2006-04-11 21:52:54 +00:00
|
|
|
/*
|
2007-04-11 08:12:51 +00:00
|
|
|
* Copyright (c) 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007
|
|
|
|
|
* NOVELL (All rights reserved)
|
2006-04-11 21:52:54 +00:00
|
|
|
*
|
2012-02-24 04:21:59 -08:00
|
|
|
* Copyright (c) 2010 - 2012
|
|
|
|
|
* Canonical Ltd. (All rights reserved)
|
2010-03-12 15:26:32 -08:00
|
|
|
*
|
2006-04-11 21:52:54 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
|
|
|
* License published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
2010-03-12 15:26:32 -08:00
|
|
|
* along with this program; if not, contact Novell, Inc. or Canonical
|
|
|
|
|
* Ltd.
|
2006-04-11 21:52:54 +00:00
|
|
|
*/
|
|
|
|
|
|
2012-02-16 08:16:18 -08:00
|
|
|
#ifndef __AA_PARSER_H
|
|
|
|
|
#define __AA_PARSER_H
|
|
|
|
|
|
2013-09-27 16:13:22 -07:00
|
|
|
|
2014-04-23 11:07:49 -07:00
|
|
|
#include <endian.h>
|
2013-09-27 16:13:22 -07:00
|
|
|
#include <string.h>
|
2008-04-06 18:55:46 +00:00
|
|
|
#include <sys/resource.h>
|
2014-04-23 11:07:49 -07:00
|
|
|
|
2014-08-23 23:50:43 -07:00
|
|
|
#include <libintl.h>
|
|
|
|
|
#define _(s) gettext(s)
|
|
|
|
|
|
2015-03-25 17:09:27 -05:00
|
|
|
#include <sys/apparmor.h>
|
|
|
|
|
|
2021-04-20 01:32:41 -07:00
|
|
|
#include "file_cache.h"
|
2006-04-11 21:52:54 +00:00
|
|
|
#include "immunix.h"
|
2007-02-27 02:29:16 +00:00
|
|
|
#include "libapparmor_re/apparmor_re.h"
|
2011-03-13 05:49:15 -07:00
|
|
|
#include "libapparmor_re/aare_rules.h"
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2014-04-07 03:16:50 -07:00
|
|
|
#include <string>
|
|
|
|
|
|
2013-09-27 16:13:22 -07:00
|
|
|
using namespace std;
|
|
|
|
|
|
|
|
|
|
#include <set>
|
2013-09-27 16:16:37 -07:00
|
|
|
class Profile;
|
2014-04-07 03:16:50 -07:00
|
|
|
class rule_t;
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
|
2015-03-25 17:09:25 -05:00
|
|
|
#define MODULE_NAME "apparmor"
|
|
|
|
|
|
2012-02-16 07:59:23 -08:00
|
|
|
/* Global variable to pass token to lexer. Will be replaced by parameter
|
|
|
|
|
* when lexer and parser are made reentrant
|
|
|
|
|
*/
|
|
|
|
|
extern int parser_token;
|
|
|
|
|
|
2014-10-08 13:20:20 -07:00
|
|
|
|
2020-08-28 08:35:45 -07:00
|
|
|
#define WARN_RULE_NOT_ENFORCED 0x1
|
|
|
|
|
#define WARN_RULE_DOWNGRADED 0x2
|
|
|
|
|
#define WARN_ABI 0x4
|
|
|
|
|
#define WARN_DEPRECATED 0x8
|
|
|
|
|
#define WARN_CONFIG 0x10
|
|
|
|
|
#define WARN_CACHE 0x20
|
|
|
|
|
#define WARN_DEBUG_CACHE 0x40
|
|
|
|
|
#define WARN_JOBS 0x80
|
|
|
|
|
#define WARN_DANGEROUS 0x100
|
|
|
|
|
#define WARN_UNEXPECTED 0x200
|
|
|
|
|
#define WARN_FORMAT 0x400
|
|
|
|
|
#define WARN_MISSING 0x800
|
|
|
|
|
#define WARN_OVERRIDE 0x1000
|
|
|
|
|
|
|
|
|
|
#define WARN_DEV (WARN_RULE_NOT_ENFORCED | WARN_RULE_DOWNGRADED | WARN_ABI | \
|
|
|
|
|
WARN_DEPRECATED | WARN_DANGEROUS | WARN_UNEXPECTED | \
|
|
|
|
|
WARN_FORMAT | WARN_MISSING | WARN_OVERRIDE | WARN_DEBUG_CACHE)
|
|
|
|
|
|
|
|
|
|
#define DEFAULT_WARNINGS (WARN_CONFIG | WARN_CACHE | WARN_JOBS | \
|
|
|
|
|
WARN_UNEXPECTED | WARN_OVERRIDE)
|
|
|
|
|
|
|
|
|
|
#define WARN_ALL (WARN_RULE_NOT_ENFORCED | WARN_RULE_DOWNGRADED | WARN_ABI | \
|
|
|
|
|
