1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * AppArmor security module |
4 | * |
5 | * This file contains AppArmor security identifier (secid) manipulation fns |
6 | * |
7 | * Copyright 2009-2017 Canonical Ltd. |
8 | * |
9 | * AppArmor allocates a unique secid for every label used. If a label |
10 | * is replaced it receives the secid of the label it is replacing. |
11 | */ |
12 | |
13 | #include <linux/errno.h> |
14 | #include <linux/err.h> |
15 | #include <linux/gfp.h> |
16 | #include <linux/slab.h> |
17 | #include <linux/spinlock.h> |
18 | #include <linux/xarray.h> |
19 | |
20 | #include "include/cred.h" |
21 | #include "include/lib.h" |
22 | #include "include/secid.h" |
23 | #include "include/label.h" |
24 | #include "include/policy_ns.h" |
25 | |
26 | /* |
27 | * secids - do not pin labels with a refcount. They rely on the label |
28 | * properly updating/freeing them |
29 | */ |
30 | #define AA_FIRST_SECID 2 |
31 | |
32 | static DEFINE_XARRAY_FLAGS(aa_secids, XA_FLAGS_LOCK_IRQ | XA_FLAGS_TRACK_FREE); |
33 | |
34 | int apparmor_display_secid_mode; |
35 | |
36 | /* |
37 | * TODO: allow policy to reserve a secid range? |
38 | * TODO: add secid pinning |
39 | * TODO: use secid_update in label replace |
40 | */ |
41 | |
42 | /** |
43 | * aa_secid_update - update a secid mapping to a new label |
44 | * @secid: secid to update |
45 | * @label: label the secid will now map to |
46 | */ |
47 | void aa_secid_update(u32 secid, struct aa_label *label) |
48 | { |
49 | unsigned long flags; |
50 | |
51 | xa_lock_irqsave(&aa_secids, flags); |
52 | __xa_store(&aa_secids, index: secid, entry: label, 0); |
53 | xa_unlock_irqrestore(&aa_secids, flags); |
54 | } |
55 | |
56 | /* |
57 | * see label for inverse aa_label_to_secid |
58 | */ |
59 | struct aa_label *aa_secid_to_label(u32 secid) |
60 | { |
61 | return xa_load(&aa_secids, index: secid); |
62 | } |
63 | |
64 | int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) |
65 | { |
66 | /* TODO: cache secctx and ref count so we don't have to recreate */ |
67 | struct aa_label *label = aa_secid_to_label(secid); |
68 | int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT; |
69 | int len; |
70 | |
71 | AA_BUG(!seclen); |
72 | |
73 | if (!label) |
74 | return -EINVAL; |
75 | |
76 | if (apparmor_display_secid_mode) |
77 | flags |= FLAG_SHOW_MODE; |
78 | |
79 | if (secdata) |
80 | len = aa_label_asxprint(strp: secdata, ns: root_ns, label, |
81 | flags, GFP_ATOMIC); |
82 | else |
83 | len = aa_label_snxprint(NULL, size: 0, view: root_ns, label, flags); |
84 | |
85 | if (len < 0) |
86 | return -ENOMEM; |
87 | |
88 | *seclen = len; |
89 | |
90 | return 0; |
91 | } |
92 | |
93 | int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) |
94 | { |
95 | struct aa_label *label; |
96 | |
97 | label = aa_label_strn_parse(base: &root_ns->unconfined->label, str: secdata, |
98 | n: seclen, GFP_KERNEL, create: false, force_stack: false); |
99 | if (IS_ERR(ptr: label)) |
100 | return PTR_ERR(ptr: label); |
101 | *secid = label->secid; |
102 | |
103 | return 0; |
104 | } |
105 | |
106 | void apparmor_release_secctx(char *secdata, u32 seclen) |
107 | { |
108 | kfree(objp: secdata); |
109 | } |
110 | |
111 | /** |
112 | * aa_alloc_secid - allocate a new secid for a profile |
113 | * @label: the label to allocate a secid for |
114 | * @gfp: memory allocation flags |
115 | * |
116 | * Returns: 0 with @label->secid initialized |
117 | * <0 returns error with @label->secid set to AA_SECID_INVALID |
118 | */ |
119 | int aa_alloc_secid(struct aa_label *label, gfp_t gfp) |
120 | { |
121 | unsigned long flags; |
122 | int ret; |
123 | |
124 | xa_lock_irqsave(&aa_secids, flags); |
125 | ret = __xa_alloc(&aa_secids, id: &label->secid, entry: label, |
126 | XA_LIMIT(AA_FIRST_SECID, INT_MAX), gfp); |
127 | xa_unlock_irqrestore(&aa_secids, flags); |
128 | |
129 | if (ret < 0) { |
130 | label->secid = AA_SECID_INVALID; |
131 | return ret; |
132 | } |
133 | |
134 | return 0; |
135 | } |
136 | |
137 | /** |
138 | * aa_free_secid - free a secid |
139 | * @secid: secid to free |
140 | */ |
141 | void aa_free_secid(u32 secid) |
142 | { |
143 | unsigned long flags; |
144 | |
145 | xa_lock_irqsave(&aa_secids, flags); |
146 | __xa_erase(&aa_secids, index: secid); |
147 | xa_unlock_irqrestore(&aa_secids, flags); |
148 | } |
149 | |