xref: /openbmc/linux/security/apparmor/secid.c (revision 8bd1369b)
1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor security identifier (secid) manipulation fns
5  *
6  * Copyright 2009-2017 Canonical Ltd.
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License as
10  * published by the Free Software Foundation, version 2 of the
11  * License.
12  *
13  *
14  * AppArmor allocates a unique secid for every label used. If a label
15  * is replaced it receives the secid of the label it is replacing.
16  */
17 
18 #include <linux/errno.h>
19 #include <linux/err.h>
20 #include <linux/gfp.h>
21 #include <linux/idr.h>
22 #include <linux/slab.h>
23 #include <linux/spinlock.h>
24 
25 #include "include/cred.h"
26 #include "include/lib.h"
27 #include "include/secid.h"
28 #include "include/label.h"
29 #include "include/policy_ns.h"
30 
31 /*
32  * secids - do not pin labels with a refcount. They rely on the label
33  * properly updating/freeing them
34  */
35 
36 #define AA_FIRST_SECID 1
37 
38 static DEFINE_IDR(aa_secids);
39 static DEFINE_SPINLOCK(secid_lock);
40 
41 /*
42  * TODO: allow policy to reserve a secid range?
43  * TODO: add secid pinning
44  * TODO: use secid_update in label replace
45  */
46 
47 /**
48  * aa_secid_update - update a secid mapping to a new label
49  * @secid: secid to update
50  * @label: label the secid will now map to
51  */
52 void aa_secid_update(u32 secid, struct aa_label *label)
53 {
54 	unsigned long flags;
55 
56 	spin_lock_irqsave(&secid_lock, flags);
57 	idr_replace(&aa_secids, label, secid);
58 	spin_unlock_irqrestore(&secid_lock, flags);
59 }
60 
61 /**
62  *
63  * see label for inverse aa_label_to_secid
64  */
65 struct aa_label *aa_secid_to_label(u32 secid)
66 {
67 	struct aa_label *label;
68 
69 	rcu_read_lock();
70 	label = idr_find(&aa_secids, secid);
71 	rcu_read_unlock();
72 
73 	return label;
74 }
75 
76 int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
77 {
78 	/* TODO: cache secctx and ref count so we don't have to recreate */
79 	struct aa_label *label = aa_secid_to_label(secid);
80 	int len;
81 
82 	AA_BUG(!secdata);
83 	AA_BUG(!seclen);
84 
85 	if (!label)
86 		return -EINVAL;
87 
88 	if (secdata)
89 		len = aa_label_asxprint(secdata, root_ns, label,
90 					FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
91 					FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT,
92 					GFP_ATOMIC);
93 	else
94 		len = aa_label_snxprint(NULL, 0, root_ns, label,
95 					FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
96 					FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT);
97 	if (len < 0)
98 		return -ENOMEM;
99 
100 	*seclen = len;
101 
102 	return 0;
103 }
104 
105 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
106 {
107 	struct aa_label *label;
108 
109 	label = aa_label_strn_parse(&root_ns->unconfined->label, secdata,
110 				    seclen, GFP_KERNEL, false, false);
111 	if (IS_ERR(label))
112 		return PTR_ERR(label);
113 	*secid = label->secid;
114 
115 	return 0;
116 }
117 
118 void apparmor_release_secctx(char *secdata, u32 seclen)
119 {
120 	kfree(secdata);
121 }
122 
123 /**
124  * aa_alloc_secid - allocate a new secid for a profile
125  * @label: the label to allocate a secid for
126  * @gfp: memory allocation flags
127  *
128  * Returns: 0 with @label->secid initialized
129  *          <0 returns error with @label->secid set to AA_SECID_INVALID
130  */
131 int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
132 {
133 	unsigned long flags;
134 	int ret;
135 
136 	idr_preload(gfp);
137 	spin_lock_irqsave(&secid_lock, flags);
138 	ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC);
139 	spin_unlock_irqrestore(&secid_lock, flags);
140 	idr_preload_end();
141 
142 	if (ret < 0) {
143 		label->secid = AA_SECID_INVALID;
144 		return ret;
145 	}
146 
147 	AA_BUG(ret == AA_SECID_INVALID);
148 	label->secid = ret;
149 	return 0;
150 }
151 
152 /**
153  * aa_free_secid - free a secid
154  * @secid: secid to free
155  */
156 void aa_free_secid(u32 secid)
157 {
158 	unsigned long flags;
159 
160 	spin_lock_irqsave(&secid_lock, flags);
161 	idr_remove(&aa_secids, secid);
162 	spin_unlock_irqrestore(&secid_lock, flags);
163 }
164 
165 void aa_secids_init(void)
166 {
167 	idr_init_base(&aa_secids, AA_FIRST_SECID);
168 }
169