[apparmor] [patch 11/24] Add tag indicating file policy is mediated.

[john.johansen at canonical.com]

Tag start of entries in the policydb as being mediated. This makes
the start state for any class being mediated be none 0. The kernel
can detect this to determine whether the parser expected mediation
for the class.

This is just a way of encoding what features expect mediation within
the policydb it self so that a separate table isn't needed.

This is also used to indicate the new unix semantics for mediation of
unix domain sockets on connect should be applied.

Note: this does cause a fail open on situation on Ubuntu Saucy, which
did not properly indicate support. That is if a kernel using this patch
is installed on an Ubuntu Saucy system, unix domain socket mediation
on connect won't happen, instead the older behavior will be applied.
This won't cause policy failures as it is less strict than what
Ubuntu Saucy applies.

This is necessary so that AppArmor can properly function on older
userspaces without a compile time configuration on the kernel to determine
behavior. A kernel expecting this behavior will function correctly
with all old userspaces expect it will not enforce connect time mediation
on Ubuntu Saucy. However Ubuntu does not support Trusty (or newer)
kernels as backports to Saucy, so this does not break them.

Signed-off-by: John Johansen <john.johansen at canonical.com>
---
 parser/parser.h           |    2 ++
 parser/parser_common.c    |    2 ++
 parser/parser_interface.c |    3 +--
 parser/parser_main.c      |    4 ++++
 parser/parser_regex.c     |    5 +++++
 5 files changed, 14 insertions(+), 2 deletions(-)

--- 2.9-test.orig/parser/parser.h
+++ 2.9-test/parser/parser.h
@@ -257,7 +257,9 @@
 extern int perms_create;
 extern int net_af_max_override;
 extern int kernel_load;
+extern int kernel_policy_version;
 extern int kernel_supports_network;
+extern int kernel_supports_policydb;
 extern int kernel_supports_mount;
 extern int kernel_supports_dbus;
 extern int conf_verbose;
--- 2.9-test.orig/parser/parser_common.c
+++ 2.9-test/parser/parser_common.c
@@ -25,7 +25,9 @@
 int perms_create = 0;                   /* perms contain create flag */
 int net_af_max_override = -1;           /* use kernel to determine af_max */
 int kernel_load = 1;
+int kernel_policy_version = 5;		/* default to base version */
 int kernel_supports_network = 0;        /* kernel supports network rules */
+int kernel_supports_policydb = 0;	/* kernel supports new policydb */
 int kernel_supports_mount = 0;	        /* kernel supports mount rules */
 int kernel_supports_dbus = 0;		/* kernel supports dbus rules */
 int conf_verbose = 0;
--- 2.9-test.orig/parser/parser_interface.c
+++ 2.9-test/parser/parser_interface.c
@@ -61,7 +61,6 @@
 #define SD_CODE_SIZE (sizeof(u8))
 #define SD_STR_LEN (sizeof(u16))
 
-#define SUBDOMAIN_INTERFACE_DFA_VERSION 5
 
 int __sd_serialize_profile(int option, Profile *prof);
 
@@ -683,7 +682,7 @@
 {
 	int version;
 
-	version = SUBDOMAIN_INTERFACE_DFA_VERSION;
+	version = kernel_policy_version;
 
 	if (!sd_write_name(p, "version"))
 		return 0;
--- 2.9-test.orig/parser/parser_main.c
+++ 2.9-test/parser/parser_main.c
@@ -838,6 +838,10 @@
 	perms_create = 1;
 
 	/* TODO: make this real parsing and config setting */
+	if (strstr(features_string, "file {"))	/* pre policydb is file= */
+		kernel_supports_policydb = 1;
+	if (strstr(features_string, "v6"))
+		kernel_policy_version = 6;
 	if (strstr(features_string, "network"))
 		kernel_supports_network = 1;
 	if (strstr(features_string, "mount"))
--- 2.9-test.orig/parser/parser_regex.c
+++ 2.9-test/parser/parser_regex.c
@@ -672,6 +672,7 @@
 #define MAKE_STR(X) #X
 #define CLASS_STR(X) "\\d" MAKE_STR(X)
 
+static const char *mediates_file = CLASS_STR(AA_CLASS_FILE);
 static const char *mediates_mount = CLASS_STR(AA_CLASS_MOUNT);
 static const char *mediates_dbus =  CLASS_STR(AA_CLASS_DBUS);
 
@@ -690,6 +691,10 @@
 	 * to be supported
 	 */
 
+	/* note: this activates unix domain sockets mediation on connect */
+	if (kernel_policy_version > 5 &&
+	    !prof->policy.rules->add_rule(mediates_file, 0, AA_MAY_READ, 0, dfaflags))
+		goto out;
 	if (kernel_supports_mount &&
 	    !prof->policy.rules->add_rule(mediates_mount, 0, AA_MAY_READ, 0, dfaflags))
 			goto out;