1/* 2 * AppArmor security module 3 * 4 * This file contains AppArmor policy attachment and domain transitions 5 * 6 * Copyright (C) 2002-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15#include <linux/errno.h> 16#include <linux/fdtable.h> 17#include <linux/file.h> 18#include <linux/mount.h> 19#include <linux/syscalls.h> 20#include <linux/tracehook.h> 21#include <linux/personality.h> 22 23#include "include/audit.h" 24#include "include/apparmorfs.h" 25#include "include/context.h" 26#include "include/domain.h" 27#include "include/file.h" 28#include "include/ipc.h" 29#include "include/match.h" 30#include "include/path.h" 31#include "include/policy.h" 32 33/** 34 * aa_free_domain_entries - free entries in a domain table 35 * @domain: the domain table to free (MAYBE NULL) 36 */ 37void aa_free_domain_entries(struct aa_domain *domain) 38{ 39 int i; 40 if (domain) { 41 if (!domain->table) 42 return; 43 44 for (i = 0; i < domain->size; i++) 45 kzfree(domain->table[i]); 46 kzfree(domain->table); 47 domain->table = NULL; 48 } 49} 50 51/** 52 * may_change_ptraced_domain - check if can change profile on ptraced task 53 * @task: task we want to change profile of (NOT NULL) 54 * @to_profile: profile to change to (NOT NULL) 55 * 56 * Check if the task is ptraced and if so if the tracing task is allowed 57 * to trace the new domain 58 * 59 * Returns: %0 or error if change not allowed 60 */ 61static int may_change_ptraced_domain(struct task_struct *task, 62 struct aa_profile *to_profile) 63{ 64 struct task_struct *tracer; 65 const struct cred *cred = NULL; 66 struct aa_profile *tracerp = NULL; 67 int error = 0; 68 69 rcu_read_lock(); 70 tracer = tracehook_tracer_task(task); 71 if (tracer) { 72 /* released below */ 73 cred = get_task_cred(tracer); 74 tracerp = aa_cred_profile(cred); 75 } 76 rcu_read_unlock(); 77 78 /* not ptraced */ 79 if (!tracer || unconfined(tracerp)) 80 goto out; 81 82 error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH); 83 84out: 85 if (cred) 86 put_cred(cred); 87 88 return error; 89} 90 91/** 92 * change_profile_perms - find permissions for change_profile 93 * @profile: the current profile (NOT NULL) 94 * @ns: the namespace being switched to (NOT NULL) 95 * @name: the name of the profile to change to (NOT NULL) 96 * @request: requested perms 97 * @start: state to start matching in 98 * 99 * Returns: permission set 100 */ 101static struct file_perms change_profile_perms(struct aa_profile *profile, 102 struct aa_namespace *ns, 103 const char *name, u32 request, 104 unsigned int start) 105{ 106 struct file_perms perms; 107 struct path_cond cond = { }; 108 unsigned int state; 109 110 if (unconfined(profile)) { 111 perms.allow = AA_MAY_CHANGE_PROFILE | AA_MAY_ONEXEC; 112 perms.audit = perms.quiet = perms.kill = 0; 113 return perms; 114 } else if (!profile->file.dfa) { 115 return nullperms; 116 } else if ((ns == profile->ns)) { 117 /* try matching against rules with out namespace prepended */ 118 aa_str_perms(profile->file.dfa, start, name, &cond, &perms); 119 if (COMBINED_PERM_MASK(perms) & request) 120 return perms; 121 } 122 123 /* try matching with namespace name and then profile */ 124 state = aa_dfa_match(profile->file.dfa, start, ns->base.name); 125 state = aa_dfa_match_len(profile->file.dfa, state, ":", 1); 126 aa_str_perms(profile->file.dfa, state, name, &cond, &perms); 127 128 return perms; 129} 130 131/** 132 * __attach_match_ - find an attachment match 133 * @name - to match against (NOT NULL) 134 * @head - profile list to walk (NOT NULL) 135 * 136 * Do a linear search on the profiles in the list. There is a matching 137 * preference where an exact match is preferred over a name which uses 138 * expressions to match, and matching expressions with the greatest 139 * xmatch_len are preferred. 