pdb()
107 aa_free_str_table(&pdb->trans); in aa_free_pdb()
113 * aa_pdb_free_kref - free aa_policydb by kref (called by aa_put_pdb)
131 kref_init(&pdb->count); in aa_alloc_pdb()
138 * __add_profile - add a profiles to list and label tree
152 AA_BUG(!profile->ns); in __add_profile()
153 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __add_profile()
155 list_add_rcu(&profile->base.list, list); in __add_profile()
158 l = aa_label_insert(&profile->ns->labels, &profile->label); in __add_profile()
159 AA_BUG(l != &profile->label); in __add_profile()
164 * __list_remove_profile - remove a profile from the list it is on
178 AA_BUG(!profile->ns); in __list_remove_profile()
179 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __list_remove_profile()
181 list_del_rcu(&profile->base.list); in __list_remove_profile()
186 * __remove_profile - remove old profile, and children
194 AA_BUG(!profile->ns); in __remove_profile()
195 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __remove_profile()
198 __aa_profile_list_release(&profile->base.profiles); in __remove_profile()
200 aa_label_remove(&profile->label); in __remove_profile()
206 * __aa_profile_list_release - remove all profiles on the list and put refs
219 * aa_free_data - free a data blob
227 kvfree_sensitive(data->data, data->size); in aa_free_data()
228 kfree_sensitive(data->key); in aa_free_data()
236 for (i = 0; i < attach->xattr_count; i++) in free_attachment()
237 kfree_sensitive(attach->xattrs[i]); in free_attachment()
238 kfree_sensitive(attach->xattrs); in free_attachment()
239 aa_put_pdb(attach->xmatch); in free_attachment()
242 static void free_ruleset(struct aa_ruleset *rules) in free_ruleset() argument
246 aa_put_pdb(rules->file); in free_ruleset()
247 aa_put_pdb(rules->policy); in free_ruleset()
248 aa_free_cap_rules(&rules->caps); in free_ruleset()
249 aa_free_rlimit_rules(&rules->rlimits); in free_ruleset()
251 for (i = 0; i < rules->secmark_count; i++) in free_ruleset()
252 kfree_sensitive(rules->secmark[i].label); in free_ruleset()
253 kfree_sensitive(rules->secmark); in free_ruleset()
254 kfree_sensitive(rules); in free_ruleset()
259 struct aa_ruleset *rules; in aa_alloc_ruleset() local
261 rules = kzalloc(sizeof(*rules), gfp); in aa_alloc_ruleset()
262 if (rules) in aa_alloc_ruleset()
263 INIT_LIST_HEAD(&rules->list); in aa_alloc_ruleset()
265 return rules; in aa_alloc_ruleset()
269 * aa_free_profile - free a profile
289 aa_policy_destroy(&profile->base); in aa_free_profile()
290 aa_put_profile(rcu_access_pointer(profile->parent)); in aa_free_profile()
292 aa_put_ns(profile->ns); in aa_free_profile()
293 kfree_sensitive(profile->rename); in aa_free_profile()
294 kfree_sensitive(profile->disconnected); in aa_free_profile()
296 free_attachment(&profile->attach); in aa_free_profile()
300 * to rules in aa_free_profile()
302 list_for_each_entry_safe(rule, tmp, &profile->rules, list) { in aa_free_profile()
303 list_del_init(&rule->list); in aa_free_profile()
306 kfree_sensitive(profile->dirname); in aa_free_profile()
308 if (profile->data) { in aa_free_profile()
309 rht = profile->data; in aa_free_profile()
310 profile->data = NULL; in aa_free_profile()
315 kfree_sensitive(profile->hash); in aa_free_profile()
316 aa_put_loaddata(profile->rawdata); in aa_free_profile()
317 aa_label_destroy(&profile->label); in aa_free_profile()
323 * aa_alloc_profile - allocate, initialize and return a new profile
334 struct aa_ruleset *rules; in aa_alloc_profile() local
336 /* freed by free_profile - usually through aa_put_profile */ in aa_alloc_profile()
341 if (!aa_policy_init(&profile->base, NULL, hname, gfp)) in aa_alloc_profile()
