summaryrefslogtreecommitdiffstats
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | apparmor: export that basic profile namespaces are supportedJohn Johansen2017-06-111-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow userspace to detect that basic profile policy namespaces are available. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add stacked domain labels interfaceJohn Johansen2017-06-112-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the user interface to support the stacked change_profile transition. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add domain label stacking info to apparmorfsJohn Johansen2017-06-113-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that the domain label transition is complete advertise it to userspace. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move change_profile mediation to using labelsJohn Johansen2017-06-111-68/+123
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move change_hat mediation to using labelsJohn Johansen2017-06-111-102/+201
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move exec domain mediation to using labelsJohn Johansen2017-06-112-259/+678
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: support v7 transition format compatible with label_parseJohn Johansen2017-06-112-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: mediate files when they are receivedJohn Johansen2017-06-112-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: rework file permission to cache file access in file->ctxJohn Johansen2017-06-111-6/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a temporary step, towards using the file->ctx for delegation, and also helps speed up file queries, until the permission lookup cache is introduced. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move path_link mediation to using labelsJohn Johansen2017-06-113-47/+59
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: refactor path name lookup and permission checks around labelsJohn Johansen2017-06-113-45/+85
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: update aa_audit_file() to use labelsJohn Johansen2017-06-113-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move aa_file_perm() to use labelsJohn Johansen2017-06-113-37/+64
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: allow ptrace checks to be finer grained than just capabilityJohn Johansen2017-06-113-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move ptrace checks to using labelsJohn Johansen2017-06-115-80/+58Star
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add cross check permission helper macrosJohn Johansen2017-06-111-1/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The cross check permission helper macros will help simplify code that does cross task permission checks like ptrace. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move resource checks to using labelsJohn Johansen2017-06-113-42/+80
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move capability checks to using labelsJohn Johansen2017-06-115-29/+58
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: update query interface to support label queriesJohn Johansen2017-06-111-7/+39
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: switch getprocattr to using label_print fns()John Johansen2017-06-113-37/+27Star
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: switch from profiles to using labels on contextsJohn Johansen2017-06-1120-529/+686
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add the base fns() for domain labelsJohn Johansen2017-06-112-0/+2561
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Begin moving apparmor to using broader domain labels, that will allow run time computation of domain type splitting via "stacking" of profiles into a domain label vec. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: revalidate files during execJohn Johansen2017-06-114-0/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of running file revalidation lazily when read/write are called copy selinux and revalidate the file table on exec. This avoids extra mediation overhead in read/write and also prevents file handles being passed through to a grand child unchecked. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: cleanup rename XXX_file_context() to XXX_file_ctx()John Johansen2017-06-112-11/+16
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: convert aa_change_XXX bool parameters to flagsJohn Johansen2017-06-115-32/+29Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of passing multiple booleans consolidate on a single flags field. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: cleanup remove unused and not fully implemented profile renameJohn Johansen2017-06-111-37/+2Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: refactor updating profiles to the newest parentJohn Johansen2017-06-111-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: share profile name on replacementJohn Johansen2017-06-113-9/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The profile names are the same, leverage this. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: convert to profile block critical sectionsJohn Johansen2017-06-118-56/+162
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move bprm_committing_creds/committed_creds to lsm.cJohn Johansen2017-06-113-32/+30Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no reason to have the small stubs that don't use domain private functions in domain.c, instead move them to lsm.c and make them static. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: fix display of ns nameJohn Johansen2017-06-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ns name being displayed should go through an ns view lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: fix apparmor_query dataJohn Johansen2017-06-111-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The data being queried isn't always the current profile and a lookup relative to the current profile should be done. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: fix policy load/remove semanticsJohn Johansen2017-06-112-15/+13Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add namespace lookup fns()John Johansen2017-06-113-4/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: cleanup __find_child()John Johansen2017-06-111-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: provide information about path buffer size at bootJohn Johansen2017-06-111-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add profile permission query abilityJohn Johansen2017-06-111-1/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow userspace to query a profile about permissions, through the transaction interface that is already used to allow userspace to query about key,value data. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: switch from file_perms to aa_permsJohn Johansen2017-06-115-48/+29Star
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add gerneric permissions struct and support fnsJohn Johansen2017-06-114-17/+153
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add fn to test if profile supports a given mediation classJohn Johansen2017-06-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: speed up transactional queriesJohn Johansen2017-06-111-11/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The simple_transaction interface is slow. It requires 4 syscalls (open, write, read, close) per query and shares a single lock for each queries. So replace its use with a compatible in multi_transaction interface. It allows for a faster 2 syscall pattern per query. After an initial open, an arbitrary number of writes and reads can be issued. Each write will reset the query with new data that can be read. Reads do not clear the data, and can be issued multiple times, and used with seek, until a new write is performed which will reset the data available and the seek position. Note: this keeps the single lock design, if needed moving to a per file lock will have to come later. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add label data availability to the feature setJohn Johansen2017-06-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gsettings mediation needs to be able to determine if apparmor supports label data queries. A label data query can be done to test for support but its failure is indistinguishable from other failures, making it an unreliable indicator. Fix by making support of label data queries available as a flag in the apparmorfs features dir tree. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add mkdir/rmdir interface to manage policy namespacesJohn Johansen2017-06-111-1/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When setting up namespaces for containers its easier for them to use an fs interface to create the namespace for the containers policy. Allow mkdir/rmdir under the policy/namespaces/ dir to be used to create and remove namespaces. BugLink: http://bugs.launchpad.net/bugs/1611078 Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: add policy revision file interfaceJohn Johansen2017-06-114-1/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: provide finer control over policy managementJohn Johansen2017-06-113-23/+35
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: rework perm mapping to a slightly broader setJohn Johansen2017-06-095-53/+133
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: move permissions into their own file to be more easily sharedJohn Johansen2017-06-084-19/+43
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
| * | | | | apparmor: convert from securityfs to apparmorfs for policy ns filesJohn Johansen2017-06-081-26/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Virtualize the apparmor policy/ directory so that the current namespace affects what part of policy is seen. To do this convert to using apparmorfs for policy namespace files and setup a magic symlink in the securityfs apparmor dir to access those files. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
| * | | | | apparmor: allow specifying an already created dir to create ns entries inJohn Johansen2017-06-083-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
| * | | | | apparmor: rename apparmor file fns and data to indicate useJohn Johansen2017-06-089-127/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | prefixes are used for fns/data that are not static to apparmorfs.c with the prefixes being aafs - special magic apparmorfs for policy namespace data aa_sfs - for fns/data that go into securityfs aa_fs - for fns/data that may be used in the either of aafs or securityfs Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-06-29 16:04:28 +0200