| 1 |
|
| 2 | |
| 3 | * AppArmor security module
|
| 4 | *
|
| 5 | * This file contains AppArmor policy definitions.
|
| 6 | *
|
| 7 | * Copyright (C) 1998-2008 Novell/SUSE
|
| 8 | * Copyright 2009-2017 Canonical Ltd.
|
| 9 |
|
| 10 |
|
| 11 | #ifndef __AA_NAMESPACE_H
|
| 12 | #define __AA_NAMESPACE_H
|
| 13 |
|
| 14 | #include <linux/kref.h>
|
| 15 |
|
| 16 | #include "apparmor.h"
|
| 17 | #include "apparmorfs.h"
|
| 18 | #include "label.h"
|
| 19 | #include "policy.h"
|
| 20 |
|
| 21 |
|
| 22 | #define MAX_NS_DEPTH 32
|
| 23 |
|
| 24 | |
| 25 | * @max_size: maximum space allowed for all profiles in namespace
|
| 26 | * @max_count: maximum number of profiles that can be in this namespace
|
| 27 | * @size: current size of profiles
|
| 28 | * @count: current count of profiles (includes null profiles)
|
| 29 |
|
| 30 | struct aa_ns_acct {
|
| 31 | int max_size;
|
| 32 | int max_count;
|
| 33 | int size;
|
| 34 | int count;
|
| 35 | };
|
| 36 |
|
| 37 | |
| 38 | * @base: common policy
|
| 39 | * @parent: parent of namespace
|
| 40 | * @lock: lock for modifying the object
|
| 41 | * @acct: accounting for the namespace
|
| 42 | * @unconfined: special unconfined profile for the namespace
|
| 43 | * @sub_ns: list of namespaces under the current namespace.
|
| 44 | * @uniq_null: uniq value used for null learning profiles
|
| 45 | * @uniq_id: a unique id count for the profiles in the namespace
|
| 46 | * @level: level of ns within the tree hierarchy
|
| 47 | * @dents: dentries for the namespaces file entries in apparmorfs
|
| 48 | *
|
| 49 | * An aa_ns defines the set profiles that are searched to determine which
|
| 50 | * profile to attach to a task. Profiles can not be shared between aa_ns
|
| 51 | * and profile names within a namespace are guaranteed to be unique. When
|
| 52 | * profiles in separate namespaces have the same name they are NOT considered
|
| 53 | * to be equivalent.
|
| 54 | *
|
| 55 | * Namespaces are hierarchical and only namespaces and profiles below the
|
| 56 | * current namespace are visible.
|
| 57 | *
|
| 58 | * Namespace names must be unique and can not contain the characters :/\0
|
| 59 |
|
| 60 | struct aa_ns {
|
| 61 | struct aa_policy base;
|
| 62 | struct aa_ns *parent;
|
| 63 | struct mutex lock;
|
| 64 | struct aa_ns_acct acct;
|
| 65 | struct aa_profile *unconfined;
|
| 66 | struct list_head sub_ns;
|
| 67 | atomic_t uniq_null;
|
| 68 | long uniq_id;
|
| 69 | int level;
|
| 70 | long revision;
|
| 71 | wait_queue_head_t wait;
|
| 72 |
|
| 73 | struct aa_labelset labels;
|
| 74 | struct list_head rawdata_list;
|
| 75 |
|
| 76 | struct dentry *dents[AAFS_NS_SIZEOF];
|
| 77 | };
|
| 78 |
|
| 79 | extern struct aa_label *kernel_t;
|
| 80 | extern struct aa_ns *root_ns;
|
| 81 |
|
| 82 | extern const char *aa_hidden_ns_name;
|
| 83 |
|
| 84 | #define ns_unconfined(NS) (&(NS)->unconfined->label)
|
| 85 |
|
| 86 | bool aa_ns_visible(struct aa_ns *curr, struct aa_ns *view, bool subns);
|
| 87 | const char *aa_ns_name(struct aa_ns *parent, struct aa_ns *child, bool subns);
|
| 88 | void aa_free_ns(struct aa_ns *ns);
|
| 89 | int aa_alloc_root_ns(void);
|
| 90 | void aa_free_root_ns(void);
|
| 91 |
|
| 92 | struct aa_ns *__aa_lookupn_ns(struct aa_ns *view, const char *hname, size_t n);
|
| 93 | struct aa_ns *aa_lookupn_ns(struct aa_ns *view, const char *name, size_t n);
|
| 94 | struct aa_ns *__aa_find_or_create_ns(struct aa_ns *parent, const char *name,
|
| 95 | struct dentry *dir);
|
| 96 | struct aa_ns *aa_prepare_ns(struct aa_ns *root, const char *name);
|
| 97 | void __aa_remove_ns(struct aa_ns *ns);
|
| 98 |
|
| 99 | static inline struct aa_profile *aa_deref_parent(struct aa_profile *p)
|
| 100 | {
|
| 101 | return rcu_dereference_protected(p->parent,
|
| 102 | mutex_is_locked(&p->ns->lock));
|
| 103 | }
|
| 104 |
|
| 105 | |
| 106 | * aa_get_ns - increment references count on @ns
|
| 107 | * @ns: namespace to increment reference count of (MAYBE NULL)
|
| 108 | *
|
| 109 | * Returns: pointer to @ns, if @ns is NULL returns NULL
|
| 110 | * Requires: @ns must be held with valid refcount when called
|
| 111 |
|
| 112 | static inline struct aa_ns *aa_get_ns(struct aa_ns *ns)
|
| 113 | {
|
| 114 | if (ns)
|
| 115 | aa_get_profile(ns->unconfined);
|
| 116 |
|
| 117 | return ns;
|
| 118 | }
|
| 119 |
|
| 120 | |
| 121 | * aa_put_ns - decrement refcount on @ns
|
| 122 | * @ns: namespace to put reference of
|
| 123 | *
|
| 124 | * Decrement reference count of @ns and if no longer in use free it
|
| 125 |
|
| 126 | static inline void aa_put_ns(struct aa_ns *ns)
|
| 127 | {
|
| 128 | if (ns)
|
| 129 | aa_put_profile(ns->unconfined);
|
| 130 | }
|
| 131 |
|
| 132 | |
| 133 | * __aa_findn_ns - find a namespace on a list by @name
|
| 134 | * @head: list to search for namespace on (NOT NULL)
|
| 135 | * @name: name of namespace to look for (NOT NULL)
|
| 136 | * @n: length of @name
|
| 137 | * Returns: unrefcounted namespace
|
| 138 | *
|
| 139 | * Requires: rcu_read_lock be held
|
| 140 |
|
| 141 | static inline struct aa_ns *__aa_findn_ns(struct list_head *head,
|
| 142 | const char *name, size_t n)
|
| 143 | {
|
| 144 | return (struct aa_ns *)__policy_strn_find(head, name, n);
|
| 145 | }
|
| 146 |
|
| 147 | static inline struct aa_ns *__aa_find_ns(struct list_head *head,
|
| 148 | const char *name)
|
| 149 | {
|
| 150 | return __aa_findn_ns(head, name, strlen(name));
|
| 151 | }
|
| 152 |
|
| 153 | #endif
|