1b886d83cSThomas Gleixner /* SPDX-License-Identifier: GPL-2.0-only */
2cff281f6SJohn Johansen /*
3cff281f6SJohn Johansen * AppArmor security module
4cff281f6SJohn Johansen *
5cff281f6SJohn Johansen * This file contains AppArmor policy definitions.
6cff281f6SJohn Johansen *
7cff281f6SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE
8cff281f6SJohn Johansen * Copyright 2009-2017 Canonical Ltd.
9cff281f6SJohn Johansen */
10cff281f6SJohn Johansen
11cff281f6SJohn Johansen #ifndef __AA_NAMESPACE_H
12cff281f6SJohn Johansen #define __AA_NAMESPACE_H
13cff281f6SJohn Johansen
14cff281f6SJohn Johansen #include <linux/kref.h>
15cff281f6SJohn Johansen
16cff281f6SJohn Johansen #include "apparmor.h"
17cff281f6SJohn Johansen #include "apparmorfs.h"
18637f688dSJohn Johansen #include "label.h"
19cff281f6SJohn Johansen #include "policy.h"
20cff281f6SJohn Johansen
21cff281f6SJohn Johansen
22cff281f6SJohn Johansen /* struct aa_ns_acct - accounting of profiles in namespace
23cff281f6SJohn Johansen * @max_size: maximum space allowed for all profiles in namespace
24cff281f6SJohn Johansen * @max_count: maximum number of profiles that can be in this namespace
25cff281f6SJohn Johansen * @size: current size of profiles
26cff281f6SJohn Johansen * @count: current count of profiles (includes null profiles)
27cff281f6SJohn Johansen */
28cff281f6SJohn Johansen struct aa_ns_acct {
29cff281f6SJohn Johansen int max_size;
30cff281f6SJohn Johansen int max_count;
31cff281f6SJohn Johansen int size;
32cff281f6SJohn Johansen int count;
33cff281f6SJohn Johansen };
34cff281f6SJohn Johansen
3598849dffSJohn Johansen /* struct aa_ns - namespace for a set of profiles
36cff281f6SJohn Johansen * @base: common policy
37cff281f6SJohn Johansen * @parent: parent of namespace
38cff281f6SJohn Johansen * @lock: lock for modifying the object
39cff281f6SJohn Johansen * @acct: accounting for the namespace
40cff281f6SJohn Johansen * @unconfined: special unconfined profile for the namespace
41cff281f6SJohn Johansen * @sub_ns: list of namespaces under the current namespace.
42cff281f6SJohn Johansen * @uniq_null: uniq value used for null learning profiles
43cff281f6SJohn Johansen * @uniq_id: a unique id count for the profiles in the namespace
44a71ada30SJohn Johansen * @level: level of ns within the tree hierarchy
45cff281f6SJohn Johansen * @dents: dentries for the namespaces file entries in apparmorfs
46cff281f6SJohn Johansen *
4731617ddfSJohn Johansen * An aa_ns defines the set profiles that are searched to determine which
4831617ddfSJohn Johansen * profile to attach to a task. Profiles can not be shared between aa_ns
4931617ddfSJohn Johansen * and profile names within a namespace are guaranteed to be unique. When
5031617ddfSJohn Johansen * profiles in separate namespaces have the same name they are NOT considered
5131617ddfSJohn Johansen * to be equivalent.
52cff281f6SJohn Johansen *
53cff281f6SJohn Johansen * Namespaces are hierarchical and only namespaces and profiles below the
54cff281f6SJohn Johansen * current namespace are visible.
55cff281f6SJohn Johansen *
56cff281f6SJohn Johansen * Namespace names must be unique and can not contain the characters :/\0
57cff281f6SJohn Johansen */
5898849dffSJohn Johansen struct aa_ns {
59cff281f6SJohn Johansen struct aa_policy base;
6098849dffSJohn Johansen struct aa_ns *parent;
61cff281f6SJohn Johansen struct mutex lock;
62cff281f6SJohn Johansen struct aa_ns_acct acct;
63cff281f6SJohn Johansen struct aa_profile *unconfined;
64cff281f6SJohn Johansen struct list_head sub_ns;
65cff281f6SJohn Johansen atomic_t uniq_null;
66cff281f6SJohn Johansen long uniq_id;
67a71ada30SJohn Johansen int level;
685d5182caSJohn Johansen long revision;
69d9bf2c26SJohn Johansen wait_queue_head_t wait;
705d5182caSJohn Johansen
71637f688dSJohn Johansen struct aa_labelset labels;
725d5182caSJohn Johansen struct list_head rawdata_list;
73cff281f6SJohn Johansen
74cff281f6SJohn Johansen struct dentry *dents[AAFS_NS_SIZEOF];
75cff281f6SJohn Johansen };
76cff281f6SJohn Johansen
77*95c0581fSJohn Johansen extern struct aa_label *kernel_t;
7898849dffSJohn Johansen extern struct aa_ns *root_ns;
79cff281f6SJohn Johansen
80cff281f6SJohn Johansen extern const char *aa_hidden_ns_name;
81cff281f6SJohn Johansen
82637f688dSJohn Johansen #define ns_unconfined(NS) (&(NS)->unconfined->label)
83637f688dSJohn Johansen
8492b6d8efSJohn Johansen bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
8592b6d8efSJohn Johansen const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
