AppArmor: Add ability to load extended policy
Add the base support for the new policy extensions. This does not bring any additional functionality, or change current semantics. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
This commit is contained in:
parent
57fa1e1809
commit
ad5ff3db53
|
@ -19,6 +19,19 @@
|
||||||
|
|
||||||
#include "match.h"
|
#include "match.h"
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Class of mediation types in the AppArmor policy db
|
||||||
|
*/
|
||||||
|
#define AA_CLASS_ENTRY 0
|
||||||
|
#define AA_CLASS_UNKNOWN 1
|
||||||
|
#define AA_CLASS_FILE 2
|
||||||
|
#define AA_CLASS_CAP 3
|
||||||
|
#define AA_CLASS_NET 4
|
||||||
|
#define AA_CLASS_RLIMITS 5
|
||||||
|
#define AA_CLASS_DOMAIN 6
|
||||||
|
|
||||||
|
#define AA_CLASS_LAST AA_CLASS_DOMAIN
|
||||||
|
|
||||||
/* Control parameters settable through module/boot flags */
|
/* Control parameters settable through module/boot flags */
|
||||||
extern enum audit_mode aa_g_audit;
|
extern enum audit_mode aa_g_audit;
|
||||||
extern bool aa_g_audit_header;
|
extern bool aa_g_audit_header;
|
||||||
|
|
|
@ -129,6 +129,17 @@ struct aa_namespace {
|
||||||
struct list_head sub_ns;
|
struct list_head sub_ns;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
/* struct aa_policydb - match engine for a policy
|
||||||
|
* dfa: dfa pattern match
|
||||||
|
* start: set of start states for the different classes of data
|
||||||
|
*/
|
||||||
|
struct aa_policydb {
|
||||||
|
/* Generic policy DFA specific rule types will be subsections of it */
|
||||||
|
struct aa_dfa *dfa;
|
||||||
|
unsigned int start[AA_CLASS_LAST + 1];
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
/* struct aa_profile - basic confinement data
|
/* struct aa_profile - basic confinement data
|
||||||
* @base - base components of the profile (name, refcount, lists, lock ...)
|
* @base - base components of the profile (name, refcount, lists, lock ...)
|
||||||
* @parent: parent of profile
|
* @parent: parent of profile
|
||||||
|
@ -143,6 +154,7 @@ struct aa_namespace {
|
||||||
* @flags: flags controlling profile behavior
|
* @flags: flags controlling profile behavior
|
||||||
* @path_flags: flags controlling path generation behavior
|
* @path_flags: flags controlling path generation behavior
|
||||||
* @size: the memory consumed by this profiles rules
|
* @size: the memory consumed by this profiles rules
|
||||||
|
* @policy: general match rules governing policy
|
||||||
* @file: The set of rules governing basic file access and domain transitions
|
* @file: The set of rules governing basic file access and domain transitions
|
||||||
* @caps: capabilities for the profile
|
* @caps: capabilities for the profile
|
||||||
* @rlimits: rlimits for the profile
|
* @rlimits: rlimits for the profile
|
||||||
|
@ -179,6 +191,7 @@ struct aa_profile {
|
||||||
u32 path_flags;
|
u32 path_flags;
|
||||||
int size;
|
int size;
|
||||||
|
|
||||||
|
struct aa_policydb policy;
|
||||||
struct aa_file_rules file;
|
struct aa_file_rules file;
|
||||||
struct aa_caps caps;
|
struct aa_caps caps;
|
||||||
struct aa_rlimit rlimits;
|
struct aa_rlimit rlimits;
|
||||||
|
|
|
@ -749,6 +749,7 @@ static void free_profile(struct aa_profile *profile)
|
||||||
|
|
||||||
aa_free_sid(profile->sid);
|
aa_free_sid(profile->sid);
|
||||||
aa_put_dfa(profile->xmatch);
|
aa_put_dfa(profile->xmatch);
|
||||||
|
aa_put_dfa(profile->policy.dfa);
|
||||||
|
|
||||||
aa_put_profile(profile->replacedby);
|
aa_put_profile(profile->replacedby);
|
||||||
|
|
||||||
|
|
|
@ -469,7 +469,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
|
||||||
{
|
{
|
||||||
struct aa_profile *profile = NULL;
|
struct aa_profile *profile = NULL;
|
||||||
const char *name = NULL;
|
const char *name = NULL;
|
||||||
int error = -EPROTO;
|
int i, error = -EPROTO;
|
||||||
kernel_cap_t tmpcap;
|
kernel_cap_t tmpcap;
|
||||||
u32 tmp;
|
u32 tmp;
|
||||||
|
|
||||||
|
@ -562,6 +562,28 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
|
||||||
if (!unpack_rlimits(e, profile))
|
if (!unpack_rlimits(e, profile))
|
||||||
goto fail;
|
goto fail;
|
||||||
|
|
||||||
|
if (unpack_nameX(e, AA_STRUCT, "policydb")) {
|
||||||
|
/* generic policy dfa - optional and may be NULL */
|
||||||
|
profile->policy.dfa = unpack_dfa(e);
|
||||||
|
if (IS_ERR(profile->policy.dfa)) {
|
||||||
|
error = PTR_ERR(profile->policy.dfa);
|
||||||
|
profile->policy.dfa = NULL;
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
if (!unpack_u32(e, &profile->policy.start[0], "start"))
|
||||||
|
/* default start state */
|
||||||
|
profile->policy.start[0] = DFA_START;
|
||||||
|
/* setup class index */
|
||||||
|
for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
|
||||||
|
profile->policy.start[i] =
|
||||||
|
aa_dfa_next(profile->policy.dfa,
|
||||||
|
profile->policy.start[0],
|
||||||
|
i);
|
||||||
|
}
|
||||||
|
if (!unpack_nameX(e, AA_STRUCTEND, NULL))
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
/* get file rules */
|
/* get file rules */
|
||||||
profile->file.dfa = unpack_dfa(e);
|
profile->file.dfa = unpack_dfa(e);
|
||||||
if (IS_ERR(profile->file.dfa)) {
|
if (IS_ERR(profile->file.dfa)) {
|
||||||
|
|
Reference in New Issue