security/apparmor/context.c

   1 /*
   2  * AppArmor security module
   3  *
   4  * This file contains AppArmor functions used to manipulate object security
   5  * contexts.
   6  *
   7  * Copyright (C) 1998-2008 Novell/SUSE
   8  * Copyright 2009-2010 Canonical Ltd.
   9  *
  10  * This program is free software; you can redistribute it and/or
  11  * modify it under the terms of the GNU General Public License as
  12  * published by the Free Software Foundation, version 2 of the
  13  * License.
  14  *
  15  *
  16  * AppArmor sets confinement on every task, via the the aa_task_ctx and
  17  * the aa_task_ctx.label, both of which are required and are not allowed
  18  * to be NULL.  The aa_task_ctx is not reference counted and is unique
  19  * to each cred (which is reference count).  The label pointed to by
  20  * the task_ctx is reference counted.
  21  *
  22  * TODO
  23  * If a task uses change_hat it currently does not return to the old
  24  * cred or task context but instead creates a new one.  Ideally the task
  25  * should return to the previous cred if it has not been modified.
  26  *
  27  */
  28
  29 #include "include/context.h"
  30 #include "include/policy.h"
  31
  32
  33 /**
  34  * aa_free_task_context - free a task_ctx
  35  * @ctx: task_ctx to free (MAYBE NULL)
  36  */
  37 void aa_free_task_context(struct aa_task_ctx *ctx)
  38 {
  39         if (ctx) {
  40                 aa_put_label(ctx->label);
  41                 aa_put_label(ctx->previous);
  42                 aa_put_label(ctx->onexec);
  43         }
  44 }
  45
  46 /**
  47  * aa_dup_task_context - duplicate a task context, incrementing reference counts
  48  * @new: a blank task context      (NOT NULL)
  49  * @old: the task context to copy  (NOT NULL)
  50  */
  51 void aa_dup_task_context(struct aa_task_ctx *new, const struct aa_task_ctx *old)
  52 {
  53         *new = *old;
  54         aa_get_label(new->label);
  55         aa_get_label(new->previous);
  56         aa_get_label(new->onexec);
  57 }
  58
  59 /**
  60  * aa_get_task_label - Get another task's label
  61  * @task: task to query  (NOT NULL)
  62  *
  63  * Returns: counted reference to @task's label
  64  */
  65 struct aa_label *aa_get_task_label(struct task_struct *task)
  66 {
  67         struct aa_label *p;
  68
  69         rcu_read_lock();
  70         p = aa_get_newest_label(__aa_task_raw_label(task));
  71         rcu_read_unlock();
  72
  73         return p;
  74 }
  75
  76 /**
  77  * aa_replace_current_label - replace the current tasks label
  78  * @label: new label  (NOT NULL)
  79  *
  80  * Returns: 0 or error on failure
  81  */
  82 int aa_replace_current_label(struct aa_label *label)
  83 {
  84         struct aa_task_ctx *ctx = current_ctx();
  85         struct cred *new;
  86         AA_BUG(!label);
  87
  88         if (ctx->label == label)
  89                 return 0;
  90
  91         if (current_cred() != current_real_cred())
  92                 return -EBUSY;
  93
  94         new  = prepare_creds();
  95         if (!new)
  96                 return -ENOMEM;
  97
  98         ctx = cred_ctx(new);
  99         if (unconfined(label) || (labels_ns(ctx->label) != labels_ns(label)))
 100                 /* if switching to unconfined or a different label namespace
 101                  * clear out context state
 102                  */
 103                 aa_clear_task_ctx_trans(ctx);
 104
 105         /*
 106          * be careful switching ctx->profile, when racing replacement it
 107          * is possible that ctx->profile->proxy->profile is the reference
 108          * keeping @profile valid, so make sure to get its reference before
 109          * dropping the reference on ctx->profile
 110          */
 111         aa_get_label(label);
 112         aa_put_label(ctx->label);
 113         ctx->label = label;
 114
 115         commit_creds(new);
 116         return 0;
 117 }
 118
 119 /**
 120  * aa_set_current_onexec - set the tasks change_profile to happen onexec
 121  * @label: system label to set at exec  (MAYBE NULL to clear value)
 122  * @stack: whether stacking should be done
 123  * Returns: 0 or error on failure
 124  */
 125 int aa_set_current_onexec(struct aa_label *label, bool stack)
 126 {
 127         struct aa_task_ctx *ctx;
 128         struct cred *new = prepare_creds();
 129         if (!new)
 130                 return -ENOMEM;
 131
 132         ctx = cred_ctx(new);
 133         aa_get_label(label);
 134         aa_clear_task_ctx_trans(ctx);
 135         ctx->onexec = label;
 136         ctx->token = stack;
 137
 138         commit_creds(new);
 139         return 0;
 140 }
 141
 142 /**
 143  * aa_set_current_hat - set the current tasks hat
 144  * @label: label to set as the current hat  (NOT NULL)
 145  * @token: token value that must be specified to change from the hat
 146  *
 147  * Do switch of tasks hat.  If the task is currently in a hat
 148  * validate the token to match.
 149  *
 150  * Returns: 0 or error on failure
 151  */
 152 int aa_set_current_hat(struct aa_label *label, u64 token)
 153 {
 154         struct aa_task_ctx *ctx;
 155         struct cred *new = prepare_creds();
 156         if (!new)
 157                 return -ENOMEM;
 158         AA_BUG(!label);
 159
 160         ctx = cred_ctx(new);
 161         if (!ctx->previous) {
 162                 /* transfer refcount */
 163                 ctx->previous = ctx->label;
 164                 ctx->token = token;
 165         } else if (ctx->token == token) {
 166                 aa_put_label(ctx->label);
 167         } else {
 168                 /* previous_profile && ctx->token != token */
 169                 abort_creds(new);
 170                 return -EACCES;
 171         }
 172         ctx->label = aa_get_newest_label(label);
 173         /* clear exec on switching context */
 174         aa_put_label(ctx->onexec);
 175         ctx->onexec = NULL;
 176
 177         commit_creds(new);
 178         return 0;
 179 }
 180
 181 /**
 182  * aa_restore_previous_label - exit from hat context restoring previous label
 183  * @token: the token that must be matched to exit hat context
 184  *
 185  * Attempt to return out of a hat to the previous label.  The token
 186  * must match the stored token value.
 187  *
 188  * Returns: 0 or error of failure
 189  */
 190 int aa_restore_previous_label(u64 token)
 191 {
 192         struct aa_task_ctx *ctx;
 193         struct cred *new = prepare_creds();
 194         if (!new)
 195                 return -ENOMEM;
 196
 197         ctx = cred_ctx(new);
 198         if (ctx->token != token) {
 199                 abort_creds(new);
 200                 return -EACCES;
 201         }
 202         /* ignore restores when there is no saved label */
 203         if (!ctx->previous) {
 204                 abort_creds(new);
 205                 return 0;
 206         }
 207
 208         aa_put_label(ctx->label);
 209         ctx->label = aa_get_newest_label(ctx->previous);
 210         AA_BUG(!ctx->label);
 211         /* clear exec && prev information when restoring to previous context */
 212         aa_clear_task_ctx_trans(ctx);
 213
 214         commit_creds(new);
 215         return 0;
 216 }