1cff281f6SJohn Johansen /*
2cff281f6SJohn Johansen  * AppArmor security module
3cff281f6SJohn Johansen  *
4cff281f6SJohn Johansen  * This file contains AppArmor policy definitions.
5cff281f6SJohn Johansen  *
6cff281f6SJohn Johansen  * Copyright (C) 1998-2008 Novell/SUSE
7cff281f6SJohn Johansen  * Copyright 2009-2017 Canonical Ltd.
8cff281f6SJohn Johansen  *
9cff281f6SJohn Johansen  * This program is free software; you can redistribute it and/or
10cff281f6SJohn Johansen  * modify it under the terms of the GNU General Public License as
11cff281f6SJohn Johansen  * published by the Free Software Foundation, version 2 of the
12cff281f6SJohn Johansen  * License.
13cff281f6SJohn Johansen  */
14cff281f6SJohn Johansen 
15cff281f6SJohn Johansen #ifndef __AA_NAMESPACE_H
16cff281f6SJohn Johansen #define __AA_NAMESPACE_H
17cff281f6SJohn Johansen 
18cff281f6SJohn Johansen #include <linux/kref.h>
19cff281f6SJohn Johansen 
20cff281f6SJohn Johansen #include "apparmor.h"
21cff281f6SJohn Johansen #include "apparmorfs.h"
22cff281f6SJohn Johansen #include "policy.h"
23cff281f6SJohn Johansen 
24cff281f6SJohn Johansen 
25cff281f6SJohn Johansen /* struct aa_ns_acct - accounting of profiles in namespace
26cff281f6SJohn Johansen  * @max_size: maximum space allowed for all profiles in namespace
27cff281f6SJohn Johansen  * @max_count: maximum number of profiles that can be in this namespace
28cff281f6SJohn Johansen  * @size: current size of profiles
29cff281f6SJohn Johansen  * @count: current count of profiles (includes null profiles)
30cff281f6SJohn Johansen  */
31cff281f6SJohn Johansen struct aa_ns_acct {
32cff281f6SJohn Johansen 	int max_size;
33cff281f6SJohn Johansen 	int max_count;
34cff281f6SJohn Johansen 	int size;
35cff281f6SJohn Johansen 	int count;
36cff281f6SJohn Johansen };
37cff281f6SJohn Johansen 
3898849dffSJohn Johansen /* struct aa_ns - namespace for a set of profiles
39cff281f6SJohn Johansen  * @base: common policy
40cff281f6SJohn Johansen  * @parent: parent of namespace
41cff281f6SJohn Johansen  * @lock: lock for modifying the object
42cff281f6SJohn Johansen  * @acct: accounting for the namespace
43cff281f6SJohn Johansen  * @unconfined: special unconfined profile for the namespace
44cff281f6SJohn Johansen  * @sub_ns: list of namespaces under the current namespace.
45cff281f6SJohn Johansen  * @uniq_null: uniq value used for null learning profiles
46cff281f6SJohn Johansen  * @uniq_id: a unique id count for the profiles in the namespace
47a71ada30SJohn Johansen  * @level: level of ns within the tree hierarchy
48cff281f6SJohn Johansen  * @dents: dentries for the namespaces file entries in apparmorfs
49cff281f6SJohn Johansen  *
5031617ddfSJohn Johansen  * An aa_ns defines the set profiles that are searched to determine which
5131617ddfSJohn Johansen  * profile to attach to a task.  Profiles can not be shared between aa_ns
5231617ddfSJohn Johansen  * and profile names within a namespace are guaranteed to be unique.  When
5331617ddfSJohn Johansen  * profiles in separate namespaces have the same name they are NOT considered
5431617ddfSJohn Johansen  * to be equivalent.
55cff281f6SJohn Johansen  *
56cff281f6SJohn Johansen  * Namespaces are hierarchical and only namespaces and profiles below the
57cff281f6SJohn Johansen  * current namespace are visible.
