public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: add support for profiles to define the kill signal

Browse source 
Previously apparmor has only sent SIGKILL but there are cases where
it can be useful to send a different signal. Allow the profile
to optionally specify a different value.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2023-08-21 16:54:58 -07:00
parent 2e12c5f060
commit 84c455decf
8 changed files with 34 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
security/apparmor/apparmorfs.c
View file

@ -2342,6 +2342,7 @@ static struct aa_sfs_entry aa_sfs_entry_domain[] = {
AA_SFS_FILE_BOOLEAN("computed_longest_left", 1),
AA_SFS_DIR("attach_conditions", aa_sfs_entry_attach),
AA_SFS_FILE_BOOLEAN("disconnected.path", 1),
AA_SFS_FILE_BOOLEAN("kill.signal", 1),
AA_SFS_FILE_STRING("version", "1.2"),
{ }
};

2
security/apparmor/audit.c
View file

@ -192,7 +192,7 @@ int aa_audit(int type, struct aa_profile *profile,
aa_audit_msg(type, ad, cb);
if (ad->type == AUDIT_APPARMOR_KILL)
(void)send_sig_info(SIGKILL, NULL,
(void)send_sig_info(profile->signal, NULL,
ad->common.type == LSM_AUDIT_DATA_TASK &&
ad->common.u.tsk ? ad->common.u.tsk : current);

3
security/apparmor/include/ipc.h
View file

@ -13,6 +13,9 @@
#include <linux/sched.h>
#define SIGUNKNOWN 0
#define MAXMAPPED_SIG 35
int aa_may_signal(const struct cred *subj_cred, struct aa_label *sender,
const struct cred *target_cred, struct aa_label *target,
int sig);

1
security/apparmor/include/policy.h
View file

@ -236,6 +236,7 @@ struct aa_profile {
enum audit_mode audit;
long mode;
u32 path_flags;
int signal;
const char *disconnected;
struct aa_attachment attach;

6
security/apparmor/include/sig_names.h
View file

@ -1,9 +1,5 @@
#include <linux/signal.h>
#define SIGUNKNOWN 0
#define MAXMAPPED_SIG 35
#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1)
#define SIGRT_BASE 128
#include "signal.h"
/* provide a mapping of arch signal to internal signal # for mediation
* those that are always an alias SIGCLD for SIGCLHD and SIGPOLL for SIGIO

19
security/apparmor/include/signal.h Normal file
View file

@ -0,0 +1,19 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
* AppArmor security module
*
* This file contains AppArmor ipc mediation function definitions.
*
* Copyright 2023 Canonical Ltd.
*/
#ifndef __AA_SIGNAL_H
#define __AA_SIGNAL_H
#define SIGUNKNOWN 0
#define MAXMAPPED_SIG 35
#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1)
#define SIGRT_BASE 128
#endif /* __AA_SIGNAL_H */

1
security/apparmor/policy.c
View file

@ -364,6 +364,7 @@ struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,
profile->label.flags |= FLAG_PROFILE;
profile->label.vec[0] = profile;
profile->signal = SIGKILL;
/* refcount released by caller */
return profile;

7
security/apparmor/policy_unpack.c
View file

@ -29,6 +29,7 @@
#include "include/policy.h"
#include "include/policy_unpack.h"
#include "include/policy_compat.h"
#include "include/signal.h"
/* audit callback for unpack fields */
static void audit_cb(struct audit_buffer *ab, void *va)
@ -916,6 +917,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
(void) aa_unpack_strdup(e, &disconnected, "disconnected");
profile->disconnected = disconnected;
/* optional */
(void) aa_unpack_u32(e, &profile->signal, "kill");
if (profile->signal < 1 && profile->signal > MAXMAPPED_SIG) {
info = "profile kill.signal invalid value";
goto fail;
}
/* per profile debug flags (complain, audit) */
if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
info = "profile missing flags";