1/* 2 * AppArmor security module 3 * 4 * This file contains AppArmor function for pathnames 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15#include <linux/magic.h> 16#include <linux/mnt_namespace.h> 17#include <linux/mount.h> 18#include <linux/namei.h> 19#include <linux/nsproxy.h> 20#include <linux/path.h> 21#include <linux/sched.h> 22#include <linux/slab.h> 23#include <linux/fs_struct.h> 24 25#include "include/apparmor.h" 26#include "include/path.h" 27#include "include/policy.h" 28 29 30/* modified from dcache.c */ 31static int prepend(char **buffer, int buflen, const char *str, int namelen) 32{ 33 buflen -= namelen; 34 if (buflen < 0) 35 return -ENAMETOOLONG; 36 *buffer -= namelen; 37 memcpy(*buffer, str, namelen); 38 return 0; 39} 40 41#define CHROOT_NSCONNECT (PATH_CHROOT_REL | PATH_CHROOT_NSCONNECT) 42 43/** 44 * d_namespace_path - lookup a name associated with a given path 45 * @path: path to lookup (NOT NULL) 46 * @buf: buffer to store path to (NOT NULL) 47 * @buflen: length of @buf 48 * @name: Returns - pointer for start of path name with in @buf (NOT NULL) 49 * @flags: flags controlling path lookup 50 * 51 * Handle path name lookup. 52 * 53 * Returns: %0 else error code if path lookup fails 54 * When no error the path name is returned in @name which points to 55 * to a position in @buf 56 */ 57static int d_namespace_path(struct path *path, char *buf, int buflen, 58 char **name, int flags) 59{ 60 struct path root, tmp; 61 char *res; 62 int connected, error = 0; 63 64 /* Get the root we want to resolve too, released below */ 65 if (flags & PATH_CHROOT_REL) { 66 /* resolve paths relative to chroot */ 67 get_fs_root(current->fs, &root); 68 } else { 69 /* resolve paths relative to namespace */ 70 root.mnt = current->nsproxy->mnt_ns->root; 71 root.dentry = root.mnt->mnt_root; 72 path_get(&root); 73 } 74 75 spin_lock(&dcache_lock); 76 tmp = root; 77 res = __d_path(path, &tmp, buf, buflen); 78 spin_unlock(&dcache_lock); 79 80 *name = res; 81 /* handle error conditions - and still allow a partial path to 82 * be returned. 83 */ 84 if (IS_ERR(res)) { 85 error = PTR_ERR(res); 86 *name = buf; 87 goto out; 88 } 89 90 /* Handle two cases: 91 * 1. A deleted dentry && profile is not allowing mediation of deleted 92 * 2. On some filesystems, newly allocated dentries appear to the 93 * security_path hooks as a deleted dentry except without an inode 94 * allocated. 95 */ 96 if (d_unlinked(path->dentry) && path->dentry->d_inode && 97 !(flags & PATH_MEDIATE_DELETED)) { 98 error = -ENOENT; 99 goto out; 100 } 101 102 /* Determine if the path is connected to the expected root */ 103 connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt; 104 105 /* If the path is not connected, 106 * check if it is a sysctl and handle specially else remove any 107 * leading / that __d_path may have returned. 108 * Unless 109 * specifically directed to connect the path, 110 * OR 111 * if in a chroot and doing chroot relative paths and the path 112 * resolves to the namespace root (would be connected outside 113 * of chroot) and specifically directed to connect paths to 114 * namespace root. 115 */ 116 if (!connected) { 117 /* is the disconnect path a sysctl? */ 118 if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC && 119 strncmp(*name, "/sys/", 5) == 0) { 120 /* TODO: convert over to using a per namespace 121 * control instead of hard coded /proc 122 */ 123 error = prepend(name, *name - buf, "/proc", 5); 124 } else if (!(flags & PATH_CONNECT_PATH) && 125 !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) && 126 (tmp.mnt == current->nsproxy->mnt_ns->root && 127 tmp.dentry == tmp.mnt->mnt_root))) { 128 /* disconnected path, don't return pathname starting 129 * with '/' 130 */ 131 error = -ESTALE; 132 if (*res == '/') 133 *name = res + 1; 134 } 135 } 136 137out: 138 path_put(&root); 139 140 return error; 141} 142 143/** 144 * get_name_to_buffer - get the pathname to a buffer ensure dir / is appended 145 * @path: path to get name for (NOT NULL) 146 * @flags: flags controlling path lookup 147 * @buffer: buffer to put name in (NOT NULL) 148 * @size: size of buffer 149 * @name: Returns - contains position of path name in @buffer (NOT NULL) 150 * 151 * Returns: %0 else error on failure 152 */ 153static int get_name_to_buffer(struct path *path, int flags, char *buffer, 154 int size, char **name) 155{ 156 int adjust = (flags & PATH_IS_DIR) ? 1 : 0; 157 int error = d_namespace_path(path, buffer, size - adjust, name, flags); 158 159 if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0') 160 /* 161 * Append "/" to the pathname. The root directory is a special 162 * case; it already ends in slash. 163 */ 164 strcpy(&buffer[size - 2], "/"); 165 166 return error; 167} 168 169/** 170 * aa_get_name - compute the pathname of a file 171 * @path: path the file (NOT NULL) 172 * @flags: flags controlling path name generation 173 * @buffer: buffer that aa_get_name() allocated (NOT NULL) 174 * @name: Returns - the generated path name if !error (NOT NULL) 175 * 176 * @name is a pointer to the beginning of the pathname (which usually differs 177 * from the beginning of the buffer), or NULL. If there is an error @name 178 * may contain a partial or invalid name that can be used for audit purposes, 179 * but it can not be used for mediation. 180 * 181 * We need PATH_IS_DIR to indicate whether the file is a directory or not 182 * because the file may not yet exist, and so we cannot check the inode's 183 * file type. 184 * 185 * Returns: %0 else error code if could retrieve name 186 */ 187int aa_get_name(struct path *path, int flags, char **buffer, const char **name) 188{ 189 char *buf, *str = NULL; 190 int size = 256; 191 int error; 192 193 *name = NULL; 194 *buffer = NULL; 195 for (;;) { 196 /* freed by caller */ 197 buf = kmalloc(size, GFP_KERNEL); 198 if (!buf) 199 return -ENOMEM; 200 201 error = get_name_to_buffer(path, flags, buf, size, &str); 202 if (error != -ENAMETOOLONG) 203 break; 204 205 kfree(buf); 206 size <<= 1; 207 if (size > aa_g_path_max) 208 return -ENAMETOOLONG; 209 } 210 *buffer = buf; 211 *name = str; 212 213 return error; 214} 215