1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor lib definitions 5 * 6 * 2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 */ 13 14 #ifndef __AA_LIB_H 15 #define __AA_LIB_H 16 17 #include <linux/slab.h> 18 #include <linux/fs.h> 19 20 #include "match.h" 21 22 /* Provide our own test for whether a write lock is held for asserts 23 * this is because on none SMP systems write_can_lock will always 24 * resolve to true, which is what you want for code making decisions 25 * based on it, but wrong for asserts checking that the lock is held 26 */ 27 #ifdef CONFIG_SMP 28 #define write_is_locked(X) !write_can_lock(X) 29 #else 30 #define write_is_locked(X) (1) 31 #endif /* CONFIG_SMP */ 32 33 /* 34 * DEBUG remains global (no per profile flag) since it is mostly used in sysctl 35 * which is not related to profile accesses. 36 */ 37 38 #define AA_DEBUG(fmt, args...) \ 39 do { \ 40 if (aa_g_debug) \ 41 pr_debug_ratelimited("AppArmor: " fmt, ##args); \ 42 } while (0) 43 44 #define AA_ERROR(fmt, args...) \ 45 pr_err_ratelimited("AppArmor: " fmt, ##args) 46 47 /* Flag indicating whether initialization completed */ 48 extern int apparmor_initialized __initdata; 49 50 /* fn's in lib */ 51 char *aa_split_fqname(char *args, char **ns_name); 52 const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name, 53 size_t *ns_len); 54 void aa_info_message(const char *str); 55 void *__aa_kvmalloc(size_t size, gfp_t flags); 56 57 static inline void *kvmalloc(size_t size) 58 { 59 return __aa_kvmalloc(size, 0); 60 } 61 62 static inline void *kvzalloc(size_t size) 63 { 64 return __aa_kvmalloc(size, __GFP_ZERO); 65 } 66 67 /* returns 0 if kref not incremented */ 68 static inline int kref_get_not0(struct kref *kref) 69 { 70 return atomic_inc_not_zero(&kref->refcount); 71 } 72 73 /** 74 * aa_strneq - compare null terminated @str to a non null terminated substring 75 * @str: a null terminated string 76 * @sub: a substring, not necessarily null terminated 77 * @len: length of @sub to compare 78 * 79 * The @str string must be full consumed for this to be considered a match 80 */ 81 static inline bool aa_strneq(const char *str, const char *sub, int len) 82 { 83 return !strncmp(str, sub, len) && !str[len]; 84 } 85 86 /** 87 * aa_dfa_null_transition - step to next state after null character 88 * @dfa: the dfa to match against 89 * @start: the state of the dfa to start matching in 90 * 91 * aa_dfa_null_transition transitions to the next state after a null 92 * character which is not used in standard matching and is only 93 * used to separate pairs. 94 */ 95 static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, 96 unsigned int start) 97 { 98 /* the null transition only needs the string's null terminator byte */ 99 return aa_dfa_next(dfa, start, 0); 100 } 101 102 static inline bool mediated_filesystem(struct dentry *dentry) 103 { 104 return !(dentry->d_sb->s_flags & MS_NOUSER); 105 } 106 107 /* struct aa_policy - common part of both namespaces and profiles 108 * @name: name of the object 109 * @hname - The hierarchical name 110 * @list: list policy object is on 111 * @profiles: head of the profiles list contained in the object 112 */ 113 struct aa_policy { 114 char *name; 115 char *hname; 116 struct list_head list; 117 struct list_head profiles; 118 }; 119 120 /** 121 * hname_tail - find the last component of an hname 122 * @name: hname to find the base profile name component of (NOT NULL) 123 * 124 * Returns: the tail (base profile name) name component of an hname 125 */ 126 static inline const char *hname_tail(const char *hname) 127 { 128 char *split; 129 130 hname = strim((char *)hname); 131 for (split = strstr(hname, "//"); split; split = strstr(hname, "//")) 132 hname = split + 2; 133 134 return hname; 135 } 136 137 /** 138 * __policy_find - find a policy by @name on a policy list 139 * @head: list to search (NOT NULL) 140 * @name: name to search for (NOT NULL) 141 * 142 * Requires: rcu_read_lock be held 143 * 144 * Returns: unrefcounted policy that match @name or NULL if not found 145 */ 146 static inline struct aa_policy *__policy_find(struct list_head *head, 147 const char *name) 148 { 149 struct aa_policy *policy; 150 151 list_for_each_entry_rcu(policy, head, list) { 152 if (!strcmp(policy->name, name)) 153 return policy; 154 } 155 return NULL; 156 } 157 158 /** 159 * __policy_strn_find - find a policy that's name matches @len chars of @str 160 * @head: list to search (NOT NULL) 161 * @str: string to search for (NOT NULL) 162 * @len: length of match required 163 * 164 * Requires: rcu_read_lock be held 165 * 166 * Returns: unrefcounted policy that match @str or NULL if not found 167 * 168 * if @len == strlen(@strlen) then this is equiv to __policy_find 169 * other wise it allows searching for policy by a partial match of name 170 */ 171 static inline struct aa_policy *__policy_strn_find(struct list_head *head, 172 const char *str, int len) 173 { 174 struct aa_policy *policy; 175 176 list_for_each_entry_rcu(policy, head, list) { 177 if (aa_strneq(policy->name, str, len)) 178 return policy; 179 } 180 181 return NULL; 182 } 183 184 bool aa_policy_init(struct aa_policy *policy, const char *prefix, 185 const char *name); 186 void aa_policy_destroy(struct aa_policy *policy); 187 188 #endif /* AA_LIB_H */ 189