summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* apparmor: make sure the decompression ctx is promperly initializedJohn Johansen2022-10-031-1/+5
| | | | | | | | | The decompress ctx was not properly initialized when reading raw profile data back to userspace. Reported-by: kernel test robot <lkp@intel.com> Fixes: 52ccc20c652b ("apparmor: use zstd compression for profile data") Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Remove unnecessary size check when unpacking trans_tableJohn Johansen2022-10-031-3/+7
| | | | | | | | | | The index into the trans_table has a max size of 2^24 bits which the code was testing but this is unnecessary as unpack_array can only unpack a table of 2^16 bits in size so the table unpacked will never be larger than what can be indexed, and any test here is redundant. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Fix doc comment for compute_fpermsJohn Johansen2022-10-031-2/+2
| | | | | | | | | | When compute_fperms was moved to policy_compat and made static it was renamed from aa_compute_fperms to just compute_fperms to help indicate it is only available statically. Unfortunately the doc comment did not also get updated to reflect the change. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make __aa_path_perm() staticXiu Jianfeng2022-10-032-6/+4
| | | | | | | Make __aa_path_perm() static as it's only used inside apparmor/file.c. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Simplify obtain the newest label on a credGaosheng Cui2022-10-032-14/+1
| | | | | | | | | In aa_get_task_label(), aa_get_newest_cred_label(__task_cred(task)) can do the same things as aa_get_newest_label(__aa_task_raw_label(task)), so we can replace it and remove __aa_task_raw_label() to simplify the code. Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Fix regression in stacking due to label flagsJohn Johansen2022-10-031-5/+7
| | | | | | | | | | The unconfined label flag is not being computed correctly. It should only be set if all the profiles in the vector are set, which is different than what is required for the debug and stale flag that are set if any on the profile flags are set. Fixes: c1ed5da19765 ("apparmor: allow label to carry debug flags") Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix aa_class_names[] to match reserved classesJohn Johansen2022-10-031-1/+16
| | | | | | The class name map did not have the reserved names added. Fix this Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rework profile->rules to be a listJohn Johansen2022-10-0315-57/+142
| | | | | | | | | Convert profile->rules to a list as the next step towards supporting multiple rulesets in a profile. For this step only support a single list entry item. The logic for iterating the list will come as a separate step. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: refactor profile rules and attachmentsJohn Johansen2022-10-0318-239/+308
| | | | | | | | | In preparation for moving from a single set of rules and a single attachment to multiple rulesets and attachments separate from the profile refactor attachment information and ruleset info into their own structures. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: verify loaded permission bits masks don't overlapJohn Johansen2022-10-031-4/+30
| | | | | | | | Add an additional verification that loaded permission sets don't overlap in ways that are not intended. This will help ensure that permission accumulation can't result in an invalid permission set. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: cleanup: move perm accumulation into perms.hJohn Johansen2022-10-032-52/+53
| | | | | | | Perm accumulation is going to be used much more frequently so let the compiler figure out if it can be optimized when used. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make sure perm indexes are accumulatedJohn Johansen2022-10-033-2/+25
| | | | | | | | accumulate permission indexes on a first encountered basis. This favors original rulesets so that new ones can not override without profile replacement. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: verify permission table indexesJohn Johansen2022-10-031-1/+34
| | | | | | | While the dfa xindex's are verified, the indexes in the permission table are not currently verified. Fix this. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add the ability for policy to specify a permission tableJohn Johansen2022-10-032-11/+98
| | | | | | | | | Currently permissions are encoded in the dfa accept entries that are then mapped to an internal permission structure. This limits the permissions that userspace can specify, so allow userspace to directly specify the permission table. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make unpack_array return a trianary valueJohn Johansen2022-10-032-22/+33
| | | | | | | | | currently unpack_array() does not return an error nor whether the array is not present. The ability to detect an error or the array not being present is needed so rework the unpack_array() to return the needed information. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: group dfa policydb unpackingJohn Johansen2022-10-031-38/+63
| | | | | | | | | | | | There are currently three policydb rule groupings (xmatch, file, policydb) that each do their own slightly different thing. Group them into a single routine and unify. This extends/unifies dfa features by - all dfas are allowed having an optional start field - all dfas are allowed having a string/transition table Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make transition table unpack generic so it can be reusedJohn Johansen2022-10-031-10/+12
| | | | | | | Currently the transition table is tied to the file dfa. Make it so we can unpack a transition table against any dfa. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add user mode flagJohn Johansen2022-10-035-5/+9
| | | | | | | | Allow the profile to contain a user mode prompt flag. This works similar to complain mode but will try to send messages to a userspace daemon. If the daemon is not present or timesout regular informent will occur. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add mediation class information to auditingJohn Johansen2022-10-0314-13/+48
