mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

pass prompt info down into the backend for mapping

Browse Source 
mapping for PROMPT_DEV needs to know that we should prompt
This commit is contained in:
John Johansen 2023-04-23 20:27:51 -07:00
parent 2510698f63
commit 5bd2271189
9 changed files with 64 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
parser/libapparmor_re/aare_rules.cc
View File

@ -199,8 +199,8 @@ bool aare_rules::append_rule(const char *rule, bool oob, bool with_perm,
*/ */
CHFA *aare_rules::create_chfa(int *min_match_len, CHFA *aare_rules::create_chfa(int *min_match_len,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, optflags const &opts, bool filedfa,
bool filedfa, bool extended_perms) bool extended_perms, bool prompt)
{ {
/* finish constructing the expr tree from the different permission /* finish constructing the expr tree from the different permission
* set nodes */ * set nodes */
@ -310,9 +310,9 @@ CHFA *aare_rules::create_chfa(int *min_match_len,
//cerr << "Checking extended perms " << extended_perms << "\n"; //cerr << "Checking extended perms " << extended_perms << "\n";
if (extended_perms) { if (extended_perms) {
//cerr << "creating permstable\n"; //cerr << "creating permstable\n";
dfa.compute_perms_table(perms_table); dfa.compute_perms_table(perms_table, prompt);
} }
chfa = new CHFA(dfa, eq, opts, extended_perms); chfa = new CHFA(dfa, eq, opts, extended_perms, prompt);
if (opts.dump & DUMP_DFA_TRANS_TABLE) if (opts.dump & DUMP_DFA_TRANS_TABLE)
chfa->dump(cerr); chfa->dump(cerr);
} }
@ -331,14 +331,15 @@ CHFA *aare_rules::create_chfa(int *min_match_len,
void *aare_rules::create_dfablob(size_t *size, int *min_match_len, void *aare_rules::create_dfablob(size_t *size, int *min_match_len,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, bool filedfa, optflags const &opts, bool filedfa,
bool extended_perms) bool extended_perms, bool prompt)
{ {
char *buffer = NULL; char *buffer = NULL;
stringstream stream; stringstream stream;
try { try {
CHFA *chfa = create_chfa(min_match_len, perms_table, CHFA *chfa = create_chfa(min_match_len, perms_table,
opts, filedfa, extended_perms); opts, filedfa, extended_perms,
prompt);
if (!chfa) { if (!chfa) {
*size = 0; *size = 0;
return NULL; return NULL;
@ -375,7 +376,7 @@ void *aare_rules::create_welded_dfablob(aare_rules *file_rules,
size_t *new_start, size_t *new_start,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, optflags const &opts,
bool extended_perms) bool extended_perms, bool prompt)
{ {
int file_min_len; int file_min_len;
vector <aa_perms> file_perms; vector <aa_perms> file_perms;
@ -383,7 +384,7 @@ void *aare_rules::create_welded_dfablob(aare_rules *file_rules,
try { try {
file_chfa = file_rules->create_chfa(&file_min_len, file_chfa = file_rules->create_chfa(&file_min_len,
file_perms, opts, file_perms, opts,
true, extended_perms); true, extended_perms, prompt);
if (!file_chfa) { if (!file_chfa) {
*size = 0; *size = 0;
return NULL; return NULL;
@ -398,7 +399,7 @@ void *aare_rules::create_welded_dfablob(aare_rules *file_rules,
try { try {
policy_chfa = create_chfa(min_match_len, policy_chfa = create_chfa(min_match_len,
perms_table, opts, perms_table, opts,
false, extended_perms); false, extended_perms, prompt);
if (!policy_chfa) { if (!policy_chfa) {
delete file_chfa; delete file_chfa;
*size = 0; *size = 0;
@ -414,7 +415,7 @@ void *aare_rules::create_welded_dfablob(aare_rules *file_rules,
stringstream stream; stringstream stream;
try { try {
policy_chfa->weld_file_to_policy(*file_chfa, *new_start, policy_chfa->weld_file_to_policy(*file_chfa, *new_start,
extended_perms, extended_perms, prompt,
perms_table, file_perms); perms_table, file_perms);
policy_chfa->flex_table(stream); policy_chfa->flex_table(stream);
} }

