1b886d83cSThomas Gleixner /* SPDX-License-Identifier: GPL-2.0-only */ 2cff281f6SJohn Johansen /* 3cff281f6SJohn Johansen * AppArmor security module 4cff281f6SJohn Johansen * 5cff281f6SJohn Johansen * This file contains AppArmor policy definitions. 6cff281f6SJohn Johansen * 7cff281f6SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 8cff281f6SJohn Johansen * Copyright 2009-2017 Canonical Ltd. 9cff281f6SJohn Johansen */ 10cff281f6SJohn Johansen 11cff281f6SJohn Johansen #ifndef __AA_NAMESPACE_H 12cff281f6SJohn Johansen #define __AA_NAMESPACE_H 13cff281f6SJohn Johansen 14cff281f6SJohn Johansen #include <linux/kref.h> 15cff281f6SJohn Johansen 16cff281f6SJohn Johansen #include "apparmor.h" 17cff281f6SJohn Johansen #include "apparmorfs.h" 18637f688dSJohn Johansen #include "label.h" 19cff281f6SJohn Johansen #include "policy.h" 20cff281f6SJohn Johansen 21cff281f6SJohn Johansen 22cff281f6SJohn Johansen /* struct aa_ns_acct - accounting of profiles in namespace 23cff281f6SJohn Johansen * @max_size: maximum space allowed for all profiles in namespace 24cff281f6SJohn Johansen * @max_count: maximum number of profiles that can be in this namespace 25cff281f6SJohn Johansen * @size: current size of profiles 26cff281f6SJohn Johansen * @count: current count of profiles (includes null profiles) 27cff281f6SJohn Johansen */ 28cff281f6SJohn Johansen struct aa_ns_acct { 29cff281f6SJohn Johansen int max_size; 30cff281f6SJohn Johansen int max_count; 31cff281f6SJohn Johansen int size; 32cff281f6SJohn Johansen int count; 33cff281f6SJohn Johansen }; 34cff281f6SJohn Johansen 3598849dffSJohn Johansen /* struct aa_ns - namespace for a set of profiles 36cff281f6SJohn Johansen * @base: common policy 37cff281f6SJohn Johansen * @parent: parent of namespace 38cff281f6SJohn Johansen * @lock: lock for modifying the object 39cff281f6SJohn Johansen * @acct: accounting for the namespace 40cff281f6SJohn Johansen * @unconfined: special unconfined profile for the namespace 41cff281f6SJohn Johansen * @sub_ns: list of namespaces under the current namespace. 42cff281f6SJohn Johansen * @uniq_null: uniq value used for null learning profiles 43cff281f6SJohn Johansen * @uniq_id: a unique id count for the profiles in the namespace 44a71ada30SJohn Johansen * @level: level of ns within the tree hierarchy 45cff281f6SJohn Johansen * @dents: dentries for the namespaces file entries in apparmorfs 46cff281f6SJohn Johansen * 4731617ddfSJohn Johansen * An aa_ns defines the set profiles that are searched to determine which 4831617ddfSJohn Johansen * profile to attach to a task. Profiles can not be shared between aa_ns 4931617ddfSJohn Johansen * and profile names within a namespace are guaranteed to be unique. When 5031617ddfSJohn Johansen * profiles in separate namespaces have the same name they are NOT considered 5131617ddfSJohn Johansen * to be equivalent. 52cff281f6SJohn Johansen * 53cff281f6SJohn Johansen * Namespaces are hierarchical and only namespaces and profiles below the 54cff281f6SJohn Johansen * current namespace are visible. 55cff281f6SJohn Johansen * 56cff281f6SJohn Johansen * Namespace names must be unique and can not contain the characters :/\0 57cff281f6SJohn Johansen */ 5898849dffSJohn Johansen struct aa_ns { 59cff281f6SJohn Johansen struct aa_policy base; 6098849dffSJohn Johansen struct aa_ns *parent; 61cff281f6SJohn Johansen struct mutex lock; 62cff281f6SJohn Johansen struct aa_ns_acct acct; 63cff281f6SJohn Johansen struct aa_profile *unconfined; 64cff281f6SJohn Johansen struct list_head sub_ns; 65cff281f6SJohn Johansen atomic_t uniq_null; 66cff281f6SJohn Johansen long uniq_id; 67a71ada30SJohn Johansen int level; 685d5182caSJohn Johansen long revision; 69d9bf2c26SJohn Johansen wait_queue_head_t wait; 705d5182caSJohn Johansen 71637f688dSJohn Johansen struct aa_labelset labels; 725d5182caSJohn Johansen struct list_head rawdata_list; 73cff281f6SJohn Johansen 74cff281f6SJohn Johansen struct dentry *dents[AAFS_NS_SIZEOF]; 75cff281f6SJohn Johansen }; 76cff281f6SJohn Johansen 7798849dffSJohn Johansen extern struct aa_ns *root_ns; 78cff281f6SJohn Johansen 79cff281f6SJohn Johansen extern const char *aa_hidden_ns_name; 80cff281f6SJohn Johansen 81637f688dSJohn Johansen #define ns_unconfined(NS) (&(NS)->unconfined->label) 82637f688dSJohn Johansen 8392b6d8efSJohn Johansen bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns); 