Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor network mediation
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
9 */
10
11#include "include/apparmor.h"
12#include "include/audit.h"
13#include "include/cred.h"
14#include "include/label.h"
15#include "include/net.h"
16#include "include/policy.h"
17#include "include/secid.h"
18
19#include "net_names.h"
20
21
22struct aa_sfs_entry aa_sfs_entry_network[] = {
23 AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK),
24 { }
25};
26
27static const char * const net_mask_names[] = {
28 "unknown",
29 "send",
30 "receive",
31 "unknown",
32
33 "create",
34 "shutdown",
35 "connect",
36 "unknown",
37
38 "setattr",
39 "getattr",
40 "setcred",
41 "getcred",
42
43 "chmod",
44 "chown",
45 "chgrp",
46 "lock",
47
48 "mmap",
49 "mprot",
50 "unknown",
51 "unknown",
52
53 "accept",
54 "bind",
55 "listen",
56 "unknown",
57
58 "setopt",
59 "getopt",
60 "unknown",
61 "unknown",
62
63 "unknown",
64 "unknown",
65 "unknown",
66 "unknown",
67};
68
69
70/* audit callback for net specific fields */
71void audit_net_cb(struct audit_buffer *ab, void *va)
72{
73 struct common_audit_data *sa = va;
74 struct apparmor_audit_data *ad = aad(sa);
75
76 if (address_family_names[sa->u.net->family])
77 audit_log_format(ab, " family=\"%s\"",
78 address_family_names[sa->u.net->family]);
79 else
80 audit_log_format(ab, " family=\"unknown(%d)\"",
81 sa->u.net->family);
82 if (sock_type_names[ad->net.type])
83 audit_log_format(ab, " sock_type=\"%s\"",
84 sock_type_names[ad->net.type]);
85 else
86 audit_log_format(ab, " sock_type=\"unknown(%d)\"",
87 ad->net.type);
88 audit_log_format(ab, " protocol=%d", ad->net.protocol);
89
90 if (ad->request & NET_PERMS_MASK) {
91 audit_log_format(ab, " requested_mask=");
92 aa_audit_perm_mask(ab, ad->request, NULL, 0,
93 net_mask_names, NET_PERMS_MASK);
94
95 if (ad->denied & NET_PERMS_MASK) {
96 audit_log_format(ab, " denied_mask=");
97 aa_audit_perm_mask(ab, ad->denied, NULL, 0,
98 net_mask_names, NET_PERMS_MASK);
99 }
100 }
101 if (ad->peer) {
102 audit_log_format(ab, " peer=");
103 aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,
104 FLAGS_NONE, GFP_ATOMIC);
105 }
106}
107
108/* Generic af perm */
109int aa_profile_af_perm(struct aa_profile *profile,
110 struct apparmor_audit_data *ad, u32 request, u16 family,
111 int type)
112{
113 struct aa_ruleset *rules = list_first_entry(&profile->rules,
114 typeof(*rules), list);
115 struct aa_perms perms = { };
116 aa_state_t state;
117 __be16 buffer[2];
118
119 AA_BUG(family >= AF_MAX);
120 AA_BUG(type < 0 || type >= SOCK_MAX);
121
122 if (profile_unconfined(profile))
123 return 0;
124 state = RULE_MEDIATES(rules, AA_CLASS_NET);
125 if (!state)
126 return 0;
127
128 buffer[0] = cpu_to_be16(family);
129 buffer[1] = cpu_to_be16((u16) type);
130 state = aa_dfa_match_len(rules->policy->dfa, state, (char *) &buffer,
131 4);
132 perms = *aa_lookup_perms(rules->policy, state);
133 aa_apply_modes_to_perms(profile, &perms);
134
135 return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
136}
137
138int aa_af_perm(const struct cred *subj_cred, struct aa_label *label,
139 const char *op, u32 request, u16 family, int type, int protocol)
140{
141 struct aa_profile *profile;
142 DEFINE_AUDIT_NET(ad, op, NULL, family, type, protocol);
143
144 return fn_for_each_confined(label, profile,
145 aa_profile_af_perm(profile, &ad, request, family,
146 type));
147}
148
149static int aa_label_sk_perm(const struct cred *subj_cred,
150 struct aa_label *label,
151 const char *op, u32 request,
152 struct sock *sk)
153{
154 struct aa_sk_ctx *ctx = aa_sock(sk);
155 int error = 0;
156
157 AA_BUG(!label);
158 AA_BUG(!sk);
159
160 if (ctx->label != kernel_t && !unconfined(label)) {
161 struct aa_profile *profile;
162 DEFINE_AUDIT_SK(ad, op, sk);
163
164 ad.subj_cred = subj_cred;
165 error = fn_for_each_confined(label, profile,
166 aa_profile_af_sk_perm(profile, &ad, request, sk));
167 }
168
169 return error;
170}
171
172int aa_sk_perm(const char *op, u32 request, struct sock *sk)
173{
174 struct aa_label *label;
175 int error;
176
177 AA_BUG(!sk);
178 AA_BUG(in_interrupt());
179
