1 | /* SPDX-License-Identifier: GPL-2.0-only */ |
2 | /* |
3 | * AppArmor security module |
4 | * |
5 | * This file contains AppArmor file mediation function definitions. |
6 | * |
7 | * Copyright (C) 1998-2008 Novell/SUSE |
8 | * Copyright 2009-2010 Canonical Ltd. |
9 | */ |
10 | |
11 | #ifndef __AA_FILE_H |
12 | #define __AA_FILE_H |
13 | |
14 | #include <linux/spinlock.h> |
15 | |
16 | #include "domain.h" |
17 | #include "match.h" |
18 | #include "perms.h" |
19 | |
20 | struct aa_policydb; |
21 | struct aa_profile; |
22 | struct path; |
23 | |
24 | #define mask_mode_t(X) (X & (MAY_EXEC | MAY_WRITE | MAY_READ | MAY_APPEND)) |
25 | |
26 | #define AA_AUDIT_FILE_MASK (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND |\ |
27 | AA_MAY_CREATE | AA_MAY_DELETE | \ |
28 | AA_MAY_GETATTR | AA_MAY_SETATTR | \ |
29 | AA_MAY_CHMOD | AA_MAY_CHOWN | AA_MAY_LOCK | \ |
30 | AA_EXEC_MMAP | AA_MAY_LINK) |
31 | |
32 | static inline struct aa_file_ctx *file_ctx(struct file *file) |
33 | { |
34 | return file->f_security + apparmor_blob_sizes.lbs_file; |
35 | } |
36 | |
37 | /* struct aa_file_ctx - the AppArmor context the file was opened in |
38 | * @lock: lock to update the ctx |
39 | * @label: label currently cached on the ctx |
40 | * @perms: the permission the file was opened with |
41 | */ |
42 | struct aa_file_ctx { |
43 | spinlock_t lock; |
44 | struct aa_label __rcu *label; |
45 | u32 allow; |
46 | }; |
47 | |
48 | /* |
49 | * The xindex is broken into 3 parts |
50 | * - index - an index into either the exec name table or the variable table |
51 | * - exec type - which determines how the executable name and index are used |
52 | * - flags - which modify how the destination name is applied |
53 | */ |
54 | #define AA_X_INDEX_MASK AA_INDEX_MASK |
55 | |
56 | #define AA_X_TYPE_MASK 0x0c000000 |
57 | #define AA_X_NONE AA_INDEX_NONE |
58 | #define AA_X_NAME 0x04000000 /* use executable name px */ |
59 | #define AA_X_TABLE 0x08000000 /* use a specified name ->n# */ |
60 | |
61 | #define AA_X_UNSAFE 0x10000000 |
62 | #define AA_X_CHILD 0x20000000 |
63 | #define AA_X_INHERIT 0x40000000 |
64 | #define AA_X_UNCONFINED 0x80000000 |
65 | |
66 | /* need to make conditional which ones are being set */ |
67 | struct path_cond { |
68 | kuid_t uid; |
69 | umode_t mode; |
70 | }; |
71 | |
72 | #define COMBINED_PERM_MASK(X) ((X).allow | (X).audit | (X).quiet | (X).kill) |
73 | |
74 | int aa_audit_file(const struct cred *cred, |
75 | struct aa_profile *profile, struct aa_perms *perms, |
76 | const char *op, u32 request, const char *name, |
77 | const char *target, struct aa_label *tlabel, kuid_t ouid, |
78 | const char *info, int error); |
79 | |
80 | struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules, |
81 | aa_state_t state, struct path_cond *cond); |
82 | aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start, |
83 | const char *name, struct path_cond *cond, |
84 | struct aa_perms *perms); |
85 | |
86 | int aa_path_perm(const char *op, const struct cred *subj_cred, |
87 | struct aa_label *label, const struct path *path, |
88 | int flags, u32 request, struct path_cond *cond); |
89 | |
90 | int aa_path_link(const struct cred *subj_cred, struct aa_label *label, |
91 | struct dentry *old_dentry, const struct path *new_dir, |
92 | struct dentry *new_dentry); |
93 | |
94 | int aa_file_perm(const char *op, const struct cred *subj_cred, |
95 | struct aa_label *label, struct file *file, |
96 | u32 request, bool in_atomic); |
97 | |
98 | void aa_inherit_files(const struct cred *cred, struct files_struct *files); |
99 | |
100 | |
101 | /** |
102 | * aa_map_file_perms - map file flags to AppArmor permissions |
103 | * @file: open file to map flags to AppArmor permissions |
104 | * |
105 | * Returns: apparmor permission set for the file |
106 | */ |
107 | static inline u32 aa_map_file_to_perms(struct file *file) |
108 | { |
109 | int flags = file->f_flags; |
110 | u32 perms = 0; |
111 | |
112 | if (file->f_mode & FMODE_WRITE) |
113 | perms |= MAY_WRITE; |
114 | if (file->f_mode & FMODE_READ) |
115 | perms |= MAY_READ; |
116 | |
117 | if ((flags & O_APPEND) && (perms & MAY_WRITE)) |
118 | perms = (perms & ~MAY_WRITE) | MAY_APPEND; |
119 | /* trunc implies write permission */ |
120 | if (flags & O_TRUNC) |
121 | perms |= MAY_WRITE; |
122 | if (flags & O_CREAT) |
123 | perms |= AA_MAY_CREATE; |
124 | |
125 | return perms; |
126 | } |
127 | |
128 | #endif /* __AA_FILE_H */ |
129 | |