summaryrefslogtreecommitdiff
path: root/security/apparmor
AgeCommit message (Collapse)Author
2017-01-16apparmor: prepare to support newer versions of policyJohn Johansen
Newer policy encodes more than just version in the version tag, so add masking to make sure the comparison remains correct. Note: this is fully compatible with older policy as it will never set the bits being masked out. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add support for force complain flag to support learning modeJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: remove paranoid load switchJohn Johansen
Policy should always under go a full paranoid verification. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: name null-XXX profiles after the executableJohn Johansen
When possible its better to name a learning profile after the missing profile in question. This allows for both more informative names and for profile reuse. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: pass gfp_t parameter into profile allocationJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: refactor prepare_ns() and make usable from different viewsJohn Johansen
prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: update policy_destroy to use new debug assertsJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: pass gfp param into aa_policy_init()John Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: constify policy name and hnameJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename hname_tail to basenameJohn Johansen
Rename to the shorter and more familiar shell cmd name Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename mediated_filesystem() to path_mediated_fs()John Johansen
Rename to indicate the test is only about whether path mediation is used, not whether other types of mediation might be used. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add debug assert AA_BUG and Kconfig to control debug infoJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add macro for bug asserts to check that a lock is heldJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: allow ns visibility question to consider subnsesJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add fn to lookup profiles by fqnameJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add lib fn to find the "split" for fqnamesJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add strn version of aa_find_nsJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: add strn version of lookup_profile fnJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename replacedby to proxyJohn Johansen
Proxy is shorter and a better fit than replaceby, so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename PFLAG_INVALID to PFLAG_STALEJohn Johansen
Invalid does not convey the meaning of the flag anymore so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename sid to secidJohn Johansen
Move to common terminology with other LSMs and kernel infrastucture Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: rename namespace to ns to improve code line lengthsJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: split apparmor policy namespaces code into its own fileJohn Johansen
Policy namespaces will be diverging from profile management and expanding so put it in its own file. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: split out shared policy_XXX fns to libJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16apparmor: move lib definitions into separate lib includeJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-15apparmor: use designated initializersKees Cook
Prepare to mark sensitive kernel structures for randomization by making sure they're using designated initializers. These were identified during allyesconfig builds of x86, arm, and arm64, with most initializer fixes extracted from grsecurity. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-15AppArmor: Use GFP_KERNEL for __aa_kvmalloc().Tetsuo Handa
Calling kmalloc(GFP_NOIO) with order == PAGE_ALLOC_COSTLY_ORDER is not recommended because it might fall into infinite retry loop without invoking the OOM killer. Since aa_dfa_unpack() is the only caller of kvzalloc() and aa_dfa_unpack() which is calling kvzalloc() via unpack_table() is doing kzalloc(GFP_KERNEL), it is safe to use GFP_KERNEL from __aa_kvmalloc(). Since aa_simple_write_to_buffer() is the only caller of kvmalloc() and aa_simple_write_to_buffer() is calling copy_from_user() which is GFP_KERNEL context (see memdup_user_nul()), it is safe to use GFP_KERNEL from __aa_kvmalloc(). Therefore, replace GFP_NOIO with GFP_KERNEL. Also, since we have vmalloc() fallback, add __GFP_NORETRY so that we don't invoke the OOM killer by kmalloc(GFP_KERNEL) with order == PAGE_ALLOC_COSTLY_ORDER. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-14locking/atomic, kref: Use kref_get_unless_zero() morePeter Zijlstra
For some obscure reason apparmor thinks its needs to locally implement kref primitives that already exist. Stop doing this. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-01-09proc,security: move restriction on writing /proc/pid/attr nodes to procStephen Smalley
Processes can only alter their own security attributes via /proc/pid/attr nodes. This is presently enforced by each individual security module and is also imposed by the Linux credentials implementation, which only allows a task to alter its own credentials. Move the check enforcing this restriction from the individual security modules to proc_pid_attr_write() before calling the security hook, and drop the unnecessary task argument to the security hook since it can only ever be the current task. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2016-11-21apparmor: fix change_hat not finding hat after policy replacementJohn Johansen
After a policy replacement, the task cred may be out of date and need to be updated. However change_hat is using the stale profiles from the out of date cred resulting in either: a stale profile being applied or, incorrect failure when searching for a hat profile as it has been migrated to the new parent profile. Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat) Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied) Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287 Cc: stable@vger.kernel.org Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2016-09-27fs: Replace CURRENT_TIME with current_time() for inode timestampsDeepa Dinamani
