Commit 6bdfe2d8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'apparmor-pr-2023-11-03' of... 

Merge tag 'apparmor-pr-2023-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor updates from John Johansen:
 "This adds initial support for mediating io_uring and userns creation.
  Adds a new restriction that tightens the use of change_profile, and a
  couple of optimizations to reduce performance bottle necks that have
  been found when retrieving the current task's secid and allocating
  work buffers.

  The majority of the patch set continues cleaning up and simplifying
  the code (fixing comments, removing now dead functions, and macros
  etc). Finally there are 4 bug fixes, with the regression fix having
  had a couple months of testing.

  Features:
   - optimize retrieving current task secid
   - add base io_uring mediation
   - add base userns mediation
   - improve buffer allocation
   - allow restricting unprivilege change_profile

  Cleanups:
   - Fix kernel doc comments
   - remove unused declarations
   - remove unused functions
   - remove unneeded #ifdef
   - remove unused macros
   - mark fns static
   - cleanup fn with unused return values
   - cleanup audit data
   - pass cred through to audit data
   - refcount the pdb instead of using duplicates
   - make SK_CTX macro an inline fn
   - some comment cleanups

  Bug fixes:
   - fix regression in mount mediation
   - fix invalid refenece
   - use passed in gfp flags
   - advertise avaiability of extended perms and disconnected.path"

* tag 'apparmor-pr-2023-11-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (39 commits)
  apparmor: Fix some kernel-doc comments
  apparmor: Fix one kernel-doc comment
  apparmor: Fix some kernel-doc comments
  apparmor: mark new functions static
  apparmor: Fix regression in mount mediation
  apparmor: cache buffers on percpu list if there is lock contention
  apparmor: add io_uring mediation
  apparmor: add user namespace creation mediation
  apparmor: allow restricting unprivileged change_profile
  apparmor: advertise disconnected.path is available
  apparmor: refcount the pdb
  apparmor: provide separate audit messages for file and policy checks
  apparmor: pass cred through to audit info.
  apparmor: rename audit_data->label to audit_data->subj_label
  apparmor: combine common_audit_data and apparmor_audit_data
  apparmor: rename SK_CTX() to aa_sock and make it an inline fn
  apparmor: Optimize retrieving current task secid
  apparmor: remove unused functions in policy_ns.c/.h
  apparmor: remove unneeded #ifdef in decompress_zstd()
  apparmor: fix invalid reference on profile->disconnected
  ...
parents 136cc1e1 6cede101

security/apparmor/apparmorfs.c

+34 −15
Original line number Diff line number Diff line
@@ -423,7 +423,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, 
	/* high level check about policy management - fine grained in

	 * below after unpack

	 */

	error = aa_may_manage_policy(label, ns, mask);

	error = aa_may_manage_policy(current_cred(), label, ns, mask);

	if (error)

		goto end_section;
@@ -486,7 +486,8 @@ static ssize_t profile_remove(struct file *f, const char __user *buf, 
	/* high level check about policy management - fine grained in

	 * below after unpack

	 */

	error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);

	error = aa_may_manage_policy(current_cred(), label, ns,

				     AA_MAY_REMOVE_POLICY);

	if (error)

		goto out;
@@ -618,23 +619,23 @@ static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms, 


	if (profile_unconfined(profile))

		return;

	if (rules->file.dfa && *match_str == AA_CLASS_FILE) {

		state = aa_dfa_match_len(rules->file.dfa,

					 rules->file.start[AA_CLASS_FILE],

	if (rules->file->dfa && *match_str == AA_CLASS_FILE) {

		state = aa_dfa_match_len(rules->file->dfa,

					 rules->file->start[AA_CLASS_FILE],

					 match_str + 1, match_len - 1);

		if (state) {

			struct path_cond cond = { };



			tmp = *(aa_lookup_fperms(&(rules->file), state, &cond));

			tmp = *(aa_lookup_fperms(rules->file, state, &cond));

		}

	} else if (rules->policy.dfa) {

	} else if (rules->policy->dfa) {

		if (!RULE_MEDIATES(rules, *match_str))

			return;	/* no change to current perms */

		state = aa_dfa_match_len(rules->policy.dfa,

					 rules->policy.start[0],

		state = aa_dfa_match_len(rules->policy->dfa,

					 rules->policy->start[0],

					 match_str, match_len);

		if (state)

			tmp = *aa_lookup_perms(&rules->policy, state);

			tmp = *aa_lookup_perms(rules->policy, state);

	}

	aa_apply_modes_to_perms(profile, &tmp);

	aa_perms_accum_raw(perms, &tmp);
@@ -1095,7 +1096,7 @@ static int seq_profile_attach_show(struct seq_file *seq, void *v) 
	struct aa_profile *profile = labels_profile(label);

	if (profile->attach.xmatch_str)

		seq_printf(seq, "%s\n", profile->attach.xmatch_str);

	else if (profile->attach.xmatch.dfa)

	else if (profile->attach.xmatch->dfa)

		seq_puts(seq, "<unknown>\n");

	else

		seq_printf(seq, "%s\n", profile->base.name);
@@ -1314,7 +1315,6 @@ SEQ_RAWDATA_FOPS(compressed_size); 


static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen)

