X-Git-Url: http://git.pld-linux.org/?a=blobdiff_plain;f=kernel-apparmor.patch;h=d6d4585978e335de979e3782ec35dc402415f46e;hb=43f6eead07048de255cf89569613884ba797bed4;hp=49f4be306944c85f5461279a6cfd066f5cb0bd09;hpb=0c3ec466e69be22e05fbcda066466fef09e36a68;p=packages%2Fkernel.git diff --git a/kernel-apparmor.patch b/kernel-apparmor.patch index 49f4be30..d6d45859 100644 --- a/kernel-apparmor.patch +++ b/kernel-apparmor.patch @@ -1,321 +1,43 @@ -From 8de755e4dfdbc40bfcaca848ae6b5aeaf0ede0e8 Mon Sep 17 00:00:00 2001 -From: John Johansen -Date: Thu, 22 Jul 2010 02:32:02 -0700 -Subject: [PATCH 1/3] UBUNTU: SAUCE: AppArmor: Add profile introspection file - to interface - -Add the dynamic profiles file to the interace, to allow load policy -introspection. - -Signed-off-by: John Johansen -Acked-by: Kees Cook -Signed-off-by: Tim Gardner ---- - security/apparmor/apparmorfs.c | 227 ++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 227 insertions(+) - -diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index 16c15ec..89bdc62 100644 ---- a/security/apparmor/apparmorfs.c -+++ b/security/apparmor/apparmorfs.c -@@ -182,6 +182,232 @@ const struct file_operations aa_fs_seq_file_ops = { - .release = single_release, - }; - -+/** -+ * __next_namespace - find the next namespace to list -+ * @root: root namespace to stop search at (NOT NULL) -+ * @ns: current ns position (NOT NULL) -+ * -+ * Find the next namespace from @ns under @root and handle all locking needed -+ * while switching current namespace. -+ * -+ * Returns: next namespace or NULL if at last namespace under @root -+ * NOTE: will not unlock root->lock -+ */ -+static struct aa_namespace *__next_namespace(struct aa_namespace *root, -+ struct aa_namespace *ns) -+{ -+ struct aa_namespace *parent; -+ -+ /* is next namespace a child */ -+ if (!list_empty(&ns->sub_ns)) { -+ struct aa_namespace *next; -+ next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list); -+ read_lock(&next->lock); -+ return next; -+ } -+ -+ /* check if the next ns is a sibling, parent, gp, .. */ -+ parent = ns->parent; -+ while (parent) { -+ read_unlock(&ns->lock); -+ list_for_each_entry_continue(ns, &parent->sub_ns, base.list) { -+ read_lock(&ns->lock); -+ return ns; -+ } -+ if (parent == root) -+ return NULL; -+ ns = parent; -+ parent = parent->parent; -+ } -+ -+ return NULL; -+} -+ -+/** -+ * __first_profile - find the first profile in a namespace -+ * @root: namespace that is root of profiles being displayed (NOT NULL) -+ * @ns: namespace to start in (NOT NULL) -+ * -+ * Returns: unrefcounted profile or NULL if no profile -+ */ -+static struct aa_profile *__first_profile(struct aa_namespace *root, -+ struct aa_namespace *ns) -+{ -+ for ( ; ns; ns = __next_namespace(root, ns)) { -+ if (!list_empty(&ns->base.profiles)) -+ return list_first_entry(&ns->base.profiles, -+ struct aa_profile, base.list); -+ } -+ return NULL; -+} -+ -+/** -+ * __next_profile - step to the next profile in a profile tree -+ * @profile: current profile in tree (NOT NULL) -+ * -+ * Perform a depth first taversal on the profile tree in a namespace -+ * -+ * Returns: next profile or NULL if done -+ * Requires: profile->ns.lock to be held -+ */ -+static struct aa_profile *__next_profile(struct aa_profile *p) -+{ -+ struct aa_profile *parent; -+ struct aa_namespace *ns = p->ns; -+ -+ /* is next profile a child */ -+ if (!list_empty(&p->base.profiles)) -+ return list_first_entry(&p->base.profiles, typeof(*p), -+ base.list); -+ -+ /* is next profile a sibling, parent sibling, gp, subling, .. */ -+ parent = p->parent; -+ while (parent) { -+ list_for_each_entry_continue(p, &parent->base.profiles, -+ base.list) -+ return p; -+ p = parent; -+ parent = parent->parent; -+ } -+ -+ /* is next another profile in the namespace */ -+ list_for_each_entry_continue(p, &ns->base.profiles, base.list) -+ return p; -+ -+ return NULL; -+} -+ -+/** -+ * next_profile - step to the next profile in where ever it may be -+ * @root: root namespace (NOT NULL) -+ * @profile: current profile (NOT NULL) -+ * -+ * Returns: next profile or NULL if there isn't one -+ */ -+static struct aa_profile *next_profile(struct aa_namespace *root, -+ struct aa_profile *profile) -+{ -+ struct aa_profile *next = __next_profile(profile); -+ if (next) -+ return next; -+ -+ /* finished all profiles in namespace move to next namespace */ -+ return __first_profile(root, __next_namespace(root, profile->ns)); -+} -+ -+/** -+ * p_start - start a depth first traversal of profile tree -+ * @f: seq_file to fill -+ * @pos: current position -+ * -+ * Returns: first profile under current namespace or NULL if none found -+ * -+ * acquires first ns->lock -+ */ -+static void *p_start(struct seq_file *f, loff_t *pos) -+ __acquires(root->lock) -+{ -+ struct aa_profile *profile = NULL; -+ struct aa_namespace *root = aa_current_profile()->ns; -+ loff_t l = *pos; -+ f->private = aa_get_namespace(root); -+ -+ -+ /* find the first profile */ -+ read_lock(&root->lock); -+ profile = __first_profile(root, root); -+ -+ /* skip to position */ -+ for (; profile && l > 0; l--) -+ profile = next_profile(root, profile); -+ -+ return profile; -+} -+ -+/** -+ * p_next - read the next profile entry -+ * @f: seq_file to fill -+ * @p: profile previously returned -+ * @pos: current position -+ * -+ * Returns: next profile after @p or NULL if none -+ * -+ * may acquire/release locks in namespace tree as necessary -+ */ -+static void *p_next(struct seq_file *f, void *p, loff_t *pos) -+{ -+ struct aa_profile *profile = p; -+ struct aa_namespace *root = f->private; -+ (*pos)++; -+ -+ return next_profile(root, profile); -+} -+ -+/** -+ * p_stop - stop depth first traversal -+ * @f: seq_file we are filling -+ * @p: the last profile writen -+ * -+ * Release all locking done by p_start/p_next on namespace tree -+ */ -+static void p_stop(struct seq_file *f, void *p) -+ __releases(root->lock) -+{ -+ struct aa_profile *profile = p; -+ struct aa_namespace *root = f->private, *ns; -+ -+ if (profile) { -+ for (ns = profile->ns; ns && ns != root; ns = ns->parent) -+ read_unlock(&ns->lock); -+ } -+ read_unlock(&root->lock); -+ aa_put_namespace(root); -+} -+ -+/** -+ * seq_show_profile - show a profile entry -+ * @f: seq_file to file -+ * @p: current position (profile) (NOT NULL) -+ * -+ * Returns: error on failure -+ */ -+static int seq_show_profile(struct seq_file *f, void *p) -+{ -+ struct aa_profile *profile = (struct aa_profile *)p; -+ struct aa_namespace *root = f->private; -+ -+ if (profile->ns != root) -+ seq_printf(f, ":%s://", aa_ns_name(root, profile->ns)); -+ seq_printf(f, "%s (%s)\n", profile->base.hname, -+ COMPLAIN_MODE(profile) ? "complain" : "enforce"); -+ -+ return 0; -+} -+ -+static const struct seq_operations aa_fs_profiles_op = { -+ .start = p_start, -+ .next = p_next, -+ .stop = p_stop, -+ .show = seq_show_profile, -+}; -+ -+static int profiles_open(struct inode *inode, struct file *file) -+{ -+ return seq_open(file, &aa_fs_profiles_op); -+} -+ -+static int profiles_release(struct inode *inode, struct file *file) -+{ -+ return seq_release(inode, file); -+} -+ -+const struct file_operations aa_fs_profiles_fops = { -+ .open = profiles_open, -+ .read = seq_read, -+ .llseek = seq_lseek, -+ .release = profiles_release, -+}; -+ - /** Base file system setup **/ - - static struct aa_fs_entry aa_fs_entry_file[] = { -@@ -210,6 +436,7 @@ static struct aa_fs_entry aa_fs_entry_apparmor[] = { - AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load), - AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace), - AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove), -+ AA_FS_FILE_FOPS("profiles", 0640, &aa_fs_profiles_fops), - AA_FS_DIR("features", aa_fs_entry_features), - { } - }; --- -1.7.9.5 - -From 423e2cb454d75d6185eecd0c1b5cf6ccc2d8482d Mon Sep 17 00:00:00 2001 +From e37c855a09ba7a8fa69334e9e3c7f5b0f66de896 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Mon, 4 Oct 2010 15:03:36 -0700 -Subject: [PATCH 2/3] UBUNTU: SAUCE: AppArmor: basic networking rules +Subject: UBUNTU: SAUCE: AppArmor: basic networking rules Base support for network mediation. Signed-off-by: John Johansen ---- - security/apparmor/.gitignore | 2 +- - security/apparmor/Makefile | 42 +++++++++- - security/apparmor/apparmorfs.c | 1 + - security/apparmor/include/audit.h | 4 + - security/apparmor/include/net.h | 44 ++++++++++ - security/apparmor/include/policy.h | 3 + - security/apparmor/lsm.c | 112 +++++++++++++++++++++++++ - security/apparmor/net.c | 162 ++++++++++++++++++++++++++++++++++++ - security/apparmor/policy.c | 1 + - security/apparmor/policy_unpack.c | 46 ++++++++++ - 10 files changed, 414 insertions(+), 3 deletions(-) - create mode 100644 security/apparmor/include/net.h - create mode 100644 security/apparmor/net.c diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore -index 4d995ae..d5b291e 100644 +index 9cdec70..d5b291e 100644 --- a/security/apparmor/.gitignore +++ b/security/apparmor/.gitignore -@@ -1,6 +1,6 @@ +@@ -1,5 +1,6 @@ # # Generated include files # --af_names.h +net_names.h capability_names.h rlim_names.h diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile -index 806bd19..19daa85 100644 +index d693df8..5dbb72f 100644 --- a/security/apparmor/Makefile +++ b/security/apparmor/Makefile -@@ -4,9 +4,9 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o +@@ -4,10 +4,10 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \ path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \ - resource.o sid.o file.o + resource.o sid.o file.o net.o + apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o -clean-files := capability_names.h rlim_names.h +clean-files := capability_names.h rlim_names.h net_names.h # Build a lower case string table of capability names -@@ -20,6 +20,38 @@ cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\ - -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\ - echo "};" >> $@ +@@ -25,6 +25,38 @@ cmd_make-caps = echo "static const char *const capability_names[] = {" > $@ ;\ + -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/\L\1/p' | \ + tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@ +# Build a lower case string table of address family names +# Transform lines from @@ -352,16 +74,16 @@ index 806bd19..19daa85 100644 # Build a lower case string table of rlimit names. # Transforms lines from -@@ -56,6 +88,7 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \ +@@ -61,6 +93,7 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \ tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@ $(obj)/capability.o : $(obj)/capability_names.h +$(obj)/net.o : $(obj)/net_names.h $(obj)/resource.o : $(obj)/rlim_names.h - $(obj)/capability_names.h : $(srctree)/include/linux/capability.h \ + $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \ $(src)/Makefile -@@ -63,3 +96,8 @@ $(obj)/capability_names.h : $(srctree)/include/linux/capability.h \ - $(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h \ +@@ -68,3 +101,8 @@ $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \ + $(obj)/rlim_names.h : $(srctree)/include/uapi/asm-generic/resource.h \ $(src)/Makefile $(call cmd,make-rlim) +$(obj)/net_names.h : $(srctree)/include/linux/socket.h \ @@ -370,24 +92,24 @@ index 806bd19..19daa85 100644 + $(call cmd,make-af) + $(call cmd,make-sock) diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index 89bdc62..c66315d 