apparmor: move ptrace mediation to more logical task.{h,c}
AppArmor split out task oriented controls to their own logical file a while ago. Ptrace mediation is better grouped with task than ipc, so move it. Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
parent
f567e7fada
commit
eac931254d
5 changed files with 133 additions and 128 deletions
|
|
@ -36,6 +36,7 @@
|
|||
#include "include/policy_ns.h"
|
||||
#include "include/resource.h"
|
||||
#include "include/policy_unpack.h"
|
||||
#include "include/task.h"
|
||||
|
||||
/*
|
||||
* The apparmor filesystem interface used for policy load and introspection
|
||||
|
|
|
|||
|
|
@ -13,24 +13,6 @@
|
|||
|
||||
#include <linux/sched.h>
|
||||
|
||||
struct aa_profile;
|
||||
|
||||
#define AA_PTRACE_TRACE MAY_WRITE
|
||||
#define AA_PTRACE_READ MAY_READ
|
||||
#define AA_MAY_BE_TRACED AA_MAY_APPEND
|
||||
#define AA_MAY_BE_READ AA_MAY_CREATE
|
||||
#define PTRACE_PERM_SHIFT 2
|
||||
|
||||
#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
|
||||
AA_MAY_BE_READ | AA_MAY_BE_TRACED)
|
||||
#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
|
||||
|
||||
#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
|
||||
"segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
|
||||
"xcpu xfsz vtalrm prof winch io pwr sys emt lost"
|
||||
|
||||
int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
|
||||
u32 request);
|
||||
int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig);
|
||||
|
||||
#endif /* __AA_IPC_H */
|
||||
|
|
|
|||
|
|
@ -77,4 +77,22 @@ static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
|
|||
ctx->token = 0;
|
||||
}
|
||||
|
||||
#define AA_PTRACE_TRACE MAY_WRITE
|
||||
#define AA_PTRACE_READ MAY_READ
|
||||
#define AA_MAY_BE_TRACED AA_MAY_APPEND
|
||||
#define AA_MAY_BE_READ AA_MAY_CREATE
|
||||
#define PTRACE_PERM_SHIFT 2
|
||||
|
||||
#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
|
||||
AA_MAY_BE_READ | AA_MAY_BE_TRACED)
|
||||
#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
|
||||
|
||||
#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
|
||||
"segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
|
||||
"xcpu xfsz vtalrm prof winch io pwr sys emt lost"
|
||||
|
||||
int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
|
||||
u32 request);
|
||||
|
||||
|
||||
#endif /* __AA_TASK_H */
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@
|
|||
*/
|
||||
|
||||
#include <linux/gfp.h>
|
||||
#include <linux/ptrace.h>
|
||||
|
||||
#include "include/audit.h"
|
||||
#include "include/capability.h"
|
||||
|
|
@ -18,115 +17,6 @@
|
|||
#include "include/ipc.h"
|
||||
#include "include/sig_names.h"
|
||||
|
||||
/**
|
||||
* audit_ptrace_mask - convert mask to permission string
|
||||
* @mask: permission mask to convert
|
||||
*
|
||||
* Returns: pointer to static string
|
||||
*/
|
||||
static const char *audit_ptrace_mask(u32 mask)
|
||||
{
|
||||
switch (mask) {
|
||||
case MAY_READ:
|
||||
return "read";
|
||||
case MAY_WRITE:
|
||||
return "trace";
|
||||
case AA_MAY_BE_READ:
|
||||
return "readby";
|
||||
case AA_MAY_BE_TRACED:
|
||||
return "tracedby";
|
||||
}
|
||||
return "";
|
||||
}
|
||||
|