6
parser/libapparmor_re/aare_rules.h
View File

@ -118,17 +118,17 @@ class aare_rules {
CHFA *create_chfa(int *min_match_len, CHFA *create_chfa(int *min_match_len,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, bool filedfa, optflags const &opts, bool filedfa,
bool extended_perms); bool extended_perms, bool prompt);
void *create_dfablob(size_t *size, int *min_match_len, void *create_dfablob(size_t *size, int *min_match_len,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, optflags const &opts,
bool filedfa, bool extended_perms); bool filedfa, bool extended_perms, bool prompt);
void *create_welded_dfablob(aare_rules *file_rules, void *create_welded_dfablob(aare_rules *file_rules,
size_t *size, int *min_match_len, size_t *size, int *min_match_len,
size_t *new_start, size_t *new_start,
vector <aa_perms> &perms_table, vector <aa_perms> &perms_table,
optflags const &opts, optflags const &opts,
bool extended_perms); bool extended_perms, bool prompt);
}; };
#endif /* __LIBAA_RE_RULES_H */ #endif /* __LIBAA_RE_RULES_H */

23
parser/libapparmor_re/chfa.cc
View File

@ -55,7 +55,7 @@ void CHFA::init_free_list(vector<pair<size_t, size_t> > &free_list,
* permtable index flag * permtable index flag
*/ */
CHFA::CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts, CHFA::CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
bool permindex): eq(eq) bool permindex, bool prompt): eq(eq)
{ {
if (opts.dump & DUMP_DFA_TRANS_PROGRESS) if (opts.dump & DUMP_DFA_TRANS_PROGRESS)
fprintf(stderr, "Compressing HFA:\r"); fprintf(stderr, "Compressing HFA:\r");
@ -110,11 +110,16 @@ CHFA::CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
accept[0] = dfa.nonmatching->idx; accept[0] = dfa.nonmatching->idx;
accept[1] = dfa.start->idx; accept[1] = dfa.start->idx;
} else { } else {
uint32_t accept3;
accept2.resize(max(dfa.states.size(), (size_t) 2)); accept2.resize(max(dfa.states.size(), (size_t) 2));
dfa.nonmatching->map_perms_to_accept(accept[0], dfa.nonmatching->map_perms_to_accept(accept[0],
accept2[0]); accept2[0],
accept3,
prompt);
dfa.start->map_perms_to_accept(accept[1], dfa.start->map_perms_to_accept(accept[1],
accept2[1]); accept2[1],
accept3,
prompt);
} }
next_check.resize(max(optimal, (size_t) dfa.max_range)); next_check.resize(max(optimal, (size_t) dfa.max_range));
free_list.resize(next_check.size()); free_list.resize(next_check.size());
@ -131,12 +136,15 @@ CHFA::CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
if (!(opts.control & CONTROL_DFA_TRANS_HIGH)) { if (!(opts.control & CONTROL_DFA_TRANS_HIGH)) {
for (Partition::iterator i = dfa.states.begin(); i != dfa.states.end(); i++) { for (Partition::iterator i = dfa.states.begin(); i != dfa.states.end(); i++) {
if (*i != dfa.nonmatching && *i != dfa.start) { if (*i != dfa.nonmatching && *i != dfa.start) {
uint32_t accept3;
insert_state(free_list, *i, dfa); insert_state(free_list, *i, dfa);
if (permindex) if (permindex)
accept[num.size()] = (*i)->idx; accept[num.size()] = (*i)->idx;
else else
(*i)->map_perms_to_accept(accept[num.size()], (*i)->map_perms_to_accept(accept[num.size()],
accept2[num.size()]); accept2[num.size()],
accept3,
prompt);
num.insert(make_pair(*i, num.size())); num.insert(make_pair(*i, num.size()));
} }
if (opts.dump & (DUMP_DFA_TRANS_PROGRESS)) { if (opts.dump & (DUMP_DFA_TRANS_PROGRESS)) {
@ -151,12 +159,15 @@ CHFA::CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
i != order.end(); i++) { i != order.end(); i++) {
if (i->second != dfa.nonmatching && if (i->second != dfa.nonmatching &&
i->second != dfa.start) { i->second != dfa.start) {
uint32_t accept3;
insert_state(free_list, i->second, dfa); insert_state(free_list, i->second, dfa);
if (permindex) if (permindex)
accept[num.size()] = i->second->idx; accept[num.size()] = i->second->idx;
else else
i->second->map_perms_to_accept(accept[num.size()], i->second->map_perms_to_accept(accept[num.size()],
accept2[num.size()]); accept2[num.size()],
accept3,
prompt);
num.insert(make_pair(i->second, num.size())); num.insert(make_pair(i->second, num.size()));
} }
if (opts.dump & (DUMP_DFA_TRANS_PROGRESS)) { if (opts.dump & (DUMP_DFA_TRANS_PROGRESS)) {
@ -484,7 +495,7 @@ void CHFA::flex_table(ostream &os)
*/ */
void CHFA::weld_file_to_policy(CHFA &file_chfa, size_t &new_start, void CHFA::weld_file_to_policy(CHFA &file_chfa, size_t &new_start,
bool accept_idx, bool accept_idx, bool prompt,
vector <aa_perms> &policy_perms, vector <aa_perms> &policy_perms,
vector <aa_perms> &file_perms) vector <aa_perms> &file_perms)
{ {

