Loading...
1/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor task related definitions and mediation
5 *
6 * Copyright 2017 Canonical Ltd.
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
11 * License.
12 *
13 * TODO
14 * If a task uses change_hat it currently does not return to the old
15 * cred or task context but instead creates a new one. Ideally the task
16 * should return to the previous cred if it has not been modified.
17 */
18
19#include "include/cred.h"
20#include "include/task.h"
21
22/**
23 * aa_get_task_label - Get another task's label
24 * @task: task to query (NOT NULL)
25 *
26 * Returns: counted reference to @task's label
27 */
28struct aa_label *aa_get_task_label(struct task_struct *task)
29{
30 struct aa_label *p;
31
32 rcu_read_lock();
33 p = aa_get_newest_label(__aa_task_raw_label(task));
34 rcu_read_unlock();
35
36 return p;
37}
38
39/**
40 * aa_replace_current_label - replace the current tasks label
41 * @label: new label (NOT NULL)
42 *
43 * Returns: 0 or error on failure
44 */
45int aa_replace_current_label(struct aa_label *label)
46{
47 struct aa_label *old = aa_current_raw_label();
48 struct aa_task_ctx *ctx = task_ctx(current);
49 struct cred *new;
50
51 AA_BUG(!label);
52
53 if (old == label)
54 return 0;
55
56 if (current_cred() != current_real_cred())
57 return -EBUSY;
58
59 new = prepare_creds();
60 if (!new)
61 return -ENOMEM;
62
63 if (ctx->nnp && label_is_stale(ctx->nnp)) {
64 struct aa_label *tmp = ctx->nnp;
65
66 ctx->nnp = aa_get_newest_label(tmp);
67 aa_put_label(tmp);
68 }
69 if (unconfined(label) || (labels_ns(old) != labels_ns(label)))
70 /*
71 * if switching to unconfined or a different label namespace
72 * clear out context state
73 */
74 aa_clear_task_ctx_trans(task_ctx(current));
75
76 /*
77 * be careful switching cred label, when racing replacement it
78 * is possible that the cred labels's->proxy->label is the reference
79 * keeping @label valid, so make sure to get its reference before
80 * dropping the reference on the cred's label
81 */
82 aa_get_label(label);
83 aa_put_label(cred_label(new));
84 cred_label(new) = label;
85
86 commit_creds(new);
87 return 0;
88}
89
90
91/**
92 * aa_set_current_onexec - set the tasks change_profile to happen onexec
93 * @label: system label to set at exec (MAYBE NULL to clear value)
94 * @stack: whether stacking should be done
95 * Returns: 0 or error on failure
96 */
97int aa_set_current_onexec(struct aa_label *label, bool stack)
98{
99 struct aa_task_ctx *ctx = task_ctx(current);
100
101 aa_get_label(label);
102 aa_put_label(ctx->onexec);
103 ctx->onexec = label;
104 ctx->token = stack;
105
106 return 0;
107}
108
109/**
110 * aa_set_current_hat - set the current tasks hat
111 * @label: label to set as the current hat (NOT NULL)
112 * @token: token value that must be specified to change from the hat
113 *
114 * Do switch of tasks hat. If the task is currently in a hat
115 * validate the token to match.
116 *
117 * Returns: 0 or error on failure
118 */
119int aa_set_current_hat(struct aa_label *label, u64 token)
120{
121 struct aa_task_ctx *ctx = task_ctx(current);
122 struct cred *new;
123
124 new = prepare_creds();
125 if (!new)
126 return -ENOMEM;
127 AA_BUG(!label);
128
129 if (!ctx->previous) {
130 /* transfer refcount */
131 ctx->previous = cred_label(new);
132 ctx->token = token;
133 } else if (ctx->token == token) {
134 aa_put_label(cred_label(new));
135 } else {
136 /* previous_profile && ctx->token != token */
137 abort_creds(new);
138 return -EACCES;
139 }
140
141 cred_label(new) = aa_get_newest_label(label);
142 /* clear exec on switching context */
143 aa_put_label(ctx->onexec);
144 ctx->onexec = NULL;
145
146 commit_creds(new);
147 return 0;
148}
149
150/**
151 * aa_restore_previous_label - exit from hat context restoring previous label
152 * @token: the token that must be matched to exit hat context
153 *
154 * Attempt to return out of a hat to the previous label. The token
155 * must match the stored token value.
