diff options
author | John Johansen <john.johansen@canonical.com> | 2017-05-22 03:06:52 -0700 |
---|---|---|
committer | John Johansen <john.johansen@canonical.com> | 2017-06-08 11:29:34 -0700 |
commit | 72c8a768641dc6ee8d1d9dcebd51bbec2817459b (patch) | |
tree | d0153542d088beddf662ffaeff25017c970093b7 /security/apparmor | |
parent | b91deb9db12851c18ccb55719f1cd55c2400aca1 (diff) |
apparmor: allow profiles to provide info to disconnected paths
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r-- | security/apparmor/domain.c | 2 | ||||
-rw-r--r-- | security/apparmor/file.c | 7 | ||||
-rw-r--r-- | security/apparmor/include/path.h | 3 | ||||
-rw-r--r-- | security/apparmor/include/policy.h | 2 | ||||
-rw-r--r-- | security/apparmor/path.c | 34 | ||||
-rw-r--r-- | security/apparmor/policy_unpack.c | 3 |
6 files changed, 34 insertions, 17 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 001e133a3c8c..c92fd0e7b33c 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -366,7 +366,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) /* buffer freed below, name is pointer into buffer */ error = aa_path_name(&bprm->file->f_path, profile->path_flags, &buffer, - &name, &info); + &name, &info, profile->disconnected); if (error) { if (unconfined(profile) || (profile->flags & PFLAG_IX_ON_NAME_ERROR)) diff --git a/security/apparmor/file.c b/security/apparmor/file.c index 750564c3ab71..83d43ac72134 100644 --- a/security/apparmor/file.c +++ b/security/apparmor/file.c @@ -285,7 +285,8 @@ int aa_path_perm(const char *op, struct aa_profile *profile, int error; flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0); - error = aa_path_name(path, flags, &buffer, &name, &info); + error = aa_path_name(path, flags, &buffer, &name, &info, + profile->disconnected); if (error) { if (error == -ENOENT && is_deleted(path->dentry)) { /* Access to open files that are deleted are @@ -366,13 +367,13 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry, /* buffer freed below, lname is pointer in buffer */ error = aa_path_name(&link, profile->path_flags, &buffer, &lname, - &info); + &info, profile->disconnected); if (error) goto audit; /* buffer2 freed below, tname is pointer in buffer2 */ error = aa_path_name(&target, profile->path_flags, &buffer2, &tname, - &info); + &info, profile->disconnected); if (error) goto audit; diff --git a/security/apparmor/include/path.h b/security/apparmor/include/path.h index 0444fdde3918..78e4909dcc6a 100644 --- a/security/apparmor/include/path.h +++ b/security/apparmor/include/path.h @@ -27,7 +27,8 @@ enum path_flags { }; int aa_path_name(const struct path *path, int flags, char **buffer, - const char **name, const char **info); + const char **name, const char **info, + const char *disconnected); #define MAX_PATH_BUFFERS 2 diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index 67bc96afe541..dffa01c018c8 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -128,6 +128,7 @@ struct aa_data { * @mode: the enforcement mode of the profile * @flags: flags controlling profile behavior * @path_flags: flags controlling path generation behavior + * @disconnected: what to prepend if attach_disconnected is specified * @size: the memory consumed by this profiles rules * @policy: general match rules governing policy * @file: The set of rules governing basic file access and domain transitions @@ -169,6 +170,7 @@ struct aa_profile { long mode; long flags; u32 path_flags; + const char *disconnected; int size; struct aa_policydb policy; diff --git a/security/apparmor/path.c b/security/apparmor/path.c index a8fc7d08c144..9490f8e89630 100644 --- a/security/apparmor/path.c +++ b/security/apparmor/path.c @@ -50,7 +50,7 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen) * namespace root. */ static int disconnect(const struct path *path, char *buf, char **name, - int flags) + int flags, const char *disconnected) { int error = 0; @@ -63,9 +63,14 @@ static int disconnect(const struct path *path, char *buf, char **name, error = -EACCES; if (**name == '/') *name = *name + 1; - } else if (**name != '/') - /* CONNECT_PATH with missing root */ - error = prepend(name, *name - buf, "/", 1); + } else { + if (**name != '/') + /* CONNECT_PATH with missing root */ + error = prepend(name, *name - buf, "/", 1); + if (!error && disconnected) + error = prepend(name, *name - buf, disconnected, + strlen(disconnected)); + } return error; } @@ -77,6 +82,7 @@ static int disconnect(const struct path *path, char *buf, char **name, * @buflen: length of @buf * @name: Returns - pointer for start of path name with in @buf (NOT NULL) * @flags: flags controlling path lookup + * @disconnected: string to prefix to disconnected paths * * Handle path name lookup. * @@ -85,7 +91,7 @@ static int disconnect(const struct path *path, char *buf, char **name, * to a position in @buf */ static int d_namespace_path(const struct path *path, char *buf, int buflen, - char **name, int flags) + char **name, int flags, const char *disconnected) { char *res; int error = 0; @@ -106,8 +112,8 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen, */ return prepend(name, *name - buf, "/proc", 5); } else - return disconnect(path, buf, name, flags); - return 0; + return disconnect(path, buf, name, flags, + disconnected); } /* resolve paths relative to chroot?*/ @@ -153,7 +159,7 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen, } if (!connected) - error = disconnect(path, buf, name, flags); + error = disconnect(path, buf, name, flags, disconnected); out: return error; @@ -170,10 +176,12 @@ out: * Returns: %0 else error on failure */ static int get_name_to_buffer(const struct path *path, int flags, char *buffer, - int size, char **name, const char **info) + int size, char **name, const char **info, + const char *disconnected) { int adjust = (flags & PATH_IS_DIR) ? 1 : 0; - int error = d_namespace_path(path, buffer, size - adjust, name, flags); + int error = d_namespace_path(path, buffer, size - adjust, name, flags, + disconnected); if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0') /* @@ -203,6 +211,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer, * @buffer: buffer that aa_get_name() allocated (NOT NULL) * @name: Returns - the generated path name if !error (NOT NULL) * @info: Returns - information on why the path lookup failed (MAYBE NULL) + * @disconnected: string to prepend to disconnected paths * * @name is a pointer to the beginning of the pathname (which usually differs * from the beginning of the buffer), or NULL. If there is an error @name @@ -216,7 +225,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer, * Returns: %0 else error code if could retrieve name */ int aa_path_name(const struct path *path, int flags, char **buffer, - const char **name, const char **info) + const char **name, const char **info, const char *disconnected) { char *buf, *str = NULL; int size = 256; @@ -230,7 +239,8 @@ int aa_path_name(const struct path *path, int flags, char **buffer, if (!buf) return -ENOMEM; - error = get_name_to_buffer(path, flags, buf, size, &str, info); + error = get_name_to_buffer(path, flags, buf, size, &str, info, + disconnected); if (error != -ENAMETOOLONG) break; diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index f3422a91353c..6bc1b10191fa 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -569,6 +569,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) profile->xmatch_len = tmp; } + /* disconnected attachment string is optional */ + (void) unpack_str(e, &profile->disconnected, "disconnected"); + /* per profile debug flags (complain, audit) */ if (!unpack_nameX(e, AA_STRUCT, "flags")) goto fail; |