5
parser/libapparmor_re/chfa.h
View File

@ -40,8 +40,7 @@ class CHFA {
public: public:
CHFA(void); CHFA(void);
CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts, CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
bool permindex); bool permindex, bool prompt);
void dump(ostream & os); void dump(ostream & os);
void flex_table(ostream &os); void flex_table(ostream &os);
void init_free_list(vector<pair<size_t, size_t> > &free_list, void init_free_list(vector<pair<size_t, size_t> > &free_list,
@ -51,7 +50,7 @@ class CHFA {
void insert_state(vector<pair<size_t, size_t> > &free_list, void insert_state(vector<pair<size_t, size_t> > &free_list,
State *state, DFA &dfa); State *state, DFA &dfa);
void weld_file_to_policy(CHFA &file_chfa, size_t &new_start, void weld_file_to_policy(CHFA &file_chfa, size_t &new_start,
bool accept_idx, bool accept_idx, bool prompt,
vector <aa_perms> &policy_perms, vector <aa_perms> &policy_perms,
vector <aa_perms> &file_perms); vector <aa_perms> &file_perms);

13
parser/libapparmor_re/hfa.cc
View File

@ -1308,12 +1308,13 @@ void DFA::apply_equivalence_classes(map<transchar, transchar> &eq)
} }
void DFA::compute_perms_table_ent(State *state, size_t pos, void DFA::compute_perms_table_ent(State *state, size_t pos,
vector <aa_perms> &perms_table) vector <aa_perms> &perms_table,
bool prompt)
{ {
uint32_t accept1, accept2, accept3; uint32_t accept1, accept2, accept3;
// until front end doesn't map the way it does // until front end doesn't map the way it does
state->map_perms_to_accept(accept1, accept2, accept3); state->map_perms_to_accept(accept1, accept2, accept3, prompt);
if (filedfa) { if (filedfa) {
state->idx = pos * 2; state->idx = pos * 2;
perms_table[pos*2] = compute_fperms_user(accept1, accept2, accept3); perms_table[pos*2] = compute_fperms_user(accept1, accept2, accept3);
@ -1324,7 +1325,7 @@ void DFA::compute_perms_table_ent(State *state, size_t pos,
} }
} }
void DFA::compute_perms_table(vector <aa_perms> &perms_table) void DFA::compute_perms_table(vector <aa_perms> &perms_table, bool prompt)
{ {
size_t mult = filedfa ? 2 : 1; size_t mult = filedfa ? 2 : 1;
size_t pos = 2; size_t pos = 2;
@ -1334,13 +1335,13 @@ void DFA::compute_perms_table(vector <aa_perms> &perms_table)
// nonmatching and start need to be 0 and 1 so handle outside of loop // nonmatching and start need to be 0 and 1 so handle outside of loop
if (filedfa) if (filedfa)
compute_perms_table_ent(nonmatching, 0, perms_table); compute_perms_table_ent(nonmatching, 0, perms_table, prompt);
compute_perms_table_ent(start, 1, perms_table); compute_perms_table_ent(start, 1, perms_table, prompt);
for (Partition::iterator i = states.begin(); i != states.end(); i++) { for (Partition::iterator i = states.begin(); i != states.end(); i++) {
if (*i == nonmatching || *i == start) if (*i == nonmatching || *i == start)
continue; continue;
compute_perms_table_ent(*i, pos, perms_table); compute_perms_table_ent(*i, pos, perms_table, prompt);
pos++; pos++;
} }
} }

