1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor security identifier (secid) manipulation fns 5 * 6 * Copyright 2009-2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 * 13 * 14 * AppArmor allocates a unique secid for every label used. If a label 15 * is replaced it receives the secid of the label it is replacing. 16 */ 17 18 #include <linux/errno.h> 19 #include <linux/err.h> 20 #include <linux/gfp.h> 21 #include <linux/idr.h> 22 #include <linux/slab.h> 23 #include <linux/spinlock.h> 24 25 #include "include/cred.h" 26 #include "include/lib.h" 27 #include "include/secid.h" 28 #include "include/label.h" 29 #include "include/policy_ns.h" 30 31 /* 32 * secids - do not pin labels with a refcount. They rely on the label 33 * properly updating/freeing them 34 */ 35 36 #define AA_FIRST_SECID 1 37 38 static DEFINE_IDR(aa_secids); 39 static DEFINE_SPINLOCK(secid_lock); 40 41 /* 42 * TODO: allow policy to reserve a secid range? 43 * TODO: add secid pinning 44 * TODO: use secid_update in label replace 45 */ 46 47 /** 48 * aa_secid_update - update a secid mapping to a new label 49 * @secid: secid to update 50 * @label: label the secid will now map to 51 */ 52 void aa_secid_update(u32 secid, struct aa_label *label) 53 { 54 unsigned long flags; 55 56 spin_lock_irqsave(&secid_lock, flags); 57 idr_replace(&aa_secids, label, secid); 58 spin_unlock_irqrestore(&secid_lock, flags); 59 } 60 61 /** 62 * 63 * see label for inverse aa_label_to_secid 64 */ 65 struct aa_label *aa_secid_to_label(u32 secid) 66 { 67 struct aa_label *label; 68 69 rcu_read_lock(); 70 label = idr_find(&aa_secids, secid); 71 rcu_read_unlock(); 72 73 return label; 74 } 75 76 int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 77 { 78 /* TODO: cache secctx and ref count so we don't have to recreate */ 79 struct aa_label *label = aa_secid_to_label(secid); 80 int len; 81 82 AA_BUG(!seclen); 83 84 if (!label) 85 return -EINVAL; 86 87 if (secdata) 88 len = aa_label_asxprint(secdata, root_ns, label, 89 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 90 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, 91 GFP_ATOMIC); 92 else 93 len = aa_label_snxprint(NULL, 0, root_ns, label, 94 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 95 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT); 96 if (len < 0) 97 return -ENOMEM; 98 99 *seclen = len; 100 101 return 0; 102 } 103 104 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 105 { 106 struct aa_label *label; 107 108 label = aa_label_strn_parse(&root_ns->unconfined->label, secdata, 109 seclen, GFP_KERNEL, false, false); 110 if (IS_ERR(label)) 111 return PTR_ERR(label); 112 *secid = label->secid; 113 114 return 0; 115 } 116 117 void apparmor_release_secctx(char *secdata, u32 seclen) 118 { 119 kfree(secdata); 120 } 121 122 /** 123 * aa_alloc_secid - allocate a new secid for a profile 124 * @label: the label to allocate a secid for 125 * @gfp: memory allocation flags 126 * 127 * Returns: 0 with @label->secid initialized 128 * <0 returns error with @label->secid set to AA_SECID_INVALID 129 */ 130 int aa_alloc_secid(struct aa_label *label, gfp_t gfp) 131 { 132 unsigned long flags; 133 int ret; 134 135 idr_preload(gfp); 136 spin_lock_irqsave(&secid_lock, flags); 137 ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC); 138 spin_unlock_irqrestore(&secid_lock, flags); 139 idr_preload_end(); 140 141 if (ret < 0) { 142 label->secid = AA_SECID_INVALID; 143 return ret; 144 } 145 146 AA_BUG(ret == AA_SECID_INVALID); 147 label->secid = ret; 148 return 0; 149 } 150 151 /** 152 * aa_free_secid - free a secid 153 * @secid: secid to free 154 */ 155 void aa_free_secid(u32 secid) 156 { 157 unsigned long flags; 158 159 spin_lock_irqsave(&secid_lock, flags); 160 idr_remove(&aa_secids, secid); 161 spin_unlock_irqrestore(&secid_lock, flags); 162 } 163 164 void aa_secids_init(void) 165 { 166 idr_init_base(&aa_secids, AA_FIRST_SECID); 167 } 168