230 lines
6.3 KiB
C
230 lines
6.3 KiB
C
/*
|
|
* AppArmor security module
|
|
*
|
|
* This file contains AppArmor contexts used to associate "labels" to objects.
|
|
*
|
|
* Copyright (C) 1998-2008 Novell/SUSE
|
|
* Copyright 2009-2010 Canonical Ltd.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation, version 2 of the
|
|
* License.
|
|
*/
|
|
|
|
#ifndef __AA_CONTEXT_H
|
|
#define __AA_CONTEXT_H
|
|
|
|
#include <linux/cred.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/sched.h>
|
|
|
|
#include "label.h"
|
|
#include "policy_ns.h"
|
|
|
|
#define cred_ctx(X) ((X)->security)
|
|
#define current_ctx() cred_ctx(current_cred())
|
|
|
|
/**
|
|
* struct aa_task_ctx - primary label for confined tasks
|
|
* @label: the current label (NOT NULL)
|
|
* @exec: label to transition to on next exec (MAYBE NULL)
|
|
* @previous: label the task may return to (MAYBE NULL)
|
|
* @token: magic value the task must know for returning to @previous
|
|
*
|
|
* Contains the task's current label (which could change due to
|
|
* change_hat). Plus the hat_magic needed during change_hat.
|
|
*
|
|
* TODO: make so a task can be confined by a stack of contexts
|
|
*/
|
|
struct aa_task_ctx {
|
|
struct aa_label *label;
|
|
struct aa_label *onexec;
|
|
struct aa_label *previous;
|
|
u64 token;
|
|
};
|
|
|
|
struct aa_task_ctx *aa_alloc_task_context(gfp_t flags);
|
|
void aa_free_task_context(struct aa_task_ctx *ctx);
|
|
void aa_dup_task_context(struct aa_task_ctx *new,
|
|
const struct aa_task_ctx *old);
|
|
int aa_replace_current_label(struct aa_label *label);
|
|
int aa_set_current_onexec(struct aa_label *label, bool stack);
|
|
int aa_set_current_hat(struct aa_label *label, u64 token);
|
|
int aa_restore_previous_label(u64 cookie);
|
|
struct aa_label *aa_get_task_label(struct task_struct *task);
|
|
|
|
|
|
/**
|
|
* aa_cred_raw_label - obtain cred's label
|
|
* @cred: cred to obtain label from (NOT NULL)
|
|
*
|
|
* Returns: confining label
|
|
*
|
|
* does NOT increment reference count
|
|
*/
|
|
static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
|
|
{
|
|
struct aa_task_ctx *ctx = cred_ctx(cred);
|
|
|
|
AA_BUG(!ctx || !ctx->label);
|
|
return ctx->label;
|
|
}
|
|
|
|
/**
|
|
* aa_get_newest_cred_label - obtain the newest label on a cred
|
|
* @cred: cred to obtain label from (NOT NULL)
|
|
*
|
|
* Returns: newest version of confining label
|
|
*/
|
|
static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
|
|
{
|
|
return aa_get_newest_label(aa_cred_raw_label(cred));
|
|
}
|
|
|
|
/**
|
|
* __aa_task_raw_label - retrieve another task's label
|
|
* @task: task to query (NOT NULL)
|
|
*
|
|
* Returns: @task's label without incrementing its ref count
|
|
*
|
|
* If @task != current needs to be called in RCU safe critical section
|
|
*/
|
|
static inline struct aa_label *__aa_task_raw_label(struct task_struct *task)
|
|
{
|
|
return aa_cred_raw_label(__task_cred(task));
|
|
}
|
|
|
|
/**
|
|
* __aa_task_is_confined - determine if @task has any confinement
|
|
* @task: task to check confinement of (NOT NULL)
|
|
*
|
|
* If @task != current needs to be called in RCU safe critical section
|
|
*/
|
|
static inline bool __aa_task_is_confined(struct task_struct *task)
|
|
{
|
|
return !unconfined(__aa_task_raw_label(task));
|
|
}
|
|
|
|
/**
|
|
* aa_current_raw_label - find the current tasks confining label
|
|
*
|
|
* Returns: up to date confining label or the ns unconfined label (NOT NULL)
|
|
*
|
|
* This fn will not update the tasks cred to the most up to date version
|
|
* of the label so it is safe to call when inside of locks.
