1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor contexts used to associate "labels" to objects. 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #ifndef __AA_CONTEXT_H 16 #define __AA_CONTEXT_H 17 18 #include <linux/cred.h> 19 #include <linux/slab.h> 20 #include <linux/sched.h> 21 22 #include "policy.h" 23 24 #define cred_cxt(X) (X)->security 25 #define current_cxt() cred_cxt(current_cred()) 26 27 /* struct aa_file_cxt - the AppArmor context the file was opened in 28 * @perms: the permission the file was opened with 29 * 30 * The file_cxt could currently be directly stored in file->f_security 31 * as the profile reference is now stored in the f_cred. However the 32 * cxt struct will expand in the future so we keep the struct. 33 */ 34 struct aa_file_cxt { 35 u16 allow; 36 }; 37 38 /** 39 * aa_alloc_file_context - allocate file_cxt 40 * @gfp: gfp flags for allocation 41 * 42 * Returns: file_cxt or NULL on failure 43 */ aa_alloc_file_context(gfp_t gfp)44static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp) 45 { 46 return kzalloc(sizeof(struct aa_file_cxt), gfp); 47 } 48 49 /** 50 * aa_free_file_context - free a file_cxt 51 * @cxt: file_cxt to free (MAYBE_NULL) 52 */ aa_free_file_context(struct aa_file_cxt * cxt)53static inline void aa_free_file_context(struct aa_file_cxt *cxt) 54 { 55 if (cxt) 56 kzfree(cxt); 57 } 58 59 /** 60 * struct aa_task_cxt - primary label for confined tasks 61 * @profile: the current profile (NOT NULL) 62 * @exec: profile to transition to on next exec (MAYBE NULL) 63 * @previous: profile the task may return to (MAYBE NULL) 64 * @token: magic value the task must know for returning to @previous_profile 65 * 66 * Contains the task's current profile (which could change due to 67 * change_hat). Plus the hat_magic needed during change_hat. 68 * 69 * TODO: make so a task can be confined by a stack of contexts 70 */ 71 struct aa_task_cxt { 72 struct aa_profile *profile; 73 struct aa_profile *onexec; 74 struct aa_profile *previous; 75 u64 token; 76 }; 77 78 struct aa_task_cxt *aa_alloc_task_context(gfp_t flags); 79 void aa_free_task_context(struct aa_task_cxt *cxt); 80 void aa_dup_task_context(struct aa_task_cxt *new, 81 const struct aa_task_cxt *old); 82 int aa_replace_current_profile(struct aa_profile *profile); 83 int aa_set_current_onexec(struct aa_profile *profile); 84 int aa_set_current_hat(struct aa_profile *profile, u64 token); 85 int aa_restore_previous_profile(u64 cookie); 86 struct aa_profile *aa_get_task_profile(struct task_struct *task); 87 88 89 /** 90 * aa_cred_profile - obtain cred's profiles 91 * @cred: cred to obtain profiles from (NOT NULL) 92 * 93 * Returns: confining profile 94 * 95 * does NOT increment reference count 96 */ aa_cred_profile(const struct cred * cred)97static inline struct aa_profile *aa_cred_profile(const struct cred *cred) 98 { 99 struct aa_task_cxt *cxt = cred_cxt(cred); 100 BUG_ON(!cxt || !cxt->profile); 101 return cxt->profile; 102 } 103 104 /** 105 * __aa_task_profile - retrieve another task's profile 106 * @task: task to query (NOT NULL) 107 * 108 * Returns: @task's profile without incrementing its ref count 109 * 110 * If @task != current needs to be called in RCU safe critical section 111 */ __aa_task_profile(struct task_struct * task)112static inline struct aa_profile *__aa_task_profile(struct task_struct *task) 113 { 114 return aa_cred_profile(__task_cred(task)); 115 } 116 117 /** 118 * __aa_task_is_confined - determine if @task has any confinement 119 * @task: task to check confinement of (NOT NULL) 120 * 121 * If @task != current needs to be called in RCU safe critical section 122 */ __aa_task_is_confined(struct task_struct * task)123static inline bool __aa_task_is_confined(struct task_struct *task) 124 { 125 return !unconfined(__aa_task_profile(task)); 126 } 127 128 /** 129 * __aa_current_profile - find the current tasks confining profile 130 * 131 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL) 132 * 133 * This fn will not update the tasks cred to the most up to date version 134 * of the profile so it is safe to call when inside of locks. 135 */ __aa_current_profile(void)136static inline struct aa_profile *__aa_current_profile(void) 137 { 138 return aa_cred_profile(current_cred()); 139 } 140 141 /** 142 * aa_current_profile - find the current tasks confining profile and do updates 143 * 144 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL) 145 * 146 * This fn will update the tasks cred structure if the profile has been 147 * replaced. Not safe to call inside locks 148 */ aa_current_profile(void)149static inline struct aa_profile *aa_current_profile(void) 150 { 151 const struct aa_task_cxt *cxt = current_cxt(); 152 struct aa_profile *profile; 153 BUG_ON(!cxt || !cxt->profile); 154 155 if (PROFILE_INVALID(cxt->profile)) { 156 profile = aa_get_newest_profile(cxt->profile); 157 aa_replace_current_profile(profile); 158 aa_put_profile(profile); 159 cxt = current_cxt(); 160 } 161 162 return cxt->profile; 163 } 164 165 /** 166 * aa_clear_task_cxt_trans - clear transition tracking info from the cxt 167 * @cxt: task context to clear (NOT NULL) 168 */ aa_clear_task_cxt_trans(struct aa_task_cxt * cxt)169static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt) 170 { 171 aa_put_profile(cxt->previous); 172 aa_put_profile(cxt->onexec); 173 cxt->previous = NULL; 174 cxt->onexec = NULL; 175 cxt->token = 0; 176 } 177 178 #endif /* __AA_CONTEXT_H */ 179