| | | | | | | | | | | Audit messages currently don't contain the mediation class which can make them less clear than they should be in some circumstances. With newer mediation classes coming this potential confusion will become worse. Fix this by adding the mediatin class to the messages. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: extend permissions to support a label and tag stringJohn Johansen2022-10-037-27/+32
| | | | | | | add indexes for label and tag entries. Rename the domain table to the str_table as its a shared string table with label and tags. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: isolate policy backwards compatibility to its own fileJohn Johansen2022-10-035-287/+359
| | | | | | | | | | | The details of mapping old policy into newer policy formats clutters up the unpack code and makes it possible to accidentally use old mappings in code, so isolate the mapping code into its own file. This will become more important when the dfa remapping code lands, as it will greatly expand the compat code base. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: extend xindex sizeJohn Johansen2022-10-033-17/+16
| | | | | | Allow the xindex to have 2^24 entries. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move dfa perm macros into policy_unpackJohn Johansen2022-10-032-51/+49
| | | | | | | Now that the permission remapping macros aren't needed anywhere except during profile unpack, move them. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: extend policydb permission set by making use of the xbitsJohn Johansen2022-10-031-4/+27
| | | | | | | | | | | | The policydb permission set has left the xbits unused. Make them available for mediation. Note: that this does not bring full auditing control of the permissions as there are not enough bits. The quieting of denials is provided as that is used more than forced auditing of allowed permissions. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix apparmor mediating locking non-fs unix socketsJohn Johansen2022-10-031-4/+9
| | | | | | | | | | | | the v8 and earlier policy does not encode the locking permission for no-fs unix sockets. However the kernel is enforcing mediation. Add the AA_MAY_LOCK perm to v8 and earlier computed perm mask which will grant permission for all current abi profiles, but still allow specifying auditing of the operation if needed. Link: http://bugs.launchpad.net/bugs/1780227 Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Fix abi check to include v8 abiJohn Johansen2022-10-031-1/+1
| | | | | | | | | | | | | | | The v8 abi is supported by the kernel but the userspace supported version check does not allow for it. This was missed when v8 was added due to a bug in the userspace compiler which was setting an older abi version for v8 encoding (which is forward compatible except on the network encoding). However it is possible to detect the network encoding by checking the policydb network support which the code does. The end result was that missing the abi flag worked until userspace was fixed and began correctly checking for the v8 abi version. Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation") Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: preparse for state being more than just an integerJohn Johansen2022-10-0315-102/+101
| | | | | | | | Convert from an unsigned int to a state_t for state position. This is a step in prepping for the state position carrying some additional flags, and a limited form of backtracking to support variables. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert policy lookup to use accept as an indexJohn Johansen2022-10-037-24/+33
| | | | | | | | | | Remap polidydb dfa accept table from embedded perms to an index, and then move the perm lookup to use the accept entry as an index into the perm table. This is done so that the perm table can be separated from the dfa, allowing dfa accept to index to share expanded permission sets. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: cleanup shared permission structJohn Johansen2022-10-032-12/+9
| | | | | | | | The shared permissions struct has the stop field which is unneeded and the "reserved" subtree field commented which is needed. Also reorganize so that the entries are logically grouped. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert xmatch lookup to use accept as an indexJohn Johansen2022-10-032-4/+7
| | | | | | | | | | Remap xmatch dfa accept table from embedded perms to an index and then move xmatch lookup to use accept entry to index into the xmatch table. This is step towards unifying permission lookup and reducing the size of permissions tables. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert fperm lookup to use accept as an indexJohn Johansen2022-10-032-19/+44
| | | | | | | | | Remap file dfa accept table from embedded perms to index and then move fperm lookup to use the accept entry as an index into the fperm table. This is a step toward unifying permission lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert xmatch to using the new shared policydb structJohn Johansen2022-10-036-29/+28
| | | | | | | continue permission unification by converting xmatch to use the policydb struct that is used by the other profile dfas. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: combine file_rules and aa_policydb into a single shared structJohn Johansen2022-10-037-59/+40
| | | | | | | file_rules and policydb are almost the same and will need the same features in the future so combine them. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: compute policydb permission on profile loadJohn Johansen2022-10-039-86/+90
| | | | | | | Rather than computing policydb permissions for each access permissions can be computed once on profile load and stored for lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert xmatch to use aa_perms structureJohn Johansen2022-10-033-7/+13
| | | | | | | Convert xmatch from using perms encoded in the accept entry of the dfa to the common external aa_perms in a table. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rework and cleanup fperm computationJohn Johansen2022-10-031-32/+38
| | | | | | | | | | | | shorten the name of some of the mapping functions which shortens line lengths. change the mapping so it returns the perm table instead of operating directly on the file struct. Handle potential memory allocation failure. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move fperm computation into policy_unpackJohn Johansen2022-10-033-98/+98
