]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - security/apparmor/label.c
2 * AppArmor security module
4 * This file contains AppArmor label definitions
6 * Copyright 2013 Canonical Ltd.
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
14 #include <linux/audit.h>
15 #include <linux/seq_file.h>
16 #include <linux/sort.h>
18 #include "include/apparmor.h"
19 #include "include/context.h"
20 #include "include/label.h"
21 #include "include/policy.h"
22 #include "include/sid.h"
26 * the aa_label represents the set of profiles confining an object
28 * Labels maintain a reference count to the set of pointers they reference
29 * Labels are ref counted by
30 * tasks and object via the security field/security context off the field
31 * code - will take a ref count on a label if it needs the label
32 * beyond what is possible with an rcu_read_lock.
33 * profiles - each profile is a label
34 * sids - a pinned sid will keep a refcount of the label it is
36 * objects - inode, files, sockets, ...
38 * Labels are not ref counted by the label set, so they maybe removed and
39 * freed when no longer in use.
43 #define PROXY_POISON 97
44 #define LABEL_POISON 100
46 static void free_proxy(struct aa_proxy
*proxy
)
49 /* p->label will not updated any more as p is dead */
50 aa_put_label(rcu_dereference_protected(proxy
->label
, true));
51 memset(proxy
, 0, sizeof(*proxy
));
52 proxy
->label
= (struct aa_label
*) PROXY_POISON
;
57 void aa_proxy_kref(struct kref
*kref
)
59 struct aa_proxy
*proxy
= container_of(kref
, struct aa_proxy
, count
);
63 struct aa_proxy
*aa_alloc_proxy(struct aa_label
*label
, gfp_t gfp
)
67 new = kzalloc(sizeof(struct aa_proxy
), gfp
);
69 kref_init(&new->count
);
70 rcu_assign_pointer(new->label
, aa_get_label(label
));
75 /* requires profile list write lock held */
76 void __aa_proxy_redirect(struct aa_label
*orig
, struct aa_label
*new)
82 AA_BUG(!write_is_locked(&labels_set(orig
)->lock
));
84 tmp
= rcu_dereference_protected(orig
->proxy
->label
,
85 &labels_ns(orig
)->lock
);
86 rcu_assign_pointer(orig
->proxy
->label
, aa_get_label(new));
87 orig
->flags
|= FLAG_STALE
;
91 static void __proxy_share(struct aa_label
*old
, struct aa_label
*new)
93 struct aa_proxy
*proxy
= new->proxy
;
94 new->proxy
= aa_get_proxy(old
->proxy
);
95 __aa_proxy_redirect(old
, new);
101 * ns_cmp - compare ns for label set ordering
102 * @a: ns to compare (NOT NULL)
103 * @b: ns to compare (NOT NULL)
105 * Returns: <0 if a < b
109 static int ns_cmp(struct aa_ns
*a
, struct aa_ns
*b
)
115 AA_BUG(!a
->base
.hname
);
116 AA_BUG(!b
->base
.hname
);
121 res
= a
->level
- b
->level
;
125 return strcmp(a
->base
.hname
, b
->base
.hname
);
129 * profile_cmp - profile comparision for set ordering
130 * @a: profile to compare (NOT NULL)
131 * @b: profile to compare (NOT NULL)
133 * Returns: <0 if a < b
137 static int profile_cmp(struct aa_profile
*a
, struct aa_profile
*b
)
145 AA_BUG(!a
->base
.hname
);
146 AA_BUG(!b
->base
.hname
);
148 if (a
== b
|| a
->base
.hname
== b
->base
.hname
)
150 res
= ns_cmp(a
->ns
, b
->ns
);
154 return strcmp(a
->base
.hname
, b
->base
.hname
);
158 * vec_cmp - label comparision for set ordering
159 * @a: label to compare (NOT NULL)
160 * @vec: vector of profiles to compare (NOT NULL)
163 * Returns: <0 if a < vec
167 static int vec_cmp(struct aa_profile
**a
, int an
, struct aa_profile
**b
, int bn
)
178 for (i
= 0; i
< an
&& i
< bn
; i
++) {
179 int res
= profile_cmp(a
[i
], b
[i
]);
187 static bool vec_is_stale(struct aa_profile
**vec
, int n
)
193 for (i
= 0; i
< n
; i
++) {