{

#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY

	if (slen < dlen) {

		const size_t wksp_len = zstd_dctx_workspace_bound();

		zstd_dctx *ctx;
@@ -1341,7 +1341,6 @@ static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen) 
		kvfree(wksp);

		return ret;

	}

#endif



	if (dlen < slen)

		return -EINVAL;
@@ -1806,7 +1805,8 @@ static int ns_mkdir_op(struct mnt_idmap *idmap, struct inode *dir, 
	int error;



	label = begin_current_label_crit_section();

	error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);

	error = aa_may_manage_policy(current_cred(), label, NULL,

				     AA_MAY_LOAD_POLICY);

	end_current_label_crit_section(label);

	if (error)

		return error;
@@ -1855,7 +1855,8 @@ static int ns_rmdir_op(struct inode *dir, struct dentry *dentry) 
	int error;



	label = begin_current_label_crit_section();

	error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);

	error = aa_may_manage_policy(current_cred(), label, NULL,

				     AA_MAY_LOAD_POLICY);

	end_current_label_crit_section(label);

	if (error)

		return error;
@@ -2339,10 +2340,16 @@ static struct aa_sfs_entry aa_sfs_entry_domain[] = { 
	AA_SFS_FILE_BOOLEAN("post_nnp_subset",	1),

	AA_SFS_FILE_BOOLEAN("computed_longest_left",	1),

	AA_SFS_DIR("attach_conditions",		aa_sfs_entry_attach),

	AA_SFS_FILE_BOOLEAN("disconnected.path",            1),

	AA_SFS_FILE_STRING("version", "1.2"),

	{ }

};



static struct aa_sfs_entry aa_sfs_entry_unconfined[] = {

	AA_SFS_FILE_BOOLEAN("change_profile", 1),

	{ }

};



static struct aa_sfs_entry aa_sfs_entry_versions[] = {

	AA_SFS_FILE_BOOLEAN("v5",	1),

	AA_SFS_FILE_BOOLEAN("v6",	1),
@@ -2352,11 +2359,15 @@ static struct aa_sfs_entry aa_sfs_entry_versions[] = { 
	{ }

};



#define PERMS32STR "allow deny subtree cond kill complain prompt audit quiet hide xindex tag label"

static struct aa_sfs_entry aa_sfs_entry_policy[] = {

	AA_SFS_DIR("versions",			aa_sfs_entry_versions),

	AA_SFS_FILE_BOOLEAN("set_load",		1),

	/* number of out of band transitions supported */

	AA_SFS_FILE_U64("outofband",		MAX_OOB_SUPPORTED),

	AA_SFS_FILE_U64("permstable32_version",	1),

	AA_SFS_FILE_STRING("permstable32", PERMS32STR),

	AA_SFS_DIR("unconfined_restrictions",   aa_sfs_entry_unconfined),

	{ }

};
@@ -2368,6 +2379,7 @@ static struct aa_sfs_entry aa_sfs_entry_mount[] = { 
static struct aa_sfs_entry aa_sfs_entry_ns[] = {

	AA_SFS_FILE_BOOLEAN("profile",		1),

	AA_SFS_FILE_BOOLEAN("pivot_root",	0),

	AA_SFS_FILE_STRING("mask", "userns_create"),

	{ }

};
@@ -2382,6 +2394,12 @@ static struct aa_sfs_entry aa_sfs_entry_query[] = { 
	AA_SFS_DIR("label",			aa_sfs_entry_query_label),

	{ }

};



static struct aa_sfs_entry aa_sfs_entry_io_uring[] = {

	AA_SFS_FILE_STRING("mask", "sqpoll override_creds"),

	{ }

};



static struct aa_sfs_entry aa_sfs_entry_features[] = {

	AA_SFS_DIR("policy",			aa_sfs_entry_policy),

	AA_SFS_DIR("domain",			aa_sfs_entry_domain),
@@ -2395,6 +2413,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = { 
	AA_SFS_DIR("ptrace",			aa_sfs_entry_ptrace),

	AA_SFS_DIR("signal",			aa_sfs_entry_signal),

	AA_SFS_DIR("query",			aa_sfs_entry_query),

	AA_SFS_DIR("io_uring",			aa_sfs_entry_io_uring),

	{ }

};

security/apparmor/audit.c

+38 −37
Original line number Diff line number Diff line
@@ -58,8 +58,8 @@ static const char *const aa_class_names[] = { 
	"io_uring",

	"module",

	"lsm",

	"unknown",

	"unknown",

	"namespace",

	"io_uring",

	"unknown",

	"unknown",

	"unknown",
@@ -85,37 +85,36 @@ static const char *const aa_class_names[] = { 
/**

 * audit_pre() - core AppArmor function.

