1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * AppArmor security module |
4 | * |
5 | * This file contains AppArmor /proc/<pid>/attr/ interface functions |
6 | * |
7 | * Copyright (C) 1998-2008 Novell/SUSE |
8 | * Copyright 2009-2010 Canonical Ltd. |
9 | */ |
10 | |
11 | #include "include/apparmor.h" |
12 | #include "include/cred.h" |
13 | #include "include/policy.h" |
14 | #include "include/policy_ns.h" |
15 | #include "include/domain.h" |
16 | #include "include/procattr.h" |
17 | |
18 | |
19 | /** |
20 | * aa_getprocattr - Return the label information for @label |
21 | * @label: the label to print label info about (NOT NULL) |
22 | * @string: Returns - string containing the label info (NOT NULL) |
23 | * @newline: indicates that a newline should be added |
24 | * |
25 | * Requires: label != NULL && string != NULL |
26 | * |
27 | * Creates a string containing the label information for @label. |
28 | * |
29 | * Returns: size of string placed in @string else error code on failure |
30 | */ |
31 | int aa_getprocattr(struct aa_label *label, char **string, bool newline) |
32 | { |
33 | struct aa_ns *ns = labels_ns(label); |
34 | struct aa_ns *current_ns = aa_get_current_ns(); |
35 | int len; |
36 | |
37 | if (!aa_ns_visible(curr: current_ns, view: ns, subns: true)) { |
38 | aa_put_ns(ns: current_ns); |
39 | return -EACCES; |
40 | } |
41 | |
42 | len = aa_label_snxprint(NULL, size: 0, view: current_ns, label, |
43 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
44 | FLAG_HIDDEN_UNCONFINED); |
45 | AA_BUG(len < 0); |
46 | |
47 | *string = kmalloc(size: len + 2, GFP_KERNEL); |
48 | if (!*string) { |
49 | aa_put_ns(ns: current_ns); |
50 | return -ENOMEM; |
51 | } |
52 | |
53 | len = aa_label_snxprint(str: *string, size: len + 2, view: current_ns, label, |
54 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
55 | FLAG_HIDDEN_UNCONFINED); |
56 | if (len < 0) { |
57 | aa_put_ns(ns: current_ns); |
58 | return len; |
59 | } |
60 | |
61 | if (newline) |
62 | (*string)[len++] = '\n'; |
63 | (*string)[len] = 0; |
64 | |
65 | aa_put_ns(ns: current_ns); |
66 | return len; |
67 | } |
68 | |
69 | /** |
70 | * split_token_from_name - separate a string of form <token>^<name> |
71 | * @op: operation being checked |
72 | * @args: string to parse (NOT NULL) |
73 | * @token: stores returned parsed token value (NOT NULL) |
74 | * |
75 | * Returns: start position of name after token else NULL on failure |
76 | */ |
77 | static char *split_token_from_name(const char *op, char *args, u64 *token) |
78 | { |
79 | char *name; |
80 | |
81 | *token = simple_strtoull(args, &name, 16); |
82 | if ((name == args) || *name != '^') { |
83 | AA_ERROR("%s: Invalid input '%s'" , op, args); |
84 | return ERR_PTR(error: -EINVAL); |
85 | } |
86 | |
87 | name++; /* skip ^ */ |
88 | if (!*name) |
89 | name = NULL; |
90 | return name; |
91 | } |
92 | |
93 | /** |
94 | * aa_setprocattr_changehat - handle procattr interface to change_hat |
95 | * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL) |
96 | * @size: size of the args |
97 | * @flags: set of flags governing behavior |
98 | * |
99 | * Returns: %0 or error code if change_hat fails |
100 | */ |
101 | int aa_setprocattr_changehat(char *args, size_t size, int flags) |
102 | { |
103 | char *hat; |
104 | u64 token; |
105 | const char *hats[16]; /* current hard limit on # of names */ |
106 | int count = 0; |
107 | |
108 | hat = split_token_from_name(OP_CHANGE_HAT, args, token: &token); |
109 | if (IS_ERR(ptr: hat)) |
110 | return PTR_ERR(ptr: hat); |
111 | |
112 | if (!hat && !token) { |
113 | AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic" ); |
114 | return -EINVAL; |
115 | } |
116 | |
117 | if (hat) { |
118 | /* set up hat name vector, args guaranteed null terminated |
119 | * at args[size] by setprocattr. |
120 | * |
121 | * If there are multiple hat names in the buffer each is |
122 | * separated by a \0. Ie. userspace writes them pre tokenized |
123 | */ |
124 | char *end = args + size; |
125 | for (count = 0; (hat < end) && count < 16; ++count) { |
126 | char *next = hat + strlen(hat) + 1; |
127 | hats[count] = hat; |
128 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n" |
129 | , __func__, current->pid, token, count, hat); |
130 | hat = next; |
131 | } |
132 | } else |
133 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n" , |
134 | __func__, current->pid, token, count, "<NULL>" ); |
135 | |
136 | return aa_change_hat(hats, count, token, flags); |
137 | } |
138 | |