GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-07 07:08:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: fix module parameters can be changed after policy is locked

Browse source 
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2016-06-22 18:01:08 -07:00
parent 5f20fdfed1
commit 58acf9d911
3 changed files with 29 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
security/apparmor/include/policy.h
View file

@ -403,6 +403,8 @@ static inline int AUDIT_MODE(struct aa_profile *profile)
return profile->audit; return profile->audit;
} }
bool policy_view_capable(void);
bool policy_admin_capable(void);
bool aa_may_manage_policy(int op); bool aa_may_manage_policy(int op);
#endif /* __AA_POLICY_H */ #endif /* __AA_POLICY_H */

22
security/apparmor/lsm.c
View file

@ -730,51 +730,49 @@ __setup("apparmor=", apparmor_enabled_setup);
/* set global flag turning off the ability to load policy */ /* set global flag turning off the ability to load policy */
static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
if (aa_g_lock_policy)
return -EACCES;
return param_set_bool(val, kp); return param_set_bool(val, kp);
} }
static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_view_capable())
return -EPERM; return -EPERM;
return param_get_bool(buffer, kp); return param_get_bool(buffer, kp);
} }
static int param_set_aabool(const char *val, const struct kernel_param *kp) static int param_set_aabool(const char *val, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
return param_set_bool(val, kp); return param_set_bool(val, kp);
} }
static int param_get_aabool(char *buffer, const struct kernel_param *kp) static int param_get_aabool(char *buffer, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_view_capable())
return -EPERM; return -EPERM;
return param_get_bool(buffer, kp); return param_get_bool(buffer, kp);
} }
static int param_set_aauint(const char *val, const struct kernel_param *kp) static int param_set_aauint(const char *val, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
return param_set_uint(val, kp); return param_set_uint(val, kp);
} }
static int param_get_aauint(char *buffer, const struct kernel_param *kp) static int param_get_aauint(char *buffer, const struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_view_capable())
return -EPERM; return -EPERM;
return param_get_uint(buffer, kp); return param_get_uint(buffer, kp);
} }
static int param_get_audit(char *buffer, struct kernel_param *kp) static int param_get_audit(char *buffer, struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_view_capable())
return -EPERM; return -EPERM;
if (!apparmor_enabled) if (!apparmor_enabled)
@ -786,7 +784,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
static int param_set_audit(const char *val, struct kernel_param *kp) static int param_set_audit(const char *val, struct kernel_param *kp)
{ {
int i; int i;
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
if (!apparmor_enabled) if (!apparmor_enabled)
@ -807,7 +805,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
static int param_get_mode(char *buffer, struct kernel_param *kp) static int param_get_mode(char *buffer, struct kernel_param *kp)
{ {
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
if (!apparmor_enabled) if (!apparmor_enabled)
@ -819,7 +817,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
static int param_set_mode(const char *val, struct kernel_param *kp) static int param_set_mode(const char *val, struct kernel_param *kp)
{ {
int i; int i;
if (!capable(CAP_MAC_ADMIN)) if (!policy_admin_capable())
return -EPERM; return -EPERM;
if (!apparmor_enabled) if (!apparmor_enabled)

18
security/apparmor/policy.c
View file

@ -918,6 +918,22 @@ static int audit_policy(int op, gfp_t gfp, const char *name, const char *info,
&sa, NULL); &sa, NULL);
} }
bool policy_view_capable(void)
{
struct user_namespace *user_ns = current_user_ns();
bool response = false;
if (ns_capable(user_ns, CAP_MAC_ADMIN))
response = true;
return response;
}
bool policy_admin_capable(void)
{
return policy_view_capable() && !aa_g_lock_policy;
}
/** /**
* aa_may_manage_policy - can the current task manage policy * aa_may_manage_policy - can the current task manage policy
* @op: the policy manipulation operation being done * @op: the policy manipulation operation being done
@ -932,7 +948,7 @@ bool aa_may_manage_policy(int op)
return 0; return 0;
} }
if (!capable(CAP_MAC_ADMIN)) { if (!policy_admin_capable()) {
audit_policy(op, GFP_KERNEL, NULL, "not policy admin", -EACCES); audit_policy(op, GFP_KERNEL, NULL, "not policy admin", -EACCES);
return 0; return 0;
} }