secid.c 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor security identifier (secid) manipulation fns
  6. *
  7. * Copyright 2009-2017 Canonical Ltd.
  8. *
  9. * AppArmor allocates a unique secid for every label used. If a label
  10. * is replaced it receives the secid of the label it is replacing.
  11. */
  12. #include <linux/errno.h>
  13. #include <linux/err.h>
  14. #include <linux/gfp.h>
  15. #include <linux/slab.h>
  16. #include <linux/spinlock.h>
  17. #include <linux/xarray.h>
  18. #include "include/cred.h"
  19. #include "include/lib.h"
  20. #include "include/secid.h"
  21. #include "include/label.h"
  22. #include "include/policy_ns.h"
  23. /*
  24. * secids - do not pin labels with a refcount. They rely on the label
  25. * properly updating/freeing them
  26. */
  27. #define AA_FIRST_SECID 2
  28. static DEFINE_XARRAY_FLAGS(aa_secids, XA_FLAGS_LOCK_IRQ | XA_FLAGS_TRACK_FREE);
  29. int apparmor_display_secid_mode;
  30. /*
  31. * TODO: allow policy to reserve a secid range?
  32. * TODO: add secid pinning
  33. * TODO: use secid_update in label replace
  34. */
  35. /**
  36. * aa_secid_update - update a secid mapping to a new label
  37. * @secid: secid to update
  38. * @label: label the secid will now map to
  39. */
  40. void aa_secid_update(u32 secid, struct aa_label *label)
  41. {
  42. unsigned long flags;
  43. xa_lock_irqsave(&aa_secids, flags);
  44. __xa_store(&aa_secids, secid, label, 0);
  45. xa_unlock_irqrestore(&aa_secids, flags);
  46. }
  47. /**
  48. *
  49. * see label for inverse aa_label_to_secid
  50. */
  51. struct aa_label *aa_secid_to_label(u32 secid)
  52. {
  53. return xa_load(&aa_secids, secid);
  54. }
  55. int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
  56. {
  57. /* TODO: cache secctx and ref count so we don't have to recreate */
  58. struct aa_label *label = aa_secid_to_label(secid);
  59. int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT;
  60. int len;
  61. AA_BUG(!seclen);
  62. if (!label)
  63. return -EINVAL;
  64. if (apparmor_display_secid_mode)
  65. flags |= FLAG_SHOW_MODE;
  66. if (secdata)
  67. len = aa_label_asxprint(secdata, root_ns, label,
  68. flags, GFP_ATOMIC);
  69. else
  70. len = aa_label_snxprint(NULL, 0, root_ns, label, flags);
  71. if (len < 0)
  72. return -ENOMEM;
  73. *seclen = len;
  74. return 0;
  75. }
  76. int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
  77. {
  78. struct aa_label *label;
  79. label = aa_label_strn_parse(&root_ns->unconfined->label, secdata,
  80. seclen, GFP_KERNEL, false, false);
  81. if (IS_ERR(label))
  82. return PTR_ERR(label);
  83. *secid = label->secid;
  84. return 0;
  85. }
  86. void apparmor_release_secctx(char *secdata, u32 seclen)
  87. {
  88. kfree(secdata);
  89. }
  90. /**
  91. * aa_alloc_secid - allocate a new secid for a profile
  92. * @label: the label to allocate a secid for
  93. * @gfp: memory allocation flags
  94. *
  95. * Returns: 0 with @label->secid initialized
  96. * <0 returns error with @label->secid set to AA_SECID_INVALID
  97. */
  98. int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
  99. {
  100. unsigned long flags;
  101. int ret;
  102. xa_lock_irqsave(&aa_secids, flags);
  103. ret = __xa_alloc(&aa_secids, &label->secid, label,
  104. XA_LIMIT(AA_FIRST_SECID, INT_MAX), gfp);
  105. xa_unlock_irqrestore(&aa_secids, flags);
  106. if (ret < 0) {
  107. label->secid = AA_SECID_INVALID;
  108. return ret;
  109. }
  110. return 0;
  111. }
  112. /**
  113. * aa_free_secid - free a secid
  114. * @secid: secid to free
  115. */
  116. void aa_free_secid(u32 secid)
  117. {
  118. unsigned long flags;
  119. xa_lock_irqsave(&aa_secids, flags);
  120. __xa_erase(&aa_secids, secid);
  121. xa_unlock_irqrestore(&aa_secids, flags);
  122. }