1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0-only */
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * AppArmor security module
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * This file contains AppArmor policy loading interface function definitions.
6*4882a593Smuzhiyun *
7*4882a593Smuzhiyun * Copyright (C) 1998-2008 Novell/SUSE
8*4882a593Smuzhiyun * Copyright 2009-2010 Canonical Ltd.
9*4882a593Smuzhiyun */
10*4882a593Smuzhiyun
11*4882a593Smuzhiyun #ifndef __POLICY_INTERFACE_H
12*4882a593Smuzhiyun #define __POLICY_INTERFACE_H
13*4882a593Smuzhiyun
14*4882a593Smuzhiyun #include <linux/list.h>
15*4882a593Smuzhiyun #include <linux/kref.h>
16*4882a593Smuzhiyun #include <linux/dcache.h>
17*4882a593Smuzhiyun #include <linux/workqueue.h>
18*4882a593Smuzhiyun
19*4882a593Smuzhiyun struct aa_load_ent {
20*4882a593Smuzhiyun struct list_head list;
21*4882a593Smuzhiyun struct aa_profile *new;
22*4882a593Smuzhiyun struct aa_profile *old;
23*4882a593Smuzhiyun struct aa_profile *rename;
24*4882a593Smuzhiyun const char *ns_name;
25*4882a593Smuzhiyun };
26*4882a593Smuzhiyun
27*4882a593Smuzhiyun void aa_load_ent_free(struct aa_load_ent *ent);
28*4882a593Smuzhiyun struct aa_load_ent *aa_load_ent_alloc(void);
29*4882a593Smuzhiyun
30*4882a593Smuzhiyun #define PACKED_FLAG_HAT 1
31*4882a593Smuzhiyun
32*4882a593Smuzhiyun #define PACKED_MODE_ENFORCE 0
33*4882a593Smuzhiyun #define PACKED_MODE_COMPLAIN 1
34*4882a593Smuzhiyun #define PACKED_MODE_KILL 2
35*4882a593Smuzhiyun #define PACKED_MODE_UNCONFINED 3
36*4882a593Smuzhiyun
37*4882a593Smuzhiyun struct aa_ns;
38*4882a593Smuzhiyun
39*4882a593Smuzhiyun enum {
40*4882a593Smuzhiyun AAFS_LOADDATA_ABI = 0,
41*4882a593Smuzhiyun AAFS_LOADDATA_REVISION,
42*4882a593Smuzhiyun AAFS_LOADDATA_HASH,
43*4882a593Smuzhiyun AAFS_LOADDATA_DATA,
44*4882a593Smuzhiyun AAFS_LOADDATA_COMPRESSED_SIZE,
45*4882a593Smuzhiyun AAFS_LOADDATA_DIR, /* must be last actual entry */
46*4882a593Smuzhiyun AAFS_LOADDATA_NDENTS /* count of entries */
47*4882a593Smuzhiyun };
48*4882a593Smuzhiyun
49*4882a593Smuzhiyun /*
50*4882a593Smuzhiyun * struct aa_loaddata - buffer of policy raw_data set
51*4882a593Smuzhiyun *
52*4882a593Smuzhiyun * there is no loaddata ref for being on ns list, nor a ref from
53*4882a593Smuzhiyun * d_inode(@dentry) when grab a ref from these, @ns->lock must be held
54*4882a593Smuzhiyun * && __aa_get_loaddata() needs to be used, and the return value
55*4882a593Smuzhiyun * checked, if NULL the loaddata is already being reaped and should be
56*4882a593Smuzhiyun * considered dead.
57*4882a593Smuzhiyun */
58*4882a593Smuzhiyun struct aa_loaddata {
59*4882a593Smuzhiyun struct kref count;
60*4882a593Smuzhiyun struct list_head list;
61*4882a593Smuzhiyun struct work_struct work;
62*4882a593Smuzhiyun struct dentry *dents[AAFS_LOADDATA_NDENTS];
63*4882a593Smuzhiyun struct aa_ns *ns;
64*4882a593Smuzhiyun char *name;
65*4882a593Smuzhiyun size_t size; /* the original size of the payload */
66*4882a593Smuzhiyun size_t compressed_size; /* the compressed size of the payload */
67*4882a593Smuzhiyun long revision; /* the ns policy revision this caused */
68*4882a593Smuzhiyun int abi;
69*4882a593Smuzhiyun unsigned char *hash;
70*4882a593Smuzhiyun
71*4882a593Smuzhiyun /* Pointer to payload. If @compressed_size > 0, then this is the
72*4882a593Smuzhiyun * compressed version of the payload, else it is the uncompressed
73*4882a593Smuzhiyun * version (with the size indicated by @size).
