1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor /sys/kernel/security/apparmor interface functions
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11#include <linux/ctype.h>
12#include <linux/security.h>
13#include <linux/vmalloc.h>
14#include <linux/init.h>
15#include <linux/seq_file.h>
16#include <linux/uaccess.h>
17#include <linux/mount.h>
18#include <linux/namei.h>
19#include <linux/capability.h>
20#include <linux/rcupdate.h>
21#include <linux/fs.h>
22#include <linux/fs_context.h>
23#include <linux/poll.h>
24#include <linux/zstd.h>
25#include <uapi/linux/major.h>
26#include <uapi/linux/magic.h>
27
28#include "include/apparmor.h"
29#include "include/apparmorfs.h"
30#include "include/audit.h"
31#include "include/cred.h"
32#include "include/crypto.h"
33#include "include/ipc.h"
34#include "include/label.h"
35#include "include/policy.h"
36#include "include/policy_ns.h"
37#include "include/resource.h"
38#include "include/policy_unpack.h"
39#include "include/task.h"
40
41/*
42 * The apparmor filesystem interface used for policy load and introspection
43 * The interface is split into two main components based on their function
44 * a securityfs component:
45 * used for static files that are always available, and which allows
46 * userspace to specificy the location of the security filesystem.
47 *
48 * fns and data are prefixed with
49 * aa_sfs_
50 *
51 * an apparmorfs component:
52 * used loaded policy content and introspection. It is not part of a
53 * regular mounted filesystem and is available only through the magic
54 * policy symlink in the root of the securityfs apparmor/ directory.
55 * Tasks queries will be magically redirected to the correct portion
56 * of the policy tree based on their confinement.
57 *
58 * fns and data are prefixed with
59 * aafs_
60 *
61 * The aa_fs_ prefix is used to indicate the fn is used by both the
62 * securityfs and apparmorfs filesystems.
63 */
64
65
66/*
67 * support fns
68 */
69
70struct rawdata_f_data {
71 struct aa_loaddata *loaddata;
72};
73
74#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
75#define RAWDATA_F_DATA_BUF(p) (char *)(p + 1)
76
77static void rawdata_f_data_free(struct rawdata_f_data *private)
78{
79 if (!private)
80 return;
81
82 aa_put_loaddata(data: private->loaddata);
83 kvfree(addr: private);
84}
85
86static struct rawdata_f_data *rawdata_f_data_alloc(size_t size)
87{
88 struct rawdata_f_data *ret;
89
90 if (size > SIZE_MAX - sizeof(*ret))
91 return ERR_PTR(error: -EINVAL);
92
93 ret = kvzalloc(size: sizeof(*ret) + size, GFP_KERNEL);
94 if (!ret)
95 return ERR_PTR(error: -ENOMEM);
96
97 return ret;
98}
99#endif
100
101/**
102 * mangle_name - mangle a profile name to std profile layout form
103 * @name: profile name to mangle (NOT NULL)
104 * @target: buffer to store mangled name, same length as @name (MAYBE NULL)
105 *
106 * Returns: length of mangled name
107 */
108static int mangle_name(const char *name, char *target)
109{
110 char *t = target;
111
112 while (*name == '/' || *name == '.')
113 name++;
114
115 if (target) {
116 for (; *name; name++) {
117 if (*name == '/')
118 *(t)++ = '.';
119 else if (isspace(*name))
120 *(t)++ = '_';
121 else if (isalnum(*name) || strchr("._-", *name))
122 *(t)++ = *name;
123 }
124
125 *t = 0;
126 } else {
127 int len = 0;
128 for (; *name; name++) {
129 if (isalnum(*name) || isspace(*name) ||
130 strchr("/._-", *name))
131 len++;
132 }
133
134 return len;
135 }
136
137 return t - target;
138}
139
140
141/*
142 * aafs - core fns and data for the policy tree
143 */
144
145#define AAFS_NAME "apparmorfs"
146static struct vfsmount *aafs_mnt;
147static int aafs_count;
148
149
150static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
151{
152 seq_printf(m: seq, fmt: "%s:[%lu]", AAFS_NAME, d_inode(dentry)->i_ino);
153 return 0;
154}
155
156static void aafs_free_inode(struct inode *inode)
157{
158 if (S_ISLNK(inode->i_mode))
159 kfree(objp: inode->i_link);
160 free_inode_nonrcu(inode);
161}
162
163static const struct super_operations aafs_super_ops = {
164 .statfs = simple_statfs,
165 .free_inode = aafs_free_inode,
166 .show_path = aafs_show_path,
167};
168
169static int apparmorfs_fill_super(struct super_block *sb, struct fs_context *fc)
170{
171 static struct tree_descr files[] = { {""} };
172 int error;
173
174 error = simple_fill_super(sb, AAFS_MAGIC, files);
175 if (error)
176 return error;
177 sb->s_op = &aafs_super_ops;
178
179 return 0;
180}
181
182static int apparmorfs_get_tree(struct fs_context *fc)
183{
184 return get_tree_single(fc, fill_super: apparmorfs_fill_super);
185}
186
187static const struct fs_context_operations apparmorfs_context_ops = {
188 .get_tree = apparmorfs_get_tree,
189};
190
191static int apparmorfs_init_fs_context(struct fs_context *fc)
192{
193 fc->ops = &apparmorfs_context_ops;
194 return 0;
195}
196
197static struct file_system_type aafs_ops = {
198 .owner = THIS_MODULE,
199 .name = AAFS_NAME,
200 .init_fs_context = apparmorfs_init_fs_context,
201 .kill_sb = kill_anon_super,
202};
203
204/**
205 * __aafs_setup_d_inode - basic inode setup for apparmorfs
206 * @dir: parent directory for the dentry
207 * @dentry: dentry we are seting the inode up for
208 * @mode: permissions the file should have
209 * @data: data to store on inode.i_private, available in open()
210 * @link: if symlink, symlink target string
211 * @fops: struct file_operations that should be used
212 * @iops: struct of inode_operations that should be used
213 */
214static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
215 umode_t mode, void *data, char *link,
216 const struct file_operations *fops,
217 const struct inode_operations *iops)
218{
219 struct inode *inode = new_inode(sb: dir->i_sb);
220
221 AA_BUG(!dir);
222 AA_BUG(!dentry);
223
224 if (!inode)
225 return -ENOMEM;
226
227 inode->i_ino = get_next_ino();
228 inode->i_mode = mode;
229 simple_inode_init_ts(inode);
230 inode->i_private = data;
231 if (S_ISDIR(mode)) {
232 inode->i_op = iops ? iops : &simple_dir_inode_operations;
233 inode->i_fop = &simple_dir_operations;
234 inc_nlink(inode);
235 inc_nlink(inode: dir);
236 } else if (S_ISLNK(mode)) {
237 inode->i_op = iops ? iops : &simple_symlink_inode_operations;
238 inode->i_link = link;
239 } else {
240 inode->i_fop = fops;
241 }
242 d_instantiate(dentry, inode);
243 dget(dentry);
244
245 return 0;
246}
247
248/**
249 * aafs_create - create a dentry in the apparmorfs filesystem
250 *
251 * @name: name of dentry to create
252 * @mode: permissions the file should have
253 * @parent: parent directory for this dentry
254 * @data: data to store on inode.i_private, available in open()
255 * @link: if symlink, symlink target string
256 * @fops: struct file_operations that should be used for
257 * @iops: struct of inode_operations that should be used
258 *
259 * This is the basic "create a xxx" function for apparmorfs.
260 *
261 * Returns a pointer to a dentry if it succeeds, that must be free with
262 * aafs_remove(). Will return ERR_PTR on failure.
263 */
264static struct dentry *aafs_create(const char *name, umode_t mode,
265 struct dentry *parent, void *data, void *link,
266 const struct file_operations *fops,
267 const struct inode_operations *iops)
268{
269 struct dentry *dentry;
270 struct inode *dir;
271 int error;
272
273 AA_BUG(!name);
274 AA_BUG(!parent);
275
276 if (!(mode & S_IFMT))
277 mode = (mode & S_IALLUGO) | S_IFREG;
278
279 error = simple_pin_fs(&aafs_ops, mount: &aafs_mnt, count: &aafs_count);
280 if (error)
281 return ERR_PTR(error);
282
283 dir = d_inode(dentry: parent);
284
285 inode_lock(inode: dir);
286 dentry = lookup_one_len(name, parent, strlen(name));
287 if (IS_ERR(ptr: dentry)) {
288 error = PTR_ERR(ptr: dentry);
289 goto fail_lock;
290 }
291
292 if (d_really_is_positive(dentry)) {
293 error = -EEXIST;
294 goto fail_dentry;
295 }
296
297 error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
298 if (error)
299 goto fail_dentry;
300 inode_unlock(inode: dir);
301
302 return dentry;
303
304fail_dentry:
305 dput(dentry);
306
307fail_lock:
308 inode_unlock(inode: dir);
309 simple_release_fs(mount: &aafs_mnt, count: &aafs_count);
310
311 return ERR_PTR(error);
312}
313
314/**
315 * aafs_create_file - create a file in the apparmorfs filesystem
316 *
317 * @name: name of dentry to create
318 * @mode: permissions the file should have
319 * @parent: parent directory for this dentry
320 * @data: data to store on inode.i_private, available in open()
321 * @fops: struct file_operations that should be used for
322 *
323 * see aafs_create
324 */
325static struct dentry *aafs_create_file(const char *name, umode_t mode,
326 struct dentry *parent, void *data,
327 const struct file_operations *fops)
328{
329 return aafs_create(name, mode, parent, data, NULL, fops, NULL);
330}
331
332/**
333 * aafs_create_dir - create a directory in the apparmorfs filesystem
334 *
335 * @name: name of dentry to create
336 * @parent: parent directory for this dentry
337 *
338 * see aafs_create
339 */
340static struct dentry *aafs_create_dir(const char *name, struct dentry *parent)
341{
342 return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL,
343 NULL);
344}
345
346/**
347 * aafs_remove - removes a file or directory from the apparmorfs filesystem
348 *
349 * @dentry: dentry of the file/directory/symlink to removed.
350 */
351static void aafs_remove(struct dentry *dentry)
352{
353 struct inode *dir;
354
355 if (!dentry || IS_ERR(ptr: dentry))
356 return;
357
358 dir = d_inode(dentry: dentry->d_parent);
359 inode_lock(inode: dir);
360 if (simple_positive(dentry)) {
361 if (d_is_dir(dentry))
362 simple_rmdir(dir, dentry);
363 else
364 simple_unlink(dir, dentry);
365 d_delete(dentry);
366 dput(dentry);
367 }
368 inode_unlock(inode: dir);
369 simple_release_fs(mount: &aafs_mnt, count: &aafs_count);
370}
371
372
373/*
374 * aa_fs - policy load/replace/remove
375 */
376
377/**
378 * aa_simple_write_to_buffer - common routine for getting policy from user
379 * @userbuf: user buffer to copy data from (NOT NULL)
380 * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size)
381 * @copy_size: size of data to copy from user buffer
382 * @pos: position write is at in the file (NOT NULL)
383 *
384 * Returns: kernel buffer containing copy of user buffer data or an
385 * ERR_PTR on failure.
