aboutsummaryrefslogtreecommitdiff
path: root/security/apparmor
AgeCommit message (Collapse)AuthorFilesLines
2022-10-03apparmor: verify loaded permission bits masks don't overlapJohn Johansen1-4/+30
Add an additional verification that loaded permission sets don't overlap in ways that are not intended. This will help ensure that permission accumulation can't result in an invalid permission set. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: cleanup: move perm accumulation into perms.hJohn Johansen2-52/+53
Perm accumulation is going to be used much more frequently so let the compiler figure out if it can be optimized when used. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: make sure perm indexes are accumulatedJohn Johansen3-2/+25
accumulate permission indexes on a first encountered basis. This favors original rulesets so that new ones can not override without profile replacement. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: verify permission table indexesJohn Johansen1-1/+34
While the dfa xindex's are verified, the indexes in the permission table are not currently verified. Fix this. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: add the ability for policy to specify a permission tableJohn Johansen2-11/+98
Currently permissions are encoded in the dfa accept entries that are then mapped to an internal permission structure. This limits the permissions that userspace can specify, so allow userspace to directly specify the permission table. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: make unpack_array return a trianary valueJohn Johansen2-22/+33
currently unpack_array() does not return an error nor whether the array is not present. The ability to detect an error or the array not being present is needed so rework the unpack_array() to return the needed information. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: group dfa policydb unpackingJohn Johansen1-38/+63
There are currently three policydb rule groupings (xmatch, file, policydb) that each do their own slightly different thing. Group them into a single routine and unify. This extends/unifies dfa features by - all dfas are allowed having an optional start field - all dfas are allowed having a string/transition table Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: make transition table unpack generic so it can be reusedJohn Johansen1-10/+12
Currently the transition table is tied to the file dfa. Make it so we can unpack a transition table against any dfa. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: add user mode flagJohn Johansen5-5/+9
Allow the profile to contain a user mode prompt flag. This works similar to complain mode but will try to send messages to a userspace daemon. If the daemon is not present or timesout regular informent will occur. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: add mediation class information to auditingJohn Johansen14-13/+48
Audit messages currently don't contain the mediation class which can make them less clear than they should be in some circumstances. With newer mediation classes coming this potential confusion will become worse. Fix this by adding the mediatin class to the messages. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: extend permissions to support a label and tag stringJohn Johansen7-27/+32
add indexes for label and tag entries. Rename the domain table to the str_table as its a shared string table with label and tags. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: isolate policy backwards compatibility to its own fileJohn Johansen5-287/+359
The details of mapping old policy into newer policy formats clutters up the unpack code and makes it possible to accidentally use old mappings in code, so isolate the mapping code into its own file. This will become more important when the dfa remapping code lands, as it will greatly expand the compat code base. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: extend xindex sizeJohn Johansen3-17/+16
Allow the xindex to have 2^24 entries. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: move dfa perm macros into policy_unpackJohn Johansen2-51/+49
Now that the permission remapping macros aren't needed anywhere except during profile unpack, move them. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: extend policydb permission set by making use of the xbitsJohn Johansen1-4/+27
The policydb permission set has left the xbits unused. Make them available for mediation. Note: that this does not bring full auditing control of the permissions as there are not enough bits. The quieting of denials is provided as that is used more than forced auditing of allowed permissions. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: fix apparmor mediating locking non-fs unix socketsJohn Johansen1-4/+9
the v8 and earlier policy does not encode the locking permission for no-fs unix sockets. However the kernel is enforcing mediation. Add the AA_MAY_LOCK perm to v8 and earlier computed perm mask which will grant permission for all current abi profiles, but still allow specifying auditing of the operation if needed. Link: http://bugs.launchpad.net/bugs/1780227 Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: Fix abi check to include v8 abiJohn Johansen1-1/+1