140 * 141 * Requires: @head not be shared or have appropriate locks held 142 * 143 * Returns: profile or NULL if no match found 144 */ 145static struct aa_profile *__attach_match(const char *name, 146 struct list_head *head) 147{ 148 int len = 0; 149 struct aa_profile *profile, *candidate = NULL; 150 151 list_for_each_entry(profile, head, base.list) { 152 if (profile->flags & PFLAG_NULL) 153 continue; 154 if (profile->xmatch && profile->xmatch_len > len) { 155 unsigned int state = aa_dfa_match(profile->xmatch, 156 DFA_START, name); 157 u32 perm = dfa_user_allow(profile->xmatch, state); 158 /* any accepting state means a valid match. */ 159 if (perm & MAY_EXEC) { 160 candidate = profile; 161 len = profile->xmatch_len; 162 } 163 } else if (!strcmp(profile->base.name, name)) 164 /* exact non-re match, no more searching required */ 165 return profile; 166 } 167 168 return candidate; 169} 170 171/** 172 * find_attach - do attachment search for unconfined processes 173 * @ns: the current namespace (NOT NULL) 174 * @list: list to search (NOT NULL) 175 * @name: the executable name to match against (NOT NULL) 176 * 177 * Returns: profile or NULL if no match found 178 */ 179static struct aa_profile *find_attach(struct aa_namespace *ns, 180 struct list_head *list, const char *name) 181{ 182 struct aa_profile *profile; 183 184 read_lock(&ns->lock); 185 profile = aa_get_profile(__attach_match(name, list)); 186 read_unlock(&ns->lock); 187 188 return profile; 189} 190 191/** 192 * separate_fqname - separate the namespace and profile names 193 * @fqname: the fqname name to split (NOT NULL) 194 * @ns_name: the namespace name if it exists (NOT NULL) 195 * 196 * This is the xtable equivalent routine of aa_split_fqname. It finds the 197 * split in an xtable fqname which contains an embedded \0 instead of a : 198 * if a namespace is specified. This is done so the xtable is constant and 199 * isn't re-split on every lookup. 200 * 201 * Either the profile or namespace name may be optional but if the namespace 202 * is specified the profile name termination must be present. This results 203 * in the following possible encodings: 204 * profile_name\0 205 * :ns_name\0profile_name\0 206 * :ns_name\0\0 207 * 208 * NOTE: the xtable fqname is pre-validated at load time in unpack_trans_table 209 * 210 * Returns: profile name if it is specified else NULL 211 */ 212static const char *separate_fqname(const char *fqname, const char **ns_name) 213{ 214 const char *name; 215 216 if (fqname[0] == ':') { 217 /* In this case there is guaranteed to be two \0 terminators 218 * in the string. They are verified at load time by 219 * by unpack_trans_table 220 */ 221 *ns_name = fqname + 1; /* skip : */ 222 name = *ns_name + strlen(*ns_name) + 1; 223 if (!*name) 224 name = NULL; 225 } else { 226 *ns_name = NULL; 227 name = fqname; 228 } 229 230 return name; 231} 232 233static const char *next_name(int xtype, const char *name) 234{ 235 return NULL; 236} 237 238/** 239 * x_table_lookup - lookup an x transition name via transition table 240 * @profile: current profile (NOT NULL) 241 * @xindex: index into x transition table 242 * 243 * Returns: refcounted profile, or NULL on failure (MAYBE NULL) 244 */ 245static struct aa_profile *x_table_lookup(struct aa_profile *profile, u32 xindex) 246{ 247 struct aa_profile *new_profile = NULL; 248 struct aa_namespace *ns = profile->ns; 249 u32 xtype = xindex & AA_X_TYPE_MASK; 250 int index = xindex & AA_X_INDEX_MASK; 251 const char *name; 252 253 /* index is guaranteed to be in range, validated at load time */ 254 for (name = profile->file.trans.table[index]; !new_profile && name; 255 name = next_name(xtype, name)) { 256 struct aa_namespace *new_ns; 257 const char *xname = NULL; 258 259 new_ns = NULL; 260 if (xindex & AA_X_CHILD) { 261 /* release by caller */ 262 new_profile = aa_find_child(profile, name); 263 continue; 264 } else if (*name == ':') { 