156 *
157 * Returns: 0 or error of failure
158 */
159int aa_restore_previous_label(u64 token)
160{
161 struct aa_task_ctx *ctx = task_ctx(current);
162 struct cred *new;
163
164 if (ctx->token != token)
165 return -EACCES;
166 /* ignore restores when there is no saved label */
167 if (!ctx->previous)
168 return 0;
169
170 new = prepare_creds();
171 if (!new)
172 return -ENOMEM;
173
174 aa_put_label(cred_label(new));
175 cred_label(new) = aa_get_newest_label(ctx->previous);
176 AA_BUG(!cred_label(new));
177 /* clear exec && prev information when restoring to previous context */
178 aa_clear_task_ctx_trans(ctx);
179
180 commit_creds(new);
181
182 return 0;
183}
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor task related definitions and mediation
6 *
7 * Copyright 2017 Canonical Ltd.
8 *
9 * TODO
10 * If a task uses change_hat it currently does not return to the old
11 * cred or task context but instead creates a new one. Ideally the task
12 * should return to the previous cred if it has not been modified.
13 */
14
15#include <linux/gfp.h>
16#include <linux/ptrace.h>
17
18#include "include/audit.h"
19#include "include/cred.h"
20#include "include/policy.h"
21#include "include/task.h"
22
23/**
24 * aa_get_task_label - Get another task's label
25 * @task: task to query (NOT NULL)
26 *
27 * Returns: counted reference to @task's label
28 */
29struct aa_label *aa_get_task_label(struct task_struct *task)
30{
31 struct aa_label *p;
32
33 rcu_read_lock();
34 p = aa_get_newest_cred_label(__task_cred(task));
35 rcu_read_unlock();
36
37 return p;
38}
39
40/**
41 * aa_replace_current_label - replace the current tasks label
42 * @label: new label (NOT NULL)
43 *
44 * Returns: 0 or error on failure
45 */
46int aa_replace_current_label(struct aa_label *label)
47{
48 struct aa_label *old = aa_current_raw_label();
49 struct aa_task_ctx *ctx = task_ctx(current);
50 struct cred *new;
51
52 AA_BUG(!label);
53
54 if (old == label)
55 return 0;
56
57 if (current_cred() != current_real_cred())
58 return -EBUSY;
59
60 new = prepare_creds();
61 if (!new)
62 return -ENOMEM;
63
64 if (ctx->nnp && label_is_stale(ctx->nnp)) {
65 struct aa_label *tmp = ctx->nnp;
66
67 ctx->nnp = aa_get_newest_label(tmp);
68 aa_put_label(tmp);
69 }
70 if (unconfined(label) || (labels_ns(old) != labels_ns(label)))
71 /*
72 * if switching to unconfined or a different label namespace
73 * clear out context state
74 */
75 aa_clear_task_ctx_trans(task_ctx(current));
76
77 /*
78 * be careful switching cred label, when racing replacement it
79 * is possible that the cred labels's->proxy->label is the reference
80 * keeping @label valid, so make sure to get its reference before
81 * dropping the reference on the cred's label
82 */
83 aa_get_label(label);
84 aa_put_label(cred_label(new));
85 set_cred_label(new, label);
86
87 commit_creds(new);
88 return 0;
89}
90
91
92/**
93 * aa_set_current_onexec - set the tasks change_profile to happen onexec
94 * @label: system label to set at exec (MAYBE NULL to clear value)
95 * @stack: whether stacking should be done
96 * Returns: 0 or error on failure
97 */
98int aa_set_current_onexec(struct aa_label *label, bool stack)
99{
100 struct aa_task_ctx *ctx = task_ctx(current);
101
102 aa_get_label(label);
103 aa_put_label(ctx->onexec);
104 ctx->onexec = label;
105 ctx->token = stack;
106
107 return 0;
108}
109
110/**
111 * aa_set_current_hat - set the current tasks hat
112 * @label: label to set as the current hat (NOT NULL)
113 * @token: token value that must be specified to change from the hat
114 *
115 * Do switch of tasks hat. If the task is currently in a hat
116 * validate the token to match.
117 *
118 * Returns: 0 or error on failure
119 */
120int aa_set_current_hat(struct aa_label *label, u64 token)
121{
122 struct aa_task_ctx *ctx = task_ctx(current);
123 struct cred *new;
124
125 new = prepare_creds();
126 if (!new)
127 return -ENOMEM;
128 AA_BUG(!label);
129
130 if (!ctx->previous) {
131 /* transfer refcount */
132 ctx->previous = cred_label(new);
133 ctx->token = token;
134 } else if (ctx->token == token) {
135 aa_put_label(cred_label(new));
136 } else {
137 /* previous_profile && ctx->token != token */
138 abort_creds(new);
139 return -EACCES;
140 }
141
142 set_cred_label(new, aa_get_newest_label(label));
143 /* clear exec on switching context */
144 aa_put_label(ctx->onexec);
145 ctx->onexec = NULL;
146
147 commit_creds(new);
148 return 0;
149}
150
151/**
152 * aa_restore_previous_label - exit from hat context restoring previous label
153 * @token: the token that must be matched to exit hat context
154 *
155 * Attempt to return out of a hat to the previous label. The token
156 * must match the stored token value.