The v8 abi is supported by the kernel but the userspace supported version check does not allow for it. This was missed when v8 was added due to a bug in the userspace compiler which was setting an older abi version for v8 encoding (which is forward compatible except on the network encoding). However it is possible to detect the network encoding by checking the policydb network support which the code does. The end result was that missing the abi flag worked until userspace was fixed and began correctly checking for the v8 abi version. Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation") Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: preparse for state being more than just an integerJohn Johansen15-102/+101
Convert from an unsigned int to a state_t for state position. This is a step in prepping for the state position carrying some additional flags, and a limited form of backtracking to support variables. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: convert policy lookup to use accept as an indexJohn Johansen7-24/+33
Remap polidydb dfa accept table from embedded perms to an index, and then move the perm lookup to use the accept entry as an index into the perm table. This is done so that the perm table can be separated from the dfa, allowing dfa accept to index to share expanded permission sets. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: cleanup shared permission structJohn Johansen2-12/+9
The shared permissions struct has the stop field which is unneeded and the "reserved" subtree field commented which is needed. Also reorganize so that the entries are logically grouped. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: convert xmatch lookup to use accept as an indexJohn Johansen2-4/+7
Remap xmatch dfa accept table from embedded perms to an index and then move xmatch lookup to use accept entry to index into the xmatch table. This is step towards unifying permission lookup and reducing the size of permissions tables. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: convert fperm lookup to use accept as an indexJohn Johansen2-19/+44
Remap file dfa accept table from embedded perms to index and then move fperm lookup to use the accept entry as an index into the fperm table. This is a step toward unifying permission lookup. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: convert xmatch to using the new shared policydb structJohn Johansen6-29/+28
continue permission unification by converting xmatch to use the policydb struct that is used by the other profile dfas. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: combine file_rules and aa_policydb into a single shared structJohn Johansen7-59/+40
file_rules and policydb are almost the same and will need the same features in the future so combine them. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: compute policydb permission on profile loadJohn Johansen9-86/+90
Rather than computing policydb permissions for each access permissions can be computed once on profile load and stored for lookup. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: convert xmatch to use aa_perms structureJohn Johansen3-7/+13
Convert xmatch from using perms encoded in the accept entry of the dfa to the common external aa_perms in a table. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: rework and cleanup fperm computationJohn Johansen1-32/+38
shorten the name of some of the mapping functions which shortens line lengths. change the mapping so it returns the perm table instead of operating directly on the file struct. Handle potential memory allocation failure. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: move fperm computation into policy_unpackJohn Johansen3-98/+98
fperm computation is only needed during policy_unpack so move the code there to isolate it fromt the run time code. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: compute xmatch permissions on profile loadMike Salvatore4-3/+26
Rather than computing xmatch permissions each time access is requested, these permissions can be computed once on profile load and stored for lookup. Signed-off-by: Mike Salvatore <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: compute file permissions on profile loadMike Salvatore5-48/+110
Rather than computing file permissions for each file access, file permissions can be computed once on profile load and stored for lookup. Signed-off-by: Mike Salvatore <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: expose compression level limits in sysfsJon Tourville1-0/+16
Create two new files in apparmor's sysfs: /sys/kernel/security/apparmor/raw_data_compression_level_min /sys/kernel/security/apparmor/raw_data_compression_level_max These correspond to the minimum and maximum zstd compression levels that can be assigned to the apparmor module parameter raw_data_compression_level. Signed-off-by: Jon Tourville <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: use zstd compression for profile dataJon Tourville4-102/+81
