mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
c386d93581
Move suggested bug reporting from launchpad to gitlab Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <steve.beattie@canonical.com>
133 lines
4.7 KiB
Text
133 lines
4.7 KiB
Text
# This publication is intellectual property of Canonical Ltd. Its contents
|
|
# can be duplicated, either in part or in whole, provided that a copyright
|
|
# label is visibly located on each copy.
|
|
#
|
|
# All information found in this book has been compiled with utmost
|
|
# attention to detail. However, this does not guarantee complete accuracy.
|
|
# Neither Canonical Ltd, the authors, nor the translators shall be held
|
|
# liable for possible errors or the consequences thereof.
|
|
#
|
|
# Many of the software and hardware descriptions cited in this book
|
|
# are registered trademarks. All trade names are subject to copyright
|
|
# restrictions and may be registered trade marks. Canonical Ltd.
|
|
# essentially adhere to the manufacturer's spelling.
|
|
#
|
|
# Names of products and trademarks appearing in this book (with or without
|
|
# specific notation) are likewise subject to trademark and trade protection
|
|
# laws and may thus fall under copyright restrictions.
|
|
#
|
|
|
|
|
|
=pod
|
|
|
|
=head1 NAME
|
|
|
|
aa_query_label - query access permission associated with a label
|
|
|
|
aa_query_file_path, aa_query_file_path_len - query access permissions of a file path
|
|
|
|
aa_query_link_path, aa_query_link_path_len - query access permissions of a link path
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
B<#include E<lt>sys/apparmor.hE<gt>>
|
|
|
|
B<int aa_query_label(uint32_t mask, char *query, size_t size, int *allowed, int *audited);>
|
|
|
|
B<int aa_query_file_path(uint32_t mask, const char *label, size_t label_len, const char *path, int *allowed, int *audited);>
|
|
|
|
B<int aa_query_file_path_len(uint32_t mask, const char *label, size_t label_len, const char *path, size_t path_len, int *allowed, int *audited);>
|
|
|
|
B<int aa_query_link_path(const char *label, const char *target, const char *link, int *allowed, int *audited);>
|
|
|
|
B<int aa_query_link_path_len(const char *label, size_t label_len, const char *target, size_t target_len, const char *link, size_t link_len, int *allowed, int *audited);>
|
|
|
|
|
|
Link with B<-lapparmor> when compiling.
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The B<aa_query_label> function fetches the current permissions granted by the
|
|
specified I<label> in the I<query> string.
|
|
|
|
The query is a raw binary formatted query, containing the label and
|
|
permission query to make. The returned I<allowed> and I<audited> values are
|
|
interpreted boolean values, simply stating whether the query is allowed and
|
|
if it is audited.
|
|
|
|
The mask of the query string is a bit mask of permissions to query and is
|
|
class type dependent (see B<AA_CLASS_xxx> entries in I<sys/apparmor.h>).
|
|
|
|
The format of the query string is also dependent on the B<AA_CLASS> and as
|
|
such the B<aa_query_xxx> helper functions should usually be used instead
|
|
of directly using B<aa_query_label>. If directly using the interface the
|
|
I<query> string is required to have a header of B<AA_QUERY_CMD_LABEL_SIZE>
|
|
that will be used by B<aa_query_label>.
|
|
|
|
The B<aa_query_file_path> and B<aa_query_file_path_len> functions are helper
|
|
function that assemble a properly formatted file path query for the
|
|
B<aa_query_label> function. The I<label> is a valid apparmor label as
|
|
returned by I<aa_splitcon> with I<label_len> being the length of the I<label>.
|
|
The I<path> is any valid filesystem path to query permissions for. For the
|
|
B<aa_query_file_path_len> variant the I<path_len> parameter specifies the
|
|
number of bytes in the I<path> to use as part of the query.
|
|
|
|
The B<aa_query_link_path> and B<aa_query_link_path_len> functions are helper
|
|
functions that assemble a properly formatted link path query for the
|
|
B<aa_query_label> function. The I<link_len> and I<target_len> parameters
|
|
specify the number of bytes in the I<link> and I<target> to use as part of
|
|
the query.
|
|
|
|
=head1 RETURN VALUE
|
|
|
|
On success 0 is returned, and the I<allowed> and I<audited> parameters
|
|
contain a boolean value of 0 not allowed/audited or 1 allowed/audited. On
|
|
error, -1 is returned, and errno(3) is set appropriately.
|
|
|
|
=head1 ERRORS
|
|
|
|
=over 4
|
|
|
|
=item B<EINVAL>
|
|
|
|
The requested I<mask> is empty.
|
|
|
|
The I<size> of the query is less than the query B<AA_QUERY_CMD_LABEL_SIZE>
|
|
|
|
The apparmor kernel module is not loaded or the kernel interface access
|
|
interface is not available
|
|
|
|
=item B<ENOMEM>
|
|
|
|
Insufficient memory was available.
|
|
|
|
=item B<EACCES>
|
|
|
|
Access to the specified I<label> or query interface was denied.
|
|
|
|
=item B<ENOENT>
|
|
|
|
The specified I<label> does not exist or is not visible.
|
|
|
|
=item B<ERANGE>
|
|
|
|
The confinement data is too large to fit in the supplied buffer.
|
|
|
|
=back
|
|
|
|
=head1 NOTES
|
|
|
|
The label permissions returned are only valid for the time of the
|
|
query and can change at any point in the future.
|
|
|
|
=head1 BUGS
|
|
|
|
None known. If you find any, please report them at
|
|
L<https://gitlab.com/apparmor/apparmor/-/issues>.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
apparmor(7), apparmor.d(5), apparmor_parser(8), aa_getcon(2), aa_splitcon(3)
|
|
and L<https://wiki.apparmor.net>.
|
|
|
|
=cut
|