WARN_DEPRECATED | WARN_CONFIG | WARN_CACHE | \
|
|
|
|
|
WARN_DEBUG_CACHE | WARN_JOBS | WARN_DANGEROUS | \
|
|
|
|
|
WARN_UNEXPECTED | WARN_FORMAT | WARN_MISSING | WARN_OVERRIDE)
|
2014-10-08 13:20:20 -07:00
|
|
|
|
|
|
|
|
extern dfaflags_t warnflags;
|
2020-08-28 11:38:12 -07:00
|
|
|
extern dfaflags_t werrflags;
|
2014-10-08 13:20:20 -07:00
|
|
|
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
typedef enum pattern_t pattern_t;
|
|
|
|
|
|
2013-09-12 13:26:13 -07:00
|
|
|
struct prefixes {
|
|
|
|
|
int audit;
|
|
|
|
|
int deny;
|
|
|
|
|
int owner;
|
|
|
|
|
};
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct cod_pattern {
|
|
|
|
|
char *regex; // posix regex
|
|
|
|
|
};
|
|
|
|
|
|
2012-02-16 08:07:28 -08:00
|
|
|
struct value_list {
|
|
|
|
|
char *value;
|
|
|
|
|
|
|
|
|
|
struct value_list *next;
|
|
|
|
|
};
|
|
|
|
|
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
struct cond_entry {
|
|
|
|
|
char *name;
|
2012-03-26 06:17:40 -07:00
|
|
|
int eq; /* where equals was used in specifying list */
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
struct value_list *vals;
|
|
|
|
|
|
|
|
|
|
struct cond_entry *next;
|
|
|
|
|
};
|
|
|
|
|
|
2014-04-23 11:36:26 -07:00
|
|
|
struct cond_entry_list {
|
|
|
|
|
char *name;
|
|
|
|
|
|
|
|
|
|
struct cond_entry *list;
|
|
|
|
|
};
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct cod_entry {
|
2007-11-16 09:34:53 +00:00
|
|
|
char *name;
|
2015-06-12 15:25:10 -07:00
|
|
|
union {
|
|
|
|
|
char *link_name;
|
|
|
|
|
char *onexec;
|
|
|
|
|
};
|
2008-04-16 04:45:02 +00:00
|
|
|
char *nt_name;
|
2013-09-27 16:16:37 -07:00
|
|
|
Profile *prof; /* Special profile defined
|
2006-04-11 21:52:54 +00:00
|
|
|
* just for this executable */
|
2007-11-16 09:34:53 +00:00
|
|
|
int mode; /* mode is 'or' of AA_* bits */
|
Add Audit control to AppArmor through, the use of audit and deny
key words. Deny is also used to subtract permissions from the
profiles permission set.
the audit key word can be prepended to any file, network, or capability
rule, to force a selective audit when that rule is matched. Audit
permissions accumulate just like standard permissions.
eg.
audit /bin/foo rw,
will force an audit message when the file /bin/foo is opened for
read or write.
audit /etc/shadow w,
/etc/shadow r,
will force an audit message when /etc/shadow is opened for writing.
The audit message is per permission bit so only opening the file
for read access will not, force an audit message.
audit can also be used in block form instead of prepending audit
to every rule.
audit {
/bin/foo rw,
/etc/shadow w,
}
/etc/shadow r, # don't audit r access to /etc/shadow
the deny key word can be prepended to file, network and capability
rules, to result in a denial of permissions when matching that rule.
The deny rule specifically does 3 things
- it gives AppArmor the ability to remember what has been denied
so that the tools don't prompt for what has been denied in
previous profiling sessions.
- it subtracts globally from the allowed permissions. Deny permissions
accumulate in the the deny set just as allow permissions accumulate
then, the deny set is subtracted from the allow set.
