Commit 58acf9d9 authored by John Johansen's avatar John Johansen
Browse files

apparmor: fix module parameters can be changed after policy is locked 



the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 5f20fdfe

security/apparmor/include/policy.h

+2 −0
Original line number Diff line number Diff line
@@ -403,6 +403,8 @@ static inline int AUDIT_MODE(struct aa_profile *profile) 
	return profile->audit;

}



bool policy_view_capable(void);

bool policy_admin_capable(void);

bool aa_may_manage_policy(int op);



#endif /* __AA_POLICY_H */

security/apparmor/lsm.c

+10 −12
Original line number Diff line number Diff line
@@ -730,51 +730,49 @@ __setup("apparmor=", apparmor_enabled_setup); 
/* set global flag turning off the ability to load policy */

static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;

	if (aa_g_lock_policy)

		return -EACCES;

	return param_set_bool(val, kp);

}



static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_view_capable())

		return -EPERM;

	return param_get_bool(buffer, kp);

}



static int param_set_aabool(const char *val, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;

	return param_set_bool(val, kp);

}



static int param_get_aabool(char *buffer, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_view_capable())

		return -EPERM;

	return param_get_bool(buffer, kp);

}



static int param_set_aauint(const char *val, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;

	return param_set_uint(val, kp);

}



static int param_get_aauint(char *buffer, const struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_view_capable())

		return -EPERM;

	return param_get_uint(buffer, kp);

}



static int param_get_audit(char *buffer, struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_view_capable())

		return -EPERM;



	if (!apparmor_enabled)
@@ -786,7 +784,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp) 
static int param_set_audit(const char *val, struct kernel_param *kp)

{

	int i;

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;



	if (!apparmor_enabled)
@@ -807,7 +805,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp) 


static int param_get_mode(char *buffer, struct kernel_param *kp)

{

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;



	if (!apparmor_enabled)
@@ -819,7 +817,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp) 
static int param_set_mode(const char *val, struct kernel_param *kp)

{

	int i;

	if (!capable(CAP_MAC_ADMIN))

	if (!policy_admin_capable())

		return -EPERM;



	if (!apparmor_enabled)

security/apparmor/policy.c

+17 −1
Original line number Diff line number Diff line
@@ -918,6 +918,22 @@ static int audit_policy(int op, gfp_t gfp, const char *name, const char *info, 
			&sa, NULL);

}



bool policy_view_capable(void)

{

	struct user_namespace *user_ns = current_user_ns();

	bool response = false;



	if (ns_capable(user_ns, CAP_MAC_ADMIN))

		response = true;



	return response;

}



bool policy_admin_capable(void)

{

	return policy_view_capable() && !aa_g_lock_policy;

}



/**

 * aa_may_manage_policy - can the current task manage policy

 * @op: the policy manipulation operation being done
@@ -932,7 +948,7 @@ bool aa_may_manage_policy(int op) 
		return 0;

	}



	if (!capable(CAP_MAC_ADMIN)) {

	if (!policy_admin_capable()) {

		audit_policy(op, GFP_KERNEL, NULL, "not policy admin", -EACCES);

		return 0;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE