LXR linux/security/apparmor/include/context.h

   1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor contexts used to associate "labels" to objects.
   5 *
   6 * Copyright (C) 1998-2008 Novell/SUSE
   7 * Copyright 2009-2010 Canonical Ltd.
   8 *
   9 * This program is free software; you can redistribute it and/or
  10 * modify it under the terms of the GNU General Public License as
  11 * published by the Free Software Foundation, version 2 of the
  12 * License.
  13 */
  14
  15#ifndef __AA_CONTEXT_H
  16#define __AA_CONTEXT_H
  17
  18#include <linux/cred.h>
  19#include <linux/slab.h>
  20#include <linux/sched.h>
  21
  22#include "policy.h"
  23
  24#define cred_cxt(X) (X)->security
  25#define current_cxt() cred_cxt(current_cred())
  26
  27/* struct aa_file_cxt - the AppArmor context the file was opened in
  28 * @perms: the permission the file was opened with
  29 *
  30 * The file_cxt could currently be directly stored in file->f_security
  31 * as the profile reference is now stored in the f_cred.  However the
  32 * cxt struct will expand in the future so we keep the struct.
  33 */
  34struct aa_file_cxt {
  35        u16 allow;
  36};
  37
  38/**
  39 * aa_alloc_file_context - allocate file_cxt
  40 * @gfp: gfp flags for allocation
  41 *
  42 * Returns: file_cxt or NULL on failure
  43 */
  44static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
  45{
  46        return kzalloc(sizeof(struct aa_file_cxt), gfp);
  47}
  48
  49/**
  50 * aa_free_file_context - free a file_cxt
  51 * @cxt: file_cxt to free  (MAYBE_NULL)
  52 */
  53static inline void aa_free_file_context(struct aa_file_cxt *cxt)
  54{
  55        if (cxt)
  56                kzfree(cxt);
  57}
  58
  59/**
  60 * struct aa_task_cxt - primary label for confined tasks
  61 * @profile: the current profile   (NOT NULL)
  62 * @exec: profile to transition to on next exec  (MAYBE NULL)
  63 * @previous: profile the task may return to     (MAYBE NULL)
  64 * @token: magic value the task must know for returning to @previous_profile
  65 *
  66 * Contains the task's current profile (which could change due to
  67 * change_hat).  Plus the hat_magic needed during change_hat.
  68 *
  69 * TODO: make so a task can be confined by a stack of contexts
  70 */
  71struct aa_task_cxt {
  72        struct aa_profile *profile;
  73        struct aa_profile *onexec;
  74        struct aa_profile *previous;
  75        u64 token;
  76};
  77
  78struct aa_task_cxt *aa_alloc_task_context(gfp_t flags);
  79void aa_free_task_context(struct aa_task_cxt *cxt);
  80void aa_dup_task_context(struct aa_task_cxt *new,
  81                         const struct aa_task_cxt *old);
  82int aa_replace_current_profile(struct aa_profile *profile);
  83int aa_set_current_onexec(struct aa_profile *profile);
  84int aa_set_current_hat(struct aa_profile *profile, u64 token);
  85int aa_restore_previous_profile(u64 cookie);
  86struct aa_profile *aa_get_task_profile(struct task_struct *task);
  87
  88
  89/**
  90 * aa_cred_profile - obtain cred's profiles
  91 * @cred: cred to obtain profiles from  (NOT NULL)
  92 *
  93 * Returns: confining profile
  94 *
  95 * does NOT increment reference count
  96 */
  97static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
  98{
  99        struct aa_task_cxt *cxt = cred_cxt(cred);
 100        BUG_ON(!cxt || !cxt->profile);
 101        return cxt->profile;
 102}
 103
 104/**
 105 * __aa_task_profile - retrieve another task's profile
 106 * @task: task to query  (NOT NULL)
 107 *
 108 * Returns: @task's profile without incrementing its ref count
 109 *
 110 * If @task != current needs to be called in RCU safe critical section
 111 */
 112static inline struct aa_profile *__aa_task_profile(struct task_struct *task)
 113{
 114        return aa_cred_profile(__task_cred(task));
 115}
 116
 117/**
 118 * __aa_task_is_confined - determine if @task has any confinement
 119 * @task: task to check confinement of  (NOT NULL)
 120 *
 121 * If @task != current needs to be called in RCU safe critical section
 122 */
 123static inline bool __aa_task_is_confined(struct task_struct *task)
 124{
 125        return !unconfined(__aa_task_profile(task));
 126}
 127
 128/**
 129 * __aa_current_profile - find the current tasks confining profile
 130 *
 131 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
 132 *
 133 * This fn will not update the tasks cred to the most up to date version
 134 * of the profile so it is safe to call when inside of locks.
 135 */
 136static inline struct aa_profile *__aa_current_profile(void)
 137{
 138        return aa_cred_profile(current_cred());
 139}
 140
 141/**
 142 * aa_current_profile - find the current tasks confining profile and do updates
 143 *
 144 * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
 145 *
 146 * This fn will update the tasks cred structure if the profile has been
 147 * replaced.  Not safe to call inside locks
 148 */
 149static inline struct aa_profile *aa_current_profile(void)
 150{
 151        const struct aa_task_cxt *cxt = current_cxt();
 152        struct aa_profile *profile;
 153        BUG_ON(!cxt || !cxt->profile);
 154
 155        if (PROFILE_INVALID(cxt->profile)) {
 156                profile = aa_get_newest_profile(cxt->profile);
 157                aa_replace_current_profile(profile);
 158                aa_put_profile(profile);
 159                cxt = current_cxt();
 160        }
 161
 162        return cxt->profile;
 163}
 164
 165/**
 166 * aa_clear_task_cxt_trans - clear transition tracking info from the cxt
 167 * @cxt: task context to clear (NOT NULL)
 168 */
 169static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt)
 170{
 171        aa_put_profile(cxt->previous);
 172        aa_put_profile(cxt->onexec);
 173        cxt->previous = NULL;
 174        cxt->onexec = NULL;
 175        cxt->token = 0;
 176}
 177
 178#endif /* __AA_CONTEXT_H */
 179