/** * aa_getprocattr - Return the profile information for @profile * @profile: the profile to print profile info about (NOT NULL) * @string: Returns - string containing the profile info (NOT NULL) * * Returns: length of @string on success else error on failure * * Requires: profile != NULL * * Creates a string containing the namespace_name://profile_name for * @profile. * * Returns: size of string placed in @string else error code on failure */ int aa_getprocattr(struct aa_profile *profile, char **string) { char *str; int len = 0, mode_len = 0, ns_len = 0, name_len; const char *mode_str = aa_profile_mode_names[profile->mode]; const char *ns_name = NULL; struct aa_namespace *ns = profile->ns; struct aa_namespace *current_ns = __aa_current_profile()->ns; char *s; if (!aa_ns_visible(current_ns, ns)) return -EACCES; ns_name = aa_ns_name(current_ns, ns); ns_len = strlen(ns_name); /* if the visible ns_name is > 0 increase size for : :// seperator */ if (ns_len) ns_len += 4; /* unconfined profiles don't have a mode string appended */ if (!unconfined(profile)) mode_len = strlen(mode_str) + 3; /* + 3 for _() */ name_len = strlen(profile->base.hname); len = mode_len + ns_len + name_len + 1; /* + 1 for \n */ s = str = kmalloc(len + 1, GFP_KERNEL); /* + 1 \0 */ if (!str) return -ENOMEM; if (ns_len) { /* skip over prefix current_ns->base.hname and separating // */ sprintf(s, ":%s://", ns_name); s += ns_len; } if (unconfined(profile)) /* mode string not being appended */ sprintf(s, "%s\n", profile->base.hname); else sprintf(s, "%s (%s)\n", profile->base.hname, mode_str); *string = str; /* NOTE: len does not include \0 of string, not saved as part of file */ return len; }
/** * aa_revalidate_sk - Revalidate access to a sock * @op: operation being checked * @sk: sock being revalidated (NOT NULL) * * Returns: %0 else error if permission denied */ int aa_revalidate_sk(int op, struct sock *sk) { struct aa_profile *profile; int error = 0; /* aa_revalidate_sk should not be called from interrupt context * don't mediate these calls as they are not task related */ if (in_interrupt()) return 0; profile = __aa_current_profile(); if (!unconfined(profile)) error = aa_net_perm(op, profile, sk->sk_family, sk->sk_type, sk->sk_protocol, sk); return error; }
static void audit_cb(struct audit_buffer *ab, void *va) { struct common_audit_data *sa = va; if (sa->aad->iface.target) { struct aa_profile *name = sa->aad->iface.target; audit_log_format(ab, " name="); audit_log_untrustedstring(ab, name->base.hname); } if (sa->aad->iface.pos) audit_log_format(ab, " offset=%ld", sa->aad->iface.pos); } static int audit_iface(struct aa_profile *new, const char *name, const char *info, struct aa_ext *e, int error) { struct aa_profile *profile = __aa_current_profile(); struct common_audit_data sa; struct apparmor_audit_data aad = {0,}; COMMON_AUDIT_DATA_INIT(&sa, NONE); sa.aad = &aad; if (e) aad.iface.pos = e->pos - e->start; aad.iface.target = new; aad.name = name; aad.info = info; aad.error = error; return aa_audit(AUDIT_APPARMOR_STATUS, profile, GFP_KERNEL, &sa, audit_cb); }