Root/
1 | /* |
2 | * AppArmor security module |
3 | * |
4 | * This file contains AppArmor policy definitions. |
5 | * |
6 | * Copyright (C) 1998-2008 Novell/SUSE |
7 | * Copyright 2009-2010 Canonical Ltd. |
8 | * |
9 | * This program is free software; you can redistribute it and/or |
10 | * modify it under the terms of the GNU General Public License as |
11 | * published by the Free Software Foundation, version 2 of the |
12 | * License. |
13 | */ |
14 | |
15 | #ifndef __AA_POLICY_H |
16 | #define __AA_POLICY_H |
17 | |
18 | #include <linux/capability.h> |
19 | #include <linux/cred.h> |
20 | #include <linux/kref.h> |
21 | #include <linux/sched.h> |
22 | #include <linux/slab.h> |
23 | #include <linux/socket.h> |
24 | |
25 | #include "apparmor.h" |
26 | #include "audit.h" |
27 | #include "capability.h" |
28 | #include "domain.h" |
29 | #include "file.h" |
30 | #include "resource.h" |
31 | |
32 | extern const char *profile_mode_names[]; |
33 | #define APPARMOR_NAMES_MAX_INDEX 3 |
34 | |
35 | #define COMPLAIN_MODE(_profile) \ |
36 | ((aa_g_profile_mode == APPARMOR_COMPLAIN) || \ |
37 | ((_profile)->mode == APPARMOR_COMPLAIN)) |
38 | |
39 | #define KILL_MODE(_profile) \ |
40 | ((aa_g_profile_mode == APPARMOR_KILL) || \ |
41 | ((_profile)->mode == APPARMOR_KILL)) |
42 | |
43 | #define PROFILE_IS_HAT(_profile) ((_profile)->flags & PFLAG_HAT) |
44 | |
45 | /* |
46 | * FIXME: currently need a clean way to replace and remove profiles as a |
47 | * set. It should be done at the namespace level. |
48 | * Either, with a set of profiles loaded at the namespace level or via |
49 | * a mark and remove marked interface. |
50 | */ |
51 | enum profile_mode { |
52 | APPARMOR_ENFORCE, /* enforce access rules */ |
53 | APPARMOR_COMPLAIN, /* allow and log access violations */ |
54 | APPARMOR_KILL, /* kill task on access violation */ |
55 | }; |
56 | |
57 | enum profile_flags { |
58 | PFLAG_HAT = 1, /* profile is a hat */ |
59 | PFLAG_UNCONFINED = 2, /* profile is an unconfined profile */ |
60 | PFLAG_NULL = 4, /* profile is null learning profile */ |
61 | PFLAG_IX_ON_NAME_ERROR = 8, /* fallback to ix on name lookup fail */ |
62 | PFLAG_IMMUTABLE = 0x10, /* don't allow changes/replacement */ |
63 | PFLAG_USER_DEFINED = 0x20, /* user based profile - lower privs */ |
64 | PFLAG_NO_LIST_REF = 0x40, /* list doesn't keep profile ref */ |
65 | PFLAG_OLD_NULL_TRANS = 0x100, /* use // as the null transition */ |
66 | |
67 | /* These flags must correspond with PATH_flags */ |
68 | PFLAG_MEDIATE_DELETED = 0x10000, /* mediate instead delegate deleted */ |
69 | }; |
70 | |
71 | struct aa_profile; |
72 | |
73 | /* struct aa_policy - common part of both namespaces and profiles |
74 | * @name: name of the object |
75 | * @hname - The hierarchical name |
76 | * @count: reference count of the obj |
77 | * @list: list policy object is on |
78 | * @profiles: head of the profiles list contained in the object |
79 | */ |
80 | struct aa_policy { |
81 | char *name; |
82 | char *hname; |
83 | struct kref count; |
84 | struct list_head list; |
85 | struct list_head profiles; |
86 | }; |
87 | |
88 | /* struct aa_ns_acct - accounting of profiles in namespace |
89 | * @max_size: maximum space allowed for all profiles in namespace |
90 | * @max_count: maximum number of profiles that can be in this namespace |
91 | * @size: current size of profiles |
92 | * @count: current count of profiles (includes null profiles) |
93 | */ |
94 | struct aa_ns_acct { |
95 | int max_size; |
96 | int max_count; |
97 | int size; |
98 | int count; |
99 | }; |
100 | |
101 | /* struct aa_namespace - namespace for a set of profiles |
102 | * @base: common policy |
103 | * @parent: parent of namespace |
104 | * @lock: lock for modifying the object |
105 | * @acct: accounting for the namespace |
