Unverified Commit 3cee6079 authored by Christian Brauner's avatar Christian Brauner
Browse files

apparmor: handle idmapped mounts 

The i_uid and i_gid are mostly used when logging for AppArmor. This is
broken in a bunch of places where the global root id is reported instead
of the i_uid or i_gid of the file. Nonetheless, be kind and log the
mapped inode if we're coming from an idmapped mount. If the initial user
namespace is passed nothing changes so non-idmapped mounts will see
identical behavior as before.

Link: https://lore.kernel.org/r/20210121131959.646623-26-christian.brauner@ubuntu.com


Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 549c7297

security/apparmor/domain.c

+6 −3
Original line number Diff line number Diff line
@@ -10,12 +10,14 @@ 


#include <linux/errno.h>

#include <linux/fdtable.h>

#include <linux/fs.h>

#include <linux/file.h>

#include <linux/mount.h>

#include <linux/syscalls.h>

#include <linux/tracehook.h>

#include <linux/personality.h>

#include <linux/xattr.h>

#include <linux/user_namespace.h>



#include "include/audit.h"

#include "include/apparmorfs.h"
@@ -858,8 +860,10 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm) 
	const char *info = NULL;

	int error = 0;

	bool unsafe = false;

	kuid_t i_uid = i_uid_into_mnt(file_mnt_user_ns(bprm->file),

				      file_inode(bprm->file));

	struct path_cond cond = {

		file_inode(bprm->file)->i_uid,

		i_uid,

		file_inode(bprm->file)->i_mode

	};
@@ -967,8 +971,7 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm) 
	error = fn_for_each(label, profile,

			aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,

				      bprm->filename, NULL, new,

				      file_inode(bprm->file)->i_uid, info,

				      error));

				      i_uid, info, error));

	aa_put_label(new);

	goto done;

}

security/apparmor/file.c

+3 −1
Original line number Diff line number Diff line
@@ -11,6 +11,8 @@ 
#include <linux/tty.h>

#include <linux/fdtable.h>

#include <linux/file.h>

#include <linux/fs.h>

#include <linux/mount.h>



#include "include/apparmor.h"

#include "include/audit.h"
@@ -509,7 +511,7 @@ static int __file_path_perm(const char *op, struct aa_label *label, 
	struct aa_profile *profile;

	struct aa_perms perms = {};

	struct path_cond cond = {

		.uid = file_inode(file)->i_uid,

		.uid = i_uid_into_mnt(file_mnt_user_ns(file), file_inode(file)),

		.mode = file_inode(file)->i_mode

	};

	char *buffer;

security/apparmor/lsm.c

+15 −6
Original line number Diff line number Diff line
@@ -224,7 +224,9 @@ static int common_perm(const char *op, const struct path *path, u32 mask, 
 */

static int common_perm_cond(const char *op, const struct path *path, u32 mask)

{

	struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,

	struct user_namespace *mnt_userns = mnt_user_ns(path->mnt);

	struct path_cond cond = {

		i_uid_into_mnt(mnt_userns, d_backing_inode(path->dentry)),

		d_backing_inode(path->dentry)->i_mode

	};
@@ -266,12 +268,13 @@ static int common_perm_rm(const char *op, const struct path *dir, 
			  struct dentry *dentry, u32 mask)

{

	struct inode *inode = d_backing_inode(dentry);

	struct user_namespace *mnt_userns = mnt_user_ns(dir->mnt);

	struct path_cond cond = { };



	if (!inode || !path_mediated_fs(dentry))

		return 0;



	cond.uid = inode->i_uid;

	cond.uid = i_uid_into_mnt(mnt_userns, inode);

	cond.mode = inode->i_mode;



	return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
@@ -361,11 +364,13 @@ static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_d 


	label = begin_current_label_crit_section();

	if (!unconfined(label)) {

		struct user_namespace *mnt_userns = mnt_user_ns(old_dir->mnt);

		struct path old_path = { .mnt = old_dir->mnt,

					 .dentry = old_dentry };

		struct path new_path = { .mnt = new_dir->mnt,

					 .dentry = new_dentry };

		struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,

		struct path_cond cond = {

			i_uid_into_mnt(mnt_userns, d_backing_inode(old_dentry)),

			d_backing_inode(old_dentry)->i_mode

		};
@@ -420,8 +425,12 @@ static int apparmor_file_open(struct file *file) 


	label = aa_get_newest_cred_label(file->f_cred);

	if (!unconfined(label)) {

		struct user_namespace *mnt_userns = file_mnt_user_ns(file);

		struct inode *inode = file_inode(file);

		struct path_cond cond = { inode->i_uid, inode->i_mode };

		struct path_cond cond = {

			i_uid_into_mnt(mnt_userns, inode),

			inode->i_mode

		};



		error = aa_path_perm(OP_OPEN, label, &file->f_path, 0,

				     aa_map_file_to_perms(file), &cond);