1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor contexts used to associate "labels" to objects. 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2010 Canonical Ltd. 9 */ 10 11 #ifndef __AA_CONTEXT_H 12 #define __AA_CONTEXT_H 13 14 #include <linux/cred.h> 15 #include <linux/slab.h> 16 #include <linux/sched.h> 17 18 #include "label.h" 19 #include "policy_ns.h" 20 #include "task.h" 21 22 static inline struct aa_label *cred_label(const struct cred *cred) 23 { 24 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 25 26 AA_BUG(!blob); 27 return *blob; 28 } 29 30 static inline void set_cred_label(const struct cred *cred, 31 struct aa_label *label) 32 { 33 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 34 35 AA_BUG(!blob); 36 *blob = label; 37 } 38 39 /** 40 * aa_cred_raw_label - obtain cred's label 41 * @cred: cred to obtain label from (NOT NULL) 42 * 43 * Returns: confining label 44 * 45 * does NOT increment reference count 46 */ 47 static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) 48 { 49 struct aa_label *label = cred_label(cred); 50 51 AA_BUG(!label); 52 return label; 53 } 54 55 /** 56 * aa_get_newest_cred_label - obtain the newest label on a cred 57 * @cred: cred to obtain label from (NOT NULL) 58 * 59 * Returns: newest version of confining label 60 */ 61 static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) 62 { 63 return aa_get_newest_label(aa_cred_raw_label(cred)); 64 } 65 66 static inline struct aa_label *aa_get_newest_cred_label_condref(const struct cred *cred, 67 bool *needput) 68 { 69 struct aa_label *l = aa_cred_raw_label(cred); 70 71 if (unlikely(label_is_stale(l))) { 72 *needput = true; 73 return aa_get_newest_label(l); 74 } 75 76 *needput = false; 77 return l; 78 } 79 80 static inline void aa_put_label_condref(struct aa_label *l, bool needput) 81 { 82 if (unlikely(needput)) 83 aa_put_label(l); 84 } 85 86 /** 87 * aa_current_raw_label - find the current tasks confining label 88 * 89 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 90 * 91 * This fn will not update the tasks cred to the most up to date version 92 * of the label so it is safe to call when inside of locks. 93 */ 94 static inline struct aa_label *aa_current_raw_label(void) 95 { 96 return aa_cred_raw_label(current_cred()); 97 } 98 99 /** 100 * aa_get_current_label - get the newest version of the current tasks label 101 * 102 * Returns: newest version of confining label (NOT NULL) 103 * 104 * This fn will not update the tasks cred, so it is safe inside of locks 105 * 106 * The returned reference must be put with aa_put_label() 107 */ 108 static inline struct aa_label *aa_get_current_label(void) 109 { 110 struct aa_label *l = aa_current_raw_label(); 111 112 if (label_is_stale(l)) 113 return aa_get_newest_label(l); 114 return aa_get_label(l); 115 } 116 117 /** 118 * __end_current_label_crit_section - end crit section begun with __begin_... 119 * @label: label obtained from __begin_current_label_crit_section 120 * @needput: output: bool set by __begin_current_label_crit_section 121 * 122 * Returns: label to use for this crit section 123 */ 124 static inline void __end_current_label_crit_section(struct aa_label *label, 125 bool needput) 126 { 127 if (unlikely(needput)) 128 aa_put_label(label); 129 } 130 131 /** 132 * end_current_label_crit_section - put a reference found with begin_current_label.. 133 * @label: label reference to put 134 * 135 * Should only be used with a reference obtained with 136 * begin_current_label_crit_section and never used in situations where the 137 * task cred may be updated 138 */ 139 static inline void end_current_label_crit_section(struct aa_label *label) 140 { 141 if (label != aa_current_raw_label()) 142 aa_put_label(label); 143 } 144 145 /** 146 * __begin_current_label_crit_section - current's confining label 147 * @needput: store whether the label needs to be put when ending crit section 148 * 149 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 150 * 151 * safe to call inside locks 152 * 153 * The returned reference must be put with __end_current_label_crit_section() 154 * This must NOT be used if the task cred could be updated within the 155 * critical section between __begin_current_label_crit_section() .. 156 * __end_current_label_crit_section() 157 */ 158 static inline struct aa_label *__begin_current_label_crit_section(bool *needput) 159 { 160 struct aa_label *label = aa_current_raw_label(); 161 162 if (label_is_stale(label)) { 163 *needput = true; 164 return aa_get_newest_label(label); 165 } 166 167 *needput = false; 168 return label; 169 } 170 171 /** 172 * begin_current_label_crit_section - current's confining label and update it 173 * 174 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 175 * 176 * Not safe to call inside locks 177 * 178 * The returned reference must be put with end_current_label_crit_section() 179 * This must NOT be used if the task cred could be updated within the 180 * critical section between begin_current_label_crit_section() .. 181 * end_current_label_crit_section() 182 */ 183 static inline struct aa_label *begin_current_label_crit_section(void) 184 { 185 struct aa_label *label = aa_current_raw_label(); 186 187 might_sleep(); 188 189 if (label_is_stale(label)) { 190 label = aa_get_newest_label(label); 191 if (aa_replace_current_label(label) == 0) 192 /* task cred will keep the reference */ 193 aa_put_label(label); 194 } 195 196 return label; 197 } 198 199 static inline struct aa_ns *aa_get_current_ns(void) 200 { 201 struct aa_label *label; 202 struct aa_ns *ns; 203 bool needput; 204 205 label = __begin_current_label_crit_section(&needput); 206 ns = aa_get_ns(labels_ns(label)); 207 __end_current_label_crit_section(label, needput); 208 209 return ns; 210 } 211 212 #endif /* __AA_CONTEXT_H */ 213