- it quiets known rejects. The default audit behavior of deny rules
is to quiet known rejects so that audit logs are not flooded
with already known rejects. To have known rejects logged prepend
the audit keyword to the deny rule. Deny rules do not have a
block form.
eg.
deny /foo/bar rw,
audit deny /etc/shadow w,
audit {
deny owner /blah w,
deny other /foo w,
deny /etc/shadow w,
}
2008-03-13 17:39:03 +00:00
|
|
|
int audit; /* audit flags for mode */
|
2007-11-16 09:34:53 +00:00
|
|
|
int deny; /* TRUE or FALSE */
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2010-02-12 13:46:55 -08:00
|
|
|
int alias_ignore; /* ignore for alias processing */
|
|
|
|
|
|
2008-03-13 16:49:10 +00:00
|
|
|
int subset;
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
pattern_t pattern_type;
|
|
|
|
|
struct cod_pattern pat;
|
|
|
|
|
|
|
|
|
|
struct cod_entry *next;
|
|
|
|
|
};
|
|
|
|
|
|
2008-04-06 18:55:46 +00:00
|
|
|
struct aa_rlimits {
|
|
|
|
|
unsigned int specified; /* limits that are set */
|
|
|
|
|
rlim_t limits[RLIMIT_NLIMITS];
|
|
|
|
|
};
|
|
|
|
|
|
2010-02-12 13:49:58 -08:00
|
|
|
struct alt_name {
|
|
|
|
|
char *name;
|
|
|
|
|
struct alt_name *next;
|
|
|
|
|
};
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
struct sd_hat {
|
|
|
|
|
char *hat_name;
|
|
|
|
|
unsigned int hat_magic;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct var_string {
|
|
|
|
|
char *prefix;
|
|
|
|
|
char *var;
|
|
|
|
|
char *suffix;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define COD_READ_CHAR 'r'
|
|
|
|
|
#define COD_WRITE_CHAR 'w'
|
2007-07-27 20:31:38 +00:00
|
|
|
#define COD_APPEND_CHAR 'a'
|
2006-04-11 21:52:54 +00:00
|
|
|
#define COD_EXEC_CHAR 'x'
|
|
|
|
|
#define COD_LINK_CHAR 'l'
|
2007-07-27 20:38:43 +00:00
|
|
|
#define COD_LOCK_CHAR 'k'
|
|
|
|
|
#define COD_MMAP_CHAR 'm'
|
|
|
|
|
#define COD_INHERIT_CHAR 'i'
|
2007-07-27 20:45:45 +00:00
|
|
|
#define COD_UNCONFINED_CHAR 'U'
|
|
|
|
|
#define COD_UNSAFE_UNCONFINED_CHAR 'u'
|
[https://bugzilla.novell.com/show_bug.cgi?id=172061]
This (updated) patch to trunk adds support for Px and Ux (toggle
bprm_secure on exec) in the parser, As requested, lowercase p and u
corresponds to an unfiltered environmnet on exec, uppercase will filter
the environment. It applies after the 'm' patch.
As a side effect, I tried to reduce the use of hardcoded characters in
the debugging statements -- there are still a few warnings that have
hard coded letters in them; not sure I can fix them all.
This version issues a warning for every unsafe ux and issues a single
warning for the first 'R', 'W', 'X', 'L', and 'I' it encounters,
except when the "-q" or "--quiet" flag , "--remove" profile flag, or
"-N" report names flags are passed. Unfortunately, it made the logic
somewhat more convoluted. Wordsmithing improvements welcome.
2006-08-04 17:14:49 +00:00
|
|
|
#define COD_PROFILE_CHAR 'P'
|
|
|
|
|
#define COD_UNSAFE_PROFILE_CHAR 'p'
|
2008-04-16 04:44:21 +00:00
|
|
|
#define COD_LOCAL_CHAR 'C'
|
|
|
|
|
#define COD_UNSAFE_LOCAL_CHAR 'c'
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
#define OPTION_ADD 1
|
|
|
|
|
#define OPTION_REMOVE 2
|
|
|
|
|
#define OPTION_REPLACE 3
|
|
|
|
|
#define OPTION_STDOUT 4
|
2010-06-26 13:13:52 -07:00
|
|
|
#define OPTION_OFILE 5
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2010-07-31 16:00:52 -07:00
|
|
|
#define BOOL int
|
|
|
|
|
|
2010-06-26 13:13:52 -07:00
|
|
|
extern int preprocess_only;
|
2010-02-17 12:21:52 -08:00
|
|
|
|
|
|
|
|
#define PATH_CHROOT_REL 0x1
|
|
|
|
|
#define PATH_NS_REL 0x2
|
|
|
|
|
#define PATH_CHROOT_NSATTACH 0x4
|
|
|
|
|
#define PATH_CHROOT_NO_ATTACH 0x8
|
|
|
|
|
#define PATH_MEDIATE_DELETED 0x10
|
|
|
|
|
#define PATH_DELEGATE_DELETED 0x20
|
|
|
|
|
#define PATH_ATTACH 0x40
|
|
|
|
|
#define PATH_NO_ATTACH 0x80
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
#ifdef DEBUG
|
2019-02-20 01:17:06 -08:00
|
|
|
#define PDEBUG(fmt, args...) \
|
|
|
|
|
do { \
|
|
|
|
|
int pdebug_error = errno; \
|
|
|
|
|
fprintf(stderr, "parser: " fmt, ## args); \
|
|
|
|
|
errno = pdebug_error; \
|
|
|
|
|
} while (0)
|
2006-04-11 21:52:54 +00:00
|
|
|
#else
|
|
|
|
|
#define PDEBUG(fmt, args...) /* Do nothing */
|
|
|
|
|
#endif
|
|
|
|
|
#define NPDEBUG(fmt, args...) /* Do nothing */
|
|
|
|
|
|
2019-02-20 01:17:06 -08:00
|
|
|
#define PERROR(fmt, args...) \
|
|
|
|
|
do { \
|
|
|
|
|
int perror_error = errno; \
|
|
|
|
|
fprintf(stderr, fmt, ## args); \
|
|
|
|
|
errno = perror_error; \
|
|
|
|
|
} while (0)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
#ifndef TRUE
|
|
|
|
|
#define TRUE (1)
|
|
|
|
|
#endif
|
|
|
|
|
#ifndef FALSE
|
|
|
|
|
#define FALSE (0)
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
#define MIN_PORT 0
|
|
|
|
|
#define MAX_PORT 65535
|
|
|
|
|
|
2014-10-02 12:58:54 -07:00
|
|
|
#ifndef unused
|
|
|
|
|
#define unused __attribute__ ((unused))
|
2006-04-11 21:52:54 +00:00
|
|
|
#endif
|
|
|
|
|
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
|
2007-02-27 02:29:16 +00:00
|
|
|
#define list_for_each(LIST, ENTRY) \
|
|
|
|
|
for ((ENTRY) = (LIST); (ENTRY); (ENTRY) = (ENTRY)->next)
|
2007-07-27 20:29:47 +00:00
|
|
|
#define list_for_each_safe(LIST, ENTRY, TMP) \
|
|
|
|
|
for ((ENTRY) = (LIST), (TMP) = (LIST) ? (LIST)->next : NULL; (ENTRY); (ENTRY) = (TMP), (TMP) = (TMP) ? (TMP)->next : NULL)
|
2007-02-27 02:29:16 +00:00
|
|
|
#define list_last_entry(LIST, ENTRY) \
|
|
|
|
|
for ((ENTRY) = (LIST); (ENTRY) && (ENTRY)->next; (ENTRY) = (ENTRY)->next)
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
#define list_append(LISTA, LISTB) \
|
|
|
|
|
do { \
|
|
|
|
|
typeof(LISTA) ___tmp; \
|
|
|
|
|
list_last_entry((LISTA), ___tmp);\
|
|
|
|
|
___tmp->next = (LISTB); \
|
|
|
|
|
} while (0)
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2014-04-07 03:18:33 -07:00
|
|
|
#define list_len(LIST) \
|
|
|
|
|
({ \
|
|
|
|
|
int len = 0; \
|
|
|
|
|
typeof(LIST) tmp; \
|
|
|
|
|
list_for_each((LIST), tmp) \
|
|
|
|
|
len++; \
|
|
|
|
|
len; \
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
#define list_find_prev(LIST, ENTRY) \
|
|
|
|
|
({ \
|
|
|
|
|
typeof(ENTRY) tmp, prev = NULL; \
|
|
|
|
|
list_for_each((LIST), tmp) { \
|
|
|
|
|
if (tmp == (ENTRY)) \
|
|
|
|
|
break; \
|
|
|
|
|
prev = tmp; \
|
|
|
|
|
} \
|
|
|
|
|
prev; \
|
|
|
|
|
})
|
|
|
|
|
|
|
|
|
|
#define list_remove_at(LIST, PREV, ENTRY) \
|
|
|
|
|
if (PREV) \
|
|
|
|
|
(PREV)->next = (ENTRY)->next; \
|
|
|
|
|
if ((ENTRY) == (LIST)) \
|
|
|
|
|
(LIST) = (ENTRY)->next; \
|
|
|
|
|
(ENTRY)->next = NULL; \
|
|
|
|
|
|
|
|
|
|
#define list_remove(LIST, ENTRY) \
|
|
|
|
|
do { \
|
|
|
|
|
typeof(ENTRY) prev = list_find_prev((LIST), (ENTRY)); \
|
|
|
|
|
list_remove_at((LIST), prev, (ENTRY)); \
|
|
|
|
|
} while (0)
|
|
|
|
|
|
|
|
|
|
|
2013-09-06 13:39:41 -07:00
|
|
|
#define DUP_STRING(orig, new, field, fail_target) \
|
|
|
|
|
do { \
|
|
|
|
|
(new)->field = ((orig)->field) ? strdup((orig)->field) : NULL; \
|
|
|
|
|
if (((orig)->field) && !((new)->field)) \
|
|
|
|
|
goto fail_target; \
|
|
|
|
|
} while (0)
|
|
|
|
|
|
2014-04-23 11:00:32 -07:00
|
|
|
|
|
|
|
|
#define u8 unsigned char
|
|
|
|
|
#define u16 uint16_t
|
|
|
|
|
#define u32 uint32_t
|
|
|
|
|
#define u64 uint64_t
|
2014-04-23 11:07:49 -07:00
|
|
|
|
|
|
|
|
#define cpu_to_le16(x) ((u16)(htole16 ((u16) x)))
|
|
|
|
|
#define cpu_to_le32(x) ((u32)(htole32 ((u32) x)))
|
|
|
|
|
#define cpu_to_le64(x) ((u64)(htole64 ((u64) x)))
|
2014-04-23 11:00:32 -07:00
|
|
|
|
|
|
|
|
/* The encoding for kernal abi > 5 is
|
|
|
|
|
* 28-31: reserved
|
|
|
|
|
* 20-27: policy version
|
|
|
|
|
