1/* SPDX-License-Identifier: GPL-2.0-only */
 2/*
 3 * AppArmor security module
 4 *
 5 * This file contains AppArmor task related definitions and mediation
 6 *
 7 * Copyright 2017 Canonical Ltd.
 8 */
 9
10#ifndef __AA_TASK_H
11#define __AA_TASK_H
12
13static inline struct aa_task_ctx *task_ctx(struct task_struct *task)
14{
15	return task->security + apparmor_blob_sizes.lbs_task;
16}
17
18/*
19 * struct aa_task_ctx - information for current task label change
20 * @nnp: snapshot of label at time of no_new_privs
21 * @onexec: profile to transition to on next exec  (MAY BE NULL)
22 * @previous: profile the task may return to     (MAY BE NULL)
23 * @token: magic value the task must know for returning to @previous_profile
24 */
25struct aa_task_ctx {
26	struct aa_label *nnp;
27	struct aa_label *onexec;
28	struct aa_label *previous;
29	u64 token;
30};
31
32int aa_replace_current_label(struct aa_label *label);
33int aa_set_current_onexec(struct aa_label *label, bool stack);
34int aa_set_current_hat(struct aa_label *label, u64 token);
35int aa_restore_previous_label(u64 cookie);
36struct aa_label *aa_get_task_label(struct task_struct *task);
37
38/**
39 * aa_free_task_ctx - free a task_ctx
40 * @ctx: task_ctx to free (MAYBE NULL)
41 */
42static inline void aa_free_task_ctx(struct aa_task_ctx *ctx)
43{
44	if (ctx) {
45		aa_put_label(ctx->nnp);
46		aa_put_label(ctx->previous);
47		aa_put_label(ctx->onexec);
48	}
49}
50
51/**
52 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts
53 * @new: a blank task context      (NOT NULL)
54 * @old: the task context to copy  (NOT NULL)
55 */
56static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
57				   const struct aa_task_ctx *old)
58{
59	*new = *old;
60	aa_get_label(new->nnp);
61	aa_get_label(new->previous);
62	aa_get_label(new->onexec);
63}
64
65/**
66 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
67 * @ctx: task context to clear (NOT NULL)
68 */
69static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
70{
71	AA_BUG(!ctx);
72
73	aa_put_label(ctx->previous);
74	aa_put_label(ctx->onexec);
75	ctx->previous = NULL;
76	ctx->onexec = NULL;
77	ctx->token = 0;
78}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
79
80#endif /* __AA_TASK_H */

  1/* SPDX-License-Identifier: GPL-2.0-only */
  2/*
  3 * AppArmor security module
  4 *
  5 * This file contains AppArmor task related definitions and mediation
  6 *
  7 * Copyright 2017 Canonical Ltd.
  8 */
  9
 10#ifndef __AA_TASK_H
 11#define __AA_TASK_H
 12
 13static inline struct aa_task_ctx *task_ctx(struct task_struct *task)
 14{
 15	return task->security + apparmor_blob_sizes.lbs_task;
 16}
 17
 18/*
 19 * struct aa_task_ctx - information for current task label change
 20 * @nnp: snapshot of label at time of no_new_privs
 21 * @onexec: profile to transition to on next exec  (MAY BE NULL)
 22 * @previous: profile the task may return to     (MAY BE NULL)
 23 * @token: magic value the task must know for returning to @previous_profile
 24 */
 25struct aa_task_ctx {
 26	struct aa_label *nnp;
 27	struct aa_label *onexec;
 28	struct aa_label *previous;
 29	u64 token;
 30};
 31
 32int aa_replace_current_label(struct aa_label *label);
 33void aa_set_current_onexec(struct aa_label *label, bool stack);
 34int aa_set_current_hat(struct aa_label *label, u64 token);
 35int aa_restore_previous_label(u64 cookie);
 36struct aa_label *aa_get_task_label(struct task_struct *task);
 37
 38/**
 39 * aa_free_task_ctx - free a task_ctx
 40 * @ctx: task_ctx to free (MAYBE NULL)
 41 */
 42static inline void aa_free_task_ctx(struct aa_task_ctx *ctx)
 43{
 44	if (ctx) {
 45		aa_put_label(ctx->nnp);
 46		aa_put_label(ctx->previous);
 47		aa_put_label(ctx->onexec);
 48	}
 49}
 50
 51/**
 52 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts
 53 * @new: a blank task context      (NOT NULL)
 54 * @old: the task context to copy  (NOT NULL)
 55 */
 56static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
 57				   const struct aa_task_ctx *old)
 58{
 59	*new = *old;
 60	aa_get_label(new->nnp);
 61	aa_get_label(new->previous);
 62	aa_get_label(new->onexec);
 63}
 64
 65/**
 66 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
 67 * @ctx: task context to clear (NOT NULL)
 68 */
 69static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
 70{
 71	AA_BUG(!ctx);
 72
 73	aa_put_label(ctx->previous);
 74	aa_put_label(ctx->onexec);
 75	ctx->previous = NULL;
 76	ctx->onexec = NULL;
 77	ctx->token = 0;
 78}
 79
 80#define AA_PTRACE_TRACE		MAY_WRITE
 81#define AA_PTRACE_READ		MAY_READ
 82#define AA_MAY_BE_TRACED	AA_MAY_APPEND
 83#define AA_MAY_BE_READ		AA_MAY_CREATE
 84#define PTRACE_PERM_SHIFT	2
 85
 86#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
 87			     AA_MAY_BE_READ | AA_MAY_BE_TRACED)
 88#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
 89
 90#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
 91	"segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
 92	"xcpu xfsz vtalrm prof winch io pwr sys emt lost"
 93
 94int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer,
 95		  const struct cred *tracee_cred, struct aa_label *tracee,
 96		  u32 request);
 97
 98
 99
100#define AA_USERNS_CREATE	8
101
102int aa_profile_ns_perm(struct aa_profile *profile,
103		       struct apparmor_audit_data *ad, u32 request);
104
105#endif /* __AA_TASK_H */