summaryrefslogtreecommitdiffstats
path: root/security
Commit message (Collapse)AuthorAgeFilesLines
* LSM: Add /sys/kernel/security/lsmCasey Schaufler2017-01-199-9/+71
| | | | | | | | | | | | | | | | | I am still tired of having to find indirect ways to determine what security modules are active on a system. I have added /sys/kernel/security/lsm, which contains a comma separated list of the active security modules. No more groping around in /proc/filesystems or other clever hacks. Unchanged from previous versions except for being updated to the latest security next branch. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Paul Moore <paul@paul-moore.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
* apparmor: fix undefined reference to `aa_g_hash_policy'John Johansen2017-01-161-1/+1
| | | | | | | | | | The kernel build bot turned up a bad config combination when CONFIG_SECURITY_APPARMOR is y and CONFIG_SECURITY_APPARMOR_HASH is n, resulting in the build error security/built-in.o: In function `aa_unpack': (.text+0x841e2): undefined reference to `aa_g_hash_policy' Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: replace remaining BUG_ON() asserts with AA_BUG()John Johansen2017-01-164-5/+5
| | | | | | AA_BUG() uses WARN and won't break the kernel like BUG_ON(). Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix restricted endian type warnings for policy unpackJohn Johansen2017-01-161-6/+6
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix restricted endian type warnings for dfa unpackJohn Johansen2017-01-162-12/+12
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add check for apparmor enabled in module parameters missing itJohn Johansen2017-01-161-0/+10
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add per cpu work buffers to avoid allocating buffers at every hookJohn Johansen2017-01-162-1/+103
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: sysctl to enable unprivileged user ns AppArmor policy loadingTyler Hicks2017-01-162-1/+47
| | | | | | | | | | | | If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: support querying extended trusted helper extra dataWilliam Hua2017-01-165-0/+245
| | | | | | | | | Allow a profile to carry extra data that can be queried via userspace. This provides a means to store extra data in a profile that a trusted helper can extract and use from live policy. Signed-off-by: William Hua <william.hua@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: update cap audit to check SECURITY_CAP_NOAUDITJohn Johansen2017-01-161-6/+10
| | | | | | | | apparmor should be checking the SECURITY_CAP_NOAUDIT constant. Also in complain mode make it so apparmor can elect to log a message, informing of the check. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: make computing policy hashes conditional on kernel parameterJohn Johansen2017-01-162-29/+32
| | | | | | | Allow turning off the computation of the policy hashes via the apparmor.hash_policy kernel parameter. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: convert change_profile to use fqname later to give better controlJohn Johansen2017-01-165-66/+28
| | | | | | | | | Moving the use of fqname to later allows learning profiles to be based on the fqname request instead of just the hname. It also allows cleaning up some of the name parsing and lookup by allowing the use of the fqlookupn_profile() lib fn. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fix change_hat debug outputJohn Johansen2017-01-161-4/+5
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: remove unused op parameter from simple_write_to_buffer()John Johansen2017-01-161-6/+3
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: change aad apparmor_audit_data macro to a fn macroJohn Johansen2017-01-1612-161/+155
| | | | | | | | | | | The aad macro can replace aad strings when it is not intended to. Switch to a fn macro so it is only applied when intended. Also at the same time cleanup audit_data initialization by putting common boiler plate behind a macro, and dropping the gfp_t parameter which will become useless. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: change op from int to const char *John Johansen2017-01-1610-134/+84
| | | | | | | | | | Having ops be an integer that is an index into an op name table is awkward and brittle. Every op change requires an edit for both the op constant and a string in the table. Instead switch to using const strings directly, eliminating the need for the table that needs to be kept in sync. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename context abreviation cxt to the more standard ctxJohn Johansen2017-01-165-144/+150
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: fail task profile update if current_cred isn't real_credJohn Johansen2017-01-161-0/+3
| | | | | | | | Trying to update the task cred while the task current cred is not the real cred will result in an error at the cred layer. Avoid this by failing early and delaying the update. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add per policy ns .load, .replace, .remove interface filesJohn Johansen2017-01-162-22/+130
| | | | | | | Having per policy ns interface files helps with containers restoring policy. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: pass the subject profile into profile replace/removeJohn Johansen2017-01-163-16/+21
| | | | | | | This is just setup for new ns specific .load, .replace, .remove interface files. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: audit policy ns specified in policy loadJohn Johansen2017-01-163-24/+77
| | | | | | | Verify that profiles in a load set specify the same policy ns and audit the name of the policy ns that policy is being loaded for. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow introspecting the loaded policy pre internal transformJohn Johansen2017-01-168-58/+278
| | | | | | | | Store loaded policy and allow introspecting it through apparmorfs. This has several uses from debugging, policy validation, and policy checkpoint and restore for containers. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add ns name to the audit data for policy loadsJohn Johansen2017-01-162-10/+25
