1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor security identifier (secid) manipulation fns 5 * 6 * Copyright 2009-2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 * 13 * 14 * AppArmor allocates a unique secid for every label used. If a label 15 * is replaced it receives the secid of the label it is replacing. 16 */ 17 18 #include <linux/errno.h> 19 #include <linux/err.h> 20 #include <linux/gfp.h> 21 #include <linux/idr.h> 22 #include <linux/slab.h> 23 #include <linux/spinlock.h> 24 25 #include "include/cred.h" 26 #include "include/lib.h" 27 #include "include/secid.h" 28 #include "include/label.h" 29 #include "include/policy_ns.h" 30 31 /* 32 * secids - do not pin labels with a refcount. They rely on the label 33 * properly updating/freeing them 34 */ 35 #define AA_FIRST_SECID 2 36 37 static DEFINE_IDR(aa_secids); 38 static DEFINE_SPINLOCK(secid_lock); 39 40 /* 41 * TODO: allow policy to reserve a secid range? 42 * TODO: add secid pinning 43 * TODO: use secid_update in label replace 44 */ 45 46 /** 47 * aa_secid_update - update a secid mapping to a new label 48 * @secid: secid to update 49 * @label: label the secid will now map to 50 */ 51 void aa_secid_update(u32 secid, struct aa_label *label) 52 { 53 unsigned long flags; 54 55 spin_lock_irqsave(&secid_lock, flags); 56 idr_replace(&aa_secids, label, secid); 57 spin_unlock_irqrestore(&secid_lock, flags); 58 } 59 60 /** 61 * 62 * see label for inverse aa_label_to_secid 63 */ 64 struct aa_label *aa_secid_to_label(u32 secid) 65 { 66 struct aa_label *label; 67 68 rcu_read_lock(); 69 label = idr_find(&aa_secids, secid); 70 rcu_read_unlock(); 71 72 return label; 73 } 74 75 int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 76 { 77 /* TODO: cache secctx and ref count so we don't have to recreate */ 78 struct aa_label *label = aa_secid_to_label(secid); 79 int len; 80 81 AA_BUG(!seclen); 82 83 if (!label) 84 return -EINVAL; 85 86 if (secdata) 87 len = aa_label_asxprint(secdata, root_ns, label, 88 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 89 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, 90 GFP_ATOMIC); 91 else 92 len = aa_label_snxprint(NULL, 0, root_ns, label, 93 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 94 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT); 95 if (len < 0) 96 return -ENOMEM; 97 98 *seclen = len; 99 100 return 0; 101 } 102 103 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 104 { 105 struct aa_label *label; 106 107 label = aa_label_strn_parse(&root_ns->unconfined->label, secdata, 108 seclen, GFP_KERNEL, false, false); 109 if (IS_ERR(label)) 110 return PTR_ERR(label); 111 *secid = label->secid; 112 113 return 0; 114 } 115 116 void apparmor_release_secctx(char *secdata, u32 seclen) 117 { 118 kfree(secdata); 119 } 120 121 /** 122 * aa_alloc_secid - allocate a new secid for a profile 123 * @label: the label to allocate a secid for 124 * @gfp: memory allocation flags 125 * 126 * Returns: 0 with @label->secid initialized 127 * <0 returns error with @label->secid set to AA_SECID_INVALID 128 */ 129 int aa_alloc_secid(struct aa_label *label, gfp_t gfp) 130 { 131 unsigned long flags; 132 int ret; 133 134 idr_preload(gfp); 135 spin_lock_irqsave(&secid_lock, flags); 136 ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC); 137 spin_unlock_irqrestore(&secid_lock, flags); 138 idr_preload_end(); 139 140 if (ret < 0) { 141 label->secid = AA_SECID_INVALID; 142 return ret; 143 } 144 145 AA_BUG(ret == AA_SECID_INVALID); 146 label->secid = ret; 147 return 0; 148 } 149 150 /** 151 * aa_free_secid - free a secid 152 * @secid: secid to free 153 */ 154 void aa_free_secid(u32 secid) 155 { 156 unsigned long flags; 157 158 spin_lock_irqsave(&secid_lock, flags); 159 idr_remove(&aa_secids, secid); 160 spin_unlock_irqrestore(&secid_lock, flags); 161 } 162 163 void aa_secids_init(void) 164 { 165 idr_init_base(&aa_secids, AA_FIRST_SECID); 166 } 167