LXR linux/security/apparmor/include/perms.h

   1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor basic permission sets definitions.
   5 *
   6 * Copyright 2017 Canonical Ltd.
   7 *
   8 * This program is free software; you can redistribute it and/or
   9 * modify it under the terms of the GNU General Public License as
  10 * published by the Free Software Foundation, version 2 of the
  11 * License.
  12 */
  13
  14#ifndef __AA_PERM_H
  15#define __AA_PERM_H
  16
  17#include <linux/fs.h>
  18#include "label.h"
  19
  20#define AA_MAY_EXEC             MAY_EXEC
  21#define AA_MAY_WRITE            MAY_WRITE
  22#define AA_MAY_READ             MAY_READ
  23#define AA_MAY_APPEND           MAY_APPEND
  24
  25#define AA_MAY_CREATE           0x0010
  26#define AA_MAY_DELETE           0x0020
  27#define AA_MAY_OPEN             0x0040
  28#define AA_MAY_RENAME           0x0080          /* pair */
  29
  30#define AA_MAY_SETATTR          0x0100          /* meta write */
  31#define AA_MAY_GETATTR          0x0200          /* meta read */
  32#define AA_MAY_SETCRED          0x0400          /* security cred/attr */
  33#define AA_MAY_GETCRED          0x0800
  34
  35#define AA_MAY_CHMOD            0x1000          /* pair */
  36#define AA_MAY_CHOWN            0x2000          /* pair */
  37#define AA_MAY_CHGRP            0x4000          /* pair */
  38#define AA_MAY_LOCK             0x8000          /* LINK_SUBSET overlaid */
  39
  40#define AA_EXEC_MMAP            0x00010000
  41#define AA_MAY_MPROT            0x00020000      /* extend conditions */
  42#define AA_MAY_LINK             0x00040000      /* pair */
  43#define AA_MAY_SNAPSHOT         0x00080000      /* pair */
  44
  45#define AA_MAY_DELEGATE
  46#define AA_CONT_MATCH           0x08000000
  47
  48#define AA_MAY_STACK            0x10000000
  49#define AA_MAY_ONEXEC           0x20000000 /* either stack or change_profile */
  50#define AA_MAY_CHANGE_PROFILE   0x40000000
  51#define AA_MAY_CHANGEHAT        0x80000000
  52
  53#define AA_LINK_SUBSET          AA_MAY_LOCK     /* overlaid */
  54
  55
  56#define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE |         \
  57                         AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK |    \
  58                         AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND)
  59
  60#define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME |     \
  61                          AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \
  62                          AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \
  63                          AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \
  64                          AA_MAY_STACK | AA_MAY_ONEXEC |                \
  65                          AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT)
  66
  67extern const char aa_file_perm_chrs[];
  68extern const char *aa_file_perm_names[];
  69
  70struct aa_perms {
  71        u32 allow;
  72        u32 audit;      /* set only when allow is set */
  73
  74        u32 deny;       /* explicit deny, or conflict if allow also set */
  75        u32 quiet;      /* set only when ~allow | deny */
  76        u32 kill;       /* set only when ~allow | deny */
  77        u32 stop;       /* set only when ~allow | deny */
  78
  79        u32 complain;   /* accumulates only used when ~allow & ~deny */
  80        u32 cond;       /* set only when ~allow and ~deny */
  81
  82        u32 hide;       /* set only when  ~allow | deny */
  83        u32 prompt;     /* accumulates only used when ~allow & ~deny */
  84
  85        /* Reserved:
  86         * u32 subtree; / * set only when allow is set * /
  87         */
  88        u16 xindex;
  89};
  90
  91#define ALL_PERMS_MASK 0xffffffff
  92extern struct aa_perms nullperms;
  93extern struct aa_perms allperms;
  94
  95
  96#define xcheck(FN1, FN2)        \
  97({                              \
  98        int e, error = FN1;     \
  99        e = FN2;                \
 100        if (e)                  \
 101                error = e;      \
 102        error;                  \
 103})
 104
 105
 106/*
 107 * TODO: update for labels pointing to labels instead of profiles
 108 * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
 109 * gah this doesn't allow for label compound check!!!!
 110 */
 111#define xcheck_ns_profile_profile(P1, P2, FN, args...)          \
 112({                                                              \
 113        int ____e = 0;                                          \
 114        if (P1->ns == P2->ns)                                   \
 115                ____e = FN((P1), (P2), args);                   \
 116        (____e);                                                \
 117})
 118
 119#define xcheck_ns_profile_label(P, L, FN, args...)              \
 120({                                                              \
 121        struct aa_profile *__p2;                                \
 122        fn_for_each((L), __p2,                                  \
 123                    xcheck_ns_profile_profile((P), __p2, (FN), args));  \
 124})
 125
 126#define xcheck_ns_labels(L1, L2, FN, args...)                   \
 127({                                                              \
 128        struct aa_profile *__p1;                                \
 129        fn_for_each((L1), __p1, FN(__p1, (L2), args));          \
 130})
 131
 132/* Do the cross check but applying FN at the profiles level */
 133#define xcheck_labels_profiles(L1, L2, FN, args...)             \
 134        xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
 135
 136#define xcheck_labels(L1, L2, P, FN1, FN2)                      \
 137        xcheck(fn_for_each((L1), (P), (FN1)), fn_for_each((L2), (P), (FN2)))
 138
 139
 140void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
 141void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
 142                         u32 mask);
 143void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
 144                        u32 chrsmask, const char * const *names, u32 namesmask);
 145void aa_apply_modes_to_perms(struct aa_profile *profile,
 146                             struct aa_perms *perms);
 147void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
 148                      struct aa_perms *perms);
 149void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend);
 150void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend);
 151void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
 152                            int type, u32 request, struct aa_perms *perms);
 153int aa_profile_label_perm(struct aa_profile *profile, struct aa_profile *target,
 154                          u32 request, int type, u32 *deny,
 155                          struct common_audit_data *sa);
 156int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
 157                   u32 request, struct common_audit_data *sa,
 158                   void (*cb)(struct audit_buffer *, void *));
 159#endif /* __AA_PERM_H */
 160