]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - security/apparmor/label.c
2 * AppArmor security module
4 * This file contains AppArmor label definitions
6 * Copyright 2013 Canonical Ltd.
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
14 #include <linux/audit.h>
15 #include <linux/seq_file.h>
16 #include <linux/sort.h>
18 #include "include/apparmor.h"
19 #include "include/context.h"
20 #include "include/label.h"
21 #include "include/policy.h"
22 #include "include/sid.h"
26 * the aa_label represents the set of profiles confining an object
28 * Labels maintain a reference count to the set of pointers they reference
29 * Labels are ref counted by
30 * tasks and object via the security field/security context off the field
31 * code - will take a ref count on a label if it needs the label
32 * beyond what is possible with an rcu_read_lock.
33 * profiles - each profile is a label
34 * sids - a pinned sid will keep a refcount of the label it is
36 * objects - inode, files, sockets, ...
38 * Labels are not ref counted by the label set, so they maybe removed and
39 * freed when no longer in use.
43 #define PROXY_POISON 97
44 #define LABEL_POISON 100
46 static void free_proxy(struct aa_proxy
*proxy
)
49 /* p->label will not updated any more as p is dead */
50 aa_put_label(rcu_dereference_protected(proxy
->label
, true));
51 memset(proxy
, 0, sizeof(*proxy
));
52 proxy
->label
= (struct aa_label
*) PROXY_POISON
;
57 void aa_proxy_kref(struct kref
*kref
)
59 struct aa_proxy
*proxy
= container_of(kref
, struct aa_proxy
, count
);
63 struct aa_proxy
*aa_alloc_proxy(struct aa_label
*label
, gfp_t gfp
)
67 new = kzalloc(sizeof(struct aa_proxy
), gfp
);
69 kref_init(&new->count
);
70 rcu_assign_pointer(new->label
, aa_get_label(label
));
75 /* requires profile list write lock held */
76 void __aa_proxy_redirect(struct aa_label
*orig
, struct aa_label
*new)
82 AA_BUG(!write_is_locked(&labels_set(orig
)->lock
));
84 tmp
= rcu_dereference_protected(orig
->proxy
->label
,
85 &labels_ns(orig
)->lock
);
86 rcu_assign_pointer(orig
->proxy
->label
, aa_get_label(new));
87 orig
->flags
|= FLAG_STALE
;
91 static void __proxy_share(struct aa_label
*old
, struct aa_label
*new)
93 struct aa_proxy
*proxy
= new->proxy
;
94 new->proxy
= aa_get_proxy(old
->proxy
);
95 __aa_proxy_redirect(old
, new);
101 * ns_cmp - compare ns for label set ordering
102 * @a: ns to compare (NOT NULL)
103 * @b: ns to compare (NOT NULL)
105 * Returns: <0 if a < b
109 static int ns_cmp(struct aa_ns
*a
, struct aa_ns
*b
)
115 AA_BUG(!a
->base
.hname
);
116 AA_BUG(!b
->base
.hname
);
121 res
= a
->level
- b
->level
;
125 return strcmp(a
->base
.hname
, b
->base
.hname
);
129 * profile_cmp - profile comparision for set ordering
130 * @a: profile to compare (NOT NULL)
131 * @b: profile to compare (NOT NULL)
133 * Returns: <0 if a < b
137 static int profile_cmp(struct aa_profile
*a
, struct aa_profile
*b
)
145 AA_BUG(!a
->base
.hname
);
146 AA_BUG(!b
->base
.hname
);
148 if (a
== b
|| a
->base
.hname
== b
->base
.hname
)
150 res
= ns_cmp(a
->ns
, b
->ns
);
154 return strcmp(a
->base
.hname
, b
->base
.hname
);
158 * vec_cmp - label comparision for set ordering
159 * @a: label to compare (NOT NULL)
160 * @vec: vector of profiles to compare (NOT NULL)
163 * Returns: <0 if a < vec
167 static int vec_cmp(struct aa_profile
**a
, int an
, struct aa_profile
**b
, int bn
)
178 for (i
= 0; i
< an
&& i
< bn
; i
++) {
179 int res
= profile_cmp(a
[i
], b
[i
]);
187 static bool vec_is_stale(struct aa_profile
**vec
, int n
)
193 for (i
= 0; i
< n
; i
++) {
194 if (profile_is_stale(vec
[i
]))
201 static bool vec_unconfined(struct aa_profile
**vec
, int n
)
207 for (i
= 0; i
< n
; i
++) {
208 if (!profile_unconfined(vec
[i
]))
215 static int sort_cmp(const void *a
, const void *b
)
217 return profile_cmp(*(struct aa_profile
**)a
, *(struct aa_profile
**)b
);
220 /* assumes vec is sorted
221 * Assumes @vec has null terminator at vec[n], and will null terminate
224 static inline int unique(struct aa_profile
**vec
, int n
)
226 int i
, pos
, dups
= 0;
232 for (i
= 1; i
< n
; i
++) {
233 int res
= profile_cmp(vec
[pos
], vec
[i
]);
234 AA_BUG(res
> 0, "vec not sorted");
237 aa_put_profile(vec
[i
]);
252 * vec_unique - canonical sort and unique a list of profiles
253 * @n: number of refcounted profiles in the list (@n > 0)
254 * @vec: list of profiles to sort and merge
256 * Returns: the number of duplicates eliminated == references put
258 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
259 * null terminate vec[n - dups]
261 int aa_vec_unique(struct aa_profile
**vec
, int n
, int flags
)
268 /* vecs are usually small and inorder, have a fallback for larger */
270 sort(vec
, n
, sizeof(struct aa_profile
*), sort_cmp
, NULL
);
271 dups
= unique(vec
, n
);
275 /* insertion sort + unique in one */
276 for (i
= 1; i
< n
; i
++) {
277 struct aa_profile
*tmp
= vec
[i
];
280 for (pos
= i
- 1 - dups
; pos
>= 0; pos
--) {
281 int res
= profile_cmp(vec
[pos
], tmp
);
283 /* drop duplicate entry */
290 /* pos is at entry < tmp, or index -1. Set to insert pos */
293 for (j
= i
- dups
; j
> pos
; j
--)
302 if (flags
& VEC_FLAG_TERMINATE
)
303 vec
[n
- dups
] = NULL
;
309 static void label_destroy(struct aa_label
*label
)
311 struct aa_label
*tmp
;
315 if (label_is_stale(label
))
316 labelsetstats_dec(labels_set(label
), stale
);
318 if (!label_isprofile(label
)) {
319 struct aa_profile
*profile
;
322 aa_put_str(label
->hname
);
324 label_for_each(i
, label
, profile
) {
