Linux Audio

Check our new training course

Loading...
Note: File does not exist in v5.4.
  1/*
  2 * AppArmor security module
  3 *
  4 * This file contains AppArmor contexts used to associate "labels" to objects.
  5 *
  6 * Copyright (C) 1998-2008 Novell/SUSE
  7 * Copyright 2009-2010 Canonical Ltd.
  8 *
  9 * This program is free software; you can redistribute it and/or
 10 * modify it under the terms of the GNU General Public License as
 11 * published by the Free Software Foundation, version 2 of the
 12 * License.
 13 */
 14
 15#ifndef __AA_CONTEXT_H
 16#define __AA_CONTEXT_H
 17
 18#include <linux/cred.h>
 19#include <linux/slab.h>
 20#include <linux/sched.h>
 21
 22#include "policy.h"
 23
 24#define cred_cxt(X) (X)->security
 25#define current_cxt() cred_cxt(current_cred())
 26
 27/* struct aa_file_cxt - the AppArmor context the file was opened in
 28 * @perms: the permission the file was opened with
 29 *
 30 * The file_cxt could currently be directly stored in file->f_security
 31 * as the profile reference is now stored in the f_cred.  However the
 32 * cxt struct will expand in the future so we keep the struct.
 33 */
 34struct aa_file_cxt {
 35	u16 allow;
 36};
 37
 38/**
 39 * aa_alloc_file_context - allocate file_cxt
 40 * @gfp: gfp flags for allocation
 41 *
 42 * Returns: file_cxt or NULL on failure
 43 */
 44static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
 45{
 46	return kzalloc(sizeof(struct aa_file_cxt), gfp);
 47}
 48
 49/**
 50 * aa_free_file_context - free a file_cxt
 51 * @cxt: file_cxt to free  (MAYBE_NULL)
 52 */
 53static inline void aa_free_file_context(struct aa_file_cxt *cxt)
 54{
 55	if (cxt)
 56		kzfree(cxt);
 57}
 58
 59/**
 60 * struct aa_task_cxt - primary label for confined tasks
 61 * @profile: the current profile   (NOT NULL)
 62 * @exec: profile to transition to on next exec  (MAYBE NULL)
 63 * @previous: profile the task may return to     (MAYBE NULL)
 64 * @token: magic value the task must know for returning to @previous_profile
 65 *
 66 * Contains the task's current profile (which could change due to
 67 * change_hat).  Plus the hat_magic needed during change_hat.
 68 *
 69 * TODO: make so a task can be confined by a stack of contexts
 70 */
 71struct aa_task_cxt {
 72	struct aa_profile *profile;
 73	struct aa_profile *onexec;
 74	struct aa_profile *previous;
 75	u64 token;
 76};
 77
 78struct aa_task_cxt *aa_alloc_task_context(gfp_t flags);
 79void aa_free_task_context(struct aa_task_cxt *cxt);
 80void aa_dup_task_context(struct aa_task_cxt *new,
 81			 const struct aa_task_cxt *old);
 82int aa_replace_current_profile(struct aa_profile *profile);
 83int aa_set_current_onexec(struct aa_profile *profile);
 84int aa_set_current_hat(struct aa_profile *profile, u64 token);
 85int aa_restore_previous_profile(u64 cookie);
 86struct aa_profile *aa_get_task_profile(struct task_struct *task);
 87
 88
 89/**
 90 * aa_cred_profile - obtain cred's profiles
 91 * @cred: cred to obtain profiles from  (NOT NULL)
 92 *
 93 * Returns: confining profile
 94 *
 95 * does NOT increment reference count
 96 */
 97static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
 98{
 99	struct aa_task_cxt *cxt = cred_cxt(cred);
100	BUG_ON(!cxt || !cxt->profile);
101	return cxt->profile;
102}
103
104/**
105 * __aa_task_profile - retrieve another task's profile
106 * @task: task to query  (NOT NULL)
107 *
108 * Returns: @task's profile without incrementing its ref count
109 *
110 * If @task != current needs to be called in RCU safe critical section
111 */
112static inline struct aa_profile *__aa_task_profile(struct task_struct *task)
113{
114	return aa_cred_profile(__task_cred(task));
115}
116
117/**
118 * __aa_task_is_confined - determine if @task has any confinement
119 * @task: task to check confinement of  (NOT NULL)
120 *
121 * If @task != current needs to be called in RCU safe critical section
122 */
123static inline bool __aa_task_is_confined(struct task_struct *task)
124{
125	return !unconfined(__aa_task_profile(task));
126}
127
128/**
129 * __aa_current_profile - find the current tasks confining profile
130 *
131 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
132 *
133 * This fn will not update the tasks cred to the most up to date version
134 * of the profile so it is safe to call when inside of locks.
135 */
136static inline struct aa_profile *__aa_current_profile(void)
137{
138	return aa_cred_profile(current_cred());
139}
140
141/**
142 * aa_current_profile - find the current tasks confining profile and do updates
143 *
144 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
145 *
146 * This fn will update the tasks cred structure if the profile has been
147 * replaced.  Not safe to call inside locks
148 */
149static inline struct aa_profile *aa_current_profile(void)
150{
151	const struct aa_task_cxt *cxt = current_cxt();
152	struct aa_profile *profile;
153	BUG_ON(!cxt || !cxt->profile);
154
155	if (PROFILE_INVALID(cxt->profile)) {
156		profile = aa_get_newest_profile(cxt->profile);
157		aa_replace_current_profile(profile);
158		aa_put_profile(profile);
159		cxt = current_cxt();
160	}
161
162	return cxt->profile;
163}
164
165/**
166 * aa_clear_task_cxt_trans - clear transition tracking info from the cxt
167 * @cxt: task context to clear (NOT NULL)
168 */
169static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt)
170{
171	aa_put_profile(cxt->previous);
172	aa_put_profile(cxt->onexec);
173	cxt->previous = NULL;
174	cxt->onexec = NULL;
175	cxt->token = 0;
176}
177
178#endif /* __AA_CONTEXT_H */