From 2b1d572f01ffd76a23967d5ffead7036c82dc8da Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Mon, 22 May 2017 03:06:52 -0700
Subject: [PATCH 09/65] apparmor: allow profiles to provide info to
disconnected paths
Git-commit: 72c8a768641dc6ee8d1d9dcebd51bbec2817459b
Patch-mainline: v4.13-rc1
References: FATE#323500
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
---
security/apparmor/domain.c | 2 +-
security/apparmor/file.c | 7 ++++---
security/apparmor/include/path.h | 3 ++-
security/apparmor/include/policy.h | 2 ++
security/apparmor/path.c | 34 ++++++++++++++++++++++------------
security/apparmor/policy_unpack.c | 3 +++
6 files changed, 34 insertions(+), 17 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 001e133a3c8c..c92fd0e7b33c 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -366,7 +366,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
/* buffer freed below, name is pointer into buffer */
error = aa_path_name(&bprm->file->f_path, profile->path_flags, &buffer,
- &name, &info);
+ &name, &info, profile->disconnected);
if (error) {
if (unconfined(profile) ||
(profile->flags & PFLAG_IX_ON_NAME_ERROR))
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 750564c3ab71..83d43ac72134 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -285,7 +285,8 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
int error;
flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0);
- error = aa_path_name(path, flags, &buffer, &name, &info);
+ error = aa_path_name(path, flags, &buffer, &name, &info,
+ profile->disconnected);
if (error) {
if (error == -ENOENT && is_deleted(path->dentry)) {
/* Access to open files that are deleted are
@@ -366,13 +367,13 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
/* buffer freed below, lname is pointer in buffer */
error = aa_path_name(&link, profile->path_flags, &buffer, &lname,
- &info);
+ &info, profile->disconnected);
if (error)
goto audit;
/* buffer2 freed below, tname is pointer in buffer2 */
error = aa_path_name(&target, profile->path_flags, &buffer2, &tname,
- &info);
+ &info, profile->disconnected);
if (error)
goto audit;
diff --git a/security/apparmor/include/path.h b/security/apparmor/include/path.h
index 0444fdde3918..78e4909dcc6a 100644
--- a/security/apparmor/include/path.h
+++ b/security/apparmor/include/path.h
@@ -27,7 +27,8 @@ enum path_flags {
};
int aa_path_name(const struct path *path, int flags, char **buffer,
- const char **name, const char **info);
+ const char **name, const char **info,
+ const char *disconnected);
#define MAX_PATH_BUFFERS 2
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 67bc96afe541..dffa01c018c8 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -128,6 +128,7 @@ struct aa_data {
* @mode: the enforcement mode of the profile
* @flags: flags controlling profile behavior
* @path_flags: flags controlling path generation behavior
+ * @disconnected: what to prepend if attach_disconnected is specified
* @size: the memory consumed by this profiles rules
* @policy: general match rules governing policy
* @file: The set of rules governing basic file access and domain transitions
@@ -169,6 +170,7 @@ struct aa_profile {
long mode;
long flags;
u32 path_flags;
+ const char *disconnected;
int size;
struct aa_policydb policy;
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index a8fc7d08c144..9490f8e89630 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -50,7 +50,7 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
* namespace root.
*/
static int disconnect(const struct path *path, char *buf, char **name,
- int flags)
+ int flags, const char *disconnected)
{
int error = 0;
@@ -63,9 +63,14 @@ static int disconnect(const struct path *path, char *buf, char **name,
error = -EACCES;
if (**name == '/')
*name = *name + 1;
- } else if (**name != '/')
- /* CONNECT_PATH with missing root */
- error = prepend(name, *name - buf, "/", 1);
+ } else {
+ if (**name != '/')
+ /* CONNECT_PATH with missing root */
+ error = prepend(name, *name - buf, "/", 1);
+ if (!error && disconnected)
+ error = prepend(name, *name - buf, disconnected,
+ strlen(disconnected));
+ }
return error;
}
@@ -77,6 +82,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
* @buflen: length of @buf
* @name: Returns - pointer for start of path name with in @buf (NOT NULL)
* @flags: flags controlling path lookup
+ * @disconnected: string to prefix to disconnected paths
*
* Handle path name lookup.
*
@@ -85,7 +91,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
* to a position in @buf
*/
static int d_namespace_path(const struct path *path, char *buf, int buflen,
- char **name, int flags)
+ char **name, int flags, const char *disconnected)
{
char *res;
int error = 0;
@@ -106,8 +112,8 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
*/
return prepend(name, *name - buf, "/proc", 5);
} else
- return disconnect(path, buf, name, flags);
- return 0;
+ return disconnect(path, buf, name, flags,
+ disconnected);
}
/* resolve paths relative to chroot?*/
@@ -153,7 +159,7 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
}
if (!connected)
- error = disconnect(path, buf, name, flags);
+ error = disconnect(path, buf, name, flags, disconnected);
out:
return error;
@@ -170,10 +176,12 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
* Returns: %0 else error on failure
*/
static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
- int size, char **name, const char **info)
+ int size, char **name, const char **info,
+ const char *disconnected)
{
int adjust = (flags & PATH_IS_DIR) ? 1 : 0;
- int error = d_namespace_path(path, buffer, size - adjust, name, flags);
+ int error = d_namespace_path(path, buffer, size - adjust, name, flags,
+ disconnected);
if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0')
/*
@@ -203,6 +211,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
* @buffer: buffer that aa_get_name() allocated (NOT NULL)
* @name: Returns - the generated path name if !error (NOT NULL)
* @info: Returns - information on why the path lookup failed (MAYBE NULL)
+ * @disconnected: string to prepend to disconnected paths
*
* @name is a pointer to the beginning of the pathname (which usually differs
* from the beginning of the buffer), or NULL. If there is an error @name
@@ -216,7 +225,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
* Returns: %0 else error code if could retrieve name
*/
int aa_path_name(const struct path *path, int flags, char **buffer,
- const char **name, const char **info)
+ const char **name, const char **info, const char *disconnected)
{
char *buf, *str = NULL;
int size = 256;
@@ -230,7 +239,8 @@ int aa_path_name(const struct path *path, int flags, char **buffer,
if (!buf)
return -ENOMEM;
- error = get_name_to_buffer(path, flags, buf, size, &str, info);
+ error = get_name_to_buffer(path, flags, buf, size, &str, info,
+ disconnected);
if (error != -ENAMETOOLONG)
break;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 981d570eebba..182bbfeb4b2c 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -569,6 +569,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
profile->xmatch_len = tmp;
}
+ /* disconnected attachment string is optional */
+ (void) unpack_str(e, &profile->disconnected, "disconnected");
+
/* per profile debug flags (complain, audit) */
if (!unpack_nameX(e, AA_STRUCT, "flags"))
goto fail;
--
2.12.3