1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * AppArmor security module 4 * 5 * This file contains AppArmor task related definitions and mediation 6 * 7 * Copyright 2017 Canonical Ltd. 8 */ 9 10#ifndef __AA_TASK_H 11#define __AA_TASK_H 12 13static inline struct aa_task_ctx *task_ctx(struct task_struct *task) 14{ 15 return task->security + apparmor_blob_sizes.lbs_task; 16} 17 18/* 19 * struct aa_task_ctx - information for current task label change 20 * @nnp: snapshot of label at time of no_new_privs 21 * @onexec: profile to transition to on next exec (MAY BE NULL) 22 * @previous: profile the task may return to (MAY BE NULL) 23 * @token: magic value the task must know for returning to @previous_profile 24 */ 25struct aa_task_ctx { 26 struct aa_label *nnp; 27 struct aa_label *onexec; 28 struct aa_label *previous; 29 u64 token; 30}; 31 32int aa_replace_current_label(struct aa_label *label); 33void aa_set_current_onexec(struct aa_label *label, bool stack); 34int aa_set_current_hat(struct aa_label *label, u64 token); 35int aa_restore_previous_label(u64 cookie); 36struct aa_label *aa_get_task_label(struct task_struct *task); 37 38/** 39 * aa_free_task_ctx - free a task_ctx 40 * @ctx: task_ctx to free (MAYBE NULL) 41 */ 42static inline void aa_free_task_ctx(struct aa_task_ctx *ctx) 43{ 44 if (ctx) { 45 aa_put_label(ctx->nnp); 46 aa_put_label(ctx->previous); 47 aa_put_label(ctx->onexec); 48 } 49} 50 51/** 52 * aa_dup_task_ctx - duplicate a task context, incrementing reference counts 53 * @new: a blank task context (NOT NULL) 54 * @old: the task context to copy (NOT NULL) 55 */ 56static inline void aa_dup_task_ctx(struct aa_task_ctx *new, 57 const struct aa_task_ctx *old) 58{ 59 *new = *old; 60 aa_get_label(new->nnp); 61 aa_get_label(new->previous); 62 aa_get_label(new->onexec); 63} 64 65/** 66 * aa_clear_task_ctx_trans - clear transition tracking info from the ctx 67 * @ctx: task context to clear (NOT NULL) 68 */ 69static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx) 70{ 71 AA_BUG(!ctx); 72 73 aa_put_label(ctx->previous); 74 aa_put_label(ctx->onexec); 75 ctx->previous = NULL; 76 ctx->onexec = NULL; 77 ctx->token = 0; 78} 79 80#define AA_PTRACE_TRACE MAY_WRITE 81#define AA_PTRACE_READ MAY_READ 82#define AA_MAY_BE_TRACED AA_MAY_APPEND 83#define AA_MAY_BE_READ AA_MAY_CREATE 84#define PTRACE_PERM_SHIFT 2 85 86#define AA_PTRACE_PERM_MASK (AA_PTRACE_READ | AA_PTRACE_TRACE | \ 87 AA_MAY_BE_READ | AA_MAY_BE_TRACED) 88#define AA_SIGNAL_PERM_MASK (MAY_READ | MAY_WRITE) 89 90#define AA_SFS_SIG_MASK "hup int quit ill trap abrt bus fpe kill usr1 " \ 91 "segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg " \ 92 "xcpu xfsz vtalrm prof winch io pwr sys emt lost" 93 94int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer, 95 const struct cred *tracee_cred, struct aa_label *tracee, 96 u32 request); 97 98 99 100#define AA_USERNS_CREATE 8 101 102int aa_profile_ns_perm(struct aa_profile *profile, 103 struct apparmor_audit_data *ad, u32 request); 104 105#endif /* __AA_TASK_H */ 106