180 /* TODO: switch to begin_current_label ???? */
181 label = begin_current_label_crit_section();
182 error = aa_label_sk_perm(current_cred(), label, op, request, sk);
183 end_current_label_crit_section(label);
184
185 return error;
186}
187
188
189int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label,
190 const char *op, u32 request, struct socket *sock)
191{
192 AA_BUG(!label);
193 AA_BUG(!sock);
194 AA_BUG(!sock->sk);
195
196 return aa_label_sk_perm(subj_cred, label, op, request, sock->sk);
197}
198
199#ifdef CONFIG_NETWORK_SECMARK
200static int apparmor_secmark_init(struct aa_secmark *secmark)
201{
202 struct aa_label *label;
203
204 if (secmark->label[0] == '*') {
205 secmark->secid = AA_SECID_WILDCARD;
206 return 0;
207 }
208
209 label = aa_label_strn_parse(&root_ns->unconfined->label,
210 secmark->label, strlen(secmark->label),
211 GFP_ATOMIC, false, false);
212
213 if (IS_ERR(label))
214 return PTR_ERR(label);
215
216 secmark->secid = label->secid;
217
218 return 0;
219}
220
221static int aa_secmark_perm(struct aa_profile *profile, u32 request, u32 secid,
222 struct apparmor_audit_data *ad)
223{
224 int i, ret;
225 struct aa_perms perms = { };
226 struct aa_ruleset *rules = list_first_entry(&profile->rules,
227 typeof(*rules), list);
228
229 if (rules->secmark_count == 0)
230 return 0;
231
232 for (i = 0; i < rules->secmark_count; i++) {
233 if (!rules->secmark[i].secid) {
234 ret = apparmor_secmark_init(&rules->secmark[i]);
235 if (ret)
236 return ret;
237 }
238
239 if (rules->secmark[i].secid == secid ||
240 rules->secmark[i].secid == AA_SECID_WILDCARD) {
241 if (rules->secmark[i].deny)
242 perms.deny = ALL_PERMS_MASK;
243 else
244 perms.allow = ALL_PERMS_MASK;
245
246 if (rules->secmark[i].audit)
247 perms.audit = ALL_PERMS_MASK;
248 }
249 }
250
251 aa_apply_modes_to_perms(profile, &perms);
252
253 return aa_check_perms(profile, &perms, request, ad, audit_net_cb);
254}
255
256int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
257 u32 secid, const struct sock *sk)
258{
259 struct aa_profile *profile;
260 DEFINE_AUDIT_SK(ad, op, sk);
261
262 return fn_for_each_confined(label, profile,
263 aa_secmark_perm(profile, request, secid,
264 &ad));
265}
266#endif
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor network mediation
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
9 */
10
11#include "include/apparmor.h"
12#include "include/audit.h"
13#include "include/cred.h"
14#include "include/label.h"
15#include "include/net.h"
16#include "include/policy.h"
17#include "include/secid.h"
18
19#include "net_names.h"
20
21
22struct aa_sfs_entry aa_sfs_entry_network[] = {
23 AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK),
24 { }
25};
26
27static const char * const net_mask_names[] = {
28 "unknown",
29 "send",
30 "receive",
31 "unknown",
32
33 "create",
34 "shutdown",
35 "connect",
36 "unknown",
37
38 "setattr",
39 "getattr",
40 "setcred",
41 "getcred",
42
43 "chmod",
44 "chown",
45 "chgrp",
46 "lock",
47
48 "mmap",
49 "mprot",
50 "unknown",
51 "unknown",
52
53 "accept",
54 "bind",
55 "listen",
56 "unknown",
57
58 "setopt",
59 "getopt",
60 "unknown",
61 "unknown",
62
63 "unknown",
64 "unknown",
65 "unknown",
66 "unknown",
67};
68
69
70/* audit callback for net specific fields */
71void audit_net_cb(struct audit_buffer *ab, void *va)
72{
73 struct common_audit_data *sa = va;
74
75 if (address_family_names[sa->u.net->family])
76 audit_log_format(ab, " family=\"%s\"",
77 address_family_names[sa->u.net->family]);
78 else
79 audit_log_format(ab, " family=\"unknown(%d)\"",
80 sa->u.net->family);
81 if (sock_type_names[aad(sa)->net.type])
82 audit_log_format(ab, " sock_type=\"%s\"",
83 sock_type_names[aad(sa)->net.type]);
84 else
85 audit_log_format(ab, " sock_type=\"unknown(%d)\"",
86 aad(sa)->net.type);
87 audit_log_format(ab, " protocol=%d", aad(sa)->net.protocol);
88
89 if (aad(sa)->request & NET_PERMS_MASK) {
90 audit_log_format(ab, " requested_mask=");
91 aa_audit_perm_mask(ab, aad(sa)->request, NULL, 0,
92 net_mask_names, NET_PERMS_MASK);
93
94 if (aad(sa)->denied & NET_PERMS_MASK) {
95 audit_log_format(ab, " denied_mask=");
96 aa_audit_perm_mask(ab, aad(sa)->denied, NULL, 0,
