Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor contexts used to associate "labels" to objects.
5 *
6 * Copyright (C) 1998-2008 Novell/SUSE
7 * Copyright 2009-2010 Canonical Ltd.
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation, version 2 of the
12 * License.
13 */
14
15#ifndef __AA_CONTEXT_H
16#define __AA_CONTEXT_H
17
18#include <linux/cred.h>
19#include <linux/slab.h>
20#include <linux/sched.h>
21
22#include "label.h"
23#include "policy_ns.h"
24#include "task.h"
25
26static inline struct aa_label *cred_label(const struct cred *cred)
27{
28 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
29
30 AA_BUG(!blob);
31 return *blob;
32}
33
34static inline void set_cred_label(const struct cred *cred,
35 struct aa_label *label)
36{
37 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
38
39 AA_BUG(!blob);
40 *blob = label;
41}
42
43/**
44 * aa_cred_raw_label - obtain cred's label
45 * @cred: cred to obtain label from (NOT NULL)
46 *
47 * Returns: confining label
48 *
49 * does NOT increment reference count
50 */
51static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
52{
53 struct aa_label *label = cred_label(cred);
54
55 AA_BUG(!label);
56 return label;
57}
58
59/**
60 * aa_get_newest_cred_label - obtain the newest label on a cred
61 * @cred: cred to obtain label from (NOT NULL)
62 *
63 * Returns: newest version of confining label
64 */
65static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
66{
67 return aa_get_newest_label(aa_cred_raw_label(cred));
68}
69
70/**
71 * __aa_task_raw_label - retrieve another task's label
72 * @task: task to query (NOT NULL)
73 *
74 * Returns: @task's label without incrementing its ref count
75 *
76 * If @task != current needs to be called in RCU safe critical section
77 */
78static inline struct aa_label *__aa_task_raw_label(struct task_struct *task)
79{
80 return aa_cred_raw_label(__task_cred(task));
81}
82
83/**
84 * aa_current_raw_label - find the current tasks confining label
85 *
86 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
87 *
88 * This fn will not update the tasks cred to the most up to date version
89 * of the label so it is safe to call when inside of locks.
90 */
91static inline struct aa_label *aa_current_raw_label(void)
92{
93 return aa_cred_raw_label(current_cred());
94}
95
96/**
97 * aa_get_current_label - get the newest version of the current tasks label
98 *
99 * Returns: newest version of confining label (NOT NULL)
100 *
101 * This fn will not update the tasks cred, so it is safe inside of locks
102 *
103 * The returned reference must be put with aa_put_label()
104 */
105static inline struct aa_label *aa_get_current_label(void)
106{
107 struct aa_label *l = aa_current_raw_label();
108
109 if (label_is_stale(l))
110 return aa_get_newest_label(l);
111 return aa_get_label(l);
112}
113
114#define __end_current_label_crit_section(X) end_current_label_crit_section(X)
115
116/**
117 * end_label_crit_section - put a reference found with begin_current_label..
118 * @label: label reference to put
119 *
120 * Should only be used with a reference obtained with
121 * begin_current_label_crit_section and never used in situations where the
122 * task cred may be updated
123 */
124static inline void end_current_label_crit_section(struct aa_label *label)
125{
126 if (label != aa_current_raw_label())
127 aa_put_label(label);
128}
129
130/**
131 * __begin_current_label_crit_section - current's confining label
132 *
133 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
134 *
135 * safe to call inside locks
136 *
137 * The returned reference must be put with __end_current_label_crit_section()
138 * This must NOT be used if the task cred could be updated within the
139 * critical section between __begin_current_label_crit_section() ..
140 * __end_current_label_crit_section()
141 */
142static inline struct aa_label *__begin_current_label_crit_section(void)
143{
144 struct aa_label *label = aa_current_raw_label();
145
146 if (label_is_stale(label))
147 label = aa_get_newest_label(label);
148
149 return label;
150}
151
152/**
153 * begin_current_label_crit_section - current's confining label and update it
154 *
155 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
156 *
157 * Not safe to call inside locks
158 *
159 * The returned reference must be put with end_current_label_crit_section()
160 * This must NOT be used if the task cred could be updated within the
161 * critical section between begin_current_label_crit_section() ..
162 * end_current_label_crit_section()
163 */
164static inline struct aa_label *begin_current_label_crit_section(void)
165{
166 struct aa_label *label = aa_current_raw_label();
167
168 might_sleep();
169
170 if (label_is_stale(label)) {
171 label = aa_get_newest_label(label);
172 if (aa_replace_current_label(label) == 0)
173 /* task cred will keep the reference */
174 aa_put_label(label);
175 }
176
177 return label;
178}
179
180static inline struct aa_ns *aa_get_current_ns(void)
181{
182 struct aa_label *label;
183 struct aa_ns *ns;
184
185 label = __begin_current_label_crit_section();
186 ns = aa_get_ns(labels_ns(label));
187 __end_current_label_crit_section(label);
188
189 return ns;
190}
191
192#endif /* __AA_CONTEXT_H */