194 if (profile_is_stale(vec
[i
]))
201 static bool vec_unconfined(struct aa_profile
**vec
, int n
)
207 for (i
= 0; i
< n
; i
++) {
208 if (!profile_unconfined(vec
[i
]))
215 static int sort_cmp(const void *a
, const void *b
)
217 return profile_cmp(*(struct aa_profile
**)a
, *(struct aa_profile
**)b
);
220 /* assumes vec is sorted
221 * Assumes @vec has null terminator at vec[n], and will null terminate
224 static inline int unique(struct aa_profile
**vec
, int n
)
226 int i
, pos
, dups
= 0;
232 for (i
= 1; i
< n
; i
++) {
233 int res
= profile_cmp(vec
[pos
], vec
[i
]);
234 AA_BUG(res
> 0, "vec not sorted");
237 aa_put_profile(vec
[i
]);
252 * vec_unique - canonical sort and unique a list of profiles
253 * @n: number of refcounted profiles in the list (@n > 0)
254 * @vec: list of profiles to sort and merge
256 * Returns: the number of duplicates eliminated == references put
258 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
259 * null terminate vec[n - dups]
261 int aa_vec_unique(struct aa_profile
**vec
, int n
, int flags
)
268 /* vecs are usually small and inorder, have a fallback for larger */
270 sort(vec
, n
, sizeof(struct aa_profile
*), sort_cmp
, NULL
);
271 dups
= unique(vec
, n
);
275 /* insertion sort + unique in one */
276 for (i
= 1; i
< n
; i
++) {
277 struct aa_profile
*tmp
= vec
[i
];
280 for (pos
= i
- 1 - dups
; pos
>= 0; pos
--) {
281 int res
= profile_cmp(vec
[pos
], tmp
);
283 /* drop duplicate entry */
290 /* pos is at entry < tmp, or index -1. Set to insert pos */
293 for (j
= i
- dups
; j
> pos
; j
--)
302 if (flags
& VEC_FLAG_TERMINATE
)
303 vec
[n
- dups
] = NULL
;
309 static void label_destroy(struct aa_label
*label
)
313 if (label_is_stale(label
))
314 labelsetstats_dec(labels_set(label
), stale
);
316 if (!label_isprofile(label
)) {
317 struct aa_profile
*profile
;
320 aa_put_str(label
->hname
);
322 label_for_each(i
, label
, profile
) {
323 aa_put_profile(profile
);
324 label
->vec
[i
.i
] = (struct aa_profile
*) (LABEL_POISON
+ (long) i
.i
);
328 if (rcu_dereference_protected(label
->proxy
->label
, true) == label
)
329 rcu_assign_pointer(label
->proxy
->label
, NULL
);
331 aa_free_sid(label
->sid
);
332 aa_put_proxy(label
->proxy
);
333 label
->proxy
= (struct aa_proxy
*) PROXY_POISON
+ 1;
336 void aa_label_free(struct aa_label
*label
)
341 label_destroy(label
);
342 labelstats_inc(freed
);
346 static void label_free_switch(struct aa_label
*label
)
348 if (label
->flags
& FLAG_NS_COUNT
)
349 aa_free_ns(labels_ns(label
));
350 else if (label_isprofile(label
))
351 aa_free_profile(labels_profile(label
));
353 aa_label_free(label
);
356 static void label_free_rcu(struct rcu_head
*head
)
358 struct aa_label
*label
= container_of(head
, struct aa_label
, rcu
);
360 if (label
->flags
& FLAG_IN_TREE
)
361 (void) aa_label_remove(label
);
362 label_free_switch(label
);
365 void aa_label_kref(struct kref
*kref
)
367 struct aa_label
*label
= container_of(kref
, struct aa_label
, count
);
368 struct aa_ns
*ns
= labels_ns(label
);
371 /* never live, no rcu callback needed, just using the fn */
372 label_free_switch(label
);
375 /* TODO: update labels_profile macro so it works here */
376 AA_BUG(label_isprofile(label
) && on_list_rcu(&label
->vec
[0]->base
.profiles
));
377 AA_BUG(label_isprofile(label
) && on_list_rcu(&label
->vec
[0]->base
.list
));
379 /* TODO: if compound label and not stale add to reclaim cache */
380 call_rcu(&label
->rcu
, label_free_rcu
);
383 bool aa_label_init(struct aa_label
*label
, int size
)
388 label
->sid
= aa_alloc_sid();
389 if (label
->sid
== AA_SID_INVALID