Change the algorithm used by apparmor to compress profile data from zlib to zstd, using the new zstd API introduced in 5.16. Zstd provides a larger range of compression levels than zlib and significantly better performance at the default level (for a relatively small increase in compressed size). The apparmor module parameter raw_data_compression_level is now clamped to the minimum and maximum compression levels reported by the zstd library. A compression level of 0 retains the previous behavior of disabling policy compression instead of using zstd's behavior, which is to use the default compression level. Signed-off-by: Jon Tourville <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: reserve mediation classesJohn Johansen1-1/+8
Reserve mediation classes that exist in out of tree development branches or are used by userspace mediation helpers. Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: fix lockdep warning when removing a namespaceJohn Johansen1-1/+1
Fix the following lockdep warning [ 1119.158984] ============================================ [ 1119.158988] WARNING: possible recursive locking detected [ 1119.158996] 6.0.0-rc1+ #257 Tainted: G E N [ 1119.158999] -------------------------------------------- [ 1119.159001] bash/80100 is trying to acquire lock: [ 1119.159007] ffff88803e79b4a0 (&ns->lock/1){+.+.}-{4:4}, at: destroy_ns.part.0+0x43/0x140 [ 1119.159028] but task is already holding lock: [ 1119.159030] ffff8881009764a0 (&ns->lock/1){+.+.}-{4:4}, at: aa_remove_profiles+0x3f0/0x640 [ 1119.159040] other info that might help us debug this: [ 1119.159042] Possible unsafe locking scenario: [ 1119.159043] CPU0 [ 1119.159045] ---- [ 1119.159047] lock(&ns->lock/1); [ 1119.159051] lock(&ns->lock/1); [ 1119.159055] *** DEADLOCK *** Which is caused by an incorrect lockdep nesting notation Fixes: feb3c766a3ab ("apparmor: fix possible recursive lock warning in __aa_create_ns") Signed-off-by: John Johansen <[email protected]>
2022-10-03apparmor: fix a memleak in multi_transaction_new()Gaosheng Cui1-1/+3
In multi_transaction_new(), the variable t is not freed or passed out on the failure of copy_from_user(t->data, buf, size), which could lead to a memleak. Fix this bug by adding a put_multi_transaction(t) in the error path. Fixes: 1dea3b41e84c5 ("apparmor: speed up transactional queries") Signed-off-by: Gaosheng Cui <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-09-01->getprocattr(): attribute name is const char *, TYVM...Al Viro1-1/+1
cast of ->d_name.name to char * is completely wrong - nothing is allowed to modify its contents. Reviewed-by: Christian Brauner (Microsoft) <[email protected]> Acked-by: Paul Moore <[email protected]> Acked-by: Casey Schaufler <[email protected]> Signed-off-by: Al Viro <[email protected]>
2022-07-20apparmor: correct config reference to intended oneLukas Bulwahn1-1/+1
Commit 5bfcbd22ee4e ("apparmor: Enable tuning of policy paranoid load for embedded systems") introduces the config SECURITY_APPARMOR_PARANOID_LOAD, but then refers in the code to SECURITY_PARANOID_LOAD; note the missing APPARMOR in the middle. Correct this to the introduced and intended config option. Fixes: 5bfcbd22ee4e ("apparmor: Enable tuning of policy paranoid load for embedded systems") Signed-off-by: Lukas Bulwahn <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: move ptrace mediation to more logical task.{h,c}John Johansen5-128/+133
AppArmor split out task oriented controls to their own logical file a while ago. Ptrace mediation is better grouped with task than ipc, so move it. Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: extend policydb permission set by making use of the xbitsJohn Johansen4-5/+25
The policydb permission set has left the xbits unused. Make them available for mediation. Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: allow label to carry debug flagsJohn Johansen6-8/+20
Allow labels to have debug flags that can be used to trigger debug output only from profiles/labels that are marked. This can help reduce debug output by allowing debug to be target to a specific confinement condition. Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: fix overlapping attachment computationJohn Johansen2-2/+2
When finding the profile via patterned attachments, the longest left match is being set to the static compile time value and not using the runtime computed value. Fix this by setting the candidate value to the greater of the precomputed value or runtime computed value. Fixes: 21f606610502 ("apparmor: improve overlapping domain attachment resolution") Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: fix setting unconfined mode on a loaded profileJohn Johansen1-5/+7
When loading a profile that is set to unconfined mode, that label flag is not set when it should be. Ensure it is set so that when used in a label the unconfined check will be applied correctly. Fixes: 038165070aa5 ("apparmor: allow setting any profile into the unconfined state") Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: Fix some kernel-doc commentsYang Li1-6/+6