343 if (!aa_label_init(&profile->label, 1, gfp)) in aa_alloc_profile()
346 INIT_LIST_HEAD(&profile->rules); in aa_alloc_profile()
349 rules = aa_alloc_ruleset(gfp); in aa_alloc_profile()
350 if (!rules) in aa_alloc_profile()
352 list_add(&rules->list, &profile->rules); in aa_alloc_profile()
356 proxy = aa_alloc_proxy(&profile->label, gfp); in aa_alloc_profile()
361 profile->label.proxy = proxy; in aa_alloc_profile()
363 profile->label.hname = profile->base.hname; in aa_alloc_profile()
364 profile->label.flags |= FLAG_PROFILE; in aa_alloc_profile()
365 profile->label.vec[0] = profile; in aa_alloc_profile()
376 /* TODO: profile accounting - setup in remove */
379 * __strn_find_child - find a profile on @head list using substring of @name
395 * __find_child - find a profile on @head list with a name matching @name
409 * aa_find_child - find a profile by @name in @parent
421 profile = __find_child(&parent->base.profiles, name); in aa_find_child()
430 * __lookup_parent - lookup the parent of a profile of name @hname
449 policy = &ns->base; in __lookup_parent()
452 profile = __strn_find_child(&policy->profiles, hname, in __lookup_parent()
453 split - hname); in __lookup_parent()
456 policy = &profile->base; in __lookup_parent()
461 return &ns->base; in __lookup_parent()
462 return &profile->base; in __lookup_parent()
466 * __create_missing_ancestors - create place holders for missing ancestores
487 policy = &ns->base; in __create_missing_ancestors()
491 profile = __strn_find_child(&policy->profiles, hname, in __create_missing_ancestors()
492 split - hname); in __create_missing_ancestors()
494 const char *name = kstrndup(hname, split - hname, in __create_missing_ancestors()
503 profile->ns = aa_get_ns(ns); in __create_missing_ancestors()
505 policy = &profile->base; in __create_missing_ancestors()
510 return &ns->base; in __create_missing_ancestors()
511 return &profile->base; in __create_missing_ancestors()
515 * __lookupn_profile - lookup the profile matching @hname
534 profile = __strn_find_child(&base->profiles, hname, in __lookupn_profile()
535 split - hname); in __lookupn_profile()
539 base = &profile->base; in __lookupn_profile()
540 n -= split + 2 - hname; in __lookupn_profile()
545 return __strn_find_child(&base->profiles, hname, n); in __lookupn_profile()
556 * aa_lookupn_profile - find a profile by its full or partial name
570 profile = __lookupn_profile(&ns->base, hname, n); in aa_lookupn_profile()
576 profile = aa_get_newest_profile(ns->unconfined); in aa_lookupn_profile()
599 profile = aa_lookupn_profile(ns, name, n - (name - fqname)); in aa_fqlookupn_profile()
602 profile = aa_get_newest_profile(ns->unconfined); in aa_fqlookupn_profile()
615 struct aa_ruleset *rules; in aa_alloc_null() local
622 profile->label.flags |= FLAG_NULL; in aa_alloc_null()
623 profile->attach.xmatch = aa_get_pdb(nullpdb); in aa_alloc_null()
624 rules = list_first_entry(&profile->rules, typeof(*rules), list); in aa_alloc_null()
625 rules->file = aa_get_pdb(nullpdb); in aa_alloc_null()
626 rules->policy = aa_get_pdb(nullpdb); in aa_alloc_null()
629 profile->path_flags = parent->path_flags; in aa_alloc_null()
632 rcu_assign_pointer(profile->parent, aa_get_profile(parent)); in aa_alloc_null()
633 profile->ns = aa_get_ns(parent->ns); in aa_alloc_null()
640 * aa_new_learning_profile - create or find a null-X learning profile
642 * @hat: true if the null- learning profile is a hat
646 * Find/Create a null- complain mode profile used in learning mode. The
647 * name of the profile is unique and follows the format of parent//null-XXX.
