1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * AppArmor security module 4 * 5 * This file contains AppArmor contexts used to associate "labels" to objects. 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2010 Canonical Ltd. 9 */ 10 11#ifndef __AA_CONTEXT_H 12#define __AA_CONTEXT_H 13 14#include <linux/cred.h> 15#include <linux/slab.h> 16#include <linux/sched.h> 17 18#include "label.h" 19#include "policy_ns.h" 20#include "task.h" 21 22static inline struct aa_label *cred_label(const struct cred *cred) 23{ 24 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 25 26 AA_BUG(!blob); 27 return *blob; 28} 29 30static inline void set_cred_label(const struct cred *cred, 31 struct aa_label *label) 32{ 33 struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred; 34 35 AA_BUG(!blob); 36 *blob = label; 37} 38 39/** 40 * aa_cred_raw_label - obtain cred's label 41 * @cred: cred to obtain label from (NOT NULL) 42 * 43 * Returns: confining label 44 * 45 * does NOT increment reference count 46 */ 47static inline struct aa_label *aa_cred_raw_label(const struct cred *cred) 48{ 49 struct aa_label *label = cred_label(cred); 50 51 AA_BUG(!label); 52 return label; 53} 54 55/** 56 * aa_get_newest_cred_label - obtain the newest label on a cred 57 * @cred: cred to obtain label from (NOT NULL) 58 * 59 * Returns: newest version of confining label 60 */ 61static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) 62{ 63 return aa_get_newest_label(aa_cred_raw_label(cred)); 64} 65 66/** 67 * aa_current_raw_label - find the current tasks confining label 68 * 69 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 70 * 71 * This fn will not update the tasks cred to the most up to date version 72 * of the label so it is safe to call when inside of locks. 73 */ 74static inline struct aa_label *aa_current_raw_label(void) 75{ 76 return aa_cred_raw_label(current_cred()); 77} 78 79/** 80 * aa_get_current_label - get the newest version of the current tasks label 81 * 82 * Returns: newest version of confining label (NOT NULL) 83 * 84 * This fn will not update the tasks cred, so it is safe inside of locks 85 * 86 * The returned reference must be put with aa_put_label() 87 */ 88static inline struct aa_label *aa_get_current_label(void) 89{ 90 struct aa_label *l = aa_current_raw_label(); 91 92 if (label_is_stale(l)) 93 return aa_get_newest_label(l); 94 return aa_get_label(l); 95} 96 97#define __end_current_label_crit_section(X) end_current_label_crit_section(X) 98 99/** 100 * end_label_crit_section - put a reference found with begin_current_label.. 101 * @label: label reference to put 102 * 103 * Should only be used with a reference obtained with 104 * begin_current_label_crit_section and never used in situations where the 105 * task cred may be updated 106 */ 107static inline void end_current_label_crit_section(struct aa_label *label) 108{ 109 if (label != aa_current_raw_label()) 110 aa_put_label(label); 111} 112 113/** 114 * __begin_current_label_crit_section - current's confining label 115 * 116 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 117 * 118 * safe to call inside locks 119 * 120 * The returned reference must be put with __end_current_label_crit_section() 121 * This must NOT be used if the task cred could be updated within the 122 * critical section between __begin_current_label_crit_section() .. 123 * __end_current_label_crit_section() 124 */ 125static inline struct aa_label *__begin_current_label_crit_section(void) 126{ 127 struct aa_label *label = aa_current_raw_label(); 128 129 if (label_is_stale(label)) 130 label = aa_get_newest_label(label); 131 132 return label; 133} 134 135/** 136 * begin_current_label_crit_section - current's confining label and update it 137 * 138 * Returns: up to date confining label or the ns unconfined label (NOT NULL) 139 * 140 * Not safe to call inside locks 141 * 142 * The returned reference must be put with end_current_label_crit_section() 143 * This must NOT be used if the task cred could be updated within the 144 * critical section between begin_current_label_crit_section() .. 145 * end_current_label_crit_section() 146 */ 147static inline struct aa_label *begin_current_label_crit_section(void) 148{ 149 struct aa_label *label = aa_current_raw_label(); 150 151 might_sleep(); 152 153 if (label_is_stale(label)) { 154 label = aa_get_newest_label(label); 155 if (aa_replace_current_label(label) == 0) 156 /* task cred will keep the reference */ 157 aa_put_label(label); 158 } 159 160 return label; 161} 162 163static inline struct aa_ns *aa_get_current_ns(void) 164{ 165 struct aa_label *label; 166 struct aa_ns *ns; 167 168 label = __begin_current_label_crit_section(); 169 ns = aa_get_ns(labels_ns(label)); 170 __end_current_label_crit_section(label); 171 172 return ns; 173} 174 175#endif /* __AA_CONTEXT_H */ 176