1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * AppArmor security module |
4 | * |
5 | * This file contains AppArmor /proc/<pid>/attr/ interface functions |
6 | * |
7 | * Copyright (C) 1998-2008 Novell/SUSE |
8 | * Copyright 2009-2010 Canonical Ltd. |
9 | */ |
10 | |
11 | #include "include/apparmor.h" |
12 | #include "include/cred.h" |
13 | #include "include/policy.h" |
14 | #include "include/policy_ns.h" |
15 | #include "include/domain.h" |
16 | #include "include/procattr.h" |
17 | |
18 | |
19 | /** |
20 | * aa_getprocattr - Return the label information for @label |
21 | * @label: the label to print label info about (NOT NULL) |
22 | * @string: Returns - string containing the label info (NOT NULL) |
23 | * |
24 | * Requires: label != NULL && string != NULL |
25 | * |
26 | * Creates a string containing the label information for @label. |
27 | * |
28 | * Returns: size of string placed in @string else error code on failure |
29 | */ |
30 | int aa_getprocattr(struct aa_label *label, char **string) |
31 | { |
32 | struct aa_ns *ns = labels_ns(label); |
33 | struct aa_ns *current_ns = aa_get_current_ns(); |
34 | int len; |
35 | |
36 | if (!aa_ns_visible(curr: current_ns, view: ns, subns: true)) { |
37 | aa_put_ns(ns: current_ns); |
38 | return -EACCES; |
39 | } |
40 | |
41 | len = aa_label_snxprint(NULL, size: 0, view: current_ns, label, |
42 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
43 | FLAG_HIDDEN_UNCONFINED); |
44 | AA_BUG(len < 0); |
45 | |
46 | *string = kmalloc(size: len + 2, GFP_KERNEL); |
47 | if (!*string) { |
48 | aa_put_ns(ns: current_ns); |
49 | return -ENOMEM; |
50 | } |
51 | |
52 | len = aa_label_snxprint(str: *string, size: len + 2, view: current_ns, label, |
53 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | |
54 | FLAG_HIDDEN_UNCONFINED); |
55 | if (len < 0) { |
56 | aa_put_ns(ns: current_ns); |
57 | return len; |
58 | } |
59 | |
60 | (*string)[len] = '\n'; |
61 | (*string)[len + 1] = 0; |
62 | |
63 | aa_put_ns(ns: current_ns); |
64 | return len + 1; |
65 | } |
66 | |
67 | /** |
68 | * split_token_from_name - separate a string of form <token>^<name> |
69 | * @op: operation being checked |
70 | * @args: string to parse (NOT NULL) |
71 | * @token: stores returned parsed token value (NOT NULL) |
72 | * |
73 | * Returns: start position of name after token else NULL on failure |
74 | */ |
75 | static char *split_token_from_name(const char *op, char *args, u64 *token) |
76 | { |
77 | char *name; |
78 | |
79 | *token = simple_strtoull(args, &name, 16); |
80 | if ((name == args) || *name != '^') { |
81 | AA_ERROR("%s: Invalid input '%s'" , op, args); |
82 | return ERR_PTR(error: -EINVAL); |
83 | } |
84 | |
85 | name++; /* skip ^ */ |
86 | if (!*name) |
87 | name = NULL; |
88 | return name; |
89 | } |
90 | |
91 | /** |
92 | * aa_setprocattr_changehat - handle procattr interface to change_hat |
93 | * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL) |
94 | * @size: size of the args |
95 | * @flags: set of flags governing behavior |
96 | * |
97 | * Returns: %0 or error code if change_hat fails |
98 | */ |
99 | int aa_setprocattr_changehat(char *args, size_t size, int flags) |
100 | { |
101 | char *hat; |
102 | u64 token; |
103 | const char *hats[16]; /* current hard limit on # of names */ |
104 | int count = 0; |
105 | |
106 | hat = split_token_from_name(OP_CHANGE_HAT, args, token: &token); |
107 | if (IS_ERR(ptr: hat)) |
108 | return PTR_ERR(ptr: hat); |
109 | |
110 | if (!hat && !token) { |
111 | AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic" ); |
112 | return -EINVAL; |
113 | } |
114 | |
115 | if (hat) { |
116 | /* set up hat name vector, args guaranteed null terminated |
117 | * at args[size] by setprocattr. |
118 | * |
119 | * If there are multiple hat names in the buffer each is |
120 | * separated by a \0. Ie. userspace writes them pre tokenized |
121 | */ |
122 | char *end = args + size; |
123 | for (count = 0; (hat < end) && count < 16; ++count) { |
124 | char *next = hat + strlen(hat) + 1; |
125 | hats[count] = hat; |
126 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d hat '%s'\n" |
127 | , __func__, current->pid, token, count, hat); |
128 | hat = next; |
129 | } |
130 | } else |
131 | AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n" , |
132 | __func__, current->pid, token, count, "<NULL>" ); |
133 | |
134 | return aa_change_hat(hats, count, token, flags); |
135 | } |
136 | |