123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809 |
- #include <asm/unaligned.h>
- #include <linux/ctype.h>
- #include <linux/errno.h>
- #include "include/apparmor.h"
- #include "include/audit.h"
- #include "include/context.h"
- #include "include/crypto.h"
- #include "include/match.h"
- #include "include/policy.h"
- #include "include/policy_unpack.h"
- enum aa_code {
- AA_U8,
- AA_U16,
- AA_U32,
- AA_U64,
- AA_NAME,
- AA_STRING,
- AA_BLOB,
- AA_STRUCT,
- AA_STRUCTEND,
- AA_LIST,
- AA_LISTEND,
- AA_ARRAY,
- AA_ARRAYEND,
- };
- struct aa_ext {
- void *start;
- void *end;
- void *pos;
- u32 version;
- };
- static void audit_cb(struct audit_buffer *ab, void *va)
- {
- struct common_audit_data *sa = va;
- if (sa->aad->iface.target) {
- struct aa_profile *name = sa->aad->iface.target;
- audit_log_format(ab, " name=");
- audit_log_untrustedstring(ab, name->base.hname);
- }
- if (sa->aad->iface.pos)
- audit_log_format(ab, " offset=%ld", sa->aad->iface.pos);
- }
- static int audit_iface(struct aa_profile *new, const char *name,
- const char *info, struct aa_ext *e, int error)
- {
- struct aa_profile *profile = __aa_current_profile();
- struct common_audit_data sa;
- struct apparmor_audit_data aad = {0,};
- sa.type = LSM_AUDIT_DATA_NONE;
- sa.aad = &aad;
- if (e)
- aad.iface.pos = e->pos - e->start;
- aad.iface.target = new;
- aad.name = name;
- aad.info = info;
- aad.error = error;
- return aa_audit(AUDIT_APPARMOR_STATUS, profile, GFP_KERNEL, &sa,
- audit_cb);
- }
- static bool inbounds(struct aa_ext *e, size_t size)
- {
- return (size <= e->end - e->pos);
- }
- static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
- {
- size_t size = 0;
- if (!inbounds(e, sizeof(u16)))
- return 0;
- size = le16_to_cpu(get_unaligned((u16 *) e->pos));
- e->pos += sizeof(u16);
- if (!inbounds(e, size))
- return 0;
- *chunk = e->pos;
- e->pos += size;
- return size;
- }
- static bool unpack_X(struct aa_ext *e, enum aa_code code)
- {
- if (!inbounds(e, 1))
- return 0;
- if (*(u8 *) e->pos != code)
- return 0;
- e->pos++;
- return 1;
- }
- static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
- {
-
- void *pos = e->pos;
-
- if (unpack_X(e, AA_NAME)) {
- char *tag = NULL;
- size_t size = unpack_u16_chunk(e, &tag);
-
- if (name && (!size || strcmp(name, tag)))
- goto fail;
- } else if (name) {
-
- goto fail;
- }
-
- if (unpack_X(e, code))
- return 1;
- fail:
- e->pos = pos;
- return 0;
- }
- static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
- {
- if (unpack_nameX(e, AA_U32, name)) {
- if (!inbounds(e, sizeof(u32)))
- return 0;
- if (data)
- *data = le32_to_cpu(get_unaligned((u32 *) e->pos));
- e->pos += sizeof(u32);
- return 1;
- }
- return 0;
- }
- static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
- {
- if (unpack_nameX(e, AA_U64, name)) {
- if (!inbounds(e, sizeof(u64)))
- return 0;
- if (data)
- *data = le64_to_cpu(get_unaligned((u64 *) e->pos));
- e->pos += sizeof(u64);
- return 1;
- }
- return 0;
- }
- static size_t unpack_array(struct aa_ext *e, const char *name)
- {
- if (unpack_nameX(e, AA_ARRAY, name)) {
- int size;
- if (!inbounds(e, sizeof(u16)))
- return 0;
- size = (int)le16_to_cpu(get_unaligned((u16 *) e->pos));
- e->pos += sizeof(u16);
- return size;
- }
- return 0;
- }
- static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
- {
- if (unpack_nameX(e, AA_BLOB, name)) {
