Commit 2e12c5f0 authored by John Johansen's avatar John Johansen
Browse files

apparmor: add additional flags to extended permission. 



This is a step towards merging the file and policy state machines.

With the switch to extended permissions the state machine's ACCEPT2
table became unused freeing it up to store state specific flags. The
first flags to be stored are FLAG_OWNER and FLAG other which paves the
way towards merging the file and policydb perms into a single
permission table.

Currently Lookups based on the objects ownership conditional will
still need separate fns, this will be address in a following patch.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent de4754c8

security/apparmor/apparmorfs.c

+3 −2
Original line number Diff line number Diff line
@@ -626,7 +626,8 @@ static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms, 
		if (state) {

			struct path_cond cond = { };



			tmp = *(aa_lookup_fperms(rules->file, state, &cond));

			tmp = *(aa_lookup_condperms(current_fsuid(),

						    rules->file, state, &cond));

		}

	} else if (rules->policy->dfa) {

		if (!RULE_MEDIATES(rules, *match_str))
@@ -2365,7 +2366,7 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = { 
	AA_SFS_FILE_BOOLEAN("set_load",		1),

	/* number of out of band transitions supported */

	AA_SFS_FILE_U64("outofband",		MAX_OOB_SUPPORTED),

	AA_SFS_FILE_U64("permstable32_version",	1),

	AA_SFS_FILE_U64("permstable32_version",	3),

	AA_SFS_FILE_STRING("permstable32", PERMS32STR),

	AA_SFS_FILE_U64("state32",	1),

	AA_SFS_DIR("unconfined_restrictions",   aa_sfs_entry_unconfined),

security/apparmor/domain.c

+6 −3
Original line number Diff line number Diff line
@@ -154,7 +154,8 @@ static int label_compound_match(struct aa_profile *profile, 
		if (!state)

			goto fail;

	}

	*perms = *(aa_lookup_fperms(rules->file, state, &cond));

	*perms = *(aa_lookup_condperms(current_fsuid(), rules->file, state,

				       &cond));

	aa_apply_modes_to_perms(profile, perms);

	if ((perms->allow & request) != request)

		return -EACCES;
@@ -209,7 +210,8 @@ static int label_components_match(struct aa_profile *profile, 
	return 0;



next:

	tmp = *(aa_lookup_fperms(rules->file, state, &cond));

	tmp = *(aa_lookup_condperms(current_fsuid(), rules->file, state,

				    &cond));

	aa_apply_modes_to_perms(profile, &tmp);

	aa_perms_accum(perms, &tmp);

	label_for_each_cont(i, label, tp) {
@@ -218,7 +220,8 @@ static int label_components_match(struct aa_profile *profile, 
		state = match_component(profile, tp, stack, start);

		if (!state)

			goto fail;

		tmp = *(aa_lookup_fperms(rules->file, state, &cond));

		tmp = *(aa_lookup_condperms(current_fsuid(), rules->file, state,

					    &cond));

		aa_apply_modes_to_perms(profile, &tmp);

		aa_perms_accum(perms, &tmp);

	}

security/apparmor/file.c

+14 −9
Original line number Diff line number Diff line
@@ -169,7 +169,8 @@ static int path_name(const char *op, const struct cred *subj_cred, 
struct aa_perms default_perms = {};

/**

 * aa_lookup_fperms - convert dfa compressed perms to internal perms

 * @file_rules: the aa_policydb to lookup perms for  (NOT NULL)

 * @subj_uid: uid to use for subject owner test

 * @rules: the aa_policydb to lookup perms for  (NOT NULL)

 * @state: state in dfa

 * @cond:  conditions to consider  (NOT NULL)

 *
@@ -177,18 +178,21 @@ struct aa_perms default_perms = {}; 
 *

 * Returns: a pointer to a file permission set

 */

struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,

struct aa_perms *aa_lookup_condperms(kuid_t subj_uid, struct aa_policydb *rules,

				     aa_state_t state, struct path_cond *cond)

{

	unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state];

	unsigned int index = ACCEPT_TABLE(rules->dfa)[state];



	if (!(file_rules->perms))

	if (!(rules->perms))

		return &default_perms;



	if (uid_eq(current_fsuid(), cond->uid))

		return &(file_rules->perms[index]);

	if ((ACCEPT_TABLE2(rules->dfa)[state] & ACCEPT_FLAG_OWNER)) {

		if (uid_eq(subj_uid, cond->uid))

			return &(rules->perms[index]);

		return &(rules->perms[index + 1]);

	}



	return &(file_rules->perms[index + 1]);

	return &(rules->perms[index]);

}



/**
@@ -207,7 +211,8 @@ aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start, 
{

	aa_state_t state;

	state = aa_dfa_match(file_rules->dfa, start, name);

	*perms = *(aa_lookup_fperms(file_rules, state, cond));

	*perms = *(aa_lookup_condperms(current_fsuid(), file_rules, state,

				       cond));



	return state;

}

security/apparmor/include/file.h

+3 −2
Original line number Diff line number Diff line
@@ -77,7 +77,8 @@ int aa_audit_file(const struct cred *cred, 
		  const char *target, struct aa_label *tlabel, kuid_t ouid,

		  const char *info, int error);



struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,

struct aa_perms *aa_lookup_condperms(kuid_t subj_uid,

				     struct aa_policydb *file_rules,

				     aa_state_t state, struct path_cond *cond);

aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start,

			const char *name, struct path_cond *cond,

security/apparmor/include/policy.h

+6 −1
Original line number Diff line number Diff line
@@ -59,6 +59,11 @@ extern const char *const aa_profile_mode_names[]; 


#define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)



/* flags in the dfa accept2 table */

enum dfa_accept_flags {

	ACCEPT_FLAG_OWNER = 1,

};



/*

 * FIXME: currently need a clean way to replace and remove profiles as a

 * set.  It should be done at the namespace level.
@@ -124,6 +129,7 @@ static inline void aa_put_pdb(struct aa_policydb *pdb) 
		kref_put(&pdb->count, aa_pdb_free_kref);

}



/* lookup perm that doesn't have and object conditional */

static inline struct aa_perms *aa_lookup_perms(struct aa_policydb *policy,

					       aa_state_t state)

{
@@ -135,7 +141,6 @@ static inline struct aa_perms *aa_lookup_perms(struct aa_policydb *policy, 
	return &(policy->perms[index]);

}





/* struct aa_data - generic data structure

 * key: name for retrieving this data

 * size: size of data in bytes