386 */
387static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
388 size_t alloc_size,
389 size_t copy_size,
390 loff_t *pos)
391{
392 struct aa_loaddata *data;
393
394 AA_BUG(copy_size > alloc_size);
395
396 if (*pos != 0)
397 /* only writes from pos 0, that is complete writes */
398 return ERR_PTR(error: -ESPIPE);
399
400 /* freed by caller to simple_write_to_buffer */
401 data = aa_loaddata_alloc(size: alloc_size);
402 if (IS_ERR(ptr: data))
403 return data;
404
405 data->size = copy_size;
406 if (copy_from_user(to: data->data, from: userbuf, n: copy_size)) {
407 aa_put_loaddata(data);
408 return ERR_PTR(error: -EFAULT);
409 }
410
411 return data;
412}
413
414static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
415 loff_t *pos, struct aa_ns *ns)
416{
417 struct aa_loaddata *data;
418 struct aa_label *label;
419 ssize_t error;
420
421 label = begin_current_label_crit_section();
422
423 /* high level check about policy management - fine grained in
424 * below after unpack
425 */
426 error = aa_may_manage_policy(current_cred(), label, ns, mask);
427 if (error)
428 goto end_section;
429
430 data = aa_simple_write_to_buffer(userbuf: buf, alloc_size: size, copy_size: size, pos);
431 error = PTR_ERR(ptr: data);
432 if (!IS_ERR(ptr: data)) {
433 error = aa_replace_profiles(view: ns, label, mask, udata: data);
434 aa_put_loaddata(data);
435 }
436end_section:
437 end_current_label_crit_section(label);
438
439 return error;
440}
441
442/* .load file hook fn to load policy */
443static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
444 loff_t *pos)
445{
446 struct aa_ns *ns = aa_get_ns(ns: f->f_inode->i_private);
447 int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
448
449 aa_put_ns(ns);
450
451 return error;
452}
453
454static const struct file_operations aa_fs_profile_load = {
455 .write = profile_load,
456 .llseek = default_llseek,
457};
458
459/* .replace file hook fn to load and/or replace policy */
460static ssize_t profile_replace(struct file *f, const char __user *buf,
461 size_t size, loff_t *pos)
462{
463 struct aa_ns *ns = aa_get_ns(ns: f->f_inode->i_private);
464 int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
465 buf, size, pos, ns);
466 aa_put_ns(ns);
467
468 return error;
469}
470
471static const struct file_operations aa_fs_profile_replace = {
472 .write = profile_replace,
473 .llseek = default_llseek,
474};
475
476/* .remove file hook fn to remove loaded policy */
477static ssize_t profile_remove(struct file *f, const char __user *buf,
478 size_t size, loff_t *pos)
479{
480 struct aa_loaddata *data;
481 struct aa_label *label;
482 ssize_t error;
483 struct aa_ns *ns = aa_get_ns(ns: f->f_inode->i_private);
484
485 label = begin_current_label_crit_section();
486 /* high level check about policy management - fine grained in
487 * below after unpack
488 */
489 error = aa_may_manage_policy(current_cred(), label, ns,
490 AA_MAY_REMOVE_POLICY);
491 if (error)
492 goto out;
493
494 /*
495 * aa_remove_profile needs a null terminated string so 1 extra
496 * byte is allocated and the copied data is null terminated.
497 */
498 data = aa_simple_write_to_buffer(userbuf: buf, alloc_size: size + 1, copy_size: size, pos);
499
500 error = PTR_ERR(ptr: data);
501 if (!IS_ERR(ptr: data)) {
502 data->data[size] = 0;
503 error = aa_remove_profiles(view: ns, label, name: data->data, size);
504 aa_put_loaddata(data);
505 }
506 out:
507 end_current_label_crit_section(label);
508 aa_put_ns(ns);
509 return error;
510}
511
512static const struct file_operations aa_fs_profile_remove = {
513 .write = profile_remove,
514 .llseek = default_llseek,
515};
516
517struct aa_revision {
518 struct aa_ns *ns;
519 long last_read;
520};
521
522/* revision file hook fn for policy loads */
523static int ns_revision_release(struct inode *inode, struct file *file)
524{
525 struct aa_revision *rev = file->private_data;
526
527 if (rev) {
528 aa_put_ns(ns: rev->ns);
529 kfree(objp: rev);
530 }
531
532 return 0;
533}
534
535static ssize_t ns_revision_read(struct file *file, char __user *buf,
536 size_t size, loff_t *ppos)
537{
538 struct aa_revision *rev = file->private_data;
539 char buffer[32];
540 long last_read;
541 int avail;
542
543 mutex_lock_nested(lock: &rev->ns->lock, subclass: rev->ns->level);
544 last_read = rev->last_read;
545 if (last_read == rev->ns->revision) {
546 mutex_unlock(lock: &rev->ns->lock);
547 if (file->f_flags & O_NONBLOCK)
548 return -EAGAIN;
549 if (wait_event_interruptible(rev->ns->wait,
550 last_read !=
551 READ_ONCE(rev->ns->revision)))
552 return -ERESTARTSYS;
553 mutex_lock_nested(lock: &rev->ns->lock, subclass: rev->ns->level);
554 }
555
556 avail = sprintf(buf: buffer, fmt: "%ld\n", rev->ns->revision);
557 if (*ppos + size > avail) {
558 rev->last_read = rev->ns->revision;
559 *ppos = 0;
560 }
561 mutex_unlock(lock: &rev->ns->lock);
562
563 return simple_read_from_buffer(to: buf, count: size, ppos, from: buffer, available: avail);
564}
565
566static int ns_revision_open(struct inode *inode, struct file *file)
567{
568 struct aa_revision *rev = kzalloc(size: sizeof(*rev), GFP_KERNEL);
569
570 if (!rev)
571 return -ENOMEM;
572
573 rev->ns = aa_get_ns(ns: inode->i_private);
574 if (!rev->ns)
575 rev->ns = aa_get_current_ns();
576 file->private_data = rev;
577
578 return 0;
579}
580
581static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
582{
583 struct aa_revision *rev = file->private_data;
584 __poll_t mask = 0;
585
586 if (rev) {
587 mutex_lock_nested(lock: &rev->ns->lock, subclass: rev->ns->level);
588 poll_wait(filp: file, wait_address: &rev->ns->wait, p: pt);
589 if (rev->last_read < rev->ns->revision)
590 mask |= EPOLLIN | EPOLLRDNORM;
591 mutex_unlock(lock: &rev->ns->lock);
592 }
593
594 return mask;
595}
596
597void __aa_bump_ns_revision(struct aa_ns *ns)
598{
599 WRITE_ONCE(ns->revision, READ_ONCE(ns->revision) + 1);
600 wake_up_interruptible(&ns->wait);
601}
602
603static const struct file_operations aa_fs_ns_revision_fops = {
604 .owner = THIS_MODULE,
605 .open = ns_revision_open,
606 .poll = ns_revision_poll,
607 .read = ns_revision_read,
608 .llseek = generic_file_llseek,
609 .release = ns_revision_release,
610};
611
612static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
613 const char *match_str, size_t match_len)
614{
615 struct aa_ruleset *rules = list_first_entry(&profile->rules,
616 typeof(*rules), list);
617 struct aa_perms tmp = { };
618 aa_state_t state = DFA_NOMATCH;
619
620 if (profile_unconfined(profile))
621 return;
622 if (rules->file->dfa && *match_str == AA_CLASS_FILE) {
623 state = aa_dfa_match_len(dfa: rules->file->dfa,
624 start: rules->file->start[AA_CLASS_FILE],
625 str: match_str + 1, len: match_len - 1);
626 if (state) {
627 struct path_cond cond = { };
628
629 tmp = *(aa_lookup_fperms(file_rules: rules->file, state, cond: &cond));
630 }
631 } else if (rules->policy->dfa) {
632 if (!RULE_MEDIATES(rules, class: *match_str))
633 return; /* no change to current perms */
634 state = aa_dfa_match_len(dfa: rules->policy->dfa,
635 start: rules->policy->start[0],
636 str: match_str, len: match_len);
637 if (state)
638 tmp = *aa_lookup_perms(policy: rules->policy, state);
639 }
640 aa_apply_modes_to_perms(profile, perms: &tmp);
641 aa_perms_accum_raw(accum: perms, addend: &tmp);
642}
643
644
645/**
646 * query_data - queries a policy and writes its data to buf
647 * @buf: the resulting data is stored here (NOT NULL)
648 * @buf_len: size of buf
649 * @query: query string used to retrieve data
650 * @query_len: size of query including second NUL byte
651 *
652 * The buffers pointed to by buf and query may overlap. The query buffer is
653 * parsed before buf is written to.
654 *
655 * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of
656 * the security confinement context and <KEY> is the name of the data to
657 * retrieve. <LABEL> and <KEY> must not be NUL-terminated.
658 *
659 * Don't expect the contents of buf to be preserved on failure.
660 *
661 * Returns: number of characters written to buf or -errno on failure
662 */
663static ssize_t query_data(char *buf, size_t buf_len,
664 char *query, size_t query_len)
665{
666 char *out;
667 const char *key;
668 struct label_it i;
669 struct aa_label *label, *curr;
670 struct aa_profile *profile;
671 struct aa_data *data;
672 u32 bytes, blocks;
673 __le32 outle32;
674
675 if (!query_len)
676 return -EINVAL; /* need a query */
677
678 key = query + strnlen(p: query, maxlen: query_len) + 1;
679 if (key + 1 >= query + query_len)
680 return -EINVAL; /* not enough space for a non-empty key */
681 if (key + strnlen(p: key, maxlen: query + query_len - key) >= query + query_len)
682 return -EINVAL; /* must end with NUL */
683
684 if (buf_len < sizeof(bytes) + sizeof(blocks))
685 return -EINVAL; /* not enough space */
686
687 curr = begin_current_label_crit_section();
688 label = aa_label_parse(base: curr, str: query, GFP_KERNEL, create: false, force_stack: false);
689 end_current_label_crit_section(label: curr);
690 if (IS_ERR(ptr: label))
691 return PTR_ERR(ptr: label);
692
693 /* We are going to leave space for two numbers. The first is the total
694 * number of bytes we are writing after the first number. This is so
695 * users can read the full output without reallocation.
696 *
697 * The second number is the number of data blocks we're writing. An
698 * application might be confined by multiple policies having data in
699 * the same key.
700 */
701 memset(buf, 0, sizeof(bytes) + sizeof(blocks));
702 out = buf + sizeof(bytes) + sizeof(blocks);
703
704 blocks = 0;
705 label_for_each_confined(i, label, profile) {
706 if (!profile->data)
707 continue;
708
709 data = rhashtable_lookup_fast(ht: profile->data, key: &key,
710 params: profile->data->p);
711
712 if (data) {
713 if (out + sizeof(outle32) + data->size > buf +
714 buf_len) {
715 aa_put_label(l: label);
716 return -EINVAL; /* not enough space */
717 }
718 outle32 = __cpu_to_le32(data->size);
719 memcpy(out, &outle32, sizeof(outle32));
720 out += sizeof(outle32);
721 memcpy(out, data->data, data->size);
722 out += data->size;
723 blocks++;
724 }
725 }
726 aa_put_label(l: label);
727
728 outle32 = __cpu_to_le32(out - buf - sizeof(bytes));
729 memcpy(buf, &outle32, sizeof(outle32));
730 outle32 = __cpu_to_le32(blocks);
731 memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32));
732
733 return out - buf;
734}
735
736/**
737 * query_label - queries a label and writes permissions to buf
738 * @buf: the resulting permissions string is stored here (NOT NULL)
739 * @buf_len: size of buf
740 * @query: binary query string to match against the dfa
741 * @query_len: size of query
742 * @view_only: only compute for querier's view
743 *
744 * The buffers pointed to by buf and query may overlap. The query buffer is
745 * parsed before buf is written to.
