mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-02 07:15:18 +00:00
Code Issues Releases Wiki Activity

[6/7] parser: update the parser to add interface rules for change_X

Browse Source 
For change_hat and change_profile instead of a single interface
rule we need to add some readonly interfaces for discovery and
the new and old proc interface for writing.

Consolidate into a single shared routine.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/150
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/713
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2021-03-16 14:02:26 -07:00
parent 35e58273e6
commit c60fc809a9
1 changed files with 54 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
parser/parser_policy.c
View File

@@ -29,6 +29,7 @@
#include <errno.h> #include <errno.h>
#include <sys/apparmor.h> #include <sys/apparmor.h>
#include "lib.h"
#include "parser.h" #include "parser.h"
#include "profile.h" #include "profile.h"
#include "parser_yacc.h" #include "parser_yacc.h"
@@ -145,6 +146,56 @@ void add_entry_to_policy(Profile *prof, struct cod_entry *entry)
prof->entries = entry; prof->entries = entry;
} }
static bool add_proc_access(Profile *prof, const char *rule)
{
/* FIXME: should use @{PROC}/@{PID}/attr/{apparmor/,}{current,exec} */
struct cod_entry *new_ent;
/* allow probe for new interfaces */
char *buffer = strdup("/proc/*/attr/apparmor/");
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
}
add_entry_to_policy(prof, new_ent);
/* allow probe if apparmor is enabled for the old interface */
buffer = strdup("/sys/module/apparmor/parameters/enabled");
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
}
add_entry_to_policy(prof, new_ent);
/* allow setting on new and old interfaces */
buffer = strdup(rule);
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_WRITE, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
}
add_entry_to_policy(prof, new_ent);
return TRUE;
}
#define CHANGEPROFILE_PATH "/proc/*/attr/{apparmor/,}{current,exec}"
void post_process_file_entries(Profile *prof) void post_process_file_entries(Profile *prof)
{ {
struct cod_entry *entry; struct cod_entry *entry;
@@ -170,22 +221,11 @@ void post_process_file_entries(Profile *prof)
} }
/* if there are change_profile rules, this implies that we need /* if there are change_profile rules, this implies that we need
* access to /proc/self/attr/current * access to some /proc/ interfaces
*/ */
if (cp_mode & AA_CHANGE_PROFILE) { if (cp_mode & AA_CHANGE_PROFILE) {
/* FIXME: should use @{PROC}/@{PID}/attr/{apparmor/,}{current,exec} */ if (!add_proc_access(prof, CHANGEPROFILE_PATH))
struct cod_entry *new_ent;
char *buffer = strdup("/proc/*/attr/{apparmor/,}{current,exec}");
if (!buffer) {
PERROR("Memory allocation error\n");
exit(1); exit(1);
}
new_ent = new_entry(buffer, AA_MAY_WRITE, NULL);
if (!new_ent) {
PERROR("Memory allocation error\n");
exit(1);
}
add_entry_to_policy(prof, new_ent);
} }
} }
@@ -202,19 +242,13 @@ void post_process_rule_entries(Profile *prof)
*/ */
static int profile_add_hat_rules(Profile *prof) static int profile_add_hat_rules(Profile *prof)
{ {
struct cod_entry *entry;
/* don't add hat rules if not hat or profile doesn't have hats */ /* don't add hat rules if not hat or profile doesn't have hats */
if (!prof->flags.hat && prof->hat_table.empty()) if (!prof->flags.hat && prof->hat_table.empty())
return 0; return 0;
/* add entry to hat */ if (!add_proc_access(prof, CHANGEHAT_PATH))
entry = new_entry(strdup(CHANGEHAT_PATH), AA_MAY_WRITE, NULL);
if (!entry)
return ENOMEM; return ENOMEM;
add_entry_to_policy(prof, entry);
return 0; return 0;
} }