Skip to content

Commit

Permalink
apparmor: rename context abreviation cxt to the more standard ctx
Browse files Browse the repository at this point in the history 
Signed-off-by: John Johansen <[email protected]>
  • Loading branch information
John Johansen committed Jan 16, 2017
1 parent a20aa95 commit 55a26eb
Show file tree
Hide file tree
Showing 5 changed files with 150 additions and 144 deletions.
100 changes: 51 additions & 49 deletions security/apparmor/context.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@
* License.
*
*
* AppArmor sets confinement on every task, via the the aa_task_cxt and
* the aa_task_cxt.profile, both of which are required and are not allowed
* to be NULL. The aa_task_cxt is not reference counted and is unique
* AppArmor sets confinement on every task, via the the aa_task_ctx and
* the aa_task_ctx.profile, both of which are required and are not allowed
* to be NULL. The aa_task_ctx is not reference counted and is unique
* to each cred (which is reference count). The profile pointed to by
* the task_cxt is reference counted.
* the task_ctx is reference counted.
*
* TODO
* If a task uses change_hat it currently does not return to the old
Expand All @@ -30,28 +30,28 @@
#include "include/policy.h"

/**
* aa_alloc_task_context - allocate a new task_cxt
* aa_alloc_task_context - allocate a new task_ctx
* @flags: gfp flags for allocation
*
* Returns: allocated buffer or NULL on failure
*/
struct aa_task_cxt *aa_alloc_task_context(gfp_t flags)
struct aa_task_ctx *aa_alloc_task_context(gfp_t flags)
{
return kzalloc(sizeof(struct aa_task_cxt), flags);
return kzalloc(sizeof(struct aa_task_ctx), flags);
}

/**
* aa_free_task_context - free a task_cxt
* @cxt: task_cxt to free (MAYBE NULL)
* aa_free_task_context - free a task_ctx
* @ctx: task_ctx to free (MAYBE NULL)
*/
void aa_free_task_context(struct aa_task_cxt *cxt)
void aa_free_task_context(struct aa_task_ctx *ctx)
{
if (cxt) {
aa_put_profile(cxt->profile);
aa_put_profile(cxt->previous);
aa_put_profile(cxt->onexec);
if (ctx) {
aa_put_profile(ctx->profile);
aa_put_profile(ctx->previous);
aa_put_profile(ctx->onexec);

kzfree(cxt);
kzfree(ctx);
}
}

Expand All @@ -60,7 +60,7 @@ void aa_free_task_context(struct aa_task_cxt *cxt)
* @new: a blank task context (NOT NULL)
* @old: the task context to copy (NOT NULL)
*/
void aa_dup_task_context(struct aa_task_cxt *new, const struct aa_task_cxt *old)
void aa_dup_task_context(struct aa_task_ctx *new, const struct aa_task_ctx *old)
{
*new = *old;
aa_get_profile(new->profile);
Expand Down Expand Up @@ -93,11 +93,11 @@ struct aa_profile *aa_get_task_profile(struct task_struct *task)
*/
int aa_replace_current_profile(struct aa_profile *profile)
{
struct aa_task_cxt *cxt = current_cxt();
struct aa_task_ctx *ctx = current_ctx();
struct cred *new;
BUG_ON(!profile);

if (cxt->profile == profile)
if (ctx->profile == profile)
return 0;

if (current_cred() != current_real_cred())
Expand All @@ -107,20 +107,22 @@ int aa_replace_current_profile(struct aa_profile *profile)
if (!new)
return -ENOMEM;

cxt = cred_cxt(new);
if (unconfined(profile) || (cxt->profile->ns != profile->ns))
ctx = cred_ctx(new);
if (unconfined(profile) || (ctx->profile->ns != profile->ns))
/* if switching to unconfined or a different profile namespace
* clear out context state
*/
aa_clear_task_cxt_trans(cxt);
aa_clear_task_ctx_trans(ctx);