)
392 label
->size
= size
; /* doesn't include null */
393 label
->vec
[size
] = NULL
; /* null terminate */
394 kref_init(&label
->count
);
395 RB_CLEAR_NODE(&label
->node
);
401 * aa_label_alloc - allocate a label with a profile vector of @size length
402 * @size: size of profile vector in the label
403 * @proxy: proxy to use OR null if to allocate a new one
404 * @gfp: memory allocation type
407 * else NULL if failed
409 struct aa_label
*aa_label_alloc(int size
, struct aa_proxy
*proxy
, gfp_t gfp
)
411 struct aa_label
*new;
415 /* + 1 for null terminator entry on vec */
416 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile
*) * (size
+ 1),
418 AA_DEBUG("%s (%p)\n", __func__
, new);
422 if (!aa_label_init(new, size
))
426 proxy
= aa_alloc_proxy(new, gfp
);
431 /* just set new's proxy, don't redirect proxy here if it was passed in*/
434 labelstats_inc(allocated
);
440 labelstats_inc(failed
);
447 * label_cmp - label comparision for set ordering
448 * @a: label to compare (NOT NULL)
449 * @b: label to compare (NOT NULL)
451 * Returns: <0 if a < b
455 static int label_cmp(struct aa_label
*a
, struct aa_label
*b
)
462 return vec_cmp(a
->vec
, a
->size
, b
->vec
, b
->size
);
465 /* helper fn for label_for_each_confined */
466 int aa_label_next_confined(struct aa_label
*label
, int i
)
471 for (; i
< label
->size
; i
++) {
472 if (!profile_unconfined(label
->vec
[i
]))
480 * aa_label_next_not_in_set - return the next profile of @sub not in @set
482 * @set: label to test against
483 * @sub: label to if is subset of @set
485 * Returns: profile in @sub that is not in @set, with iterator set pos after
486 * else NULL if @sub is a subset of @set
488 struct aa_profile
*__aa_label_next_not_in_set(struct label_it
*I
,
489 struct aa_label
*set
,
490 struct aa_label
*sub
)
495 AA_BUG(I
->i
> set
->size
);
498 AA_BUG(I
->j
> sub
->size
);
500 while (I
->j
< sub
->size
&& I
->i
< set
->size
) {
501 int res
= profile_cmp(sub
->vec
[I
->j
], set
->vec
[I
->i
]);
508 return sub
->vec
[(I
->j
)++];
511 if (I
->j
< sub
->size
)
512 return sub
->vec
[(I
->j
)++];
518 * aa_label_is_subset - test if @sub is a subset of @set
519 * @set: label to test against
520 * @sub: label to test if is subset of @set
522 * Returns: true if @sub is subset of @set
525 bool aa_label_is_subset(struct aa_label
*set
, struct aa_label
*sub
)
527 struct label_it i
= { };
535 return __aa_label_next_not_in_set(&i
, set
, sub
) == NULL
;
541 * __label_remove - remove @label from the label set
542 * @l: label to remove
543 * @new: label to redirect to
545 * Requires: labels_set(@label)->lock write_lock
546 * Returns: true if the label was in the tree and removed
548 static bool __label_remove(struct aa_label
*label
, struct aa_label
*new)
550 struct aa_labelset
*ls
= labels_set(label
);
553 AA_BUG(!write_is_locked(&ls
->lock
));
556 __aa_proxy_redirect(label
, new);
558 if (label_is_stale(label
))
559 labelstats_dec(stale_intree
);
561 __label_make_stale(label
);
563 if (label
->flags
& FLAG_IN_TREE
) {
564 labelsetstats_dec(ls
, intree
);
565 rb_erase(&label
->node
, &ls
->root
);
566 label
->flags
&= ~FLAG_IN_TREE
;
574 * __label_replace - replace @old with @new in label set
575 * @old: label to remove from label set
576 * @new: label to replace @old with
578 * Requires: labels_set(@old)->lock write_lock
579 * valid ref count be held on @new
580 * Returns: true if @old was in set and replaced by @new
582 * Note: current implementation requires label set be order in such a way
583 * that @new directly replaces @old position in the set (ie.
