]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor contexts used to associate "labels" to objects. | |
5 | * | |
6 | * Copyright (C) 1998-2008 Novell/SUSE | |
7 | * Copyright 2009-2010 Canonical Ltd. | |
8 | * | |
9 | * This program is free software; you can redistribute it and/or | |
10 | * modify it under the terms of the GNU General Public License as | |
11 | * published by the Free Software Foundation, version 2 of the | |
12 | * License. | |
13 | */ | |
14 | ||
15 | #ifndef __AA_CONTEXT_H | |
16 | #define __AA_CONTEXT_H | |
17 | ||
18 | #include <linux/cred.h> | |
19 | #include <linux/slab.h> | |
20 | #include <linux/sched.h> | |
21 | #include <linux/lsm_hooks.h> | |
22 | ||
23 | #include "label.h" | |
24 | #include "policy_ns.h" | |
25 | ||
26 | #define cred_ctx(X) apparmor_cred(X) | |
27 | #define current_ctx() cred_ctx(current_cred()) | |
28 | ||
29 | /** | |
30 | * struct aa_task_ctx - primary label for confined tasks | |
31 | * @label: the current label (NOT NULL) | |
32 | * @exec: label to transition to on next exec (MAYBE NULL) | |
33 | * @previous: label the task may return to (MAYBE NULL) | |
34 | * @token: magic value the task must know for returning to @previous | |
35 | * | |
36 | * Contains the task's current label (which could change due to | |
37 | * change_hat). Plus the hat_magic needed during change_hat. | |
38 | * | |
39 | * TODO: make so a task can be confined by a stack of contexts | |
40 | */ | |
41 | struct aa_task_ctx { | |
42 | struct aa_label *label; | |
43 | struct aa_label *onexec; | |
44 | struct aa_label *previous; | |
45 | u64 token; | |
46 | }; | |
47 | ||
48 | struct aa_task_ctx *aa_alloc_task_context(gfp_t flags); | |
49 | void aa_free_task_context(struct aa_task_ctx *ctx); | |
50 | void aa_dup_task_context(struct aa_task_ctx *new, | |
51 | const struct aa_task_ctx *old); | |
52 | int aa_replace_current_label(struct aa_label *label); | |
53 | int aa_set_current_onexec(struct aa_label *label, bool stack); | |
54 | int aa_set_current_hat(struct aa_label *label, u64 token); | |
55 | int aa_restore_previous_label(u64 cookie); | |
56 | struct aa_label *aa_get_task_label(struct task_struct *task); | |
57 | ||
58 | extern struct lsm_blob_sizes apparmor_blob_sizes; | |
59 | ||
60 | static inline struct aa_task_ctx *apparmor_cred(const struct cred *cred) | |
61 | { | |
62 | #ifdef CONFIG_SECURITY_STACKING | |
63 | return cred->security + apparmor_blob_sizes.lbs_cred; | |
64 | #else | |
65 | return cred->security; | |
66 | #endif | |
67 | } | |
68 | ||
69 | /** | |
70 | * aa_cred_raw_label - obtain cred's label | |
71 | * @cred: cred to obtain label from (NOT NULL) | |
72 | * | |
73 | * Returns: confining label | |
74 | * | |
75 | * does NOT increment reference count | |
76 | */ | |
77 | static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) | |
78 | { | |
79 | struct aa_task_ctx *ctx = apparmor_cred(cred); | |
80 | ||
81 | AA_BUG(!ctx || !ctx->label); | |
82 | return ctx->label; | |
83 | } | |
84 | ||
85 | /** | |
86 | * aa_get_newest_cred_label - obtain the newest label on a cred | |
87 | * @cred: cred to obtain label from (NOT NULL) | |
88 | * | |
89 | * Returns: newest version of confining label | |
90 | */ | |
91 | static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) | |
92 | { | |
93 | return aa_get_newest_label(aa_cred_raw_label(cred)); | |
94 | } | |
95 | ||
96 | static inline struct aa_file_ctx *apparmor_file(const struct file *file) | |
97 | { | |
98 | #ifdef CONFIG_SECURITY_STACKING | |
99 | return file->f_security + apparmor_blob_sizes.lbs_file; | |
100 | #else | |
101 | return file->f_security; | |
102 | #endif | |
103 | } | |
104 | ||
105 | /** | |
106 | * __aa_task_raw_label - retrieve another task's label | |
107 | * @task: task to query (NOT NULL) | |
108 | * | |
109 | * Returns: @task's label without incrementing its ref count | |
110 | * | |
111 | * If @task != current needs to be called in RCU safe critical section | |
112 | */ | |
113 | static inline struct aa_label *__aa_task_raw_label(struct task_struct *task) | |
114 | { | |
115 | return aa_cred_raw_label(__task_cred(task)); | |
116 | } | |
117 | ||
118 | /** | |
119 | * __aa_task_is_confined - determine if @task has any confinement | |
120 | * @task: task to check confinement of (NOT NULL) | |
121 | * | |
122 | * If @task != current needs to be called in RCU safe critical section | |
123 | */ | |
124 | static inline bool __aa_task_is_confined(struct task_struct *task) | |
125 | { | |