 * @ab: audit buffer to fill (NOT NULL)

 * @ca: audit structure containing data to audit (NOT NULL)

 * @va: audit structure containing data to audit (NOT NULL)

 *

 * Record common AppArmor audit data from @sa

 * Record common AppArmor audit data from @va

 */

static void audit_pre(struct audit_buffer *ab, void *ca)

static void audit_pre(struct audit_buffer *ab, void *va)

{

	struct common_audit_data *sa = ca;

	struct apparmor_audit_data *ad = aad_of_va(va);



	if (aa_g_audit_header) {

		audit_log_format(ab, "apparmor=\"%s\"",

				 aa_audit_type[aad(sa)->type]);

				 aa_audit_type[ad->type]);

	}



	if (aad(sa)->op) {

		audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);

	}

	if (ad->op)

		audit_log_format(ab, " operation=\"%s\"", ad->op);



	if (aad(sa)->class)

	if (ad->class)

		audit_log_format(ab, " class=\"%s\"",

				 aad(sa)->class <= AA_CLASS_LAST ?

				 aa_class_names[aad(sa)->class] :

				 ad->class <= AA_CLASS_LAST ?

				 aa_class_names[ad->class] :

				 "unknown");



	if (aad(sa)->info) {

		audit_log_format(ab, " info=\"%s\"", aad(sa)->info);

		if (aad(sa)->error)

			audit_log_format(ab, " error=%d", aad(sa)->error);

	if (ad->info) {

		audit_log_format(ab, " info=\"%s\"", ad->info);

		if (ad->error)

			audit_log_format(ab, " error=%d", ad->error);

	}



	if (aad(sa)->label) {

		struct aa_label *label = aad(sa)->label;

	if (ad->subj_label) {

		struct aa_label *label = ad->subj_label;



		if (label_isprofile(label)) {

			struct aa_profile *profile = labels_profile(label);
@@ -134,42 +133,44 @@ static void audit_pre(struct audit_buffer *ab, void *ca) 
		}

	}



	if (aad(sa)->name) {

	if (ad->name) {

		audit_log_format(ab, " name=");

		audit_log_untrustedstring(ab, aad(sa)->name);

		audit_log_untrustedstring(ab, ad->name);

	}

}



/**

 * aa_audit_msg - Log a message to the audit subsystem

 * @sa: audit event structure (NOT NULL)

 * @type: audit type for the message

 * @ad: audit event structure (NOT NULL)

 * @cb: optional callback fn for type specific fields (MAYBE NULL)

 */

void aa_audit_msg(int type, struct common_audit_data *sa,

void aa_audit_msg(int type, struct apparmor_audit_data *ad,

		  void (*cb) (struct audit_buffer *, void *))

{

	aad(sa)->type = type;

	common_lsm_audit(sa, audit_pre, cb);

	ad->type = type;

	common_lsm_audit(&ad->common, audit_pre, cb);

}



/**

 * aa_audit - Log a profile based audit event to the audit subsystem

 * @type: audit type for the message

 * @profile: profile to check against (NOT NULL)

 * @sa: audit event (NOT NULL)

 * @ad: audit event (NOT NULL)

 * @cb: optional callback fn for type specific fields (MAYBE NULL)

 *

 * Handle default message switching based off of audit mode flags

 *

 * Returns: error on failure

 */

int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,

int aa_audit(int type, struct aa_profile *profile,

	     struct apparmor_audit_data *ad,

	     void (*cb) (struct audit_buffer *, void *))

{

	AA_BUG(!profile);



	if (type == AUDIT_APPARMOR_AUTO) {

		if (likely(!aad(sa)->error)) {

		if (likely(!ad->error)) {

			if (AUDIT_MODE(profile) != AUDIT_ALL)

				return 0;

			type = AUDIT_APPARMOR_AUDIT;
@@ -181,24 +182,24 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa, 
	if (AUDIT_MODE(profile) == AUDIT_QUIET ||

	    (type == AUDIT_APPARMOR_DENIED &&

	     AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))

		return aad(sa)->error;

		return ad->error;



	if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)

		type = AUDIT_APPARMOR_KILL;



	aad(sa)->label = &profile->label;

	ad->subj_label = &profile->label;



	aa_audit_msg(type, sa, cb);

	aa_audit_msg(type, ad, cb);



	if (aad(sa)->type == AUDIT_APPARMOR_KILL)

	if (ad->type == AUDIT_APPARMOR_KILL)

		(void)send_sig_info(SIGKILL, NULL,

			sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?

