tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor policy definitions.
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
9 */
10
11#ifndef __AA_NAMESPACE_H
12#define __AA_NAMESPACE_H
13
14#include <linux/kref.h>
15
16#include "apparmor.h"
17#include "apparmorfs.h"
18#include "label.h"
19#include "policy.h"
20
21
22/* struct aa_ns_acct - accounting of profiles in namespace
23 * @max_size: maximum space allowed for all profiles in namespace
24 * @max_count: maximum number of profiles that can be in this namespace
25 * @size: current size of profiles
26 * @count: current count of profiles (includes null profiles)
27 */
28struct aa_ns_acct {
29 int max_size;
30 int max_count;
31 int size;
32 int count;
33};
34
35/* struct aa_ns - namespace for a set of profiles
36 * @base: common policy
37 * @parent: parent of namespace
38 * @lock: lock for modifying the object
39 * @acct: accounting for the namespace
40 * @unconfined: special unconfined profile for the namespace
41 * @sub_ns: list of namespaces under the current namespace.
42 * @uniq_null: uniq value used for null learning profiles
43 * @uniq_id: a unique id count for the profiles in the namespace
44 * @level: level of ns within the tree hierarchy
45 * @dents: dentries for the namespaces file entries in apparmorfs
46 *
47 * An aa_ns defines the set profiles that are searched to determine which
48 * profile to attach to a task. Profiles can not be shared between aa_ns
49 * and profile names within a namespace are guaranteed to be unique. When
50 * profiles in separate namespaces have the same name they are NOT considered
51 * to be equivalent.
52 *
53 * Namespaces are hierarchical and only namespaces and profiles below the
54 * current namespace are visible.
55 *
56 * Namespace names must be unique and can not contain the characters :/\0
57 */
58struct aa_ns {
59 struct aa_policy base;
60 struct aa_ns *parent;
61 struct mutex lock;
62 struct aa_ns_acct acct;
63 struct aa_profile *unconfined;
64 struct list_head sub_ns;
65 atomic_t uniq_null;
66 long uniq_id;
67 int level;
68 long revision;
69 wait_queue_head_t wait;
70
71 struct aa_labelset labels;
72 struct list_head rawdata_list;
73
74 struct dentry *dents[AAFS_NS_SIZEOF];
75};
76
77extern struct aa_label *kernel_t;
78extern struct aa_ns *root_ns;
79
80extern const char *aa_hidden_ns_name;
81
82#define ns_unconfined(NS) (&(NS)->unconfined->label)
83
84bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
85const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
86void aa_free_ns(struct aa_ns *ns);
87int aa_alloc_root_ns(void);
88void aa_free_root_ns(void);
89void aa_free_ns_kref(struct kref *kref);
90
91struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name);
92struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n);
93struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n);
94struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n);
95struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
96 struct dentry *dir);
97struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
98void __aa_remove_ns(struct aa_ns *ns);
99
100static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
101{
102 return rcu_dereference_protected(p->parent,
103 mutex_is_locked(&p->ns->lock));
104}
105
106/**
107 * aa_get_ns - increment references count on @ns
108 * @ns: namespace to increment reference count of (MAYBE NULL)
109 *
110 * Returns: pointer to @ns, if @ns is NULL returns NULL
111 * Requires: @ns must be held with valid refcount when called
112 */
113static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
114{
115 if (ns)
116 aa_get_profile(ns->unconfined);
117
118 return ns;
119}
120
121/**
122 * aa_put_ns - decrement refcount on @ns
123 * @ns: namespace to put reference of
124 *
125 * Decrement reference count of @ns and if no longer in use free it
126 */
127static inline void aa_put_ns(struct aa_ns *ns)
128{
129 if (ns)
130 aa_put_profile(ns->unconfined);
131}
132
133/**
134 * __aa_findn_ns - find a namespace on a list by @name
135 * @head: list to search for namespace on (NOT NULL)
136 * @name: name of namespace to look for (NOT NULL)
137 * @n: length of @name
138 * Returns: unrefcounted namespace
139 *
140 * Requires: rcu_read_lock be held
141 */
142static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
143 const char *name, size_t n)
144{
145 return (struct aa_ns *)__policy_strn_find(head, name, n);
146}
147
148static inline struct aa_ns *__aa_find_ns(struct list_head *head,
149 const char *name)
150{
151 return __aa_findn_ns(head, name, strlen(name));
152}
153
154static inline struct aa_ns *__aa_lookup_ns(struct aa_ns *base,
155 const char *hname)
156{
157 return __aa_lookupn_ns(base, hname, strlen(hname));
158}
159
160static inline struct aa_ns *aa_lookup_ns(struct aa_ns *view, const char *name)
161{
162 return aa_lookupn_ns(view, name, strlen(name));
163}
164
165#endif /* AA_NAMESPACE_H */