* 12-19: policy abi version
|
|
|
|
|
* 11: force complain flag
|
|
|
|
|
* 10: reserved
|
|
|
|
|
* 0-9: kernel abi version
|
|
|
|
|
*/
|
|
|
|
|
#define ENCODE_VERSION(C, P, PABI, KABI) \
|
|
|
|
|
({ \
|
|
|
|
|
u32 version = (KABI) & 0x3ff; \
|
|
|
|
|
if ((KABI) > 5) { \
|
|
|
|
|
version |= (C) ? 1 << 11 : 0; \
|
|
|
|
|
version |= ((PABI) & 0xff) << 12; \
|
|
|
|
|
version |= ((P) & 0xff) << 20; \
|
|
|
|
|
} \
|
|
|
|
|
version; \
|
|
|
|
|
})
|
|
|
|
|
|
2014-04-23 16:38:29 -07:00
|
|
|
/* The parser fills this variable in automatically */
|
|
|
|
|
#define PROFILE_NAME_VARIABLE "profile_name"
|
|
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
/* from parser_common.c */
|
2014-04-23 11:00:32 -07:00
|
|
|
extern uint32_t policy_version;
|
|
|
|
|
extern uint32_t parser_abi_version;
|
|
|
|
|
extern uint32_t kernel_abi_version;
|
|
|
|
|
|
2020-07-09 02:43:10 -07:00
|
|
|
extern aa_features *pinned_features;
|
2020-04-24 17:43:47 -07:00
|
|
|
extern aa_features *policy_features;
|
2020-07-21 05:10:46 -07:00
|
|
|
extern aa_features *override_features;
|
2020-04-24 17:43:47 -07:00
|
|
|
extern aa_features *kernel_features;
|
|
|
|
|
|
2014-04-23 11:00:32 -07:00
|
|
|
extern int force_complain;
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
extern int perms_create;
|
|
|
|
|
extern int net_af_max_override;
|
|
|
|
|
extern int kernel_load;
|
2014-05-08 09:03:13 -07:00
|
|
|
extern int kernel_supports_setload;
|
2020-04-29 02:18:24 -07:00
|
|
|
extern int features_supports_network;
|
2018-07-24 04:40:25 -07:00
|
|
|
extern int features_supports_networkv8;
|
2014-04-23 10:59:07 -07:00
|
|
|
extern int kernel_supports_policydb;
|
2014-04-23 11:05:58 -07:00
|
|
|
extern int kernel_supports_diff_encode;
|
2020-04-29 02:18:24 -07:00
|
|
|
extern int features_supports_mount;
|
|
|
|
|
extern int features_supports_dbus;
|
|
|
|
|
extern int features_supports_signal;
|
|
|
|
|
extern int features_supports_ptrace;
|
|
|
|
|
extern int features_supports_unix;
|
|
|
|
|
extern int features_supports_stacking;
|
|
|
|
|
extern int features_supports_domain_xattr;
|
2019-08-17 05:02:13 -07:00
|
|
|
extern int kernel_supports_oob;
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
extern int conf_verbose;
|
|
|
|
|
extern int conf_quiet;
|
|
|
|
|
extern int names_only;
|
|
|
|
|
extern int option;
|
|
|
|
|
extern int current_lineno;
|
|
|
|
|
extern dfaflags_t dfaflags;
|
2013-10-01 10:59:04 -07:00
|
|
|
extern const char *progname;
|
2006-04-11 21:52:54 +00:00
|
|
|
extern char *profilename;
|
2013-09-27 16:13:22 -07:00
|
|
|
extern char *profile_ns;
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
extern char *current_filename;
|
|
|
|
|
extern FILE *ofile;
|
|
|
|
|
extern int read_implies_exec;
|
2021-04-20 01:32:41 -07:00
|
|
|
extern IncludeCache_t *g_includecache;
|
|
|
|
|
|
2020-08-28 11:38:12 -07:00
|
|
|
extern void pwarnf(bool werr, const char *fmt, ...) __attribute__((__format__(__printf__, 2, 3)));
|
2020-08-09 14:51:55 -04:00
|
|
|
extern void common_warn_once(const char *name, const char *msg, const char **warned_name);
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2020-08-28 11:38:12 -07:00
|
|
|
#define pwarn(F, args...) do { if (warnflags & (F)) pwarnf((werrflags & (F)), ## args); } while (0)
|
2020-08-28 07:13:28 -07:00
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
/* from parser_main (cannot be used in tst builds) */
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int force_complain;
|
2014-04-23 11:10:41 -07:00
|
|
|
extern void display_version(void);
|
2015-03-25 17:09:25 -05:00
|
|
|
extern int show_cache;
|
|
|
|
|
extern int skip_cache;
|
|
|
|
|
extern int skip_read_cache;
|
|
|
|
|
extern int write_cache;
|
|
|
|
|
extern int cond_clear_cache;
|
|
|
|
|
extern int force_clear_cache;
|
|
|
|
|
extern int create_cache_dir;
|
|
|
|
|
extern int preprocess_only;
|
|
|
|
|
extern int skip_mode_force;
|
|
|
|
|
extern int abort_on_error;
|
|
|
|
|
extern int skip_bad_cache_rebuild;
|
|
|
|
|
extern int mru_skip_cache;
|
2006-04-11 21:52:54 +00:00
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
/* provided by parser_lex.l (cannot be used in tst builds) */
|
2009-07-24 07:34:11 +00:00
|
|
|
extern FILE *yyin;
|
|
|
|
|
extern void yyrestart(FILE *fp);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int yyparse(void);
|
2012-02-16 08:17:41 -08:00
|
|
|
extern void yyerror(const char *msg, ...);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int yylex(void);
|
|
|
|
|
|
2009-07-24 07:35:39 +00:00
|
|
|
/* parser_include.c */
|
2013-10-01 10:59:04 -07:00
|
|
|
extern const char *basedir;
|
2009-07-24 07:35:39 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* parser_regex.c */
|
2014-04-23 11:35:29 -07:00
|
|
|
#define default_match_pattern "[^\\000]*"
|
|
|
|
|
#define anyone_match_pattern "[^\\000]+"
|
|
|
|
|
|
2015-02-12 10:19:16 -08:00
|
|
|
#define glob_default 0
|
|
|
|
|
#define glob_null 1
|
|
|
|
|
extern pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
|
2014-04-07 03:16:50 -07:00
|
|
|
std::string& pcre, int *first_re_pos);
|
|
|
|
|
extern int build_list_val_expr(std::string& buffer, struct value_list *list);
|
|
|
|
|
extern int convert_entry(std::string& buffer, char *entry);
|
|
|
|
|
extern int clear_and_convert_entry(std::string& buffer, char *entry);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int process_regex(Profile *prof);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int post_process_entry(struct cod_entry *entry);
|
2013-07-31 09:05:51 -07:00
|
|
|
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int process_policydb(Profile *prof);
|
2012-02-16 08:14:46 -08:00
|
|
|
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int process_policy_ents(Profile *prof);
|
2020-08-31 19:01:06 -07:00
|
|
|
extern void filter_slashes(char *path);
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* parser_variable.c */
|
2014-04-07 03:16:50 -07:00
|
|
|
int expand_entry_variables(char **name);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int process_variables(Profile *prof);
|
2013-10-01 10:59:04 -07:00
|
|
|
extern struct var_string *split_out_var(const char *string);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern void free_var_string(struct var_string *var);
|
|
|
|
|
|
|
|
|
|
/* parser_misc.c */
|
2014-04-07 03:16:50 -07:00
|
|
|
extern void warn_uppercase(void);
|
2013-10-26 00:15:13 -07:00
|
|
|
extern int is_blacklisted(const char *name, const char *path);
|
2012-02-16 08:07:28 -08:00
|
|
|
extern struct value_list *new_value_list(char *value);
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
extern struct value_list *dup_value_list(struct value_list *list);
|
2012-02-16 08:07:28 -08:00
|
|
|
extern void free_value_list(struct value_list *list);
|
|
|
|
|
extern void print_value_list(struct value_list *list);
|
2012-03-26 06:17:40 -07:00
|
|
|
extern struct cond_entry *new_cond_entry(char *name, int eq, struct value_list *list);
|
2014-04-23 11:36:26 -07:00
|
|
|
extern void move_conditional_value(const char *rulename, char **dst_ptr,
|
|
|
|
|
struct cond_entry *cond_ent);
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
extern void free_cond_entry(struct cond_entry *ent);
|
2013-07-31 09:05:51 -07:00
|
|
|
extern void free_cond_list(struct cond_entry *ents);
|
2019-08-17 05:01:39 -07:00
|
|
|
extern void free_cond_entry_list(struct cond_entry_list &cond);
|
Add mount rules
Add the ability to control mounting and unmounting
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
conds follow the extended conditional syntax of allowing either:
* a single value after the equals, which has the same character range as
regular IDS (ie most anything but it can't be terminated with a , (comma)
and if spaces or other characters are needed it can be quoted
eg.
options=foo
options = foo
options="foo bar"
* a list of values after the equals, the list of values is enclosed within
parenthesis () and its has a slightly reduced character set but again
elements can be quoted.
the separation between elements is whitespace and commas.
eg.
options=(foo bar)
options=(foo, bar)
options=(foo , bar)
options=(foo,bar)
The rules are flexible and follow a similar pattern as network, capability,
etc.
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/
umount,
umount /m*,
Currently variables and regexs are are supported on the device and mount
point. ie.
mount <devince> -> <mount point>,
Regexes are supported in fstype and options. The options have a further
caveat that regexs only work if the option is fs specific option.
eg. options=(upperdir=/tmp/*,lowerdir=/)
regex's will not currently work against the standard options like ro, rw
nosuid
Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).
Options can be specified multiple times
mount option=rw option=(nosuid,upperdir=/foo),
and will be combined together into a single set of values
The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.
Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
option=(rw,ro) options=(suid,nosuid)
For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.
Improvements to the syntax and order restrictions are planned for the
future.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
|
|
|
extern void print_cond_entry(struct cond_entry *ent);
|
2013-10-01 10:59:04 -07:00
|
|
|
extern char *processid(const char *string, int len);
|
|
|
|
|
extern char *processquoted(const char *string, int len);
|
|
|
|
|
extern char *processunquoted(const char *string, int len);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int get_keyword_token(const char *keyword);
|
2008-04-06 18:55:46 +00:00
|
|
|
extern int get_rlimit(const char *name);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern char *process_var(const char *var);
|
|
|
|
|
extern int parse_mode(const char *mode);
|
2014-04-07 03:19:19 -07:00
|
|
|
extern int parse_X_mode(const char *X, int valid, const char *str_mode, int *mode, int fail);
|
2016-03-18 17:28:51 -05:00
|
|
|
bool label_contains_ns(const char *label);
|
2016-03-18 17:28:51 -05:00
|
|
|
bool parse_label(bool *_stack, char **_ns, char **_name,
|
|
|
|
|
const char *label, bool yyerr);
|
2016-03-18 17:28:51 -05:00
|
|
|
extern struct cod_entry *new_entry(char *id, int mode, char *link_id);
|
2007-07-27 20:29:47 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* returns -1 if value != true or false, otherwise 0 == false, 1 == true */
|
|
|
|
|
extern int str_to_boolean(const char* str);
|
|
|
|
|
extern struct cod_entry *copy_cod_entry(struct cod_entry *cod);
|
|
|
|
|
extern void free_cod_entries(struct cod_entry *list);
|
2013-09-27 16:16:37 -07:00
|
|
|
void debug_cod_entries(struct cod_entry *list);
|
|
|
|
|
|
2015-07-10 18:16:09 -07:00
|
|
|
#define SECONDS_P_MS (1000LL * 1000LL)
|
|
|
|
|
long long convert_time_units(long long value, long long base, const char *units);
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* parser_symtab.c */
|
2014-04-07 03:16:50 -07:00
|
|
|
struct set_value {
|
2010-03-12 15:16:06 -08:00
|
|
|
char *val;
|
|
|
|
|
struct set_value *next;
|
|
|
|
|
};
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int add_boolean_var(const char *var, int boolean);
|
|
|
|
|
extern int get_boolean_var(const char *var);
|
|
|
|
|
extern int new_set_var(const char *var, const char *value);
|
|
|
|
|
extern int add_set_value(const char *var, const char *value);
