Merge lp:~kees/procenv/add-apparmor into lp:procenv

[Kees Cook]

  Add support for AppArmor

  This fixes the name of the LSM context (it is not exclusive to SELinux),
  and attempts to report the name of the running LSM.

  (Also cleans up whitespace in src/Makefile.am and adds missing mkdir in
  reconf.)

[lp:~kees/procenv/add-apparmor]

12. By Kees Cook on 2012-10-30

Add missing capabilities details

This adds the securebits and KEEPCAPS settings to the capabilities report.

=== modified file 'Makefile.am'
--- Makefile.am	2012-10-26 19:52:13 +0000
+++ Makefile.am	2012-10-30 18:58:19 +0000
@@ -3,4 +3,4 @@
 
 ACLOCAL_AMFLAGS = -I m4
 
-EXTRA_DIST = m4/ChangeLog man/procenv.1 
+EXTRA_DIST = m4/ChangeLog man/procenv.1

=== modified file 'configure.ac'
--- configure.ac	2012-10-27 19:28:51 +0000
+++ configure.ac	2012-10-30 18:58:19 +0000
@@ -39,6 +39,9 @@
 AC_SEARCH_LIBS([getpidcon], [selinux], [HAVE_SELINUX=true])
 AM_CONDITIONAL([HAVE_SELINUX], [test x$HAVE_SELINUX = xtrue])
 
+AC_SEARCH_LIBS([aa_gettaskcon], [apparmor], [HAVE_APPARMOR=true])
+AM_CONDITIONAL([HAVE_APPARMOR], [test x$HAVE_APPARMOR = xtrue])
+
 # Other checks
 
 AM_INIT_AUTOMAKE

=== modified file 'reconf'
--- reconf	2012-10-25 21:38:48 +0000
+++ reconf	2012-10-30 18:58:19 +0000
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+mkdir -p config
 rm -f config.cache
 aclocal -I m4
 autoconf

=== modified file 'src/Makefile.am'
--- src/Makefile.am	2012-10-25 21:38:48 +0000
+++ src/Makefile.am	2012-10-30 18:58:19 +0000
@@ -6,5 +6,8 @@
 if HAVE_SELINUX
     procenv_CPPFLAGS += -DHAVE_SELINUX
 endif
+if HAVE_APPARMOR
+    procenv_CPPFLAGS += -DHAVE_APPARMOR
+endif
 
 TESTS = procenv

=== modified file 'src/procenv.c'
--- src/procenv.c	2012-10-27 13:57:54 +0000
+++ src/procenv.c	2012-10-30 18:58:19 +0000
@@ -873,7 +873,8 @@
 #endif
 	show ("chroot: %s", in_chroot () ? YES_STR : NO_STR);
 #if defined (PROCENV_LINUX)
-	show_linux_selinux_context ();
+	show_linux_security_module ();
+	show_linux_security_module_context ();
 #endif
 	show ("container: %s", container_type ());
 
@@ -2382,8 +2383,6 @@
 
 #define show_capability(cap) \
 { \
-	int ret; \
-	\
 	ret = prctl (PR_CAPBSET_READ, cap, 0, 0, 0); \
 	\
 	if (ret < 0) \
@@ -2395,6 +2394,8 @@
 void
 show_capabilities (void)
 {
+	int ret;
+
 	header ("capabilities(linux)");
 
 	show_capability (CAP_CHOWN);
@@ -2437,29 +2438,83 @@
 #ifdef CAP_WAKE_ALARM
 	show_capability (CAP_WAKE_ALARM);
 #endif
-}
-
-void
-show_linux_selinux_context (void)
-{
-	char   *context;
+
+#ifdef PR_GET_KEEPCAPS
+	ret = prctl (PR_GET_KEEPCAPS, 0, 0, 0, 0);
+	if (ret < 0 && errno != ENOSYS)
+		die ("prctl failed for PR_GET_KEEPCAPS");
+	if (ret >= 0)
+		show ("keep=%s", ret ? YES_STR : NO_STR);
+#endif
+
+#ifdef PR_GET_SECUREBITS
+	ret = prctl (PR_GET_SECUREBITS, 0, 0, 0, 0);
+	if (ret < 0 && errno != ENOSYS)
+		die ("prctl failed for PR_GET_SECUREBITS");
+	if (ret >= 0) {
+		struct securebits_t {
+			unsigned int securebits;
+		} flags;
+		flags.securebits = (unsigned int)ret;
+		show ("securebits=0x%x", flags.securebits);
+
+		show_const (flags, securebits, SECBIT_KEEP_CAPS);
+		show_const (flags, securebits, SECBIT_NO_SETUID_FIXUP);
+		show_const (flags, securebits, SECBIT_NOROOT);
+	}
+#endif
+}
+
+void
+show_linux_security_module (void)
+{
+	char *lsm = UNKNOWN_STR;
+#if defined(HAVE_APPARMOR)
+	if (aa_is_enabled ())
+		lsm = "AppArmor";
+#endif
+#if defined(HAVE_SELINUX)
+	if (is_selinux_enabled ())
+		lsm = "SELinux";
+#endif
+	show ("Linux Security Module: %s", lsm);
+}
+
+void
+show_linux_security_module_context (void)
+{
+	char   *context = NULL;
+	char   *mode = NULL;
 	size_t  len;
 
-#ifdef HAVE_SELINUX
+#if defined(HAVE_APPARMOR)
+	if (aa_gettaskcon (user.pid, &context, &mode) < 0)
+		die ("failed to query AppArmor context");
+
+	if (context) {
+		if (mode)
+			show ("LSM context: %s (%s)", context, mode);
+		else
+			show ("LSM context: %s", context);
+	} else
+		show ("LSM context: %s", UNKNOWN_STR);
+
+#elif defined(HAVE_SELINUX)
 	if (getpidcon (user.pid, &context) < 0)
 		die ("failed to query SELinux context");
 
 	len = strlen (context);
 
 	/* don't show trailing NL */
-	show ("selinux context: %.*s",
+	show ("LSM context: %.*s",
 			len - 1,
 			context);
 
+#else
+	show ("LSM context: %s", UNKNOWN_STR);
+#endif
 	free (context);
-#else
-	show ("selinux context: %s", UNKNOWN_STR);
-#endif
+	free (mode);
 
 }
 

=== modified file 'src/procenv.h'
--- src/procenv.h	2012-10-27 13:39:54 +0000
+++ src/procenv.h	2012-10-30 18:58:19 +0000
@@ -54,8 +54,14 @@
 #include <execinfo.h>
 #include <sys/inotify.h>
 #include <sys/prctl.h>
+#ifdef PR_GET_SECUREBITS
+#include <linux/securebits.h>
+#endif
 #include <linux/capability.h>
 #include <linux/vt.h>
+#ifdef HAVE_APPARMOR
+#include <sys/apparmor.h>
+#endif
 #ifdef HAVE_SELINUX
 #include <selinux/selinux.h>
 #endif
@@ -362,7 +368,8 @@
 void show_linux_cgroups (void);
 void show_oom (void);
 void show_capabilities (void);
-void show_linux_selinux_context (void);
+void show_linux_security_module (void);
+void show_linux_security_module_context (void);
 void show_linux_mounts (ShowMountType what);
 void show_linux_proc_branch (void);
 void show_linux_cpu (void);