static int profile_umount(struct aa_profile *profile, struct path *path, char *buffer) { struct aa_perms perms = { }; const char *name = NULL, *info = NULL; unsigned int state; int error; AA_BUG(!profile); AA_BUG(!path); if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT)) return 0; error = aa_path_name(path, path_flags(profile, path), buffer, &name, &info, profile->disconnected); if (error) goto audit; state = aa_dfa_match(profile->policy.dfa, profile->policy.start[AA_CLASS_MOUNT], name); perms = compute_mnt_perms(profile->policy.dfa, state); if (AA_MAY_UMOUNT & ~perms.allow) error = -EACCES; audit: return audit_mount(profile, OP_UMOUNT, name, NULL, NULL, NULL, 0, NULL, AA_MAY_UMOUNT, &perms, info, error); }
/** * match_mnt - handle path matching for mount * @profile: the confining profile * @mntpath: for the mntpnt (NOT NULL) * @buffer: buffer to be used to lookup mntpath * @devpath: path devname/src_name (MAYBE NULL) * @devbuffer: buffer to be used to lookup devname/src_name * @type: string for the dev type (MAYBE NULL) * @flags: mount flags to match * @data: fs mount data (MAYBE NULL) * @binary: whether @data is binary * * Returns: 0 on success else error */ static int match_mnt(struct aa_profile *profile, const struct path *path, char *buffer, struct path *devpath, char *devbuffer, const char *type, unsigned long flags, void *data, bool binary) { const char *devname = NULL, *info = NULL; int error = -EACCES; AA_BUG(!profile); AA_BUG(devpath && !devbuffer); if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT)) return 0; if (devpath) { error = aa_path_name(devpath, path_flags(profile, devpath), devbuffer, &devname, &info, profile->disconnected); if (error) devname = ERR_PTR(error); } return match_mnt_path_str(profile, path, buffer, devname, type, flags, data, binary, info); }
static int path_name(const char *op, struct aa_label *label, const struct path *path, int flags, char *buffer, const char **name, struct path_cond *cond, u32 request) { struct aa_profile *profile; const char *info = NULL; int error; error = aa_path_name(path, flags, buffer, name, &info, labels_profile(label)->disconnected); if (error) { fn_for_each_confined(label, profile, aa_audit_file(profile, &nullperms, op, request, *name, NULL, NULL, cond->uid, info, error)); return error; } return 0; }
/** * match_mnt_path_str - handle path matching for mount * @profile: the confining profile * @mntpath: for the mntpnt (NOT NULL) * @buffer: buffer to be used to lookup mntpath * @devnme: string for the devname/src_name (MAY BE NULL OR ERRPTR) * @type: string for the dev type (MAYBE NULL) * @flags: mount flags to match * @data: fs mount data (MAYBE NULL) * @binary: whether @data is binary * @devinfo: error str if (IS_ERR(@devname)) * * Returns: 0 on success else error */ static int match_mnt_path_str(struct aa_profile *profile, const struct path *mntpath, char *buffer, const char *devname, const char *type, unsigned long flags, void *data, bool binary, const char *devinfo) { struct aa_perms perms = { }; const char *mntpnt = NULL, *info = NULL; int pos, error; AA_BUG(!profile); AA_BUG(!mntpath); AA_BUG(!buffer); if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT)) return 0; error = aa_path_name(mntpath, path_flags(profile, mntpath), buffer, &mntpnt, &info, profile->disconnected); if (error) goto audit; if (IS_ERR(devname)) { error = PTR_ERR(devname); devname = NULL; info = devinfo; goto audit; } error = -EACCES; pos = do_match_mnt(profile->policy.dfa, profile->policy.start[AA_CLASS_MOUNT], mntpnt, devname, type, flags, data, binary, &perms); if (pos) { info = mnt_info_table[pos]; goto audit; } error = 0; audit: return audit_mount(profile, OP_MOUNT, mntpnt, devname, type, NULL, flags, data, AA_MAY_MOUNT, &perms, info, error); }
int aa_umount(struct aa_label *label, struct vfsmount *mnt, int flags) { struct aa_profile *profile; char *buffer = NULL; int error; struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; AA_BUG(!label); AA_BUG(!mnt); get_buffers(buffer); error = fn_for_each_confined(label, profile, profile_umount(profile, &path, buffer)); put_buffers(buffer); return error; } /* helper fn for transition on pivotroot * * Returns: label for transition or ERR_PTR. Does not return NULL */ static struct aa_label *build_pivotroot(struct aa_profile *profile, const struct path *new_path, char *new_buffer, const struct path *old_path, char *old_buffer) { const char *old_name, *new_name = NULL, *info = NULL; const char *trans_name = NULL; struct aa_perms perms = { }; unsigned int state; int error; AA_BUG(!profile); AA_BUG(!new_path); AA_BUG(!old_path); if (profile_unconfined(profile) || !PROFILE_MEDIATES(profile, AA_CLASS_MOUNT)) return aa_get_newest_label(&profile->label); error = aa_path_name(old_path, path_flags(profile, old_path), old_buffer, &old_name, &info, profile->disconnected); if (error) goto audit; error = aa_path_name(new_path, path_flags(profile, new_path), new_buffer, &new_name, &info, profile->disconnected); if (error) goto audit; error = -EACCES; state = aa_dfa_match(profile->policy.dfa, profile->policy.start[AA_CLASS_MOUNT], new_name); state = aa_dfa_null_transition(profile->policy.dfa, state); state = aa_dfa_match(profile->policy.dfa, state, old_name); perms = compute_mnt_perms(profile->policy.dfa, state); if (AA_MAY_PIVOTROOT & perms.allow) error = 0; audit: error = audit_mount(profile, OP_PIVOTROOT, new_name, old_name, NULL, trans_name, 0, NULL, AA_MAY_PIVOTROOT, &perms, info, error); if (error) return ERR_PTR(error); return aa_get_newest_label(&profile->label); } int aa_pivotroot(struct aa_label *label, const struct path *old_path, const struct path *new_path) { struct aa_profile *profile; struct aa_label *target = NULL; char *old_buffer = NULL, *new_buffer = NULL, *info = NULL; int error; AA_BUG(!label); AA_BUG(!old_path); AA_BUG(!new_path); get_buffers(old_buffer, new_buffer); target = fn_label_build(label, profile, GFP_ATOMIC, build_pivotroot(profile, new_path, new_buffer, old_path, old_buffer)); if (!target) { info = "label build failed"; error = -ENOMEM; goto fail; } else if (!IS_ERR(target)) { error = aa_replace_current_label(target); if (error) { /* TODO: audit target */ aa_put_label(target); goto out; } } else /* already audited error */ error = PTR_ERR(target); out: put_buffers(old_buffer, new_buffer); return error; fail: /* TODO: add back in auditing of new_name and old_name */ error = fn_for_each(label, profile, audit_mount(profile, OP_PIVOTROOT, NULL /*new_name */, NULL /* old_name */, NULL, NULL, 0, NULL, AA_MAY_PIVOTROOT, &nullperms, info, error)); goto out; }