~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/include/context.h

Version: ~ [ linux-5.10-rc1 ] ~ [ linux-5.9.1 ] ~ [ linux-5.8.16 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.72 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.152 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.202 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.240 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.240 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * AppArmor security module
  3  *
  4  * This file contains AppArmor contexts used to associate "labels" to objects.
  5  *
  6  * Copyright (C) 1998-2008 Novell/SUSE
  7  * Copyright 2009-2010 Canonical Ltd.
  8  *
  9  * This program is free software; you can redistribute it and/or
 10  * modify it under the terms of the GNU General Public License as
 11  * published by the Free Software Foundation, version 2 of the
 12  * License.
 13  */
 14 
 15 #ifndef __AA_CONTEXT_H
 16 #define __AA_CONTEXT_H
 17 
 18 #include <linux/cred.h>
 19 #include <linux/slab.h>
 20 #include <linux/sched.h>
 21 
 22 #include "policy.h"
 23 #include "policy_ns.h"
 24 
 25 #define cred_ctx(X) ((X)->security)
 26 #define current_ctx() cred_ctx(current_cred())
 27 
 28 /* struct aa_file_ctx - the AppArmor context the file was opened in
 29  * @perms: the permission the file was opened with
 30  *
 31  * The file_ctx could currently be directly stored in file->f_security
 32  * as the profile reference is now stored in the f_cred.  However the
 33  * ctx struct will expand in the future so we keep the struct.
 34  */
 35 struct aa_file_ctx {
 36         u16 allow;
 37 };
 38 
 39 /**
 40  * aa_alloc_file_context - allocate file_ctx
 41  * @gfp: gfp flags for allocation
 42  *
 43  * Returns: file_ctx or NULL on failure
 44  */
 45 static inline struct aa_file_ctx *aa_alloc_file_context(gfp_t gfp)
 46 {
 47         return kzalloc(sizeof(struct aa_file_ctx), gfp);
 48 }
 49 
 50 /**
 51  * aa_free_file_context - free a file_ctx
 52  * @ctx: file_ctx to free  (MAYBE_NULL)
 53  */
 54 static inline void aa_free_file_context(struct aa_file_ctx *ctx)
 55 {
 56         if (ctx)
 57                 kzfree(ctx);
 58 }
 59 
 60 /**
 61  * struct aa_task_ctx - primary label for confined tasks
 62  * @profile: the current profile   (NOT NULL)
 63  * @exec: profile to transition to on next exec  (MAYBE NULL)
 64  * @previous: profile the task may return to     (MAYBE NULL)
 65  * @token: magic value the task must know for returning to @previous_profile
 66  *
 67  * Contains the task's current profile (which could change due to
 68  * change_hat).  Plus the hat_magic needed during change_hat.
 69  *
 70  * TODO: make so a task can be confined by a stack of contexts
 71  */
 72 struct aa_task_ctx {
 73         struct aa_profile *profile;
 74         struct aa_profile *onexec;
 75         struct aa_profile *previous;
 76         u64 token;
 77 };
 78 
 79 struct aa_task_ctx *aa_alloc_task_context(gfp_t flags);
 80 void aa_free_task_context(struct aa_task_ctx *ctx);
 81 void aa_dup_task_context(struct aa_task_ctx *new,
 82                          const struct aa_task_ctx *old);
 83 int aa_replace_current_profile(struct aa_profile *profile);
 84 int aa_set_current_onexec(struct aa_profile *profile);
 85 int aa_set_current_hat(struct aa_profile *profile, u64 token);
 86 int aa_restore_previous_profile(u64 cookie);
 87 struct aa_profile *aa_get_task_profile(struct task_struct *task);
 88 
 89 
 90 /**
 91  * aa_cred_profile - obtain cred's profiles
 92  * @cred: cred to obtain profiles from  (NOT NULL)
 93  *
 94  * Returns: confining profile
 95  *
 96  * does NOT increment reference count
 97  */
 98 static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
 99 {
100         struct aa_task_ctx *ctx = cred_ctx(cred);
101 
102         AA_BUG(!ctx || !ctx->profile);
103         return ctx->profile;
104 }
105 
106 /**
107  * __aa_task_profile - retrieve another task's profile
108  * @task: task to query  (NOT NULL)
109  *
110  * Returns: @task's profile without incrementing its ref count
111  *
112  * If @task != current needs to be called in RCU safe critical section
113  */
114 static inline struct aa_profile *__aa_task_profile(struct task_struct *task)
115 {
116         return aa_cred_profile(__task_cred(task));
117 }
118 
119 /**
120  * __aa_task_is_confined - determine if @task has any confinement
121  * @task: task to check confinement of  (NOT NULL)
122  *
123  * If @task != current needs to be called in RCU safe critical section
124  */
125 static inline bool __aa_task_is_confined(struct task_struct *task)
126 {
127         return !unconfined(__aa_task_profile(task));
128 }
129 
130 /**
131  * __aa_current_profile - find the current tasks confining profile
132  *
133  * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
134  *
135  * This fn will not update the tasks cred to the most up to date version
136  * of the profile so it is safe to call when inside of locks.
137  */
138 static inline struct aa_profile *__aa_current_profile(void)
139 {
140         return aa_cred_profile(current_cred());
141 }
142 
143 /**
144  * aa_current_profile - find the current tasks confining profile and do updates
145  *
146  * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
147  *
148  * This fn will update the tasks cred structure if the profile has been
149  * replaced.  Not safe to call inside locks
150  */
151 static inline struct aa_profile *aa_current_profile(void)
152 {
153         const struct aa_task_ctx *ctx = current_ctx();
154         struct aa_profile *profile;
155 
156         AA_BUG(!ctx || !ctx->profile);
157 
158         if (profile_is_stale(ctx->profile)) {
159                 profile = aa_get_newest_profile(ctx->profile);
160                 aa_replace_current_profile(profile);
161                 aa_put_profile(profile);
162                 ctx = current_ctx();
163         }
164 
165         return ctx->profile;
166 }
167 
168 static inline struct aa_ns *aa_get_current_ns(void)
169 {
170         return aa_get_ns(__aa_current_profile()->ns);
171 }
172 
173 /**
174  * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
175  * @ctx: task context to clear (NOT NULL)
176  */
177 static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
178 {
179         aa_put_profile(ctx->previous);
180         aa_put_profile(ctx->onexec);
181         ctx->previous = NULL;
182         ctx->onexec = NULL;
183         ctx->token = 0;
184 }
185 
186 #endif /* __AA_CONTEXT_H */
187 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp