blob: 6bf65798e5d145e985a65f674273db20472ece67 [file] [log] [blame]
John Johansenc75afcd2010-07-29 14:47:59 -07001/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor contexts used to associate "labels" to objects.
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 */
14
15#ifndef __AA_CONTEXT_H
16#define __AA_CONTEXT_H
17
18#include <linux/cred.h>
19#include <linux/slab.h>
20#include <linux/sched.h>
21
22#include "policy.h"
23
John Johansen214beac2013-02-27 03:43:40 -080024#define cred_cxt(X) (X)->security
25#define current_cxt() cred_cxt(current_cred())
26
John Johansenc75afcd2010-07-29 14:47:59 -070027/* struct aa_file_cxt - the AppArmor context the file was opened in
28 * @perms: the permission the file was opened with
29 *
30 * The file_cxt could currently be directly stored in file->f_security
31 * as the profile reference is now stored in the f_cred. However the
32 * cxt struct will expand in the future so we keep the struct.
33 */
34struct aa_file_cxt {
35 u16 allow;
36};
37
38/**
39 * aa_alloc_file_context - allocate file_cxt
40 * @gfp: gfp flags for allocation
41 *
42 * Returns: file_cxt or NULL on failure
43 */
44static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
45{
46 return kzalloc(sizeof(struct aa_file_cxt), gfp);
47}
48
49/**
50 * aa_free_file_context - free a file_cxt
51 * @cxt: file_cxt to free (MAYBE_NULL)
52 */
53static inline void aa_free_file_context(struct aa_file_cxt *cxt)
54{
55 if (cxt)
56 kzfree(cxt);
57}
58
59/**
60 * struct aa_task_cxt - primary label for confined tasks
61 * @profile: the current profile (NOT NULL)
62 * @exec: profile to transition to on next exec (MAYBE NULL)
63 * @previous: profile the task may return to (MAYBE NULL)
64 * @token: magic value the task must know for returning to @previous_profile
65 *
66 * Contains the task's current profile (which could change due to
67 * change_hat). Plus the hat_magic needed during change_hat.
68 *
69 * TODO: make so a task can be confined by a stack of contexts
70 */
71struct aa_task_cxt {
72 struct aa_profile *profile;
73 struct aa_profile *onexec;
74 struct aa_profile *previous;
75 u64 token;
76};
77
78struct aa_task_cxt *aa_alloc_task_context(gfp_t flags);
79void aa_free_task_context(struct aa_task_cxt *cxt);
80void aa_dup_task_context(struct aa_task_cxt *new,
81 const struct aa_task_cxt *old);
82int aa_replace_current_profile(struct aa_profile *profile);
83int aa_set_current_onexec(struct aa_profile *profile);
84int aa_set_current_hat(struct aa_profile *profile, u64 token);
85int aa_restore_previous_profile(u64 cookie);
John Johansen3cfcc192013-02-18 16:03:34 -080086struct aa_profile *aa_get_task_profile(struct task_struct *task);
John Johansenc75afcd2010-07-29 14:47:59 -070087
John Johansenc75afcd2010-07-29 14:47:59 -070088
89/**
90 * aa_cred_profile - obtain cred's profiles
91 * @cred: cred to obtain profiles from (NOT NULL)
92 *
93 * Returns: confining profile
94 *
95 * does NOT increment reference count
96 */
97static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
98{
John Johansen214beac2013-02-27 03:43:40 -080099 struct aa_task_cxt *cxt = cred_cxt(cred);
John Johansenc75afcd2010-07-29 14:47:59 -0700100 BUG_ON(!cxt || !cxt->profile);
John Johansen77b071b2013-07-10 21:07:43 -0700101 return cxt->profile;
John Johansenc75afcd2010-07-29 14:47:59 -0700102}
103
104/**
John Johansen3cfcc192013-02-18 16:03:34 -0800105 * __aa_task_profile - retrieve another task's profile
106 * @task: task to query (NOT NULL)
107 *
108 * Returns: @task's profile without incrementing its ref count
109 *
110 * If @task != current needs to be called in RCU safe critical section
111 */
112static inline struct aa_profile *__aa_task_profile(struct task_struct *task)
113{
114 return aa_cred_profile(__task_cred(task));
115}
116
117/**
118 * __aa_task_is_confined - determine if @task has any confinement
119 * @task: task to check confinement of (NOT NULL)
120 *
121 * If @task != current needs to be called in RCU safe critical section
122 */
123static inline bool __aa_task_is_confined(struct task_struct *task)
124{
125 return !unconfined(__aa_task_profile(task));
126}
127
128/**
John Johansenc75afcd2010-07-29 14:47:59 -0700129 * __aa_current_profile - find the current tasks confining profile
130 *
131 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
132 *
133 * This fn will not update the tasks cred to the most up to date version
134 * of the profile so it is safe to call when inside of locks.
135 */
136static inline struct aa_profile *__aa_current_profile(void)
137{
138 return aa_cred_profile(current_cred());
139}
140
141/**
142 * aa_current_profile - find the current tasks confining profile and do updates
143 *
144 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
145 *
146 * This fn will update the tasks cred structure if the profile has been
147 * replaced. Not safe to call inside locks
148 */
149static inline struct aa_profile *aa_current_profile(void)
150{
John Johansen214beac2013-02-27 03:43:40 -0800151 const struct aa_task_cxt *cxt = current_cxt();
John Johansenc75afcd2010-07-29 14:47:59 -0700152 struct aa_profile *profile;
153 BUG_ON(!cxt || !cxt->profile);
154
John Johansen77b071b2013-07-10 21:07:43 -0700155 if (PROFILE_INVALID(cxt->profile)) {
156 profile = aa_get_newest_profile(cxt->profile);
John Johansenc75afcd2010-07-29 14:47:59 -0700157 aa_replace_current_profile(profile);
John Johansen77b071b2013-07-10 21:07:43 -0700158 aa_put_profile(profile);
159 cxt = current_cxt();
160 }
John Johansenc75afcd2010-07-29 14:47:59 -0700161
John Johansen77b071b2013-07-10 21:07:43 -0700162 return cxt->profile;
John Johansenc75afcd2010-07-29 14:47:59 -0700163}
164
John Johansen7a2871b2013-02-18 16:05:34 -0800165/**
166 * aa_clear_task_cxt_trans - clear transition tracking info from the cxt
167 * @cxt: task context to clear (NOT NULL)
168 */
169static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt)
170{
171 aa_put_profile(cxt->previous);
172 aa_put_profile(cxt->onexec);
173 cxt->previous = NULL;
174 cxt->onexec = NULL;
175 cxt->token = 0;
176}
177
John Johansenc75afcd2010-07-29 14:47:59 -0700178#endif /* __AA_CONTEXT_H */