||||
/* call back to audit ptrace fields */
|
||||
static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
|
||||
{
|
||||
struct common_audit_data *sa = va;
|
||||
|
||||
if (aad(sa)->request & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " requested_mask=\"%s\"",
|
||||
audit_ptrace_mask(aad(sa)->request));
|
||||
|
||||
if (aad(sa)->denied & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " denied_mask=\"%s\"",
|
||||
audit_ptrace_mask(aad(sa)->denied));
|
||||
}
|
||||
}
|
||||
audit_log_format(ab, " peer=");
|
||||
aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
|
||||
FLAGS_NONE, GFP_ATOMIC);
|
||||
}
|
||||
|
||||
/* assumes check for PROFILE_MEDIATES is already done */
|
||||
/* TODO: conditionals */
|
||||
static int profile_ptrace_perm(struct aa_profile *profile,
|
||||
struct aa_label *peer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
struct aa_perms perms = { };
|
||||
|
||||
aad(sa)->peer = peer;
|
||||
aa_profile_match_label(profile, peer, AA_CLASS_PTRACE, request,
|
||||
&perms);
|
||||
aa_apply_modes_to_perms(profile, &perms);
|
||||
return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
static int profile_tracee_perm(struct aa_profile *tracee,
|
||||
struct aa_label *tracer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
if (profile_unconfined(tracee) || unconfined(tracer) ||
|
||||
!PROFILE_MEDIATES(tracee, AA_CLASS_PTRACE))
|
||||
return 0;
|
||||
|
||||
return profile_ptrace_perm(tracee, tracer, request, sa);
|
||||
}
|
||||
|
||||
static int profile_tracer_perm(struct aa_profile *tracer,
|
||||
struct aa_label *tracee, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
if (profile_unconfined(tracer))
|
||||
return 0;
|
||||
|
||||
if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE))
|
||||
return profile_ptrace_perm(tracer, tracee, request, sa);
|
||||
|
||||
/* profile uses the old style capability check for ptrace */
|
||||
if (&tracer->label == tracee)
|
||||
return 0;
|
||||
|
||||
aad(sa)->label = &tracer->label;
|
||||
aad(sa)->peer = tracee;
|
||||
aad(sa)->request = 0;
|
||||
aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE,
|
||||
CAP_OPT_NONE);
|
||||
|
||||
return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
/**
|
||||
* aa_may_ptrace - test if tracer task can trace the tracee
|
||||
* @tracer: label of the task doing the tracing (NOT NULL)
|
||||
* @tracee: task label to be traced
|
||||
* @request: permission request
|
||||
*
|
||||
* Returns: %0 else error code if permission denied or error
|
||||
*/
|
||||
int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
|
||||
u32 request)
|
||||
{
|
||||
struct aa_profile *profile;
|
||||
u32 xrequest = request << PTRACE_PERM_SHIFT;
|
||||
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
|
||||
|
||||
return xcheck_labels(tracer, tracee, profile,
|
||||
profile_tracer_perm(profile, tracee, request, &sa),
|
||||
profile_tracee_perm(profile, tracer, xrequest, &sa));
|
||||
}
|
||||
|
||||
|
||||
static inline int map_signal_num(int sig)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -12,7 +12,12 @@
|
|||
* should return to the previous cred if it has not been modified.
