mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
145 lines
4.9 KiB
Text
145 lines
4.9 KiB
Text
# This publication is intellectual property of Canonical Ltd. Its contents
|
|
# can be duplicated, either in part or in whole, provided that a copyright
|
|
# label is visibly located on each copy.
|
|
#
|
|
# All information found in this book has been compiled with utmost
|
|
# attention to detail. However, this does not guarantee complete accuracy.
|
|
# Neither Canonical Ltd, the authors, nor the translators shall be held
|
|
# liable for possible errors or the consequences thereof.
|
|
#
|
|
# Many of the software and hardware descriptions cited in this book
|
|
# are registered trademarks. All trade names are subject to copyright
|
|
# restrictions and may be registered trade marks. Canonical Ltd.
|
|
# essentially adhere to the manufacturer's spelling.
|
|
#
|
|
# Names of products and trademarks appearing in this book (with or without
|
|
# specific notation) are likewise subject to trademark and trade protection
|
|
# laws and may thus fall under copyright restrictions.
|
|
#
|
|
|
|
|
|
=pod
|
|
|
|
=head1 NAME
|
|
|
|
aa_getprocattr_raw, aa_getprocattr - read and parse procattr data
|
|
|
|
aa_getcon, aa_gettaskcon - get task confinement information
|
|
|
|
aa_getpeercon - get the confinement of a socket's other end (peer)
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
B<#include E<lt>sys/apparmor.hE<gt>>
|
|
|
|
B<int aa_getprocattr_raw(pid_t tid, const char *attr, char *buf, int len, char **mode);>
|
|
|
|
B<int aa_getprocattr(pid_t tid, const char *attr, char **label, char **mode);>
|
|
|
|
B<int aa_gettaskcon(pid_t target, char **label, char **mode);>
|
|
|
|
B<int aa_getcon(char **label, char **mode);>
|
|
|
|
B<int aa_getpeercon_raw(int fd, char *buf, int *len, char **mode);>
|
|
|
|
B<int aa_getpeercon(int fd, char **label, char **mode);>
|
|
|
|
Link with B<-lapparmor> when compiling.
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The aa_getcon function gets the current AppArmor confinement context for the
|
|
current task. The confinement context consists of a label and a mode. The label
|
|
is usually just the name of the AppArmor profile restricting the task, but it
|
|
may include the profile namespace or in some cases a set of profile names
|
|
(known as a stack of profiles). The mode is a string that describes how the
|
|
kernel is enforcing the policy defined in the profile. Profiles loaded in
|
|
"enforce" mode will result in enforcement of the policy defined in the profile
|
|
as well as reporting policy violation attempts. Profiles in "complain" mode
|
|
will not enforce policy but instead report policy violation attempts.
|
|
|
|
Some examples of possible returned *label strings are "unconfined", "/sbin/dhclient",
|
|
and "Firefox". The string can consist of any non-NUL characters but it will be
|
|
NUL-terminated. The *label string must be freed using free().
|
|
|
|
The possible *mode strings are "enforce" and "complain". Additionally, *mode may
|
|
be NULL when *label is "unconfined". B<The *mode string must not be freed>. The
|
|
*label and *mode strings come from a single buffer allocation and are separated
|
|
by a NUL character.
|
|
|
|
The aa_gettaskcon function is like the aa_getcon function except it will work
|
|
for any arbitrary task in the system.
|
|
|
|
The aa_getpeercon function is similar to that of aa_gettaskcon except that
|
|
it returns the confinement information for task on the other end of a socket
|
|
connection.
|
|
|
|
The aa_getpeercon_raw function is the backend for the aa_getpeercon function
|
|
and does not handle buffer allocation.
|
|
|
|
The aa_getprocattr function is the backend for the aa_getcon and aa_gettaskcon
|
|
functions and handles the reading and parsing of the confinement data from
|
|
different arbitrary attr files and returns the processed results in
|
|
an allocated buffer.
|
|
|
|
The aa_getprocattr_raw() is the backend for the aa_getprocattr function and
|
|
does not handle buffer allocation.
|
|
|
|
=head1 RETURN VALUE
|
|
|
|
On success size of data placed in the buffer is returned, this includes the
|
|
mode if present and any terminating characters. On error, -1 is returned, and
|
|
errno(3) is set appropriately.
|
|
|
|
=head1 ERRORS
|
|
|
|
=over 4
|
|
|
|
=item B<EINVAL>
|
|
|
|
The apparmor kernel module is not loaded or the communication via the
|
|
F</proc/*/attr/file> did not conform to protocol.
|
|
|
|
=item B<ENOMEM>
|
|
|
|
Insufficient kernel memory was available.
|
|
|
|
=item B<EACCES>
|
|
|
|
Access to the specified I<file/task> was denied.
|
|
|
|
=item B<ENOENT>
|
|
|
|
The specified I<file/task> does not exist or is not visible.
|
|
|
|
=item B<ERANGE>
|
|
|
|
The confinement data is too large to fit in the supplied buffer.
|
|
|
|
=item B<ENOPROTOOPT>
|
|
|
|
The kernel doesn't support the SO_PEERLABEL option in sockets. This happens
|
|
mainly when the kernel lacks 'fine grained unix mediation' support. It also
|
|
can happen on LSM stacking kernels where another LSM has claimed this
|
|
interface and decides to return this error, although this is really a
|
|
corner case.
|
|
|
|
=back
|
|
|
|
=head1 NOTES
|
|
|
|
If aa_getpeercon_raw returns -1 and errno is ERANGE, the value of *len can be
|
|
used to reallocate buf so that it is sufficiently large enough to store the
|
|
confinement data.
|
|
|
|
=head1 BUGS
|
|
|
|
None known. If you find any, please report them at
|
|
L<https://gitlab.com/apparmor/apparmor/-/issues>.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
apparmor(7), apparmor.d(5), apparmor_parser(8), aa_change_profile(2),
|
|
aa_splitcon(3) and L<https://wiki.apparmor.net>.
|
|
|
|
=cut
|