Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor security identifier (secid) manipulation fns
5 *
6 * Copyright 2009-2017 Canonical Ltd.
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
11 * License.
12 *
13 *
14 * AppArmor allocates a unique secid for every label used. If a label
15 * is replaced it receives the secid of the label it is replacing.
16 */
17
18#include <linux/errno.h>
19#include <linux/err.h>
20#include <linux/gfp.h>
21#include <linux/idr.h>
22#include <linux/slab.h>
23#include <linux/spinlock.h>
24
25#include "include/cred.h"
26#include "include/lib.h"
27#include "include/secid.h"
28#include "include/label.h"
29#include "include/policy_ns.h"
30
31/*
32 * secids - do not pin labels with a refcount. They rely on the label
33 * properly updating/freeing them
34 */
35
36#define AA_FIRST_SECID 1
37
38static DEFINE_IDR(aa_secids);
39static DEFINE_SPINLOCK(secid_lock);
40
41/*
42 * TODO: allow policy to reserve a secid range?
43 * TODO: add secid pinning
44 * TODO: use secid_update in label replace
45 */
46
47/**
48 * aa_secid_update - update a secid mapping to a new label
49 * @secid: secid to update
50 * @label: label the secid will now map to
51 */
52void aa_secid_update(u32 secid, struct aa_label *label)
53{
54 unsigned long flags;
55
56 spin_lock_irqsave(&secid_lock, flags);
57 idr_replace(&aa_secids, label, secid);
58 spin_unlock_irqrestore(&secid_lock, flags);
59}
60
61/**
62 *
63 * see label for inverse aa_label_to_secid
64 */
65struct aa_label *aa_secid_to_label(u32 secid)
66{
67 struct aa_label *label;
68
69 rcu_read_lock();
70 label = idr_find(&aa_secids, secid);
71 rcu_read_unlock();
72
73 return label;
74}
75
76int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
77{
78 /* TODO: cache secctx and ref count so we don't have to recreate */
79 struct aa_label *label = aa_secid_to_label(secid);
80 int len;
81
82 AA_BUG(!secdata);
83 AA_BUG(!seclen);
84
85 if (!label)
86 return -EINVAL;
87
88 if (secdata)
89 len = aa_label_asxprint(secdata, root_ns, label,
90 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
91 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT,
92 GFP_ATOMIC);
93 else
94 len = aa_label_snxprint(NULL, 0, root_ns, label,
95 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
96 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT);
97 if (len < 0)
98 return -ENOMEM;
99
100 *seclen = len;
101
102 return 0;
103}
104
105int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
106{
107 struct aa_label *label;
108
109 label = aa_label_strn_parse(&root_ns->unconfined->label, secdata,
110 seclen, GFP_KERNEL, false, false);
111 if (IS_ERR(label))
112 return PTR_ERR(label);
113 *secid = label->secid;
114
115 return 0;
116}
117
118void apparmor_release_secctx(char *secdata, u32 seclen)
119{
120 kfree(secdata);
121}
122
123/**
124 * aa_alloc_secid - allocate a new secid for a profile
125 * @label: the label to allocate a secid for
126 * @gfp: memory allocation flags
127 *
128 * Returns: 0 with @label->secid initialized
129 * <0 returns error with @label->secid set to AA_SECID_INVALID
130 */
131int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
132{
133 unsigned long flags;
134 int ret;
135
136 idr_preload(gfp);
137 spin_lock_irqsave(&secid_lock, flags);
138 ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC);
139 spin_unlock_irqrestore(&secid_lock, flags);
140 idr_preload_end();
141
142 if (ret < 0) {
143 label->secid = AA_SECID_INVALID;
144 return ret;
145 }
146
147 AA_BUG(ret == AA_SECID_INVALID);
148 label->secid = ret;
149 return 0;
150}
151
152/**
153 * aa_free_secid - free a secid
154 * @secid: secid to free
155 */
156void aa_free_secid(u32 secid)
157{
158 unsigned long flags;
159
160 spin_lock_irqsave(&secid_lock, flags);
161 idr_remove(&aa_secids, secid);
162 spin_unlock_irqrestore(&secid_lock, flags);
163}
164
165void aa_secids_init(void)
166{
167 idr_init_base(&aa_secids, AA_FIRST_SECID);
168}