policy_ns.h

  1/* SPDX-License-Identifier: GPL-2.0-only */
  2/*
  3 * AppArmor security module
  4 *
  5 * This file contains AppArmor policy definitions.
  6 *
  7 * Copyright (C) 1998-2008 Novell/SUSE
  8 * Copyright 2009-2017 Canonical Ltd.
  9 */
 10
 11#ifndef __AA_NAMESPACE_H
 12#define __AA_NAMESPACE_H
 13
 14#include <linux/kref.h>
 15
 16#include "apparmor.h"
 17#include "apparmorfs.h"
 18#include "label.h"
 19#include "policy.h"
 20
 21/* Match max depth of user namespaces */
 22#define MAX_NS_DEPTH 32
 23
 24/* struct aa_ns_acct - accounting of profiles in namespace
 25 * @max_size: maximum space allowed for all profiles in namespace
 26 * @max_count: maximum number of profiles that can be in this namespace
 27 * @size: current size of profiles
 28 * @count: current count of profiles (includes null profiles)
 29 */
 30struct aa_ns_acct {
 31	int max_size;
 32	int max_count;
 33	int size;
 34	int count;
 35};
 36
 37/* struct aa_ns - namespace for a set of profiles
 38 * @base: common policy
 39 * @parent: parent of namespace
 40 * @lock: lock for modifying the object
 41 * @acct: accounting for the namespace
 42 * @unconfined: special unconfined profile for the namespace
 43 * @sub_ns: list of namespaces under the current namespace.
 44 * @uniq_null: uniq value used for null learning profiles
 45 * @uniq_id: a unique id count for the profiles in the namespace
 46 * @level: level of ns within the tree hierarchy
 47 * @dents: dentries for the namespaces file entries in apparmorfs
 48 *
 49 * An aa_ns defines the set profiles that are searched to determine which
 50 * profile to attach to a task.  Profiles can not be shared between aa_ns
 51 * and profile names within a namespace are guaranteed to be unique.  When
 52 * profiles in separate namespaces have the same name they are NOT considered
 53 * to be equivalent.
 54 *
 55 * Namespaces are hierarchical and only namespaces and profiles below the
 56 * current namespace are visible.
 57 *
 58 * Namespace names must be unique and can not contain the characters :/\0
 59 */
 60struct aa_ns {
 61	struct aa_policy base;
 62	struct aa_ns *parent;
 63	struct mutex lock;
 64	struct aa_ns_acct acct;
 65	struct aa_profile *unconfined;
 66	struct list_head sub_ns;
 67	atomic_t uniq_null;
 68	long uniq_id;
 69	int level;
 70	long revision;
 71	wait_queue_head_t wait;
 72
 73	struct aa_labelset labels;
 74	struct list_head rawdata_list;
 75
 76	struct dentry *dents[AAFS_NS_SIZEOF];
 77};
 78
 79extern struct aa_label *kernel_t;
 80extern struct aa_ns *root_ns;
 81
 82extern const char *aa_hidden_ns_name;
 83
 84#define ns_unconfined(NS) (&(NS)->unconfined->label)
 85
 86bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
 87const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
 88void aa_free_ns(struct aa_ns *ns);
 89int aa_alloc_root_ns(void);
 90void aa_free_root_ns(void);
 91
 92struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n);
 93struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n);
 94struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
 95				     struct dentry *dir);
 96struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
 97void __aa_remove_ns(struct aa_ns *ns);
 98
 99static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
100{
101	return rcu_dereference_protected(p->parent,
102					 mutex_is_locked(&p->ns->lock));
103}
104
105/**
106 * aa_get_ns - increment references count on @ns
107 * @ns: namespace to increment reference count of (MAYBE NULL)
108 *
109 * Returns: pointer to @ns, if @ns is NULL returns NULL
110 * Requires: @ns must be held with valid refcount when called
111 */
112static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
113{
114	if (ns)
115		aa_get_profile(ns->unconfined);
116
117	return ns;
118}
119
120/**
121 * aa_put_ns - decrement refcount on @ns
122 * @ns: namespace to put reference of
123 *
124 * Decrement reference count of @ns and if no longer in use free it
125 */
126static inline void aa_put_ns(struct aa_ns *ns)
127{
128	if (ns)
129		aa_put_profile(ns->unconfined);
130}
131
132/**
133 * __aa_findn_ns - find a namespace on a list by @name
134 * @head: list to search for namespace on  (NOT NULL)
135 * @name: name of namespace to look for  (NOT NULL)
136 * @n: length of @name
137 * Returns: unrefcounted namespace
138 *
139 * Requires: rcu_read_lock be held
140 */
141static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
142					  const char *name, size_t n)
143{
144	return (struct aa_ns *)__policy_strn_find(head, name, n);
145}
146
147static inline struct aa_ns *__aa_find_ns(struct list_head *head,
148					 const char *name)
149{
150	return __aa_findn_ns(head, name, strlen(name));
151}
152
153#endif /* AA_NAMESPACE_H */