584 * using pointer comparison of the label address would not work)
586 static bool __label_replace(struct aa_label
*old
, struct aa_label
*new)
588 struct aa_labelset
*ls
= labels_set(old
);
592 AA_BUG(!write_is_locked(&ls
->lock
));
593 AA_BUG(new->flags
& FLAG_IN_TREE
);
595 if (label_is_stale(old
))
596 labelstats_dec(stale_intree
);
598 __label_make_stale(old
);
600 if (old
->flags
& FLAG_IN_TREE
) {
601 rb_replace_node(&old
->node
, &new->node
, &ls
->root
);
602 old
->flags
&= ~FLAG_IN_TREE
;
603 new->flags
|= FLAG_IN_TREE
;
611 * __label_insert - attempt to insert @l into a label set
612 * @ls: set of labels to insert @l into (NOT NULL)
613 * @label: new label to insert (NOT NULL)
614 * @replace: whether insertion should replace existing entry that is not stale
616 * Requires: @ls->lock
617 * caller to hold a valid ref on l
618 * if @replace is true l has a preallocated proxy associated
619 * Returns: @l if successful in inserting @l - with additional refcount
620 * else ref counted equivalent label that is already in the set,
621 the else condition only happens if @replace is false
623 static struct aa_label
*__label_insert(struct aa_labelset
*ls
,
624 struct aa_label
*label
, bool replace
)
626 struct rb_node
**new, *parent
= NULL
;
630 AA_BUG(labels_set(label
) != ls
);
631 AA_BUG(!write_is_locked(&ls
->lock
));
632 AA_BUG(label
->flags
& FLAG_IN_TREE
);
634 /* Figure out where to put new node */
635 new = &ls
->root
.rb_node
;
637 struct aa_label
*this = rb_entry(*new, struct aa_label
, node
);
638 int result
= label_cmp(label
, this);
642 labelsetstats_inc(ls
, existing
);
643 /* !aa_get_label_not0 means queued for destruction,
644 * so replace in place, however the label has
645 * died before the replacement so do not share
648 if (!replace
&& !label_is_stale(this)) {
649 if (aa_get_label_not0(this))
652 __proxy_share(this, label
);
653 AA_BUG(!__label_replace(this, label
));
654 return aa_get_label(label
);
655 } else if (result
< 0)
656 new = &((*new)->rb_left
);
657 else /* (result > 0) */
658 new = &((*new)->rb_right
);
661 /* Add new node and rebalance tree. */
662 rb_link_node(&label
->node
, parent
, new);
663 rb_insert_color(&label
->node
, &ls
->root
);
664 label
->flags
|= FLAG_IN_TREE
;
665 labelsetstats_inc(ls
, insert
);
666 labelsetstats_inc(ls
, intree
);
668 return aa_get_label(label
);
672 * __vec_find - find label that matches @vec in label set
673 * @vec: vec of profiles to find matching label for (NOT NULL)
676 * Requires: @vec_labelset(vec) lock held
677 * caller to hold a valid ref on l
679 * Returns: ref counted @label if matching label is in tree
680 * ref counted label that is equiv to @l in tree
681 * else NULL if @vec equiv is not in tree
683 static struct aa_label
*__vec_find(struct aa_profile
**vec
, int n
)
685 struct rb_node
*node
;
691 node
= vec_labelset(vec
, n
)->root
.rb_node
;
693 struct aa_label
*this = rb_entry(node
, struct aa_label
, node
);
694 int result
= vec_cmp(this->vec
, this->size
, vec
, n
);
697 node
= node
->rb_left
;
699 node
= node
->rb_right
;
701 return aa_get_label_not0(this);
708 * __label_find - find label @label in label set
709 * @label: label to find (NOT NULL)
711 * Requires: labels_set(@label)->lock held
712 * caller to hold a valid ref on l