325 aa_put_profile(profile
);
326 label
->vec
[i
.i
] = (struct aa_profile
*) (LABEL_POISON
+ (long) i
.i
);
330 if (rcu_dereference_protected(label
->proxy
->label
, true) == label
)
331 rcu_assign_pointer(label
->proxy
->label
, NULL
);
333 aa_free_sid(label
->sid
);
335 tmp
= rcu_dereference_protected(label
->proxy
->label
, true);
337 rcu_assign_pointer(label
->proxy
->label
, NULL
);
339 aa_put_proxy(label
->proxy
);
340 label
->proxy
= (struct aa_proxy
*) PROXY_POISON
+ 1;
343 void aa_label_free(struct aa_label
*label
)
348 label_destroy(label
);
349 labelstats_inc(freed
);
353 static void label_free_switch(struct aa_label
*label
)
355 if (label
->flags
& FLAG_NS_COUNT
)
356 aa_free_ns(labels_ns(label
));
357 else if (label_isprofile(label
))
358 aa_free_profile(labels_profile(label
));
360 aa_label_free(label
);
363 static void label_free_rcu(struct rcu_head
*head
)
365 struct aa_label
*label
= container_of(head
, struct aa_label
, rcu
);
367 if (label
->flags
& FLAG_IN_TREE
)
368 (void) aa_label_remove(label
);
369 label_free_switch(label
);
372 void aa_label_kref(struct kref
*kref
)
374 struct aa_label
*label
= container_of(kref
, struct aa_label
, count
);
375 struct aa_ns
*ns
= labels_ns(label
);
378 /* never live, no rcu callback needed, just using the fn */
379 label_free_switch(label
);
382 /* TODO: update labels_profile macro so it works here */
383 AA_BUG(label_isprofile(label
) && on_list_rcu(&label
->vec
[0]->base
.profiles
));
384 AA_BUG(label_isprofile(label
) && on_list_rcu(&label
->vec
[0]->base
.list
));
386 /* TODO: if compound label and not stale add to reclaim cache */
387 call_rcu(&label
->rcu
, label_free_rcu
);
390 static void label_free_or_put_new(struct aa_label
*label
, struct aa_label
*new)
393 /* need to free directly to break circular ref with proxy */
399 bool aa_label_init(struct aa_label
*label
, int size
)
404 label
->sid
= aa_alloc_sid();
405 if (label
->sid
== AA_SID_INVALID
)
408 label
->size
= size
; /* doesn't include null */
409 label
->vec
[size
] = NULL
; /* null terminate */
410 kref_init(&label
->count
);
411 RB_CLEAR_NODE(&label
->node
);
417 * aa_label_alloc - allocate a label with a profile vector of @size length
418 * @size: size of profile vector in the label
419 * @proxy: proxy to use OR null if to allocate a new one
420 * @gfp: memory allocation type
423 * else NULL if failed
425 struct aa_label
*aa_label_alloc(int size
, struct aa_proxy
*proxy
, gfp_t gfp
)
427 struct aa_label
*new;
431 /* + 1 for null terminator entry on vec */
432 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile
*) * (size
+ 1),
434 AA_DEBUG("%s (%p)\n", __func__
, new);
438 if (!aa_label_init(new, size
))
442 proxy
= aa_alloc_proxy(new, gfp
);
447 /* just set new's proxy, don't redirect proxy here if it was passed in*/
450 labelstats_inc(allocated
);
456 labelstats_inc(failed
);
463 * label_cmp - label comparision for set ordering
464 * @a: label to compare (NOT NULL)
465 * @b: label to compare (NOT NULL)
467 * Returns: <0 if a < b
471 static int label_cmp(struct aa_label
*a
, struct aa_label
*b
)
478 return vec_cmp(a
->vec
, a
->size
, b
->vec
, b
->size
);
481 /* helper fn for label_for_each_confined */
482 int aa_label_next_confined(struct aa_label
*label
, int i
)
487 for (; i
< label
->size
; i
++) {
488 if (!profile_unconfined(label
->vec
[i
]))
496 * aa_label_next_not_in_set - return the next profile of @sub not in @set
498 * @set: label to test against
499 * @sub: label to if is subset of @set
501 * Returns: profile in @sub that is not in @set, with iterator set pos after
502 * else NULL if @sub is a subset of @set
504 struct aa_profile
*__aa_label_next_not_in_set(struct label_it
*I
,
505 struct aa_label
*set
,
506 struct aa_label
*sub
)
511 AA_BUG(I
->i
> set
->size
);
514 AA_BUG(I
->j
> sub
->size
);
516 while (I
->j
< sub
->size
&& I
->i
< set
->size
) {
517 int res
= profile_cmp(sub
->vec
[I
->j
], set
->vec
[I
->i
]);
524 return sub
->vec
[(I
->j
)++];
527 if (I
->j
< sub
->size
)
528 return sub
->vec
[(I
->j
)++];
534 * aa_label_is_subset - test if @sub is a subset of @set
535 * @set: label to test against
536 * @sub: label to test if is subset of @set
538 * Returns: true if @sub is subset of @set
541 bool aa_label_is_subset(struct aa_label
*set
, struct aa_label
*sub
)
543 struct label_it i
= { };
551 return __aa_label_next_not_in_set(&i
, set
, sub
) == NULL
;
557 * __label_remove - remove @label from the label set
558 * @l: label to remove
559 * @new: label to redirect to
561 * Requires: labels_set(@label)->lock write_lock
562 * Returns: true if the label was in the tree and removed
564 static bool __label_remove(struct aa_label
*label
, struct aa_label
*new)
566 struct aa_labelset
*ls
= labels_set(label
);
569 AA_BUG(!write_is_locked(&ls
->lock
));
572 __aa_proxy_redirect(label
, new);
574 if (label_is_stale(label
))
575 labelstats_dec(stale_intree
);
577 __label_make_stale(label
);
579 if (label
->flags
& FLAG_IN_TREE
) {
580 labelsetstats_dec(ls
, intree
);
581 rb_erase(&label
->node
, &ls
->root
);
582 label
->flags
&= ~FLAG_IN_TREE
;
590 * __label_replace - replace @old with @new in label set
591 * @old: label to remove from label set
592 * @new: label to replace @old with
594 * Requires: labels_set(@old)->lock write_lock
595 * valid ref count be held on @new
596 * Returns: true if @old was in set and replaced by @new
598 * Note: current implementation requires label set be order in such a way
599 * that @new directly replaces @old position in the set (ie.