- u32 size;
- if (!inbounds(e, sizeof(u32)))
- return 0;
- size = le32_to_cpu(get_unaligned((u32 *) e->pos));
- e->pos += sizeof(u32);
- if (inbounds(e, (size_t) size)) {
- *blob = e->pos;
- e->pos += size;
- return size;
- }
- }
- return 0;
- }
- static int unpack_str(struct aa_ext *e, const char **string, const char *name)
- {
- char *src_str;
- size_t size = 0;
- void *pos = e->pos;
- *string = NULL;
- if (unpack_nameX(e, AA_STRING, name)) {
- size = unpack_u16_chunk(e, &src_str);
- if (size) {
-
- if (src_str[size - 1] != 0)
- goto fail;
- *string = src_str;
- }
- }
- return size;
- fail:
- e->pos = pos;
- return 0;
- }
- static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
- {
- const char *tmp;
- void *pos = e->pos;
- int res = unpack_str(e, &tmp, name);
- *string = NULL;
- if (!res)
- return 0;
- *string = kmemdup(tmp, res, GFP_KERNEL);
- if (!*string) {
- e->pos = pos;
- return 0;
- }
- return res;
- }
- #define DFA_VALID_PERM_MASK 0xffffffff
- #define DFA_VALID_PERM2_MASK 0xffffffff
- static bool verify_accept(struct aa_dfa *dfa, int flags)
- {
- int i;
-
- for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
- int mode = ACCEPT_TABLE(dfa)[i];
- if (mode & ~DFA_VALID_PERM_MASK)
- return 0;
- if (ACCEPT_TABLE2(dfa)[i] & ~DFA_VALID_PERM2_MASK)
- return 0;
- }
- return 1;
- }
- static struct aa_dfa *unpack_dfa(struct aa_ext *e)
- {
- char *blob = NULL;
- size_t size;
- struct aa_dfa *dfa = NULL;
- size = unpack_blob(e, &blob, "aadfa");
- if (size) {
-
- size_t sz = blob - (char *) e->start -
- ((e->pos - e->start) & 7);
- size_t pad = ALIGN(sz, 8) - sz;
- int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
- TO_ACCEPT2_FLAG(YYTD_DATA32);
- if (aa_g_paranoid_load)
- flags |= DFA_FLAG_VERIFY_STATES;
- dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
- if (IS_ERR(dfa))
- return dfa;
- if (!verify_accept(dfa, flags))
- goto fail;
- }
- return dfa;
- fail:
- aa_put_dfa(dfa);
- return ERR_PTR(-EPROTO);
- }
- static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
- {
- void *pos = e->pos;
-
- if (unpack_nameX(e, AA_STRUCT, "xtable")) {
- int i, size;
- size = unpack_array(e, NULL);
-
- if (size > 16 - 4)
- goto fail;
- profile->file.trans.table = kzalloc(sizeof(char *) * size,
- GFP_KERNEL);
- if (!profile->file.trans.table)
- goto fail;
- profile->file.trans.size = size;
- for (i = 0; i < size; i++) {
- char *str;
- int c, j, size2 = unpack_strdup(e, &str, NULL);
-
- if (!size2)
- goto fail;
- profile->file.trans.table[i] = str;
-
- if (isspace(*str))
- goto fail;
-
- for (c = j = 0; j < size2 - 2; j++) {
- if (!str[j])
- c++;
- }
- if (*str == ':') {
-
- if (c != 1)
- goto fail;
-
- if (!str[1])
- goto fail;
- } else if (c)
-
- goto fail;
- }
- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
- goto fail;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- }
- return 1;
- fail:
- aa_free_domain_entries(&profile->file.trans);
- e->pos = pos;
- return 0;
- }
- static bool unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
- {
- void *pos = e->pos;
-
- if (unpack_nameX(e, AA_STRUCT, "rlimits")) {
- int i, size;
- u32 tmp = 0;
- if (!unpack_u32(e, &tmp, NULL))
- goto fail;
- profile->rlimits.mask = tmp;
- size = unpack_array(e, NULL);
- if (size > RLIM_NLIMITS)
- goto fail;
- for (i = 0; i < size; i++) {
- u64 tmp2 = 0;
- int a = aa_map_resource(i);