746 *
747 * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is
748 * the name of the label, in the current namespace, that is to be queried and
749 * DFA_STRING is a binary string to match against the label(s)'s DFA.
750 *
751 * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters
752 * but must *not* be NUL terminated.
753 *
754 * Returns: number of characters written to buf or -errno on failure
755 */
756static ssize_t query_label(char *buf, size_t buf_len,
757 char *query, size_t query_len, bool view_only)
758{
759 struct aa_profile *profile;
760 struct aa_label *label, *curr;
761 char *label_name, *match_str;
762 size_t label_name_len, match_len;
763 struct aa_perms perms;
764 struct label_it i;
765
766 if (!query_len)
767 return -EINVAL;
768
769 label_name = query;
770 label_name_len = strnlen(p: query, maxlen: query_len);
771 if (!label_name_len || label_name_len == query_len)
772 return -EINVAL;
773
774 /**
775 * The extra byte is to account for the null byte between the
776 * profile name and dfa string. profile_name_len is greater
777 * than zero and less than query_len, so a byte can be safely
778 * added or subtracted.
779 */
780 match_str = label_name + label_name_len + 1;
781 match_len = query_len - label_name_len - 1;
782
783 curr = begin_current_label_crit_section();
784 label = aa_label_parse(base: curr, str: label_name, GFP_KERNEL, create: false, force_stack: false);
785 end_current_label_crit_section(label: curr);
786 if (IS_ERR(ptr: label))
787 return PTR_ERR(ptr: label);
788
789 perms = allperms;
790 if (view_only) {
791 label_for_each_in_ns(i, labels_ns(label), label, profile) {
792 profile_query_cb(profile, perms: &perms, match_str, match_len);
793 }
794 } else {
795 label_for_each(i, label, profile) {
796 profile_query_cb(profile, perms: &perms, match_str, match_len);
797 }
798 }
799 aa_put_label(l: label);
800
801 return scnprintf(buf, size: buf_len,
802 fmt: "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n",
803 perms.allow, perms.deny, perms.audit, perms.quiet);
804}
805
806/*
807 * Transaction based IO.
808 * The file expects a write which triggers the transaction, and then
809 * possibly a read(s) which collects the result - which is stored in a
810 * file-local buffer. Once a new write is performed, a new set of results
811 * are stored in the file-local buffer.
812 */
813struct multi_transaction {
814 struct kref count;
815 ssize_t size;
816 char data[];
817};
818
819#define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction))
820
821static void multi_transaction_kref(struct kref *kref)
822{
823 struct multi_transaction *t;
824
825 t = container_of(kref, struct multi_transaction, count);
826 free_page((unsigned long) t);
827}
828
829static struct multi_transaction *
830get_multi_transaction(struct multi_transaction *t)
831{
832 if (t)
833 kref_get(kref: &(t->count));
834
835 return t;
836}
837
838static void put_multi_transaction(struct multi_transaction *t)
839{
840 if (t)
841 kref_put(kref: &(t->count), release: multi_transaction_kref);
842}
843
844/* does not increment @new's count */
845static void multi_transaction_set(struct file *file,
846 struct multi_transaction *new, size_t n)
847{
848 struct multi_transaction *old;
849
850 AA_BUG(n > MULTI_TRANSACTION_LIMIT);
851
852 new->size = n;
853 spin_lock(lock: &file->f_lock);
854 old = (struct multi_transaction *) file->private_data;
855 file->private_data = new;
856 spin_unlock(lock: &file->f_lock);
857 put_multi_transaction(t: old);
858}
859
860static struct multi_transaction *multi_transaction_new(struct file *file,
861 const char __user *buf,
862 size_t size)
863{
864 struct multi_transaction *t;
865
866 if (size > MULTI_TRANSACTION_LIMIT - 1)
867 return ERR_PTR(error: -EFBIG);
868
869 t = (struct multi_transaction *)get_zeroed_page(GFP_KERNEL);
870 if (!t)
871 return ERR_PTR(error: -ENOMEM);
872 kref_init(kref: &t->count);
873 if (copy_from_user(to: t->data, from: buf, n: size)) {
874 put_multi_transaction(t);
875 return ERR_PTR(error: -EFAULT);
876 }
877
878 return t;
879}
880
881static ssize_t multi_transaction_read(struct file *file, char __user *buf,
882 size_t size, loff_t *pos)
883{
884 struct multi_transaction *t;
885 ssize_t ret;
886
887 spin_lock(lock: &file->f_lock);
888 t = get_multi_transaction(t: file->private_data);
889 spin_unlock(lock: &file->f_lock);
890
891 if (!t)
892 return 0;
893
894 ret = simple_read_from_buffer(to: buf, count: size, ppos: pos, from: t->data, available: t->size);
895 put_multi_transaction(t);
896
897 return ret;
898}
899
900static int multi_transaction_release(struct inode *inode, struct file *file)
901{
902 put_multi_transaction(t: file->private_data);
903
904 return 0;
905}
906
907#define QUERY_CMD_LABEL "label\0"
908#define QUERY_CMD_LABEL_LEN 6
909#define QUERY_CMD_PROFILE "profile\0"
910#define QUERY_CMD_PROFILE_LEN 8
911#define QUERY_CMD_LABELALL "labelall\0"
912#define QUERY_CMD_LABELALL_LEN 9
913#define QUERY_CMD_DATA "data\0"
914#define QUERY_CMD_DATA_LEN 5
915
916/**
917 * aa_write_access - generic permissions and data query
918 * @file: pointer to open apparmorfs/access file
919 * @ubuf: user buffer containing the complete query string (NOT NULL)
920 * @count: size of ubuf
921 * @ppos: position in the file (MUST BE ZERO)
922 *
923 * Allows for one permissions or data query per open(), write(), and read()
924 * sequence. The only queries currently supported are label-based queries for
925 * permissions or data.
926 *
927 * For permissions queries, ubuf must begin with "label\0", followed by the
928 * profile query specific format described in the query_label() function
929 * documentation.
930 *
931 * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where
932 * <LABEL> is the name of the security confinement context and <KEY> is the
933 * name of the data to retrieve.
934 *
935 * Returns: number of bytes written or -errno on failure
936 */
937static ssize_t aa_write_access(struct file *file, const char __user *ubuf,
938 size_t count, loff_t *ppos)
939{
940 struct multi_transaction *t;
941 ssize_t len;
942
943 if (*ppos)
944 return -ESPIPE;
945
946 t = multi_transaction_new(file, buf: ubuf, size: count);
947 if (IS_ERR(ptr: t))
948 return PTR_ERR(ptr: t);
949
950 if (count > QUERY_CMD_PROFILE_LEN &&
951 !memcmp(p: t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) {
952 len = query_label(buf: t->data, MULTI_TRANSACTION_LIMIT,
953 query: t->data + QUERY_CMD_PROFILE_LEN,
954 query_len: count - QUERY_CMD_PROFILE_LEN, view_only: true);
955 } else if (count > QUERY_CMD_LABEL_LEN &&
956 !memcmp(p: t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) {
957 len = query_label(buf: t->data, MULTI_TRANSACTION_LIMIT,
958 query: t->data + QUERY_CMD_LABEL_LEN,
959 query_len: count - QUERY_CMD_LABEL_LEN, view_only: true);
960 } else if (count > QUERY_CMD_LABELALL_LEN &&
961 !memcmp(p: t->data, QUERY_CMD_LABELALL,
962 QUERY_CMD_LABELALL_LEN)) {
963 len = query_label(buf: t->data, MULTI_TRANSACTION_LIMIT,
964 query: t->data + QUERY_CMD_LABELALL_LEN,
965 query_len: count - QUERY_CMD_LABELALL_LEN, view_only: false);
966 } else if (count > QUERY_CMD_DATA_LEN &&
967 !memcmp(p: t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) {
968 len = query_data(buf: t->data, MULTI_TRANSACTION_LIMIT,
969 query: t->data + QUERY_CMD_DATA_LEN,
970 query_len: count - QUERY_CMD_DATA_LEN);
971 } else
972 len = -EINVAL;
973
974 if (len < 0) {
975 put_multi_transaction(t);
976 return len;
977 }
978
979 multi_transaction_set(file, new: t, n: len);
980
981 return count;
982}
983
984static const struct file_operations aa_sfs_access = {
985 .write = aa_write_access,
986 .read = multi_transaction_read,
987 .release = multi_transaction_release,
988 .llseek = generic_file_llseek,
989};
990
991static int aa_sfs_seq_show(struct seq_file *seq, void *v)
992{
993 struct aa_sfs_entry *fs_file = seq->private;
994
995 if (!fs_file)
996 return 0;
997
998 switch (fs_file->v_type) {
999 case AA_SFS_TYPE_BOOLEAN:
1000 seq_printf(m: seq, fmt: "%s\n", fs_file->v.boolean ? "yes" : "no");
1001 break;
1002 case AA_SFS_TYPE_STRING:
1003 seq_printf(m: seq, fmt: "%s\n", fs_file->v.string);
1004 break;
1005 case AA_SFS_TYPE_U64:
1006 seq_printf(m: seq, fmt: "%#08lx\n", fs_file->v.u64);
1007 break;
1008 default:
1009 /* Ignore unpritable entry types. */
1010 break;
1011 }
1012
1013 return 0;
1014}
1015
1016static int aa_sfs_seq_open(struct inode *inode, struct file *file)
1017{
1018 return single_open(file, aa_sfs_seq_show, inode->i_private);
1019}
1020
1021const struct file_operations aa_sfs_seq_file_ops = {
1022 .owner = THIS_MODULE,
1023 .open = aa_sfs_seq_open,
1024 .read = seq_read,
1025 .llseek = seq_lseek,
1026 .release = single_release,
1027};
1028
1029/*
1030 * profile based file operations
1031 * policy/profiles/XXXX/profiles/ *
1032 */
1033
1034#define SEQ_PROFILE_FOPS(NAME) \
1035static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\
1036{ \
1037 return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show); \
1038} \
1039 \
1040static const struct file_operations seq_profile_ ##NAME ##_fops = { \
1041 .owner = THIS_MODULE, \
1042 .open = seq_profile_ ##NAME ##_open, \
1043 .read = seq_read, \
1044 .llseek = seq_lseek, \
1045 .release = seq_profile_release, \
1046} \
1047
1048static int seq_profile_open(struct inode *inode, struct file *file,
1049 int (*show)(struct seq_file *, void *))
1050{
1051 struct aa_proxy *proxy = aa_get_proxy(proxy: inode->i_private);
1052 int error = single_open(file, show, proxy);
1053
1054 if (error) {