265 /* switching namespace */ 266 const char *ns_name; 267 xname = name = separate_fqname(name, &ns_name); 268 if (!xname) 269 /* no name so use profile name */ 270 xname = profile->base.hname; 271 if (*ns_name == '@') { 272 /* TODO: variable support */ 273 ; 274 } 275 /* released below */ 276 new_ns = aa_find_namespace(ns, ns_name); 277 if (!new_ns) 278 continue; 279 } else if (*name == '@') { 280 /* TODO: variable support */ 281 continue; 282 } else { 283 /* basic namespace lookup */ 284 xname = name; 285 } 286 287 /* released by caller */ 288 new_profile = aa_lookup_profile(new_ns ? new_ns : ns, xname); 289 aa_put_namespace(new_ns); 290 } 291 292 /* released by caller */ 293 return new_profile; 294} 295 296/** 297 * x_to_profile - get target profile for a given xindex 298 * @profile: current profile (NOT NULL) 299 * @name: name to lookup (NOT NULL) 300 * @xindex: index into x transition table 301 * 302 * find profile for a transition index 303 * 304 * Returns: refcounted profile or NULL if not found available 305 */ 306static struct aa_profile *x_to_profile(struct aa_profile *profile, 307 const char *name, u32 xindex) 308{ 309 struct aa_profile *new_profile = NULL; 310 struct aa_namespace *ns = profile->ns; 311 u32 xtype = xindex & AA_X_TYPE_MASK; 312 313 switch (xtype) { 314 case AA_X_NONE: 315 /* fail exec unless ix || ux fallback - handled by caller */ 316 return NULL; 317 case AA_X_NAME: 318 if (xindex & AA_X_CHILD) 319 /* released by caller */ 320 new_profile = find_attach(ns, &profile->base.profiles, 321 name); 322 else 323 /* released by caller */ 324 new_profile = find_attach(ns, &ns->base.profiles, 325 name); 326 break; 327 case AA_X_TABLE: 328 /* released by caller */ 329 new_profile = x_table_lookup(profile, xindex); 330 break; 331 } 332 333 /* released by caller */ 334 return new_profile; 335} 336 337/** 338 * apparmor_bprm_set_creds - set the new creds on the bprm struct 339 * @bprm: binprm for the exec (NOT NULL) 340 * 341 * Returns: %0 or error on failure 342 */ 343int apparmor_bprm_set_creds(struct linux_binprm *bprm) 344{ 345 struct aa_task_cxt *cxt; 346 struct aa_profile *profile, *new_profile = NULL; 347 struct aa_namespace *ns; 348 char *buffer = NULL; 349 unsigned int state; 350 struct file_perms perms = {}; 351 struct path_cond cond = { 352 bprm->file->f_path.dentry->d_inode->i_uid, 353 bprm->file->f_path.dentry->d_inode->i_mode 354 }; 355 const char *name = NULL, *target = NULL, *info = NULL; 356 int error = cap_bprm_set_creds(bprm); 357 if (error) 358 return error; 359 360 if (bprm->cred_prepared) 361 return 0; 362 363 cxt = bprm->cred->security; 364 BUG_ON(!cxt); 365 366 profile = aa_get_profile(aa_newest_version(cxt->profile)); 367 /* 368 * get the namespace from the replacement profile as replacement 369 * can change the namespace 370 */ 371 ns = profile->ns; 372 state = profile->file.start; 373 374 /* buffer freed below, name is pointer into buffer */ 375 error = aa_get_name(&bprm->file->f_path, profile->path_flags, &buffer, 376 &name); 377 if (error) { 378 if (profile->flags & 379 (PFLAG_IX_ON_NAME_ERROR | PFLAG_UNCONFINED)) 380 error = 0; 381 info = "Exec failed name resolution"; 382 name = bprm->filename; 383 goto audit; 384 } 385 386 /* Test for onexec first as onexec directives override other 387 * x transitions. 388 */ 389 if (unconfined(profile)) { 390 /* unconfined task */ 391 if (cxt->onexec) 392 /* change_profile on exec already been granted */ 393 new_profile = aa_get_profile(cxt->onexec); 394 else 395 new_profile = find_attach(ns, &ns->base.profiles, name); 396 if (!new_profile) 397 goto cleanup; 398 goto apply; 399 } 400 401 /* find exec permissions for name */ 402 state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms); 403 if (cxt->onexec) { 404 struct file_perms cp; 405 info = "change_profile onexec"; 406 if (!