157 *
158 * Returns: 0 or error of failure
159 */
160int aa_restore_previous_label(u64 token)
161{
162 struct aa_task_ctx *ctx = task_ctx(current);
163 struct cred *new;
164
165 if (ctx->token != token)
166 return -EACCES;
167 /* ignore restores when there is no saved label */
168 if (!ctx->previous)
169 return 0;
170
171 new = prepare_creds();
172 if (!new)
173 return -ENOMEM;
174
175 aa_put_label(cred_label(new));
176 set_cred_label(new, aa_get_newest_label(ctx->previous));
177 AA_BUG(!cred_label(new));
178 /* clear exec && prev information when restoring to previous context */
179 aa_clear_task_ctx_trans(ctx);
180
181 commit_creds(new);
182
183 return 0;
184}
185
186/**
187 * audit_ptrace_mask - convert mask to permission string
188 * @mask: permission mask to convert
189 *
190 * Returns: pointer to static string
191 */
192static const char *audit_ptrace_mask(u32 mask)
193{
194 switch (mask) {
195 case MAY_READ:
196 return "read";
197 case MAY_WRITE:
198 return "trace";
199 case AA_MAY_BE_READ:
200 return "readby";
201 case AA_MAY_BE_TRACED:
202 return "tracedby";
203 }
204 return "";
205}
206
207/* call back to audit ptrace fields */
208static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
209{
210 struct common_audit_data *sa = va;
211
212 if (aad(sa)->request & AA_PTRACE_PERM_MASK) {
213 audit_log_format(ab, " requested_mask=\"%s\"",
214 audit_ptrace_mask(aad(sa)->request));
215
216 if (aad(sa)->denied & AA_PTRACE_PERM_MASK) {
217 audit_log_format(ab, " denied_mask=\"%s\"",
218 audit_ptrace_mask(aad(sa)->denied));
219 }
220 }
221 audit_log_format(ab, " peer=");
222 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
223 FLAGS_NONE, GFP_ATOMIC);
224}
225
226/* assumes check for RULE_MEDIATES is already done */
227/* TODO: conditionals */
228static int profile_ptrace_perm(struct aa_profile *profile,
229 struct aa_label *peer, u32 request,
230 struct common_audit_data *sa)
231{
232 struct aa_ruleset *rules = list_first_entry(&profile->rules,
233 typeof(*rules), list);
234 struct aa_perms perms = { };
235
236 aad(sa)->peer = peer;
237 aa_profile_match_label(profile, rules, peer, AA_CLASS_PTRACE, request,
238 &perms);
239 aa_apply_modes_to_perms(profile, &perms);
240 return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
241}
242
243static int profile_tracee_perm(struct aa_profile *tracee,
244 struct aa_label *tracer, u32 request,
245 struct common_audit_data *sa)
246{
247 if (profile_unconfined(tracee) || unconfined(tracer) ||
248 !ANY_RULE_MEDIATES(&tracee->rules, AA_CLASS_PTRACE))
249 return 0;
250
251 return profile_ptrace_perm(tracee, tracer, request, sa);
252}
253
254static int profile_tracer_perm(struct aa_profile *tracer,
255 struct aa_label *tracee, u32 request,
256 struct common_audit_data *sa)
257{
258 if (profile_unconfined(tracer))
259 return 0;
260
261 if (ANY_RULE_MEDIATES(&tracer->rules, AA_CLASS_PTRACE))
262 return profile_ptrace_perm(tracer, tracee, request, sa);
263
264 /* profile uses the old style capability check for ptrace */
265 if (&tracer->label == tracee)
266 return 0;
267
268 aad(sa)->label = &tracer->label;
269 aad(sa)->peer = tracee;
270 aad(sa)->request = 0;
271 aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE,
272 CAP_OPT_NONE);
273
274 return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
275}
276
277/**
278 * aa_may_ptrace - test if tracer task can trace the tracee
279 * @tracer: label of the task doing the tracing (NOT NULL)
280 * @tracee: task label to be traced
281 * @request: permission request
282 *
283 * Returns: %0 else error code if permission denied or error
284 */
285int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
286 u32 request)
287{
288 struct aa_profile *profile;
289 u32 xrequest = request << PTRACE_PERM_SHIFT;
290 DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_PTRACE, OP_PTRACE);
291
292 return xcheck_labels(tracer, tracee, profile,
293 profile_tracer_perm(profile, tracee, request, &sa),
294 profile_tracee_perm(profile, tracer, xrequest, &sa));
295}