14
parser/libapparmor_re/hfa.h
View File

@ -34,6 +34,8 @@
#include "expr-tree.h" #include "expr-tree.h"
#include "policy_compat.h" #include "policy_compat.h"
#include "../rule.h"
extern int prompt_compat_mode;
#define DiffEncodeFlag 1 #define DiffEncodeFlag 1
@ -258,9 +260,13 @@ public:
void flatten_relative(State *, int upper_bound); void flatten_relative(State *, int upper_bound);
int apply_and_clear_deny(void) { return perms.apply_and_clear_deny(); } int apply_and_clear_deny(void) { return perms.apply_and_clear_deny(); }
void map_perms_to_accept(uint32_t &accept1, uint32_t &accept2, uint32_t &accept3) void map_perms_to_accept(uint32_t &accept1, uint32_t &accept2,
uint32_t &accept3, bool prompt)
{ {
accept1 = perms.allow; accept1 = perms.allow;
if (prompt && prompt_compat_mode == PROMPT_COMPAT_DEV)
accept2 = PACK_AUDIT_CTL(perms.prompt, perms.quiet & perms.deny);
else
accept2 = PACK_AUDIT_CTL(perms.audit, perms.quiet & perms.deny); accept2 = PACK_AUDIT_CTL(perms.audit, perms.quiet & perms.deny);
accept3 = perms.prompt; accept3 = perms.prompt;
} }
@ -358,8 +364,10 @@ public:
void apply_equivalence_classes(map<transchar, transchar> &eq); void apply_equivalence_classes(map<transchar, transchar> &eq);
void compute_perms_table_ent(State *state, size_t pos, void compute_perms_table_ent(State *state, size_t pos,
vector <aa_perms> &perms_table); vector <aa_perms> &perms_table,
void compute_perms_table(vector <aa_perms> &perms_table); bool prompt);
void compute_perms_table(vector <aa_perms> &perms_table,
bool prompt);
unsigned int diffcount; unsigned int diffcount;
int oob_range; int oob_range;

4
parser/parser.h
View File

@ -324,10 +324,6 @@ do { \
/* The parser fills this variable in automatically */ /* The parser fills this variable in automatically */
#define PROFILE_NAME_VARIABLE "profile_name" #define PROFILE_NAME_VARIABLE "profile_name"
#define PROMPT_COMPAT_IGNORE 0
#define PROMPT_COMPAT_PERMSV2 1
#define PROMPT_COMPAT_DEV 2
#define PROMPT_COMPAT_PERMSV1 3
/* from parser_common.c */ /* from parser_common.c */
extern uint32_t policy_version; extern uint32_t policy_version;

11
parser/parser_regex.c
View File

@ -578,7 +578,7 @@ build:
* *
* we don't need to build xmatch for permstable32, so don't * we don't need to build xmatch for permstable32, so don't
*/ */
prof->xmatch = rules->create_dfablob(&prof->xmatch_size, &prof->xmatch_len, prof->xmatch_perms_table, parseopts, false, kernel_supports_permstable32 && !kernel_supports_permstable32_v1); prof->xmatch = rules->create_dfablob(&prof->xmatch_size, &prof->xmatch_len, prof->xmatch_perms_table, parseopts, false, false, false);
delete rules; delete rules;
if (!prof->xmatch) if (!prof->xmatch)
return FALSE; return FALSE;
@ -785,7 +785,8 @@ int process_profile_regex(Profile *prof)
prof->dfa.dfa = prof->dfa.rules->create_dfablob(&prof->dfa.size, prof->dfa.dfa = prof->dfa.rules->create_dfablob(&prof->dfa.size,
&xmatch_len, prof->dfa.perms_table, &xmatch_len, prof->dfa.perms_table,
parseopts, true, parseopts, true,
prof->uses_prompt_rules && kernel_supports_permstable32); prof->uses_prompt_rules && kernel_supports_permstable32,
prof->uses_prompt_rules);
delete prof->dfa.rules; delete prof->dfa.rules;
prof->dfa.rules = NULL; prof->dfa.rules = NULL;
if (!prof->dfa.dfa) if (!prof->dfa.dfa)
@ -1149,7 +1150,8 @@ int process_profile_policydb(Profile *prof)
&xmatch_len, &xmatch_len,
&prof->policy.file_start, &prof->policy.file_start,
prof->policy.perms_table, parseopts, prof->policy.perms_table, parseopts,
kernel_supports_permstable32_v1); kernel_supports_permstable32_v1,
prof->uses_prompt_rules);
delete prof->policy.rules; delete prof->policy.rules;
delete prof->dfa.rules; delete prof->dfa.rules;
prof->policy.rules = NULL; prof->policy.rules = NULL;
@ -1165,7 +1167,8 @@ int process_profile_policydb(Profile *prof)
&xmatch_len, &xmatch_len,
prof->policy.perms_table, prof->policy.perms_table,
parseopts, false, parseopts, false,
prof->uses_prompt_rules && kernel_supports_permstable32); prof->uses_prompt_rules && kernel_supports_permstable32,
prof->uses_prompt_rules);
delete prof->policy.rules; delete prof->policy.rules;
prof->policy.rules = NULL; prof->policy.rules = NULL;

6
parser/rule.h
View File

@ -27,6 +27,12 @@
using namespace std; using namespace std;
#define PROMPT_COMPAT_IGNORE 0
#define PROMPT_COMPAT_PERMSV2 1
#define PROMPT_COMPAT_DEV 2
#define PROMPT_COMPAT_PERMSV1 3
class Profile; class Profile;
#define RULE_NOT_SUPPORTED 0 #define RULE_NOT_SUPPORTED 0