714 * Returns: ref counted @label if @label is in tree OR
715 * ref counted label that is equiv to @label in tree
716 * else NULL if @label or equiv is not in tree
718 static struct aa_label
*__label_find(struct aa_label
*label
)
722 return __vec_find(label
->vec
, label
->size
);
727 * aa_label_remove - remove a label from the labelset
728 * @label: label to remove
730 * Returns: true if @label was removed from the tree
731 * else @label was not in tree so it could not be removed
733 bool aa_label_remove(struct aa_label
*label
)
735 struct aa_labelset
*ls
= labels_set(label
);
741 write_lock_irqsave(&ls
->lock
, flags
);
742 res
= __label_remove(label
, ns_unconfined(labels_ns(label
)));
743 write_unlock_irqrestore(&ls
->lock
, flags
);
749 * aa_label_replace - replace a label @old with a new version @new
750 * @old: label to replace
751 * @new: label replacing @old
753 * Returns: true if @old was in tree and replaced
754 * else @old was not in tree, and @new was not inserted
756 bool aa_label_replace(struct aa_label
*old
, struct aa_label
*new)
761 if (name_is_shared(old
, new) && labels_ns(old
) == labels_ns(new)) {
762 write_lock_irqsave(&labels_set(old
)->lock
, flags
);
763 if (old
->proxy
!= new->proxy
) {
764 __proxy_share(old
, new);
766 __aa_proxy_redirect(old
, new);
767 res
= __label_replace(old
, new);
768 write_unlock_irqrestore(&labels_set(old
)->lock
, flags
);
771 struct aa_labelset
*ls
= labels_set(old
);
772 write_lock_irqsave(&ls
->lock
, flags
);
773 res
= __label_remove(old
, new);
774 if (labels_ns(old
) != labels_ns(new)) {
775 write_unlock_irqrestore(&ls
->lock
, flags
);
776 ls
= labels_set(new);
777 write_lock_irqsave(&ls
->lock
, flags
);
779 l
= __label_insert(ls
, new, true);
781 write_unlock_irqrestore(&ls
->lock
, flags
);
789 * vec_find - find label @l in label set
790 * @vec: array of profiles to find equiv label for (NOT NULL)
793 * Returns: refcounted label if @vec equiv is in tree
794 * else NULL if @vec equiv is not in tree
796 static struct aa_label
*vec_find(struct aa_profile
**vec
, int n
)
798 struct aa_labelset
*ls
;
799 struct aa_label
*label
;
806 ls
= vec_labelset(vec
, n
);
807 read_lock_irqsave(&ls
->lock
, flags
);
808 label
= __vec_find(vec
, n
);
809 labelstats_inc(sread
);
810 read_unlock_irqrestore(&ls
->lock
, flags
);
815 /* requires sort and merge done first */
816 static struct aa_label
*vec_create_and_insert_label(struct aa_profile
**vec
,
819 struct aa_label
*label
= NULL
;
820 struct aa_labelset
*ls
;
822 struct aa_label
*new;
828 return aa_get_label(&vec
[0]->label
);
830 ls
= labels_set(&vec
[len
- 1]->label
);
832 /* TODO: enable when read side is lockless
833 * check if label exists before taking locks
835 new = aa_label_alloc(len
, NULL
, gfp
);
839 for (i
= 0; i
< len
; i
++) {
840 new->vec
[i
] = aa_get_profile(vec
[i
]);
842 write_lock_irqsave(&ls
->lock
, flags
);
843 label
= __label_insert(ls
, new, false);
844 write_unlock_irqrestore(&ls
->lock
, flags
);
850 struct aa_label
*aa_vec_find_or_create_label(struct aa_profile
**vec
, int len
,
853 struct aa_label
*label
= vec_find(vec
, len
);
857 return vec_create_and_insert_label(vec
, len
, gfp
);
861 * aa_label_find - find label @label in label set
862 * @label: label to find (NOT NULL)
