AppArmor: file enforcement routines

AppArmor does files enforcement via pathname matching.  Matching is done
at file open using a dfa match engine.  Permission is against the final
file object not parent directories, ie. the traversal of directories
as part of the file match is implicitly allowed.  In the case of nonexistant
files (creation) permissions are checked against the target file not the
directory.  eg. In case of creating the file /dir/new, permissions are
checked against the match /dir/new not against /dir/.

The permissions for matches are currently stored in the dfa accept table,
but this will change to allow for dfa reuse and also to allow for sharing
of wider accept states.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>

2 files changed, 674 insertions, 0 deletions

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
new file mode 100644
index 000000000000..7312db741219
--- /dev/null
+++ b/security/apparmor/file.c
@@ -0,0 +1,457 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor mediation of files
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/file.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+struct file_perms nullperms;
+
+
+/**
+ * audit_file_mask - convert mask to permission string
+ * @buffer: buffer to write string to (NOT NULL)
+ * @mask: permission mask to convert
+ */
+static void audit_file_mask(struct audit_buffer *ab, u32 mask)
+{
+        char str[10];
+
+        char *m = str;
+
+        if (mask & AA_EXEC_MMAP)
+                *m++ = 'm';
+        if (mask & (MAY_READ | AA_MAY_META_READ))
+                *m++ = 'r';
+        if (mask & (MAY_WRITE | AA_MAY_META_WRITE | AA_MAY_CHMOD |
+                    AA_MAY_CHOWN))
+                *m++ = 'w';
+        else if (mask & MAY_APPEND)
+                *m++ = 'a';
+        if (mask & AA_MAY_CREATE)
+                *m++ = 'c';
+        if (mask & AA_MAY_DELETE)
+                *m++ = 'd';
+        if (mask & AA_MAY_LINK)
+                *m++ = 'l';
+        if (mask & AA_MAY_LOCK)
+                *m++ = 'k';
+        if (mask & MAY_EXEC)
+                *m++ = 'x';
+        *m = '\0';
+
+        audit_log_string(ab, str);
+}
+
+/**
+ * file_audit_cb - call back for file specific audit fields
+ * @ab: audit_buffer  (NOT NULL)
+ * @va: audit struct to audit values of  (NOT NULL)
+ */
+static void file_audit_cb(struct audit_buffer *ab, void *va)
+{
+        struct common_audit_data *sa = va;
+        uid_t fsuid = current_fsuid();
+
+        if (sa->aad.fs.request & AA_AUDIT_FILE_MASK) {
+                audit_log_format(ab, " requested_mask=");
+                audit_file_mask(ab, sa->aad.fs.request);
+        }
+        if (sa->aad.fs.denied & AA_AUDIT_FILE_MASK) {
+                audit_log_format(ab, " denied_mask=");
+                audit_file_mask(ab, sa->aad.fs.denied);
+        }
+        if (sa->aad.fs.request & AA_AUDIT_FILE_MASK) {
+                audit_log_format(ab, " fsuid=%d", fsuid);
+                audit_log_format(ab, " ouid=%d", sa->aad.fs.ouid);
+        }
+
+        if (sa->aad.fs.target) {
+                audit_log_format(ab, " target=");
+                audit_log_untrustedstring(ab, sa->aad.fs.target);
+        }
+}
+
+/**
+ * aa_audit_file - handle the auditing of file operations
+ * @profile: the profile being enforced  (NOT NULL)
+ * @perms: the permissions computed for the request (NOT NULL)
+ * @gfp: allocation flags
+ * @op: operation being mediated
+ * @request: permissions requested
+ * @name: name of object being mediated (MAYBE NULL)
+ * @target: name of target (MAYBE NULL)
+ * @ouid: object uid
+ * @info: extra information message (MAYBE NULL)
+ * @error: 0 if operation allowed else failure error code
+ *
+ * Returns: %0 or error on failure
+ */
+int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
+                  gfp_t gfp, int op, u32 request, const char *name,
+                  const char *target, uid_t ouid, const char *info, int error)
+{
+        int type = AUDIT_APPARMOR_AUTO;
+        struct common_audit_data sa;
+        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.aad.op = op,
+        sa.aad.fs.request = request;
+        sa.aad.name = name;
+        sa.aad.fs.target = target;
+        sa.aad.fs.ouid = ouid;
+        sa.aad.info = info;
+        sa.aad.error = error;
+
+        if (likely(!sa.aad.error)) {
+                u32 mask = perms->audit;
+
+                if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
+                        mask = 0xffff;
+
+                /* mask off perms that are not being force audited */
+                sa.aad.fs.request &= mask;
+
+                if (likely(!sa.aad.fs.request))
+                        return 0;
+                type = AUDIT_APPARMOR_AUDIT;
+        } else {
+                /* only report permissions that were denied */
+                sa.aad.fs.request = sa.aad.fs.request & ~perms->allow;
+
+                if (sa.aad.fs.request & perms->kill)
+                        type = AUDIT_APPARMOR_KILL;
+
+                /* quiet known rejects, assumes quiet and kill do not overlap */
+                if ((sa.aad.fs.request & perms->quiet) &&
+                    AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+                    AUDIT_MODE(profile) != AUDIT_ALL)
+                        sa.aad.fs.request &= ~perms->quiet;
+
+                if (!sa.aad.fs.request)
+                        return COMPLAIN_MODE(profile) ? 0 : sa.aad.error;
+        }
+
+        sa.aad.fs.denied = sa.aad.fs.request & ~perms->allow;
+        return aa_audit(type, profile, gfp, &sa, file_audit_cb);
+}
+
+/**
+ * map_old_perms - map old file perms layout to the new layout
+ * @old: permission set in old mapping
+ *
+ * Returns: new permission mapping
+ */
+static u32 map_old_perms(u32 old)
+{
+        u32 new = old & 0xf;
+        if (old & MAY_READ)
+                new |= AA_MAY_META_READ;
+        if (old & MAY_WRITE)
+                new |= AA_MAY_META_WRITE | AA_MAY_CREATE | AA_MAY_DELETE |
+                        AA_MAY_CHMOD | AA_MAY_CHOWN;
+        if (old & 0x10)
+                new |= AA_MAY_LINK;
+        /* the old mapping lock and link_subset flags where overlaid
+         * and use was determined by part of a pair that they were in
+         */
+        if (old & 0x20)
+                new |= AA_MAY_LOCK | AA_LINK_SUBSET;
+        if (old & 0x40) /* AA_EXEC_MMAP */
+                new |= AA_EXEC_MMAP;
+
+        new |= AA_MAY_META_READ;
+
+        return new;
+}
+
+/**
+ * compute_perms - convert dfa compressed perms to internal perms
+ * @dfa: dfa to compute perms for   (NOT NULL)
+ * @state: state in dfa
+ * @cond:  conditions to consider  (NOT NULL)
+ *
+ * TODO: convert from dfa + state to permission entry, do computation conversion
+ *       at load time.
+ *
+ * Returns: computed permission set
+ */
+static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
+                                       struct path_cond *cond)
+{
+        struct file_perms perms;