1 // SPDX-License-Identifier: GPL-2.0-only
19 #include "include/path.h"
26  * aa_get_task_label - Get another task's label
43  * aa_replace_current_label - replace the current tasks label
51 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_replace_current_label()
60 		return -EBUSY;  in aa_replace_current_label()
64 		return -ENOMEM;  in aa_replace_current_label()
66 	if (ctx->nnp && label_is_stale(ctx->nnp)) {  in aa_replace_current_label()
67 		struct aa_label *tmp = ctx->nnp;  in aa_replace_current_label()
69 		ctx->nnp = aa_get_newest_label(tmp);  in aa_replace_current_label()
77 		aa_clear_task_ctx_trans(task_ctx(current));  in aa_replace_current_label()
81 	 * is possible that the cred labels's->proxy->label is the reference  in aa_replace_current_label()
95 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_replace_stale_label_tw_func()
98 	ctx->label_replacement_pending = false;  in aa_replace_stale_label_tw_func()
107 /* replace the current task's stale label on syscall return */
110 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_schedule_stale_label_replacement()
112 	if (ctx->label_replacement_pending)  in aa_schedule_stale_label_replacement()
114 	init_task_work(&ctx->label_replacement_tw, aa_replace_stale_label_tw_func);  in aa_schedule_stale_label_replacement()
115 	if (task_work_add(current, &ctx->label_replacement_tw, TWA_RESUME) == 0)  in aa_schedule_stale_label_replacement()
116 		ctx->label_replacement_pending = true;  in aa_schedule_stale_label_replacement()
121  * aa_set_current_onexec - set the tasks change_profile to happen onexec
127 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_set_current_onexec()
130 	aa_put_label(ctx->onexec);  in aa_set_current_onexec()
131 	ctx->onexec = label;  in aa_set_current_onexec()
132 	ctx->token = stack;  in aa_set_current_onexec()
136  * aa_set_current_hat - set the current tasks hat
137  * @label: label to set as the current hat  (NOT NULL)
147 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_set_current_hat()
152 		return -ENOMEM;  in aa_set_current_hat()
155 	if (!ctx->previous) {  in aa_set_current_hat()
157 		ctx->previous = cred_label(new);  in aa_set_current_hat()
158 		ctx->token = token;  in aa_set_current_hat()
159 	} else if (ctx->token == token) {  in aa_set_current_hat()
162 		/* previous_profile && ctx->token != token */  in aa_set_current_hat()
164 		return -EACCES;  in aa_set_current_hat()
169 	aa_put_label(ctx->onexec);  in aa_set_current_hat()
170 	ctx->onexec = NULL;  in aa_set_current_hat()
177  * aa_restore_previous_label - exit from hat context restoring previous label
187 	struct aa_task_ctx *ctx = task_ctx(current);  in aa_restore_previous_label()
190 	if (ctx->token != token)  in aa_restore_previous_label()
191 		return -EACCES;  in aa_restore_previous_label()
193 	if (!ctx->previous)  in aa_restore_previous_label()
198 		return -ENOMEM;  in aa_restore_previous_label()
201 	set_cred_label(new, aa_get_newest_label(ctx->previous));  in aa_restore_previous_label()
212  * audit_ptrace_mask - convert mask to permission string
238 	if (ad->request & AA_PTRACE_PERM_MASK) {  in audit_ptrace_cb()
240 				 audit_ptrace_mask(ad->request));  in audit_ptrace_cb()
242 		if (ad->denied & AA_PTRACE_PERM_MASK) {  in audit_ptrace_cb()
244 					 audit_ptrace_mask(ad->denied));  in audit_ptrace_cb()
248 	aa_label_xaudit(ab, labels_ns(ad->subj_label), ad->peer,  in audit_ptrace_cb()
259 	struct aa_ruleset *rules = profile->label.rules[0];  in profile_ptrace_perm()
262 	ad->subj_cred = cred;  in profile_ptrace_perm()
263 	ad->peer = peer;  in profile_ptrace_perm()
276 	    !label_mediates(&tracee->label, AA_CLASS_PTRACE))  in profile_tracee_perm()
290 	if (label_mediates(&tracer->label, AA_CLASS_PTRACE))  in profile_tracer_perm()
294 	if (&tracer->label == tracee)  in profile_tracer_perm()
297 	ad->subj_label = &tracer->label;  in profile_tracer_perm()
298 	ad->peer = tracee;  in profile_tracer_perm()
299 	ad->request = 0;  in profile_tracer_perm()
300 	ad->error = aa_capable(cred, &tracer->label, CAP_SYS_PTRACE,  in profile_tracer_perm()
307  * aa_may_ptrace - test if tracer task can trace the tracee
334 	struct path p;  in get_current_exe_path()
337 	exe_file = get_task_exe_file(current);  in get_current_exe_path()
339 		return ERR_PTR(-ENOENT);  in get_current_exe_path()
340 	p = exe_file->f_path;  in get_current_exe_path()
344 		path_str = ERR_PTR(-ENOMEM);  in get_current_exe_path()
357 	const char *path;  in audit_ns_cb()  local
359 	if (ad->request & AA_USERNS_CREATE)  in audit_ns_cb()
362 	if (ad->denied & AA_USERNS_CREATE)  in audit_ns_cb()
368 	path = get_current_exe_path(buffer, aa_g_path_max);  in audit_ns_cb()
369 	if (!IS_ERR(path))  in audit_ns_cb()
370 		audit_log_format(ab, " execpath=\"%s\"", path);  in audit_ns_cb()
381 	ad->subj_label = &profile->label;  in aa_profile_ns_perm()
382 	ad->request = request;  in aa_profile_ns_perm()
385 		struct aa_ruleset *rules = profile->label.rules[0];  in aa_profile_ns_perm()
388 		state = RULE_MEDIATES(rules, ad->class);  in aa_profile_ns_perm()
392 		perms = *aa_lookup_perms(rules->policy, state);  in aa_profile_ns_perm()