				    sa->u.tsk : current);

			ad->common.type == LSM_AUDIT_DATA_TASK &&

			ad->common.u.tsk ? ad->common.u.tsk : current);



	if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)

		return complain_error(aad(sa)->error);

	if (ad->type == AUDIT_APPARMOR_ALLOWED)

		return complain_error(ad->error);



	return aad(sa)->error;

	return ad->error;

}



struct aa_audit_rule {

security/apparmor/capability.c

+18 −15
Original line number Diff line number Diff line
@@ -38,8 +38,8 @@ static DEFINE_PER_CPU(struct audit_cache, audit_cache); 


/**

 * audit_cb - call back for capability components of audit struct

 * @ab - audit buffer   (NOT NULL)

 * @va - audit struct to audit data from  (NOT NULL)

 * @ab: audit buffer   (NOT NULL)

 * @va: audit struct to audit data from  (NOT NULL)

 */

static void audit_cb(struct audit_buffer *ab, void *va)

{
@@ -51,7 +51,7 @@ static void audit_cb(struct audit_buffer *ab, void *va) 


/**

 * audit_caps - audit a capability

 * @sa: audit data

 * @ad: audit data

 * @profile: profile being tested for confinement (NOT NULL)

 * @cap: capability tested

 * @error: error code returned by test
@@ -59,9 +59,9 @@ static void audit_cb(struct audit_buffer *ab, void *va) 
 * Do auditing of capability and handle, audit/complain/kill modes switching

 * and duplicate message elimination.

 *

 * Returns: 0 or sa->error on success,  error code on failure

 * Returns: 0 or ad->error on success,  error code on failure

 */

static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,

static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile,

		      int cap, int error)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,
@@ -69,7 +69,7 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, 
	struct audit_cache *ent;

	int type = AUDIT_APPARMOR_AUTO;



	aad(sa)->error = error;

	ad->error = error;



	if (likely(!error)) {

		/* test if auditing is being forced */
@@ -101,7 +101,7 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, 
	}

	put_cpu_var(audit_cache);



	return aa_audit(type, profile, sa, audit_cb);

	return aa_audit(type, profile, ad, audit_cb);

}



/**
@@ -109,12 +109,12 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, 
 * @profile: profile being enforced    (NOT NULL, NOT unconfined)

 * @cap: capability to test if allowed

 * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated

 * @sa: audit data (MAY BE NULL indicating no auditing)

 * @ad: audit data (MAY BE NULL indicating no auditing)

 *

 * Returns: 0 if allowed else -EPERM

 */

static int profile_capable(struct aa_profile *profile, int cap,

			   unsigned int opts, struct common_audit_data *sa)

			   unsigned int opts, struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);
@@ -132,14 +132,15 @@ static int profile_capable(struct aa_profile *profile, int cap, 
		/* audit the cap request in complain mode but note that it

		 * should be optional.

		 */

		aad(sa)->info = "optional: no audit";

		ad->info = "optional: no audit";

	}



	return audit_caps(sa, profile, cap, error);

	return audit_caps(ad, profile, cap, error);

}



/**

 * aa_capable - test permission to use capability

 * @subj_cred: cred we are testing capability against

 * @label: label being tested for capability (NOT NULL)

 * @cap: capability to be tested

 * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
@@ -148,15 +149,17 @@ static int profile_capable(struct aa_profile *profile, int cap, 
 *

 * Returns: 0 on success, or else an error code.

 */

int aa_capable(struct aa_label *label, int cap, unsigned int opts)

int aa_capable(const struct cred *subj_cred, struct aa_label *label,

	       int cap, unsigned int opts)

{

	struct aa_profile *profile;

	int error = 0;

	DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE);

	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE);



	sa.u.cap = cap;

	ad.subj_cred = subj_cred;

	ad.common.u.cap = cap;

	error = fn_for_each_confined(label, profile,

			profile_capable(profile, cap, opts, &sa));

			profile_capable(profile, cap, opts, &ad));



	return error;

}

security/apparmor/domain.c

+125 −68

File changed.

Preview size limit exceeded, changes collapsed.

security/apparmor/file.c

+131 −86
Original line number Diff line number Diff line
@@ -44,38 +44,40 @@ static u32 map_mask_to_chr_mask(u32 mask) 
static void file_audit_cb(struct audit_buffer *ab, void *va)

{

	struct common_audit_data *sa = va;

	kuid_t fsuid = current_fsuid();

	struct apparmor_audit_data *ad = aad(sa);

	kuid_t fsuid = ad->subj_cred ? ad->subj_cred->fsuid : current_fsuid();

	char str[10];



	if (aad(sa)->request & AA_AUDIT_FILE_MASK) {

	if (ad->request & AA_AUDIT_FILE_MASK) {

		aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,

				    map_mask_to_chr_mask(aad(sa)->request));

				    map_mask_to_chr_mask(ad->request));

		audit_log_format(ab, " requested_mask=\"%s\"", str);

