Loading...
1/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor task related definitions and mediation
5 *
6 * Copyright 2017 Canonical Ltd.
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
11 * License.
12 */
13
14#ifndef __AA_TASK_H
15#define __AA_TASK_H
16
17#define task_ctx(X) ((X)->security)
18
19/*
20 * struct aa_task_ctx - information for current task label change
21 * @nnp: snapshot of label at time of no_new_privs
22 * @onexec: profile to transition to on next exec (MAY BE NULL)
23 * @previous: profile the task may return to (MAY BE NULL)
24 * @token: magic value the task must know for returning to @previous_profile
25 */
26struct aa_task_ctx {
27 struct aa_label *nnp;
28 struct aa_label *onexec;
29 struct aa_label *previous;
30 u64 token;
31};
32
33int aa_replace_current_label(struct aa_label *label);
34int aa_set_current_onexec(struct aa_label *label, bool stack);
35int aa_set_current_hat(struct aa_label *label, u64 token);
36int aa_restore_previous_label(u64 cookie);
37struct aa_label *aa_get_task_label(struct task_struct *task);
38
39/**
40 * aa_alloc_task_ctx - allocate a new task_ctx
41 * @flags: gfp flags for allocation
42 *
43 * Returns: allocated buffer or NULL on failure
44 */
45static inline struct aa_task_ctx *aa_alloc_task_ctx(gfp_t flags)
46{
47 return kzalloc(sizeof(struct aa_task_ctx), flags);
48}
49
50/**
51 * aa_free_task_ctx - free a task_ctx
52 * @ctx: task_ctx to free (MAYBE NULL)
53 */
54static inline void aa_free_task_ctx(struct aa_task_ctx *ctx)
55{
56 if (ctx) {
57 aa_put_label(ctx->nnp);
58 aa_put_label(ctx->previous);
59 aa_put_label(ctx->onexec);
60
61 kzfree(ctx);
62 }
63}
64
65/**
66 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts
67 * @new: a blank task context (NOT NULL)
68 * @old: the task context to copy (NOT NULL)
69 */
70static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
71 const struct aa_task_ctx *old)
72{
73 *new = *old;
74 aa_get_label(new->nnp);
75 aa_get_label(new->previous);
76 aa_get_label(new->onexec);
77}
78
79/**
80 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
81 * @ctx: task context to clear (NOT NULL)
82 */
83static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
84{
85 AA_BUG(!ctx);
86
87 aa_put_label(ctx->previous);
88 aa_put_label(ctx->onexec);
89 ctx->previous = NULL;
90 ctx->onexec = NULL;
91 ctx->token = 0;
92}
93
94#endif /* __AA_TASK_H */
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor task related definitions and mediation
6 *
7 * Copyright 2017 Canonical Ltd.
8 */
9
10#ifndef __AA_TASK_H
11#define __AA_TASK_H
12
13static inline struct aa_task_ctx *task_ctx(struct task_struct *task)
14{
15 return task->security + apparmor_blob_sizes.lbs_task;
16}
17
18/*
19 * struct aa_task_ctx - information for current task label change
20 * @nnp: snapshot of label at time of no_new_privs
21 * @onexec: profile to transition to on next exec (MAY BE NULL)
22 * @previous: profile the task may return to (MAY BE NULL)
23 * @token: magic value the task must know for returning to @previous_profile
24 */
25struct aa_task_ctx {
26 struct aa_label *nnp;
27 struct aa_label *onexec;
28 struct aa_label *previous;
29 u64 token;
30};
31
32int aa_replace_current_label(struct aa_label *label);
33void aa_set_current_onexec(struct aa_label *label, bool stack);
34int aa_set_current_hat(struct aa_label *label, u64 token);
35int aa_restore_previous_label(u64 cookie);
36struct aa_label *aa_get_task_label(struct task_struct *task);
37
38/**
39 * aa_free_task_ctx - free a task_ctx
40 * @ctx: task_ctx to free (MAYBE NULL)
41 */
42static inline void aa_free_task_ctx(struct aa_task_ctx *ctx)
43{
44 if (ctx) {
45 aa_put_label(ctx->nnp);
46 aa_put_label(ctx->previous);
47 aa_put_label(ctx->onexec);
48 }
49}
50
51/**
52 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts
53 * @new: a blank task context (NOT NULL)
54 * @old: the task context to copy (NOT NULL)
55 */
56static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
57 const struct aa_task_ctx *old)
58{
59 *new = *old;
60 aa_get_label(new->nnp);
61 aa_get_label(new->previous);
62 aa_get_label(new->onexec);
63}
64
65/**
66 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
67 * @ctx: task context to clear (NOT NULL)
68 */
69static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
70{
71 AA_BUG(!ctx);
72
73 aa_put_label(ctx->previous);
74 aa_put_label(ctx->onexec);
75 ctx->previous = NULL;
76 ctx->onexec = NULL;
77 ctx->token = 0;
78}
79
80#define AA_PTRACE_TRACE MAY_WRITE
81#define AA_PTRACE_READ MAY_READ
82#define AA_MAY_BE_TRACED AA_MAY_APPEND
83#define AA_MAY_BE_READ AA_MAY_CREATE
84#define PTRACE_PERM_SHIFT 2
85
86#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
87 AA_MAY_BE_READ | AA_MAY_BE_TRACED)
88#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
89
90#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
91 "segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
92 "xcpu xfsz vtalrm prof winch io pwr sys emt lost"
93
94int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer,
95 const struct cred *tracee_cred, struct aa_label *tracee,
96 u32 request);
97
98
99
100#define AA_USERNS_CREATE 8
101
102int aa_profile_ns_perm(struct aa_profile *profile,
103 struct apparmor_audit_data *ad, u32 request);
104
105#endif /* __AA_TASK_H */