| | | | | | | fperm computation is only needed during policy_unpack so move the code there to isolate it fromt the run time code. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: compute xmatch permissions on profile loadMike Salvatore2022-10-034-3/+26
| | | | | | | | | Rather than computing xmatch permissions each time access is requested, these permissions can be computed once on profile load and stored for lookup. Signed-off-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: compute file permissions on profile loadMike Salvatore2022-10-035-48/+110
| | | | | | | | Rather than computing file permissions for each file access, file permissions can be computed once on profile load and stored for lookup. Signed-off-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: expose compression level limits in sysfsJon Tourville2022-10-031-0/+16
| | | | | | | | | | | | | | Create two new files in apparmor's sysfs: /sys/kernel/security/apparmor/raw_data_compression_level_min /sys/kernel/security/apparmor/raw_data_compression_level_max These correspond to the minimum and maximum zstd compression levels that can be assigned to the apparmor module parameter raw_data_compression_level. Signed-off-by: Jon Tourville <jon.tourville@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: use zstd compression for profile dataJon Tourville2022-10-034-102/+81
| | | | | | | | | | | | | | | | | | Change the algorithm used by apparmor to compress profile data from zlib to zstd, using the new zstd API introduced in 5.16. Zstd provides a larger range of compression levels than zlib and significantly better performance at the default level (for a relatively small increase in compressed size). The apparmor module parameter raw_data_compression_level is now clamped to the minimum and maximum compression levels reported by the zstd library. A compression level of 0 retains the previous behavior of disabling policy compression instead of using zstd's behavior, which is to use the default compression level. Signed-off-by: Jon Tourville <jon.tourville@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: reserve mediation classesJohn Johansen2022-10-031-1/+8
| | | | | | | Reserve mediation classes that exist in out of tree development branches or are used by userspace mediation helpers. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix lockdep warning when removing a namespaceJohn Johansen2022-10-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following lockdep warning [ 1119.158984] ============================================ [ 1119.158988] WARNING: possible recursive locking detected [ 1119.158996] 6.0.0-rc1+ #257 Tainted: G E N [ 1119.158999] -------------------------------------------- [ 1119.159001] bash/80100 is trying to acquire lock: [ 1119.159007] ffff88803e79b4a0 (&ns->lock/1){+.+.}-{4:4}, at: destroy_ns.part.0+0x43/0x140 [ 1119.159028] but task is already holding lock: [ 1119.159030] ffff8881009764a0 (&ns->lock/1){+.+.}-{4:4}, at: aa_remove_profiles+0x3f0/0x640 [ 1119.159040] other info that might help us debug this: [ 1119.159042] Possible unsafe locking scenario: [ 1119.159043] CPU0 [ 1119.159045] ---- [ 1119.159047] lock(&ns->lock/1); [ 1119.159051] lock(&ns->lock/1); [ 1119.159055] *** DEADLOCK *** Which is caused by an incorrect lockdep nesting notation Fixes: feb3c766a3ab ("apparmor: fix possible recursive lock warning in __aa_create_ns") Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix a memleak in multi_transaction_new()Gaosheng Cui2022-10-031-1/+3
| | | | | | | | | | | | In multi_transaction_new(), the variable t is not freed or passed out on the failure of copy_from_user(t->data, buf, size), which could lead to a memleak. Fix this bug by adding a put_multi_transaction(t) in the error path. Fixes: 1dea3b41e84c5 ("apparmor: speed up transactional queries") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* Merge tag 'nios2_fixes_v6.0' of ↵Linus Torvalds2022-08-165-9/+22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 fixes from Dinh Nguyen: - Security fixes from Al Viro * tag 'nios2_fixes_v6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: add force_successful_syscall_return() nios2: restarts apply only to the first sigframe we build... nios2: fix syscall restart checks nios2: traced syscall does need to check the syscall number nios2: don't leave NULLs in sys_call_table[] nios2: page fault et.al. are *not* restartable syscalls...
| * nios2: add force_successful_syscall_return()Al Viro2022-08-152-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we use the ancient SysV syscall ABI, we'd better have tell the kernel how to claim that a negative return value is a success. Use ->orig_r2 for that - it's inaccessible via ptrace, so it's a fair game for changes and it's normally[*] non-negative on return from syscall. Set to -1; syscall is not going to be restart-worthy by definition, so we won't interfere with that use either. [*] the only exception is rt_sigreturn(), where we skip the entire messing with r1/r2 anyway. Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
| * nios2: restarts apply only to the first sigframe we build...Al Viro2022-08-151-0/+1
| | | | | | | | | | | | Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
| * nios2: fix syscall restart checksAl Viro2022-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | sys_foo() returns -512 (aka -ERESTARTSYS) => do_signal() sees 512 in r2 and 1 in r1. sys_foo() returns 512 => do_signal() sees 512 in r2 and 0 in r1. The former is restart-worthy; the latter obviously isn't. Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
| * nios2: traced syscall does need to check the syscall numberAl Viro2022-08-151-3/+8
| | | | | | | | | | | | | | | | | | all checks done before letting the tracer modify the register state are worthless... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
| * nios2: don't leave NULLs in sys_call_table[]Al Viro2022-08-152-1/+1
| | | | | | | | | | | | | | | | fill the gaps in there with sys_ni_syscall, as everyone does... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 09:19:50 +0000