8492b6d8efSJohn Johansen const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns); 8598849dffSJohn Johansen void aa_free_ns(struct aa_ns *ns); 86cff281f6SJohn Johansen int aa_alloc_root_ns(void); 87cff281f6SJohn Johansen void aa_free_root_ns(void); 8898849dffSJohn Johansen void aa_free_ns_kref(struct kref *kref); 89cff281f6SJohn Johansen 9098849dffSJohn Johansen struct aa_ns *aa_find_ns(struct aa_ns *root, const char *name); 919a2d40c1SJohn Johansen struct aa_ns *aa_findn_ns(struct aa_ns *root, const char *name, size_t n); 923664268fSJohn Johansen struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n); 933664268fSJohn Johansen struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n); 9473688d1eSJohn Johansen struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name, 9573688d1eSJohn Johansen struct dentry *dir); 9673688d1eSJohn Johansen struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name); 9798849dffSJohn Johansen void __aa_remove_ns(struct aa_ns *ns); 98cff281f6SJohn Johansen 99cff281f6SJohn Johansen static inline struct aa_profile *aa_deref_parent(struct aa_profile *p) 100cff281f6SJohn Johansen { 101cff281f6SJohn Johansen return rcu_dereference_protected(p->parent, 102cff281f6SJohn Johansen mutex_is_locked(&p->ns->lock)); 103cff281f6SJohn Johansen } 104cff281f6SJohn Johansen 105cff281f6SJohn Johansen /** 10698849dffSJohn Johansen * aa_get_ns - increment references count on @ns 107cff281f6SJohn Johansen * @ns: namespace to increment reference count of (MAYBE NULL) 108cff281f6SJohn Johansen * 109cff281f6SJohn Johansen * Returns: pointer to @ns, if @ns is NULL returns NULL 110cff281f6SJohn Johansen * Requires: @ns must be held with valid refcount when called 111cff281f6SJohn Johansen */ 11298849dffSJohn Johansen static inline struct aa_ns *aa_get_ns(struct aa_ns *ns) 113cff281f6SJohn Johansen { 114cff281f6SJohn Johansen if (ns) 115cff281f6SJohn Johansen aa_get_profile(ns->unconfined); 116cff281f6SJohn Johansen 117cff281f6SJohn Johansen return ns; 118cff281f6SJohn Johansen } 119cff281f6SJohn Johansen 120cff281f6SJohn Johansen /** 12198849dffSJohn Johansen * aa_put_ns - decrement refcount on @ns 122cff281f6SJohn Johansen * @ns: namespace to put reference of 123cff281f6SJohn Johansen * 124cff281f6SJohn Johansen * Decrement reference count of @ns and if no longer in use free it 125cff281f6SJohn Johansen */ 12698849dffSJohn Johansen static inline void aa_put_ns(struct aa_ns *ns) 127cff281f6SJohn Johansen { 128cff281f6SJohn Johansen if (ns) 129cff281f6SJohn Johansen aa_put_profile(ns->unconfined); 130cff281f6SJohn Johansen } 131cff281f6SJohn Johansen 132cff281f6SJohn Johansen /** 1339a2d40c1SJohn Johansen * __aa_findn_ns - find a namespace on a list by @name 134cff281f6SJohn Johansen * @head: list to search for namespace on (NOT NULL) 135cff281f6SJohn Johansen * @name: name of namespace to look for (NOT NULL) 1369a2d40c1SJohn Johansen * @n: length of @name 137cff281f6SJohn Johansen * Returns: unrefcounted namespace 138cff281f6SJohn Johansen * 139cff281f6SJohn Johansen * Requires: rcu_read_lock be held 140cff281f6SJohn Johansen */ 1419a2d40c1SJohn Johansen static inline struct aa_ns *__aa_findn_ns(struct list_head *head, 1429a2d40c1SJohn Johansen const char *name, size_t n) 1439a2d40c1SJohn Johansen { 1449a2d40c1SJohn Johansen return (struct aa_ns *)__policy_strn_find(head, name, n); 1459a2d40c1SJohn Johansen } 1469a2d40c1SJohn Johansen 14798849dffSJohn Johansen static inline struct aa_ns *__aa_find_ns(struct list_head *head, 148cff281f6SJohn Johansen const char *name) 149cff281f6SJohn Johansen { 1509a2d40c1SJohn Johansen return __aa_findn_ns(head, name, strlen(name)); 151cff281f6SJohn Johansen } 152cff281f6SJohn Johansen 1533664268fSJohn Johansen static inline struct aa_ns *__aa_lookup_ns(struct aa_ns *base, 1543664268fSJohn Johansen const char *hname) 1553664268fSJohn Johansen { 1563664268fSJohn Johansen return __aa_lookupn_ns(base, hname, strlen(hname)); 1573664268fSJohn Johansen } 1583664268fSJohn Johansen 1593664268fSJohn Johansen static inline struct aa_ns *aa_lookup_ns(struct aa_ns *view, const char *name) 1603664268fSJohn Johansen { 1613664268fSJohn Johansen return aa_lookupn_ns(view, name, strlen(name)); 1623664268fSJohn Johansen } 1633664268fSJohn Johansen 164cff281f6SJohn Johansen #endif /* AA_NAMESPACE_H */ 165