apparmor: allow profiles to provide info to disconnected paths
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
parent
b91deb9db1
commit
72c8a76864
|
@ -366,7 +366,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
|
|||
|
||||
/* buffer freed below, name is pointer into buffer */
|
||||
error = aa_path_name(&bprm->file->f_path, profile->path_flags, &buffer,
|
||||
&name, &info);
|
||||
&name, &info, profile->disconnected);
|
||||
if (error) {
|
||||
if (unconfined(profile) ||
|
||||
(profile->flags & PFLAG_IX_ON_NAME_ERROR))
|
||||
|
|
|
@ -285,7 +285,8 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
|
|||
int error;
|
||||
|
||||
flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0);
|
||||
error = aa_path_name(path, flags, &buffer, &name, &info);
|
||||
error = aa_path_name(path, flags, &buffer, &name, &info,
|
||||
profile->disconnected);
|
||||
if (error) {
|
||||
if (error == -ENOENT && is_deleted(path->dentry)) {
|
||||
/* Access to open files that are deleted are
|
||||
|
@ -366,13 +367,13 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
|
|||
|
||||
/* buffer freed below, lname is pointer in buffer */
|
||||
error = aa_path_name(&link, profile->path_flags, &buffer, &lname,
|
||||
&info);
|
||||
&info, profile->disconnected);
|
||||
if (error)
|
||||
goto audit;
|
||||
|
||||
/* buffer2 freed below, tname is pointer in buffer2 */
|
||||
error = aa_path_name(&target, profile->path_flags, &buffer2, &tname,
|
||||
&info);
|
||||
&info, profile->disconnected);
|
||||
if (error)
|
||||
goto audit;
|
||||
|
||||
|
|
|
@ -27,7 +27,8 @@ enum path_flags {
|
|||
};
|
||||
|
||||
int aa_path_name(const struct path *path, int flags, char **buffer,
|
||||
const char **name, const char **info);
|
||||
const char **name, const char **info,
|
||||
const char *disconnected);
|
||||
|
||||
#define MAX_PATH_BUFFERS 2
|
||||
|
||||
|
|
|
@ -128,6 +128,7 @@ struct aa_data {
|
|||
* @mode: the enforcement mode of the profile
|
||||
* @flags: flags controlling profile behavior
|
||||
* @path_flags: flags controlling path generation behavior
|
||||
* @disconnected: what to prepend if attach_disconnected is specified
|
||||
* @size: the memory consumed by this profiles rules
|
||||
* @policy: general match rules governing policy
|
||||
* @file: The set of rules governing basic file access and domain transitions
|
||||
|
@ -169,6 +170,7 @@ struct aa_profile {
|
|||
long mode;
|
||||
long flags;
|
||||
u32 path_flags;
|
||||
const char *disconnected;
|
||||
int size;
|
||||
|
||||
struct aa_policydb policy;
|
||||
|
|
|
@ -50,7 +50,7 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
|
|||
* namespace root.
|
||||
*/
|
||||
static int disconnect(const struct path *path, char *buf, char **name,
|
||||
int flags)
|
||||
int flags, const char *disconnected)
|
||||
{
|
||||
int error = 0;
|
||||
|
||||
|
@ -63,9 +63,14 @@ static int disconnect(const struct path *path, char *buf, char **name,
|
|||
error = -EACCES;
|
||||
if (**name == '/')
|
||||
*name = *name + 1;
|
||||
} else if (**name != '/')
|
||||
} else {
|
||||
if (**name != '/')
|
||||
/* CONNECT_PATH with missing root */
|
||||
error = prepend(name, *name - buf, "/", 1);
|
||||
if (!error && disconnected)
|
||||
error = prepend(name, *name - buf, disconnected,
|
||||
strlen(disconnected));
|
||||
}
|
||||
|
||||
return error;
|
||||
}
|
||||
|
@ -77,6 +82,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
|
|||
* @buflen: length of @buf
|
||||
* @name: Returns - pointer for start of path name with in @buf (NOT NULL)
|
||||
* @flags: flags controlling path lookup
|
||||
* @disconnected: string to prefix to disconnected paths
|
||||
*
|
||||
* Handle path name lookup.