- if (!unpack_u64(e, &tmp2, NULL))
- goto fail;
- profile->rlimits.limits[a].rlim_max = tmp2;
- }
- if (!unpack_nameX(e, AA_ARRAYEND, NULL))
- goto fail;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- }
- return 1;
- fail:
- e->pos = pos;
- return 0;
- }
- static struct aa_profile *unpack_profile(struct aa_ext *e)
- {
- struct aa_profile *profile = NULL;
- const char *name = NULL;
- int i, error = -EPROTO;
- kernel_cap_t tmpcap;
- u32 tmp;
-
- if (!unpack_nameX(e, AA_STRUCT, "profile"))
- goto fail;
- if (!unpack_str(e, &name, NULL))
- goto fail;
- profile = aa_alloc_profile(name);
- if (!profile)
- return ERR_PTR(-ENOMEM);
-
- (void) unpack_str(e, &profile->rename, "rename");
-
- (void) unpack_str(e, &profile->attach, "attach");
-
- profile->xmatch = unpack_dfa(e);
- if (IS_ERR(profile->xmatch)) {
- error = PTR_ERR(profile->xmatch);
- profile->xmatch = NULL;
- goto fail;
- }
-
- if (profile->xmatch) {
- if (!unpack_u32(e, &tmp, NULL))
- goto fail;
- profile->xmatch_len = tmp;
- }
-
- if (!unpack_nameX(e, AA_STRUCT, "flags"))
- goto fail;
- if (!unpack_u32(e, &tmp, NULL))
- goto fail;
- if (tmp & PACKED_FLAG_HAT)
- profile->flags |= PFLAG_HAT;
- if (!unpack_u32(e, &tmp, NULL))
- goto fail;
- if (tmp == PACKED_MODE_COMPLAIN)
- profile->mode = APPARMOR_COMPLAIN;
- else if (tmp == PACKED_MODE_KILL)
- profile->mode = APPARMOR_KILL;
- else if (tmp == PACKED_MODE_UNCONFINED)
- profile->mode = APPARMOR_UNCONFINED;
- if (!unpack_u32(e, &tmp, NULL))
- goto fail;
- if (tmp)
- profile->audit = AUDIT_ALL;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
-
- if (unpack_u32(e, &profile->path_flags, "path_flags"))
- profile->path_flags |= profile->flags & PFLAG_MEDIATE_DELETED;
- else
-
- profile->path_flags = PFLAG_MEDIATE_DELETED;
- if (!unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
- goto fail;
- if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
- goto fail;
- if (!unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
- goto fail;
- if (!unpack_u32(e, &tmpcap.cap[0], NULL))
- goto fail;
- if (unpack_nameX(e, AA_STRUCT, "caps64")) {
-
- if (!unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
- goto fail;
- if (!unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
- goto fail;
- if (!unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
- goto fail;
- if (!unpack_u32(e, &(tmpcap.cap[1]), NULL))
- goto fail;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- }
- if (unpack_nameX(e, AA_STRUCT, "capsx")) {
-
- if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
- goto fail;
- if (!unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
- goto fail;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- }
- if (!unpack_rlimits(e, profile))
- goto fail;
- if (unpack_nameX(e, AA_STRUCT, "policydb")) {
-
- profile->policy.dfa = unpack_dfa(e);
- if (IS_ERR(profile->policy.dfa)) {
- error = PTR_ERR(profile->policy.dfa);
- profile->policy.dfa = NULL;
- goto fail;
- } else if (!profile->policy.dfa) {
- error = -EPROTO;
- goto fail;
- }
- if (!unpack_u32(e, &profile->policy.start[0], "start"))
-
- profile->policy.start[0] = DFA_START;
-
- for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
- profile->policy.start[i] =
- aa_dfa_next(profile->policy.dfa,
- profile->policy.start[0],
- i);
- }
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- }
-
- profile->file.dfa = unpack_dfa(e);