864 * Requires: caller to hold a valid ref on l
866 * Returns: refcounted @label if @label is in tree
867 * refcounted label that is equiv to @label in tree
868 * else NULL if @label or equiv is not in tree
870 struct aa_label
*aa_label_find(struct aa_label
*label
)
874 return vec_find(label
->vec
, label
->size
);
879 * aa_label_insert - insert label @label into @ls or return existing label
880 * @ls - labelset to insert @label into
881 * @label - label to insert
883 * Requires: caller to hold a valid ref on @label
885 * Returns: ref counted @label if successful in inserting @label
886 * else ref counted equivalent label that is already in the set
888 struct aa_label
*aa_label_insert(struct aa_labelset
*ls
, struct aa_label
*label
)
896 /* check if label exists before taking lock */
897 if (!label_is_stale(label
)) {
898 read_lock_irqsave(&ls
->lock
, flags
);
899 l
= __label_find(label
);
900 read_unlock_irqrestore(&ls
->lock
, flags
);
901 labelstats_inc(fread
);
906 write_lock_irqsave(&ls
->lock
, flags
);
907 l
= __label_insert(ls
, label
, false);
908 write_unlock_irqrestore(&ls
->lock
, flags
);
915 * aa_label_next_in_merge - find the next profile when merging @a and @b
920 * Returns: next profile
921 * else null if no more profiles
923 struct aa_profile
*aa_label_next_in_merge(struct label_it
*I
,
931 AA_BUG(I
->i
> a
->size
);
933 AA_BUG(I
->j
> b
->size
);
935 if (I
->i
< a
->size
) {
936 if (I
->j
< b
->size
) {
937 int res
= profile_cmp(a
->vec
[I
->i
], b
->vec
[I
->j
]);
939 return b
->vec
[(I
->j
)++];
944 return a
->vec
[(I
->i
)++];
948 return b
->vec
[(I
->j
)++];
954 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
955 * @a: label to merge then compare (NOT NULL)
956 * @b: label to merge then compare (NOT NULL)
957 * @z: label to compare merge against (NOT NULL)
959 * Assumes: using the most recent versions of @a, @b, and @z
961 * Returns: <0 if a < b
965 static int label_merge_cmp(struct aa_label
*a
, struct aa_label
*b
,
968 struct aa_profile
*p
= NULL
;
969 struct label_it i
= { };
977 k
< z
->size
&& (p
= aa_label_next_in_merge(&i
, a
, b
));
979 int res
= profile_cmp(p
, z
->vec
[k
]);
987 else if (k
< z
->size
)
994 * label_merge_len - find the length of the merge of @a and @b
995 * @a: label to merge (NOT NULL)
996 * @b: label to merge (NOT NULL)
998 * Assumes: using newest versions of labels @a and @b
1000 * Returns: length of a label vector for merge of @a and @b
1002 static int label_merge_len(struct aa_label
*a
, struct aa_label
*b
)
1004 int len
= a
->size
+ b
->size
;
1010 /* find entries in common and remove from count */
1011 for (i
= j
= 0; i
< a
->size
&& j
< b
->size
; ) {
1012 int res
= profile_cmp(a
->vec
[i
], b
->vec
[j
]);
1028 * label_merge_insert - create a new label by merging @a and @b
1029 * @new: preallocated label to merge into (NOT NULL)
1030 * @a: label to merge with @b (NOT NULL)
1031 * @b: label to merge with @a (NOT NULL)
1033 * Requires: preallocated proxy
1035 * Returns: ref counted label either @new if merge is unique
1036 * @a if @b is a subset of @a
1037 * @b if @a is a subset of @b
1039 * NOTE: will not use @new if the merge results in @new == @a or @b
1041 * Must be used within labelset write lock to avoid racing with
1042 * setting labels stale.