600 * using pointer comparison of the label address would not work)
602 static bool __label_replace(struct aa_label
*old
, struct aa_label
*new)
604 struct aa_labelset
*ls
= labels_set(old
);
608 AA_BUG(!write_is_locked(&ls
->lock
));
609 AA_BUG(new->flags
& FLAG_IN_TREE
);
611 if (label_is_stale(old
))
612 labelstats_dec(stale_intree
);
614 __label_make_stale(old
);
616 if (old
->flags
& FLAG_IN_TREE
) {
617 rb_replace_node(&old
->node
, &new->node
, &ls
->root
);
618 old
->flags
&= ~FLAG_IN_TREE
;
619 new->flags
|= FLAG_IN_TREE
;
627 * __label_insert - attempt to insert @l into a label set
628 * @ls: set of labels to insert @l into (NOT NULL)
629 * @label: new label to insert (NOT NULL)
630 * @replace: whether insertion should replace existing entry that is not stale
632 * Requires: @ls->lock
633 * caller to hold a valid ref on l
634 * if @replace is true l has a preallocated proxy associated
635 * Returns: @l if successful in inserting @l - with additional refcount
636 * else ref counted equivalent label that is already in the set,
637 the else condition only happens if @replace is false
639 static struct aa_label
*__label_insert(struct aa_labelset
*ls
,
640 struct aa_label
*label
, bool replace
)
642 struct rb_node
**new, *parent
= NULL
;
646 AA_BUG(labels_set(label
) != ls
);
647 AA_BUG(!write_is_locked(&ls
->lock
));
648 AA_BUG(label
->flags
& FLAG_IN_TREE
);
650 /* Figure out where to put new node */
651 new = &ls
->root
.rb_node
;
653 struct aa_label
*this = rb_entry(*new, struct aa_label
, node
);
654 int result
= label_cmp(label
, this);
658 labelsetstats_inc(ls
, existing
);
659 /* !aa_get_label_not0 means queued for destruction,
660 * so replace in place, however the label has
661 * died before the replacement so do not share
664 if (!replace
&& !label_is_stale(this)) {
665 if (aa_get_label_not0(this))
668 __proxy_share(this, label
);
669 AA_BUG(!__label_replace(this, label
));
670 return aa_get_label(label
);
671 } else if (result
< 0)
672 new = &((*new)->rb_left
);
673 else /* (result > 0) */
674 new = &((*new)->rb_right
);
677 /* Add new node and rebalance tree. */
678 rb_link_node(&label
->node
, parent
, new);
679 rb_insert_color(&label
->node
, &ls
->root
);
680 label
->flags
|= FLAG_IN_TREE
;
681 labelsetstats_inc(ls
, insert
);
682 labelsetstats_inc(ls
, intree
);
684 return aa_get_label(label
);
688 * __vec_find - find label that matches @vec in label set
689 * @vec: vec of profiles to find matching label for (NOT NULL)
692 * Requires: @vec_labelset(vec) lock held
693 * caller to hold a valid ref on l
695 * Returns: ref counted @label if matching label is in tree
696 * ref counted label that is equiv to @l in tree
697 * else NULL if @vec equiv is not in tree
699 static struct aa_label
*__vec_find(struct aa_profile
**vec
, int n
)
701 struct rb_node
*node
;
707 node
= vec_labelset(vec
, n
)->root
.rb_node
;
709 struct aa_label
*this = rb_entry(node
, struct aa_label
, node
);
710 int result
= vec_cmp(this->vec
, this->size
, vec
, n
);
713 node
= node
->rb_left
;
715 node
= node
->rb_right
;
717 return aa_get_label_not0(this);
724 * __label_find - find label @label in label set
725 * @label: label to find (NOT NULL)
727 * Requires: labels_set(@label)->lock held
728 * caller to hold a valid ref on l
730 * Returns: ref counted @label if @label is in tree OR
731 * ref counted label that is equiv to @label in tree
732 * else NULL if @label or equiv is not in tree
734 static struct aa_label
*__label_find(struct aa_label
*label
)
738 return __vec_find(label
->vec
, label
->size
);
743 * aa_label_remove - remove a label from the labelset
744 * @label: label to remove
746 * Returns: true if @label was removed from the tree
747 * else @label was not in tree so it could not be removed
749 bool aa_label_remove(struct aa_label
*label
)
751 struct aa_labelset
*ls
= labels_set(label
);
757 write_lock_irqsave(&ls
->lock
, flags
);
758 res
= __label_remove(label
, ns_unconfined(labels_ns(label
)));
759 write_unlock_irqrestore(&ls
->lock
, flags
);
765 * aa_label_replace - replace a label @old with a new version @new
766 * @old: label to replace
767 * @new: label replacing @old
769 * Returns: true if @old was in tree and replaced
770 * else @old was not in tree, and @new was not inserted
772 bool aa_label_replace(struct aa_label
*old
, struct aa_label
*new)
777 if (name_is_shared(old
, new) && labels_ns(old
) == labels_ns(new)) {
778 write_lock_irqsave(&labels_set(old
)->lock
, flags
);
779 if (old
->proxy
!= new->proxy
) {
780 __proxy_share(old
, new);
782 __aa_proxy_redirect(old
, new);
783 res
= __label_replace(old
, new);
784 write_unlock_irqrestore(&labels_set(old
)->lock
, flags
);
787 struct aa_labelset
*ls
= labels_set(old
);
788 write_lock_irqsave(&ls
->lock
, flags
);
789 res
= __label_remove(old
, new);
790 if (labels_ns(old
) != labels_ns(new)) {
791 write_unlock_irqrestore(&ls
->lock
, flags
);
792 ls
= labels_set(new);
793 write_lock_irqsave(&ls
->lock
, flags
);
795 l
= __label_insert(ls
, new, true);
797 write_unlock_irqrestore(&ls
->lock
, flags
);
805 * vec_find - find label @l in label set
806 * @vec: array of profiles to find equiv label for (NOT NULL)
809 * Returns: refcounted label if @vec equiv is in tree
810 * else NULL if @vec equiv is not in tree
812 static struct aa_label
*vec_find(struct aa_profile
**vec
, int n
)
814 struct aa_labelset
*ls
;
815 struct aa_label
*label
;
822 ls
= vec_labelset(vec
, n
);
823 read_lock_irqsave(&ls
->lock
, flags
);
824 label
= __vec_find(vec
, n
);
825 labelstats_inc(sread
);
826 read_unlock_irqrestore(&ls
->lock
, flags
);
831 /* requires sort and merge done first */
832 static struct aa_label
*vec_create_and_insert_label(struct aa_profile
**vec
,
835 struct aa_label
*label
= NULL
;
836 struct aa_labelset
*ls
;
838 struct aa_label
*new;
844 return aa_get_label(&vec
[0]->label
);
846 ls
= labels_set(&vec
[len
- 1]->label
);