/* be careful switching cxt->profile, when racing replacement it
* is possible that cxt->profile->proxy->profile is the reference
/*
* be careful switching ctx->profile, when racing replacement it
* is possible that ctx->profile->proxy->profile is the reference
* keeping @profile valid, so make sure to get its reference before
* dropping the reference on cxt->profile */
* dropping the reference on ctx->profile
*/
aa_get_profile(profile);
aa_put_profile(cxt->profile);
cxt->profile = profile;
aa_put_profile(ctx->profile);
ctx->profile = profile;

commit_creds(new);
return 0;
Expand All @@ -134,15 +136,15 @@ int aa_replace_current_profile(struct aa_profile *profile)
*/
int aa_set_current_onexec(struct aa_profile *profile)
{
struct aa_task_cxt *cxt;
struct aa_task_ctx *ctx;
struct cred *new = prepare_creds();
if (!new)
return -ENOMEM;

cxt = cred_cxt(new);
ctx = cred_ctx(new);
aa_get_profile(profile);
aa_put_profile(cxt->onexec);
cxt->onexec = profile;
aa_put_profile(ctx->onexec);
ctx->onexec = profile;

commit_creds(new);
return 0;
Expand All @@ -160,28 +162,28 @@ int aa_set_current_onexec(struct aa_profile *profile)
*/
int aa_set_current_hat(struct aa_profile *profile, u64 token)
{
struct aa_task_cxt *cxt;
struct aa_task_ctx *ctx;
struct cred *new = prepare_creds();
if (!new)
return -ENOMEM;
BUG_ON(!profile);

cxt = cred_cxt(new);
if (!cxt->previous) {
ctx = cred_ctx(new);
if (!ctx->previous) {
/* transfer refcount */
cxt->previous = cxt->profile;
cxt->token = token;
} else if (cxt->token == token) {
aa_put_profile(cxt->profile);
ctx->previous = ctx->profile;
ctx->token = token;
} else if (ctx->token == token) {
aa_put_profile(ctx->profile);
} else {
/* previous_profile && cxt->token != token */
/* previous_profile && ctx->token != token */
abort_creds(new);
return -EACCES;
}
cxt->profile = aa_get_newest_profile(profile);
ctx->profile = aa_get_newest_profile(profile);
/* clear exec on switching context */
aa_put_profile(cxt->onexec);
cxt->onexec = NULL;
aa_put_profile(ctx->onexec);
ctx->onexec = NULL;

commit_creds(new);
return 0;
Expand All @@ -198,27 +200,27 @@ int aa_set_current_hat(struct aa_profile *profile, u64 token)
*/
int aa_restore_previous_profile(u64 token)
{
struct aa_task_cxt *cxt;
struct aa_task_ctx *ctx;
struct cred *new = prepare_creds();
if (!new)
return -ENOMEM;

cxt = cred_cxt(new);
if (cxt->token != token) {
ctx = cred_ctx(new);
if (ctx->token != token) {
abort_creds(new);
return -EACCES;
}
/* ignore restores when there is no saved profile */
if (!cxt->previous) {
if (!ctx->previous) {
abort_creds(new);
return 0;
}

aa_put_profile(cxt->profile);
cxt->profile = aa_get_newest_profile(cxt->previous);
BUG_ON(!cxt->profile);
aa_put_profile(ctx->profile);
ctx->profile = aa_get_newest_profile(ctx->previous);
AA_BUG(!ctx->profile);
/* clear exec && prev information when restoring to previous context */
aa_clear_task_cxt_trans(cxt);
aa_clear_task_ctx_trans(ctx);

commit_creds(new);
return 0;
Expand Down
42 changes: 21 additions & 21 deletions security/apparmor/domain.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -337,7 +337,7 @@ static struct aa_profile *x_to_profile(struct aa_profile *profile,
*/
int apparmor_bprm_set_creds(struct linux_binprm *bprm)
{
struct aa_task_cxt *cxt;
struct aa_task_ctx *ctx;
struct aa_profile *profile, *new_profile = NULL;
struct aa_ns *ns;
char *buffer = NULL;
Expand All @@ -353,10 +353,10 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
if (bprm->cred_prepared)
return 0;

