1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor task related definitions and mediation 6 * 7 * Copyright 2017 Canonical Ltd. 8 */ 9 10 #ifndef __AA_TASK_H 11 #define __AA_TASK_H 12 13 #include <linux/sched.h> 14 15 #include "audit.h" 16 #include "label.h" 17 18 static inline struct aa_task_ctx *task_ctx(struct task_struct *task) 19 { 20 return task->security + apparmor_blob_sizes.lbs_task; 21 } 22 23 /* 24 * struct aa_task_ctx - information for current task label change 25 * @nnp: snapshot of label at time of no_new_privs 26 * @onexec: profile to transition to on next exec (MAY BE NULL) 27 * @previous: profile the task may return to (MAY BE NULL) 28 * @token: magic value the task must know for returning to @previous_profile 29 * @label_replacement_tw: for aa_schedule_stale_label_replacement() 30 * @label_replacement_pending: is @label_replacement_tw pending? 31 * 32 * When changing this, check if aa_dup_task_ctx() needs to be updated. 33 */ 34 struct aa_task_ctx { 35 struct aa_label *nnp; 36 struct aa_label *onexec; 37 struct aa_label *previous; 38 u64 token; 39 struct callback_head label_replacement_tw; 40 bool label_replacement_pending; 41 }; 42 43 int aa_replace_current_label(struct aa_label *label); 44 void aa_schedule_stale_label_replacement(void); 45 void aa_set_current_onexec(struct aa_label *label, bool stack); 46 int aa_set_current_hat(struct aa_label *label, u64 token); 47 int aa_restore_previous_label(u64 cookie); 48 struct aa_label *aa_get_task_label(struct task_struct *task); 49 50 /** 51 * aa_free_task_ctx - free a task_ctx 52 * @ctx: task_ctx to free (MAYBE NULL) 53 */ 54 static inline void aa_free_task_ctx(struct aa_task_ctx *ctx) 55 { 56 if (ctx) { 57 aa_put_label(ctx->nnp); 58 aa_put_label(ctx->previous); 59 aa_put_label(ctx->onexec); 60 } 61 } 62 63 /** 64 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts 65 * @new: a blank task context (NOT NULL) 66 * @old: the task context to copy (NOT NULL) 67 */ 68 static inline void aa_dup_task_ctx(struct aa_task_ctx *new, 69 const struct aa_task_ctx *old) 70 { 71 new->nnp = aa_get_label(old->nnp); 72 new->onexec = aa_get_label(old->onexec); 73 new->previous = aa_get_label(old->previous); 74 new->token = old->token; 75 } 76 77 /** 78 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx 79 * @ctx: task context to clear (NOT NULL) 80 */ 81 static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx) 82 { 83 AA_BUG(!ctx); 84 85 aa_put_label(ctx->previous); 86 aa_put_label(ctx->onexec); 87 ctx->previous = NULL; 88 ctx->onexec = NULL; 89 ctx->token = 0; 90 } 91 92 #define AA_PTRACE_TRACE MAY_WRITE 93 #define AA_PTRACE_READ MAY_READ 94 #define AA_MAY_BE_TRACED AA_MAY_APPEND 95 #define AA_MAY_BE_READ AA_MAY_CREATE 96 #define PTRACE_PERM_SHIFT 2 97 98 #define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \ 99 AA_MAY_BE_READ | AA_MAY_BE_TRACED) 100 #define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE) 101 102 #define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \ 103 "segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \ 104 "xcpu xfsz vtalrm prof winch io pwr sys emt lost" 105 106 int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer, 107 const struct cred *tracee_cred, struct aa_label *tracee, 108 u32 request); 109 110 111 112 #define AA_USERNS_CREATE 8 113 114 int aa_profile_ns_perm(struct aa_profile *profile, 115 struct apparmor_audit_data *ad, u32 request); 116 117 #endif /* __AA_TASK_H */ 118