LXR linux/security/apparmor/include/cred.h

   1/* SPDX-License-Identifier: GPL-2.0-only */
   2/*
   3 * AppArmor security module
   4 *
   5 * This file contains AppArmor contexts used to associate "labels" to objects.
   6 *
   7 * Copyright (C) 1998-2008 Novell/SUSE
   8 * Copyright 2009-2010 Canonical Ltd.
   9 */
  10
  11#ifndef __AA_CONTEXT_H
  12#define __AA_CONTEXT_H
  13
  14#include <linux/cred.h>
  15#include <linux/slab.h>
  16#include <linux/sched.h>
  17
  18#include "label.h"
  19#include "policy_ns.h"
  20#include "task.h"
  21
  22static inline struct aa_label *cred_label(const struct cred *cred)
  23{
  24        struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
  25
  26        AA_BUG(!blob);
  27        return *blob;
  28}
  29
  30static inline void set_cred_label(const struct cred *cred,
  31                                  struct aa_label *label)
  32{
  33        struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
  34
  35        AA_BUG(!blob);
  36        *blob = label;
  37}
  38
  39/**
  40 * aa_cred_raw_label - obtain cred's label
  41 * @cred: cred to obtain label from  (NOT NULL)
  42 *
  43 * Returns: confining label
  44 *
  45 * does NOT increment reference count
  46 */
  47static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
  48{
  49        struct aa_label *label = cred_label(cred);
  50
  51        AA_BUG(!label);
  52        return label;
  53}
  54
  55/**
  56 * aa_get_newest_cred_label - obtain the newest label on a cred
  57 * @cred: cred to obtain label from (NOT NULL)
  58 *
  59 * Returns: newest version of confining label
  60 */
  61static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
  62{
  63        return aa_get_newest_label(aa_cred_raw_label(cred));
  64}
  65
  66/**
  67 * __aa_task_raw_label - retrieve another task's label
  68 * @task: task to query  (NOT NULL)
  69 *
  70 * Returns: @task's label without incrementing its ref count
  71 *
  72 * If @task != current needs to be called in RCU safe critical section
  73 */
  74static inline struct aa_label *__aa_task_raw_label(struct task_struct *task)
  75{
  76        return aa_cred_raw_label(__task_cred(task));
  77}
  78
  79/**
  80 * aa_current_raw_label - find the current tasks confining label
  81 *
  82 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
  83 *
  84 * This fn will not update the tasks cred to the most up to date version
  85 * of the label so it is safe to call when inside of locks.
  86 */
  87static inline struct aa_label *aa_current_raw_label(void)
  88{
  89        return aa_cred_raw_label(current_cred());
  90}
  91
  92/**
  93 * aa_get_current_label - get the newest version of the current tasks label
  94 *
  95 * Returns: newest version of confining label (NOT NULL)
  96 *
  97 * This fn will not update the tasks cred, so it is safe inside of locks
  98 *
  99 * The returned reference must be put with aa_put_label()
 100 */
 101static inline struct aa_label *aa_get_current_label(void)
 102{
 103        struct aa_label *l = aa_current_raw_label();
 104
 105        if (label_is_stale(l))
 106                return aa_get_newest_label(l);
 107        return aa_get_label(l);
 108}
 109
 110#define __end_current_label_crit_section(X) end_current_label_crit_section(X)
 111
 112/**
 113 * end_label_crit_section - put a reference found with begin_current_label..
 114 * @label: label reference to put
 115 *
 116 * Should only be used with a reference obtained with
 117 * begin_current_label_crit_section and never used in situations where the
 118 * task cred may be updated
 119 */
 120static inline void end_current_label_crit_section(struct aa_label *label)
 121{
 122        if (label != aa_current_raw_label())
 123                aa_put_label(label);
 124}
 125
 126/**
 127 * __begin_current_label_crit_section - current's confining label
 128 *
 129 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
 130 *
 131 * safe to call inside locks
 132 *
 133 * The returned reference must be put with __end_current_label_crit_section()
 134 * This must NOT be used if the task cred could be updated within the
 135 * critical section between __begin_current_label_crit_section() ..
 136 * __end_current_label_crit_section()
 137 */
 138static inline struct aa_label *__begin_current_label_crit_section(void)
 139{
 140        struct aa_label *label = aa_current_raw_label();
 141
 142        if (label_is_stale(label))
 143                label = aa_get_newest_label(label);
 144
 145        return label;
 146}
 147
 148/**
 149 * begin_current_label_crit_section - current's confining label and update it
 150 *
 151 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
 152 *
 153 * Not safe to call inside locks
 154 *
 155 * The returned reference must be put with end_current_label_crit_section()
 156 * This must NOT be used if the task cred could be updated within the
 157 * critical section between begin_current_label_crit_section() ..
 158 * end_current_label_crit_section()
 159 */
 160static inline struct aa_label *begin_current_label_crit_section(void)
 161{
 162        struct aa_label *label = aa_current_raw_label();
 163
 164        might_sleep();
 165
 166        if (label_is_stale(label)) {
 167                label = aa_get_newest_label(label);
 168                if (aa_replace_current_label(label) == 0)
 169                        /* task cred will keep the reference */
 170                        aa_put_label(label);
 171        }
 172
 173        return label;
 174}
 175
 176static inline struct aa_ns *aa_get_current_ns(void)
 177{
 178        struct aa_label *label;
 179        struct aa_ns *ns;
 180
 181        label  = __begin_current_label_crit_section();
 182        ns = aa_get_ns(labels_ns(label));
 183        __end_current_label_crit_section(label);
 184
 185        return ns;
 186}
 187
 188#endif /* __AA_CONTEXT_H */
 189