mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
c05e705812
Extend af_unix mediation to support fine grained controls based on
the type (abstract, anonymous, fs), the address, and the labeling
on the socket.
This allows for using socket addresses to label and the socket and
control which subjects can communicate.
The unix rule format follows standard apparmor rules except that fs
based unix sockets can be mediated by existing file rules. None fs
unix sockets can be mediated by a unix socket rule. Where The address
of an abstract unix domain socket begins with the @ character, similar
to how they are reported (as paths) by netstat -x. The address then
follows and may contain pattern matching and any characters including
the null character. In apparmor null characters must be specified by
using an escape sequence \000 or \x00. The pattern matching is the
same as is used by file path matching so * will not match / even
though it has no special meaning with in an abstract socket name. Eg.
allow unix addr=@*,
Autobound unix domain sockets have a unix sun_path assigned to them by
the kernel, as such specifying a policy based address is not possible.
The autobinding of sockets can be controlled by specifying the special
auto keyword. Eg.
allow unix addr=auto,
To indicate that the rule only applies to auto binding of unix domain
sockets. It is important to note this only applies to the bind
permission as once the socket is bound to an address it is
indistinguishable from a socket that have an addr bound with a
specified name. When the auto keyword is used with other permissions
or as part of a peer addr it will be replaced with a pattern that can
match an autobound socket. Eg. For some kernels
allow unix rw addr=auto,
It is important to note, this pattern may match abstract sockets that
were not autobound but have an addr that fits what is generated by the
kernel when autobinding a socket.
Anonymous unix domain sockets have no sun_path associated with the
socket address, however it can be specified with the special none
keyword to indicate the rule only applies to anonymous unix domain
sockets. Eg.
allow unix addr=none,
If the address component of a rule is not specified then the rule
applies to autobind, abstract and anonymous sockets.
The label on the socket can be compared using the standard label=
rule conditional. Eg.
allow unix addr=@foo peer=(label=bar),
see man apparmor.d for full syntax description.
Signed-off-by: John Johansen <john.johansen@canonical.com>
68 lines
1.7 KiB
C
68 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* AppArmor security module
|
|
*
|
|
* This file contains AppArmor basic global
|
|
*
|
|
* Copyright (C) 1998-2008 Novell/SUSE
|
|
* Copyright 2009-2017 Canonical Ltd.
|
|
*/
|
|
|
|
#ifndef __APPARMOR_H
|
|
#define __APPARMOR_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* Class of mediation types in the AppArmor policy db
|
|
*/
|
|
#define AA_CLASS_NONE 0
|
|
#define AA_CLASS_UNKNOWN 1
|
|
#define AA_CLASS_FILE 2
|
|
#define AA_CLASS_CAP 3
|
|
#define AA_CLASS_DEPRECATED 4
|
|
#define AA_CLASS_RLIMITS 5
|
|
#define AA_CLASS_DOMAIN 6
|
|
#define AA_CLASS_MOUNT 7
|
|
#define AA_CLASS_PTRACE 9
|
|
#define AA_CLASS_SIGNAL 10
|
|
#define AA_CLASS_XMATCH 11
|
|
#define AA_CLASS_NET 14
|
|
#define AA_CLASS_NETV9 15
|
|
#define AA_CLASS_LABEL 16
|
|
#define AA_CLASS_POSIX_MQUEUE 17
|
|
#define AA_CLASS_MODULE 19
|
|
#define AA_CLASS_DISPLAY_LSM 20
|
|
#define AA_CLASS_NS 21
|
|
#define AA_CLASS_IO_URING 22
|
|
|
|
#define AA_CLASS_X 31
|
|
#define AA_CLASS_DBUS 32
|
|
|
|
/* NOTE: if AA_CLASS_LAST > 63 need to update label->mediates */
|
|
#define AA_CLASS_LAST AA_CLASS_DBUS
|
|
|
|
/* Control parameters settable through module/boot flags */
|
|
extern enum audit_mode aa_g_audit;
|
|
extern bool aa_g_audit_header;
|
|
extern int aa_g_debug;
|
|
extern bool aa_g_hash_policy;
|
|
extern bool aa_g_export_binary;
|
|
extern int aa_g_rawdata_compression_level;
|
|
extern bool aa_g_lock_policy;
|
|
extern bool aa_g_logsyscall;
|
|
extern bool aa_g_paranoid_load;
|
|
extern unsigned int aa_g_path_max;
|
|
|
|
#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
|
|
#define AA_MIN_CLEVEL zstd_min_clevel()
|
|
#define AA_MAX_CLEVEL zstd_max_clevel()
|
|
#define AA_DEFAULT_CLEVEL ZSTD_CLEVEL_DEFAULT
|
|
#else
|
|
#define AA_MIN_CLEVEL 0
|
|
#define AA_MAX_CLEVEL 0
|
|
#define AA_DEFAULT_CLEVEL 0
|
|
#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY */
|
|
|
|
|
|
#endif /* __APPARMOR_H */
|