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add profile and ns params to aa_may_manage_policy()John Johansen2017-01-163-14/+12
| | | | | | | | Policy management will be expanded beyond traditional unconfined root. This will require knowning the profile of the task doing the management and the ns view. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add ns being viewed as a param to policy_admin_capable()John Johansen2017-01-163-10/+16
| | | | | | | Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add ns being viewed as a param to policy_view_capable()John Johansen2017-01-164-8/+35
| | | | | | | | | | | Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available and checking that the user namespace level is the same as the policy ns level. This strict pairing will be relaxed once true support of user namespaces lands. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow specifying the profile doing the managementJohn Johansen2017-01-161-11/+21
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow introspecting the policy namespace nameJohn Johansen2017-01-161-0/+24
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: Make aa_remove_profile() callable from a different viewJohn Johansen2017-01-163-5/+7
| | | | | | This is prep work for fs operations being able to remove namespaces. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: track ns level so it can be used to help in view checksJohn Johansen2017-01-161-0/+1
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add special .null file used to "close" fds at execJohn Johansen2017-01-163-1/+81
| | | | | | | Borrow the special null device file from selinux to "close" fds that don't have sufficient permissions at exec time. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: provide userspace flag indicating binfmt_elf_mmap changeJohn Johansen2017-01-161-0/+1
| | | | | | | | | | | | | | | | Commit 9f834ec18def ("binfmt_elf: switch to new creds when switching to new mm") changed when the creds are installed by the binfmt_elf handler. This affects which creds are used to mmap the executable into the address space. Which can have an affect on apparmor policy. Add a flag to apparmor at /sys/kernel/security/apparmor/features/domain/fix_binfmt_elf_mmap to make it possible to detect this semantic change so that the userspace tools and the regression test suite can correctly deal with the change. BugLink: http://bugs.launchpad.net/bugs/1630069 Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add a default null dfaJohn Johansen2017-01-166-2/+46
| | | | | | | | | | | Instead of testing whether a given dfa exists in every code path, have a default null dfa that is used when loaded policy doesn't provide a dfa. This will let us get rid of special casing and avoid dereference bugs when special casing is missed. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow policydb to be used as the file dfaJohn Johansen2017-01-161-4/+8
| | | | | | | | | | Newer policy will combine the file and policydb dfas, allowing for better optimizations. However to support older policy we need to keep the ability to address the "file" dfa separately. So dup the policydb as if it is the file dfa and set the appropriate start state. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add get_dfa() fnJohn Johansen2017-01-161-0/+15
| | | | | | | The dfa is currently setup to be shared (has the basis of refcounting) but currently can't be because the count can't be increased. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: prepare to support newer versions of policyJohn Johansen2017-01-162-10/+25
| | | | | | | | | | Newer policy encodes more than just version in the version tag, so add masking to make sure the comparison remains correct. Note: this is fully compatible with older policy as it will never set the bits being masked out. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add support for force complain flag to support learning modeJohn Johansen2017-01-161-1/+3
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: remove paranoid load switchJohn Johansen2017-01-162-16/+10
| | | | | | Policy should always under go a full paranoid verification. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: name null-XXX profiles after the executableJohn Johansen2017-01-163-17/+47
| | | | | | | | When possible its better to name a learning profile after the missing profile in question. This allows for both more informative names and for profile reuse. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: pass gfp_t parameter into profile allocationJohn Johansen2017-01-164-8/+9
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: refactor prepare_ns() and make usable from different viewsJohn Johansen2017-01-165-38/+79
| | | | | | | | prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: update policy_destroy to use new debug assertsJohn Johansen2017-01-161-9/+2
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: pass gfp param into aa_policy_init()John Johansen2017-01-164-7/+7
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: constify policy name and hnameJohn Johansen2017-01-163-4/+4
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename hname_tail to basenameJohn Johansen2017-01-163-4/+4
| | | | | | Rename to the shorter and more familiar shell cmd name Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename mediated_filesystem() to path_mediated_fs()John Johansen2017-01-162-8/+8
| | | | | | | Rename to indicate the test is only about whether path mediation is used, not whether other types of mediation might be used. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add debug assert AA_BUG and Kconfig to control debug infoJohn Johansen2017-01-163-4/+43
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add macro for bug asserts to check that a lock is heldJohn Johansen2017-01-161-0/+11
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow ns visibility question to consider subnsesJohn Johansen2017-01-164-8/+14
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add fn to lookup profiles by fqnameJohn Johansen2017-01-164-7/+38
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
OpenPOWER on IntegriCloud