|
||||
*/
|
||||
|
||||
#include <linux/gfp.h>
|
||||
#include <linux/ptrace.h>
|
||||
|
||||
#include "include/audit.h"
|
||||
#include "include/cred.h"
|
||||
#include "include/policy.h"
|
||||
#include "include/task.h"
|
||||
|
||||
/**
|
||||
|
|
@ -177,3 +182,112 @@ int aa_restore_previous_label(u64 token)
|
|||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* audit_ptrace_mask - convert mask to permission string
|
||||
* @mask: permission mask to convert
|
||||
*
|
||||
* Returns: pointer to static string
|
||||
*/
|
||||
static const char *audit_ptrace_mask(u32 mask)
|
||||
{
|
||||
switch (mask) {
|
||||
case MAY_READ:
|
||||
return "read";
|
||||
case MAY_WRITE:
|
||||
return "trace";
|
||||
case AA_MAY_BE_READ:
|
||||
return "readby";
|
||||
case AA_MAY_BE_TRACED:
|
||||
return "tracedby";
|
||||
}
|
||||
return "";
|
||||
}
|
||||
|
||||
/* call back to audit ptrace fields */
|
||||
static void audit_ptrace_cb(struct audit_buffer *ab, void *va)
|
||||
{
|
||||
struct common_audit_data *sa = va;
|
||||
|
||||
if (aad(sa)->request & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " requested_mask=\"%s\"",
|
||||
audit_ptrace_mask(aad(sa)->request));
|
||||
|
||||
if (aad(sa)->denied & AA_PTRACE_PERM_MASK) {
|
||||
audit_log_format(ab, " denied_mask=\"%s\"",
|
||||
audit_ptrace_mask(aad(sa)->denied));
|
||||
}
|
||||
}
|
||||
audit_log_format(ab, " peer=");
|
||||
aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
|
||||
FLAGS_NONE, GFP_ATOMIC);
|
||||
}
|
||||
|
||||
/* assumes check for PROFILE_MEDIATES is already done */
|
||||
/* TODO: conditionals */
|
||||
static int profile_ptrace_perm(struct aa_profile *profile,
|
||||
struct aa_label *peer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
struct aa_perms perms = { };
|
||||
|
||||
aad(sa)->peer = peer;
|
||||
aa_profile_match_label(profile, peer, AA_CLASS_PTRACE, request,
|
||||
&perms);
|
||||
aa_apply_modes_to_perms(profile, &perms);
|
||||
return aa_check_perms(profile, &perms, request, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
static int profile_tracee_perm(struct aa_profile *tracee,
|
||||
struct aa_label *tracer, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
if (profile_unconfined(tracee) || unconfined(tracer) ||
|
||||
!PROFILE_MEDIATES(tracee, AA_CLASS_PTRACE))
|
||||
return 0;
|
||||
|
||||
return profile_ptrace_perm(tracee, tracer, request, sa);
|
||||
}
|
||||
|
||||
static int profile_tracer_perm(struct aa_profile *tracer,
|
||||
struct aa_label *tracee, u32 request,
|
||||
struct common_audit_data *sa)
|
||||
{
|
||||
if (profile_unconfined(tracer))
|
||||
return 0;
|
||||
|
||||
if (PROFILE_MEDIATES(tracer, AA_CLASS_PTRACE))
|
||||
return profile_ptrace_perm(tracer, tracee, request, sa);
|
||||
|
||||
/* profile uses the old style capability check for ptrace */
|
||||
if (&tracer->label == tracee)
|
||||
return 0;
|
||||
|
||||
aad(sa)->label = &tracer->label;
|
||||
aad(sa)->peer = tracee;
|
||||
aad(sa)->request = 0;
|
||||
aad(sa)->error = aa_capable(&tracer->label, CAP_SYS_PTRACE,
|
||||
CAP_OPT_NONE);
|
||||
|
||||
return aa_audit(AUDIT_APPARMOR_AUTO, tracer, sa, audit_ptrace_cb);
|
||||
}
|
||||
|
||||
/**
|
||||
* aa_may_ptrace - test if tracer task can trace the tracee
|
||||
* @tracer: label of the task doing the tracing (NOT NULL)
|
||||
* @tracee: task label to be traced
|
||||
* @request: permission request
|
||||
*
|
||||
* Returns: %0 else error code if permission denied or error
|
||||
*/
|
||||
int aa_may_ptrace(struct aa_label *tracer, struct aa_label *tracee,
|
||||
u32 request)
|
||||
{
|
||||
struct aa_profile *profile;
|
||||
u32 xrequest = request << PTRACE_PERM_SHIFT;
|
||||
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
|
||||
|
||||
return xcheck_labels(tracer, tracee, profile,
|
||||
profile_tracer_perm(profile, tracee, request, &sa),
|
||||
profile_tracee_perm(profile, tracer, xrequest, &sa));
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue