1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor contexts used to associate "labels" to objects. 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #ifndef __AA_CONTEXT_H 16 #define __AA_CONTEXT_H 17 18 #include <linux/cred.h> 19 #include <linux/slab.h> 20 #include <linux/sched.h> 21 22 #include "label.h" 23 #include "policy_ns.h" 24 #include "task.h" 25 26 #define cred_label(X) ((X)->security) 27 28 29 /** 30 * aa_cred_raw_label - obtain cred's label 31 * @cred: cred to obtain label from (NOT NULL) 32 * 33 * Returns: confining label 34 * 35 * does NOT increment reference count 36 */ 37 static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) 38 { 39 struct aa_label *label = cred_label(cred); 40 41 AA_BUG(!label); 42 return label; 43 } 44 45 /** 46 * aa_get_newest_cred_label - obtain the newest label on a cred 47 * @cred: cred to obtain label from (NOT NULL) 48 * 49 * Returns: newest version of confining label 50 */ 51 static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) 52 { 53 return aa_get_newest_label(aa_cred_raw_label(cred)); 54 } 55 56 /** 57 * __aa_task_raw_label - retrieve another task's label 58 * @task: task to query (NOT NULL) 59 * 60 * Returns: @task's label without incrementing its ref count 61 * 62 * If @task != current needs to be called in RCU safe critical section 63 */ 64 static inline struct aa_label *__aa_task_raw_label(struct task_struct *task) 65 { 66 return aa_cred_raw_label(__task_cred(task)); 67 } 68 69 /** 70 * aa_current_raw_label - find the current tasks confining label 71 * 72 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 73 * 74 * This fn will not update the tasks cred to the most up to date version 75 * of the label so it is safe to call when inside of locks. 76 */ 77 static inline struct aa_label *aa_current_raw_label(void) 78 { 79 return aa_cred_raw_label(current_cred()); 80 } 81 82 /** 83 * aa_get_current_label - get the newest version of the current tasks label 84 * 85 * Returns: newest version of confining label (NOT NULL) 86 * 87 * This fn will not update the tasks cred, so it is safe inside of locks 88 * 89 * The returned reference must be put with aa_put_label() 90 */ 91 static inline struct aa_label *aa_get_current_label(void) 92 { 93 struct aa_label *l = aa_current_raw_label(); 94 95 if (label_is_stale(l)) 96 return aa_get_newest_label(l); 97 return aa_get_label(l); 98 } 99 100 #define __end_current_label_crit_section(X) end_current_label_crit_section(X) 101 102 /** 103 * end_label_crit_section - put a reference found with begin_current_label.. 104 * @label: label reference to put 105 * 106 * Should only be used with a reference obtained with 107 * begin_current_label_crit_section and never used in situations where the 108 * task cred may be updated 109 */ 110 static inline void end_current_label_crit_section(struct aa_label *label) 111 { 112 if (label != aa_current_raw_label()) 113 aa_put_label(label); 114 } 115 116 /** 117 * __begin_current_label_crit_section - current's confining label 118 * 119 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 120 * 121 * safe to call inside locks 122 * 123 * The returned reference must be put with __end_current_label_crit_section() 124 * This must NOT be used if the task cred could be updated within the 125 * critical section between __begin_current_label_crit_section() .. 126 * __end_current_label_crit_section() 127 */ 128 static inline struct aa_label *__begin_current_label_crit_section(void) 129 { 130 struct aa_label *label = aa_current_raw_label(); 131 132 if (label_is_stale(label)) 133 label = aa_get_newest_label(label); 134 135 return label; 136 } 137 138 /** 139 * begin_current_label_crit_section - current's confining label and update it 140 * 141 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 142 * 143 * Not safe to call inside locks 144 * 145 * The returned reference must be put with end_current_label_crit_section() 146 * This must NOT be used if the task cred could be updated within the 147 * critical section between begin_current_label_crit_section() .. 148 * end_current_label_crit_section() 149 */ 150 static inline struct aa_label *begin_current_label_crit_section(void) 151 { 152 struct aa_label *label = aa_current_raw_label(); 153 154 might_sleep(); 155 156 if (label_is_stale(label)) { 157 label = aa_get_newest_label(label); 158 if (aa_replace_current_label(label) == 0) 159 /* task cred will keep the reference */ 160 aa_put_label(label); 161 } 162 163 return label; 164 } 165 166 static inline struct aa_ns *aa_get_current_ns(void) 167 { 168 struct aa_label *label; 169 struct aa_ns *ns; 170 171 label = __begin_current_label_crit_section(); 172 ns = aa_get_ns(labels_ns(label)); 173 __end_current_label_crit_section(label); 174 175 return ns; 176 } 177 178 #endif /* __AA_CONTEXT_H */ 179