8698849dffSJohn Johansen void aa_free_ns(struct aa_ns *ns);
87cff281f6SJohn Johansen int aa_alloc_root_ns(void);
88cff281f6SJohn Johansen void aa_free_root_ns(void);
8998849dffSJohn Johansen void aa_free_ns_kref(struct kref *kref);
90cff281f6SJohn Johansen
9198849dffSJohn Johansen struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name);
929a2d40c1SJohn Johansen struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n);
933664268fSJohn Johansen struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n);
943664268fSJohn Johansen struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n);
9573688d1eSJohn Johansen struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
9673688d1eSJohn Johansen struct dentry *dir);
9773688d1eSJohn Johansen struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
9898849dffSJohn Johansen void __aa_remove_ns(struct aa_ns *ns);
99cff281f6SJohn Johansen
aa_deref_parent(struct aa_profile * p)100cff281f6SJohn Johansen static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
101cff281f6SJohn Johansen {
102cff281f6SJohn Johansen return rcu_dereference_protected(p->parent,
103cff281f6SJohn Johansen mutex_is_locked(&p->ns->lock));
104cff281f6SJohn Johansen }
105cff281f6SJohn Johansen
106cff281f6SJohn Johansen /**
10798849dffSJohn Johansen * aa_get_ns - increment references count on @ns
108cff281f6SJohn Johansen * @ns: namespace to increment reference count of (MAYBE NULL)
109cff281f6SJohn Johansen *
110cff281f6SJohn Johansen * Returns: pointer to @ns, if @ns is NULL returns NULL
111cff281f6SJohn Johansen * Requires: @ns must be held with valid refcount when called
112cff281f6SJohn Johansen */
aa_get_ns(struct aa_ns * ns)11398849dffSJohn Johansen static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
114cff281f6SJohn Johansen {
115cff281f6SJohn Johansen if (ns)
116cff281f6SJohn Johansen aa_get_profile(ns->unconfined);
117cff281f6SJohn Johansen
118cff281f6SJohn Johansen return ns;
119cff281f6SJohn Johansen }
120cff281f6SJohn Johansen
121cff281f6SJohn Johansen /**
12298849dffSJohn Johansen * aa_put_ns - decrement refcount on @ns
123cff281f6SJohn Johansen * @ns: namespace to put reference of
124cff281f6SJohn Johansen *
125cff281f6SJohn Johansen * Decrement reference count of @ns and if no longer in use free it
126cff281f6SJohn Johansen */
aa_put_ns(struct aa_ns * ns)12798849dffSJohn Johansen static inline void aa_put_ns(struct aa_ns *ns)
128cff281f6SJohn Johansen {
129cff281f6SJohn Johansen if (ns)
130cff281f6SJohn Johansen aa_put_profile(ns->unconfined);
131cff281f6SJohn Johansen }
132cff281f6SJohn Johansen
133cff281f6SJohn Johansen /**
1349a2d40c1SJohn Johansen * __aa_findn_ns - find a namespace on a list by @name
135cff281f6SJohn Johansen * @head: list to search for namespace on (NOT NULL)
136cff281f6SJohn Johansen * @name: name of namespace to look for (NOT NULL)
1379a2d40c1SJohn Johansen * @n: length of @name
138cff281f6SJohn Johansen * Returns: unrefcounted namespace
139cff281f6SJohn Johansen *
140cff281f6SJohn Johansen * Requires: rcu_read_lock be held
141cff281f6SJohn Johansen */
__aa_findn_ns(struct list_head * head,const char * name,size_t n)1429a2d40c1SJohn Johansen static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
1439a2d40c1SJohn Johansen const char *name, size_t n)
1449a2d40c1SJohn Johansen {
1459a2d40c1SJohn Johansen return (struct aa_ns *)__policy_strn_find(head, name, n);
1469a2d40c1SJohn Johansen }
1479a2d40c1SJohn Johansen
__aa_find_ns(struct list_head * head,const char * name)14898849dffSJohn Johansen static inline struct aa_ns *__aa_find_ns(struct list_head *head,
149cff281f6SJohn Johansen const char *name)
150cff281f6SJohn Johansen {
1519a2d40c1SJohn Johansen return __aa_findn_ns(head, name, strlen(name));
152cff281f6SJohn Johansen }
153cff281f6SJohn Johansen
__aa_lookup_ns(struct aa_ns * base,const char * hname)1543664268fSJohn Johansen static inline struct aa_ns *__aa_lookup_ns(struct aa_ns *base,
1553664268fSJohn Johansen const char *hname)
1563664268fSJohn Johansen {
1573664268fSJohn Johansen return __aa_lookupn_ns(base, hname, strlen(hname));
1583664268fSJohn Johansen }
1593664268fSJohn Johansen
aa_lookup_ns(struct aa_ns * view,const char * name)1603664268fSJohn Johansen static inline struct aa_ns *aa_lookup_ns(struct aa_ns *view, const char *name)
1613664268fSJohn Johansen {
1623664268fSJohn Johansen return aa_lookupn_ns(view, name, strlen(name));
1633664268fSJohn Johansen }
1643664268fSJohn Johansen
165cff281f6SJohn Johansen #endif /* AA_NAMESPACE_H */
166