linux/security/apparmor/resource.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * AppArmor security module
 *
 * This file contains AppArmor resource mediation and attachment
 *
 * Copyright (C) 1998-2008 Novell/SUSE
 * Copyright 2009-2010 Canonical Ltd.
 */

#include <linux/audit.h>
#include <linux/security.h>

#include "include/audit.h"
#include "include/cred.h"
#include "include/resource.h"
#include "include/policy.h"

/*
 * Table of rlimit names: we generate it from resource.h.
 */
#include "rlim_names.h"

struct aa_sfs_entry aa_sfs_entry_rlimit[] = …;

/* audit callback for resource specific fields */
static void audit_cb(struct audit_buffer *ab, void *va)
{ … }

/**
 * audit_resource - audit setting resource limit
 * @subj_cred: cred setting the resource
 * @profile: profile being enforced  (NOT NULL)
 * @resource: rlimit being auditing
 * @value: value being set
 * @peer: aa_albel of the task being set
 * @info: info being auditing
 * @error: error value
 *
 * Returns: 0 or ad->error else other error code on failure
 */
static int audit_resource(const struct cred *subj_cred,
			  struct aa_profile *profile, unsigned int resource,
			  unsigned long value, struct aa_label *peer,
			  const char *info, int error)
{ … }

/**
 * aa_map_resource - map compiled policy resource to internal #
 * @resource: flattened policy resource number
 *
 * Returns: resource # for the current architecture.
 *
 * rlimit resource can vary based on architecture, map the compiled policy
 * resource # to the internal representation for the architecture.
 */
int aa_map_resource(int resource)
{ … }

static int profile_setrlimit(const struct cred *subj_cred,
			     struct aa_profile *profile, unsigned int resource,
			     struct rlimit *new_rlim)
{ … }

/**
 * aa_task_setrlimit - test permission to set an rlimit
 * @subj_cred: cred setting the limit
 * @label: label confining the task  (NOT NULL)
 * @task: task the resource is being set on
 * @resource: the resource being set
 * @new_rlim: the new resource limit  (NOT NULL)
 *
 * Control raising the processes hard limit.
 *
 * Returns: 0 or error code if setting resource failed
 */
int aa_task_setrlimit(const struct cred *subj_cred, struct aa_label *label,
		      struct task_struct *task,
		      unsigned int resource, struct rlimit *new_rlim)
{ … }

/**
 * __aa_transition_rlimits - apply new profile rlimits
 * @old_l: old label on task  (NOT NULL)
 * @new_l: new label with rlimits to apply  (NOT NULL)
 */
void __aa_transition_rlimits(struct aa_label *old_l, struct aa_label *new_l)
{ … }