848 /* TODO: enable when read side is lockless
849 * check if label exists before taking locks
851 new = aa_label_alloc(len
, NULL
, gfp
);
855 for (i
= 0; i
< len
; i
++) {
856 new->vec
[i
] = aa_get_profile(vec
[i
]);
858 write_lock_irqsave(&ls
->lock
, flags
);
859 label
= __label_insert(ls
, new, false);
860 write_unlock_irqrestore(&ls
->lock
, flags
);
861 label_free_or_put_new(label
, new);
866 struct aa_label
*aa_vec_find_or_create_label(struct aa_profile
**vec
, int len
,
869 struct aa_label
*label
= vec_find(vec
, len
);
873 return vec_create_and_insert_label(vec
, len
, gfp
);
877 * aa_label_find - find label @label in label set
878 * @label: label to find (NOT NULL)
880 * Requires: caller to hold a valid ref on l
882 * Returns: refcounted @label if @label is in tree
883 * refcounted label that is equiv to @label in tree
884 * else NULL if @label or equiv is not in tree
886 struct aa_label
*aa_label_find(struct aa_label
*label
)
890 return vec_find(label
->vec
, label
->size
);
895 * aa_label_insert - insert label @label into @ls or return existing label
896 * @ls - labelset to insert @label into
897 * @label - label to insert
899 * Requires: caller to hold a valid ref on @label
901 * Returns: ref counted @label if successful in inserting @label
902 * else ref counted equivalent label that is already in the set
904 struct aa_label
*aa_label_insert(struct aa_labelset
*ls
, struct aa_label
*label
)
912 /* check if label exists before taking lock */
913 if (!label_is_stale(label
)) {
914 read_lock_irqsave(&ls
->lock
, flags
);
915 l
= __label_find(label
);
916 read_unlock_irqrestore(&ls
->lock
, flags
);
917 labelstats_inc(fread
);
922 write_lock_irqsave(&ls
->lock
, flags
);
923 l
= __label_insert(ls
, label
, false);
924 write_unlock_irqrestore(&ls
->lock
, flags
);
931 * aa_label_next_in_merge - find the next profile when merging @a and @b
936 * Returns: next profile
937 * else null if no more profiles
939 struct aa_profile
*aa_label_next_in_merge(struct label_it
*I
,
947 AA_BUG(I
->i
> a
->size
);
949 AA_BUG(I
->j
> b
->size
);
951 if (I
->i
< a
->size
) {
952 if (I
->j
< b
->size
) {
953 int res
= profile_cmp(a
->vec
[I
->i
], b
->vec
[I
->j
]);
955 return b
->vec
[(I
->j
)++];
960 return a
->vec
[(I
->i
)++];
964 return b
->vec
[(I
->j
)++];
970 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
971 * @a: label to merge then compare (NOT NULL)
972 * @b: label to merge then compare (NOT NULL)
973 * @z: label to compare merge against (NOT NULL)
975 * Assumes: using the most recent versions of @a, @b, and @z
977 * Returns: <0 if a < b
981 static int label_merge_cmp(struct aa_label
*a
, struct aa_label
*b
,
984 struct aa_profile
*p
= NULL
;
985 struct label_it i
= { };
993 k
< z
->size
&& (p
= aa_label_next_in_merge(&i
, a
, b
));
995 int res
= profile_cmp(p
, z
->vec
[k
]);
1003 else if (k
< z
->size
)
1010 * label_merge_len - find the length of the merge of @a and @b
1011 * @a: label to merge (NOT NULL)
1012 * @b: label to merge (NOT NULL)
1014 * Assumes: using newest versions of labels @a and @b
1016 * Returns: length of a label vector for merge of @a and @b
1018 static int label_merge_len(struct aa_label
*a
, struct aa_label
*b
)
1020 int len
= a
->size
+ b
->size
;
1026 /* find entries in common and remove from count */
1027 for (i
= j
= 0; i
< a
->size
&& j
< b
->size
; ) {
1028 int res
= profile_cmp(a
->vec
[i
], b
->vec
[j
]);
1044 * label_merge_insert - create a new label by merging @a and @b
1045 * @new: preallocated label to merge into (NOT NULL)
1046 * @a: label to merge with @b (NOT NULL)
1047 * @b: label to merge with @a (NOT NULL)
1049 * Requires: preallocated proxy
1051 * Returns: ref counted label either @new if merge is unique
1052 * @a if @b is a subset of @a
1053 * @b if @a is a subset of @b
1055 * NOTE: will not use @new if the merge results in @new == @a or @b
1057 * Must be used within labelset write lock to avoid racing with
1058 * setting labels stale.
1060 static struct aa_label
*label_merge_insert(struct aa_label
*new,
1064 struct aa_label
*label
;
1065 struct aa_labelset
*ls
;
1066 struct aa_profile
*next
;
1068 unsigned long flags
;
1069 int k
= 0, invcount
= 0;
1073 AA_BUG(a
->size
< 0);
1075 AA_BUG(b
->size
< 0);
1077 AA_BUG(new->size
< a
->size
+ b
->size
);
1079 label_for_each_in_merge(i
, a
, b
, next
) {
1081 if (profile_is_stale(next
)) {
1082 new->vec
[k
] = aa_get_newest_profile(next
);
1083 AA_BUG(!new->vec
[k
]->label
.proxy
);
1084 AA_BUG(!new->vec
[k
]->label
.proxy
->label
);
1085 if (next
->label
.proxy
!= new->vec
[k
]->label
.proxy
)
1090 new->vec
[k
++] = aa_get_profile(next
);
1092 /* set to actual size which is <= allocated len */
1097 new->size
-= aa_vec_unique(&new->vec
[0], new->size
,
1098 VEC_FLAG_TERMINATE
);
1099 /* TODO: deal with reference labels */
1100 if (new->size
== 1) {
1101 label
= aa_get_label(&new->vec
[0]->label
);
1104 } else if (!stale
) {
1105 /* merge could be same as a || b, note: it is not possible
1106 * for new->size == a->size == b->size unless a == b */
1108 return aa_get_label(a
);
1109 else if (k
== b
->size
)
1110 return aa_get_label(b
);
1112 if (vec_unconfined(new->vec
, new->size
))
1113 new->flags
|= FLAG_UNCONFINED
;
1114 ls
= labels_set(new);
1115 write_lock_irqsave(&ls
->lock
, flags
);
1116 label
= __label_insert(labels_set(new), new, false);
1117 write_unlock_irqrestore(&ls
->lock
, flags
);
1123 * labelset_of_merge - find into which labelset a merged label should be inserted
1124 * @a: label to merge and insert
1125 * @b: label to merge and insert
1127 * Returns: labelset that the merged label should be inserted into
1129 static struct aa_labelset
*labelset_of_merge(struct aa_label
*a
, struct aa_label
*b
)
1131 struct aa_ns
*nsa
= labels_ns(a
);
1132 struct aa_ns
*nsb
= labels_ns(b
);
1134 if (ns_cmp(nsa
, nsb
) <= 0)
1135 return &nsa
->labels
;
1136 return &nsb
->labels
;
