Commit | Line | Data |
---|---|---|
121d4a91 JJ |
1 | /* |
2 | * AppArmor security module | |
3 | * | |
4 | * This file contains AppArmor security identifier (secid) manipulation fns | |
5 | * | |
c0929212 | 6 | * Copyright 2009-2017 Canonical Ltd. |
121d4a91 JJ |
7 | * |
8 | * This program is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU General Public License as | |
10 | * published by the Free Software Foundation, version 2 of the | |
11 | * License. | |
12 | * | |
13 | * | |
c0929212 JJ |
14 | * AppArmor allocates a unique secid for every label used. If a label |
15 | * is replaced it receives the secid of the label it is replacing. | |
121d4a91 JJ |
16 | */ |
17 | ||
121d4a91 JJ |
18 | #include <linux/errno.h> |
19 | #include <linux/err.h> | |
c0929212 | 20 | #include <linux/gfp.h> |
99cc45e4 | 21 | #include <linux/idr.h> |
c0929212 JJ |
22 | #include <linux/slab.h> |
23 | #include <linux/spinlock.h> | |
121d4a91 | 24 | |
c0929212 JJ |
25 | #include "include/cred.h" |
26 | #include "include/lib.h" | |
121d4a91 | 27 | #include "include/secid.h" |
c0929212 JJ |
28 | #include "include/label.h" |
29 | #include "include/policy_ns.h" | |
121d4a91 | 30 | |
c0929212 JJ |
31 | /* |
32 | * secids - do not pin labels with a refcount. They rely on the label | |
33 | * properly updating/freeing them | |
c0929212 JJ |
34 | */ |
35 | ||
a4c3f89c JJ |
36 | #define AA_FIRST_SECID 1 |
37 | ||
99cc45e4 | 38 | static DEFINE_IDR(aa_secids); |
121d4a91 | 39 | static DEFINE_SPINLOCK(secid_lock); |
c0929212 JJ |
40 | |
41 | /* | |
42 | * TODO: allow policy to reserve a secid range? | |
43 | * TODO: add secid pinning | |
44 | * TODO: use secid_update in label replace | |
45 | */ | |
46 | ||
c0929212 JJ |
47 | /** |
48 | * aa_secid_update - update a secid mapping to a new label | |
49 | * @secid: secid to update | |
50 | * @label: label the secid will now map to | |
51 | */ | |
52 | void aa_secid_update(u32 secid, struct aa_label *label) | |
53 | { | |
c0929212 JJ |
54 | unsigned long flags; |
55 | ||
56 | spin_lock_irqsave(&secid_lock, flags); | |
99cc45e4 | 57 | idr_replace(&aa_secids, label, secid); |
c0929212 JJ |
58 | spin_unlock_irqrestore(&secid_lock, flags); |
59 | } | |
60 | ||
61 | /** | |
62 | * | |
63 | * see label for inverse aa_label_to_secid | |
64 | */ | |
65 | struct aa_label *aa_secid_to_label(u32 secid) | |
66 | { | |
67 | struct aa_label *label; | |
68 | ||
69 | rcu_read_lock(); | |
99cc45e4 | 70 | label = idr_find(&aa_secids, secid); |
c0929212 JJ |
71 | rcu_read_unlock(); |
72 | ||
73 | return label; | |
74 | } | |
75 | ||
76 | int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) | |
77 | { | |
78 | /* TODO: cache secctx and ref count so we don't have to recreate */ | |
79 | struct aa_label *label = aa_secid_to_label(secid); | |
52e7128e | 80 | int len; |
c0929212 | 81 | |
c0929212 JJ |
82 | AA_BUG(!seclen); |
83 | ||
84 | if (!label) | |
85 | return -EINVAL; | |
86 | ||
87 | if (secdata) | |
52e7128e JJ |
88 | len = aa_label_asxprint(secdata, root_ns, label, |
89 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | | |
90 | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT, | |
91 | GFP_ATOMIC); | |
c0929212 | 92 | else |
52e7128e JJ |
93 | len = aa_label_snxprint(NULL, 0, root_ns, label, |
94 | FLAG_SHOW_MODE | FLAG_VIEW_SUBNS | | |
95 | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT); | |
96 | if (len < 0) | |
c0929212 JJ |
97 | return -ENOMEM; |
98 | ||
52e7128e JJ |
99 | *seclen = len; |
100 | ||
c0929212 JJ |
101 | return 0; |
102 | } | |
103 | ||
c0929212 JJ |
104 | int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) |
105 | { | |
106 | struct aa_label *label; | |
107 | ||
108 | label = aa_label_strn_parse(&root_ns->unconfined->label, secdata, | |
109 | seclen, GFP_KERNEL, false, false); | |
110 | if (IS_ERR(label)) | |
111 | return PTR_ERR(label); | |
112 | *secid = label->secid; | |
113 | ||
114 | return 0; | |
115 | } | |
116 | ||
117 | void apparmor_release_secctx(char *secdata, u32 seclen) | |
118 | { | |
119 | kfree(secdata); | |
120 | } | |
121d4a91 | 121 | |
121d4a91 JJ |
122 | /** |
123 | * aa_alloc_secid - allocate a new secid for a profile | |
a4c3f89c JJ |
124 | * @label: the label to allocate a secid for |
125 | * @gfp: memory allocation flags | |
126 | * | |
127 | * Returns: 0 with @label->secid initialized | |
128 | * <0 returns error with @label->secid set to AA_SECID_INVALID | |
121d4a91 | 129 | */ |
a4c3f89c | 130 | int aa_alloc_secid(struct aa_label *label, gfp_t gfp) |
121d4a91 | 131 | { |
c0929212 | 132 | unsigned long flags; |
a4c3f89c | 133 | int ret; |
121d4a91 | 134 | |
99cc45e4 MW |
135 | idr_preload(gfp); |
136 | spin_lock_irqsave(&secid_lock, flags); | |
a4c3f89c | 137 | ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC); |
99cc45e4 MW |
138 | spin_unlock_irqrestore(&secid_lock, flags); |
139 | idr_preload_end(); | |
c0929212 | 140 | |
a4c3f89c JJ |
141 | if (ret < 0) { |
142 | label->secid = AA_SECID_INVALID; | |
143 | return ret; | |
144 | } | |
145 | ||
146 | AA_BUG(ret == AA_SECID_INVALID); | |
147 | label->secid = ret; | |
148 | return 0; | |
121d4a91 JJ |
149 | } |
150 | ||
151 | /** | |
152 | * aa_free_secid - free a secid | |
153 | * @secid: secid to free | |
154 | */ | |
155 | void aa_free_secid(u32 secid) | |
156 | { | |
c0929212 JJ |
157 | unsigned long flags; |
158 | ||
159 | spin_lock_irqsave(&secid_lock, flags); | |
99cc45e4 | 160 | idr_remove(&aa_secids, secid); |
c0929212 | 161 | spin_unlock_irqrestore(&secid_lock, flags); |
121d4a91 | 162 | } |
a4c3f89c JJ |
163 | |
164 | void aa_secids_init(void) | |
165 | { | |
166 | idr_init_base(&aa_secids, AA_FIRST_SECID); | |
167 | } |