1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor policy loading interface function definitions. 5 * 6 * Copyright (C) 1998-2008 Novell/SUSE 7 * Copyright 2009-2010 Canonical Ltd. 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License as 11 * published by the Free Software Foundation, version 2 of the 12 * License. 13 */ 14 15 #ifndef __POLICY_INTERFACE_H 16 #define __POLICY_INTERFACE_H 17 18 #include <linux/list.h> 19 #include <linux/kref.h> 20 #include <linux/dcache.h> 21 #include <linux/workqueue.h> 22 23 struct aa_load_ent { 24 struct list_head list; 25 struct aa_profile *new; 26 struct aa_profile *old; 27 struct aa_profile *rename; 28 const char *ns_name; 29 }; 30 31 void aa_load_ent_free(struct aa_load_ent *ent); 32 struct aa_load_ent *aa_load_ent_alloc(void); 33 34 #define PACKED_FLAG_HAT 1 35 36 #define PACKED_MODE_ENFORCE 0 37 #define PACKED_MODE_COMPLAIN 1 38 #define PACKED_MODE_KILL 2 39 #define PACKED_MODE_UNCONFINED 3 40 41 struct aa_ns; 42 43 enum { 44 AAFS_LOADDATA_ABI = 0, 45 AAFS_LOADDATA_REVISION, 46 AAFS_LOADDATA_HASH, 47 AAFS_LOADDATA_DATA, 48 AAFS_LOADDATA_DIR, /* must be last actual entry */ 49 AAFS_LOADDATA_NDENTS /* count of entries */ 50 }; 51 52 /* 53 * struct aa_loaddata - buffer of policy raw_data set 54 * 55 * there is no loaddata ref for being on ns list, nor a ref from 56 * d_inode(@dentry) when grab a ref from these, @ns->lock must be held 57 * && __aa_get_loaddata() needs to be used, and the return value 58 * checked, if NULL the loaddata is already being reaped and should be 59 * considered dead. 60 */ 61 struct aa_loaddata { 62 struct kref count; 63 struct list_head list; 64 struct work_struct work; 65 struct dentry *dents[AAFS_LOADDATA_NDENTS]; 66 struct aa_ns *ns; 67 char *name; 68 size_t size; 69 long revision; /* the ns policy revision this caused */ 70 int abi; 71 unsigned char *hash; 72 73 char *data; 74 }; 75 76 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh, const char **ns); 77 78 /** 79 * __aa_get_loaddata - get a reference count to uncounted data reference 80 * @data: reference to get a count on 81 * 82 * Returns: pointer to reference OR NULL if race is lost and reference is 83 * being repeated. 84 * Requires: @data->ns->lock held, and the return code MUST be checked 85 * 86 * Use only from inode->i_private and @data->list found references 87 */ 88 static inline struct aa_loaddata * 89 __aa_get_loaddata(struct aa_loaddata *data) 90 { 91 if (data && kref_get_unless_zero(&(data->count))) 92 return data; 93 94 return NULL; 95 } 96 97 /** 98 * aa_get_loaddata - get a reference count from a counted data reference 99 * @data: reference to get a count on 100 * 101 * Returns: point to reference 102 * Requires: @data to have a valid reference count on it. It is a bug 103 * if the race to reap can be encountered when it is used. 104 */ 105 static inline struct aa_loaddata * 106 aa_get_loaddata(struct aa_loaddata *data) 107 { 108 struct aa_loaddata *tmp = __aa_get_loaddata(data); 109 110 AA_BUG(data && !tmp); 111 112 return tmp; 113 } 114 115 void __aa_loaddata_update(struct aa_loaddata *data, long revision); 116 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r); 117 void aa_loaddata_kref(struct kref *kref); 118 struct aa_loaddata *aa_loaddata_alloc(size_t size); 119 static inline void aa_put_loaddata(struct aa_loaddata *data) 120 { 121 if (data) 122 kref_put(&data->count, aa_loaddata_kref); 123 } 124 125 #endif /* __POLICY_INTERFACE_H */ 126