1140 * __label_find_merge - find label that is equiv to merge of @a and @b
1141 * @ls: set of labels to search (NOT NULL)
1142 * @a: label to merge with @b (NOT NULL)
1143 * @b: label to merge with @a (NOT NULL)
1145 * Requires: ls->lock read_lock held
1147 * Returns: ref counted label that is equiv to merge of @a and @b
1148 * else NULL if merge of @a and @b is not in set
1150 static struct aa_label
*__label_find_merge(struct aa_labelset
*ls
,
1154 struct rb_node
*node
;
1161 return __label_find(a
);
1163 node
= ls
->root
.rb_node
;
1165 struct aa_label
*this = container_of(node
, struct aa_label
,
1167 int result
= label_merge_cmp(a
, b
, this);
1170 node
= node
->rb_left
;
1171 else if (result
> 0)
1172 node
= node
->rb_right
;
1174 return aa_get_label_not0(this);
1182 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1183 * @a: label to merge with @b (NOT NULL)
1184 * @b: label to merge with @a (NOT NULL)
1186 * Requires: labels be fully constructed with a valid ns
1188 * Returns: ref counted label that is equiv to merge of @a and @b
1189 * else NULL if merge of @a and @b is not in set
1191 struct aa_label
*aa_label_find_merge(struct aa_label
*a
, struct aa_label
*b
)
1193 struct aa_labelset
*ls
;
1194 struct aa_label
*label
, *ar
= NULL
, *br
= NULL
;
1195 unsigned long flags
;
1200 if (label_is_stale(a
))
1201 a
= ar
= aa_get_newest_label(a
);
1202 if (label_is_stale(b
))
1203 b
= br
= aa_get_newest_label(b
);
1204 ls
= labelset_of_merge(a
, b
);
1205 read_lock_irqsave(&ls
->lock
, flags
);
1206 label
= __label_find_merge(ls
, a
, b
);
1207 read_unlock_irqrestore(&ls
->lock
, flags
);
1210 labelsetstats_inc(ls
, msread
);
1216 * aa_label_merge - attempt to insert new merged label of @a and @b
1217 * @ls: set of labels to insert label into (NOT NULL)
1218 * @a: label to merge with @b (NOT NULL)
1219 * @b: label to merge with @a (NOT NULL)
1220 * @gfp: memory allocation type
1222 * Requires: caller to hold valid refs on @a and @b
1223 * labels be fully constructed with a valid ns
1225 * Returns: ref counted new label if successful in inserting merge of a & b
1226 * else ref counted equivalent label that is already in the set.
1227 * else NULL if could not create label (-ENOMEM)
1229 struct aa_label
*aa_label_merge(struct aa_label
*a
, struct aa_label
*b
,
1232 struct aa_label
*label
= NULL
;
1238 return aa_get_newest_label(a
);
1240 /* TODO: enable when read side is lockless
1241 * check if label exists before taking locks
1242 if (!label_is_stale(a) && !label_is_stale(b))
1243 label = aa_label_find_merge(a, b);
1247 struct aa_label
*new;
1249 a
= aa_get_newest_label(a
);
1250 b
= aa_get_newest_label(b
);
1252 /* could use label_merge_len(a, b), but requires double
1253 * comparison for small savings
1255 new = aa_label_alloc(a
->size
+ b
->size
, NULL
, gfp
);
1259 label
= label_merge_insert(new, a
, b
);
1260 label_free_or_put_new(label
, new);
1269 static inline bool label_is_visible(struct aa_profile
*profile
,
1270 struct aa_label
*label
)
1272 return aa_ns_visible(profile
->ns
, labels_ns(label
), true);
1275 /* match a profile and its associated ns component if needed
1276 * Assumes visibility test has already been done.
1277 * If a subns profile is not to be matched should be prescreened with
1280 static inline unsigned int match_component(struct aa_profile
*profile
,
1281 struct aa_profile
*tp
,
1284 const char *ns_name
;
1286 if (profile
->ns
== tp
->ns
)
1287 return aa_dfa_match(profile
->policy
.dfa
, state
, tp
->base
.hname
);
1289 /* try matching with namespace name and then profile */
1290 ns_name
= aa_ns_name(profile
->ns
, tp
->ns
, true);
1291 state
= aa_dfa_match_len(profile
->policy
.dfa
, state
, ":", 1);
1292 state
= aa_dfa_match(profile
->policy
.dfa
, state
, ns_name
);
1293 state
= aa_dfa_match_len(profile
->policy
.dfa
, state
, ":", 1);
1294 return aa_dfa_match(profile
->policy
.dfa
, state
, tp
->base
.hname
);
1298 * label_component_match - find perms for full compound label
1299 * @profile: profile to find perms for
1300 * @label: label to check access permissions for
1301 * @start: state to start match in
1302 * @subns: whether to do permission checks on components in a subns
1303 * @request: permissions to request
1304 * @perms: perms struct to set
1306 * Returns: 0 on success else ERROR
1308 * For the label A//&B//&C this does the perm match for A//&B//&C
1309 * @perms should be preinitialized with allperms OR a previous permission
1310 * check to be stacked.
1312 static int label_compound_match(struct aa_profile
*profile
,
1313 struct aa_label
*label
,
1314 unsigned int state
, bool subns
, u32 request
,
1315 struct aa_perms
*perms
)
1317 struct aa_profile
*tp
;
1320 /* find first subcomponent that is visible */
1321 label_for_each(i
, label
, tp
) {
1322 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1324 state
= match_component(profile
, tp
, state
);
1330 /* no component visible */
1335 label_for_each_cont(i
, label
, tp
) {
1336 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1338 state
= aa_dfa_match(profile
->policy
.dfa
, state
, "//&");
1339 state
= match_component(profile
, tp
, state
);
1343 aa_compute_perms(profile
->policy
.dfa
, state
, perms
);
1344 aa_apply_modes_to_perms(profile
, perms
);
1345 if ((perms
->allow
& request
) != request
)
1356 * label_component_match - find perms for all subcomponents of a label
1357 * @profile: profile to find perms for
1358 * @label: label to check access permissions for
1359 * @start: state to start match in
1360 * @subns: whether to do permission checks on components in a subns
1361 * @request: permissions to request
1362 * @perms: an initialized perms struct to add accumulation to
1364 * Returns: 0 on success else ERROR
1366 * For the label A//&B//&C this does the perm match for each of A and B and C
1367 * @perms should be preinitialized with allperms OR a previous permission
1368 * check to be stacked.
1370 static int label_components_match(struct aa_profile
*profile
,
1371 struct aa_label
*label
, unsigned int start
,
1372 bool subns
, u32 request
,
1373 struct aa_perms
*perms
)
1375 struct aa_profile
*tp
;
1377 struct aa_perms tmp
;
1378 unsigned int state
= 0;
1380 /* find first subcomponent to test */
1381 label_for_each(i
, label
, tp
) {
1382 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1384 state
= match_component(profile
, tp
, start
);
1390 /* no subcomponents visible - no change in perms */
1394 aa_compute_perms(profile
->policy
.dfa
, state
, &tmp
);
1395 aa_apply_modes_to_perms(profile
, &tmp
);
1396 aa_perms_accum(perms
, &tmp
);
1397 label_for_each_cont(i
, label
, tp
) {
1398 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1400 state
= match_component(profile
, tp
, start
);
1403 aa_compute_perms(profile
->policy
.dfa
, state
, &tmp
);
1404 aa_apply_modes_to_perms(profile
, &tmp
);
1405 aa_perms_accum(perms
, &tmp
);
1408 if ((perms
->allow
& request
) != request
)
1419 * aa_label_match - do a multi-component label match
1420 * @profile: profile to match against (NOT NULL)
1421 * @label: label to match (NOT NULL)
1422 * @state: state to start in
1423 * @subns: whether to match subns components
1424 * @request: permission request
1425 * @perms: Returns computed perms (NOT NULL)
1427 * Returns: the state the match finished in, may be the none matching state
1429 int aa_label_match(struct aa_profile
*profile
, struct aa_label
*label
,
1430 unsigned int state
, bool subns
, u32 request
,
1431 struct aa_perms
*perms
)
1433 int error
= label_compound_match(profile
, label
, state
, subns
, request
,
1439 return label_components_match(profile
, label
, state
, subns
, request
,
1445 * aa_update_label_name - update a label to have a stored name
1446 * @ns: ns being viewed from (NOT NULL)
1447 * @label: label to update (NOT NULL)
1448 * @gfp: type of memory allocation
1450 * Requires: labels_set(label) not locked in caller
1452 * note: only updates the label name if it does not have a name already
1453 * and if it is in the labelset
1455 bool aa_update_label_name(struct aa_ns
*ns
, struct aa_label
*label
, gfp_t gfp
)
1457 struct aa_labelset
*ls
;
1458 unsigned long flags
;
1459 char __counted
*name
;
1465 if (label
->hname
|| labels_ns(label
) != ns
)
1468 if (aa_label_acntsxprint(&name
, ns
, label
, FLAGS_NONE
, gfp
) == -1)
1471 ls
= labels_set(label
);
1472 write_lock_irqsave(&ls
->lock
, flags
);
1473 if (!label
->hname
&& label
->flags
& FLAG_IN_TREE
) {
1474 label
->hname
= name
;
1478 write_unlock_irqrestore(&ls
->lock
, flags
);
1483 /* cached label name is present and visible
1484 * @label->hname only exists if label is namespace hierachical */
1485 static inline bool use_label_hname(struct aa_ns
*ns
, struct aa_label
*label
)
1487 if (label
->hname
&& labels_ns(label
) == ns
)
1493 /* helper macro for snprint routines */
1494 #define update_for_len(total, len, size, str) \
1498 len = min(len, size); \
1504 * aa_profile_snxprint_profile - print a profile name to a buffer
1505 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1506 * @size: size of buffer
1507 * @ns: namespace profile is being viewed from
1508 * @profile: profile to view (NOT NULL)
1509 * @flags: whether to include the mode string
1511 * Returns: size of name written or would be written if larger than
1514 * Note: will not print anything if the profile is not visible
1516 int aa_profile_snxprint(char *str
, size_t size
, struct aa_ns
*ns
,
1517 struct aa_profile
*profile
, int flags
)
1519 const char *ns_name
= "";
1521 AA_BUG(!str
&& size
!= 0);
1525 ns
= profiles_ns(profile
);
1527 if (ns
!= profile
->ns
) {
1528 ns_name
= aa_ns_name(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
);
1529 if (ns_name
== aa_hidden_ns_name
) {
1530 if (flags
& FLAG_HIDDEN_UNCONFINED
)
1531 return snprintf(str
, size
, "%s", "unconfined");
1532 return snprintf(str
, size
, "%s", ns_name
);
1536 if ((flags
& FLAG_SHOW_MODE
) && profile
!= profile
->ns
->unconfined
) {
1537 const char *modestr
= aa_profile_mode_names
[profile
->mode
];
1538 if (strlen(ns_name
))
1539 return snprintf(str
, size
, ":%s://%s (%s)", ns_name
,
1540 profile
->base
.hname
, modestr
);
1541 return snprintf(str
, size
, "%s (%s)", profile
->base
.hname
,
1545 if (strlen(ns_name
))
1546 return snprintf(str
, size
, ":%s://%s", ns_name
,
1547 profile
->base
.hname
);
1548 return snprintf(str
, size
, "%s", profile
->base
.hname
);
1551 static const char *label_modename(struct aa_ns
*ns
, struct aa_label
*label
,
1554 struct aa_profile
*profile
;
1556 int mode
= -1, count
= 0;
1558 label_for_each(i
, label
, profile
) {
1559 if (aa_ns_visible(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
)) {
1560 if (profile
->mode
== APPARMOR_UNCONFINED
)
1561 /* special case unconfined so stacks with
1562 * unconfined don't report as mixed. ie.
1563 * profile_foo//&:ns1://unconfined (mixed)
1568 mode
= profile
->mode
;
1569 else if (mode
!= profile
->mode
)
1577 /* everything was unconfined */
1578 mode
= APPARMOR_UNCONFINED
;
1580 return aa_profile_mode_names
[mode
];
1583 /* if any visible label is not unconfined the display_mode returns true */
1584 static inline bool display_mode(struct aa_ns
*ns
, struct aa_label
*label
,
1587 if ((flags
& FLAG_SHOW_MODE
)) {
1588 struct aa_profile
*profile
;
1591 label_for_each(i
, label
, profile
) {
1592 if (aa_ns_visible(ns
, profile
->ns
,
1593 flags
& FLAG_VIEW_SUBNS
) &&
1594 profile
!= profile
->ns
->unconfined
)
1597 /* only ns->unconfined in set of profiles in ns */
1605 * aa_label_snxprint - print a label name to a string buffer
1606 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1607 * @size: size of buffer
1608 * @ns: namespace profile is being viewed from
1609 * @label: label to view (NOT NULL)
1610 * @flags: whether to include the mode string
1612 * Returns: size of name written or would be written if larger than
1615 * Note: labels do not have to be strictly hierarchical to the ns as
1616 * objects may be shared across different namespaces and thus
1617 * pickup labeling from each ns. If a particular part of the
1618 * label is not visible it will just be excluded. And if none
1619 * of the label is visible "---" will be used.
1621 int aa_label_snxprint(char *str
, size_t size
, struct aa_ns
*ns
,
1622 struct aa_label
*label
, int flags
)
1624 struct aa_profile
*profile
;
1626 int count
= 0, total
= 0;
1629 AA_BUG(!str
&& size
!= 0);
1633 ns
= labels_ns(label
);
1635 label_for_each(i
, label
, profile
) {
1636 if (aa_ns_visible(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
)) {
1638 len
= snprintf(str
, size
, "//&");
1639 update_for_len(total
, len
, size
, str
);
1641 len
= aa_profile_snxprint(str
, size
, ns
, profile
,
1642 flags
& FLAG_VIEW_SUBNS
);
1643 update_for_len(total
, len
, size
, str
);
1649 if (flags
& FLAG_HIDDEN_UNCONFINED
)
1650 return snprintf(str
, size
, "%s", "unconfined");
1651 return snprintf(str
, size
, "%s", aa_hidden_ns_name
);
1654 /* count == 1 && ... is for backwards compat where the mode
1655 * is not displayed for 'unconfined' in the current ns
1657 if (display_mode(ns
, label
, flags
)) {
1658 len
= snprintf(str
, size
, " (%s)",
1659 label_modename(ns
, label
, flags
));
1660 update_for_len(total
, len
, size
, str
);
1665 #undef update_for_len
1668 * aa_label_asxprint - allocate a string buffer and print label into it
1669 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1670 * @ns: namespace profile is being viewed from
1671 * @label: label to view (NOT NULL)
1672 * @flags: flags controlling what label info is printed
1673 * @gfp: kernel memory allocation type
1675 * Returns: size of name written or would be written if larger than
1678 int aa_label_asxprint(char **strp
, struct aa_ns
*ns
, struct aa_label
*label
,
1679 int flags
, gfp_t gfp
)
1686 size
= aa_label_snxprint(NULL
, 0, ns
, label
, flags
);
1690 *strp
= kmalloc(size
+ 1, gfp
);
1693 return aa_label_snxprint(*strp
, size
+ 1, ns
, label
, flags
);
1697 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1698 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1699 * @ns: namespace profile is being viewed from
1700 * @label: label to view (NOT NULL)
1701 * @flags: flags controlling what label info is printed
1702 * @gfp: kernel memory allocation type
1704 * Returns: size of name written or would be written if larger than
1707 int aa_label_acntsxprint(char __counted
**strp
, struct aa_ns
*ns
,
1708 struct aa_label
*label
, int flags
, gfp_t gfp
)
1715 size
= aa_label_snxprint(NULL
, 0, ns
, label
, flags
);
1719 *strp
= aa_str_alloc(size
+ 1, gfp
);
1722 return aa_label_snxprint(*strp
, size
+ 1, ns
, label
, flags
);
1726 void aa_label_xaudit(struct audit_buffer
*ab
, struct aa_ns
*ns
,
1727 struct aa_label
*label
, int flags
, gfp_t gfp
)
1737 ns
= labels_ns(label
);
1739 if (!use_label_hname(ns
, label
) || display_mode(ns
, label
, flags
)) {
1740 labelstats_inc(audit_name_alloc
);
1741 len
= aa_label_asxprint(&name
, ns
, label
, flags
, gfp
);
1743 labelstats_inc(audit_name_fail
);
1744 AA_DEBUG("label print error");
1749 str
= (char *) label
->hname
;
1752 if (audit_string_contains_control(str
, len
))
1753 audit_log_n_hex(ab
, str
, len
);
1755 audit_log_n_string(ab
, str
, len
);
1760 void aa_label_seq_xprint(struct seq_file
*f
, struct aa_ns
*ns
,
1761 struct aa_label
*label
, int flags
, gfp_t gfp
)
1767 ns
= labels_ns(label
);
1769 if (!use_label_hname(ns
, label
)) {
1773 labelstats_inc(seq_print_name_alloc
);
1774 len
= aa_label_asxprint(&str
, ns
, label
, flags
, gfp
);
1776 labelstats_inc(seq_print_name_fail
);
1777 AA_DEBUG("label print error");
1780 seq_printf(f
, "%s", str
);
1782 } else if (display_mode(ns
, label
, flags
))
1783 seq_printf(f
, "%s (%s)", label
->hname
,
1784 label_modename(ns
, label
, flags
));
1786 seq_printf(f
, "%s", label
->hname
);
1789 void aa_label_xprintk(struct aa_ns
*ns
, struct aa_label
*label
, int flags
,
1795 ns
= labels_ns(label
);
1797 if (!use_label_hname(ns
, label
)) {
1801 labelstats_inc(printk_name_alloc
);
1802 len
= aa_label_asxprint(&str
, ns
, label
, flags
, gfp
);
1804 labelstats_inc(printk_name_fail
);
1805 AA_DEBUG("label print error");
1810 } else if (display_mode(ns
, label
, flags
))
1811 printk("%s (%s)", label
->hname
,
1812 label_modename(ns
, label
, flags
));
1814 printk("%s", label
->hname
);
1817 void aa_label_audit(struct audit_buffer
*ab
, struct aa_label
*label
, gfp_t gfp
)
1819 struct aa_ns
*ns
= aa_get_current_ns();
1820 aa_label_xaudit(ab
, ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1824 void aa_label_seq_print(struct seq_file
*f
, struct aa_label
*label
, gfp_t gfp
)
1826 struct aa_ns
*ns
= aa_get_current_ns();
1827 aa_label_seq_xprint(f
, ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1831 void aa_label_printk(struct aa_label
*label
, gfp_t gfp
)
1833 struct aa_ns
*ns
= aa_get_current_ns();
1834 aa_label_xprintk(ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1838 static int label_count_str_entries(const char *str
)
1845 for (split
= strstr(str
, "//&"); split
; split
= strstr(str
, "//&")) {
1854 * ensure stacks with components like
1856 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1857 * to the base if the lookup specifies an ns, else making the stacked lookup
1858 * relative to the last embedded ns in the string.
1860 static struct aa_profile
*fqlookupn_profile(struct aa_label
*base
,
1861 struct aa_label
*currentbase
,
1862 const char *str
, size_t n
)
1864 const char *first
= skipn_spaces(str
, n
);
1865 if (first
&& *first
== ':')
1866 return aa_fqlookupn_profile(base
, str
, n
);
1867 return aa_fqlookupn_profile(currentbase
, str
, n
);
1871 * aa_label_parse - parse, validate and convert a text string to a label
1872 * @base: base label to use for lookups (NOT NULL)
1873 * @str: null terminated text string (NOT NULL)
1874 * @gfp: allocation type
1875 * @create: true if should create compound labels if they don't exist
1876 * @force_stack: true if should stack even if no leading &
1878 * Returns: the matching refcounted label if present
1881 struct aa_label
*aa_label_parse(struct aa_label
*base
, const char *str
,
1882 gfp_t gfp
, bool create
, bool force_stack
)
1884 DEFINE_VEC(profile
, vec
);
1885 struct aa_label
*label
, *currbase
= base
;
1886 int i
, len
, stack
= 0, error
;
1892 str
= skip_spaces(str
);
1893 len
= label_count_str_entries(str
);
1894 if (*str
== '&' || force_stack
) {
1895 /* stack on top of base */
1901 error
= vec_setup(profile
, vec
, len
, gfp
);
1903 return ERR_PTR(error
);
1905 for (i
= 0; i
< stack
; i
++)
1906 vec
[i
] = aa_get_profile(base
->vec
[i
]);
1908 for (split
= strstr(str
, "//&"), i
= stack
; split
&& i
< len
; i
++) {
1909 vec
[i
] = fqlookupn_profile(base
, currbase
, str
, split
- str
);
1913 * if component specified a new ns it becomes the new base
1914 * so that subsequent lookups are relative to it
1916 if (vec
[i
]->ns
!= labels_ns(currbase
))
1917 currbase
= &vec
[i
]->label
;
1919 split
= strstr(str
, "//&");
1921 /* last element doesn't have a split so this should be the case but just to be safe */
1923 vec
[i
] = fqlookupn_profile(base
, currbase
, str
, strlen(str
));
1928 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1929 return &vec
[0]->label
;
1931 len
-= aa_vec_unique(vec
, len
, VEC_FLAG_TERMINATE
);
1932 /* TODO: deal with reference labels */
1934 label
= aa_get_label(&vec
[0]->label
);
1939 label
= aa_vec_find_or_create_label(vec
, len
, gfp
);
1941 label
= vec_find(vec
, len
);
1946 /* use adjusted len from after vec_unique, not original */
1947 vec_cleanup(profile
, vec
, len
);
1951 label
= ERR_PTR(-ENOENT
);
1957 * aa_labelset_destroy - remove all labels from the label set
1958 * @ls: label set to cleanup (NOT NULL)
1960 * Labels that are removed from the set may still exist beyond the set
1961 * being destroyed depending on their reference counting
1963 void aa_labelset_destroy(struct aa_labelset
*ls
)
1965 struct rb_node
*node
;
1966 unsigned long flags
;
1970 write_lock_irqsave(&ls
->lock
, flags
);
1971 for (node
= rb_first(&ls
->root
); node
; node
= rb_first(&ls
->root
)) {
1972 struct aa_label
*this = rb_entry(node
, struct aa_label
, node
);
1973 if (labels_ns(this) != root_ns
)
1974 __label_remove(this,
1975 ns_unconfined(labels_ns(this)->parent
));
1977 __label_remove(this, NULL
);
1979 write_unlock_irqrestore(&ls
->lock
, flags
);
1983 * @ls: labelset to init (NOT NULL)
1985 void aa_labelset_init(struct aa_labelset
*ls
)
1989 rwlock_init(&ls
->lock
);
1991 labelstats_init(&ls
);
1994 static struct aa_label
*labelset_next_stale(struct aa_labelset
*ls
)
1996 struct aa_label
*label
;
1997 struct rb_node
*node
;
1998 unsigned long flags
;
2002 read_lock_irqsave(&ls
->lock
, flags
);
2004 __labelset_for_each(ls
, node
) {
2005 label
= rb_entry(node
, struct aa_label
, node
);
2006 if ((label_is_stale(label
) || vec_is_stale(label
->vec
, label
->size
)) &&
2007 aa_get_label_not0(label
))
2014 read_unlock_irqrestore(&ls
->lock
, flags
);
2020 * __label_update - insert updated version of @label into labelset
2021 * @label - the label to update/repace
2023 * Returns: new label that is up to date
2024 * else NULL on failure
2026 * Requires: @ns lock be held
2028 * Note: worst case is the stale @label does not get updated and has
2029 * to be updated at a later time.
2031 static struct aa_label
*__label_update(struct aa_label
*label
)
2033 struct aa_label
*new, *tmp
;
2034 struct aa_labelset
*ls
;
2035 unsigned long flags
;
2036 int i
, invcount
= 0;
2039 AA_BUG(!mutex_is_locked(&labels_ns(label
)->lock
));
2041 new = aa_label_alloc(label
->size
, label
->proxy
, GFP_KERNEL
);
2045 /* while holding the ns_lock will stop profile replacement, removal,
2046 * and label updates, label merging and removal can be occuring
2048 ls
= labels_set(label
);
2049 write_lock_irqsave(&ls
->lock
, flags
);
2050 for (i
= 0; i
< label
->size
; i
++) {
2051 AA_BUG(!label
->vec
[i
]);
2052 new->vec
[i
] = aa_get_newest_profile(label
->vec
[i
]);
2053 AA_BUG(!new->vec
[i
]);
2054 AA_BUG(!new->vec
[i
]->label
.proxy
);
2055 AA_BUG(!new->vec
[i
]->label
.proxy
->label
);
2056 if (new->vec
[i
]->label
.proxy
!= label
->vec
[i
]->label
.proxy
)
2060 /* updated stale label by being removed/renamed from labelset */
2062 new->size
-= aa_vec_unique(&new->vec
[0], new->size
,
2063 VEC_FLAG_TERMINATE
);
2064 /* TODO: deal with reference labels */
2065 if (new->size
== 1) {
2066 tmp
= aa_get_label(&new->vec
[0]->label
);
2067 AA_BUG(tmp
== label
);
2070 if (labels_set(label
) != labels_set(new)) {
2071 write_unlock_irqrestore(&ls
->lock
, flags
);
2072 tmp
= aa_label_insert(labels_set(new), new);
2073 write_lock_irqsave(&ls
->lock
, flags
);
2077 AA_BUG(labels_ns(label
) != labels_ns(new));
2079 tmp
= __label_insert(labels_set(label
), new, true);
2081 /* ensure label is removed, and redirected correctly */
2082 __label_remove(label
, tmp
);
2083 write_unlock_irqrestore(&ls
->lock
, flags
);
2084 label_free_or_put_new(tmp
, new);
2090 * __labelset_update - update labels in @ns
2091 * @ns: namespace to update labels in (NOT NULL)
2093 * Requires: @ns lock be held
2095 * Walk the labelset ensuring that all labels are up to date and valid
2096 * Any label that has a stale component is marked stale and replaced and
2097 * by an updated version.
2099 * If failures happen due to memory pressures then stale labels will
2100 * be left in place until the next pass.
2102 static void __labelset_update(struct aa_ns
*ns
)
2104 struct aa_label
*label
;
2107 AA_BUG(!mutex_is_locked(&ns
->lock
));
2110 label
= labelset_next_stale(&ns
->labels
);
2113 l
= __label_update(label
);
2115 aa_put_label(label
);
2121 * __aa_labelset_udate_subtree - update all labels with a stale component
2122 * @ns: ns to start update at (NOT NULL)
2124 * Requires: @ns lock be held
2126 * Invalidates labels based on @p in @ns and any children namespaces.
2128 void __aa_labelset_update_subtree(struct aa_ns
*ns
)
2130 struct aa_ns
*child
;
2133 AA_BUG(!mutex_is_locked(&ns
->lock
));
2135 __labelset_update(ns
);
2137 list_for_each_entry(child
, &ns
->sub_ns
, base
.list
) {
2138 mutex_lock(&child
->lock
);
2139 __aa_labelset_update_subtree(child
);
2140 mutex_unlock(&child
->lock
);