cxt = cred_cxt(bprm->cred);
BUG_ON(!cxt);
ctx = cred_ctx(bprm->cred);
AA_BUG(!ctx);

profile = aa_get_newest_profile(cxt->profile);
profile = aa_get_newest_profile(ctx->profile);
/*
* get the namespace from the replacement profile as replacement
* can change the namespace
Expand All @@ -380,9 +380,9 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
*/
if (unconfined(profile)) {
/* unconfined task */
if (cxt->onexec)
if (ctx->onexec)
/* change_profile on exec already been granted */
new_profile = aa_get_profile(cxt->onexec);
new_profile = aa_get_profile(ctx->onexec);
else
new_profile = find_attach(ns, &ns->base.profiles, name);
if (!new_profile)
Expand All @@ -397,10 +397,10 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)

/* find exec permissions for name */
state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms);
if (cxt->onexec) {
if (ctx->onexec) {
struct file_perms cp;
info = "change_profile onexec";
new_profile = aa_get_newest_profile(cxt->onexec);
new_profile = aa_get_newest_profile(ctx->onexec);
if (!(perms.allow & AA_MAY_ONEXEC))
goto audit;

Expand All @@ -409,8 +409,8 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
* exec\0change_profile
*/
state = aa_dfa_null_transition(profile->file.dfa, state);
cp = change_profile_perms(profile, cxt->onexec->ns,
cxt->onexec->base.name,
cp = change_profile_perms(profile, ctx->onexec->ns,
ctx->onexec->base.name,
AA_MAY_ONEXEC, state);

if (!(cp.allow & AA_MAY_ONEXEC))
Expand Down Expand Up @@ -499,13 +499,13 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
bprm->per_clear |= PER_CLEAR_ON_SETID;

x_clear:
aa_put_profile(cxt->profile);
/* transfer new profile reference will be released when cxt is freed */
cxt->profile = new_profile;
aa_put_profile(ctx->profile);
/* transfer new profile reference will be released when ctx is freed */
ctx->profile = new_profile;
new_profile = NULL;

/* clear out all temporary/transitional state from the context */
aa_clear_task_cxt_trans(cxt);
aa_clear_task_ctx_trans(ctx);

audit:
error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC,
Expand Down Expand Up @@ -545,17 +545,17 @@ int apparmor_bprm_secureexec(struct linux_binprm *bprm)
void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
{
struct aa_profile *profile = __aa_current_profile();
struct aa_task_cxt *new_cxt = cred_cxt(bprm->cred);
struct aa_task_ctx *new_ctx = cred_ctx(bprm->cred);

/* bail out if unconfined or not changing profile */
if ((new_cxt->profile == profile) ||
(unconfined(new_cxt->profile)))
if ((new_ctx->profile == profile) ||
(unconfined(new_ctx->profile)))
return;

current->pdeath_signal = 0;

/* reset soft limits and set hard limits for the new profile */
__aa_transition_rlimits(profile, new_cxt->profile);
__aa_transition_rlimits(profile, new_ctx->profile);
}

/**
Expand Down Expand Up @@ -604,7 +604,7 @@ static char *new_compound_name(const char *n1, const char *n2)
int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
{
const struct cred *cred;
struct aa_task_cxt *cxt;
struct aa_task_ctx *ctx;
struct aa_profile *profile, *previous_profile, *hat = NULL;
char *name = NULL;
int i;
Expand All @@ -622,9 +622,9 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)

/* released below */
cred = get_current_cred();
cxt = cred_cxt(cred);
ctx = cred_ctx(cred);
profile = aa_get_newest_profile(aa_cred_profile(cred));
previous_profile = aa_get_newest_profile(cxt->previous);
previous_profile = aa_get_newest_profile(ctx->previous);

if (unconfined(profile)) {
info = "unconfined";
Expand Down
Loading

0 comments on commit 55a26eb

Please sign in to comment.