From b9b99508e888e1470d9a42d8ca213cef7fc616f6 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Wed, 23 Apr 2014 10:59:07 -0700 Subject: [PATCH] Add tag indicating file policy is mediated. Tag start of entries in the policydb as being mediated. This makes the start state for any class being mediated be none 0. The kernel can detect this to determine whether the parser expected mediation for the class. This is just a way of encoding what features expect mediation within the policydb it self so that a separate table isn't needed. This is also used to indicate the new unix semantics for mediation of unix domain sockets on connect should be applied. Note: this does cause a fail open on situation on Ubuntu Saucy, which did not properly indicate support. That is if a kernel using this patch is installed on an Ubuntu Saucy system, unix domain socket mediation on connect won't happen, instead the older behavior will be applied. This won't cause policy failures as it is less strict than what Ubuntu Saucy applies. This is necessary so that AppArmor can properly function on older userspaces without a compile time configuration on the kernel to determine behavior. A kernel expecting this behavior will function correctly with all old userspaces expect it will not enforce connect time mediation on Ubuntu Saucy. However Ubuntu does not support Trusty (or newer) kernels as backports to Saucy, so this does not break them. Signed-off-by: John Johansen Acked-by: Seth Arnold --- parser/parser.h | 2 ++ parser/parser_common.c | 2 ++ parser/parser_interface.c | 3 +-- parser/parser_main.c | 4 ++++ parser/parser_regex.c | 5 +++++ 5 files changed, 14 insertions(+), 2 deletions(-) diff --git a/parser/parser.h b/parser/parser.h index f704169e9..3e6bc3498 100644 --- a/parser/parser.h +++ b/parser/parser.h @@ -257,7 +257,9 @@ do { \ extern int perms_create; extern int net_af_max_override; extern int kernel_load; +extern int kernel_policy_version; extern int kernel_supports_network; +extern int kernel_supports_policydb; extern int kernel_supports_mount; extern int kernel_supports_dbus; extern int conf_verbose; diff --git a/parser/parser_common.c b/parser/parser_common.c index 0b3170f48..f75a6b0af 100644 --- a/parser/parser_common.c +++ b/parser/parser_common.c @@ -25,7 +25,9 @@ int perms_create = 0; /* perms contain create flag */ int net_af_max_override = -1; /* use kernel to determine af_max */ int kernel_load = 1; +int kernel_policy_version = 5; /* default to base version */ int kernel_supports_network = 0; /* kernel supports network rules */ +int kernel_supports_policydb = 0; /* kernel supports new policydb */ int kernel_supports_mount = 0; /* kernel supports mount rules */ int kernel_supports_dbus = 0; /* kernel supports dbus rules */ int conf_verbose = 0; diff --git a/parser/parser_interface.c b/parser/parser_interface.c index f017fa95e..40e7f13f6 100644 --- a/parser/parser_interface.c +++ b/parser/parser_interface.c @@ -61,7 +61,6 @@ #define SD_CODE_SIZE (sizeof(u8)) #define SD_STR_LEN (sizeof(u16)) -#define SUBDOMAIN_INTERFACE_DFA_VERSION 5 int __sd_serialize_profile(int option, Profile *prof); @@ -683,7 +682,7 @@ int sd_serialize_top_profile(sd_serialize *p, Profile *profile) { int version; - version = SUBDOMAIN_INTERFACE_DFA_VERSION; + version = kernel_policy_version; if (!sd_write_name(p, "version")) return 0; diff --git a/parser/parser_main.c b/parser/parser_main.c index 2d51d67dd..65025f45f 100644 --- a/parser/parser_main.c +++ b/parser/parser_main.c @@ -838,6 +838,10 @@ static void set_supported_features(void) { perms_create = 1; /* TODO: make this real parsing and config setting */ + if (strstr(features_string, "file {")) /* pre policydb is file= */ + kernel_supports_policydb = 1; + if (strstr(features_string, "v6")) + kernel_policy_version = 6; if (strstr(features_string, "network")) kernel_supports_network = 1; if (strstr(features_string, "mount")) diff --git a/parser/parser_regex.c b/parser/parser_regex.c index edcbaf2a9..68ad9ab3e 100644 --- a/parser/parser_regex.c +++ b/parser/parser_regex.c @@ -672,6 +672,7 @@ int post_process_policydb_ents(Profile *prof) #define MAKE_STR(X) #X #define CLASS_STR(X) "\\d" MAKE_STR(X) +static const char *mediates_file = CLASS_STR(AA_CLASS_FILE); static const char *mediates_mount = CLASS_STR(AA_CLASS_MOUNT); static const char *mediates_dbus = CLASS_STR(AA_CLASS_DBUS); @@ -690,6 +691,10 @@ int process_profile_policydb(Profile *prof) * to be supported */ + /* note: this activates unix domain sockets mediation on connect */ + if (kernel_policy_version > 5 && + !prof->policy.rules->add_rule(mediates_file, 0, AA_MAY_READ, 0, dfaflags)) + goto out; if (kernel_supports_mount && !prof->policy.rules->add_rule(mediates_mount, 0, AA_MAY_READ, 0, dfaflags)) goto out;