1055 file->private_data = NULL;
1056 aa_put_proxy(proxy);
1057 }
1058
1059 return error;
1060}
1061
1062static int seq_profile_release(struct inode *inode, struct file *file)
1063{
1064 struct seq_file *seq = (struct seq_file *) file->private_data;
1065 if (seq)
1066 aa_put_proxy(proxy: seq->private);
1067 return single_release(inode, file);
1068}
1069
1070static int seq_profile_name_show(struct seq_file *seq, void *v)
1071{
1072 struct aa_proxy *proxy = seq->private;
1073 struct aa_label *label = aa_get_label_rcu(l: &proxy->label);
1074 struct aa_profile *profile = labels_profile(label);
1075 seq_printf(m: seq, fmt: "%s\n", profile->base.name);
1076 aa_put_label(l: label);
1077
1078 return 0;
1079}
1080
1081static int seq_profile_mode_show(struct seq_file *seq, void *v)
1082{
1083 struct aa_proxy *proxy = seq->private;
1084 struct aa_label *label = aa_get_label_rcu(l: &proxy->label);
1085 struct aa_profile *profile = labels_profile(label);
1086 seq_printf(m: seq, fmt: "%s\n", aa_profile_mode_names[profile->mode]);
1087 aa_put_label(l: label);
1088
1089 return 0;
1090}
1091
1092static int seq_profile_attach_show(struct seq_file *seq, void *v)
1093{
1094 struct aa_proxy *proxy = seq->private;
1095 struct aa_label *label = aa_get_label_rcu(l: &proxy->label);
1096 struct aa_profile *profile = labels_profile(label);
1097 if (profile->attach.xmatch_str)
1098 seq_printf(m: seq, fmt: "%s\n", profile->attach.xmatch_str);
1099 else if (profile->attach.xmatch->dfa)
1100 seq_puts(m: seq, s: "<unknown>\n");
1101 else
1102 seq_printf(m: seq, fmt: "%s\n", profile->base.name);
1103 aa_put_label(l: label);
1104
1105 return 0;
1106}
1107
1108static int seq_profile_hash_show(struct seq_file *seq, void *v)
1109{
1110 struct aa_proxy *proxy = seq->private;
1111 struct aa_label *label = aa_get_label_rcu(l: &proxy->label);
1112 struct aa_profile *profile = labels_profile(label);
1113 unsigned int i, size = aa_hash_size();
1114
1115 if (profile->hash) {
1116 for (i = 0; i < size; i++)
1117 seq_printf(m: seq, fmt: "%.2x", profile->hash[i]);
1118 seq_putc(m: seq, c: '\n');
1119 }
1120 aa_put_label(l: label);
1121
1122 return 0;
1123}
1124
1125SEQ_PROFILE_FOPS(name);
1126SEQ_PROFILE_FOPS(mode);
1127SEQ_PROFILE_FOPS(attach);
1128SEQ_PROFILE_FOPS(hash);
1129
1130/*
1131 * namespace based files
1132 * several root files and
1133 * policy/ *
1134 */
1135
1136#define SEQ_NS_FOPS(NAME) \
1137static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file) \
1138{ \
1139 return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private); \
1140} \
1141 \
1142static const struct file_operations seq_ns_ ##NAME ##_fops = { \
1143 .owner = THIS_MODULE, \
1144 .open = seq_ns_ ##NAME ##_open, \
1145 .read = seq_read, \
1146 .llseek = seq_lseek, \
1147 .release = single_release, \
1148} \
1149
1150static int seq_ns_stacked_show(struct seq_file *seq, void *v)
1151{
1152 struct aa_label *label;
1153
1154 label = begin_current_label_crit_section();
1155 seq_printf(m: seq, fmt: "%s\n", label->size > 1 ? "yes" : "no");
1156 end_current_label_crit_section(label);
1157
1158 return 0;
1159}
1160
1161static int seq_ns_nsstacked_show(struct seq_file *seq, void *v)
1162{
1163 struct aa_label *label;
1164 struct aa_profile *profile;
1165 struct label_it it;
1166 int count = 1;
1167
1168 label = begin_current_label_crit_section();
1169
1170 if (label->size > 1) {
1171 label_for_each(it, label, profile)
1172 if (profile->ns != labels_ns(label)) {
1173 count++;
1174 break;
1175 }
1176 }
1177
1178 seq_printf(m: seq, fmt: "%s\n", count > 1 ? "yes" : "no");
1179 end_current_label_crit_section(label);
1180
1181 return 0;
1182}
1183
1184static int seq_ns_level_show(struct seq_file *seq, void *v)
1185{
1186 struct aa_label *label;
1187
1188 label = begin_current_label_crit_section();
1189 seq_printf(m: seq, fmt: "%d\n", labels_ns(label)->level);
1190 end_current_label_crit_section(label);
1191
1192 return 0;
1193}
1194
1195static int seq_ns_name_show(struct seq_file *seq, void *v)
1196{
1197 struct aa_label *label = begin_current_label_crit_section();
1198 seq_printf(m: seq, fmt: "%s\n", labels_ns(label)->base.name);
1199 end_current_label_crit_section(label);
1200
1201 return 0;
1202}
1203
1204static int seq_ns_compress_min_show(struct seq_file *seq, void *v)
1205{
1206 seq_printf(m: seq, fmt: "%d\n", AA_MIN_CLEVEL);
1207 return 0;
1208}
1209
1210static int seq_ns_compress_max_show(struct seq_file *seq, void *v)
1211{
1212 seq_printf(m: seq, fmt: "%d\n", AA_MAX_CLEVEL);
1213 return 0;
1214}
1215
1216SEQ_NS_FOPS(stacked);
1217SEQ_NS_FOPS(nsstacked);
1218SEQ_NS_FOPS(level);
1219SEQ_NS_FOPS(name);
1220SEQ_NS_FOPS(compress_min);
1221SEQ_NS_FOPS(compress_max);
1222
1223
1224/* policy/raw_data/ * file ops */
1225#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1226#define SEQ_RAWDATA_FOPS(NAME) \
1227static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\
1228{ \
1229 return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show); \
1230} \
1231 \
1232static const struct file_operations seq_rawdata_ ##NAME ##_fops = { \
1233 .owner = THIS_MODULE, \
1234 .open = seq_rawdata_ ##NAME ##_open, \
1235 .read = seq_read, \
1236 .llseek = seq_lseek, \
1237 .release = seq_rawdata_release, \
1238} \
1239
1240static int seq_rawdata_open(struct inode *inode, struct file *file,
1241 int (*show)(struct seq_file *, void *))
1242{
1243 struct aa_loaddata *data = __aa_get_loaddata(data: inode->i_private);
1244 int error;
1245
1246 if (!data)
1247 /* lost race this ent is being reaped */
1248 return -ENOENT;
1249
1250 error = single_open(file, show, data);
1251 if (error) {
1252 AA_BUG(file->private_data &&
1253 ((struct seq_file *)file->private_data)->private);
1254 aa_put_loaddata(data);
1255 }
1256
1257 return error;
1258}
1259
1260static int seq_rawdata_release(struct inode *inode, struct file *file)
1261{
1262 struct seq_file *seq = (struct seq_file *) file->private_data;
1263
1264 if (seq)
1265 aa_put_loaddata(data: seq->private);
1266
1267 return single_release(inode, file);
1268}
1269
1270static int seq_rawdata_abi_show(struct seq_file *seq, void *v)
1271{
1272 struct aa_loaddata *data = seq->private;
1273
1274 seq_printf(m: seq, fmt: "v%d\n", data->abi);
1275
1276 return 0;
1277}
1278
1279static int seq_rawdata_revision_show(struct seq_file *seq, void *v)
1280{
1281 struct aa_loaddata *data = seq->private;
1282
1283 seq_printf(m: seq, fmt: "%ld\n", data->revision);
1284
1285 return 0;
1286}
1287
1288static int seq_rawdata_hash_show(struct seq_file *seq, void *v)
1289{
1290 struct aa_loaddata *data = seq->private;
1291 unsigned int i, size = aa_hash_size();
1292
1293 if (data->hash) {
1294 for (i = 0; i < size; i++)
1295 seq_printf(m: seq, fmt: "%.2x", data->hash[i]);
1296 seq_putc(m: seq, c: '\n');
1297 }
1298
1299 return 0;
1300}
1301
1302static int seq_rawdata_compressed_size_show(struct seq_file *seq, void *v)
1303{
1304 struct aa_loaddata *data = seq->private;
1305
1306 seq_printf(m: seq, fmt: "%zu\n", data->compressed_size);
1307
1308 return 0;
1309}
1310
1311SEQ_RAWDATA_FOPS(abi);
1312SEQ_RAWDATA_FOPS(revision);
1313SEQ_RAWDATA_FOPS(hash);
1314SEQ_RAWDATA_FOPS(compressed_size);
1315
1316static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen)
1317{
1318 if (slen < dlen) {
1319 const size_t wksp_len = zstd_dctx_workspace_bound();
1320 zstd_dctx *ctx;
1321 void *wksp;
1322 size_t out_len;
1323 int ret = 0;
1324
1325 wksp = kvzalloc(size: wksp_len, GFP_KERNEL);
1326 if (!wksp) {
1327 ret = -ENOMEM;
1328 goto cleanup;
1329 }
1330 ctx = zstd_init_dctx(workspace: wksp, workspace_size: wksp_len);
1331 if (ctx == NULL) {
1332 ret = -ENOMEM;
1333 goto cleanup;
1334 }
1335 out_len = zstd_decompress_dctx(dctx: ctx, dst, dst_capacity: dlen, src, src_size: slen);
1336 if (zstd_is_error(code: out_len)) {
1337 ret = -EINVAL;
1338 goto cleanup;
1339 }
1340cleanup:
1341 kvfree(addr: wksp);
1342 return ret;
1343 }
1344
1345 if (dlen < slen)
1346 return -EINVAL;
1347 memcpy(dst, src, slen);
1348 return 0;
1349}
1350
1351static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
1352 loff_t *ppos)
1353{
1354 struct rawdata_f_data *private = file->private_data;
1355
1356 return simple_read_from_buffer(to: buf, count: size, ppos,
1357 RAWDATA_F_DATA_BUF(private),
1358 available: private->loaddata->size);
1359}
1360
1361static int rawdata_release(struct inode *inode, struct file *file)
1362{
1363 rawdata_f_data_free(private: file->private_data);
1364
1365 return 0;
1366}
1367
1368static int rawdata_open(struct inode *inode, struct file *file)
1369{
1370 int error;
1371 struct aa_loaddata *loaddata;
1372 struct rawdata_f_data *private;
1373
1374 if (!aa_current_policy_view_capable(NULL))
1375 return -EACCES;
1376
1377 loaddata = __aa_get_loaddata(data: inode->i_private);
1378 if (!loaddata)
1379 /* lost race: this entry is being reaped */
1380 return -ENOENT;
1381
1382 private = rawdata_f_data_alloc(size: loaddata->size);
1383 if (IS_ERR(ptr: private)) {
1384 error = PTR_ERR(ptr: private);
1385 goto fail_private_alloc;
1386 }
1387
1388 private->loaddata = loaddata;
1389
1390 error = decompress_zstd(src: loaddata->data, slen: loaddata->compressed_size,
1391 RAWDATA_F_DATA_BUF(private),
1392 dlen: loaddata->size);
1393 if (error)
1394 goto fail_decompress;
1395
1396 file->private_data = private;
1397 return 0;
1398
1399fail_decompress:
1400 rawdata_f_data_free(private);
1401 return error;
1402
1403fail_private_alloc:
1404 aa_put_loaddata(data: loaddata);
1405 return error;
1406}
1407
1408static const struct file_operations rawdata_fops = {
