Commit | Line | Data |
---|---|---|
c75afcd1 JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor contexts used to associate "labels" to objects. | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #ifndef __AA_CONTEXT_H | |
16 | #define __AA_CONTEXT_H | |
17 | ||
18 | #include <linux/cred.h> | |
19 | #include <linux/slab.h> | |
20 | #include <linux/sched.h> | |
21 | ||
22 | #include "policy.h" | |
23 | ||
214beaca JJ |
24 | #define cred_cxt(X) (X)->security |
25 | #define current_cxt() cred_cxt(current_cred()) | |
26 | ||
c75afcd1 JJ |
27 | /* struct aa_file_cxt - the AppArmor context the file was opened in |
28 | * @perms: the permission the file was opened with | |
29 | * | |
30 | * The file_cxt could currently be directly stored in file->f_security | |
31 | * as the profile reference is now stored in the f_cred. However the | |
32 | * cxt struct will expand in the future so we keep the struct. | |
33 | */ | |
34 | struct aa_file_cxt { | |
35 | u16 allow; | |
36 | }; | |
37 | ||
38 | /** | |
39 | * aa_alloc_file_context - allocate file_cxt | |
40 | * @gfp: gfp flags for allocation | |
41 | * | |
42 | * Returns: file_cxt or NULL on failure | |
43 | */ | |
44 | static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp) | |
45 | { | |
46 | return kzalloc(sizeof(struct aa_file_cxt), gfp); | |
47 | } | |
48 | ||
49 | /** | |
50 | * aa_free_file_context - free a file_cxt | |
51 | * @cxt: file_cxt to free (MAYBE_NULL) | |
52 | */ | |
53 | static inline void aa_free_file_context(struct aa_file_cxt *cxt) | |
54 | { | |
55 | if (cxt) | |
56 | kzfree(cxt); | |
57 | } | |
58 | ||
59 | /** | |
60 | * struct aa_task_cxt - primary label for confined tasks | |
61 | * @profile: the current profile (NOT NULL) | |
62 | * @exec: profile to transition to on next exec (MAYBE NULL) | |
63 | * @previous: profile the task may return to (MAYBE NULL) | |
64 | * @token: magic value the task must know for returning to @previous_profile | |
65 | * | |
66 | * Contains the task's current profile (which could change due to | |
67 | * change_hat). Plus the hat_magic needed during change_hat. | |
68 | * | |
69 | * TODO: make so a task can be confined by a stack of contexts | |
70 | */ | |
71 | struct aa_task_cxt { | |
72 | struct aa_profile *profile; | |
73 | struct aa_profile *onexec; | |
74 | struct aa_profile *previous; | |
75 | u64 token; | |
76 | }; | |
77 | ||
78 | struct aa_task_cxt *aa_alloc_task_context(gfp_t flags); | |
79 | void aa_free_task_context(struct aa_task_cxt *cxt); | |
80 | void aa_dup_task_context(struct aa_task_cxt *new, | |
81 | const struct aa_task_cxt *old); | |
82 | int aa_replace_current_profile(struct aa_profile *profile); | |
83 | int aa_set_current_onexec(struct aa_profile *profile); | |
84 | int aa_set_current_hat(struct aa_profile *profile, u64 token); | |
85 | int aa_restore_previous_profile(u64 cookie); | |
3cfcc19e | 86 | struct aa_profile *aa_get_task_profile(struct task_struct *task); |
c75afcd1 | 87 | |
c75afcd1 JJ |
88 | |
89 | /** | |
90 | * aa_cred_profile - obtain cred's profiles | |
91 | * @cred: cred to obtain profiles from (NOT NULL) | |
92 | * | |
93 | * Returns: confining profile | |
94 | * | |
95 | * does NOT increment reference count | |
96 | */ | |
97 | static inline struct aa_profile *aa_cred_profile(const struct cred *cred) | |
98 | { | |
214beaca | 99 | struct aa_task_cxt *cxt = cred_cxt(cred); |
c75afcd1 | 100 | BUG_ON(!cxt || !cxt->profile); |
77b071b3 | 101 | return cxt->profile; |
c75afcd1 JJ |
102 | } |
103 | ||
3cfcc19e JJ |
104 | /** |
105 | * __aa_task_profile - retrieve another task's profile | |
106 | * @task: task to query (NOT NULL) | |
107 | * | |
108 | * Returns: @task's profile without incrementing its ref count | |
109 | * | |
110 | * If @task != current needs to be called in RCU safe critical section | |
111 | */ | |
112 | static inline struct aa_profile *__aa_task_profile(struct task_struct *task) | |
113 | { | |
114 | return aa_cred_profile(__task_cred(task)); | |
115 | } | |
116 | ||
117 | /** | |
118 | * __aa_task_is_confined - determine if @task has any confinement | |
119 | * @task: task to check confinement of (NOT NULL) | |
120 | * | |
121 | * If @task != current needs to be called in RCU safe critical section | |
122 | */ | |
123 | static inline bool __aa_task_is_confined(struct task_struct *task) | |
124 | { | |
125 | return !unconfined(__aa_task_profile(task)); | |
126 | } | |
127 | ||
c75afcd1 JJ |
128 | /** |
129 | * __aa_current_profile - find the current tasks confining profile | |
130 | * | |
131 | * Returns: up to date confining profile or the ns unconfined profile (NOT NULL) | |
132 | * | |
133 | * This fn will not update the tasks cred to the most up to date version | |
134 | * of the profile so it is safe to call when inside of locks. | |
135 | */ | |
136 | static inline struct aa_profile *__aa_current_profile(void) | |
137 | { | |
138 | return aa_cred_profile(current_cred()); | |
139 | } | |
140 | ||
141 | /** | |
142 | * aa_current_profile - find the current tasks confining profile and do updates | |
143 | * | |
144 | * Returns: up to date confining profile or the ns unconfined profile (NOT NULL) | |
145 | * | |
146 | * This fn will update the tasks cred structure if the profile has been | |
147 | * replaced. Not safe to call inside locks | |
148 | */ | |
149 | static inline struct aa_profile *aa_current_profile(void) | |
150 | { | |
214beaca | 151 | const struct aa_task_cxt *cxt = current_cxt(); |
c75afcd1 JJ |
152 | struct aa_profile *profile; |
153 | BUG_ON(!cxt || !cxt->profile); | |
154 | ||
77b071b3 JJ |
155 | if (PROFILE_INVALID(cxt->profile)) { |
156 | profile = aa_get_newest_profile(cxt->profile); | |
c75afcd1 | 157 | aa_replace_current_profile(profile); |
77b071b3 JJ |
158 | aa_put_profile(profile); |
159 | cxt = current_cxt(); | |
160 | } | |
c75afcd1 | 161 | |
77b071b3 | 162 | return cxt->profile; |
c75afcd1 JJ |
163 | } |
164 | ||
7a2871b5 JJ |
165 | /** |
166 | * aa_clear_task_cxt_trans - clear transition tracking info from the cxt | |
167 | * @cxt: task context to clear (NOT NULL) | |
168 | */ | |
169 | static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt) | |
170 | { | |
171 | aa_put_profile(cxt->previous); | |
172 | aa_put_profile(cxt->onexec); | |
173 | cxt->previous = NULL; | |
174 | cxt->onexec = NULL; | |
175 | cxt->token = 0; | |
176 | } | |
177 | ||
c75afcd1 | 178 | #endif /* __AA_CONTEXT_H */ |