|
2010-03-12 15:16:06 -08:00
|
|
|
extern struct set_value *get_set_var(const char *var);
|
|
|
|
|
extern char *get_next_set_value(struct set_value **context);
|
2014-04-23 16:38:29 -07:00
|
|
|
extern int delete_set_var(const char *var_name);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern void dump_symtab(void);
|
|
|
|
|
extern void dump_expanded_symtab(void);
|
2009-07-24 07:34:11 +00:00
|
|
|
void free_symtabs(void);
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2008-04-09 09:03:17 +00:00
|
|
|
/* parser_alias.c */
|
|
|
|
|
extern int new_alias(const char *from, const char *to);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int replace_profile_aliases(Profile *prof);
|
2008-04-09 09:03:17 +00:00
|
|
|
extern void free_aliases(void);
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
/* parser_merge.c */
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int profile_merge_rules(Profile *prof);
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* parser_interface.c */
|
2015-03-25 17:09:26 -05:00
|
|
|
extern int load_profile(int option, aa_kernel_interface *kernel_interface,
|
|
|
|
|
Profile *prof, int cache_fd);
|
2014-04-23 11:07:01 -07:00
|
|
|
extern void sd_serialize_profile(std::ostringstream &buf, Profile *prof,
|
2007-06-26 21:09:46 +00:00
|
|
|
int flatten);
|
2008-06-09 10:00:28 +00:00
|
|
|
extern int sd_load_buffer(int option, char *buffer, int size);
|
2009-07-24 07:36:09 +00:00
|
|
|
extern int cache_fd;
|
2008-06-09 10:00:28 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
/* parser_policy.c */
|
2013-09-27 16:16:37 -07:00
|
|
|
extern void add_to_list(Profile *profile);
|
|
|
|
|
extern void add_hat_to_policy(Profile *policy, Profile *hat);
|
2014-04-07 03:16:50 -07:00
|
|
|
extern int add_entry_to_x_table(Profile *prof, char *name);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern void add_entry_to_policy(Profile *policy, struct cod_entry *entry);
|
|
|
|
|
extern void post_process_file_entries(Profile *prof);
|
2014-04-07 03:16:50 -07:00
|
|
|
extern void post_process_rule_entries(Profile *prof);
|
2010-03-12 15:26:32 -08:00
|
|
|
extern int post_process_policy(int debug_only);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int process_profile_regex(Profile *prof);
|
|
|
|
|
extern int process_profile_variables(Profile *prof);
|
|
|
|
|
extern int process_profile_policydb(Profile *prof);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern int post_merge_rules(void);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern int merge_hat_rules(Profile *prof);
|
|
|
|
|
extern Profile *merge_policy(Profile *a, Profile *b);
|
2015-03-25 17:09:26 -05:00
|
|
|
extern int load_policy(int option, aa_kernel_interface *kernel_interface,
|
|
|
|
|
int cache_fd);
|
2014-04-23 11:07:01 -07:00
|
|
|
extern int load_hats(std::ostringstream &buf, Profile *prof);
|
2015-03-25 17:09:26 -05:00
|
|
|
extern int load_flattened_hats(Profile *prof, int option,
|
|
|
|
|
aa_kernel_interface *kernel_interface,
|
|
|
|
|
int cache_fd);
|
2013-09-27 16:16:37 -07:00
|
|
|
extern void dump_policy_hats(Profile *prof);
|
2006-04-11 21:52:54 +00:00
|
|
|
extern void dump_policy_names(void);
|
2013-09-27 16:16:37 -07:00
|
|
|
void dump_policy(void);
|
2013-09-27 16:14:25 -07:00
|
|
|
|
2009-07-24 07:34:11 +00:00
|
|
|
void free_policies(void);
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
|
2020-04-24 17:43:47 -07:00
|
|
|
/* parser_main.c */
|
|
|
|
|
extern void set_supported_features();
|
|
|
|
|
|
|
|
|
|
/* default_features.c */
|
|
|
|
|
extern const char *match_n_abi;
|
|
|
|
|
extern const char *match_c_abi;
|
|
|
|
|
extern const char *match_cn_abi;
|
|
|
|
|
extern const char *default_features_abi;
|
|
|
|
|
|
2012-02-16 08:16:18 -08:00
|
|
|
#endif /** __AA_PARSER_H */
|