1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * AppArmor security module
4 *
5 * This file contains AppArmor contexts used to associate "labels" to objects.
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2010 Canonical Ltd.
9 */
10
11 #ifndef __AA_CONTEXT_H
12 #define __AA_CONTEXT_H
13
14 #include <linux/cred.h>
15 #include <linux/slab.h>
16 #include <linux/sched.h>
17
18 #include "label.h"
19 #include "policy_ns.h"
20 #include "task.h"
21
cred_label(const struct cred * cred)22 static inline struct aa_label *cred_label(const struct cred *cred)
23 {
24 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
25
26 AA_BUG(!blob);
27 return *blob;
28 }
29
set_cred_label(const struct cred * cred,struct aa_label * label)30 static inline void set_cred_label(const struct cred *cred,
31 struct aa_label *label)
32 {
33 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
34
35 AA_BUG(!blob);
36 *blob = label;
37 }
38
39 /**
40 * aa_cred_raw_label - obtain cred's label
41 * @cred: cred to obtain label from (NOT NULL)
42 *
43 * Returns: confining label
44 *
45 * does NOT increment reference count
46 */
aa_cred_raw_label(const struct cred * cred)47 static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
48 {
49 struct aa_label *label = cred_label(cred);
50
51 AA_BUG(!label);
52 return label;
53 }
54
55 /**
56 * aa_get_newest_cred_label - obtain the newest label on a cred
57 * @cred: cred to obtain label from (NOT NULL)
58 *
59 * Returns: newest version of confining label
60 */
aa_get_newest_cred_label(const struct cred * cred)61 static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
62 {
63 return aa_get_newest_label(aa_cred_raw_label(cred));
64 }
65
aa_get_newest_cred_label_condref(const struct cred * cred,bool * needput)66 static inline struct aa_label *aa_get_newest_cred_label_condref(const struct cred *cred,
67 bool *needput)
68 {
69 struct aa_label *l = aa_cred_raw_label(cred);
70
71 if (unlikely(label_is_stale(l))) {
72 *needput = true;
73 return aa_get_newest_label(l);
74 }
75
76 *needput = false;
77 return l;
78 }
79
aa_put_label_condref(struct aa_label * l,bool needput)80 static inline void aa_put_label_condref(struct aa_label *l, bool needput)
81 {
82 if (unlikely(needput))
83 aa_put_label(l);
84 }
85
86 /**
87 * aa_current_raw_label - find the current tasks confining label
88 *
89 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
90 *
91 * This fn will not update the tasks cred to the most up to date version
92 * of the label so it is safe to call when inside of locks.
93 */
aa_current_raw_label(void)94 static inline struct aa_label *aa_current_raw_label(void)
95 {
96 return aa_cred_raw_label(current_cred());
97 }
98
99 /**
100 * aa_get_current_label - get the newest version of the current tasks label
101 *
102 * Returns: newest version of confining label (NOT NULL)
103 *
104 * This fn will not update the tasks cred, so it is safe inside of locks
105 *
106 * The returned reference must be put with aa_put_label()
107 */
aa_get_current_label(void)108 static inline struct aa_label *aa_get_current_label(void)
109 {
110 struct aa_label *l = aa_current_raw_label();
111
112 if (label_is_stale(l))
113 return aa_get_newest_label(l);
114 return aa_get_label(l);
115 }
116
117 /**
118 * __end_current_label_crit_section - end crit section begun with __begin_...
119 * @label: label obtained from __begin_current_label_crit_section
120 * @needput: output: bool set by __begin_current_label_crit_section
121 *
122 * Returns: label to use for this crit section
123 */
__end_current_label_crit_section(struct aa_label * label,bool needput)124 static inline void __end_current_label_crit_section(struct aa_label *label,
125 bool needput)
126 {
127 if (unlikely(needput))
128 aa_put_label(label);
129 }
130
131 /**
132 * end_current_label_crit_section - put a reference found with begin_current_label..
133 * @label: label reference to put
134 *
135 * Should only be used with a reference obtained with
136 * begin_current_label_crit_section and never used in situations where the
137 * task cred may be updated
138 */
end_current_label_crit_section(struct aa_label * label)139 static inline void end_current_label_crit_section(struct aa_label *label)
140 {
141 if (label != aa_current_raw_label())
142 aa_put_label(label);
143 }
144
145 /**
146 * __begin_current_label_crit_section - current's confining label
147 * @needput: store whether the label needs to be put when ending crit section
148 *
149 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
150 *
151 * safe to call inside locks
152 *
153 * The returned reference must be put with __end_current_label_crit_section()
154 * This must NOT be used if the task cred could be updated within the
155 * critical section between __begin_current_label_crit_section() ..
156 * __end_current_label_crit_section()
157 */
__begin_current_label_crit_section(bool * needput)158 static inline struct aa_label *__begin_current_label_crit_section(bool *needput)
159 {
160 struct aa_label *label = aa_current_raw_label();
161
162 if (label_is_stale(label)) {
163 *needput = true;
164 return aa_get_newest_label(label);
165 }
166
167 *needput = false;
168 return label;
169 }
170
171 /**
172 * begin_current_label_crit_section - current's confining label and update it
173 *
174 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
175 *
176 * Not safe to call inside locks
177 *
178 * The returned reference must be put with end_current_label_crit_section()
179 * This must NOT be used if the task cred could be updated within the
180 * critical section between begin_current_label_crit_section() ..
181 * end_current_label_crit_section()
182 */
begin_current_label_crit_section(void)183 static inline struct aa_label *begin_current_label_crit_section(void)
184 {
185 struct aa_label *label = aa_current_raw_label();
186
187 might_sleep();
188
189 if (label_is_stale(label)) {
190 label = aa_get_newest_label(label);
191 if (aa_replace_current_label(label) == 0)
192 /* task cred will keep the reference */
193 aa_put_label(label);
194 }
195
196 return label;
197 }
198
aa_get_current_ns(void)199 static inline struct aa_ns *aa_get_current_ns(void)
200 {
201 struct aa_label *label;
202 struct aa_ns *ns;
203 bool needput;
204
205 label = __begin_current_label_crit_section(&needput);
206 ns = aa_get_ns(labels_ns(label));
207 __end_current_label_crit_section(label, needput);
208
209 return ns;
210 }
211
212 #endif /* __AA_CONTEXT_H */
213