Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor security identifier (secid) manipulation fns
6 *
7 * Copyright 2009-2017 Canonical Ltd.
8 *
9 * AppArmor allocates a unique secid for every label used. If a label
10 * is replaced it receives the secid of the label it is replacing.
11 */
12
13#include <linux/errno.h>
14#include <linux/err.h>
15#include <linux/gfp.h>
16#include <linux/slab.h>
17#include <linux/spinlock.h>
18#include <linux/xarray.h>
19
20#include "include/cred.h"
21#include "include/lib.h"
22#include "include/secid.h"
23#include "include/label.h"
24#include "include/policy_ns.h"
25
26/*
27 * secids - do not pin labels with a refcount. They rely on the label
28 * properly updating/freeing them
29 */
30#define AA_FIRST_SECID 2
31
32static DEFINE_XARRAY_FLAGS(aa_secids, XA_FLAGS_LOCK_IRQ | XA_FLAGS_TRACK_FREE);
33
34int apparmor_display_secid_mode;
35
36/*
37 * TODO: allow policy to reserve a secid range?
38 * TODO: add secid pinning
39 * TODO: use secid_update in label replace
40 */
41
42/*
43 * see label for inverse aa_label_to_secid
44 */
45struct aa_label *aa_secid_to_label(u32 secid)
46{
47 return xa_load(&aa_secids, secid);
48}
49
50static int apparmor_label_to_secctx(struct aa_label *label, char **secdata,
51 u32 *seclen)
52{
53 /* TODO: cache secctx and ref count so we don't have to recreate */
54 int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT;
55 int len;
56
57 AA_BUG(!seclen);
58
59 if (!label)
60 return -EINVAL;
61
62 if (apparmor_display_secid_mode)
63 flags |= FLAG_SHOW_MODE;
64
65 if (secdata)
66 len = aa_label_asxprint(secdata, root_ns, label,
67 flags, GFP_ATOMIC);
68 else
69 len = aa_label_snxprint(NULL, 0, root_ns, label, flags);
70
71 if (len < 0)
72 return -ENOMEM;
73
74 *seclen = len;
75
76 return 0;
77}
78
79int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
80{
81 struct aa_label *label = aa_secid_to_label(secid);
82
83 return apparmor_label_to_secctx(label, secdata, seclen);
84}
85
86int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata,
87 u32 *seclen)
88{
89 struct aa_label *label;
90
91 label = prop->apparmor.label;
92
93 return apparmor_label_to_secctx(label, secdata, seclen);
94}
95
96int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
97{
98 struct aa_label *label;
99
100 label = aa_label_strn_parse(&root_ns->unconfined->label, secdata,
101 seclen, GFP_KERNEL, false, false);
102 if (IS_ERR(label))
103 return PTR_ERR(label);
104 *secid = label->secid;
105
106 return 0;
107}
108
109void apparmor_release_secctx(char *secdata, u32 seclen)
110{
111 kfree(secdata);
112}
113
114/**
115 * aa_alloc_secid - allocate a new secid for a profile
116 * @label: the label to allocate a secid for
117 * @gfp: memory allocation flags
118 *
119 * Returns: 0 with @label->secid initialized
120 * <0 returns error with @label->secid set to AA_SECID_INVALID
121 */
122int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
123{
124 unsigned long flags;
125 int ret;
126
127 xa_lock_irqsave(&aa_secids, flags);
128 ret = __xa_alloc(&aa_secids, &label->secid, label,
129 XA_LIMIT(AA_FIRST_SECID, INT_MAX), gfp);
130 xa_unlock_irqrestore(&aa_secids, flags);
131
132 if (ret < 0) {
133 label->secid = AA_SECID_INVALID;
134 return ret;
135 }
136
137 return 0;
138}
139
140/**
141 * aa_free_secid - free a secid
142 * @secid: secid to free
143 */
144void aa_free_secid(u32 secid)
145{
146 unsigned long flags;
147
148 xa_lock_irqsave(&aa_secids, flags);
149 __xa_erase(&aa_secids, secid);
150 xa_unlock_irqrestore(&aa_secids, flags);
151}