74*4882a593Smuzhiyun */
75*4882a593Smuzhiyun char *data;
76*4882a593Smuzhiyun };
77*4882a593Smuzhiyun
78*4882a593Smuzhiyun int aa_unpack(struct aa_loaddata *udata, struct list_head *lh, const char **ns);
79*4882a593Smuzhiyun
80*4882a593Smuzhiyun /**
81*4882a593Smuzhiyun * __aa_get_loaddata - get a reference count to uncounted data reference
82*4882a593Smuzhiyun * @data: reference to get a count on
83*4882a593Smuzhiyun *
84*4882a593Smuzhiyun * Returns: pointer to reference OR NULL if race is lost and reference is
85*4882a593Smuzhiyun * being repeated.
86*4882a593Smuzhiyun * Requires: @data->ns->lock held, and the return code MUST be checked
87*4882a593Smuzhiyun *
88*4882a593Smuzhiyun * Use only from inode->i_private and @data->list found references
89*4882a593Smuzhiyun */
90*4882a593Smuzhiyun static inline struct aa_loaddata *
__aa_get_loaddata(struct aa_loaddata * data)91*4882a593Smuzhiyun __aa_get_loaddata(struct aa_loaddata *data)
92*4882a593Smuzhiyun {
93*4882a593Smuzhiyun if (data && kref_get_unless_zero(&(data->count)))
94*4882a593Smuzhiyun return data;
95*4882a593Smuzhiyun
96*4882a593Smuzhiyun return NULL;
97*4882a593Smuzhiyun }
98*4882a593Smuzhiyun
99*4882a593Smuzhiyun /**
100*4882a593Smuzhiyun * aa_get_loaddata - get a reference count from a counted data reference
101*4882a593Smuzhiyun * @data: reference to get a count on
102*4882a593Smuzhiyun *
103*4882a593Smuzhiyun * Returns: point to reference
104*4882a593Smuzhiyun * Requires: @data to have a valid reference count on it. It is a bug
105*4882a593Smuzhiyun * if the race to reap can be encountered when it is used.
106*4882a593Smuzhiyun */
107*4882a593Smuzhiyun static inline struct aa_loaddata *
aa_get_loaddata(struct aa_loaddata * data)108*4882a593Smuzhiyun aa_get_loaddata(struct aa_loaddata *data)
109*4882a593Smuzhiyun {
110*4882a593Smuzhiyun struct aa_loaddata *tmp = __aa_get_loaddata(data);
111*4882a593Smuzhiyun
112*4882a593Smuzhiyun AA_BUG(data && !tmp);
113*4882a593Smuzhiyun
114*4882a593Smuzhiyun return tmp;
115*4882a593Smuzhiyun }
116*4882a593Smuzhiyun
117*4882a593Smuzhiyun void __aa_loaddata_update(struct aa_loaddata *data, long revision);
118*4882a593Smuzhiyun bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r);
119*4882a593Smuzhiyun void aa_loaddata_kref(struct kref *kref);
120*4882a593Smuzhiyun struct aa_loaddata *aa_loaddata_alloc(size_t size);
aa_put_loaddata(struct aa_loaddata * data)121*4882a593Smuzhiyun static inline void aa_put_loaddata(struct aa_loaddata *data)
122*4882a593Smuzhiyun {
123*4882a593Smuzhiyun if (data)
124*4882a593Smuzhiyun kref_put(&data->count, aa_loaddata_kref);
125*4882a593Smuzhiyun }
126*4882a593Smuzhiyun
127*4882a593Smuzhiyun #endif /* __POLICY_INTERFACE_H */
128