106 | * @unconfined: special unconfined profile for the namespace |
107 | * @sub_ns: list of namespaces under the current namespace. |
108 | * |
109 | * An aa_namespace defines the set profiles that are searched to determine |
110 | * which profile to attach to a task. Profiles can not be shared between |
111 | * aa_namespaces and profile names within a namespace are guaranteed to be |
112 | * unique. When profiles in separate namespaces have the same name they |
113 | * are NOT considered to be equivalent. |
114 | * |
115 | * Namespaces are hierarchical and only namespaces and profiles below the |
116 | * current namespace are visible. |
117 | * |
118 | * Namespace names must be unique and can not contain the characters :/\0 |
119 | * |
120 | * FIXME TODO: add vserver support of namespaces (can it all be done in |
121 | * userspace?) |
122 | */ |
123 | struct aa_namespace { |
124 | struct aa_policy base; |
125 | struct aa_namespace *parent; |
126 | rwlock_t lock; |
127 | struct aa_ns_acct acct; |
128 | struct aa_profile *unconfined; |
129 | struct list_head sub_ns; |
130 | }; |
131 | |
132 | /* struct aa_profile - basic confinement data |
133 | * @base - base components of the profile (name, refcount, lists, lock ...) |
134 | * @parent: parent of profile |
135 | * @ns: namespace the profile is in |
136 | * @replacedby: is set to the profile that replaced this profile |
137 | * @rename: optional profile name that this profile renamed |
138 | * @xmatch: optional extended matching for unconfined executables names |
139 | * @xmatch_len: xmatch prefix len, used to determine xmatch priority |
140 | * @sid: the unique security id number of this profile |
141 | * @audit: the auditing mode of the profile |
142 | * @mode: the enforcement mode of the profile |
143 | * @flags: flags controlling profile behavior |
144 | * @path_flags: flags controlling path generation behavior |
145 | * @size: the memory consumed by this profiles rules |
146 | * @file: The set of rules governing basic file access and domain transitions |
147 | * @caps: capabilities for the profile |
148 | * @rlimits: rlimits for the profile |
149 | * |
150 | * The AppArmor profile contains the basic confinement data. Each profile |
151 | * has a name, and exists in a namespace. The @name and @exec_match are |
152 | * used to determine profile attachment against unconfined tasks. All other |
153 | * attachments are determined by profile X transition rules. |
154 | * |
155 | * The @replacedby field is write protected by the profile lock. Reads |
156 | * are assumed to be atomic, and are done without locking. |
157 | * |
158 | * Profiles have a hierarchy where hats and children profiles keep |
159 | * a reference to their parent. |
160 | * |
161 | * Profile names can not begin with a : and can not contain the \0 |
162 | * character. If a profile name begins with / it will be considered when |
163 | * determining profile attachment on "unconfined" tasks. |
164 | */ |
165 | struct aa_profile { |
166 | struct aa_policy base; |
167 | struct aa_profile *parent; |
168 | |
169 | struct aa_namespace *ns; |
170 | struct aa_profile *replacedby; |
171 | const char *rename; |
172 | |
173 | struct aa_dfa *xmatch; |
174 | int xmatch_len; |
175 | u32 sid; |
176 | enum audit_mode audit; |
177 | enum profile_mode mode; |
178 | u32 flags; |
179 | u32 path_flags; |
180 | int size; |
181 | |
182 | struct aa_file_rules file; |
183 | struct aa_caps caps; |
184 | struct aa_rlimit rlimits; |
185 | }; |
186 | |
187 | extern struct aa_namespace *root_ns; |
188 | extern enum profile_mode aa_g_profile_mode; |
189 | |
190 | void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); |
191 | |
192 | bool aa_ns_visible(struct aa_namespace *curr, struct aa_namespace *view); |
