From patchwork Mon Apr 8 16:07:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10889803 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 93A031708 for ; Mon, 8 Apr 2019 16:07:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 77F2B286E2 for ; Mon, 8 Apr 2019 16:07:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 67138286E6; Mon, 8 Apr 2019 16:07:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F0546286E2 for ; Mon, 8 Apr 2019 16:07:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726620AbfDHQHJ (ORCPT ); Mon, 8 Apr 2019 12:07:09 -0400 Received: from mail-pg1-f193.google.com ([209.85.215.193]:41782 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726544AbfDHQHJ (ORCPT ); Mon, 8 Apr 2019 12:07:09 -0400 Received: by mail-pg1-f193.google.com with SMTP id f6so7581921pgs.8 for ; Mon, 08 Apr 2019 09:07:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=TCLGovzegw701/u4c+RSrYN+SJq+Buy7ekNIjiUF7iE=; b=cKVLwp5sjVO3yDLjmDytFvAVPNES9IV5smEidd9Dv+mM0QcVpWWHI3nF+xKCvEY57I VC9dYpNiZklSKd8VMOX+831rRJQcmNdsRBfyu6nAwckQJZF0rNnpexRxYQx+xy/oCinC wcY/Gh+Zp+acbo10+hQwTFuBGmw4gafJrBDZ4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=TCLGovzegw701/u4c+RSrYN+SJq+Buy7ekNIjiUF7iE=; b=pNwAuONV9KFx+Yjf62j24Jlka8csShf8ZB1iCnebF+1iK1wPrqW6tcjwDzCdkS5tNQ +0bdOEiV9OWNfPRcn3P2zaSxpaqh0rPKo64GoayRtKwmSbcep5U3DLeQLB4ba8ZkIQHA puiWEEf4Lij6dwDuWV5qcT4mfsZZabcsSefvRrn18g4xi1I+x8Tn7rVpSt0dmJsyJO0N SJugB+l3vG5Gui92bT/cUywyUiE4DWP2q1JIgK5cAPUsIkqQuBgAWezNwXe4HKWmRric djT8ovxn/oGs5J1zKQZs3g2EUt4sN5jD8lSe42dwuHQK23GjwSbtTNjGSLrMDAN6SMXn LRXg== X-Gm-Message-State: APjAAAWNrErs3ClLmpfNGdwzQJJiXHdnw1FGoF/Tzci9285glepQMazL EIJDavFO8hPnjKxyPdves+FgCw== X-Google-Smtp-Source: APXvYqxb6q7VwwjBHoiQ4mPiJKKDVAgFOwj3jEDSgduZAHBnpeX5be1MSsDDDANk7YBLsq/8b4hjrQ== X-Received: by 2002:a63:7444:: with SMTP id e4mr29603061pgn.261.1554739628321; Mon, 08 Apr 2019 09:07:08 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id u5sm3105935pfa.169.2019.04.08.09.07.06 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 08 Apr 2019 09:07:07 -0700 (PDT) Date: Mon, 8 Apr 2019 09:07:06 -0700 From: Kees Cook To: James Morris , John Johansen Cc: David Rheinsberg , "Serge E. Hallyn" , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] apparmor: Restore Y/N in /sys for apparmor's "enabled" Message-ID: <20190408160706.GA18786@beast> MIME-Version: 1.0 Content-Disposition: inline Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Before commit c5459b829b71 ("LSM: Plumb visibility into optional "enabled" state"), /sys/module/apparmor/parameters/enabled would show "Y" or "N" since it was using the "bool" handler. After being changed to "int", this switched to "1" or "0", breaking the userspace AppArmor detection of dbus-broker. This restores the Y/N output while keeping the LSM infrastructure happy. Before: $ cat /sys/module/apparmor/parameters/enabled 1 After: $ cat /sys/module/apparmor/parameters/enabled Y Reported-by: David Rheinsberg Link: https://lkml.kernel.org/r/CADyDSO6k8vYb1eryT4g6+EHrLCvb68GAbHVWuULkYjcZcYNhhw@mail.gmail.com Fixes: c5459b829b71 ("LSM: Plumb visibility into optional "enabled" state") Signed-off-by: Kees Cook Reviewed-by: David Rheinsberg --- This fix, if John is okay with it, is needed in v5.1 to correct the userspace regression reported by David. --- security/apparmor/lsm.c | 49 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 1 deletion(-) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 49d664ddff44..87500bde5a92 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1336,9 +1336,16 @@ module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); bool aa_g_paranoid_load = true; module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO); +static int param_get_aaintbool(char *buffer, const struct kernel_param *kp); +static int param_set_aaintbool(const char *val, const struct kernel_param *kp); +#define param_check_aaintbool param_check_int +static const struct kernel_param_ops param_ops_aaintbool = { + .set = param_set_aaintbool, + .get = param_get_aaintbool +}; /* Boot time disable flag */ static int apparmor_enabled __lsm_ro_after_init = 1; -module_param_named(enabled, apparmor_enabled, int, 0444); +module_param_named(enabled, apparmor_enabled, aaintbool, 0444); static int __init apparmor_enabled_setup(char *str) { @@ -1413,6 +1420,46 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp) return param_get_uint(buffer, kp); } +/* Can only be set before AppArmor is initialized (i.e. on boot cmdline). */ +static int param_set_aaintbool(const char *val, const struct kernel_param *kp) +{ + struct kernel_param kp_local; + bool value; + int error; + + if (apparmor_initialized) + return -EPERM; + + /* Create local copy, with arg pointing to bool type. */ + value = !!*((int *)kp->arg); + memcpy(&kp_local, kp, sizeof(kp_local)); + kp_local.arg = &value; + + error = param_set_bool(val, &kp_local); + if (!error) + *((int *)kp->arg) = *((bool *)kp_local.arg); + return error; +} + +/* + * To avoid changing /sys/module/apparmor/parameters/enabled from Y/N to + * 1/0, this converts the "int that is actually bool" back to bool for + * display in the /sys filesystem, while keeping it "int" for the LSM + * infrastructure. + */ +static int param_get_aaintbool(char *buffer, const struct kernel_param *kp) +{ + struct kernel_param kp_local; + bool value; + + /* Create local copy, with arg pointing to bool type. */ + value = !!*((int *)kp->arg); + memcpy(&kp_local, kp, sizeof(kp_local)); + kp_local.arg = &value; + + return param_get_bool(buffer, &kp_local); +} + static int param_get_audit(char *buffer, const struct kernel_param *kp) { if (!apparmor_enabled)