Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor contexts used to associate "labels" to objects.
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11#ifndef __AA_CONTEXT_H
12#define __AA_CONTEXT_H
13
14#include <linux/cred.h>
15#include <linux/slab.h>
16#include <linux/sched.h>
17
18#include "label.h"
19#include "policy_ns.h"
20#include "task.h"
21
22static inline struct aa_label *cred_label(const struct cred *cred)
23{
24 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
25
26 AA_BUG(!blob);
27 return *blob;
28}
29
30static inline void set_cred_label(const struct cred *cred,
31 struct aa_label *label)
32{
33 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
34
35 AA_BUG(!blob);
36 *blob = label;
37}
38
39/**
40 * aa_cred_raw_label - obtain cred's label
41 * @cred: cred to obtain label from (NOT NULL)
42 *
43 * Returns: confining label
44 *
45 * does NOT increment reference count
46 */
47static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
48{
49 struct aa_label *label = cred_label(cred);
50
51 AA_BUG(!label);
52 return label;
53}
54
55/**
56 * aa_get_newest_cred_label - obtain the newest label on a cred
57 * @cred: cred to obtain label from (NOT NULL)
58 *
59 * Returns: newest version of confining label
60 */
61static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
62{
63 return aa_get_newest_label(aa_cred_raw_label(cred));
64}
65
66static inline struct aa_label *aa_get_newest_cred_label_condref(const struct cred *cred,
67 bool *needput)
68{
69 struct aa_label *l = aa_cred_raw_label(cred);
70
71 if (unlikely(label_is_stale(l))) {
72 *needput = true;
73 return aa_get_newest_label(l);
74 }
75
76 *needput = false;
77 return l;
78}
79
80static inline void aa_put_label_condref(struct aa_label *l, bool needput)
81{
82 if (unlikely(needput))
83 aa_put_label(l);
84}
85
86/**
87 * aa_current_raw_label - find the current tasks confining label
88 *
89 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
90 *
91 * This fn will not update the tasks cred to the most up to date version
92 * of the label so it is safe to call when inside of locks.
93 */
94static inline struct aa_label *aa_current_raw_label(void)
95{
96 return aa_cred_raw_label(current_cred());
97}
98
99/**
100 * aa_get_current_label - get the newest version of the current tasks label
101 *
102 * Returns: newest version of confining label (NOT NULL)
103 *
104 * This fn will not update the tasks cred, so it is safe inside of locks
105 *
106 * The returned reference must be put with aa_put_label()
107 */
108static inline struct aa_label *aa_get_current_label(void)
109{
110 struct aa_label *l = aa_current_raw_label();
111
112 if (label_is_stale(l))
113 return aa_get_newest_label(l);
114 return aa_get_label(l);
115}
116
117#define __end_current_label_crit_section(X) end_current_label_crit_section(X)
118
119/**
120 * end_label_crit_section - put a reference found with begin_current_label..
121 * @label: label reference to put
122 *
123 * Should only be used with a reference obtained with
124 * begin_current_label_crit_section and never used in situations where the
125 * task cred may be updated
126 */
127static inline void end_current_label_crit_section(struct aa_label *label)
128{
129 if (label != aa_current_raw_label())
130 aa_put_label(label);
131}
132
133/**
134 * __begin_current_label_crit_section - current's confining label
135 *
136 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
137 *
138 * safe to call inside locks
139 *
140 * The returned reference must be put with __end_current_label_crit_section()
141 * This must NOT be used if the task cred could be updated within the
142 * critical section between __begin_current_label_crit_section() ..
143 * __end_current_label_crit_section()
144 */
145static inline struct aa_label *__begin_current_label_crit_section(void)
146{
147 struct aa_label *label = aa_current_raw_label();
148
149 if (label_is_stale(label))
150 label = aa_get_newest_label(label);
151
152 return label;
153}
154
155/**
156 * begin_current_label_crit_section - current's confining label and update it
157 *
158 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
159 *
160 * Not safe to call inside locks
161 *
162 * The returned reference must be put with end_current_label_crit_section()
163 * This must NOT be used if the task cred could be updated within the
164 * critical section between begin_current_label_crit_section() ..
165 * end_current_label_crit_section()
166 */
167static inline struct aa_label *begin_current_label_crit_section(void)
168{
169 struct aa_label *label = aa_current_raw_label();
170
171 might_sleep();
172
173 if (label_is_stale(label)) {
174 label = aa_get_newest_label(label);
175 if (aa_replace_current_label(label) == 0)
176 /* task cred will keep the reference */
177 aa_put_label(label);
178 }
179
180 return label;
181}
182
183static inline struct aa_ns *aa_get_current_ns(void)
184{
185 struct aa_label *label;
186 struct aa_ns *ns;
187
188 label = __begin_current_label_crit_section();
189 ns = aa_get_ns(labels_ns(label));
190 __end_current_label_crit_section(label);
191
192 return ns;
193}
194
195#endif /* __AA_CONTEXT_H */