58cff281f6SJohn Johansen  *
59cff281f6SJohn Johansen  * Namespace names must be unique and can not contain the characters :/\0
60cff281f6SJohn Johansen  */
6198849dffSJohn Johansen struct aa_ns {
62cff281f6SJohn Johansen 	struct aa_policy base;
6398849dffSJohn Johansen 	struct aa_ns *parent;
64cff281f6SJohn Johansen 	struct mutex lock;
65cff281f6SJohn Johansen 	struct aa_ns_acct acct;
66cff281f6SJohn Johansen 	struct aa_profile *unconfined;
67cff281f6SJohn Johansen 	struct list_head sub_ns;
68cff281f6SJohn Johansen 	atomic_t uniq_null;
69cff281f6SJohn Johansen 	long uniq_id;
70a71ada30SJohn Johansen 	int level;
715d5182caSJohn Johansen 	long revision;
725d5182caSJohn Johansen 
735d5182caSJohn Johansen 	struct list_head rawdata_list;
74cff281f6SJohn Johansen 
75cff281f6SJohn Johansen 	struct dentry *dents[AAFS_NS_SIZEOF];
76cff281f6SJohn Johansen };
77cff281f6SJohn Johansen 
7898849dffSJohn Johansen extern struct aa_ns *root_ns;
79cff281f6SJohn Johansen 
80cff281f6SJohn Johansen extern const char *aa_hidden_ns_name;
81cff281f6SJohn Johansen 
8292b6d8efSJohn Johansen bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
8392b6d8efSJohn Johansen const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
8498849dffSJohn Johansen void aa_free_ns(struct aa_ns *ns);
85cff281f6SJohn Johansen int aa_alloc_root_ns(void);
86cff281f6SJohn Johansen void aa_free_root_ns(void);
8798849dffSJohn Johansen void aa_free_ns_kref(struct kref *kref);
88cff281f6SJohn Johansen 
8998849dffSJohn Johansen struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name);
909a2d40c1SJohn Johansen struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n);
9173688d1eSJohn Johansen struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
9273688d1eSJohn Johansen 				     struct dentry *dir);
9373688d1eSJohn Johansen struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
9498849dffSJohn Johansen void __aa_remove_ns(struct aa_ns *ns);
95cff281f6SJohn Johansen 
96cff281f6SJohn Johansen static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
97cff281f6SJohn Johansen {
98cff281f6SJohn Johansen 	return rcu_dereference_protected(p->parent,
99cff281f6SJohn Johansen 					 mutex_is_locked(&p->ns->lock));
100cff281f6SJohn Johansen }
101cff281f6SJohn Johansen 
102cff281f6SJohn Johansen /**
10398849dffSJohn Johansen  * aa_get_ns - increment references count on @ns
104cff281f6SJohn Johansen  * @ns: namespace to increment reference count of (MAYBE NULL)
105cff281f6SJohn Johansen  *
106cff281f6SJohn Johansen  * Returns: pointer to @ns, if @ns is NULL returns NULL
107cff281f6SJohn Johansen  * Requires: @ns must be held with valid refcount when called
108cff281f6SJohn Johansen  */
10998849dffSJohn Johansen static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
110cff281f6SJohn Johansen {
111cff281f6SJohn Johansen 	if (ns)
112cff281f6SJohn Johansen 		aa_get_profile(ns->unconfined);
113cff281f6SJohn Johansen 
114cff281f6SJohn Johansen 	return ns;
115cff281f6SJohn Johansen }
116cff281f6SJohn Johansen 
117cff281f6SJohn Johansen /**
11898849dffSJohn Johansen  * aa_put_ns - decrement refcount on @ns
119cff281f6SJohn Johansen  * @ns: namespace to put reference of
120cff281f6SJohn Johansen  *
121cff281f6SJohn Johansen  * Decrement reference count of @ns and if no longer in use free it
122cff281f6SJohn Johansen  */
12398849dffSJohn Johansen static inline void aa_put_ns(struct aa_ns *ns)
124cff281f6SJohn Johansen {
125cff281f6SJohn Johansen 	if (ns)
126cff281f6SJohn Johansen 		aa_put_profile(ns->unconfined);
127cff281f6SJohn Johansen }
128cff281f6SJohn Johansen 
129cff281f6SJohn Johansen /**
1309a2d40c1SJohn Johansen  * __aa_findn_ns - find a namespace on a list by @name
131cff281f6SJohn Johansen  * @head: list to search for namespace on  (NOT NULL)
132cff281f6SJohn Johansen  * @name: name of namespace to look for  (NOT NULL)
1339a2d40c1SJohn Johansen  * @n: length of @name
134cff281f6SJohn Johansen  * Returns: unrefcounted namespace
135cff281f6SJohn Johansen  *
136cff281f6SJohn Johansen  * Requires: rcu_read_lock be held
137cff281f6SJohn Johansen  */
1389a2d40c1SJohn Johansen static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
1399a2d40c1SJohn Johansen 					  const char *name, size_t n)
1409a2d40c1SJohn Johansen {
1419a2d40c1SJohn Johansen 	return (struct aa_ns *)__policy_strn_find(head, name, n);
1429a2d40c1SJohn Johansen }
1439a2d40c1SJohn Johansen 
14498849dffSJohn Johansen static inline struct aa_ns *__aa_find_ns(struct list_head *head,
145cff281f6SJohn Johansen 					 const char *name)
146cff281f6SJohn Johansen {
1479a2d40c1SJohn Johansen 	return __aa_findn_ns(head, name, strlen(name));
148cff281f6SJohn Johansen }
149cff281f6SJohn Johansen 
150cff281f6SJohn Johansen #endif /* AA_NAMESPACE_H */
151