(perms.allow & AA_MAY_ONEXEC)) 407 goto audit; 408 409 /* test if this exec can be paired with change_profile onexec. 410 * onexec permission is linked to exec with a standard pairing 411 * exec\0change_profile 412 */ 413 state = aa_dfa_null_transition(profile->file.dfa, state); 414 cp = change_profile_perms(profile, cxt->onexec->ns, name, 415 AA_MAY_ONEXEC, state); 416 417 if (!(cp.allow & AA_MAY_ONEXEC)) 418 goto audit; 419 new_profile = aa_get_profile(aa_newest_version(cxt->onexec)); 420 goto apply; 421 } 422 423 if (perms.allow & MAY_EXEC) { 424 /* exec permission determine how to transition */ 425 new_profile = x_to_profile(profile, name, perms.xindex); 426 if (!new_profile) { 427 if (perms.xindex & AA_X_INHERIT) { 428 /* (p|c|n)ix - don't change profile but do 429 * use the newest version, which was picked 430 * up above when getting profile 431 */ 432 info = "ix fallback"; 433 new_profile = aa_get_profile(profile); 434 goto x_clear; 435 } else if (perms.xindex & AA_X_UNCONFINED) { 436 new_profile = aa_get_profile(ns->unconfined); 437 info = "ux fallback"; 438 } else { 439 error = -ENOENT; 440 info = "profile not found"; 441 } 442 } 443 } else if (COMPLAIN_MODE(profile)) { 444 /* no exec permission - are we in learning mode */ 445 new_profile = aa_new_null_profile(profile, 0); 446 if (!new_profile) { 447 error = -ENOMEM; 448 info = "could not create null profile"; 449 } else { 450 error = -EACCES; 451 target = new_profile->base.hname; 452 } 453 perms.xindex |= AA_X_UNSAFE; 454 } else 455 /* fail exec */ 456 error = -EACCES; 457 458 if (!new_profile) 459 goto audit; 460 461 if (bprm->unsafe & LSM_UNSAFE_SHARE) { 462 ; 463 } 464 465 if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { 466 error = may_change_ptraced_domain(current, new_profile); 467 if (error) { 468 aa_put_profile(new_profile); 469 goto audit; 470 } 471 } 472 473 /* Determine if secure exec is needed. 474 * Can be at this point for the following reasons: 475 * 1. unconfined switching to confined 476 * 2. confined switching to different confinement 477 * 3. confined switching to unconfined 478 * 479 * Cases 2 and 3 are marked as requiring secure exec 480 * (unless policy specified "unsafe exec") 481 * 482 * bprm->unsafe is used to cache the AA_X_UNSAFE permission 483 * to avoid having to recompute in secureexec 484 */ 485 if (!(perms.xindex & AA_X_UNSAFE)) { 486 AA_DEBUG("scrubbing environment variables for %s profile=%s\n", 487 name, new_profile->base.hname); 488 bprm->unsafe |= AA_SECURE_X_NEEDED; 489 } 490apply: 491 target = new_profile->base.hname; 492 /* when transitioning profiles clear unsafe personality bits */ 493 bprm->per_clear |= PER_CLEAR_ON_SETID; 494 495x_clear: 496 aa_put_profile(cxt->profile); 497 /* transfer new profile reference will be released when cxt is freed */ 498 cxt->profile = new_profile; 499 500 /* clear out all temporary/transitional state from the context */ 501 aa_put_profile(cxt->previous); 502 aa_put_profile(cxt->onexec); 503 cxt->previous = NULL; 504 cxt->onexec = NULL; 505 cxt->token = 0; 506 507audit: 508 error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC, 509 name, target, cond.uid, info, error); 510 511cleanup: 512 aa_put_profile(profile); 513 kfree(buffer); 514 515 return error; 516} 517 518/** 519 * apparmor_bprm_secureexec - determine if secureexec is needed 520 * @bprm: binprm for exec (NOT NULL) 521 * 522 * Returns: %1 if secureexec is needed else %0 523 */ 524int apparmor_bprm_secureexec(struct linux_binprm *bprm) 525{ 526 int ret = cap_bprm_secureexec(bprm); 527 528 /* the decision to use secure exec is computed in set_creds 529 * and stored in bprm->unsafe. 530 */ 531 if (!ret && (bprm->unsafe & AA_SECURE_X_NEEDED)) 532 ret = 1; 533 534 return ret; 535} 536 537/** 538 * apparmor_bprm_committing_creds - do task cleanup on committing new creds 539 * @bprm: binprm for the exec (NOT NULL) 540 */ 541void apparmor_bprm_committing_creds(struct linux_binprm *bprm) 542{ 543 struct aa_profile *profile = __aa_current_profile(); 544 struct aa_task_cxt *new_cxt = bprm->cred->security; 545 546 /* bail out if unconfined or not changing profile */ 547 if ((new_cxt->profile == profile) || 548 (unconfined(new_cxt->profile))) 549 return; 550 551 current->pdeath_signal = 0; 552 553 /* reset soft limits and set hard limits for the new profile */ 554 __aa_transition_rlimits(profile, new_cxt->profile); 555} 556 557/** 558 * apparmor_bprm_commited_cred - do cleanup after new creds committed 559 * @bprm: binprm for the exec (NOT NULL) 560 */ 561void apparmor_bprm_committed_creds(struct linux_binprm *bprm) 562{ 563 /* TODO: cleanup signals - ipc mediation */ 564 return; 565} 566 567/* 568 * Functions for self directed profile change 569 */ 570 571/** 572 * new_compound_name - create an hname with @n2 appended to @n1 573 * @n1: base of hname (NOT NULL) 574 * @n2: name to append (NOT NULL) 575 * 576 * Returns: new name or NULL on error 577 */ 578static char *new_compound_name(const char *n1, const char *n2) 579{ 580 char *name = kmalloc(strlen(n1) + strlen(n2) + 3, GFP_KERNEL); 581 if (name) 582 sprintf(name, "%s//%s", n1, n2); 583 return name; 584} 585 586/** 587 * aa_change_hat - change hat to/from subprofile 588 * @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0) 589 * @count: number of hat names in @hats 590 * @token: magic value to validate the hat change 591 * @permtest: true if this is just a permission test 592 * 593 * Change to the first profile specified in @hats that exists, and store 594 * the @hat_magic in the current task context. If the count == 0 and the 595 * @token matches that stored in the current task context, return to the 596 * top level profile. 597 * 598 * Returns %0 on success, error otherwise. 599 */ 600int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) 601{ 602 const struct cred *cred; 603 struct aa_task_cxt *cxt; 604 struct aa_profile *profile, *previous_profile, *hat = NULL; 605 char *name = NULL; 606 int i; 607 struct file_perms perms = {}; 608 const char *target = NULL, *info = NULL; 609 int error = 0; 610 611 /* released below */ 612 cred = get_current_cred(); 613 cxt = cred->security; 614 profile = aa_cred_profile(cred); 615 previous_profile = cxt->previous; 616 617 if (unconfined(profile)) { 618 info = "unconfined"; 619 error = -EPERM; 620 goto audit; 621 } 622 623 if (count) { 624 /* attempting to change into a new hat or switch to a sibling */ 625 struct aa_profile *root; 626 root = PROFILE_IS_HAT(profile) ? profile->parent : profile; 627 628 /* find first matching hat */ 629 for (i = 0; i < count && !hat; i++) 630 /* released below */ 631 hat = aa_find_child(root, hats[i]); 632 if (!hat) { 633 if (!COMPLAIN_MODE(root) || permtest) { 634 if (list_empty(&root->base.profiles)) 635 error = -ECHILD; 636 else 637 error = -ENOENT; 638 goto out; 639 } 640 641 /* 642 * In complain mode and failed to match any hats. 643 * Audit the failure is based off of the first hat 644 * supplied. This is done due how userspace 645 * interacts with change_hat. 646 * 647 * TODO: Add logging of all failed hats 648 */ 649 650 /* freed below */ 651 name = new_compound_name(root->base.hname, hats[0]); 652 target = name; 653 /* released below */ 654 hat = aa_new_null_profile(profile, 1); 655 if (!hat) { 656 info = "failed null profile create"; 657 error = -ENOMEM; 658 goto audit; 659 } 660 } else { 661 target = hat->base.hname; 662 if (!PROFILE_IS_HAT(hat)) { 663 info = "target not hat"; 664 error = -EPERM; 665 goto audit; 666 } 667 } 668 669 error = may_change_ptraced_domain(current, hat); 670 if (error) { 671 info = "ptraced"; 672 error = -EPERM; 673 goto audit; 674 } 675 676 if (!permtest) { 677 error = aa_set_current_hat(hat, token); 