97 net_mask_names, NET_PERMS_MASK);
98 }
99 }
100 if (aad(sa)->peer) {
101 audit_log_format(ab, " peer=");
102 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
103 FLAGS_NONE, GFP_ATOMIC);
104 }
105}
106
107/* Generic af perm */
108int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
109 u32 request, u16 family, int type)
110{
111 struct aa_ruleset *rules = list_first_entry(&profile->rules,
112 typeof(*rules), list);
113 struct aa_perms perms = { };
114 aa_state_t state;
115 __be16 buffer[2];
116
117 AA_BUG(family >= AF_MAX);
118 AA_BUG(type < 0 || type >= SOCK_MAX);
119
120 if (profile_unconfined(profile))
121 return 0;
122 state = RULE_MEDIATES(rules, AA_CLASS_NET);
123 if (!state)
124 return 0;
125
126 buffer[0] = cpu_to_be16(family);
127 buffer[1] = cpu_to_be16((u16) type);
128 state = aa_dfa_match_len(rules->policy.dfa, state, (char *) &buffer,
129 4);
130 perms = *aa_lookup_perms(&rules->policy, state);
131 aa_apply_modes_to_perms(profile, &perms);
132
133 return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
134}
135
136int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
137 int type, int protocol)
138{
139 struct aa_profile *profile;
140 DEFINE_AUDIT_NET(sa, op, NULL, family, type, protocol);
141
142 return fn_for_each_confined(label, profile,
143 aa_profile_af_perm(profile, &sa, request, family,
144 type));
145}
146
147static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
148 struct sock *sk)
149{
150 struct aa_sk_ctx *ctx = SK_CTX(sk);
151 int error = 0;
152
153 AA_BUG(!label);
154 AA_BUG(!sk);
155
156 if (ctx->label != kernel_t && !unconfined(label)) {
157 struct aa_profile *profile;
158 DEFINE_AUDIT_SK(sa, op, sk);
159
160 error = fn_for_each_confined(label, profile,
161 aa_profile_af_sk_perm(profile, &sa, request, sk));
162 }
163
164 return error;
165}
166
167int aa_sk_perm(const char *op, u32 request, struct sock *sk)
168{
169 struct aa_label *label;
170 int error;
171
172 AA_BUG(!sk);
173 AA_BUG(in_interrupt());
174
175 /* TODO: switch to begin_current_label ???? */
176 label = begin_current_label_crit_section();
177 error = aa_label_sk_perm(label, op, request, sk);
178 end_current_label_crit_section(label);
179
180 return error;
181}
182
183
184int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
185 struct socket *sock)
186{
187 AA_BUG(!label);
188 AA_BUG(!sock);
189 AA_BUG(!sock->sk);
190
191 return aa_label_sk_perm(label, op, request, sock->sk);
192}
193
194#ifdef CONFIG_NETWORK_SECMARK
195static int apparmor_secmark_init(struct aa_secmark *secmark)
196{
197 struct aa_label *label;
198
199 if (secmark->label[0] == '*') {
200 secmark->secid = AA_SECID_WILDCARD;
201 return 0;
202 }
203
204 label = aa_label_strn_parse(&root_ns->unconfined->label,
205 secmark->label, strlen(secmark->label),
206 GFP_ATOMIC, false, false);
207
208 if (IS_ERR(label))
209 return PTR_ERR(label);
210
211 secmark->secid = label->secid;
212
213 return 0;
214}
215
216static int aa_secmark_perm(struct aa_profile *profile, u32 request, u32 secid,
217 struct common_audit_data *sa)
218{
219 int i, ret;
220 struct aa_perms perms = { };
221 struct aa_ruleset *rules = list_first_entry(&profile->rules,
222 typeof(*rules), list);
223
224 if (rules->secmark_count == 0)
225 return 0;
226
227 for (i = 0; i < rules->secmark_count; i++) {
228 if (!rules->secmark[i].secid) {
229 ret = apparmor_secmark_init(&rules->secmark[i]);
230 if (ret)
231 return ret;
232 }
233
234 if (rules->secmark[i].secid == secid ||
235 rules->secmark[i].secid == AA_SECID_WILDCARD) {
236 if (rules->secmark[i].deny)
237 perms.deny = ALL_PERMS_MASK;
238 else
239 perms.allow = ALL_PERMS_MASK;
240
241 if (rules->secmark[i].audit)
242 perms.audit = ALL_PERMS_MASK;
243 }
244 }
245
246 aa_apply_modes_to_perms(profile, &perms);
247
248 return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
249}
250
251int apparmor_secmark_check(struct aa_label *label, char *op, u32 request,
252 u32 secid, const struct sock *sk)
253{
254 struct aa_profile *profile;
255 DEFINE_AUDIT_SK(sa, op, sk);
256
257 return fn_for_each_confined(label, profile,
258 aa_secmark_perm(profile, request, secid,
259 &sa));
260}
261#endif