Lines Matching +full:subset +full:- +full:of
1 // SPDX-License-Identifier: GPL-2.0-only
5 * This file contains AppArmor mediation of files
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
38 * file_audit_cb - call back for file specific audit fields
40 * @va: audit struct to audit values of (NOT NULL)
48 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { in file_audit_cb()
50 map_mask_to_chr_mask(aad(sa)->request)); in file_audit_cb()
53 if (aad(sa)->denied & AA_AUDIT_FILE_MASK) { in file_audit_cb()
55 map_mask_to_chr_mask(aad(sa)->denied)); in file_audit_cb()
58 if (aad(sa)->request & AA_AUDIT_FILE_MASK) { in file_audit_cb()
62 from_kuid(&init_user_ns, aad(sa)->fs.ouid)); in file_audit_cb()
65 if (aad(sa)->peer) { in file_audit_cb()
67 aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer, in file_audit_cb()
69 } else if (aad(sa)->fs.target) { in file_audit_cb()
71 audit_log_untrustedstring(ab, aad(sa)->fs.target); in file_audit_cb()
76 * aa_audit_file - handle the auditing of file operations
81 * @name: name of object being mediated (MAYBE NULL)
82 * @target: name of target (MAYBE NULL)
99 aad(&sa)->request = request; in aa_audit_file()
100 aad(&sa)->name = name; in aa_audit_file()
101 aad(&sa)->fs.target = target; in aa_audit_file()
102 aad(&sa)->peer = tlabel; in aa_audit_file()
103 aad(&sa)->fs.ouid = ouid; in aa_audit_file()
104 aad(&sa)->info = info; in aa_audit_file()
105 aad(&sa)->error = error; in aa_audit_file()
108 if (likely(!aad(&sa)->error)) { in aa_audit_file()
109 u32 mask = perms->audit; in aa_audit_file()
115 aad(&sa)->request &= mask; in aa_audit_file()
117 if (likely(!aad(&sa)->request)) in aa_audit_file()
122 aad(&sa)->request = aad(&sa)->request & ~perms->allow; in aa_audit_file()
123 AA_BUG(!aad(&sa)->request); in aa_audit_file()
125 if (aad(&sa)->request & perms->kill) in aa_audit_file()
129 if ((aad(&sa)->request & perms->quiet) && in aa_audit_file()
132 aad(&sa)->request &= ~perms->quiet; in aa_audit_file()
134 if (!aad(&sa)->request) in aa_audit_file()
135 return aad(&sa)->error; in aa_audit_file()
138 aad(&sa)->denied = aad(&sa)->request & ~perms->allow; in aa_audit_file()
143 * is_deleted - test if a file has been completely unlinked
144 * @dentry: dentry of file to test for deletion (NOT NULL)
150 if (d_unlinked(dentry) && d_backing_inode(dentry)->i_nlink == 0) in is_deleted()
164 labels_profile(label)->disconnected); in path_name()
168 NULL, NULL, cond->uid, info, error)); in path_name()
176 * map_old_perms - map old file perms layout to the new layout
192 * and use was determined by part of a pair that they were in in map_old_perms()
203 * aa_compute_fperms - convert dfa compressed perms to internal perms
223 if (uid_eq(current_fsuid(), cond->uid)) { in aa_compute_fperms()
246 * aa_str_perms - find permission that match @name
251 * @perms: Returns - the permissions found when matching @name
274 aa_str_perms(profile->file.dfa, profile->file.start, name, cond, perms); in __aa_path_perm()
275 if (request & ~perms->allow) in __aa_path_perm()
276 e = -EACCES; in __aa_path_perm()
278 cond->uid, NULL, e); in __aa_path_perm()
293 error = path_name(op, &profile->label, path, in profile_path_perm()
294 flags | profile->path_flags, buffer, &name, cond, in profile_path_perm()
303 * aa_path_perm - do permissions check & audit for @path
306 * @path: path to check permissions of (NOT NULL)
322 flags |= PATH_DELEGATE_DELETED | (S_ISDIR(cond->mode) ? PATH_IS_DIR : in aa_path_perm()
326 return -ENOMEM; in aa_path_perm()
337 * xindex_is_subset - helper for aa_path_link
341 * test target x permissions are equal OR a subset of link x permissions
342 * this is done as part of the subset test, where a hardlink must have
343 * a subset of permissions that the target has.