- if (IS_ERR(profile->file.dfa)) {
- error = PTR_ERR(profile->file.dfa);
- profile->file.dfa = NULL;
- goto fail;
- }
- if (!unpack_u32(e, &profile->file.start, "dfa_start"))
-
- profile->file.start = DFA_START;
- if (!unpack_trans_table(e, profile))
- goto fail;
- if (!unpack_nameX(e, AA_STRUCTEND, NULL))
- goto fail;
- return profile;
- fail:
- if (profile)
- name = NULL;
- else if (!name)
- name = "unknown";
- audit_iface(profile, name, "failed to unpack profile", e, error);
- aa_free_profile(profile);
- return ERR_PTR(error);
- }
- static int verify_header(struct aa_ext *e, int required, const char **ns)
- {
- int error = -EPROTONOSUPPORT;
- const char *name = NULL;
- *ns = NULL;
-
- if (!unpack_u32(e, &e->version, "version")) {
- if (required) {
- audit_iface(NULL, NULL, "invalid profile format", e,
- error);
- return error;
- }
-
- if (e->version != 5) {
- audit_iface(NULL, NULL, "unsupported interface version",
- e, error);
- return error;
- }
- }
-
- if (unpack_str(e, &name, "namespace")) {
- if (*ns && strcmp(*ns, name))
- audit_iface(NULL, NULL, "invalid ns change", e, error);
- else if (!*ns)
- *ns = name;
- }
- return 0;
- }
- static bool verify_xindex(int xindex, int table_size)
- {
- int index, xtype;
- xtype = xindex & AA_X_TYPE_MASK;
- index = xindex & AA_X_INDEX_MASK;
- if (xtype == AA_X_TABLE && index >= table_size)
- return 0;
- return 1;
- }
- static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
- {
- int i;
- for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
- if (!verify_xindex(dfa_user_xindex(dfa, i), table_size))
- return 0;
- if (!verify_xindex(dfa_other_xindex(dfa, i), table_size))
- return 0;
- }
- return 1;
- }
- static int verify_profile(struct aa_profile *profile)
- {
- if (aa_g_paranoid_load) {
- if (profile->file.dfa &&
- !verify_dfa_xindex(profile->file.dfa,
- profile->file.trans.size)) {
- audit_iface(profile, NULL, "Invalid named transition",
- NULL, -EPROTO);
- return -EPROTO;
- }
- }
- return 0;
- }
- void aa_load_ent_free(struct aa_load_ent *ent)
- {
- if (ent) {
- aa_put_profile(ent->rename);
- aa_put_profile(ent->old);
- aa_put_profile(ent->new);
- kzfree(ent);
- }
- }
- struct aa_load_ent *aa_load_ent_alloc(void)
- {
- struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
- if (ent)
- INIT_LIST_HEAD(&ent->list);
- return ent;
- }
- int aa_unpack(void *udata, size_t size, struct list_head *lh, const char **ns)
- {
- struct aa_load_ent *tmp, *ent;
- struct aa_profile *profile = NULL;
- int error;
- struct aa_ext e = {
- .start = udata,
- .end = udata + size,
- .pos = udata,
- };
- *ns = NULL;
- while (e.pos < e.end) {
- void *start;
- error = verify_header(&e, e.pos == e.start, ns);
- if (error)
- goto fail;
- start = e.pos;
- profile = unpack_profile(&e);
- if (IS_ERR(profile)) {
- error = PTR_ERR(profile);
- goto fail;
- }
- error = verify_profile(profile);
- if (error)
- goto fail_profile;
- error = aa_calc_profile_hash(profile, e.version, start,
- e.pos - start);
- if (error)
- goto fail_profile;
- ent = aa_load_ent_alloc();
- if (!ent) {
- error = -ENOMEM;
- goto fail_profile;
- }
- ent->new = profile;
- list_add_tail(&ent->list, lh);
- }
- return 0;
- fail_profile:
- aa_put_profile(profile);
- fail:
- list_for_each_entry_safe(ent, tmp, lh, list) {
- list_del_init(&ent->list);
- aa_load_ent_free(ent);
- }
- return error;
- }
|