apparmor: allow profiles to provide info to disconnected paths

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 001e133a3c8ce605c3db5fc977d5c1d7372665c0..c92fd0e7b33c6be8824e57e8a9d93b952a15a20c 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -366,7 +366,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
 
        /* buffer freed below, name is pointer into buffer */
        error = aa_path_name(&bprm->file->f_path, profile->path_flags, &buffer,
-                            &name, &info);
+                            &name, &info, profile->disconnected);
        if (error) {
                if (unconfined(profile) ||
                    (profile->flags & PFLAG_IX_ON_NAME_ERROR))

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 750564c3ab7116e13b46693e6002e87bf6d90e7d..83d43ac72134a70be2b178e89f8ea38fea4031a4 100644 (file)
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -285,7 +285,8 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
        int error;
 
        flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0);
-       error = aa_path_name(path, flags, &buffer, &name, &info);
+       error = aa_path_name(path, flags, &buffer, &name, &info,
+                            profile->disconnected);
        if (error) {
                if (error == -ENOENT && is_deleted(path->dentry)) {
                        /* Access to open files that are deleted are
@@ -366,13 +367,13 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
 
        /* buffer freed below, lname is pointer in buffer */
        error = aa_path_name(&link, profile->path_flags, &buffer, &lname,
-                            &info);
+                            &info, profile->disconnected);
        if (error)
                goto audit;
 
        /* buffer2 freed below, tname is pointer in buffer2 */
        error = aa_path_name(&target, profile->path_flags, &buffer2, &tname,
-                            &info);
+                            &info, profile->disconnected);
        if (error)
                goto audit;
 

diff --git a/security/apparmor/include/path.h b/security/apparmor/include/path.h
index 0444fdde3918905dded243442a9743a7497c183b..78e4909dcc6a3152e6e57714b4683bc17fb0a123 100644 (file)
--- a/security/apparmor/include/path.h
+++ b/security/apparmor/include/path.h
@@ -27,7 +27,8 @@ enum path_flags {
 };
 
 int aa_path_name(const struct path *path, int flags, char **buffer,
-                const char **name, const char **info);
+                const char **name, const char **info,
+                const char *disconnected);
 
 #define MAX_PATH_BUFFERS 2
 

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 67bc96afe54185dff2b0792d5a4cfde8917fdb74..dffa01c018c80ed4bd06b545757e7e0c64440e5c 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -128,6 +128,7 @@ struct aa_data {
  * @mode: the enforcement mode of the profile
  * @flags: flags controlling profile behavior
  * @path_flags: flags controlling path generation behavior
+ * @disconnected: what to prepend if attach_disconnected is specified
  * @size: the memory consumed by this profiles rules
  * @policy: general match rules governing policy
  * @file: The set of rules governing basic file access and domain transitions
@@ -169,6 +170,7 @@ struct aa_profile {
        long mode;
        long flags;
        u32 path_flags;
+       const char *disconnected;
        int size;
 
        struct aa_policydb policy;

diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index a8fc7d08c144bb542ac65cfd8312945c00a1ef50..9490f8e896305d7343216ebca8db9ce756fc3059 100644 (file)
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -50,7 +50,7 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
  *     namespace root.
  */
 static int disconnect(const struct path *path, char *buf, char **name,
-                     int flags)
+                     int flags, const char *disconnected)
 {
        int error = 0;
 
@@ -63,9 +63,14 @@ static int disconnect(const struct path *path, char *buf, char **name,
                error = -EACCES;
                if (**name == '/')
                        *name = *name + 1;
-       } else if (**name != '/')
-               /* CONNECT_PATH with missing root */
-               error = prepend(name, *name - buf, "/", 1);
+       } else {
+               if (**name != '/')
+                       /* CONNECT_PATH with missing root */
+                       error = prepend(name, *name - buf, "/", 1);
+               if (!error && disconnected)
+                       error = prepend(name, *name - buf, disconnected,
+                                       strlen(disconnected));
+       }
 
        return error;
 }
@@ -77,6 +82,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
  * @buflen: length of @buf
  * @name: Returns - pointer for start of path name with in @buf (NOT NULL)
  * @flags: flags controlling path lookup
+ * @disconnected: string to prefix to disconnected paths
  *
  * Handle path name lookup.
  *
@@ -85,7 +91,7 @@ static int disconnect(const struct path *path, char *buf, char **name,
  *          to a position in @buf
  */
 static int d_namespace_path(const struct path *path, char *buf, int buflen,
-                           char **name, int flags)
+                           char **name, int flags, const char *disconnected)
 {
        char *res;
        int error = 0;
@@ -106,8 +112,8 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
                         */
                        return prepend(name, *name - buf, "/proc", 5);
                } else
-                       return disconnect(path, buf, name, flags);
-               return 0;
+                       return disconnect(path, buf, name, flags,
+                                         disconnected);
        }
 
        /* resolve paths relative to chroot?*/
@@ -153,7 +159,7 @@ static int d_namespace_path(const struct path *path, char *buf, int buflen,
        }
 
        if (!connected)
-               error = disconnect(path, buf, name, flags);
+               error = disconnect(path, buf, name, flags, disconnected);
 
 out:
        return error;
@@ -170,10 +176,12 @@ out:
  * Returns: %0 else error on failure
  */
 static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
-                             int size, char **name, const char **info)
+                             int size, char **name, const char **info,
+                             const char *disconnected)
 {
        int adjust = (flags & PATH_IS_DIR) ? 1 : 0;
-       int error = d_namespace_path(path, buffer, size - adjust, name, flags);
+       int error = d_namespace_path(path, buffer, size - adjust, name, flags,
+                                    disconnected);
 
        if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0')
                /*
@@ -203,6 +211,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
  * @buffer: buffer that aa_get_name() allocated  (NOT NULL)
  * @name: Returns - the generated path name if !error (NOT NULL)
  * @info: Returns - information on why the path lookup failed (MAYBE NULL)
+ * @disconnected: string to prepend to disconnected paths
  *
  * @name is a pointer to the beginning of the pathname (which usually differs
  * from the beginning of the buffer), or NULL.  If there is an error @name
@@ -216,7 +225,7 @@ static int get_name_to_buffer(const struct path *path, int flags, char *buffer,
  * Returns: %0 else error code if could retrieve name
  */
 int aa_path_name(const struct path *path, int flags, char **buffer,
-                const char **name, const char **info)
+                const char **name, const char **info, const char *disconnected)
 {
        char *buf, *str = NULL;
        int size = 256;
@@ -230,7 +239,8 @@ int aa_path_name(const struct path *path, int flags, char **buffer,
                if (!buf)
                        return -ENOMEM;
 
-               error = get_name_to_buffer(path, flags, buf, size, &str, info);
+               error = get_name_to_buffer(path, flags, buf, size, &str, info,
+                                          disconnected);
                if (error != -ENAMETOOLONG)
                        break;
 

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index f3422a91353c459b3f0a95448aaaff9b6164e1bd..6bc1b10191fa8b972a42b055391d6c4131c98a98 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -569,6 +569,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                profile->xmatch_len = tmp;
        }
 
+       /* disconnected attachment string is optional */
+       (void) unpack_str(e, &profile->disconnected, "disconnected");
+
        /* per profile debug flags (complain, audit) */
        if (!unpack_nameX(e, AA_STRUCT, "flags"))
                goto fail;