|
|
*/
|
|
static inline struct aa_label *aa_current_raw_label(void)
|
|
{
|
|
return aa_cred_raw_label(current_cred());
|
|
}
|
|
|
|
/**
|
|
* aa_get_current_label - get the newest version of the current tasks label
|
|
*
|
|
* Returns: newest version of confining label (NOT NULL)
|
|
*
|
|
* This fn will not update the tasks cred, so it is safe inside of locks
|
|
*
|
|
* The returned reference must be put with aa_put_label()
|
|
*/
|
|
static inline struct aa_label *aa_get_current_label(void)
|
|
{
|
|
struct aa_label *l = aa_current_raw_label();
|
|
|
|
if (label_is_stale(l))
|
|
return aa_get_newest_label(l);
|
|
return aa_get_label(l);
|
|
}
|
|
|
|
#define __end_current_label_crit_section(X) end_current_label_crit_section(X)
|
|
|
|
/**
|
|
* end_label_crit_section - put a reference found with begin_current_label..
|
|
* @label: label reference to put
|
|
*
|
|
* Should only be used with a reference obtained with
|
|
* begin_current_label_crit_section and never used in situations where the
|
|
* task cred may be updated
|
|
*/
|
|
static inline void end_current_label_crit_section(struct aa_label *label)
|
|
{
|
|
if (label != aa_current_raw_label())
|
|
aa_put_label(label);
|
|
}
|
|
|
|
/**
|
|
* __begin_current_label_crit_section - current's confining label
|
|
*
|
|
* Returns: up to date confining label or the ns unconfined label (NOT NULL)
|
|
*
|
|
* safe to call inside locks
|
|
*
|
|
* The returned reference must be put with __end_current_label_crit_section()
|
|
* This must NOT be used if the task cred could be updated within the
|
|
* critical section between __begin_current_label_crit_section() ..
|
|
* __end_current_label_crit_section()
|
|
*/
|
|
static inline struct aa_label *__begin_current_label_crit_section(void)
|
|
{
|
|
struct aa_label *label = aa_current_raw_label();
|
|
|
|
if (label_is_stale(label))
|
|
label = aa_get_newest_label(label);
|
|
|
|
return label;
|
|
}
|
|
|
|
/**
|
|
* begin_current_label_crit_section - current's confining label and update it
|
|
*
|
|
* Returns: up to date confining label or the ns unconfined label (NOT NULL)
|
|
*
|
|
* Not safe to call inside locks
|
|
*
|
|
* The returned reference must be put with end_current_label_crit_section()
|
|
* This must NOT be used if the task cred could be updated within the
|
|
* critical section between begin_current_label_crit_section() ..
|
|
* end_current_label_crit_section()
|
|
*/
|
|
static inline struct aa_label *begin_current_label_crit_section(void)
|
|
{
|
|
struct aa_label *label = aa_current_raw_label();
|
|
|
|
if (label_is_stale(label)) {
|
|
label = aa_get_newest_label(label);
|
|
if (aa_replace_current_label(label) == 0)
|
|
/* task cred will keep the reference */
|
|
aa_put_label(label);
|
|
}
|
|
|
|
return label;
|
|
}
|
|
|
|
static inline struct aa_ns *aa_get_current_ns(void)
|
|
{
|
|
struct aa_label *label;
|
|
struct aa_ns *ns;
|
|
|
|
label = __begin_current_label_crit_section();
|
|
ns = aa_get_ns(labels_ns(label));
|
|
__end_current_label_crit_section(label);
|
|
|
|
return ns;
|
|
}
|
|
|
|
/**
|
|
* aa_clear_task_ctx_trans - clear transition tracking info from the ctx
|
|
* @ctx: task context to clear (NOT NULL)
|
|
*/
|
|
static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
|
|
{
|
|
aa_put_label(ctx->previous);
|
|
aa_put_label(ctx->onexec);
|
|
ctx->previous = NULL;
|
|
ctx->onexec = NULL;
|
|
ctx->token = 0;
|
|
}
|
|
|
|
#endif /* __AA_CONTEXT_H */
|