1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor lib definitions 5 * 6 * 2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 */ 13 14 #ifndef __AA_LIB_H 15 #define __AA_LIB_H 16 17 #include <linux/slab.h> 18 #include <linux/fs.h> 19 20 #include "match.h" 21 22 /* 23 * DEBUG remains global (no per profile flag) since it is mostly used in sysctl 24 * which is not related to profile accesses. 25 */ 26 27 #define AA_DEBUG(fmt, args...) \ 28 do { \ 29 if (aa_g_debug) \ 30 pr_debug_ratelimited("AppArmor: " fmt, ##args); \ 31 } while (0) 32 33 #define AA_ERROR(fmt, args...) \ 34 pr_err_ratelimited("AppArmor: " fmt, ##args) 35 36 /* Flag indicating whether initialization completed */ 37 extern int apparmor_initialized __initdata; 38 39 /* fn's in lib */ 40 char *aa_split_fqname(char *args, char **ns_name); 41 void aa_info_message(const char *str); 42 void *__aa_kvmalloc(size_t size, gfp_t flags); 43 44 static inline void *kvmalloc(size_t size) 45 { 46 return __aa_kvmalloc(size, 0); 47 } 48 49 static inline void *kvzalloc(size_t size) 50 { 51 return __aa_kvmalloc(size, __GFP_ZERO); 52 } 53 54 /* returns 0 if kref not incremented */ 55 static inline int kref_get_not0(struct kref *kref) 56 { 57 return atomic_inc_not_zero(&kref->refcount); 58 } 59 60 /** 61 * aa_strneq - compare null terminated @str to a non null terminated substring 62 * @str: a null terminated string 63 * @sub: a substring, not necessarily null terminated 64 * @len: length of @sub to compare 65 * 66 * The @str string must be full consumed for this to be considered a match 67 */ 68 static inline bool aa_strneq(const char *str, const char *sub, int len) 69 { 70 return !strncmp(str, sub, len) && !str[len]; 71 } 72 73 /** 74 * aa_dfa_null_transition - step to next state after null character 75 * @dfa: the dfa to match against 76 * @start: the state of the dfa to start matching in 77 * 78 * aa_dfa_null_transition transitions to the next state after a null 79 * character which is not used in standard matching and is only 80 * used to separate pairs. 81 */ 82 static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, 83 unsigned int start) 84 { 85 /* the null transition only needs the string's null terminator byte */ 86 return aa_dfa_next(dfa, start, 0); 87 } 88 89 static inline bool mediated_filesystem(struct dentry *dentry) 90 { 91 return !(dentry->d_sb->s_flags & MS_NOUSER); 92 } 93 94 /* struct aa_policy - common part of both namespaces and profiles 95 * @name: name of the object 96 * @hname - The hierarchical name 97 * @list: list policy object is on 98 * @profiles: head of the profiles list contained in the object 99 */ 100 struct aa_policy { 101 char *name; 102 char *hname; 103 struct list_head list; 104 struct list_head profiles; 105 }; 106 107 /** 108 * hname_tail - find the last component of an hname 109 * @name: hname to find the base profile name component of (NOT NULL) 110 * 111 * Returns: the tail (base profile name) name component of an hname 112 */ 113 static inline const char *hname_tail(const char *hname) 114 { 115 char *split; 116 117 hname = strim((char *)hname); 118 for (split = strstr(hname, "//"); split; split = strstr(hname, "//")) 119 hname = split + 2; 120 121 return hname; 122 } 123 124 /** 125 * __policy_find - find a policy by @name on a policy list 126 * @head: list to search (NOT NULL) 127 * @name: name to search for (NOT NULL) 128 * 129 * Requires: rcu_read_lock be held 130 * 131 * Returns: unrefcounted policy that match @name or NULL if not found 132 */ 133 static inline struct aa_policy *__policy_find(struct list_head *head, 134 const char *name) 135 { 136 struct aa_policy *policy; 137 138 list_for_each_entry_rcu(policy, head, list) { 139 if (!strcmp(policy->name, name)) 140 return policy; 141 } 142 return NULL; 143 } 144 145 /** 146 * __policy_strn_find - find a policy that's name matches @len chars of @str 147 * @head: list to search (NOT NULL) 148 * @str: string to search for (NOT NULL) 149 * @len: length of match required 150 * 151 * Requires: rcu_read_lock be held 152 * 153 * Returns: unrefcounted policy that match @str or NULL if not found 154 * 155 * if @len == strlen(@strlen) then this is equiv to __policy_find 156 * other wise it allows searching for policy by a partial match of name 157 */ 158 static inline struct aa_policy *__policy_strn_find(struct list_head *head, 159 const char *str, int len) 160 { 161 struct aa_policy *policy; 162 163 list_for_each_entry_rcu(policy, head, list) { 164 if (aa_strneq(policy->name, str, len)) 165 return policy; 166 } 167 168 return NULL; 169 } 170 171 bool aa_policy_init(struct aa_policy *policy, const char *prefix, 172 const char *name); 173 void aa_policy_destroy(struct aa_policy *policy); 174 175 #endif /* AA_LIB_H */ 176