1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor contexts used to associate "labels" to objects. 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2010 Canonical Ltd. 9 */ 10 11 #ifndef __AA_CONTEXT_H 12 #define __AA_CONTEXT_H 13 14 #include <linux/cred.h> 15 #include <linux/slab.h> 16 #include <linux/sched.h> 17 18 #include "label.h" 19 #include "policy_ns.h" 20 #include "task.h" 21 22 static inline struct aa_label *cred_label(const struct cred *cred) 23 { 24 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 25 26 AA_BUG(!blob); 27 return *blob; 28 } 29 30 static inline void set_cred_label(const struct cred *cred, 31 struct aa_label *label) 32 { 33 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 34 35 AA_BUG(!blob); 36 *blob = label; 37 } 38 39 /** 40 * aa_cred_raw_label - obtain cred's label 41 * @cred: cred to obtain label from (NOT NULL) 42 * 43 * Returns: confining label 44 * 45 * does NOT increment reference count 46 */ 47 static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) 48 { 49 struct aa_label *label = cred_label(cred); 50 51 AA_BUG(!label); 52 return label; 53 } 54 55 /** 56 * aa_get_newest_cred_label - obtain the newest label on a cred 57 * @cred: cred to obtain label from (NOT NULL) 58 * 59 * Returns: newest version of confining label 60 */ 61 static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) 62 { 63 return aa_get_newest_label(aa_cred_raw_label(cred)); 64 } 65 66 /** 67 * __aa_task_raw_label - retrieve another task's label 68 * @task: task to query (NOT NULL) 69 * 70 * Returns: @task's label without incrementing its ref count 71 * 72 * If @task != current needs to be called in RCU safe critical section 73 */ 74 static inline struct aa_label *__aa_task_raw_label(struct task_struct *task) 75 { 76 return aa_cred_raw_label(__task_cred(task)); 77 } 78 79 /** 80 * aa_current_raw_label - find the current tasks confining label 81 * 82 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 83 * 84 * This fn will not update the tasks cred to the most up to date version 85 * of the label so it is safe to call when inside of locks. 86 */ 87 static inline struct aa_label *aa_current_raw_label(void) 88 { 89 return aa_cred_raw_label(current_cred()); 90 } 91 92 /** 93 * aa_get_current_label - get the newest version of the current tasks label 94 * 95 * Returns: newest version of confining label (NOT NULL) 96 * 97 * This fn will not update the tasks cred, so it is safe inside of locks 98 * 99 * The returned reference must be put with aa_put_label() 100 */ 101 static inline struct aa_label *aa_get_current_label(void) 102 { 103 struct aa_label *l = aa_current_raw_label(); 104 105 if (label_is_stale(l)) 106 return aa_get_newest_label(l); 107 return aa_get_label(l); 108 } 109 110 #define __end_current_label_crit_section(X) end_current_label_crit_section(X) 111 112 /** 113 * end_label_crit_section - put a reference found with begin_current_label.. 114 * @label: label reference to put 115 * 116 * Should only be used with a reference obtained with 117 * begin_current_label_crit_section and never used in situations where the 118 * task cred may be updated 119 */ 120 static inline void end_current_label_crit_section(struct aa_label *label) 121 { 122 if (label != aa_current_raw_label()) 123 aa_put_label(label); 124 } 125 126 /** 127 * __begin_current_label_crit_section - current's confining label 128 * 129 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 130 * 131 * safe to call inside locks 132 * 133 * The returned reference must be put with __end_current_label_crit_section() 134 * This must NOT be used if the task cred could be updated within the 135 * critical section between __begin_current_label_crit_section() .. 136 * __end_current_label_crit_section() 137 */ 138 static inline struct aa_label *__begin_current_label_crit_section(void) 139 { 140 struct aa_label *label = aa_current_raw_label(); 141 142 if (label_is_stale(label)) 143 label = aa_get_newest_label(label); 144 145 return label; 146 } 147 148 /** 149 * begin_current_label_crit_section - current's confining label and update it 150 * 151 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 152 * 153 * Not safe to call inside locks 154 * 155 * The returned reference must be put with end_current_label_crit_section() 156 * This must NOT be used if the task cred could be updated within the 157 * critical section between begin_current_label_crit_section() .. 158 * end_current_label_crit_section() 159 */ 160 static inline struct aa_label *begin_current_label_crit_section(void) 161 { 162 struct aa_label *label = aa_current_raw_label(); 163 164 might_sleep(); 165 166 if (label_is_stale(label)) { 167 label = aa_get_newest_label(label); 168 if (aa_replace_current_label(label) == 0) 169 /* task cred will keep the reference */ 170 aa_put_label(label); 171 } 172 173 return label; 174 } 175 176 static inline struct aa_ns *aa_get_current_ns(void) 177 { 178 struct aa_label *label; 179 struct aa_ns *ns; 180 181 label = __begin_current_label_crit_section(); 182 ns = aa_get_ns(labels_ns(label)); 183 __end_current_label_crit_section(label); 184 185 return ns; 186 } 187 188 #endif /* __AA_CONTEXT_H */ 189