1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor contexts used to associate "labels" to objects. 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #ifndef __AA_CONTEXT_H 16 #define __AA_CONTEXT_H 17 18 #include <linux/cred.h> 19 #include <linux/slab.h> 20 #include <linux/sched.h> 21 22 #include "label.h" 23 #include "policy_ns.h" 24 #include "task.h" 25 26 static inline struct aa_label *cred_label(const struct cred *cred) 27 { 28 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 29 30 AA_BUG(!blob); 31 return *blob; 32 } 33 34 static inline void set_cred_label(const struct cred *cred, 35 struct aa_label *label) 36 { 37 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 38 39 AA_BUG(!blob); 40 *blob = label; 41 } 42 43 /** 44 * aa_cred_raw_label - obtain cred's label 45 * @cred: cred to obtain label from (NOT NULL) 46 * 47 * Returns: confining label 48 * 49 * does NOT increment reference count 50 */ 51 static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) 52 { 53 struct aa_label *label = cred_label(cred); 54 55 AA_BUG(!label); 56 return label; 57 } 58 59 /** 60 * aa_get_newest_cred_label - obtain the newest label on a cred 61 * @cred: cred to obtain label from (NOT NULL) 62 * 63 * Returns: newest version of confining label 64 */ 65 static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) 66 { 67 return aa_get_newest_label(aa_cred_raw_label(cred)); 68 } 69 70 /** 71 * __aa_task_raw_label - retrieve another task's label 72 * @task: task to query (NOT NULL) 73 * 74 * Returns: @task's label without incrementing its ref count 75 * 76 * If @task != current needs to be called in RCU safe critical section 77 */ 78 static inline struct aa_label *__aa_task_raw_label(struct task_struct *task) 79 { 80 return aa_cred_raw_label(__task_cred(task)); 81 } 82 83 /** 84 * aa_current_raw_label - find the current tasks confining label 85 * 86 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 87 * 88 * This fn will not update the tasks cred to the most up to date version 89 * of the label so it is safe to call when inside of locks. 90 */ 91 static inline struct aa_label *aa_current_raw_label(void) 92 { 93 return aa_cred_raw_label(current_cred()); 94 } 95 96 /** 97 * aa_get_current_label - get the newest version of the current tasks label 98 * 99 * Returns: newest version of confining label (NOT NULL) 100 * 101 * This fn will not update the tasks cred, so it is safe inside of locks 102 * 103 * The returned reference must be put with aa_put_label() 104 */ 105 static inline struct aa_label *aa_get_current_label(void) 106 { 107 struct aa_label *l = aa_current_raw_label(); 108 109 if (label_is_stale(l)) 110 return aa_get_newest_label(l); 111 return aa_get_label(l); 112 } 113 114 #define __end_current_label_crit_section(X) end_current_label_crit_section(X) 115 116 /** 117 * end_label_crit_section - put a reference found with begin_current_label.. 118 * @label: label reference to put 119 * 120 * Should only be used with a reference obtained with 121 * begin_current_label_crit_section and never used in situations where the 122 * task cred may be updated 123 */ 124 static inline void end_current_label_crit_section(struct aa_label *label) 125 { 126 if (label != aa_current_raw_label()) 127 aa_put_label(label); 128 } 129 130 /** 131 * __begin_current_label_crit_section - current's confining label 132 * 133 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 134 * 135 * safe to call inside locks 136 * 137 * The returned reference must be put with __end_current_label_crit_section() 138 * This must NOT be used if the task cred could be updated within the 139 * critical section between __begin_current_label_crit_section() .. 140 * __end_current_label_crit_section() 141 */ 142 static inline struct aa_label *__begin_current_label_crit_section(void) 143 { 144 struct aa_label *label = aa_current_raw_label(); 145 146 if (label_is_stale(label)) 147 label = aa_get_newest_label(label); 148 149 return label; 150 } 151 152 /** 153 * begin_current_label_crit_section - current's confining label and update it 154 * 155 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 156 * 157 * Not safe to call inside locks 158 * 159 * The returned reference must be put with end_current_label_crit_section() 160 * This must NOT be used if the task cred could be updated within the 161 * critical section between begin_current_label_crit_section() .. 162 * end_current_label_crit_section() 163 */ 164 static inline struct aa_label *begin_current_label_crit_section(void) 165 { 166 struct aa_label *label = aa_current_raw_label(); 167 168 might_sleep(); 169 170 if (label_is_stale(label)) { 171 label = aa_get_newest_label(label); 172 if (aa_replace_current_label(label) == 0) 173 /* task cred will keep the reference */ 174 aa_put_label(label); 175 } 176 177 return label; 178 } 179 180 static inline struct aa_ns *aa_get_current_ns(void) 181 { 182 struct aa_label *label; 183 struct aa_ns *ns; 184 185 label = __begin_current_label_crit_section(); 186 ns = aa_get_ns(labels_ns(label)); 187 __end_current_label_crit_section(label); 188 189 return ns; 190 } 191 192 #endif /* __AA_CONTEXT_H */ 193