1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * AppArmor security module
4 *
5 * This file contains AppArmor policy definitions.
6 *
7 * Copyright (C) 1998-2008 Novell/SUSE
8 * Copyright 2009-2017 Canonical Ltd.
9 */
10
11 #ifndef __AA_NAMESPACE_H
12 #define __AA_NAMESPACE_H
13
14 #include <linux/kref.h>
15
16 #include "apparmor.h"
17 #include "apparmorfs.h"
18 #include "label.h"
19 #include "policy.h"
20
21 /* Match max depth of user namespaces */
22 #define MAX_NS_DEPTH 32
23
24 /* struct aa_ns_acct - accounting of profiles in namespace
25 * @max_size: maximum space allowed for all profiles in namespace
26 * @max_count: maximum number of profiles that can be in this namespace
27 * @size: current size of profiles
28 * @count: current count of profiles (includes null profiles)
29 */
30 struct aa_ns_acct {
31 int max_size;
32 int max_count;
33 int size;
34 int count;
35 };
36
37 /* struct aa_ns - namespace for a set of profiles
38 * @base: common policy
39 * @parent: parent of namespace
40 * @lock: lock for modifying the object
41 * @acct: accounting for the namespace
42 * @unconfined: special unconfined profile for the namespace
43 * @sub_ns: list of namespaces under the current namespace.
44 * @uniq_null: uniq value used for null learning profiles
45 * @uniq_id: a unique id count for the profiles in the namespace
46 * @level: level of ns within the tree hierarchy
47 * @dents: dentries for the namespaces file entries in apparmorfs
48 *
49 * An aa_ns defines the set profiles that are searched to determine which
50 * profile to attach to a task. Profiles can not be shared between aa_ns
51 * and profile names within a namespace are guaranteed to be unique. When
52 * profiles in separate namespaces have the same name they are NOT considered
53 * to be equivalent.
54 *
55 * Namespaces are hierarchical and only namespaces and profiles below the
56 * current namespace are visible.
57 *
58 * Namespace names must be unique and can not contain the characters :/\0
59 */
60 struct aa_ns {
61 struct aa_policy base;
62 struct aa_ns *parent;
63 struct mutex lock;
64 struct aa_ns_acct acct;
65 struct aa_profile *unconfined;
66 struct list_head sub_ns;
67 atomic_t uniq_null;
68 long uniq_id;
69 int level;
70 long revision;
71 wait_queue_head_t wait;
72
73 struct aa_labelset labels;
74 struct list_head rawdata_list;
75
76 struct dentry *dents[AAFS_NS_SIZEOF];
77 };
78
79 extern struct aa_label *kernel_t;
80 extern struct aa_ns *root_ns;
81
82 extern const char *aa_hidden_ns_name;
83
84 #define ns_unconfined(NS) (&(NS)->unconfined->label)
85
86 bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
87 const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
88 void aa_free_ns(struct aa_ns *ns);
89 int aa_alloc_root_ns(void);
90 void aa_free_root_ns(void);
91
92 struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n);
93 struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n);
94 struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
95 struct dentry *dir);
96 struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
97 void __aa_remove_ns(struct aa_ns *ns);
98
aa_deref_parent(struct aa_profile * p)99 static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
100 {
101 return rcu_dereference_protected(p->parent,
102 mutex_is_locked(&p->ns->lock));
103 }
104
105 /**
106 * aa_get_ns - increment references count on @ns
107 * @ns: namespace to increment reference count of (MAYBE NULL)
108 *
109 * Returns: pointer to @ns, if @ns is NULL returns NULL
110 * Requires: @ns must be held with valid refcount when called
111 */
aa_get_ns(struct aa_ns * ns)112 static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
113 {
114 if (ns)
115 aa_get_profile(ns->unconfined);
116
117 return ns;
118 }
119
120 /**
121 * aa_put_ns - decrement refcount on @ns
122 * @ns: namespace to put reference of
123 *
124 * Decrement reference count of @ns and if no longer in use free it
125 */
aa_put_ns(struct aa_ns * ns)126 static inline void aa_put_ns(struct aa_ns *ns)
127 {
128 if (ns)
129 aa_put_profile(ns->unconfined);
130 }
131
132 /**
133 * __aa_findn_ns - find a namespace on a list by @name
134 * @head: list to search for namespace on (NOT NULL)
135 * @name: name of namespace to look for (NOT NULL)
136 * @n: length of @name
137 * Returns: unrefcounted namespace
138 *
139 * Requires: rcu_read_lock be held
140 */
__aa_findn_ns(struct list_head * head,const char * name,size_t n)141 static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
142 const char *name, size_t n)
143 {
144 return (struct aa_ns *)__policy_strn_find(head, name, n);
145 }
146
__aa_find_ns(struct list_head * head,const char * name)147 static inline struct aa_ns *__aa_find_ns(struct list_head *head,
148 const char *name)
149 {
150 return __aa_findn_ns(head, name, strlen(name));
151 }
152
153 #endif /* AA_NAMESPACE_H */
154