100644 +index ad4fa49..6362c5a 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c -@@ -427,6 +427,7 @@ static struct aa_fs_entry aa_fs_entry_domain[] = { - static struct aa_fs_entry aa_fs_entry_features[] = { +@@ -806,6 +806,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = { + AA_FS_DIR("policy", aa_fs_entry_policy), AA_FS_DIR("domain", aa_fs_entry_domain), AA_FS_DIR("file", aa_fs_entry_file), + AA_FS_DIR("network", aa_fs_entry_network), AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), AA_FS_DIR("rlimit", aa_fs_entry_rlimit), - { } + AA_FS_DIR("caps", aa_fs_entry_caps), diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h -index 3868b1e..c1ff09c 100644 +index ba3dfd1..5d3c419 100644 --- a/security/apparmor/include/audit.h +++ b/security/apparmor/include/audit.h -@@ -126,6 +126,10 @@ struct apparmor_audit_data { +@@ -125,6 +125,10 @@ struct apparmor_audit_data { u32 denied; - uid_t ouid; + kuid_t ouid; } fs; + struct { + int type, protocol; @@ -447,7 +169,7 @@ index 0000000..cb8a121 + +#endif /* __AA_NET_H */ diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h -index bda4569..eb13a73 100644 +index c28b0f2..b524d88 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -27,6 +27,7 @@ @@ -457,25 +179,25 @@ index bda4569..eb13a73 100644 +#include "net.h" #include "resource.h" - extern const char *const profile_mode_names[]; -@@ -157,6 +158,7 @@ struct aa_policydb { + extern const char *const aa_profile_mode_names[]; +@@ -176,6 +177,7 @@ struct aa_replacedby { * @policy: general match rules governing policy * @file: The set of rules governing basic file access and domain transitions * @caps: capabilities for the profile + * @net: network controls for the profile * @rlimits: rlimits for the profile * - * The AppArmor profile contains the basic confinement data. Each profile -@@ -194,6 +196,7 @@ struct aa_profile { + * @dents: dentries for the profiles file entries in apparmorfs +@@ -217,6 +219,7 @@ struct aa_profile { struct aa_policydb policy; struct aa_file_rules file; struct aa_caps caps; + struct aa_net net; struct aa_rlimit rlimits; - }; + unsigned char *hash; diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index ad05d39..3cde194 100644 +index dec607c..47fd244 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -32,6 +32,7 @@ @@ -486,7 +208,7 @@ index ad05d39..3cde194 100644 #include "include/path.h" #include "include/policy.h" #include "include/procattr.h" -@@ -622,6 +623,104 @@ static int apparmor_task_setrlimit(struct task_struct *task, +@@ -605,6 +606,104 @@ static int apparmor_task_setrlimit(struct task_struct *task, return error; } @@ -588,32 +310,32 @@ index ad05d39..3cde194 100644 + return aa_revalidate_sk(OP_SOCK_SHUTDOWN, sk); +} + - static struct security_operations apparmor_ops = { - .name = "apparmor", - -@@ -653,6 +752,19 @@ static struct security_operations apparmor_ops = { - .getprocattr = apparmor_getprocattr, - .setprocattr = apparmor_setprocattr, + static struct security_hook_list apparmor_hooks[] = { + LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), + LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), +@@ -634,6 +733,19 @@ static struct security_hook_list apparmor_hooks[] = { + LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), + LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), -+ .socket_create = apparmor_socket_create, -+ .socket_bind = apparmor_socket_bind, -+ .socket_connect = apparmor_socket_connect, -+ .socket_listen = apparmor_socket_listen, -+ .socket_accept = apparmor_socket_accept, -+ .socket_sendmsg = apparmor_socket_sendmsg, -+ .socket_recvmsg = apparmor_socket_recvmsg, -+ .socket_getsockname = apparmor_socket_getsockname, -+ .socket_getpeername = apparmor_socket_getpeername, -+ .socket_getsockopt = apparmor_socket_getsockopt, -+ .socket_setsockopt = apparmor_socket_setsockopt, -+ .socket_shutdown = apparmor_socket_shutdown, -+ - .cred_alloc_blank = apparmor_cred_alloc_blank, - .cred_free = apparmor_cred_free, - .cred_prepare = apparmor_cred_prepare, ++ LSM_HOOK_INIT(socket_create, apparmor_socket_create), ++ LSM_HOOK_INIT(socket_bind, apparmor_socket_bind), ++ LSM_HOOK_INIT(socket_connect, apparmor_socket_connect), ++ LSM_HOOK_INIT(socket_listen, apparmor_socket_listen), ++ LSM_HOOK_INIT(socket_accept, apparmor_socket_accept), ++ LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg), ++ LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg), ++ LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname), ++ LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername), ++ LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), ++ LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), ++ LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), ++ + LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), + LSM_HOOK_INIT(cred_free, apparmor_cred_free), + LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), diff --git a/security/apparmor/net.c b/security/apparmor/net.c new file mode 100644 -index 0000000..084232b +index 0000000..003dd18 --- /dev/null +++ b/security/apparmor/net.c @@ -0,0 +1,162 @@ @@ -780,19 +502,19 @@ index 0000000..084232b + return error; +} diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c -index f1f7506..b8100a7 100644 +index 705c287..e2afe29 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c -@@ -745,6 +745,7 @@ static void free_profile(struct aa_profile *profile) +@@ -603,6 +603,7 @@ void aa_free_profile(struct aa_profile *profile) aa_free_file_rules(&profile->file); aa_free_cap_rules(&profile->caps); + aa_free_net_rules(&profile->net); aa_free_rlimit_rules(&profile->rlimits); - aa_free_sid(profile->sid); + kzfree(profile->dirname); diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c -index deab7c7..8f8e9c1 100644 +index a689f10..1a35e6b 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -193,6 +193,19 @@ fail: @@ -815,7 +537,7 @@ index deab7c7..8f8e9c1 100644 static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name) { if (unpack_nameX(e, AA_U32, name)) { -@@ -471,6 +484,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) +@@ -476,6 +489,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) { struct aa_profile *profile = NULL; const char *name = NULL; @@ -823,7 +545,7 @@ index deab7c7..8f8e9c1 100644 int i, error = -EPROTO; kernel_cap_t tmpcap; u32 tmp; -@@ -564,6 +578,38 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) +@@ -576,6 +590,38 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) if (!unpack_rlimits(e, profile)) goto fail; @@ -863,13 +585,46 @@ index deab7c7..8f8e9c1 100644 /* generic policy dfa - optional and may be NULL */ profile->policy.dfa = unpack_dfa(e); -- -1.7.9.5 +cgit v0.10.2 + +From 6b77d90baf3807b70ca17309ad6c0bd39f3297e7 Mon Sep 17 00:00:00 2001 +From: John Johansen +Date: Fri, 29 Jun 2012 17:34:00 -0700 +Subject: apparmor: Fix quieting of audit messages for network mediation + +If a profile specified a quieting of network denials for a given rule by +either the quiet or deny rule qualifiers, the resultant quiet mask for +denied requests was applied incorrectly, resulting in two potential bugs. +1. The misapplied quiet mask would prevent denials from being correctly + tested against the kill mask/mode. Thus network access requests that + should have resulted in the application being killed did not. + +2. The actual quieting of the denied network request was not being applied. + This would result in network rejections always being logged even when + they had been specifically marked as quieted. + +Signed-off-by: John Johansen + +diff --git a/security/apparmor/net.c b/security/apparmor/net.c +index 003dd18..6e6e5c9 100644 +--- a/security/apparmor/net.c ++++ b/security/apparmor/net.c +@@ -88,7 +88,7 @@ static int audit_net(struct aa_profile *profile, int op, u16 family, int type, + } else { + u16 quiet_mask = profile->net.quiet[sa.u.net->family]; + u16 kill_mask = 0; +- u16 denied = (1 << sa.aad->net.type) & ~quiet_mask; ++ u16 denied = (1 << sa.aad->net.type); + + if (denied & kill_mask) + audit_type = AUDIT_APPARMOR_KILL; +-- +cgit v0.10.2 -From a94d5e11c0484af59e5feebf144cc48c186892ad Mon Sep 17 00:00:00 2001 +From a71049ba973b214e88eae89f9cb0c4965d184ead Mon Sep 17 00:00:00 2001 From: John Johansen Date: Wed, 16 May 2012 10:58:05 -0700 -Subject: [PATCH 3/3] UBUNTU: SAUCE: apparmor: Add the ability to mediate - mount +Subject: UBUNTU: SAUCE: apparmor: Add the ability to mediate mount Add the ability for apparmor to do mediation of mount operations. Mount rules require an updated apparmor_parser (2.8 series) for policy compilation. @@ -908,23 +663,9 @@ See the apparmor userspace for full documentation Signed-off-by: John Johansen Acked-by: Kees Cook ---- - security/apparmor/Makefile | 2 +- - security/apparmor/apparmorfs.c | 13 + - security/apparmor/audit.c | 4 + - security/apparmor/domain.c | 2 +- - security/apparmor/include/apparmor.h | 3 +- - security/apparmor/include/audit.h | 11 + - security/apparmor/include/domain.h | 2 + - security/apparmor/include/mount.h | 54 +++ - security/apparmor/lsm.c | 59 ++++ - security/apparmor/mount.c | 620 ++++++++++++++++++++++++++++++++++ - 10 files changed, 767 insertions(+), 3 deletions(-) - create mode 100644 security/apparmor/include/mount.h - create mode 100644 security/apparmor/mount.c diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile -index 19daa85..63e0a4c 100644 +index 5dbb72f..89b3445 100644 --- a/security/apparmor/Makefile +++ b/security/apparmor/Makefile @@ -4,7 +4,7 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o @@ -933,17 +674,21 @@ index 19daa85..63e0a4c 100644 path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \ - resource.o sid.o file.o net.o + resource.o sid.o file.o net.o mount.o + apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o clean-files := capability_names.h rlim_names.h net_names.h - diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index c66315d..ff19009 100644 +index 6362c5a..4917747 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c -@@ -424,10 +424,23 @@ static struct aa_fs_entry aa_fs_entry_domain[] = { - { } - }; +@@ -799,7 +799,18 @@ static struct aa_fs_entry aa_fs_entry_domain[] = { + static struct aa_fs_entry aa_fs_entry_policy[] = { + AA_FS_FILE_BOOLEAN("set_load", 1), +- {} ++ { } ++}; ++ +static struct aa_fs_entry aa_fs_entry_mount[] = { + AA_FS_FILE_STRING("mask", "mount umount"), + { } @@ -953,9 +698,10 @@ index c66315d..ff19009 100644 + AA_FS_FILE_BOOLEAN("profile", 1), + AA_FS_FILE_BOOLEAN("pivot_root", 1), + { } -+}; -+ + }; + static struct aa_fs_entry aa_fs_entry_features[] = { +@@ -807,6 +818,8 @@ static struct aa_fs_entry aa_fs_entry_features[] = { AA_FS_DIR("domain", aa_fs_entry_domain), AA_FS_DIR("file", aa_fs_entry_file), AA_FS_DIR("network", aa_fs_entry_network), @@ -963,9 +709,9 @@ index c66315d..ff19009 100644 + AA_FS_DIR("namespaces", aa_fs_entry_namespaces), AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), AA_FS_DIR("rlimit", aa_fs_entry_rlimit), - { } + AA_FS_DIR("caps", aa_fs_entry_caps), diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c -index cc3520d..b9f5ee9 100644 +index 89c7865..7fdb5d7 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -44,6 +44,10 @@ const char *const op_table[] = { @@ -980,10 +726,10 @@ index cc3520d..b9f5ee9 100644 "post_create", "bind", diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c -index 