	}

	if (aad(sa)->denied & AA_AUDIT_FILE_MASK) {

	if (ad->denied & AA_AUDIT_FILE_MASK) {

		aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,

				    map_mask_to_chr_mask(aad(sa)->denied));

				    map_mask_to_chr_mask(ad->denied));

		audit_log_format(ab, " denied_mask=\"%s\"", str);

	}

	if (aad(sa)->request & AA_AUDIT_FILE_MASK) {

	if (ad->request & AA_AUDIT_FILE_MASK) {

		audit_log_format(ab, " fsuid=%d",

				 from_kuid(&init_user_ns, fsuid));

		audit_log_format(ab, " ouid=%d",

				 from_kuid(&init_user_ns, aad(sa)->fs.ouid));

				 from_kuid(&init_user_ns, ad->fs.ouid));

	}



	if (aad(sa)->peer) {

	if (ad->peer) {

		audit_log_format(ab, " target=");

		aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,

		aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,

				FLAG_VIEW_SUBNS, GFP_KERNEL);

	} else if (aad(sa)->fs.target) {

	} else if (ad->fs.target) {

		audit_log_format(ab, " target=");

		audit_log_untrustedstring(ab, aad(sa)->fs.target);

		audit_log_untrustedstring(ab, ad->fs.target);

	}

}



/**

 * aa_audit_file - handle the auditing of file operations

 * @subj_cred: cred of the subject

 * @profile: the profile being enforced  (NOT NULL)

 * @perms: the permissions computed for the request (NOT NULL)

 * @op: operation being mediated
@@ -89,59 +91,74 @@ static void file_audit_cb(struct audit_buffer *ab, void *va) 
 *

 * Returns: %0 or error on failure

 */

int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,

int aa_audit_file(const struct cred *subj_cred,

		  struct aa_profile *profile, struct aa_perms *perms,

		  const char *op, u32 request, const char *name,

		  const char *target, struct aa_label *tlabel,

		  kuid_t ouid, const char *info, int error)

{

	int type = AUDIT_APPARMOR_AUTO;

	DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);



	sa.u.tsk = NULL;

	aad(&sa)->request = request;

	aad(&sa)->name = name;

	aad(&sa)->fs.target = target;

	aad(&sa)->peer = tlabel;

	aad(&sa)->fs.ouid = ouid;

	aad(&sa)->info = info;

	aad(&sa)->error = error;

	sa.u.tsk = NULL;



	if (likely(!aad(&sa)->error)) {

	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);



	ad.subj_cred = subj_cred;

	ad.request = request;

	ad.name = name;

	ad.fs.target = target;

	ad.peer = tlabel;

	ad.fs.ouid = ouid;

	ad.info = info;

	ad.error = error;

	ad.common.u.tsk = NULL;



	if (likely(!ad.error)) {

		u32 mask = perms->audit;



		if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))

			mask = 0xffff;



		/* mask off perms that are not being force audited */

		aad(&sa)->request &= mask;

		ad.request &= mask;



		if (likely(!aad(&sa)->request))

		if (likely(!ad.request))

			return 0;

		type = AUDIT_APPARMOR_AUDIT;

	} else {

		/* only report permissions that were denied */

		aad(&sa)->request = aad(&sa)->request & ~perms->allow;

		AA_BUG(!aad(&sa)->request);

		ad.request = ad.request & ~perms->allow;

		AA_BUG(!ad.request);



		if (aad(&sa)->request & perms->kill)

		if (ad.request & perms->kill)

			type = AUDIT_APPARMOR_KILL;



		/* quiet known rejects, assumes quiet and kill do not overlap */

		if ((aad(&sa)->request & perms->quiet) &&

		if ((ad.request & perms->quiet) &&

		    AUDIT_MODE(profile) != AUDIT_NOQUIET &&

		    AUDIT_MODE(profile) != AUDIT_ALL)

			aad(&sa)->request &= ~perms->quiet;

			ad.request &= ~perms->quiet;



		if (!aad(&sa)->request)

			return aad(&sa)->error;

		if (!ad.request)

			return ad.error;

	}



	aad(&sa)->denied = aad(&sa)->request & ~perms->allow;

	return aa_audit(type, profile, &sa, file_audit_cb);

	ad.denied = ad.request & ~perms->allow;

	return aa_audit(type, profile, &ad, file_audit_cb);

}



static int path_name(const char *op, struct aa_label *label,

/**

 * is_deleted - test if a file has been completely unlinked

 * @dentry: dentry of file to test for deletion  (NOT NULL)

 *

 * Returns: true if deleted else false

 */

static inline bool is_deleted(struct dentry *dentry)

{

	if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0)

		return true;

	return false;

}



static int path_name(const char *op, const struct cred *subj_cred,

		     struct aa_label *label,

		     const struct path *path, int flags, char *buffer,

		     const char **name, struct path_cond *cond, u32 request)

