LXR linux/security/apparmor/include/cred.h

   1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor contexts used to associate "labels" to objects.
   5 *
   6 * Copyright (C) 1998-2008 Novell/SUSE
   7 * Copyright 2009-2010 Canonical Ltd.
   8 *
   9 * This program is free software; you can redistribute it and/or
  10 * modify it under the terms of the GNU General Public License as
  11 * published by the Free Software Foundation, version 2 of the
  12 * License.
  13 */
  14
  15#ifndef __AA_CONTEXT_H
  16#define __AA_CONTEXT_H
  17
  18#include <linux/cred.h>
  19#include <linux/slab.h>
  20#include <linux/sched.h>
  21
  22#include "label.h"
  23#include "policy_ns.h"
  24#include "task.h"
  25
  26#define cred_label(X) ((X)->security)
  27
  28
  29/**
  30 * aa_cred_raw_label - obtain cred's label
  31 * @cred: cred to obtain label from  (NOT NULL)
  32 *
  33 * Returns: confining label
  34 *
  35 * does NOT increment reference count
  36 */
  37static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
  38{
  39        struct aa_label *label = cred_label(cred);
  40
  41        AA_BUG(!label);
  42        return label;
  43}
  44
  45/**
  46 * aa_get_newest_cred_label - obtain the newest label on a cred
  47 * @cred: cred to obtain label from (NOT NULL)
  48 *
  49 * Returns: newest version of confining label
  50 */
  51static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
  52{
  53        return aa_get_newest_label(aa_cred_raw_label(cred));
  54}
  55
  56/**
  57 * __aa_task_raw_label - retrieve another task's label
  58 * @task: task to query  (NOT NULL)
  59 *
  60 * Returns: @task's label without incrementing its ref count
  61 *
  62 * If @task != current needs to be called in RCU safe critical section
  63 */
  64static inline struct aa_label *__aa_task_raw_label(struct task_struct *task)
  65{
  66        return aa_cred_raw_label(__task_cred(task));
  67}
  68
  69/**
  70 * aa_current_raw_label - find the current tasks confining label
  71 *
  72 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
  73 *
  74 * This fn will not update the tasks cred to the most up to date version
  75 * of the label so it is safe to call when inside of locks.
  76 */
  77static inline struct aa_label *aa_current_raw_label(void)
  78{
  79        return aa_cred_raw_label(current_cred());
  80}
  81
  82/**
  83 * aa_get_current_label - get the newest version of the current tasks label
  84 *
  85 * Returns: newest version of confining label (NOT NULL)
  86 *
  87 * This fn will not update the tasks cred, so it is safe inside of locks
  88 *
  89 * The returned reference must be put with aa_put_label()
  90 */
  91static inline struct aa_label *aa_get_current_label(void)
  92{
  93        struct aa_label *l = aa_current_raw_label();
  94
  95        if (label_is_stale(l))
  96                return aa_get_newest_label(l);
  97        return aa_get_label(l);
  98}
  99
 100#define __end_current_label_crit_section(X) end_current_label_crit_section(X)
 101
 102/**
 103 * end_label_crit_section - put a reference found with begin_current_label..
 104 * @label: label reference to put
 105 *
 106 * Should only be used with a reference obtained with
 107 * begin_current_label_crit_section and never used in situations where the
 108 * task cred may be updated
 109 */
 110static inline void end_current_label_crit_section(struct aa_label *label)
 111{
 112        if (label != aa_current_raw_label())
 113                aa_put_label(label);
 114}
 115
 116/**
 117 * __begin_current_label_crit_section - current's confining label
 118 *
 119 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
 120 *
 121 * safe to call inside locks
 122 *
 123 * The returned reference must be put with __end_current_label_crit_section()
 124 * This must NOT be used if the task cred could be updated within the
 125 * critical section between __begin_current_label_crit_section() ..
 126 * __end_current_label_crit_section()
 127 */
 128static inline struct aa_label *__begin_current_label_crit_section(void)
 129{
 130        struct aa_label *label = aa_current_raw_label();
 131
 132        if (label_is_stale(label))
 133                label = aa_get_newest_label(label);
 134
 135        return label;
 136}
 137
 138/**
 139 * begin_current_label_crit_section - current's confining label and update it
 140 *
 141 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
 142 *
 143 * Not safe to call inside locks
 144 *
 145 * The returned reference must be put with end_current_label_crit_section()
 146 * This must NOT be used if the task cred could be updated within the
 147 * critical section between begin_current_label_crit_section() ..
 148 * end_current_label_crit_section()
 149 */
 150static inline struct aa_label *begin_current_label_crit_section(void)
 151{
 152        struct aa_label *label = aa_current_raw_label();
 153
 154        if (label_is_stale(label)) {
 155                label = aa_get_newest_label(label);
 156                if (aa_replace_current_label(label) == 0)
 157                        /* task cred will keep the reference */
 158                        aa_put_label(label);
 159        }
 160
 161        return label;
 162}
 163
 164static inline struct aa_ns *aa_get_current_ns(void)
 165{
 166        struct aa_label *label;
 167        struct aa_ns *ns;
 168
 169        label  = __begin_current_label_crit_section();
 170        ns = aa_get_ns(labels_ns(label));
 171        __end_current_label_crit_section(label);
 172
 173        return ns;
 174}
 175
 176#endif /* __AA_CONTEXT_H */
 177