6327685..dfdc47b 100644 +index dc0027b..a2e3813 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c -@@ -242,7 +242,7 @@ static const char *next_name(int xtype, const char *name) +@@ -236,7 +236,7 @@ static const char *next_name(int xtype, const char *name) * * Returns: refcounted profile, or NULL on failure (MAYBE NULL) */ @@ -993,10 +739,10 @@ index 6327685..dfdc47b 100644 struct aa_profile *new_profile = NULL; struct aa_namespace *ns = profile->ns; diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h -index 40aedd9..e243d96 100644 +index e4ea626..ce6ff6a 100644 --- a/security/apparmor/include/apparmor.h +++ b/security/apparmor/include/apparmor.h -@@ -29,8 +29,9 @@ +@@ -30,8 +30,9 @@ #define AA_CLASS_NET 4 #define AA_CLASS_RLIMITS 5 #define AA_CLASS_DOMAIN 6 @@ -1008,10 +754,10 @@ index 40aedd9..e243d96 100644 /* Control parameters settable through module/boot flags */ extern enum audit_mode aa_g_audit; diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h -index c1ff09c..7b90900c 100644 +index 5d3c419..b9f1d57 100644 --- a/security/apparmor/include/audit.h +++ b/security/apparmor/include/audit.h -@@ -73,6 +73,10 @@ enum aa_ops { +@@ -72,6 +72,10 @@ enum aa_ops { OP_FMMAP, OP_FMPROT, @@ -1022,7 +768,7 @@ index c1ff09c..7b90900c 100644 OP_CREATE, OP_POST_CREATE, OP_BIND, -@@ -121,6 +125,13 @@ struct apparmor_audit_data { +@@ -120,6 +124,13 @@ struct apparmor_audit_data { unsigned long max; } rlim; struct { @@ -1110,7 +856,7 @@ index 0000000..bc17a53 + +#endif /* __AA_MOUNT_H */ diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c -index 3cde194..4512cc6 100644 +index 47fd244..fb92441 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -36,6 +36,7 @@ @@ -1121,11 +867,11 @@ index 3cde194..4512cc6 100644 /* Flag indicating whether initialization completed */ int apparmor_initialized __initdata; -@@ -512,6 +513,60 @@ static int apparmor_file_mprotect(struct vm_area_struct *vma, +@@ -492,6 +493,60 @@ static int apparmor_file_mprotect(struct vm_area_struct *vma, !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); } -+static int apparmor_sb_mount(char *dev_name, struct path *path, char *type, ++static int apparmor_sb_mount(const char *dev_name, struct path *path, const char *type, + unsigned long flags, void *data) +{ + struct aa_profile *profile; @@ -1182,20 +928,20 @@ index 3cde194..4512cc6 100644 static int apparmor_getprocattr(struct task_struct *task, char *name, char **value) { -@@ -729,6 +784,10 @@ static struct security_operations apparmor_ops = { - .capget = apparmor_capget, - .capable = apparmor_capable, +@@ -710,6 +765,10 @@ static struct security_hook_list apparmor_hooks[] = { + LSM_HOOK_INIT(capget, apparmor_capget), + LSM_HOOK_INIT(capable, apparmor_capable), -+ .sb_mount = apparmor_sb_mount, -+ .sb_umount = apparmor_sb_umount, -+ .sb_pivotroot = apparmor_sb_pivotroot, -+ - .path_link = apparmor_path_link, - .path_unlink = apparmor_path_unlink, - .path_symlink = apparmor_path_symlink, ++ LSM_HOOK_INIT(sb_mount, apparmor_sb_mount), ++ LSM_HOOK_INIT(sb_umount, apparmor_sb_umount), ++ LSM_HOOK_INIT(sb_pivotroot, apparmor_sb_pivotroot), ++ + LSM_HOOK_INIT(path_link, apparmor_path_link), + LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), + LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c new file mode 100644 -index 0000000..63d8493 +index 0000000..478aa4d --- /dev/null +++ b/security/apparmor/mount.c @@ -0,0 +1,620 @@ @@ -1339,7 +1085,7 @@ index 0000000..63d8493 + struct file_perms *perms, const char *info, int error) +{ + int audit_type = AUDIT_APPARMOR_AUTO; -+ struct common_audit_data sa; ++ struct common_audit_data sa = { }; + struct apparmor_audit_data aad = { }; + + if (likely(!error)) { @@ -1820,5 +1566,5 @@ index 0000000..63d8493 + return error; +} -- -1.7.9.5 +cgit v0.10.2