126 | return !unconfined(__aa_task_raw_label(task)); | |
127 | } | |
128 | ||
129 | /** | |
130 | * aa_current_raw_label - find the current tasks confining label | |
131 | * | |
132 | * Returns: up to date confining label or the ns unconfined label (NOT NULL) | |
133 | * | |
134 | * This fn will not update the tasks cred to the most up to date version | |
135 | * of the label so it is safe to call when inside of locks. | |
136 | */ | |
137 | static inline struct aa_label *aa_current_raw_label(void) | |
138 | { | |
139 | return aa_cred_raw_label(current_cred()); | |
140 | } | |
141 | ||
142 | /** | |
143 | * aa_get_current_label - get the newest version of the current tasks label | |
144 | * | |
145 | * Returns: newest version of confining label (NOT NULL) | |
146 | * | |
147 | * This fn will not update the tasks cred, so it is safe inside of locks | |
148 | * | |
149 | * The returned reference must be put with aa_put_label() | |
150 | */ | |
151 | static inline struct aa_label *aa_get_current_label(void) | |
152 | { | |
153 | struct aa_label *l = aa_current_raw_label(); | |
154 | ||
155 | if (label_is_stale(l)) | |
156 | return aa_get_newest_label(l); | |
157 | return aa_get_label(l); | |
158 | } | |
159 | ||
160 | #define __end_current_label_crit_section(X) end_current_label_crit_section(X) | |
161 | ||
162 | /** | |
163 | * end_label_crit_section - put a reference found with begin_current_label.. | |
164 | * @label: label reference to put | |
165 | * | |
166 | * Should only be used with a reference obtained with | |
167 | * begin_current_label_crit_section and never used in situations where the | |
168 | * task cred may be updated | |
169 | */ | |
170 | static inline void end_current_label_crit_section(struct aa_label *label) | |
171 | { | |
172 | if (label != aa_current_raw_label()) | |
173 | aa_put_label(label); | |
174 | } | |
175 | ||
176 | /** | |
177 | * __begin_current_label_crit_section - current's confining label | |
178 | * | |
179 | * Returns: up to date confining label or the ns unconfined label (NOT NULL) | |
180 | * | |
181 | * safe to call inside locks | |
182 | * | |
183 | * The returned reference must be put with __end_current_label_crit_section() | |
184 | * This must NOT be used if the task cred could be updated within the | |
185 | * critical section between __begin_current_label_crit_section() .. | |
186 | * __end_current_label_crit_section() | |
187 | */ | |
188 | static inline struct aa_label *__begin_current_label_crit_section(void) | |
189 | { | |
190 | struct aa_label *label = aa_current_raw_label(); | |
191 | ||
192 | if (label_is_stale(label)) | |
193 | label = aa_get_newest_label(label); | |
194 | ||
195 | return label; | |
196 | } | |
197 | ||
198 | /** | |
199 | * begin_current_label_crit_section - current's confining label and update it | |
200 | * | |
201 | * Returns: up to date confining label or the ns unconfined label (NOT NULL) | |
202 | * | |
203 | * Not safe to call inside locks | |
204 | * | |
205 | * The returned reference must be put with end_current_label_crit_section() | |
206 | * This must NOT be used if the task cred could be updated within the | |
207 | * critical section between begin_current_label_crit_section() .. | |
208 | * end_current_label_crit_section() | |
209 | */ | |
210 | static inline struct aa_label *begin_current_label_crit_section(void) | |
211 | { | |
212 | struct aa_label *label = aa_current_raw_label(); | |
213 | ||
214 | if (label_is_stale(label)) { | |
215 | label = aa_get_newest_label(label); | |
216 | if (aa_replace_current_label(label) == 0) | |
217 | /* task cred will keep the reference */ | |
218 | aa_put_label(label); | |
219 | } | |
220 | ||
221 | return label; | |
222 | } | |
223 | ||
224 | static inline struct aa_ns *aa_get_current_ns(void) | |
225 | { | |
226 | struct aa_label *label; | |
227 | struct aa_ns *ns; | |
228 | ||
229 | label = __begin_current_label_crit_section(); | |
230 | ns = aa_get_ns(labels_ns(label)); | |
231 | __end_current_label_crit_section(label); | |
232 | ||
233 | return ns; | |
234 | } | |
235 | ||
236 | /** | |
237 | * aa_clear_task_ctx_trans - clear transition tracking info from the ctx | |
238 | * @ctx: task context to clear (NOT NULL) | |
239 | */ | |
240 | static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx) | |
241 | { | |
242 | aa_put_label(ctx->previous); | |
243 | aa_put_label(ctx->onexec); | |
244 | ctx->previous = NULL; | |
245 | ctx->onexec = NULL; | |
246 | ctx->token = 0; | |
247 | } | |
248 | ||
249 | #endif /* __AA_CONTEXT_H */ |