CURRENT_TIME macro is not appropriate for filesystems as it doesn't use the right granularity for filesystem timestamps. Use current_time() instead. CURRENT_TIME is also not y2038 safe. This is also in preparation for the patch that transitions vfs timestamps to use 64 bit time and hence make them y2038 safe. As part of the effort current_time() will be extended to do range checks. Hence, it is necessary for all file system timestamps to use current_time(). Also, current_time() will be transitioned along with vfs to be y2038 safe. Note that whenever a single call to current_time() is used to change timestamps in different inodes, it is because they share the same time granularity. Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Felipe Balbi <balbi@kernel.org> Acked-by: Steven Whitehouse <swhiteho@redhat.com> Acked-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Acked-by: David Sterba <dsterba@suse.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2016-07-27apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handlingArnd Bergmann
The newly added Kconfig option could never work and just causes a build error when disabled: security/apparmor/lsm.c:675:25: error: 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function) bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT; The problem is that the macro undefined in this case, and we need to use the IS_ENABLED() helper to turn it into a boolean constant. Another minor problem with the original patch is that the option is even offered in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the option in that case. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2016-07-12apparmor: fix arg_size computation for when setprocattr is null terminatedJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix oops, validate buffer size in apparmor_setprocattr()Vegard Nossum
When proc_pid_attr_write() was changed to use memdup_user apparmor's (interface violating) assumption that the setprocattr buffer was always a single page was violated. The size test is not strictly speaking needed as proc_pid_attr_write() will reject anything larger, but for the sake of robustness we can keep it in. SMACK and SELinux look safe to me, but somebody else should probably have a look just in case. Based on original patch from Vegard Nossum <vegard.nossum@oracle.com> modified for the case that apparmor provides null termination. Fixes: bb646cdb12e75d82258c2f2e7746d5952d3e321a Reported-by: Vegard Nossum <vegard.nossum@oracle.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: John Johansen <john.johansen@canonical.com> Cc: Paul Moore <paul@paul-moore.com> Cc: Stephen Smalley <sds@tycho.nsa.gov> Cc: Eric Paris <eparis@parisplace.org> Cc: Casey Schaufler <casey@schaufler-ca.com> Cc: stable@kernel.org Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2016-07-12apparmor: do not expose kernel stackHeinrich Schuchardt
Do not copy uninitalized fields th.td_hilen, th.td_data. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix module parameters can be changed after policy is lockedJohn Johansen
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement. split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter. Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix oops in profile_unpack() when policy_db is not presentJohn Johansen
BugLink: http://bugs.launchpad.net/bugs/1592547 If unpack_dfa() returns NULL due to the dfa not being present, profile_unpack() is not checking if the dfa is not present (NULL). Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: don't check for vmalloc_addr if kvzalloc() failedJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: add missing id bounds check on dfa verificationJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another taskJeff Mahoney
While using AppArmor, SYS_CAP_RESOURCE is insufficient to call prlimit on another task. The only other example of a AppArmor mediating access to another, already running, task (ignoring fork+exec) is ptrace. The AppArmor model for ptrace is that one of the following must be true: 1) The tracer is unconfined 2) The tracer is in complain mode 3) The tracer and tracee are confined by the same profile 4) The tracer is confined but has SYS_CAP_PTRACE 1), 2, and 3) are already true for setrlimit. We can match the ptrace model just by allowing CAP_SYS_RESOURCE. We still test the values of the rlimit since it can always be overridden using a value that means unlimited for a particular resource. Signed-off-by: Jeff Mahoney <jeffm@suse.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: use list_next_entry instead of list_entry_nextGeliang Tang
list_next_entry has been defined in list.h, so I replace list_entry_next with it. Signed-off-by: Geliang Tang <geliangtang@163.com> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-12apparmor: fix refcount race when finding a child profileJohn Johansen
When finding a child profile via an rcu critical section, the profile may be put and scheduled for deletion after the child is found but before its refcount is incremented. Protect against this by repeating the lookup if the profiles refcount is 0 and is one its way to deletion. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix ref count leak when profile sha1 hash is readJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: check that xindex is in trans_table boundsJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: ensure the target profile name is always auditedJohn Johansen
The target profile name was not being correctly audited in a few cases because the target variable was not being set and gotos passed the code to set it at apply: Since it is always based on new_profile just drop the target var and conditionally report based on new_profile. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix audit full profile hname on successful loadJohn Johansen
Currently logging of a successful profile load only logs the basename of the profile. This can result in confusion when a child profile has the same name as the another profile in the set. Logging the hname will ensure there is no confusion. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix log failures for all profiles in a setJohn Johansen
currently only the profile that is causing the failure is logged. This makes it more confusing than necessary about which profiles loaded and which didn't. So make sure to log success and failure messages for all profiles in the set being loaded. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: fix put() parent ref after updating the active refJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: add parameter to control whether policy hashing is usedJohn Johansen
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-07-12apparmor: internal paths should be treated as disconnectedJohn Johansen
Internal mounts are not mounted anywhere and as such should be treated as disconnected paths. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
generated by cgit (git 2.34.1) at 2024-05-23 05:33:55 +0000