1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * AppArmor security module
4 *
5 * This file contains AppArmor task related definitions and mediation
6 *
7 * Copyright 2017 Canonical Ltd.
8 */
9
10 #ifndef __AA_TASK_H
11 #define __AA_TASK_H
12
13 #include <linux/sched.h>
14
15 #include "audit.h"
16 #include "label.h"
17
task_ctx(struct task_struct * task)18 static inline struct aa_task_ctx *task_ctx(struct task_struct *task)
19 {
20 return task->security + apparmor_blob_sizes.lbs_task;
21 }
22
23 /*
24 * struct aa_task_ctx - information for current task label change
25 * @nnp: snapshot of label at time of no_new_privs
26 * @onexec: profile to transition to on next exec (MAY BE NULL)
27 * @previous: profile the task may return to (MAY BE NULL)
28 * @token: magic value the task must know for returning to @previous_profile
29 * @label_replacement_tw: for aa_schedule_stale_label_replacement()
30 * @label_replacement_pending: is @label_replacement_tw pending?
31 *
32 * When changing this, check if aa_dup_task_ctx() needs to be updated.
33 */
34 struct aa_task_ctx {
35 struct aa_label *nnp;
36 struct aa_label *onexec;
37 struct aa_label *previous;
38 u64 token;
39 struct callback_head label_replacement_tw;
40 bool label_replacement_pending;
41 };
42
43 int aa_replace_current_label(struct aa_label *label);
44 void aa_schedule_stale_label_replacement(void);
45 void aa_set_current_onexec(struct aa_label *label, bool stack);
46 int aa_set_current_hat(struct aa_label *label, u64 token);
47 int aa_restore_previous_label(u64 cookie);
48 struct aa_label *aa_get_task_label(struct task_struct *task);
49
50 /**
51 * aa_free_task_ctx - free a task_ctx
52 * @ctx: task_ctx to free (MAYBE NULL)
53 */
aa_free_task_ctx(struct aa_task_ctx * ctx)54 static inline void aa_free_task_ctx(struct aa_task_ctx *ctx)
55 {
56 if (ctx) {
57 aa_put_label(ctx->nnp);
58 aa_put_label(ctx->previous);
59 aa_put_label(ctx->onexec);
60 }
61 }
62
63 /**
64 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts
65 * @new: a blank task context (NOT NULL)
66 * @old: the task context to copy (NOT NULL)
67 */
aa_dup_task_ctx(struct aa_task_ctx * new,const struct aa_task_ctx * old)68 static inline void aa_dup_task_ctx(struct aa_task_ctx *new,
69 const struct aa_task_ctx *old)
70 {
71 new->nnp = aa_get_label(old->nnp);
72 new->onexec = aa_get_label(old->onexec);
73 new->previous = aa_get_label(old->previous);
74 new->token = old->token;
75 }
76
77 /**
78 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
79 * @ctx: task context to clear (NOT NULL)
80 */
aa_clear_task_ctx_trans(struct aa_task_ctx * ctx)81 static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
82 {
83 AA_BUG(!ctx);
84
85 aa_put_label(ctx->previous);
86 aa_put_label(ctx->onexec);
87 ctx->previous = NULL;
88 ctx->onexec = NULL;
89 ctx->token = 0;
90 }
91
92 #define AA_PTRACE_TRACE MAY_WRITE
93 #define AA_PTRACE_READ MAY_READ
94 #define AA_MAY_BE_TRACED AA_MAY_APPEND
95 #define AA_MAY_BE_READ AA_MAY_CREATE
96 #define PTRACE_PERM_SHIFT 2
97
98 #define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \
99 AA_MAY_BE_READ | AA_MAY_BE_TRACED)
100 #define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE)
101
102 #define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \
103 "segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \
104 "xcpu xfsz vtalrm prof winch io pwr sys emt lost"
105
106 int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer,
107 const struct cred *tracee_cred, struct aa_label *tracee,
108 u32 request);
109
110
111
112 #define AA_USERNS_CREATE 8
113
114 int aa_profile_ns_perm(struct aa_profile *profile,
115 struct apparmor_audit_data *ad, u32 request);
116
117 #endif /* __AA_TASK_H */
118