apparmor: add an optional profile attachment string for profiles

Add the ability to take in and report a human readable profile attachment
string for profiles so that attachment specifications can be easily
inspected.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 0fdd08c6ea5920e9e7e1524b3a80107464565776..d6329aa7aa982bd67c9c3a39cc042e3d503700fe 100644 (file)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -290,6 +290,34 @@ static const struct file_operations aa_fs_profmode_fops = {
        .release        = aa_fs_seq_profile_release,
 };
 
+static int aa_fs_seq_profattach_show(struct seq_file *seq, void *v)
+{
+       struct aa_replacedby *r = seq->private;
+       struct aa_profile *profile = aa_get_profile_rcu(&r->profile);
+       if (profile->attach)
+               seq_printf(seq, "%s\n", profile->attach);
+       else if (profile->xmatch)
+               seq_puts(seq, "<unknown>\n");
+       else
+               seq_printf(seq, "%s\n", profile->base.name);
+       aa_put_profile(profile);
+
+       return 0;
+}
+
+static int aa_fs_seq_profattach_open(struct inode *inode, struct file *file)
+{
+       return aa_fs_seq_profile_open(inode, file, aa_fs_seq_profattach_show);
+}
+
+static const struct file_operations aa_fs_profattach_fops = {
+       .owner          = THIS_MODULE,
+       .open           = aa_fs_seq_profattach_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = aa_fs_seq_profile_release,
+};
+
 /** fns to setup dynamic per profile/namespace files **/
 void __aa_fs_profile_rmdir(struct aa_profile *profile)
 {
@@ -385,6 +413,12 @@ int __aa_fs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
                goto fail;
        profile->dents[AAFS_PROF_MODE] = dent;
 
+       dent = create_profile_file(dir, "attach", profile,
+                                  &aa_fs_profattach_fops);
+       if (IS_ERR(dent))
+               goto fail;
+       profile->dents[AAFS_PROF_ATTACH] = dent;
+
        list_for_each_entry(child, &profile->base.profiles, base.list) {
                error = __aa_fs_profile_mkdir(child, prof_child_dir(profile));
                if (error)

diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
index 2494e112f2bf9b4c60c0f0a281f9ba3c2bbd70f4..f91712cf1b306a18e766c97fe57143775756e79f 100644 (file)
--- a/security/apparmor/include/apparmorfs.h
+++ b/security/apparmor/include/apparmorfs.h
@@ -81,6 +81,7 @@ enum aafs_prof_type {
        AAFS_PROF_PROFS,
        AAFS_PROF_NAME,
        AAFS_PROF_MODE,
+       AAFS_PROF_ATTACH,
        AAFS_PROF_SIZEOF,
 };
 

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 5c72231d1c4268d0a8aa2525a55530b07849a514..59b36372ae4007858052b5a0a514617b204d0c4c 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -165,6 +165,7 @@ struct aa_replacedby {
  * @ns: namespace the profile is in
  * @replacedby: is set to the profile that replaced this profile
  * @rename: optional profile name that this profile renamed
+ * @attach: human readable attachment string
  * @xmatch: optional extended matching for unconfined executables names
  * @xmatch_len: xmatch prefix len, used to determine xmatch priority
  * @audit: the auditing mode of the profile
@@ -204,6 +205,7 @@ struct aa_profile {
        struct aa_replacedby *replacedby;
        const char *rename;
 
+       const char *attach;
        struct aa_dfa *xmatch;
        int xmatch_len;
        enum audit_mode audit;

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index cac0aa0757879e7e7516b1dc5a1b8bd5e5ef3715..bdaef2e1b2a0f395bfd440c68fef68dfcc232255 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -492,6 +492,9 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
        /* profile renaming is optional */
        (void) unpack_str(e, &profile->rename, "rename");
 
+       /* attachment string is optional */
+       (void) unpack_str(e, &profile->attach, "attach");
+
        /* xmatch is optional and may be NULL */
        profile->xmatch = unpack_dfa(e);
        if (IS_ERR(profile->xmatch)) {