1409 .open = rawdata_open,
1410 .read = rawdata_read,
1411 .llseek = generic_file_llseek,
1412 .release = rawdata_release,
1413};
1414
1415static void remove_rawdata_dents(struct aa_loaddata *rawdata)
1416{
1417 int i;
1418
1419 for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
1420 if (!IS_ERR_OR_NULL(ptr: rawdata->dents[i])) {
1421 /* no refcounts on i_private */
1422 aafs_remove(dentry: rawdata->dents[i]);
1423 rawdata->dents[i] = NULL;
1424 }
1425 }
1426}
1427
1428void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata)
1429{
1430 AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock));
1431
1432 if (rawdata->ns) {
1433 remove_rawdata_dents(rawdata);
1434 list_del_init(entry: &rawdata->list);
1435 aa_put_ns(ns: rawdata->ns);
1436 rawdata->ns = NULL;
1437 }
1438}
1439
1440int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
1441{
1442 struct dentry *dent, *dir;
1443
1444 AA_BUG(!ns);
1445 AA_BUG(!rawdata);
1446 AA_BUG(!mutex_is_locked(&ns->lock));
1447 AA_BUG(!ns_subdata_dir(ns));
1448
1449 /*
1450 * just use ns revision dir was originally created at. This is
1451 * under ns->lock and if load is successful revision will be
1452 * bumped and is guaranteed to be unique
1453 */
1454 rawdata->name = kasprintf(GFP_KERNEL, fmt: "%ld", ns->revision);
1455 if (!rawdata->name)
1456 return -ENOMEM;
1457
1458 dir = aafs_create_dir(name: rawdata->name, ns_subdata_dir(ns));
1459 if (IS_ERR(ptr: dir))
1460 /* ->name freed when rawdata freed */
1461 return PTR_ERR(ptr: dir);
1462 rawdata->dents[AAFS_LOADDATA_DIR] = dir;
1463
1464 dent = aafs_create_file(name: "abi", S_IFREG | 0444, parent: dir, data: rawdata,
1465 fops: &seq_rawdata_abi_fops);
1466 if (IS_ERR(ptr: dent))
1467 goto fail;
1468 rawdata->dents[AAFS_LOADDATA_ABI] = dent;
1469
1470 dent = aafs_create_file(name: "revision", S_IFREG | 0444, parent: dir, data: rawdata,
1471 fops: &seq_rawdata_revision_fops);
1472 if (IS_ERR(ptr: dent))
1473 goto fail;
1474 rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
1475
1476 if (aa_g_hash_policy) {
1477 dent = aafs_create_file(name: "sha1", S_IFREG | 0444, parent: dir,
1478 data: rawdata, fops: &seq_rawdata_hash_fops);
1479 if (IS_ERR(ptr: dent))
1480 goto fail;
1481 rawdata->dents[AAFS_LOADDATA_HASH] = dent;
1482 }
1483
1484 dent = aafs_create_file(name: "compressed_size", S_IFREG | 0444, parent: dir,
1485 data: rawdata,
1486 fops: &seq_rawdata_compressed_size_fops);
1487 if (IS_ERR(ptr: dent))
1488 goto fail;
1489 rawdata->dents[AAFS_LOADDATA_COMPRESSED_SIZE] = dent;
1490
1491 dent = aafs_create_file(name: "raw_data", S_IFREG | 0444,
1492 parent: dir, data: rawdata, fops: &rawdata_fops);
1493 if (IS_ERR(ptr: dent))
1494 goto fail;
1495 rawdata->dents[AAFS_LOADDATA_DATA] = dent;
1496 d_inode(dentry: dent)->i_size = rawdata->size;
1497
1498 rawdata->ns = aa_get_ns(ns);
1499 list_add(new: &rawdata->list, head: &ns->rawdata_list);
1500 /* no refcount on inode rawdata */
1501
1502 return 0;
1503
1504fail:
1505 remove_rawdata_dents(rawdata);
1506
1507 return PTR_ERR(ptr: dent);
1508}
1509#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
1510
1511
1512/** fns to setup dynamic per profile/namespace files **/
1513
1514/*
1515 *
1516 * Requires: @profile->ns->lock held
1517 */
1518void __aafs_profile_rmdir(struct aa_profile *profile)
1519{
1520 struct aa_profile *child;
1521 int i;
1522
1523 if (!profile)
1524 return;
1525
1526 list_for_each_entry(child, &profile->base.profiles, base.list)
1527 __aafs_profile_rmdir(profile: child);
1528
1529 for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
1530 struct aa_proxy *proxy;
1531 if (!profile->dents[i])
1532 continue;
1533
1534 proxy = d_inode(dentry: profile->dents[i])->i_private;
1535 aafs_remove(dentry: profile->dents[i]);
1536 aa_put_proxy(proxy);
1537 profile->dents[i] = NULL;
1538 }
1539}
1540
1541/*
1542 *
1543 * Requires: @old->ns->lock held
1544 */
1545void __aafs_profile_migrate_dents(struct aa_profile *old,
1546 struct aa_profile *new)
1547{
1548 int i;
1549
1550 AA_BUG(!old);
1551 AA_BUG(!new);
1552 AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
1553
1554 for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
1555 new->dents[i] = old->dents[i];
1556 if (new->dents[i]) {
1557 struct inode *inode = d_inode(dentry: new->dents[i]);
1558
1559 inode_set_mtime_to_ts(inode,
1560 ts: inode_set_ctime_current(inode));
1561 }
1562 old->dents[i] = NULL;
1563 }
1564}
1565
1566static struct dentry *create_profile_file(struct dentry *dir, const char *name,
1567 struct aa_profile *profile,
1568 const struct file_operations *fops)
1569{
1570 struct aa_proxy *proxy = aa_get_proxy(proxy: profile->label.proxy);
1571 struct dentry *dent;
1572
1573 dent = aafs_create_file(name, S_IFREG | 0444, parent: dir, data: proxy, fops);
1574 if (IS_ERR(ptr: dent))
1575 aa_put_proxy(proxy);
1576
1577 return dent;
1578}
1579
1580#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1581static int profile_depth(struct aa_profile *profile)
1582{
1583 int depth = 0;
1584
1585 rcu_read_lock();
1586 for (depth = 0; profile; profile = rcu_access_pointer(profile->parent))
1587 depth++;
1588 rcu_read_unlock();
1589
1590 return depth;
1591}
1592
1593static char *gen_symlink_name(int depth, const char *dirname, const char *fname)
1594{
1595 char *buffer, *s;
1596 int error;
1597 int size = depth * 6 + strlen(dirname) + strlen(fname) + 11;
1598
1599 s = buffer = kmalloc(size, GFP_KERNEL);
1600 if (!buffer)
1601 return ERR_PTR(error: -ENOMEM);
1602
1603 for (; depth > 0; depth--) {
1604 strcpy(p: s, q: "../../");
1605 s += 6;
1606 size -= 6;
1607 }
1608
1609 error = snprintf(buf: s, size, fmt: "raw_data/%s/%s", dirname, fname);
1610 if (error >= size || error < 0) {
1611 kfree(objp: buffer);
1612 return ERR_PTR(error: -ENAMETOOLONG);
1613 }
1614
1615 return buffer;
1616}
1617
1618static void rawdata_link_cb(void *arg)
1619{
1620 kfree(objp: arg);
1621}
1622
1623static const char *rawdata_get_link_base(struct dentry *dentry,
1624 struct inode *inode,
1625 struct delayed_call *done,
1626 const char *name)
1627{
1628 struct aa_proxy *proxy = inode->i_private;
1629 struct aa_label *label;
1630 struct aa_profile *profile;
1631 char *target;
1632 int depth;
1633
1634 if (!dentry)
1635 return ERR_PTR(error: -ECHILD);
1636
1637 label = aa_get_label_rcu(l: &proxy->label);
1638 profile = labels_profile(label);
1639 depth = profile_depth(profile);
1640 target = gen_symlink_name(depth, dirname: profile->rawdata->name, fname: name);
1641 aa_put_label(l: label);
1642
1643 if (IS_ERR(ptr: target))
1644 return target;
1645
1646 set_delayed_call(call: done, fn: rawdata_link_cb, arg: target);
1647
1648 return target;
1649}
1650
1651static const char *rawdata_get_link_sha1(struct dentry *dentry,
1652 struct inode *inode,
1653 struct delayed_call *done)
1654{
1655 return rawdata_get_link_base(dentry, inode, done, name: "sha1");
1656}
1657
1658static const char *rawdata_get_link_abi(struct dentry *dentry,
1659 struct inode *inode,
1660 struct delayed_call *done)
1661{
1662 return rawdata_get_link_base(dentry, inode, done, name: "abi");
1663}
1664
1665static const char *rawdata_get_link_data(struct dentry *dentry,
1666 struct inode *inode,
1667 struct delayed_call *done)
1668{
1669 return rawdata_get_link_base(dentry, inode, done, name: "raw_data");
1670}
1671
1672static const struct inode_operations rawdata_link_sha1_iops = {
1673 .get_link = rawdata_get_link_sha1,
1674};
1675
1676static const struct inode_operations rawdata_link_abi_iops = {
1677 .get_link = rawdata_get_link_abi,
1678};
1679static const struct inode_operations rawdata_link_data_iops = {
1680 .get_link = rawdata_get_link_data,
1681};
1682#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
1683
1684/*
1685 * Requires: @profile->ns->lock held
1686 */
1687int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
1688{
1689 struct aa_profile *child;
1690 struct dentry *dent = NULL, *dir;
1691 int error;
1692
1693 AA_BUG(!profile);
1694 AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
1695
1696 if (!parent) {
1697 struct aa_profile *p;
1698 p = aa_deref_parent(p: profile);
1699 dent = prof_dir(p);
1700 /* adding to parent that previously didn't have children */
1701 dent = aafs_create_dir(name: "profiles", parent: dent);
1702 if (IS_ERR(ptr: dent))
1703 goto fail;
1704 prof_child_dir(p) = parent = dent;
1705 }
1706
1707 if (!profile->dirname) {
1708 int len, id_len;
1709 len = mangle_name(name: profile->base.name, NULL);
1710 id_len = snprintf(NULL, size: 0, fmt: ".%ld", profile->ns->uniq_id);
1711
1712 profile->dirname = kmalloc(size: len + id_len + 1, GFP_KERNEL);
1713 if (!profile->dirname) {
1714 error = -ENOMEM;
1715 goto fail2;
1716 }
1717
1718 mangle_name(name: profile->base.name, target: profile->dirname);
1719 sprintf(buf: profile->dirname + len, fmt: ".%ld", profile->ns->uniq_id++);
1720 }
1721
1722 dent = aafs_create_dir(name: profile->dirname, parent);
1723 if (IS_ERR(ptr: dent))
1724 goto fail;
1725 prof_dir(profile) = dir = dent;
1726
1727 dent = create_profile_file(dir, name: "name", profile,
1728 fops: &seq_profile_name_fops);
1729 if (IS_ERR(ptr: dent))
1730 goto fail;
1731 profile->dents[AAFS_PROF_NAME] = dent;
1732
1733 dent = create_profile_file(dir, name: "mode", profile,
1734 fops: &seq_profile_mode_fops);
1735 if (IS_ERR(ptr: dent))
1736 goto fail;
1737 profile->dents[AAFS_PROF_MODE] = dent;
1738
1739 dent = create_profile_file(dir, name: "attach", profile,
1740 fops: &seq_profile_attach_fops);
1741 if (IS_ERR(ptr: dent))
1742 goto fail;
1743 profile->dents[AAFS_PROF_ATTACH] = dent;