667 name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base), in aa_new_learning_profile()
670 sprintf(name, "%s//null-%s", parent->base.hname, base); in aa_new_learning_profile()
676 name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp); in aa_new_learning_profile()
679 sprintf(name, "%s//null-%x", parent->base.hname, in aa_new_learning_profile()
680 atomic_inc_return(&parent->ns->uniq_null)); in aa_new_learning_profile()
692 profile->mode = APPARMOR_COMPLAIN; in aa_new_learning_profile()
694 profile->label.flags |= FLAG_HAT; in aa_new_learning_profile()
696 mutex_lock_nested(&profile->ns->lock, profile->ns->level); in aa_new_learning_profile()
697 p = __find_child(&parent->base.profiles, bname); in aa_new_learning_profile()
702 __add_profile(&parent->base.profiles, profile); in aa_new_learning_profile()
704 mutex_unlock(&profile->ns->lock); in aa_new_learning_profile()
719 * replacement_allowed - test to see if replacement is allowed
722 * @info: Returns - info about why replacement failed (NOT NULL)
730 if (profile->label.flags & FLAG_IMMUTIBLE) { in replacement_allowed()
732 return -EPERM; in replacement_allowed()
735 return -EEXIST; in replacement_allowed()
747 if (ad->iface.ns) { in audit_cb()
749 audit_log_untrustedstring(ab, ad->iface.ns); in audit_cb()
754 * audit_policy - Do auditing of policy changes
799 * aa_policy_view_capable - check if viewing policy in at @ns is allowed
812 struct user_namespace *user_ns = subj_cred->user_ns; in aa_policy_view_capable()
823 user_ns->level == view_ns->level))) in aa_policy_view_capable()
832 struct user_namespace *user_ns = subj_cred->user_ns; in aa_policy_admin_capable()
868 * aa_may_manage_policy - can the current task manage policy
891 -EACCES); in aa_may_manage_policy()
895 -EACCES); in aa_may_manage_policy()
904 const char *base = basename(profile->base.hname); in __list_lookup_parent()
905 long len = base - profile->base.hname; in __list_lookup_parent()
911 len -= 2; in __list_lookup_parent()
914 if (ent->new == profile) in __list_lookup_parent()
916 if (strncmp(ent->new->base.hname, profile->base.hname, len) == in __list_lookup_parent()
917 0 && ent->new->base.hname[len] == 0) in __list_lookup_parent()
918 return ent->new; in __list_lookup_parent()
925 * __replace_profile - replace @old with @new on a list
940 if (!list_empty(&old->base.profiles)) { in __replace_profile()
942 list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu); in __replace_profile()
947 list_del_init(&child->base.list); in __replace_profile()
948 p = __find_child(&new->base.profiles, child->base.name); in __replace_profile()
959 rcu_assign_pointer(child->parent, aa_get_profile(new)); in __replace_profile()
960 list_add_rcu(&child->base.list, &new->base.profiles); in __replace_profile()
965 if (!rcu_access_pointer(new->parent)) { in __replace_profile()
967 rcu_assign_pointer(new->parent, aa_get_profile(parent)); in __replace_profile()
969 aa_label_replace(&old->label, &new->label); in __replace_profile()
973 if (list_empty(&new->base.list)) { in __replace_profile()
975 list_replace_rcu(&old->base.list, &new->base.list); in __replace_profile()
983 * __lookup_replace - lookup replacement information for a profile
987 * @p: Returns - profile to be replaced
988 * @info: Returns - info string on why lookup failed
996 *p = aa_get_profile(__lookup_profile(&ns->base, hname)); in __lookup_replace()
1010 aa_put_str(new->base.hname); in share_name()
1011 aa_get_str(old->base.hname); in share_name()
1012 new->base.hname = old->base.hname; in share_name()
1013 new->base.name = old->base.name; in share_name()
1014 new->label.hname = old->label.hname; in share_name()
1024 parent = rcu_dereference_protected(new->parent, in update_to_newest_parent()
1025 mutex_is_locked(&new->ns->lock)); in update_to_newest_parent()
1031 rcu_assign_pointer(new->parent, newest); in update_to_newest_parent()
1039 * aa_replace_profiles - replace profile(s) on the profile list
1078 if (ent->ns_name && in aa_replace_profiles()
1079 strcmp(ent->ns_name, ns_name) != 0) { in aa_replace_profiles()
1081 error = -EACCES; in aa_replace_profiles()
1084 } else if (ent->ns_name) { in aa_replace_profiles()
1087 error = -EACCES; in aa_replace_profiles()
1090 ns_name = ent->ns_name; in aa_replace_profiles()
1108 mutex_lock_nested(&ns->lock, ns->level); in aa_replace_profiles()
1110 if (!list_empty(&ns->rawdata_list)) { in aa_replace_profiles()
1111 list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) { in aa_replace_profiles()
1131 ent->new->rawdata = aa_get_loaddata(udata); in aa_replace_profiles()
1132 error = __lookup_replace(ns, ent->new->base.hname, in aa_replace_profiles()
1134 &ent->old, &info); in aa_replace_profiles()
1138 if (ent->new->rename) { in aa_replace_profiles()
1139 error = __lookup_replace(ns, ent->new->rename, in aa_replace_profiles()
1141 &ent->rename, &info); in aa_replace_profiles()
1147 ent->new->ns = aa_get_ns(ns); in aa_replace_profiles()
1149 if (ent->old || ent->rename) in aa_replace_profiles()
1154 policy = __lookup_parent(ns, ent->new->base.hname); in aa_replace_profiles()
1157 p = __list_lookup_parent(&lh, ent->new); in aa_replace_profiles()
1172 ent->new->base.hname, in aa_replace_profiles()
1175 error = -ENOENT; in aa_replace_profiles()
1181 if (!p && policy != &ns->base) in aa_replace_profiles()
1184 rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); in aa_replace_profiles()
1188 if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) { in aa_replace_profiles()
1197 if (!ent->old) { in aa_replace_profiles()
1199 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1201 p = aa_deref_parent(ent->new); in aa_replace_profiles()
1204 parent = ns_subprofs_dir(ent->new->ns); in aa_replace_profiles()
1205 error = __aafs_profile_mkdir(ent->new, parent); in aa_replace_profiles()
1214 /* Done with checks that may fail - do actual replacement */ in aa_replace_profiles()
1217 __aa_loaddata_update(udata, ns->revision); in aa_replace_profiles()
1219 list_del_init(&ent->list); in aa_replace_profiles()
1220 op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1222 if (ent->old && ent->old->rawdata == ent->new->rawdata && in aa_replace_profiles()
1223 ent->new->rawdata) { in aa_replace_profiles()
1225 audit_policy(label, op, ns_name, ent->new->base.hname, in aa_replace_profiles()
1229 aa_put_proxy(ent->new->label.proxy); in aa_replace_profiles()
1230 ent->new->label.proxy = NULL; in aa_replace_profiles()
1238 audit_policy(label, op, ns_name, ent->new->base.hname, NULL, in aa_replace_profiles()
1241 if (ent->old) { in aa_replace_profiles()
1242 share_name(ent->old, ent->new); in aa_replace_profiles()
1243 __replace_profile(ent->old, ent->new); in aa_replace_profiles()
1247 if (rcu_access_pointer(ent->new->parent)) { in aa_replace_profiles()
1250 parent = update_to_newest_parent(ent->new); in aa_replace_profiles()
1251 lh = &parent->base.profiles; in aa_replace_profiles()
1253 lh = &ns->base.profiles; in aa_replace_profiles()
1254 __add_profile(lh, ent->new); in aa_replace_profiles()
1260 mutex_unlock(&ns->lock); in aa_replace_profiles()
1269 return udata->size; in aa_replace_profiles()
1272 mutex_unlock(&ns->lock); in aa_replace_profiles()
1275 op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1277 audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL, in aa_replace_profiles()
1287 op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL; in aa_replace_profiles()
1288 audit_policy(label, op, ns_name, tmp->new->base.hname, info, in aa_replace_profiles()
1292 list_del_init(&ent->list); in aa_replace_profiles()
1300 * aa_remove_profiles - remove profile(s) from the system
1324 error = -ENOENT; in aa_remove_profiles()
1337 error = -ENOENT; in aa_remove_profiles()
1345 /* remove namespace - can only happen if fqname[0] == ':' */ in aa_remove_profiles()
1346 mutex_lock_nested(&ns->parent->lock, ns->parent->level); in aa_remove_profiles()
1349 mutex_unlock(&ns->parent->lock); in aa_remove_profiles()
1352 mutex_lock_nested(&ns->lock, ns->level); in aa_remove_profiles()
1353 profile = aa_get_profile(__lookup_profile(&ns->base, name)); in aa_remove_profiles()
1355 error = -ENOENT; in aa_remove_profiles()
1359 name = profile->base.hname; in aa_remove_profiles()
1363 mutex_unlock(&ns->lock); in aa_remove_profiles()
1374 mutex_unlock(&ns->lock); in aa_remove_profiles()