{
@@ -153,7 +170,8 @@ static int path_name(const char *op, struct aa_label *label, 
			     labels_profile(label)->disconnected);

	if (error) {

		fn_for_each_confined(label, profile,

			aa_audit_file(profile, &nullperms, op, request, *name,

			aa_audit_file(subj_cred,

				      profile, &nullperms, op, request, *name,

				      NULL, NULL, cond->uid, info, error));

		return error;

	}
@@ -164,7 +182,7 @@ static int path_name(const char *op, struct aa_label *label, 
struct aa_perms default_perms = {};

/**

 * aa_lookup_fperms - convert dfa compressed perms to internal perms

 * @dfa: dfa to lookup perms for   (NOT NULL)

 * @file_rules: the aa_policydb to lookup perms for  (NOT NULL)

 * @state: state in dfa

 * @cond:  conditions to consider  (NOT NULL)

 *
@@ -188,8 +206,8 @@ struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules, 


/**

 * aa_str_perms - find permission that match @name

 * @dfa: to match against  (MAYBE NULL)

 * @state: state to start matching in

 * @file_rules: the aa_policydb to match against  (NOT NULL)

 * @start: state to start matching in

 * @name: string to match against dfa  (NOT NULL)

 * @cond: conditions to consider for permission set computation  (NOT NULL)

 * @perms: Returns - the permissions found when matching @name
@@ -207,9 +225,9 @@ aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start, 
	return state;

}



static int __aa_path_perm(const char *op, struct aa_profile *profile,

			  const char *name, u32 request,

			  struct path_cond *cond, int flags,

static int __aa_path_perm(const char *op, const struct cred *subj_cred,

			  struct aa_profile *profile, const char *name,

			  u32 request, struct path_cond *cond, int flags,

			  struct aa_perms *perms)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,
@@ -218,16 +236,18 @@ static int __aa_path_perm(const char *op, struct aa_profile *profile, 


	if (profile_unconfined(profile))

		return 0;

	aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE],

	aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],

		     name, cond, perms);

	if (request & ~perms->allow)

		e = -EACCES;

	return aa_audit_file(profile, perms, op, request, name, NULL, NULL,

	return aa_audit_file(subj_cred,

			     profile, perms, op, request, name, NULL, NULL,

			     cond->uid, NULL, e);

}





static int profile_path_perm(const char *op, struct aa_profile *profile,

static int profile_path_perm(const char *op, const struct cred *subj_cred,

			     struct aa_profile *profile,

			     const struct path *path, char *buffer, u32 request,

			     struct path_cond *cond, int flags,

			     struct aa_perms *perms)
@@ -238,18 +258,19 @@ static int profile_path_perm(const char *op, struct aa_profile *profile, 
	if (profile_unconfined(profile))

		return 0;



	error = path_name(op, &profile->label, path,

	error = path_name(op, subj_cred, &profile->label, path,

			  flags | profile->path_flags, buffer, &name, cond,

			  request);

	if (error)

		return error;

	return __aa_path_perm(op, profile, name, request, cond, flags,

			      perms);

	return __aa_path_perm(op, subj_cred, profile, name, request, cond,

			      flags, perms);

}



/**

 * aa_path_perm - do permissions check & audit for @path

 * @op: operation being checked

 * @subj_cred: subject cred

 * @label: profile being enforced  (NOT NULL)

 * @path: path to check permissions of  (NOT NULL)

 * @flags: any additional path flags beyond what the profile specifies
@@ -258,7 +279,8 @@ static int profile_path_perm(const char *op, struct aa_profile *profile, 
 *

 * Returns: %0 else error if access denied or other error

 */

int aa_path_perm(const char *op, struct aa_label *label,

int aa_path_perm(const char *op, const struct cred *subj_cred,

		 struct aa_label *label,

		 const struct path *path, int flags, u32 request,

		 struct path_cond *cond)

{
@@ -273,8 +295,8 @@ int aa_path_perm(const char *op, struct aa_label *label, 
	if (!buffer)

		return -ENOMEM;

	error = fn_for_each_confined(label, profile,

			profile_path_perm(op, profile, path, buffer, request,

					  cond, flags, &perms));

			profile_path_perm(op, subj_cred, profile, path, buffer,

					  request, cond, flags, &perms));



	aa_put_buffer(buffer);
@@ -301,7 +323,8 @@ static inline bool xindex_is_subset(u32 link, u32 target) 
	return true;

}



static int profile_path_link(struct aa_profile *profile,

static int profile_path_link(const struct cred *subj_cred,

			     struct aa_profile *profile,

			     const struct path *link, char *buffer,

			     const struct path *target, char *buffer2,

			     struct path_cond *cond)
@@ -315,29 +338,31 @@ static int profile_path_link(struct aa_profile *profile, 
	aa_state_t state;

	int error;



	error = path_name(OP_LINK, &profile->label, link, profile->path_flags,

	error = path_name(OP_LINK, subj_cred, &profile->label, link,

			  profile->path_flags,

			  buffer, &lname, cond, AA_MAY_LINK);

	if (error)

		goto audit;