345 * Returns: true if subset else false
368 error = path_name(OP_LINK, &profile->label, link, profile->path_flags, in profile_path_link()
374 error = path_name(OP_LINK, &profile->label, target, profile->path_flags, in profile_path_link()
379 error = -EACCES; in profile_path_link()
380 /* aa_str_perms - handles the case of the dfa being NULL */ in profile_path_link()
381 state = aa_str_perms(profile->file.dfa, profile->file.start, lname, in profile_path_link()
388 state = aa_dfa_null_transition(profile->file.dfa, state); in profile_path_link()
389 aa_str_perms(profile->file.dfa, state, tname, cond, &perms); in profile_path_link()
404 /* done if link subset test is not required */ in profile_path_link()
408 /* Do link perm subset test requiring allowed permission on link are in profile_path_link()
409 * a subset of the allowed permissions on target. in profile_path_link()
411 aa_str_perms(profile->file.dfa, profile->file.start, tname, cond, in profile_path_link()
414 /* AA_MAY_LINK is not considered in the subset test */ in profile_path_link()
425 info = "link not subset of target"; in profile_path_link()
434 NULL, cond->uid, info, error); in profile_path_link()
438 * aa_path_link - Handle hard link permission check
447 * is done from the point of the link match (not start of DFA)
450 * The subset test if required forces that permissions granted
451 * on link are a subset of the permission granted to target.
458 struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry }; in aa_path_link()
459 struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry }; in aa_path_link()
461 d_backing_inode(old_dentry)->i_uid, in aa_path_link()
462 d_backing_inode(old_dentry)->i_mode in aa_path_link()
471 error = -ENOMEM; in aa_path_link()
489 /* update caching of label on file_ctx */ in update_file_ctx()
490 spin_lock(&fctx->lock); in update_file_ctx()
491 old = rcu_dereference_protected(fctx->label, in update_file_ctx()
492 lockdep_is_held(&fctx->lock)); in update_file_ctx()
496 rcu_assign_pointer(fctx->label, l); in update_file_ctx()
500 fctx->allow |= request; in update_file_ctx()
502 spin_unlock(&fctx->lock); in update_file_ctx()
512 .uid = file_inode(file)->i_uid, in __file_path_perm()
513 .mode = file_inode(file)->i_mode in __file_path_perm()
518 /* revalidation due to label out of date. No revocation at this time */ in __file_path_perm()
526 return -ENOMEM; in __file_path_perm()
530 profile_path_perm(op, profile, &file->f_path, buffer, in __file_path_perm()
537 * TODO: cache full perms so this only happens because of in __file_path_perm()
543 profile_path_perm(op, profile, &file->f_path, in __file_path_perm()
548 profile_path_perm(op, profile, &file->f_path, in __file_path_perm()
564 struct socket *sock = (struct socket *) file->private_data; in __file_sock_perm()
569 /* revalidation due to label out of date. No revocation at this time */ in __file_sock_perm()
587 * aa_file_perm - do permission revalidation check & audit for @file
610 flabel = rcu_dereference(fctx->label); in aa_file_perm()
620 denied = request & ~fctx->allow; in aa_file_perm()
631 if (file->f_path.mnt && path_mediated_fs(file->f_path.dentry)) in aa_file_perm()
635 else if (S_ISSOCK(file_inode(file)->i_mode)) in aa_file_perm()
653 spin_lock(&tty->files_lock); in revalidate_tty()
654 if (!list_empty(&tty->tty_files)) { in revalidate_tty()
658 file_priv = list_first_entry(&tty->tty_files, in revalidate_tty()
660 file = file_priv->file; in revalidate_tty()
666 spin_unlock(&tty->files_lock); in revalidate_tty()
703 replace_fd(n - 1, devnull, 0); in aa_inherit_files()