1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor security identifier (secid) manipulation fns 5 * 6 * Copyright 2009-2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 * 13 * 14 * AppArmor allocates a unique secid for every label used. If a label 15 * is replaced it receives the secid of the label it is replacing. 16 */ 17 18 #include <linux/errno.h> 19 #include <linux/err.h> 20 #include <linux/gfp.h> 21 #include <linux/idr.h> 22 #include <linux/slab.h> 23 #include <linux/spinlock.h> 24 25 #include "include/cred.h" 26 #include "include/lib.h" 27 #include "include/secid.h" 28 #include "include/label.h" 29 #include "include/policy_ns.h" 30 31 /* 32 * secids - do not pin labels with a refcount. They rely on the label 33 * properly updating/freeing them 34 */ 35 36 #define AA_FIRST_SECID 1 37 38 static DEFINE_IDR(aa_secids); 39 static DEFINE_SPINLOCK(secid_lock); 40 41 /* 42 * TODO: allow policy to reserve a secid range? 43 * TODO: add secid pinning 44 * TODO: use secid_update in label replace 45 */ 46 47 /** 48 * aa_secid_update - update a secid mapping to a new label 49 * @secid: secid to update 50 * @label: label the secid will now map to 51 */ 52 void aa_secid_update(u32 secid, struct aa_label *label) 53 { 54 unsigned long flags; 55 56 spin_lock_irqsave(&secid_lock, flags); 57 idr_replace(&aa_secids, label, secid); 58 spin_unlock_irqrestore(&secid_lock, flags); 59 } 60 61 /** 62 * 63 * see label for inverse aa_label_to_secid 64 */ 65 struct aa_label *aa_secid_to_label(u32 secid) 66 { 67 struct aa_label *label; 68 69 rcu_read_lock(); 70 label = idr_find(&aa_secids, secid); 71 rcu_read_unlock(); 72 73 return label; 74 } 75 76 int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 77 { 78 /* TODO: cache secctx and ref count so we don't have to recreate */ 79 struct aa_label *label = aa_secid_to_label(secid); 80 int len; 81 82 AA_BUG(!secdata); 83 AA_BUG(!seclen); 84 85 if (!label) 86 return -EINVAL; 87 88 if (secdata) 89 len = aa_label_asxprint(secdata, root_ns, label, 90 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 91 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, 92 GFP_ATOMIC); 93 else 94 len = aa_label_snxprint(NULL, 0, root_ns, label, 95 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | 96 FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT); 97 if (len < 0) 98 return -ENOMEM; 99 100 *seclen = len; 101 102 return 0; 103 } 104 105 int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 106 { 107 struct aa_label *label; 108 109 label = aa_label_strn_parse(&root_ns->unconfined->label, secdata, 110 seclen, GFP_KERNEL, false, false); 111 if (IS_ERR(label)) 112 return PTR_ERR(label); 113 *secid = label->secid; 114 115 return 0; 116 } 117 118 void apparmor_release_secctx(char *secdata, u32 seclen) 119 { 120 kfree(secdata); 121 } 122 123 /** 124 * aa_alloc_secid - allocate a new secid for a profile 125 * @label: the label to allocate a secid for 126 * @gfp: memory allocation flags 127 * 128 * Returns: 0 with @label->secid initialized 129 * <0 returns error with @label->secid set to AA_SECID_INVALID 130 */ 131 int aa_alloc_secid(struct aa_label *label, gfp_t gfp) 132 { 133 unsigned long flags; 134 int ret; 135 136 idr_preload(gfp); 137 spin_lock_irqsave(&secid_lock, flags); 138 ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC); 139 spin_unlock_irqrestore(&secid_lock, flags); 140 idr_preload_end(); 141 142 if (ret < 0) { 143 label->secid = AA_SECID_INVALID; 144 return ret; 145 } 146 147 AA_BUG(ret == AA_SECID_INVALID); 148 label->secid = ret; 149 return 0; 150 } 151 152 /** 153 * aa_free_secid - free a secid 154 * @secid: secid to free 155 */ 156 void aa_free_secid(u32 secid) 157 { 158 unsigned long flags; 159 160 spin_lock_irqsave(&secid_lock, flags); 161 idr_remove(&aa_secids, secid); 162 spin_unlock_irqrestore(&secid_lock, flags); 163 } 164 165 void aa_secids_init(void) 166 { 167 idr_init_base(&aa_secids, AA_FIRST_SECID); 168 } 169