	/* buffer2 freed below, tname is pointer in buffer2 */

	error = path_name(OP_LINK, &profile->label, target, profile->path_flags,

	error = path_name(OP_LINK, subj_cred, &profile->label, target,

			  profile->path_flags,

			  buffer2, &tname, cond, AA_MAY_LINK);

	if (error)

		goto audit;



	error = -EACCES;

	/* aa_str_perms - handles the case of the dfa being NULL */

	state = aa_str_perms(&(rules->file),

			     rules->file.start[AA_CLASS_FILE], lname,

	state = aa_str_perms(rules->file,

			     rules->file->start[AA_CLASS_FILE], lname,

			     cond, &lperms);



	if (!(lperms.allow & AA_MAY_LINK))

		goto audit;



	/* test to see if target can be paired with link */

	state = aa_dfa_null_transition(rules->file.dfa, state);

	aa_str_perms(&(rules->file), state, tname, cond, &perms);

	state = aa_dfa_null_transition(rules->file->dfa, state);

	aa_str_perms(rules->file, state, tname, cond, &perms);



	/* force audit/quiet masks for link are stored in the second entry

	 * in the link pair.
@@ -359,7 +384,7 @@ static int profile_path_link(struct aa_profile *profile, 
	/* Do link perm subset test requiring allowed permission on link are

	 * a subset of the allowed permissions on target.

	 */

	aa_str_perms(&(rules->file), rules->file.start[AA_CLASS_FILE],

	aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE],

		     tname, cond, &perms);



	/* AA_MAY_LINK is not considered in the subset test */
@@ -381,12 +406,14 @@ static int profile_path_link(struct aa_profile *profile, 
	error = 0;



audit:

	return aa_audit_file(profile, &lperms, OP_LINK, request, lname, tname,

	return aa_audit_file(subj_cred,

			     profile, &lperms, OP_LINK, request, lname, tname,

			     NULL, cond->uid, info, error);

}



/**

 * aa_path_link - Handle hard link permission check

 * @subj_cred: subject cred

 * @label: the label being enforced  (NOT NULL)

 * @old_dentry: the target dentry  (NOT NULL)

 * @new_dir: directory the new link will be created in  (NOT NULL)
@@ -403,7 +430,8 @@ static int profile_path_link(struct aa_profile *profile, 
 *

 * Returns: %0 if allowed else error

 */

int aa_path_link(struct aa_label *label, struct dentry *old_dentry,

int aa_path_link(const struct cred *subj_cred,

		 struct aa_label *label, struct dentry *old_dentry,

		 const struct path *new_dir, struct dentry *new_dentry)

{

	struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
@@ -424,8 +452,8 @@ int aa_path_link(struct aa_label *label, struct dentry *old_dentry, 
		goto out;



	error = fn_for_each_confined(label, profile,

			profile_path_link(profile, &link, buffer, &target,

					  buffer2, &cond));

			profile_path_link(subj_cred, profile, &link, buffer,

					  &target, buffer2, &cond));

out:

	aa_put_buffer(buffer);

	aa_put_buffer(buffer2);
@@ -453,7 +481,8 @@ static void update_file_ctx(struct aa_file_ctx *fctx, struct aa_label *label, 
	spin_unlock(&fctx->lock);

}



static int __file_path_perm(const char *op, struct aa_label *label,

static int __file_path_perm(const char *op, const struct cred *subj_cred,

			    struct aa_label *label,

			    struct aa_label *flabel, struct file *file,

			    u32 request, u32 denied, bool in_atomic)

{
@@ -480,7 +509,8 @@ static int __file_path_perm(const char *op, struct aa_label *label, 


	/* check every profile in task label not in current cache */

	error = fn_for_each_not_in_set(flabel, label, profile,

			profile_path_perm(op, profile, &file->f_path, buffer,

			profile_path_perm(op, subj_cred, profile,

					  &file->f_path, buffer,

					  request, &cond, flags, &perms));

	if (denied && !error) {

		/*
@@ -493,12 +523,14 @@ static int __file_path_perm(const char *op, struct aa_label *label, 
		 */

		if (label == flabel)

			error = fn_for_each(label, profile,

				profile_path_perm(op, profile, &file->f_path,

				profile_path_perm(op, subj_cred,

						  profile, &file->f_path,

						  buffer, request, &cond, flags,

						  &perms));

		else

			error = fn_for_each_not_in_set(label, flabel, profile,

				profile_path_perm(op, profile, &file->f_path,

				profile_path_perm(op, subj_cred,

						  profile, &file->f_path,

						  buffer, request, &cond, flags,

						  &perms));

	}
@@ -510,7 +542,8 @@ static int __file_path_perm(const char *op, struct aa_label *label, 
	return error;

