cred.h

  1/* SPDX-License-Identifier: GPL-2.0-only */
  2/*
  3 * AppArmor security module
  4 *
  5 * This file contains AppArmor contexts used to associate "labels" to objects.
  6 *
  7 * Copyright (C) 1998-2008 Novell/SUSE
  8 * Copyright 2009-2010 Canonical Ltd.
  9 */
 10
 11#ifndef __AA_CONTEXT_H
 12#define __AA_CONTEXT_H
 13
 14#include <linux/cred.h>
 15#include <linux/slab.h>
 16#include <linux/sched.h>
 17
 18#include "label.h"
 19#include "policy_ns.h"
 20#include "task.h"
 21
 22static inline struct aa_label *cred_label(const struct cred *cred)
 23{
 24	struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
 25
 26	AA_BUG(!blob);
 27	return *blob;
 28}
 29
 30static inline void set_cred_label(const struct cred *cred,
 31				  struct aa_label *label)
 32{
 33	struct aa_label **blob = cred->security + apparmor_blob_sizes.lbs_cred;
 34
 35	AA_BUG(!blob);
 36	*blob = label;
 37}
 38
 39/**
 40 * aa_cred_raw_label - obtain cred's label
 41 * @cred: cred to obtain label from  (NOT NULL)
 42 *
 43 * Returns: confining label
 44 *
 45 * does NOT increment reference count
 46 */
 47static inline struct aa_label *aa_cred_raw_label(const struct cred *cred)
 48{
 49	struct aa_label *label = cred_label(cred);
 50
 51	AA_BUG(!label);
 52	return label;
 53}
 54
 55/**
 56 * aa_get_newest_cred_label - obtain the newest label on a cred
 57 * @cred: cred to obtain label from (NOT NULL)
 58 *
 59 * Returns: newest version of confining label
 60 */
 61static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred)
 62{
 63	return aa_get_newest_label(aa_cred_raw_label(cred));
 64}
 65
 66static inline struct aa_label *aa_get_newest_cred_label_condref(const struct cred *cred,
 67								bool *needput)
 68{
 69	struct aa_label *l = aa_cred_raw_label(cred);
 70
 71	if (unlikely(label_is_stale(l))) {
 72		*needput = true;
 73		return aa_get_newest_label(l);
 74	}
 75
 76	*needput = false;
 77	return l;
 78}
 79
 80static inline void aa_put_label_condref(struct aa_label *l, bool needput)
 81{
 82	if (unlikely(needput))
 83		aa_put_label(l);
 84}
 85
 86/**
 87 * aa_current_raw_label - find the current tasks confining label
 88 *
 89 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
 90 *
 91 * This fn will not update the tasks cred to the most up to date version
 92 * of the label so it is safe to call when inside of locks.
 93 */
 94static inline struct aa_label *aa_current_raw_label(void)
 95{
 96	return aa_cred_raw_label(current_cred());
 97}
 98
 99/**
100 * aa_get_current_label - get the newest version of the current tasks label
101 *
102 * Returns: newest version of confining label (NOT NULL)
103 *
104 * This fn will not update the tasks cred, so it is safe inside of locks
105 *
106 * The returned reference must be put with aa_put_label()
107 */
108static inline struct aa_label *aa_get_current_label(void)
109{
110	struct aa_label *l = aa_current_raw_label();
111
112	if (label_is_stale(l))
113		return aa_get_newest_label(l);
114	return aa_get_label(l);
115}
116
117/**
118 * __end_current_label_crit_section - end crit section begun with __begin_...
119 * @label: label obtained from __begin_current_label_crit_section
120 * @needput: output: bool set by __begin_current_label_crit_section
121 *
122 * Returns: label to use for this crit section
123 */
124static inline void __end_current_label_crit_section(struct aa_label *label,
125						    bool needput)
126{
127	if (unlikely(needput))
128		aa_put_label(label);
129}
130
131/**
132 * end_current_label_crit_section - put a reference found with begin_current_label..
133 * @label: label reference to put
134 *
135 * Should only be used with a reference obtained with
136 * begin_current_label_crit_section and never used in situations where the
137 * task cred may be updated
138 */
139static inline void end_current_label_crit_section(struct aa_label *label)
140{
141	if (label != aa_current_raw_label())
142		aa_put_label(label);
143}
144
145/**
146 * __begin_current_label_crit_section - current's confining label
147 * @needput: store whether the label needs to be put when ending crit section
148 *
149 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
150 *
151 * safe to call inside locks
152 *
153 * The returned reference must be put with __end_current_label_crit_section()
154 * This must NOT be used if the task cred could be updated within the
155 * critical section between __begin_current_label_crit_section() ..
156 * __end_current_label_crit_section()
157 */
158static inline struct aa_label *__begin_current_label_crit_section(bool *needput)
159{
160	struct aa_label *label = aa_current_raw_label();
161
162	if (label_is_stale(label)) {
163		*needput = true;
164		return aa_get_newest_label(label);
165	}
166
167	*needput = false;
168	return label;
169}
170
171/**
172 * begin_current_label_crit_section - current's confining label and update it
173 *
174 * Returns: up to date confining label or the ns unconfined label (NOT NULL)
175 *
176 * Not safe to call inside locks
177 *
178 * The returned reference must be put with end_current_label_crit_section()
179 * This must NOT be used if the task cred could be updated within the
180 * critical section between begin_current_label_crit_section() ..
181 * end_current_label_crit_section()
182 */
183static inline struct aa_label *begin_current_label_crit_section(void)
184{
185	struct aa_label *label = aa_current_raw_label();
186
187	might_sleep();
188
189	if (label_is_stale(label)) {
190		label = aa_get_newest_label(label);
191		if (aa_replace_current_label(label) == 0)
192			/* task cred will keep the reference */
193			aa_put_label(label);
194	}
195
196	return label;
197}
198
199static inline struct aa_ns *aa_get_current_ns(void)
200{
201	struct aa_label *label;
202	struct aa_ns *ns;
203	bool needput;
204
205	label  = __begin_current_label_crit_section(&needput);
206	ns = aa_get_ns(labels_ns(label));
207	__end_current_label_crit_section(label, needput);
208
209	return ns;
210}
211
212#endif /* __AA_CONTEXT_H */