|
||||
*
|
||||
|
@ -85,7 +91,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
|
|||
* to a position in @buf
|
||||
*/
|
||||
static int d_namespace_path(const struct path *path, char *buf, int buflen,
|
||||
char **name, int flags)
|
||||
char **name, int flags, const char *disconnected)
|
||||
{
|
||||
char *res;
|
||||
int error = 0;
|
||||
|
@ -106,8 +112,8 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
|
|||
*/
|
||||
return prepend(name, *name - buf, "/proc", 5);
|
||||
} else
|
||||
return disconnect(path, buf, name, flags);
|
||||
return 0;
|
||||
return disconnect(path, buf, name, flags,
|
||||
disconnected);
|
||||
}
|
||||
|
||||
/* resolve paths relative to chroot?*/
|
||||
|
@ -153,7 +159,7 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
|
|||
}
|
||||
|
||||
if (!connected)
|
||||
error = disconnect(path, buf, name, flags);
|
||||
error = disconnect(path, buf, name, flags, disconnected);
|
||||
|
||||
out:
|
||||
return error;
|
||||
|
@ -170,10 +176,12 @@ out:
|
|||
* Returns: %0 else error on failure
|
||||
*/
|
||||
static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
|
||||
int size, char **name, const char **info)
|
||||
int size, char **name, const char **info,
|
||||
const char *disconnected)
|
||||
{
|
||||
int adjust = (flags & PATH_IS_DIR) ? 1 : 0;
|
||||
int error = d_namespace_path(path, buffer, size - adjust, name, flags);
|
||||
int error = d_namespace_path(path, buffer, size - adjust, name, flags,
|
||||
disconnected);
|
||||
|
||||
if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0')
|
||||
/*
|
||||
|
@ -203,6 +211,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
|
|||
* @buffer: buffer that aa_get_name() allocated (NOT NULL)
|
||||
* @name: Returns - the generated path name if !error (NOT NULL)
|
||||
* @info: Returns - information on why the path lookup failed (MAYBE NULL)
|
||||
* @disconnected: string to prepend to disconnected paths
|
||||
*
|
||||
* @name is a pointer to the beginning of the pathname (which usually differs
|
||||
* from the beginning of the buffer), or NULL. If there is an error @name
|
||||
|
@ -216,7 +225,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
|
|||
* Returns: %0 else error code if could retrieve name
|
||||
*/
|
||||
int aa_path_name(const struct path *path, int flags, char **buffer,
|
||||
const char **name, const char **info)
|
||||
const char **name, const char **info, const char *disconnected)
|
||||
{
|
||||
char *buf, *str = NULL;
|
||||
int size = 256;
|
||||
|
@ -230,7 +239,8 @@ int aa_path_name(const struct path *path, int flags, char **buffer,
|
|||
if (!buf)
|
||||
return -ENOMEM;
|
||||
|
||||
error = get_name_to_buffer(path, flags, buf, size, &str, info);
|
||||
error = get_name_to_buffer(path, flags, buf, size, &str, info,
|
||||
disconnected);
|
||||
if (error != -ENAMETOOLONG)
|
||||
break;
|
||||
|
||||
|
|
|
@ -569,6 +569,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
|
|||
profile->xmatch_len = tmp;
|
||||
}
|
||||
|
||||
/* disconnected attachment string is optional */
|
||||
(void) unpack_str(e, &profile->disconnected, "disconnected");
|
||||
|
||||
/* per profile debug flags (complain, audit) */
|
||||
if (!unpack_nameX(e, AA_STRUCT, "flags"))
|
||||
goto fail;
|
||||
|
|
Loading…
Reference in New Issue