1744
1745 if (profile->hash) {
1746 dent = create_profile_file(dir, name: "sha1", profile,
1747 fops: &seq_profile_hash_fops);
1748 if (IS_ERR(ptr: dent))
1749 goto fail;
1750 profile->dents[AAFS_PROF_HASH] = dent;
1751 }
1752
1753#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1754 if (profile->rawdata) {
1755 if (aa_g_hash_policy) {
1756 dent = aafs_create(name: "raw_sha1", S_IFLNK | 0444, parent: dir,
1757 data: profile->label.proxy, NULL, NULL,
1758 iops: &rawdata_link_sha1_iops);
1759 if (IS_ERR(ptr: dent))
1760 goto fail;
1761 aa_get_proxy(proxy: profile->label.proxy);
1762 profile->dents[AAFS_PROF_RAW_HASH] = dent;
1763 }
1764 dent = aafs_create(name: "raw_abi", S_IFLNK | 0444, parent: dir,
1765 data: profile->label.proxy, NULL, NULL,
1766 iops: &rawdata_link_abi_iops);
1767 if (IS_ERR(ptr: dent))
1768 goto fail;
1769 aa_get_proxy(proxy: profile->label.proxy);
1770 profile->dents[AAFS_PROF_RAW_ABI] = dent;
1771
1772 dent = aafs_create(name: "raw_data", S_IFLNK | 0444, parent: dir,
1773 data: profile->label.proxy, NULL, NULL,
1774 iops: &rawdata_link_data_iops);
1775 if (IS_ERR(ptr: dent))
1776 goto fail;
1777 aa_get_proxy(proxy: profile->label.proxy);
1778 profile->dents[AAFS_PROF_RAW_DATA] = dent;
1779 }
1780#endif /*CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
1781
1782 list_for_each_entry(child, &profile->base.profiles, base.list) {
1783 error = __aafs_profile_mkdir(profile: child, prof_child_dir(profile));
1784 if (error)
1785 goto fail2;
1786 }
1787
1788 return 0;
1789
1790fail:
1791 error = PTR_ERR(ptr: dent);
1792
1793fail2:
1794 __aafs_profile_rmdir(profile);
1795
1796 return error;
1797}
1798
1799static int ns_mkdir_op(struct mnt_idmap *idmap, struct inode *dir,
1800 struct dentry *dentry, umode_t mode)
1801{
1802 struct aa_ns *ns, *parent;
1803 /* TODO: improve permission check */
1804 struct aa_label *label;
1805 int error;
1806
1807 label = begin_current_label_crit_section();
1808 error = aa_may_manage_policy(current_cred(), label, NULL,
1809 AA_MAY_LOAD_POLICY);
1810 end_current_label_crit_section(label);
1811 if (error)
1812 return error;
1813
1814 parent = aa_get_ns(ns: dir->i_private);
1815 AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
1816
1817 /* we have to unlock and then relock to get locking order right
1818 * for pin_fs
1819 */
1820 inode_unlock(inode: dir);
1821 error = simple_pin_fs(&aafs_ops, mount: &aafs_mnt, count: &aafs_count);
1822 mutex_lock_nested(lock: &parent->lock, subclass: parent->level);
1823 inode_lock_nested(inode: dir, subclass: I_MUTEX_PARENT);
1824 if (error)
1825 goto out;
1826
1827 error = __aafs_setup_d_inode(dir, dentry, mode: mode | S_IFDIR, NULL,
1828 NULL, NULL, NULL);
1829 if (error)
1830 goto out_pin;
1831
1832 ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name),
1833 dir: dentry);
1834 if (IS_ERR(ptr: ns)) {
1835 error = PTR_ERR(ptr: ns);
1836 ns = NULL;
1837 }
1838
1839 aa_put_ns(ns); /* list ref remains */
1840out_pin:
1841 if (error)
1842 simple_release_fs(mount: &aafs_mnt, count: &aafs_count);
1843out:
1844 mutex_unlock(lock: &parent->lock);
1845 aa_put_ns(ns: parent);
1846
1847 return error;
1848}
1849
1850static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
1851{
1852 struct aa_ns *ns, *parent;
1853 /* TODO: improve permission check */
1854 struct aa_label *label;
1855 int error;
1856
1857 label = begin_current_label_crit_section();
1858 error = aa_may_manage_policy(current_cred(), label, NULL,
1859 AA_MAY_LOAD_POLICY);
1860 end_current_label_crit_section(label);
1861 if (error)
1862 return error;
1863
1864 parent = aa_get_ns(ns: dir->i_private);
1865 /* rmdir calls the generic securityfs functions to remove files
1866 * from the apparmor dir. It is up to the apparmor ns locking
1867 * to avoid races.
1868 */
1869 inode_unlock(inode: dir);
1870 inode_unlock(inode: dentry->d_inode);
1871
1872 mutex_lock_nested(lock: &parent->lock, subclass: parent->level);
1873 ns = aa_get_ns(ns: __aa_findn_ns(head: &parent->sub_ns, name: dentry->d_name.name,
1874 n: dentry->d_name.len));
1875 if (!ns) {
1876 error = -ENOENT;
1877 goto out;
1878 }
1879 AA_BUG(ns_dir(ns) != dentry);
1880
1881 __aa_remove_ns(ns);
1882 aa_put_ns(ns);
1883
1884out:
1885 mutex_unlock(lock: &parent->lock);
1886 inode_lock_nested(inode: dir, subclass: I_MUTEX_PARENT);
1887 inode_lock(inode: dentry->d_inode);
1888 aa_put_ns(ns: parent);
1889
1890 return error;
1891}
1892
1893static const struct inode_operations ns_dir_inode_operations = {
1894 .lookup = simple_lookup,
1895 .mkdir = ns_mkdir_op,
1896 .rmdir = ns_rmdir_op,
1897};
1898
1899static void __aa_fs_list_remove_rawdata(struct aa_ns *ns)
1900{
1901 struct aa_loaddata *ent, *tmp;
1902
1903 AA_BUG(!mutex_is_locked(&ns->lock));
1904
1905 list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list)
1906 __aa_fs_remove_rawdata(rawdata: ent);
1907}
1908
1909/*
1910 *
1911 * Requires: @ns->lock held
1912 */
1913void __aafs_ns_rmdir(struct aa_ns *ns)
1914{
1915 struct aa_ns *sub;
1916 struct aa_profile *child;
1917 int i;
1918
1919 if (!ns)
1920 return;
1921 AA_BUG(!mutex_is_locked(&ns->lock));
1922
1923 list_for_each_entry(child, &ns->base.profiles, base.list)
1924 __aafs_profile_rmdir(profile: child);
1925
1926 list_for_each_entry(sub, &ns->sub_ns, base.list) {
1927 mutex_lock_nested(lock: &sub->lock, subclass: sub->level);
1928 __aafs_ns_rmdir(ns: sub);
1929 mutex_unlock(lock: &sub->lock);
1930 }
1931
1932 __aa_fs_list_remove_rawdata(ns);
1933
1934 if (ns_subns_dir(ns)) {
1935 sub = d_inode(ns_subns_dir(ns))->i_private;
1936 aa_put_ns(ns: sub);
1937 }
1938 if (ns_subload(ns)) {
1939 sub = d_inode(ns_subload(ns))->i_private;
1940 aa_put_ns(ns: sub);
1941 }
1942 if (ns_subreplace(ns)) {
1943 sub = d_inode(ns_subreplace(ns))->i_private;
1944 aa_put_ns(ns: sub);
1945 }
1946 if (ns_subremove(ns)) {
1947 sub = d_inode(ns_subremove(ns))->i_private;
1948 aa_put_ns(ns: sub);
1949 }
1950 if (ns_subrevision(ns)) {
1951 sub = d_inode(ns_subrevision(ns))->i_private;
1952 aa_put_ns(ns: sub);
1953 }
1954
1955 for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
1956 aafs_remove(dentry: ns->dents[i]);
1957 ns->dents[i] = NULL;
1958 }
1959}
1960
1961/* assumes cleanup in caller */
1962static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
1963{
1964 struct dentry *dent;
1965
1966 AA_BUG(!ns);
1967 AA_BUG(!dir);
1968
1969 dent = aafs_create_dir(name: "profiles", parent: dir);
1970 if (IS_ERR(ptr: dent))
1971 return PTR_ERR(ptr: dent);
1972 ns_subprofs_dir(ns) = dent;
1973
1974 dent = aafs_create_dir(name: "raw_data", parent: dir);
1975 if (IS_ERR(ptr: dent))
1976 return PTR_ERR(ptr: dent);
1977 ns_subdata_dir(ns) = dent;
1978
1979 dent = aafs_create_file(name: "revision", mode: 0444, parent: dir, data: ns,
1980 fops: &aa_fs_ns_revision_fops);
1981 if (IS_ERR(ptr: dent))
1982 return PTR_ERR(ptr: dent);
1983 aa_get_ns(ns);
1984 ns_subrevision(ns) = dent;
1985
1986 dent = aafs_create_file(name: ".load", mode: 0640, parent: dir, data: ns,
1987 fops: &aa_fs_profile_load);
1988 if (IS_ERR(ptr: dent))
1989 return PTR_ERR(ptr: dent);
1990 aa_get_ns(ns);
1991 ns_subload(ns) = dent;
1992
1993 dent = aafs_create_file(name: ".replace", mode: 0640, parent: dir, data: ns,
1994 fops: &aa_fs_profile_replace);
1995 if (IS_ERR(ptr: dent))
1996 return PTR_ERR(ptr: dent);
1997 aa_get_ns(ns);
1998 ns_subreplace(ns) = dent;
1999
2000 dent = aafs_create_file(name: ".remove", mode: 0640, parent: dir, data: ns,
2001 fops: &aa_fs_profile_remove);
2002 if (IS_ERR(ptr: dent))
2003 return PTR_ERR(ptr: dent);
2004 aa_get_ns(ns);
2005 ns_subremove(ns) = dent;
2006
2007 /* use create_dentry so we can supply private data */
2008 dent = aafs_create(name: "namespaces", S_IFDIR | 0755, parent: dir, data: ns, NULL, NULL,
2009 iops: &ns_dir_inode_operations);
2010 if (IS_ERR(ptr: dent))
2011 return PTR_ERR(ptr: dent);
2012 aa_get_ns(ns);
2013 ns_subns_dir(ns) = dent;
2014
2015 return 0;
2016}
2017
2018/*
2019 * Requires: @ns->lock held
2020 */
2021int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
2022 struct dentry *dent)
2023{
2024 struct aa_ns *sub;
2025 struct aa_profile *child;
2026 struct dentry *dir;
2027 int error;
2028
2029 AA_BUG(!ns);
2030 AA_BUG(!parent);
2031 AA_BUG(!mutex_is_locked(&ns->lock));
2032
2033 if (!name)
2034 name = ns->base.name;
2035
2036 if (!dent) {
2037 /* create ns dir if it doesn't already exist */
2038 dent = aafs_create_dir(name, parent);
2039 if (IS_ERR(ptr: dent))
2040 goto fail;
2041 } else
2042 dget(dentry: dent);
2043 ns_dir(ns) = dir = dent;
2044 error = __aafs_ns_mkdir_entries(ns, dir);
2045 if (error)
2046 goto fail2;
2047
2048 /* profiles */
2049 list_for_each_entry(child, &ns->base.profiles, base.list) {
2050 error = __aafs_profile_mkdir(profile: child, ns_subprofs_dir(ns));
2051 if (error)
2052 goto fail2;
2053 }
2054
2055 /* subnamespaces */
2056 list_for_each_entry(sub, &ns->sub_ns, base.list) {
2057 mutex_lock_nested(lock: &sub->lock, subclass: sub->level);
2058 error = __aafs_ns_mkdir(ns: sub, ns_subns_dir(ns), NULL, NULL);
2059 mutex_unlock(lock: &sub->lock);
2060 if (error)
2061 goto fail2;
2062 }
2063
2064 return 0;
2065
2066fail:
2067 error = PTR_ERR(ptr: dent);
2068
2069fail2:
2070 __aafs_ns_rmdir(ns);
2071
2072 return error;
2073}
2074
2075/**
2076 * __next_ns - find the next namespace to list
2077 * @root: root namespace to stop search at (NOT NULL)
2078 * @ns: current ns position (NOT NULL)
2079 *
2080 * Find the next namespace from @ns under @root and handle all locking needed
2081 * while switching current namespace.