}



static int __file_sock_perm(const char *op, struct aa_label *label,

static int __file_sock_perm(const char *op, const struct cred *subj_cred,

			    struct aa_label *label,

			    struct aa_label *flabel, struct file *file,

			    u32 request, u32 denied)

{
@@ -524,11 +557,12 @@ static int __file_sock_perm(const char *op, struct aa_label *label, 
		return 0;



	/* TODO: improve to skip profiles cached in flabel */

	error = aa_sock_file_perm(label, op, request, sock);

	error = aa_sock_file_perm(subj_cred, label, op, request, sock);

	if (denied) {

		/* TODO: improve to skip profiles checked above */

		/* check every profile in file label to is cached */

		last_error(error, aa_sock_file_perm(flabel, op, request, sock));

		last_error(error, aa_sock_file_perm(subj_cred, flabel, op,

						    request, sock));

	}

	if (!error)

		update_file_ctx(file_ctx(file), label, request);
@@ -539,6 +573,7 @@ static int __file_sock_perm(const char *op, struct aa_label *label, 
/**

 * aa_file_perm - do permission revalidation check & audit for @file

 * @op: operation being checked

 * @subj_cred: subject cred

 * @label: label being enforced   (NOT NULL)

 * @file: file to revalidate access permissions on  (NOT NULL)

 * @request: requested permissions
@@ -546,7 +581,8 @@ static int __file_sock_perm(const char *op, struct aa_label *label, 
 *

 * Returns: %0 if access allowed else error

 */

int aa_file_perm(const char *op, struct aa_label *label, struct file *file,

int aa_file_perm(const char *op, const struct cred *subj_cred,

		 struct aa_label *label, struct file *file,

		 u32 request, bool in_atomic)

{

	struct aa_file_ctx *fctx;
@@ -582,19 +618,19 @@ int aa_file_perm(const char *op, struct aa_label *label, struct file *file, 
	/* TODO: label cross check */



	if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry))

		error = __file_path_perm(op, label, flabel, file, request,

					 denied, in_atomic);

		error = __file_path_perm(op, subj_cred, label, flabel, file,

					 request, denied, in_atomic);



	else if (S_ISSOCK(file_inode(file)->i_mode))

		error = __file_sock_perm(op, label, flabel, file, request,

					 denied);

		error = __file_sock_perm(op, subj_cred, label, flabel, file,

					 request, denied);

	aa_put_label(flabel);



done:

	return error;

}



static void revalidate_tty(struct aa_label *label)

static void revalidate_tty(const struct cred *subj_cred, struct aa_label *label)

{

	struct tty_struct *tty;

	int drop_tty = 0;
@@ -612,8 +648,8 @@ static void revalidate_tty(struct aa_label *label) 
					     struct tty_file_private, list);

		file = file_priv->file;



		if (aa_file_perm(OP_INHERIT, label, file, MAY_READ | MAY_WRITE,

				 IN_ATOMIC))

		if (aa_file_perm(OP_INHERIT, subj_cred, label, file,

				 MAY_READ | MAY_WRITE, IN_ATOMIC))

			drop_tty = 1;

	}

	spin_unlock(&tty->files_lock);
@@ -623,12 +659,17 @@ static void revalidate_tty(struct aa_label *label) 
		no_tty();

}



struct cred_label {

	const struct cred *cred;

	struct aa_label *label;

};



static int match_file(const void *p, struct file *file, unsigned int fd)

{

	struct aa_label *label = (struct aa_label *)p;

	struct cred_label *cl = (struct cred_label *)p;



	if (aa_file_perm(OP_INHERIT, label, file, aa_map_file_to_perms(file),

			 IN_ATOMIC))

	if (aa_file_perm(OP_INHERIT, cl->cred, cl->label, file,

			 aa_map_file_to_perms(file), IN_ATOMIC))

		return fd + 1;

	return 0;

}
@@ -638,13 +679,17 @@ static int match_file(const void *p, struct file *file, unsigned int fd) 
void aa_inherit_files(const struct cred *cred, struct files_struct *files)

{

	struct aa_label *label = aa_get_newest_cred_label(cred);

	struct cred_label cl = {

		.cred = cred,

		.label = label,

	};

	struct file *devnull = NULL;

	unsigned int n;



	revalidate_tty(label);

	revalidate_tty(cred, label);



	/* Revalidate access to inherited open files. */

	n = iterate_fd(files, 0, match_file, label);

	n = iterate_fd(files, 0, match_file, &cl);

	if (!n) /* none found? */

		goto out;
@@ -654,7 +699,7 @@ void aa_inherit_files(const struct cred *cred, struct files_struct *files) 
	/* replace all the matching ones with this */

	do {

		replace_fd(n - 1, devnull, 0);

	} while ((n = iterate_fd(files, n, match_file, label)) != 0);

	} while ((n = iterate_fd(files, n, match_file, &cl)) != 0);

	if (devnull)

		fput(devnull);

out: