1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains basic common functions used in AppArmor
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
11 #include <linux/ctype.h>
13 #include <linux/slab.h>
14 #include <linux/string.h>
15 #include <linux/vmalloc.h>
17 #include "include/audit.h"
18 #include "include/apparmor.h"
19 #include "include/lib.h"
20 #include "include/perms.h"
21 #include "include/policy.h"
23 struct aa_perms nullperms;
24 struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
25 .quiet = ALL_PERMS_MASK,
26 .hide = ALL_PERMS_MASK };
29 * aa_free_str_table - free entries str table
30 * @t: the string table to free (MAYBE NULL)
32 void aa_free_str_table(struct aa_str_table *t)
40 for (i = 0; i < t->size; i++)
41 kfree_sensitive(t->table[i]);
42 kfree_sensitive(t->table);
49 * aa_split_fqname - split a fqname into a profile and namespace name
50 * @fqname: a full qualified name in namespace profile format (NOT NULL)
51 * @ns_name: pointer to portion of the string containing the ns name (NOT NULL)
53 * Returns: profile name or NULL if one is not specified
55 * Split a namespace name from a profile name (see policy.c for naming
56 * description). If a portion of the name is missing it returns NULL for
59 * NOTE: may modify the @fqname string. The pointers returned point
60 * into the @fqname string.
62 char *aa_split_fqname(char *fqname, char **ns_name)
64 char *name = strim(fqname);
68 char *split = strchr(&name[1], ':');
69 *ns_name = skip_spaces(&name[1]);
71 /* overwrite ':' with \0 */
73 if (strncmp(split, "//", 2) == 0)
75 name = skip_spaces(split);
77 /* a ns name without a following profile is allowed */
80 if (name && *name == 0)
87 * skipn_spaces - Removes leading whitespace from @str.
88 * @str: The string to be stripped.
89 * @n: length of str to parse, will stop at \0 if encountered before n
91 * Returns a pointer to the first non-whitespace character in @str.
92 * if all whitespace will return NULL
95 const char *skipn_spaces(const char *str, size_t n)
97 for (; n && isspace(*str); --n)
104 const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
107 const char *end = fqname + n;
108 const char *name = skipn_spaces(fqname, n);
116 if (name[0] == ':') {
117 char *split = strnchr(&name[1], end - &name[1], ':');
118 *ns_name = skipn_spaces(&name[1], end - &name[1]);
122 *ns_len = split - *ns_name;
126 if (end - split > 1 && strncmp(split, "//", 2) == 0)
128 name = skipn_spaces(split, end - split);
130 /* a ns name without a following profile is allowed */
132 *ns_len = end - *ns_name;
135 if (name && *name == 0)
142 * aa_info_message - log a none profile related status message
143 * @str: message to log
145 void aa_info_message(const char *str)
148 DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
151 aa_audit_msg(AUDIT_APPARMOR_STATUS, &ad, NULL);
153 printk(KERN_INFO "AppArmor: %s\n", str);
156 __counted char *aa_str_alloc(int size, gfp_t gfp)
158 struct counted_str *str;
160 str = kmalloc(struct_size(str, name, size), gfp);
164 kref_init(&str->count);
168 void aa_str_kref(struct kref *kref)
170 kfree(container_of(kref, struct counted_str, count));
174 const char aa_file_perm_chrs[] = "xwracd km l ";
175 const char *aa_file_perm_names[] = {
218 * aa_perm_mask_to_str - convert a perm mask to its short string
219 * @str: character buffer to store string in (at least 10 characters)
220 * @str_size: size of the @str buffer
221 * @chrs: NUL-terminated character buffer of permission characters
222 * @mask: permission mask to convert
224 void aa_perm_mask_to_str(char *str, size_t str_size, const char *chrs, u32 mask)
226 unsigned int i, perm = 1;
227 size_t num_chrs = strlen(chrs);
229 for (i = 0; i < num_chrs; perm <<= 1, i++) {
231 /* Ensure that one byte is left for NUL-termination */
232 if (WARN_ON_ONCE(str_size <= 1))
242 void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
245 const char *fmt = "%s";
246 unsigned int i, perm = 1;
249 for (i = 0; i < 32; perm <<= 1, i++) {
251 audit_log_format(ab, fmt, names[i]);
260 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
261 u32 chrsmask, const char * const *names, u32 namesmask)
265 audit_log_format(ab, "\"");
266 if ((mask & chrsmask) && chrs) {
267 aa_perm_mask_to_str(str, sizeof(str), chrs, mask & chrsmask);
269 audit_log_format(ab, "%s", str);
270 if (mask & namesmask)
271 audit_log_format(ab, " ");
273 if ((mask & namesmask) && names)
274 aa_audit_perm_names(ab, names, mask & namesmask);
275 audit_log_format(ab, "\"");
279 * aa_audit_perms_cb - generic callback fn for auditing perms
280 * @ab: audit buffer (NOT NULL)
281 * @va: audit struct to audit values of (NOT NULL)
283 static void aa_audit_perms_cb(struct audit_buffer *ab, void *va)
285 struct common_audit_data *sa = va;
286 struct apparmor_audit_data *ad = aad(sa);
289 audit_log_format(ab, " requested_mask=");
290 aa_audit_perm_mask(ab, ad->request, aa_file_perm_chrs,
291 PERMS_CHRS_MASK, aa_file_perm_names,
295 audit_log_format(ab, "denied_mask=");
296 aa_audit_perm_mask(ab, ad->denied, aa_file_perm_chrs,
297 PERMS_CHRS_MASK, aa_file_perm_names,
300 audit_log_format(ab, " peer=");
301 aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
302 FLAGS_NONE, GFP_ATOMIC);
306 * aa_apply_modes_to_perms - apply namespace and profile flags to perms
307 * @profile: that perms where computed from
308 * @perms: perms to apply mode modifiers to
310 * TODO: split into profile and ns based flags for when accumulating perms
312 void aa_apply_modes_to_perms(struct aa_profile *profile, struct aa_perms *perms)
314 switch (AUDIT_MODE(profile)) {
316 perms->audit = ALL_PERMS_MASK;
324 case AUDIT_QUIET_DENIED:
325 perms->quiet = ALL_PERMS_MASK;
329 if (KILL_MODE(profile))
330 perms->kill = ALL_PERMS_MASK;
331 else if (COMPLAIN_MODE(profile))
332 perms->complain = ALL_PERMS_MASK;
333 else if (USER_MODE(profile))
334 perms->prompt = ALL_PERMS_MASK;
337 void aa_profile_match_label(struct aa_profile *profile,
338 struct aa_ruleset *rules,
339 struct aa_label *label,
340 int type, u32 request, struct aa_perms *perms)
342 /* TODO: doesn't yet handle extended types */
345 state = aa_dfa_next(rules->policy->dfa,
346 rules->policy->start[AA_CLASS_LABEL],
348 aa_label_match(profile, rules, label, state, false, request, perms);
352 /* currently unused */
353 int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
354 u32 request, int type, u32 *deny,
355 struct apparmor_audit_data *ad)
357 struct aa_ruleset *rules = list_first_entry(&profile->rules,
358 typeof(*rules), list);
359 struct aa_perms perms;
361 ad->peer = &target->label;
362 ad->request = request;
364 aa_profile_match_label(profile, rules, &target->label, type, request,
366 aa_apply_modes_to_perms(profile, &perms);
367 *deny |= request & perms.deny;
368 return aa_check_perms(profile, &perms, request, ad, aa_audit_perms_cb);
372 * aa_check_perms - do audit mode selection based on perms set
373 * @profile: profile being checked
374 * @perms: perms computed for the request
375 * @request: requested perms
376 * @ad: initialized audit structure (MAY BE NULL if not auditing)
377 * @cb: callback fn for type specific fields (MAY BE NULL)
379 * Returns: 0 if permission else error code
381 * Note: profile audit modes need to be set before calling by setting the
382 * perm masks appropriately.
384 * If not auditing then complain mode is not enabled and the
385 * error code will indicate whether there was an explicit deny
386 * with a positive value.
388 int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
389 u32 request, struct apparmor_audit_data *ad,
390 void (*cb)(struct audit_buffer *, void *))
393 u32 denied = request & (~perms->allow | perms->deny);
395 if (likely(!denied)) {
396 /* mask off perms that are not being force audited */
397 request &= perms->audit;
401 type = AUDIT_APPARMOR_AUDIT;
406 if (denied & perms->kill)
407 type = AUDIT_APPARMOR_KILL;
408 else if (denied == (denied & perms->complain))
409 type = AUDIT_APPARMOR_ALLOWED;
411 type = AUDIT_APPARMOR_DENIED;
413 if (denied == (denied & perms->hide))
416 denied &= ~perms->quiet;
422 ad->subj_label = &profile->label;
423 ad->request = request;
426 aa_audit_msg(type, ad, cb);
429 if (type == AUDIT_APPARMOR_ALLOWED)
437 * aa_policy_init - initialize a policy structure
438 * @policy: policy to initialize (NOT NULL)
439 * @prefix: prefix name if any is required. (MAYBE NULL)
440 * @name: name of the policy, init will make a copy of it (NOT NULL)
441 * @gfp: allocation mode
443 * Note: this fn creates a copy of strings passed in
445 * Returns: true if policy init successful
447 bool aa_policy_init(struct aa_policy *policy, const char *prefix,
448 const char *name, gfp_t gfp)
452 /* freed by policy_free */
454 hname = aa_str_alloc(strlen(prefix) + strlen(name) + 3, gfp);
456 sprintf(hname, "%s//%s", prefix, name);
458 hname = aa_str_alloc(strlen(name) + 1, gfp);
464 policy->hname = hname;
465 /* base.name is a substring of fqname */
466 policy->name = basename(policy->hname);
467 INIT_LIST_HEAD(&policy->list);
468 INIT_LIST_HEAD(&policy->profiles);
474 * aa_policy_destroy - free the elements referenced by @policy
475 * @policy: policy that is to have its elements freed (NOT NULL)
477 void aa_policy_destroy(struct aa_policy *policy)
479 AA_BUG(on_list_rcu(&policy->profiles));
480 AA_BUG(on_list_rcu(&policy->list));
482 /* don't free name as its a subset of hname */
483 aa_put_str(policy->hname);