2082 *
2083 * Returns: next namespace or NULL if at last namespace under @root
2084 * Requires: ns->parent->lock to be held
2085 * NOTE: will not unlock root->lock
2086 */
2087static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
2088{
2089 struct aa_ns *parent, *next;
2090
2091 AA_BUG(!root);
2092 AA_BUG(!ns);
2093 AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
2094
2095 /* is next namespace a child */
2096 if (!list_empty(head: &ns->sub_ns)) {
2097 next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
2098 mutex_lock_nested(lock: &next->lock, subclass: next->level);
2099 return next;
2100 }
2101
2102 /* check if the next ns is a sibling, parent, gp, .. */
2103 parent = ns->parent;
2104 while (ns != root) {
2105 mutex_unlock(lock: &ns->lock);
2106 next = list_next_entry(ns, base.list);
2107 if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
2108 mutex_lock_nested(lock: &next->lock, subclass: next->level);
2109 return next;
2110 }
2111 ns = parent;
2112 parent = parent->parent;
2113 }
2114
2115 return NULL;
2116}
2117
2118/**
2119 * __first_profile - find the first profile in a namespace
2120 * @root: namespace that is root of profiles being displayed (NOT NULL)
2121 * @ns: namespace to start in (NOT NULL)
2122 *
2123 * Returns: unrefcounted profile or NULL if no profile
2124 * Requires: profile->ns.lock to be held
2125 */
2126static struct aa_profile *__first_profile(struct aa_ns *root,
2127 struct aa_ns *ns)
2128{
2129 AA_BUG(!root);
2130 AA_BUG(ns && !mutex_is_locked(&ns->lock));
2131
2132 for (; ns; ns = __next_ns(root, ns)) {
2133 if (!list_empty(head: &ns->base.profiles))
2134 return list_first_entry(&ns->base.profiles,
2135 struct aa_profile, base.list);
2136 }
2137 return NULL;
2138}
2139
2140/**
2141 * __next_profile - step to the next profile in a profile tree
2142 * @p: current profile in tree (NOT NULL)
2143 *
2144 * Perform a depth first traversal on the profile tree in a namespace
2145 *
2146 * Returns: next profile or NULL if done
2147 * Requires: profile->ns.lock to be held
2148 */
2149static struct aa_profile *__next_profile(struct aa_profile *p)
2150{
2151 struct aa_profile *parent;
2152 struct aa_ns *ns = p->ns;
2153
2154 AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
2155
2156 /* is next profile a child */
2157 if (!list_empty(head: &p->base.profiles))
2158 return list_first_entry(&p->base.profiles, typeof(*p),
2159 base.list);
2160
2161 /* is next profile a sibling, parent sibling, gp, sibling, .. */
2162 parent = rcu_dereference_protected(p->parent,
2163 mutex_is_locked(&p->ns->lock));
2164 while (parent) {
2165 p = list_next_entry(p, base.list);
2166 if (!list_entry_is_head(p, &parent->base.profiles, base.list))
2167 return p;
2168 p = parent;
2169 parent = rcu_dereference_protected(parent->parent,
2170 mutex_is_locked(&parent->ns->lock));
2171 }
2172
2173 /* is next another profile in the namespace */
2174 p = list_next_entry(p, base.list);
2175 if (!list_entry_is_head(p, &ns->base.profiles, base.list))
2176 return p;
2177
2178 return NULL;
2179}
2180
2181/**
2182 * next_profile - step to the next profile in where ever it may be
2183 * @root: root namespace (NOT NULL)
2184 * @profile: current profile (NOT NULL)
2185 *
2186 * Returns: next profile or NULL if there isn't one
2187 */
2188static struct aa_profile *next_profile(struct aa_ns *root,
2189 struct aa_profile *profile)
2190{
2191 struct aa_profile *next = __next_profile(p: profile);
2192 if (next)
2193 return next;
2194
2195 /* finished all profiles in namespace move to next namespace */
2196 return __first_profile(root, ns: __next_ns(root, ns: profile->ns));
2197}
2198
2199/**
2200 * p_start - start a depth first traversal of profile tree
2201 * @f: seq_file to fill
2202 * @pos: current position
2203 *
2204 * Returns: first profile under current namespace or NULL if none found
2205 *
2206 * acquires first ns->lock
2207 */
2208static void *p_start(struct seq_file *f, loff_t *pos)
2209{
2210 struct aa_profile *profile = NULL;
2211 struct aa_ns *root = aa_get_current_ns();
2212 loff_t l = *pos;
2213 f->private = root;
2214
2215 /* find the first profile */
2216 mutex_lock_nested(lock: &root->lock, subclass: root->level);
2217 profile = __first_profile(root, ns: root);
2218
2219 /* skip to position */
2220 for (; profile && l > 0; l--)
2221 profile = next_profile(root, profile);
2222
2223 return profile;
2224}
2225
2226/**
2227 * p_next - read the next profile entry
2228 * @f: seq_file to fill
2229 * @p: profile previously returned
2230 * @pos: current position
2231 *
2232 * Returns: next profile after @p or NULL if none
2233 *
2234 * may acquire/release locks in namespace tree as necessary
2235 */
2236static void *p_next(struct seq_file *f, void *p, loff_t *pos)
2237{
2238 struct aa_profile *profile = p;
2239 struct aa_ns *ns = f->private;
2240 (*pos)++;
2241
2242 return next_profile(root: ns, profile);
2243}
2244
2245/**
2246 * p_stop - stop depth first traversal
2247 * @f: seq_file we are filling
2248 * @p: the last profile writen
2249 *
2250 * Release all locking done by p_start/p_next on namespace tree
2251 */
2252static void p_stop(struct seq_file *f, void *p)
2253{
2254 struct aa_profile *profile = p;
2255 struct aa_ns *root = f->private, *ns;
2256
2257 if (profile) {
2258 for (ns = profile->ns; ns && ns != root; ns = ns->parent)
2259 mutex_unlock(lock: &ns->lock);
2260 }
2261 mutex_unlock(lock: &root->lock);
2262 aa_put_ns(ns: root);
2263}
2264
2265/**
2266 * seq_show_profile - show a profile entry
2267 * @f: seq_file to file
2268 * @p: current position (profile) (NOT NULL)
2269 *
2270 * Returns: error on failure
2271 */
2272static int seq_show_profile(struct seq_file *f, void *p)
2273{
2274 struct aa_profile *profile = (struct aa_profile *)p;
2275 struct aa_ns *root = f->private;
2276
2277 aa_label_seq_xprint(f, ns: root, label: &profile->label,
2278 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL);
2279 seq_putc(m: f, c: '\n');
2280
2281 return 0;
2282}
2283
2284static const struct seq_operations aa_sfs_profiles_op = {
2285 .start = p_start,
2286 .next = p_next,
2287 .stop = p_stop,
2288 .show = seq_show_profile,
2289};
2290
2291static int profiles_open(struct inode *inode, struct file *file)
2292{
2293 if (!aa_current_policy_view_capable(NULL))
2294 return -EACCES;
2295
2296 return seq_open(file, &aa_sfs_profiles_op);
2297}
2298
2299static int profiles_release(struct inode *inode, struct file *file)
2300{
2301 return seq_release(inode, file);
2302}
2303
2304static const struct file_operations aa_sfs_profiles_fops = {
2305 .open = profiles_open,
2306 .read = seq_read,
2307 .llseek = seq_lseek,
2308 .release = profiles_release,
2309};
2310
2311
2312/** Base file system setup **/
2313static struct aa_sfs_entry aa_sfs_entry_file[] = {
2314 AA_SFS_FILE_STRING("mask",
2315 "create read write exec append mmap_exec link lock"),
2316 { }
2317};
2318
2319static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
2320 AA_SFS_FILE_STRING("mask", "read trace"),
2321 { }
2322};
2323
2324static struct aa_sfs_entry aa_sfs_entry_signal[] = {
2325 AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
2326 { }
2327};
2328
2329static struct aa_sfs_entry aa_sfs_entry_attach[] = {
2330 AA_SFS_FILE_BOOLEAN("xattr", 1),
2331 { }
2332};
2333static struct aa_sfs_entry aa_sfs_entry_domain[] = {
2334 AA_SFS_FILE_BOOLEAN("change_hat", 1),
2335 AA_SFS_FILE_BOOLEAN("change_hatv", 1),
2336 AA_SFS_FILE_BOOLEAN("change_onexec", 1),
2337 AA_SFS_FILE_BOOLEAN("change_profile", 1),
2338 AA_SFS_FILE_BOOLEAN("stack", 1),
2339 AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap", 1),
2340 AA_SFS_FILE_BOOLEAN("post_nnp_subset", 1),
2341 AA_SFS_FILE_BOOLEAN("computed_longest_left", 1),
2342 AA_SFS_DIR("attach_conditions", aa_sfs_entry_attach),
2343 AA_SFS_FILE_BOOLEAN("disconnected.path", 1),
2344 AA_SFS_FILE_STRING("version", "1.2"),
2345 { }
2346};
2347
2348static struct aa_sfs_entry aa_sfs_entry_unconfined[] = {
2349 AA_SFS_FILE_BOOLEAN("change_profile", 1),
2350 { }
2351};
2352
2353static struct aa_sfs_entry aa_sfs_entry_versions[] = {
2354 AA_SFS_FILE_BOOLEAN("v5", 1),
2355 AA_SFS_FILE_BOOLEAN("v6", 1),
2356 AA_SFS_FILE_BOOLEAN("v7", 1),
2357 AA_SFS_FILE_BOOLEAN("v8", 1),
2358 AA_SFS_FILE_BOOLEAN("v9", 1),
2359 { }
2360};
2361
2362#define PERMS32STR "allow deny subtree cond kill complain prompt audit quiet hide xindex tag label"
2363static struct aa_sfs_entry aa_sfs_entry_policy[] = {
2364 AA_SFS_DIR("versions", aa_sfs_entry_versions),
2365 AA_SFS_FILE_BOOLEAN("set_load", 1),
2366 /* number of out of band transitions supported */
2367 AA_SFS_FILE_U64("outofband", MAX_OOB_SUPPORTED),
2368 AA_SFS_FILE_U64("permstable32_version", 1),
2369 AA_SFS_FILE_STRING("permstable32", PERMS32STR),
2370 AA_SFS_DIR("unconfined_restrictions", aa_sfs_entry_unconfined),
2371 { }
2372};
2373
2374static struct aa_sfs_entry aa_sfs_entry_mount[] = {
2375 AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
2376 { }
2377};
2378
2379static struct aa_sfs_entry aa_sfs_entry_ns[] = {
2380 AA_SFS_FILE_BOOLEAN("profile", 1),
2381 AA_SFS_FILE_BOOLEAN("pivot_root", 0),
2382 AA_SFS_FILE_STRING("mask", "userns_create"),
2383 { }
2384};
2385
2386static struct aa_sfs_entry aa_sfs_entry_query_label[] = {
2387 AA_SFS_FILE_STRING("perms", "allow deny audit quiet"),
2388 AA_SFS_FILE_BOOLEAN("data", 1),
2389 AA_SFS_FILE_BOOLEAN("multi_transaction", 1),
2390 { }
2391};
2392
2393static struct aa_sfs_entry aa_sfs_entry_query[] = {
2394 AA_SFS_DIR("label", aa_sfs_entry_query_label),
2395 { }
2396};
2397
2398static struct aa_sfs_entry aa_sfs_entry_io_uring[] = {
2399 AA_SFS_FILE_STRING("mask", "sqpoll override_creds"),
2400 { }
2401};
2402
2403static struct aa_sfs_entry aa_sfs_entry_features[] = {
2404 AA_SFS_DIR("policy", aa_sfs_entry_policy),
2405 AA_SFS_DIR("domain", aa_sfs_entry_domain),
2406 AA_SFS_DIR("file", aa_sfs_entry_file),
2407 AA_SFS_DIR("network_v8", aa_sfs_entry_network),
2408 AA_SFS_DIR("mount", aa_sfs_entry_mount),
2409 AA_SFS_DIR("namespaces", aa_sfs_entry_ns),
2410 AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
2411 AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit),
2412 AA_SFS_DIR("caps", aa_sfs_entry_caps),
2413 AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace),
2414 AA_SFS_DIR("signal", aa_sfs_entry_signal),
2415 AA_SFS_DIR("query", aa_sfs_entry_query),
2416 AA_SFS_DIR("io_uring", aa_sfs_entry_io_uring),
2417 { }
2418};
2419
2420static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
2421 AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
2422 AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
2423 AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
2424 AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
2425 AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
2426 AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
2427 AA_SFS_FILE_FOPS("raw_data_compression_level_min", 0444, &seq_ns_compress_min_fops),
2428 AA_SFS_FILE_FOPS("raw_data_compression_level_max", 0444, &seq_ns_compress_max_fops),
2429 AA_SFS_DIR("features", aa_sfs_entry_features),
2430 { }
2431};
2432
2433static struct aa_sfs_entry aa_sfs_entry =
2434 AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor);
2435
2436/**
2437 * entry_create_file - create a file entry in the apparmor securityfs
2438 * @fs_file: aa_sfs_entry to build an entry for (NOT NULL)
2439 * @parent: the parent dentry in the securityfs
2440 *
2441 * Use entry_remove_file to remove entries created with this fn.
