]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor lib definitions | |
5 | * | |
6 | * 2017 Canonical Ltd. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU General Public License as | |
10 | * published by the Free Software Foundation, version 2 of the | |
11 | * License. | |
12 | */ | |
13 | ||
14 | #ifndef __AA_LIB_H | |
15 | #define __AA_LIB_H | |
16 | ||
17 | #include <linux/slab.h> | |
18 | #include <linux/fs.h> | |
19 | ||
20 | #include "match.h" | |
21 | ||
22 | /* Provide our own test for whether a write lock is held for asserts | |
23 | * this is because on none SMP systems write_can_lock will always | |
24 | * resolve to true, which is what you want for code making decisions | |
25 | * based on it, but wrong for asserts checking that the lock is held | |
26 | */ | |
27 | #ifdef CONFIG_SMP | |
28 | #define write_is_locked(X) !write_can_lock(X) | |
29 | #else | |
30 | #define write_is_locked(X) (1) | |
31 | #endif /* CONFIG_SMP */ | |
32 | ||
33 | /* | |
34 | * DEBUG remains global (no per profile flag) since it is mostly used in sysctl | |
35 | * which is not related to profile accesses. | |
36 | */ | |
37 | ||
38 | #define AA_DEBUG(fmt, args...) \ | |
39 | do { \ | |
40 | if (aa_g_debug) \ | |
41 | pr_debug_ratelimited("AppArmor: " fmt, ##args); \ | |
42 | } while (0) | |
43 | ||
44 | #define AA_ERROR(fmt, args...) \ | |
45 | pr_err_ratelimited("AppArmor: " fmt, ##args) | |
46 | ||
47 | /* Flag indicating whether initialization completed */ | |
48 | extern int apparmor_initialized __initdata; | |
49 | ||
50 | /* fn's in lib */ | |
51 | char *aa_split_fqname(char *args, char **ns_name); | |
52 | const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name, | |
53 | size_t *ns_len); | |
54 | void aa_info_message(const char *str); | |
55 | void *__aa_kvmalloc(size_t size, gfp_t flags); | |
56 | ||
57 | static inline void *kvmalloc(size_t size) | |
58 | { | |
59 | return __aa_kvmalloc(size, 0); | |
60 | } | |
61 | ||
62 | static inline void *kvzalloc(size_t size) | |
63 | { | |
64 | return __aa_kvmalloc(size, __GFP_ZERO); | |
65 | } | |
66 | ||
67 | /* returns 0 if kref not incremented */ | |
68 | static inline int kref_get_not0(struct kref *kref) | |
69 | { | |
70 | return atomic_inc_not_zero(&kref->refcount); | |
71 | } | |
72 | ||
73 | /** | |
74 | * aa_strneq - compare null terminated @str to a non null terminated substring | |
75 | * @str: a null terminated string | |
76 | * @sub: a substring, not necessarily null terminated | |
77 | * @len: length of @sub to compare | |
78 | * | |
79 | * The @str string must be full consumed for this to be considered a match | |
80 | */ | |
81 | static inline bool aa_strneq(const char *str, const char *sub, int len) | |
82 | { | |
83 | return !strncmp(str, sub, len) && !str[len]; | |
84 | } | |
85 | ||
86 | /** | |
87 | * aa_dfa_null_transition - step to next state after null character | |
88 | * @dfa: the dfa to match against | |
89 | * @start: the state of the dfa to start matching in | |
90 | * | |
91 | * aa_dfa_null_transition transitions to the next state after a null | |
92 | * character which is not used in standard matching and is only | |
93 | * used to separate pairs. | |
94 | */ | |
95 | static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, | |
96 | unsigned int start) | |
97 | { | |
98 | /* the null transition only needs the string's null terminator byte */ | |
99 | return aa_dfa_next(dfa, start, 0); | |
100 | } | |
101 | ||
102 | static inline bool mediated_filesystem(struct dentry *dentry) | |
103 | { | |
104 | return !(dentry->d_sb->s_flags & MS_NOUSER); | |
105 | } | |
106 | ||
107 | /* struct aa_policy - common part of both namespaces and profiles | |
108 | * @name: name of the object | |
109 | * @hname - The hierarchical name | |
110 | * @list: list policy object is on | |
111 | * @profiles: head of the profiles list contained in the object | |
112 | */ | |
113 | struct aa_policy { | |
114 | char *name; | |
115 | char *hname; | |
116 | struct list_head list; | |
117 | struct list_head profiles; | |
118 | }; | |
119 | ||
120 | /** | |
121 | * hname_tail - find the last component of an hname | |
122 | * @name: hname to find the base profile name component of (NOT NULL) | |
123 | * | |
124 | * Returns: the tail (base profile name) name component of an hname | |
125 | */ | |
126 | static inline const char *hname_tail(const char *hname) | |
127 | { | |
128 | char *split; | |
129 | ||
130 | hname = strim((char *)hname); | |
131 | for (split = strstr(hname, "//"); split; split = strstr(hname, "//")) | |
132 | hname = split + 2; | |
133 | ||
134 | return hname; | |
135 | } | |
136 | ||
137 | /** | |
138 | * __policy_find - find a policy by @name on a policy list | |
139 | * @head: list to search (NOT NULL) | |
140 | * @name: name to search for (NOT NULL) | |
141 | * | |
142 | * Requires: rcu_read_lock be held | |
143 | * | |
144 | * Returns: unrefcounted policy that match @name or NULL if not found | |
145 | */ | |
146 | static inline struct aa_policy *__policy_find(struct list_head *head, | |
147 | const char *name) | |
148 | { | |
149 | struct aa_policy *policy; | |
150 | ||
151 | list_for_each_entry_rcu(policy, head, list) { | |
152 | if (!strcmp(policy->name, name)) | |
153 | return policy; | |
154 | } | |
155 | return NULL; | |
156 | } | |
157 | ||
158 | /** | |
159 | * __policy_strn_find - find a policy that's name matches @len chars of @str | |
160 | * @head: list to search (NOT NULL) | |
161 | * @str: string to search for (NOT NULL) | |
162 | * @len: length of match required | |
163 | * | |
164 | * Requires: rcu_read_lock be held | |
165 | * | |
166 | * Returns: unrefcounted policy that match @str or NULL if not found | |
167 | * | |
168 | * if @len == strlen(@strlen) then this is equiv to __policy_find | |
169 | * other wise it allows searching for policy by a partial match of name | |
170 | */ | |
171 | static inline struct aa_policy *__policy_strn_find(struct list_head *head, | |
172 | const char *str, int len) | |
173 | { | |
174 | struct aa_policy *policy; | |
175 | ||
176 | list_for_each_entry_rcu(policy, head, list) { | |
177 | if (aa_strneq(policy->name, str, len)) | |
178 | return policy; | |
179 | } | |
180 | ||
181 | return NULL; | |
182 | } | |
183 | ||
184 | bool aa_policy_init(struct aa_policy *policy, const char *prefix, | |
185 | const char *name); | |
186 | void aa_policy_destroy(struct aa_policy *policy); | |
187 | ||
188 | #endif /* AA_LIB_H */ |