Remove warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. security/apparmor/policy_ns.c:65: warning: Function parameter or member 'curr' not described in 'aa_ns_name' security/apparmor/policy_ns.c:65: warning: Function parameter or member 'view' not described in 'aa_ns_name' security/apparmor/policy_ns.c:65: warning: Function parameter or member 'subns' not described in 'aa_ns_name' security/apparmor/policy_ns.c:65: warning: expecting prototype for aa_na_name(). Prototype was for aa_ns_name() instead security/apparmor/policy_ns.c:214: warning: Function parameter or member 'view' not described in '__aa_lookupn_ns' security/apparmor/policy_ns.c:214: warning: Excess function parameter 'base' description in '__aa_lookupn_ns' security/apparmor/policy_ns.c:297: warning: expecting prototype for aa_create_ns(). Prototype was for __aa_find_or_create_ns() instead Reported-by: Abaci Robot <[email protected]> Signed-off-by: Yang Li <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-19apparmor: Mark alloc_unconfined() as staticSouptick Joarder (HPE)1-1/+1
Kernel test robot throws below warning -> security/apparmor/policy_ns.c:83:20: warning: no previous prototype for function 'alloc_unconfined' [-Wmissing-prototypes] Mark it as static. Reported-by: kernel test robot <[email protected]> Signed-off-by: Souptick Joarder (HPE) <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-13apparmor: disable showing the mode as part of a secid to secctxJohn Johansen3-6/+20
Displaying the mode as part of the seectx takes up unnecessary memory, makes it so we can't use refcounted secctx so we need to alloc/free on every conversion from secid to secctx and introduces a space that could be potentially mishandled by tooling. Eg. In an audit record we get subj_type=firefix (enforce) Having the mode reported is not necessary, and might even be confusing eg. when writing an audit rule to match the above record field you would use -F subj_type=firefox ie. the mode is not included. AppArmor provides ways to find the mode without reporting as part of the secctx. So disable this by default before its use is wide spread and we can't. For now we add a sysctl to control the behavior as we can't guarantee no one is using this. Acked-by: Andrea Righi <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-13apparmor: Convert secid mapping to XArrays instead of IDRMatthew Wilcox3-32/+13
XArrays are a better match than IDR for how AppArmor is mapping secids. Specifically AppArmor is trying to keep the allocation dense. XArrays also have the advantage of avoiding the complexity IDRs preallocation. In addition this avoids/fixes a lockdep issue raised in the LKML thread "Linux 5.18-rc4" where there is a report of an interaction between apparmor and IPC, this warning may have been spurious as the reported issue is in a per-cpu local lock taken by the IDR. With the one side in the IPC id allocation and the other in AppArmor's secid allocation. Description by John Johansen <[email protected]> Message-Id: <[email protected]> Signed-off-by: Matthew Wilcox <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-13apparmor: add a kernel label to use on kernel objectsJohn Johansen4-13/+37
Separate kernel objects from unconfined. This is done so we can distinguish between the two in debugging, auditing and in preparation for being able to replace unconfined, which is not appropriate for the kernel. The kernel label will continue to behave similar to unconfined. Acked-by: Jon Tourville <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-09apparmor: test: Remove some casts which are no-longer requiredDavid Gow1-6/+6
With some of the stricter type checking in KUnit's EXPECT macros removed, several casts in policy_unpack_test are no longer required. Remove the unnecessary casts, making the conditions clearer. Reviewed-by: Brendan Higgins <[email protected]> Acked-by: John Johansen <[email protected]> Signed-off-by: David Gow <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-09apparmor: Fix memleak in aa_simple_write_to_buffer()Xiu Jianfeng1-1/+1
When copy_from_user failed, the memory is freed by kvfree. however the management struct and data blob are allocated independently, so only kvfree(data) cause a memleak issue here. Use aa_put_loaddata(data) to fix this issue. Fixes: a6a52579e52b5 ("apparmor: split load data into management struct and data blob") Signed-off-by: Xiu Jianfeng <[email protected]> Signed-off-by: John Johansen <[email protected]>
2022-07-09apparmor: fix reference count leak in aa_pivotroot()Xin Xiong1-0/+1
The aa_pivotroot() function has a reference counting bug in a specific path. When aa_replace_current_label() returns on success, the function forgets to decrement the reference count of “target”, which is increased earlier by build_pivotroot(), causing a reference leak. Fix it by decreasing the refcount of “target” in that path. Fixes: 2ea3ffb7782a ("apparmor: add mount mediation") Co-developed-by: Xiyu Yang <[email protected]> Signed-off-by: Xiyu Yang <[email protected]> Co-developed-by: Xin Tan <[email protected]> Signed-off-by: Xin Tan <[email protected]> Signed-off-by: Xin Xiong <[email protected]> Signed-off-by: John Johansen <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.