2442 */
2443static int __init entry_create_file(struct aa_sfs_entry *fs_file,
2444 struct dentry *parent)
2445{
2446 int error = 0;
2447
2448 fs_file->dentry = securityfs_create_file(name: fs_file->name,
2449 S_IFREG | fs_file->mode,
2450 parent, data: fs_file,
2451 fops: fs_file->file_ops);
2452 if (IS_ERR(ptr: fs_file->dentry)) {
2453 error = PTR_ERR(ptr: fs_file->dentry);
2454 fs_file->dentry = NULL;
2455 }
2456 return error;
2457}
2458
2459static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir);
2460/**
2461 * entry_create_dir - recursively create a directory entry in the securityfs
2462 * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL)
2463 * @parent: the parent dentry in the securityfs
2464 *
2465 * Use entry_remove_dir to remove entries created with this fn.
2466 */
2467static int __init entry_create_dir(struct aa_sfs_entry *fs_dir,
2468 struct dentry *parent)
2469{
2470 struct aa_sfs_entry *fs_file;
2471 struct dentry *dir;
2472 int error;
2473
2474 dir = securityfs_create_dir(name: fs_dir->name, parent);
2475 if (IS_ERR(ptr: dir))
2476 return PTR_ERR(ptr: dir);
2477 fs_dir->dentry = dir;
2478
2479 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2480 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2481 error = entry_create_dir(fs_dir: fs_file, parent: fs_dir->dentry);
2482 else
2483 error = entry_create_file(fs_file, parent: fs_dir->dentry);
2484 if (error)
2485 goto failed;
2486 }
2487
2488 return 0;
2489
2490failed:
2491 entry_remove_dir(fs_dir);
2492
2493 return error;
2494}
2495
2496/**
2497 * entry_remove_file - drop a single file entry in the apparmor securityfs
2498 * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL)
2499 */
2500static void __init entry_remove_file(struct aa_sfs_entry *fs_file)
2501{
2502 if (!fs_file->dentry)
2503 return;
2504
2505 securityfs_remove(dentry: fs_file->dentry);
2506 fs_file->dentry = NULL;
2507}
2508
2509/**
2510 * entry_remove_dir - recursively drop a directory entry from the securityfs
2511 * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL)
2512 */
2513static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir)
2514{
2515 struct aa_sfs_entry *fs_file;
2516
2517 for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2518 if (fs_file->v_type == AA_SFS_TYPE_DIR)
2519 entry_remove_dir(fs_dir: fs_file);
2520 else
2521 entry_remove_file(fs_file);
2522 }
2523
2524 entry_remove_file(fs_file: fs_dir);
2525}
2526
2527/**
2528 * aa_destroy_aafs - cleanup and free aafs
2529 *
2530 * releases dentries allocated by aa_create_aafs
2531 */
2532void __init aa_destroy_aafs(void)
2533{
2534 entry_remove_dir(fs_dir: &aa_sfs_entry);
2535}
2536
2537
2538#define NULL_FILE_NAME ".null"
2539struct path aa_null;
2540
2541static int aa_mk_null_file(struct dentry *parent)
2542{
2543 struct vfsmount *mount = NULL;
2544 struct dentry *dentry;
2545 struct inode *inode;
2546 int count = 0;
2547 int error = simple_pin_fs(parent->d_sb->s_type, mount: &mount, count: &count);
2548
2549 if (error)
2550 return error;
2551
2552 inode_lock(inode: d_inode(dentry: parent));
2553 dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME));
2554 if (IS_ERR(ptr: dentry)) {
2555 error = PTR_ERR(ptr: dentry);
2556 goto out;
2557 }
2558 inode = new_inode(sb: parent->d_inode->i_sb);
2559 if (!inode) {
2560 error = -ENOMEM;
2561 goto out1;
2562 }
2563
2564 inode->i_ino = get_next_ino();
2565 inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO;
2566 simple_inode_init_ts(inode);
2567 init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO,
2568 MKDEV(MEM_MAJOR, 3));
2569 d_instantiate(dentry, inode);
2570 aa_null.dentry = dget(dentry);
2571 aa_null.mnt = mntget(mnt: mount);
2572
2573 error = 0;
2574
2575out1:
2576 dput(dentry);
2577out:
2578 inode_unlock(inode: d_inode(dentry: parent));
2579 simple_release_fs(mount: &mount, count: &count);
2580 return error;
2581}
2582
2583
2584
2585static const char *policy_get_link(struct dentry *dentry,
2586 struct inode *inode,
2587 struct delayed_call *done)
2588{
2589 struct aa_ns *ns;
2590 struct path path;
2591 int error;
2592
2593 if (!dentry)
2594 return ERR_PTR(error: -ECHILD);
2595
2596 ns = aa_get_current_ns();
2597 path.mnt = mntget(mnt: aafs_mnt);
2598 path.dentry = dget(ns_dir(ns));
2599 error = nd_jump_link(path: &path);
2600 aa_put_ns(ns);
2601
2602 return ERR_PTR(error);
2603}
2604
2605static int policy_readlink(struct dentry *dentry, char __user *buffer,
2606 int buflen)
2607{
2608 char name[32];
2609 int res;
2610
2611 res = snprintf(buf: name, size: sizeof(name), fmt: "%s:[%lu]", AAFS_NAME,
2612 d_inode(dentry)->i_ino);
2613 if (res > 0 && res < sizeof(name))
2614 res = readlink_copy(buffer, buflen, name);
2615 else
2616 res = -ENOENT;
2617
2618 return res;
2619}
2620
2621static const struct inode_operations policy_link_iops = {
2622 .readlink = policy_readlink,
2623 .get_link = policy_get_link,
2624};
2625
2626
2627/**
2628 * aa_create_aafs - create the apparmor security filesystem
2629 *
2630 * dentries created here are released by aa_destroy_aafs
2631 *
2632 * Returns: error on failure
2633 */
2634static int __init aa_create_aafs(void)
2635{
2636 struct dentry *dent;
2637 int error;
2638
2639 if (!apparmor_initialized)
2640 return 0;
2641
2642 if (aa_sfs_entry.dentry) {
2643 AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
2644 return -EEXIST;
2645 }
2646
2647 /* setup apparmorfs used to virtualize policy/ */
2648 aafs_mnt = kern_mount(&aafs_ops);
2649 if (IS_ERR(ptr: aafs_mnt))
2650 panic(fmt: "can't set apparmorfs up\n");
2651 aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
2652
2653 /* Populate fs tree. */
2654 error = entry_create_dir(fs_dir: &aa_sfs_entry, NULL);
2655 if (error)
2656 goto error;
2657
2658 dent = securityfs_create_file(name: ".load", mode: 0666, parent: aa_sfs_entry.dentry,
2659 NULL, fops: &aa_fs_profile_load);
2660 if (IS_ERR(ptr: dent))
2661 goto dent_error;
2662 ns_subload(root_ns) = dent;
2663
2664 dent = securityfs_create_file(name: ".replace", mode: 0666, parent: aa_sfs_entry.dentry,
2665 NULL, fops: &aa_fs_profile_replace);
2666 if (IS_ERR(ptr: dent))
2667 goto dent_error;
2668 ns_subreplace(root_ns) = dent;
2669
2670 dent = securityfs_create_file(name: ".remove", mode: 0666, parent: aa_sfs_entry.dentry,
2671 NULL, fops: &aa_fs_profile_remove);
2672 if (IS_ERR(ptr: dent))
2673 goto dent_error;
2674 ns_subremove(root_ns) = dent;
2675
2676 dent = securityfs_create_file(name: "revision", mode: 0444, parent: aa_sfs_entry.dentry,
2677 NULL, fops: &aa_fs_ns_revision_fops);
2678 if (IS_ERR(ptr: dent))
2679 goto dent_error;
2680 ns_subrevision(root_ns) = dent;
2681
2682 /* policy tree referenced by magic policy symlink */
2683 mutex_lock_nested(lock: &root_ns->lock, subclass: root_ns->level);
2684 error = __aafs_ns_mkdir(ns: root_ns, parent: aafs_mnt->mnt_root, name: ".policy",
2685 dent: aafs_mnt->mnt_root);
2686 mutex_unlock(lock: &root_ns->lock);
2687 if (error)
2688 goto error;
2689
2690 /* magic symlink similar to nsfs redirects based on task policy */
2691 dent = securityfs_create_symlink(name: "policy", parent: aa_sfs_entry.dentry,
2692 NULL, iops: &policy_link_iops);
2693 if (IS_ERR(ptr: dent))
2694 goto dent_error;
2695
2696 error = aa_mk_null_file(parent: aa_sfs_entry.dentry);
2697 if (error)
2698 goto error;
2699
2700 /* TODO: add default profile to apparmorfs */
2701
2702 /* Report that AppArmor fs is enabled */
2703 aa_info_message(str: "AppArmor Filesystem Enabled");
2704 return 0;
2705
2706dent_error:
2707 error = PTR_ERR(ptr: dent);
2708error:
2709 aa_destroy_aafs();
2710 AA_ERROR("Error creating AppArmor securityfs\n");
2711 return error;
2712}
2713
2714fs_initcall(aa_create_aafs);
2715

source code of linux/security/apparmor/apparmorfs.c