193 | const char *aa_ns_name(struct aa_namespace *parent, struct aa_namespace *child); |
194 | int aa_alloc_root_ns(void); |
195 | void aa_free_root_ns(void); |
196 | void aa_free_namespace_kref(struct kref *kref); |
197 | |
198 | struct aa_namespace *aa_find_namespace(struct aa_namespace *root, |
199 | const char *name); |
200 | |
201 | static inline struct aa_policy *aa_get_common(struct aa_policy *c) |
202 | { |
203 | if (c) |
204 | kref_get(&c->count); |
205 | |
206 | return c; |
207 | } |
208 | |
209 | /** |
210 | * aa_get_namespace - increment references count on @ns |
211 | * @ns: namespace to increment reference count of (MAYBE NULL) |
212 | * |
213 | * Returns: pointer to @ns, if @ns is NULL returns NULL |
214 | * Requires: @ns must be held with valid refcount when called |
215 | */ |
216 | static inline struct aa_namespace *aa_get_namespace(struct aa_namespace *ns) |
217 | { |
218 | if (ns) |
219 | kref_get(&(ns->base.count)); |
220 | |
221 | return ns; |
222 | } |
223 | |
224 | /** |
225 | * aa_put_namespace - decrement refcount on @ns |
226 | * @ns: namespace to put reference of |
227 | * |
228 | * Decrement reference count of @ns and if no longer in use free it |
229 | */ |
230 | static inline void aa_put_namespace(struct aa_namespace *ns) |
231 | { |
232 | if (ns) |
233 | kref_put(&ns->base.count, aa_free_namespace_kref); |
234 | } |
235 | |
236 | struct aa_profile *aa_alloc_profile(const char *name); |
237 | struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat); |
238 | void aa_free_profile_kref(struct kref *kref); |
239 | struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); |
240 | struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *name); |
241 | struct aa_profile *aa_match_profile(struct aa_namespace *ns, const char *name); |
242 | |
243 | ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace); |
244 | ssize_t aa_remove_profiles(char *name, size_t size); |
245 | |
246 | #define PROF_ADD 1 |
247 | #define PROF_REPLACE 0 |
248 | |
249 | #define unconfined(X) ((X)->flags & PFLAG_UNCONFINED) |
250 | |
251 | /** |
252 | * aa_newest_version - find the newest version of @profile |
253 | * @profile: the profile to check for newer versions of (NOT NULL) |
254 | * |
255 | * Returns: newest version of @profile, if @profile is the newest version |
256 | * return @profile. |
257 | * |
258 | * NOTE: the profile returned is not refcounted, The refcount on @profile |
259 | * must be held until the caller decides what to do with the returned newest |
260 | * version. |
261 | */ |
262 | static inline struct aa_profile *aa_newest_version(struct aa_profile *profile) |
263 | { |
264 | while (profile->replacedby) |
265 | profile = profile->replacedby; |
266 | |
267 | return profile; |
268 | } |
269 | |
270 | /** |
271 | * aa_get_profile - increment refcount on profile @p |
272 | * @p: profile (MAYBE NULL) |
273 | * |
274 | * Returns: pointer to @p if @p is NULL will return NULL |
275 | * Requires: @p must be held with valid refcount when called |
276 | */ |
277 | static inline struct aa_profile *aa_get_profile(struct aa_profile *p) |
278 | { |
279 | if (p) |
280 | kref_get(&(p->base.count)); |
281 | |
282 | return p; |
283 | } |
284 | |
285 | /** |
286 | * aa_put_profile - decrement refcount on profile @p |
287 | * @p: profile (MAYBE NULL) |
288 | */ |
289 | static inline void aa_put_profile(struct aa_profile *p) |
290 | { |
291 | if (p) |
292 | kref_put(&p->base.count, aa_free_profile_kref); |
293 | } |
294 | |
295 | static inline int AUDIT_MODE(struct aa_profile *profile) |
296 | { |
297 | if (aa_g_audit != AUDIT_NORMAL) |
298 | return aa_g_audit; |
299 | |
300 | return profile->audit; |
301 | } |
302 | |
303 | bool aa_may_manage_policy(int op); |
304 | |
305 | #endif /* __AA_POLICY_H */ |
306 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9