apparmor/include/policy.h

1 /* SPDX-License-Identifier: GPL-2.0-only */
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
31 #include "resource.h"
44 	 ((_profile)->mode == (_mode)))
52 #define PROFILE_IS_HAT(_profile) ((_profile)->label.flags & FLAG_HAT)
54 #define CHECK_DEBUG1(_profile) ((_profile)->label.flags & FLAG_DEBUG1)
56 #define CHECK_DEBUG2(_profile) ((_profile)->label.flags & FLAG_DEBUG2)
58 #define profile_is_stale(_profile) (label_is_stale(&(_profile)->label))
60 #define on_list_rcu(X) (!list_empty(X) && (X)->prev != LIST_POISON2)
77 /* struct aa_policydb - match engine for a policy
101  * aa_get_pdb - increment refcount on @pdb
110 		kref_get(&(pdb->count));  in aa_get_pdb()
116  * aa_put_pdb - put a pdb refcount
124 		kref_put(&pdb->count, aa_pdb_free_kref);  in aa_put_pdb()
130 	unsigned int index = ACCEPT_TABLE(policy->dfa)[state];  in aa_lookup_perms()
132 	if (!(policy->perms))  in aa_lookup_perms()
135 	return &(policy->perms[index]);  in aa_lookup_perms()
139 /* struct aa_data - generic data structure
152 /* struct aa_ruleset - data covering mediation rules
178 /* struct aa_attachment - data and rules for a profiles attachment
194 /* struct aa_profile - basic confinement data
195  * @base - base components of the profile (name, refcount, lists, lock ...)
196  * @label - label this profile is an extension of
210  * @data: hashtable for free-form policy aa_data
215  * attachments are determined by profile X transition rules.
253 #define profiles_ns(P) ((P)->ns)
254 #define name_is_shared(A, B) ((A)->hname && (A)->hname == (B)->hname)
277 #define profile_unconfined(X) ((X)->mode == APPARMOR_UNCONFINED)
280  * aa_get_newest_profile - simple wrapper fn to wrap the label version
289 	return labels_profile(aa_get_newest_label(&p->label));  in aa_get_newest_profile()
296 		return rules->policy->start[class];  in RULE_MEDIATES()
298 		return aa_dfa_match_len(rules->policy->dfa,  in RULE_MEDIATES()
299 					rules->policy->start[0], &class, 1);  in RULE_MEDIATES()
309 	return aa_dfa_match_len(rules->policy->dfa, state, (char *) &be_af, 2);  in RULE_MEDIATES_AF()
323  * aa_get_profile - increment refcount on profile @p
332 		kref_get(&(p->label.count));  in aa_get_profile()
338  * aa_get_profile_not0 - increment refcount on profile @p found via lookup
346 	if (p && kref_get_unless_zero(&p->label.count))  in aa_get_profile_not0()
353  * aa_get_profile_rcu - increment a refcount profile that can be replaced
366 	} while (c && !kref_get_unless_zero(&c->label.count));  in aa_get_profile_rcu()
373  * aa_put_profile - decrement refcount on profile @p
379 		kref_put(&p->label.count, aa_label_kref);  in aa_put_profile()
387 	return profile->audit;  in AUDIT_MODE()