Branch data Line data Source code
1 : : /*
2 : : * AppArmor security module
3 : : *
4 : : * This file contains AppArmor contexts used to associate "labels" to objects.
5 : : *
6 : : * Copyright (C) 1998-2008 Novell/SUSE
7 : : * Copyright 2009-2010 Canonical Ltd.
8 : : *
9 : : * This program is free software; you can redistribute it and/or
10 : : * modify it under the terms of the GNU General Public License as
11 : : * published by the Free Software Foundation, version 2 of the
12 : : * License.
13 : : */
14 : :
15 : : #ifndef __AA_CONTEXT_H
16 : : #define __AA_CONTEXT_H
17 : :
18 : : #include <linux/cred.h>
19 : : #include <linux/slab.h>
20 : : #include <linux/sched.h>
21 : :
22 : : #include "policy.h"
23 : :
24 : : #define cred_cxt(X) (X)->security
25 : : #define current_cxt() cred_cxt(current_cred())
26 : :
27 : : /* struct aa_file_cxt - the AppArmor context the file was opened in
28 : : * @perms: the permission the file was opened with
29 : : *
30 : : * The file_cxt could currently be directly stored in file->f_security
31 : : * as the profile reference is now stored in the f_cred. However the
32 : : * cxt struct will expand in the future so we keep the struct.
33 : : */
34 : : struct aa_file_cxt {
35 : : u16 allow;
36 : : };
37 : :
38 : : /**
39 : : * aa_alloc_file_context - allocate file_cxt
40 : : * @gfp: gfp flags for allocation
41 : : *
42 : : * Returns: file_cxt or NULL on failure
43 : : */
44 : : static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
45 : : {
46 : : return kzalloc(sizeof(struct aa_file_cxt), gfp);
47 : : }
48 : :
49 : : /**
50 : : * aa_free_file_context - free a file_cxt
51 : : * @cxt: file_cxt to free (MAYBE_NULL)
52 : : */
53 : : static inline void aa_free_file_context(struct aa_file_cxt *cxt)
54 : : {
55 [ + ]: 4489774 : if (cxt)
56 : 4493973 : kzfree(cxt);
57 : : }
58 : :
59 : : /**
60 : : * struct aa_task_cxt - primary label for confined tasks
61 : : * @profile: the current profile (NOT NULL)
62 : : * @exec: profile to transition to on next exec (MAYBE NULL)
63 : : * @previous: profile the task may return to (MAYBE NULL)
64 : : * @token: magic value the task must know for returning to @previous_profile
65 : : *
66 : : * Contains the task's current profile (which could change due to
67 : : * change_hat). Plus the hat_magic needed during change_hat.
68 : : *
69 : : * TODO: make so a task can be confined by a stack of contexts
70 : : */
71 : : struct aa_task_cxt {
72 : : struct aa_profile *profile;
73 : : struct aa_profile *onexec;
74 : : struct aa_profile *previous;
75 : : u64 token;
76 : : };
77 : :
78 : : struct aa_task_cxt *aa_alloc_task_context(gfp_t flags);
79 : : void aa_free_task_context(struct aa_task_cxt *cxt);
80 : : void aa_dup_task_context(struct aa_task_cxt *new,
81 : : const struct aa_task_cxt *old);
82 : : int aa_replace_current_profile(struct aa_profile *profile);
83 : : int aa_set_current_onexec(struct aa_profile *profile);
84 : : int aa_set_current_hat(struct aa_profile *profile, u64 token);
85 : : int aa_restore_previous_profile(u64 cookie);
86 : : struct aa_profile *aa_get_task_profile(struct task_struct *task);
87 : :
88 : :
89 : : /**
90 : : * aa_cred_profile - obtain cred's profiles
91 : : * @cred: cred to obtain profiles from (NOT NULL)
92 : : *
93 : : * Returns: confining profile
94 : : *
95 : : * does NOT increment reference count
96 : : */
97 : : static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
98 : : {
99 : : struct aa_task_cxt *cxt = cred_cxt(cred);
100 [ + - ][ - + ]: 35455455 : BUG_ON(!cxt || !cxt->profile);
[ + ][ + ][ + ]
[ + ][ + ]
[ + + ][ + ]
[ + + ][ + ]
[ + + - ]
[ - + ][ + - ]
[ - + ][ # # ]
[ # # ][ + - ]
[ - + ]
101 : : return cxt->profile;
102 : : }
103 : :
104 : : /**
105 : : * __aa_task_profile - retrieve another task's profile
106 : : * @task: task to query (NOT NULL)
107 : : *
108 : : * Returns: @task's profile without incrementing its ref count
109 : : *
110 : : * If @task != current needs to be called in RCU safe critical section
111 : : */
112 : : static inline struct aa_profile *__aa_task_profile(struct task_struct *task)
113 : : {
114 : 89860 : return aa_cred_profile(__task_cred(task));
115 : : }
116 : :
117 : : /**
118 : : * __aa_task_is_confined - determine if @task has any confinement
119 : : * @task: task to check confinement of (NOT NULL)
120 : : *
121 : : * If @task != current needs to be called in RCU safe critical section
122 : : */
123 : : static inline bool __aa_task_is_confined(struct task_struct *task)
124 : : {
125 : : return !unconfined(__aa_task_profile(task));
126 : : }
127 : :
128 : : /**
129 : : * __aa_current_profile - find the current tasks confining profile
130 : : *
131 : : * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
132 : : *
133 : : * This fn will not update the tasks cred to the most up to date version
134 : : * of the profile so it is safe to call when inside of locks.
135 : : */
136 : : static inline struct aa_profile *__aa_current_profile(void)
137 : : {
138 : 18049356 : return aa_cred_profile(current_cred());
139 : : }
140 : :
141 : : /**
142 : : * aa_current_profile - find the current tasks confining profile and do updates
143 : : *
144 : : * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
145 : : *
146 : : * This fn will update the tasks cred structure if the profile has been
147 : : * replaced. Not safe to call inside locks
148 : : */
149 : : static inline struct aa_profile *aa_current_profile(void)
150 : : {
151 : 158386 : const struct aa_task_cxt *cxt = current_cxt();
152 : : struct aa_profile *profile;
153 [ # # ][ # # ]: 158386 : BUG_ON(!cxt || !cxt->profile);
[ + - ][ - + ]
[ + - ][ - + ]
154 : :
155 [ # # ][ - + ]: 158386 : if (PROFILE_INVALID(cxt->profile)) {
[ - + ]
156 : : profile = aa_get_newest_profile(cxt->profile);
157 : 0 : aa_replace_current_profile(profile);
158 : : aa_put_profile(profile);
159 : 0 : cxt = current_cxt();
160 : : }
161 : :
162 : 158386 : return cxt->profile;
163 : : }
164 : :
165 : : /**
166 : : * aa_clear_task_cxt_trans - clear transition tracking info from the cxt
167 : : * @cxt: task context to clear (NOT NULL)
168 : : */
169 : : static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt)
170 : : {
171 : 0 : aa_put_profile(cxt->previous);
172 : 0 : aa_put_profile(cxt->onexec);
173 : 0 : cxt->previous = NULL;
174 : 0 : cxt->onexec = NULL;
175 : 0 : cxt->token = 0;
176 : : }
177 : :
178 : : #endif /* __AA_CONTEXT_H */
|