678 if (error == -EACCES) 679 /* kill task in case of brute force attacks */ 680 perms.kill = AA_MAY_CHANGEHAT; 681 else if (name && !error) 682 /* reset error for learning of new hats */ 683 error = -ENOENT; 684 } 685 } else if (previous_profile) { 686 /* Return to saved profile. Kill task if restore fails 687 * to avoid brute force attacks 688 */ 689 target = previous_profile->base.hname; 690 error = aa_restore_previous_profile(token); 691 perms.kill = AA_MAY_CHANGEHAT; 692 } else 693 /* ignore restores when there is no saved profile */ 694 goto out; 695 696audit: 697 if (!permtest) 698 error = aa_audit_file(profile, &perms, GFP_KERNEL, 699 OP_CHANGE_HAT, AA_MAY_CHANGEHAT, NULL, 700 target, 0, info, error); 701 702out: 703 aa_put_profile(hat); 704 kfree(name); 705 put_cred(cred); 706 707 return error; 708} 709 710/** 711 * aa_change_profile - perform a one-way profile transition 712 * @ns_name: name of the profile namespace to change to (MAYBE NULL) 713 * @hname: name of profile to change to (MAYBE NULL) 714 * @onexec: whether this transition is to take place immediately or at exec 715 * @permtest: true if this is just a permission test 716 * 717 * Change to new profile @name. Unlike with hats, there is no way 718 * to change back. If @name isn't specified the current profile name is 719 * used. 720 * If @onexec then the transition is delayed until 721 * the next exec. 722 * 723 * Returns %0 on success, error otherwise. 724 */ 725int aa_change_profile(const char *ns_name, const char *hname, bool onexec, 726 bool permtest) 727{ 728 const struct cred *cred; 729 struct aa_task_cxt *cxt; 730 struct aa_profile *profile, *target = NULL; 731 struct aa_namespace *ns = NULL; 732 struct file_perms perms = {}; 733 const char *name = NULL, *info = NULL; 734 int op, error = 0; 735 u32 request; 736 737 if (!hname && !ns_name) 738 return -EINVAL; 739 740 if (onexec) { 741 request = AA_MAY_ONEXEC; 742 op = OP_CHANGE_ONEXEC; 743 } else { 744 request = AA_MAY_CHANGE_PROFILE; 745 op = OP_CHANGE_PROFILE; 746 } 747 748 cred = get_current_cred(); 749 cxt = cred->security; 750 profile = aa_cred_profile(cred); 751 752 if (ns_name) { 753 /* released below */ 754 ns = aa_find_namespace(profile->ns, ns_name); 755 if (!ns) { 756 /* we don't create new namespace in complain mode */ 757 name = ns_name; 758 info = "namespace not found"; 759 error = -ENOENT; 760 goto audit; 761 } 762 } else 763 /* released below */ 764 ns = aa_get_namespace(profile->ns); 765 766 /* if the name was not specified, use the name of the current profile */ 767 if (!hname) { 768 if (unconfined(profile)) 769 hname = ns->unconfined->base.hname; 770 else 771 hname = profile->base.hname; 772 } 773 774 perms = change_profile_perms(profile, ns, hname, request, 775 profile->file.start); 776 if (!(perms.allow & request)) { 777 error = -EACCES; 778 goto audit; 779 } 780 781 /* released below */ 782 target = aa_lookup_profile(ns, hname); 783 if (!target) { 784 info = "profile not found"; 785 error = -ENOENT; 786 if (permtest || !COMPLAIN_MODE(profile)) 787 goto audit; 788 /* released below */ 789 target = aa_new_null_profile(profile, 0); 790 if (!target) { 791 info = "failed null profile create"; 792 error = -ENOMEM; 793 goto audit; 794 } 795 } 796 797 /* check if tracing task is allowed to trace target domain */ 798 error = may_change_ptraced_domain(current, target); 799 if (error) { 800 info = "ptrace prevents transition"; 801 goto audit; 802 } 803 804 if (permtest) 805 goto audit; 806 807 if (onexec) 808 error = aa_set_current_onexec(target); 809 else 810 error = aa_replace_current_profile(target); 811 812audit: 813 if (!permtest) 814 error = aa_audit_file(profile, &perms, GFP_KERNEL, op, request, 815 name, hname, 0, info, error); 816 817 aa_put_namespace(ns); 818 aa_put_profile(target); 819 put_cred(cred); 820 821 return error; 822} 823