1044 static struct aa_label
*label_merge_insert(struct aa_label
*new,
1048 struct aa_label
*label
;
1049 struct aa_labelset
*ls
;
1050 struct aa_profile
*next
;
1052 unsigned long flags
;
1053 int k
= 0, invcount
= 0;
1057 AA_BUG(a
->size
< 0);
1059 AA_BUG(b
->size
< 0);
1061 AA_BUG(new->size
< a
->size
+ b
->size
);
1063 label_for_each_in_merge(i
, a
, b
, next
) {
1065 if (profile_is_stale(next
)) {
1066 new->vec
[k
] = aa_get_newest_profile(next
);
1067 AA_BUG(!new->vec
[k
]->label
.proxy
);
1068 AA_BUG(!new->vec
[k
]->label
.proxy
->label
);
1069 if (next
->label
.proxy
!= new->vec
[k
]->label
.proxy
)
1074 new->vec
[k
++] = aa_get_profile(next
);
1076 /* set to actual size which is <= allocated len */
1081 new->size
-= aa_vec_unique(&new->vec
[0], new->size
,
1082 VEC_FLAG_TERMINATE
);
1083 /* TODO: deal with reference labels */
1084 if (new->size
== 1) {
1085 label
= aa_get_label(&new->vec
[0]->label
);
1089 } else if (!stale
) {
1090 /* merge could be same as a || b, note: it is not possible
1091 * for new->size == a->size == b->size unless a == b */
1093 return aa_get_label(a
);
1094 else if (k
== b
->size
)
1095 return aa_get_label(b
);
1097 if (vec_unconfined(new->vec
, new->size
))
1098 new->flags
|= FLAG_UNCONFINED
;
1099 ls
= labels_set(new);
1100 write_lock_irqsave(&ls
->lock
, flags
);
1101 label
= __label_insert(labels_set(new), new, false);
1102 write_unlock_irqrestore(&ls
->lock
, flags
);
1108 * labelset_of_merge - find into which labelset a merged label should be inserted
1109 * @a: label to merge and insert
1110 * @b: label to merge and insert
1112 * Returns: labelset that the merged label should be inserted into
1114 static struct aa_labelset
*labelset_of_merge(struct aa_label
*a
, struct aa_label
*b
)
1116 struct aa_ns
*nsa
= labels_ns(a
);
1117 struct aa_ns
*nsb
= labels_ns(b
);
1119 if (ns_cmp(nsa
, nsb
) <= 0)
1120 return &nsa
->labels
;
1121 return &nsb
->labels
;
1125 * __label_find_merge - find label that is equiv to merge of @a and @b
1126 * @ls: set of labels to search (NOT NULL)
1127 * @a: label to merge with @b (NOT NULL)
1128 * @b: label to merge with @a (NOT NULL)
1130 * Requires: ls->lock read_lock held
1132 * Returns: ref counted label that is equiv to merge of @a and @b
1133 * else NULL if merge of @a and @b is not in set
1135 static struct aa_label
*__label_find_merge(struct aa_labelset
*ls
,
1139 struct rb_node
*node
;
1146 return __label_find(a
);
1148 node
= ls
->root
.rb_node
;
1150 struct aa_label
*this = container_of(node
, struct aa_label
,
1152 int result
= label_merge_cmp(a
, b
, this);
1155 node
= node
->rb_left
;
1156 else if (result
> 0)
1157 node
= node
->rb_right
;
1159 return aa_get_label_not0(this);
1167 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1168 * @a: label to merge with @b (NOT NULL)
1169 * @b: label to merge with @a (NOT NULL)
1171 * Requires: labels be fully constructed with a valid ns
1173 * Returns: ref counted label that is equiv to merge of @a and @b
1174 * else NULL if merge of @a and @b is not in set
1176 struct aa_label
*aa_label_find_merge(struct aa_label
*a
, struct aa_label
*b
)
1178 struct aa_labelset
*ls
;
1179 struct aa_label
*label
, *ar
= NULL
, *br
= NULL
;
1180 unsigned long flags
;
1185 if (label_is_stale(a
))
1186 a
= ar
= aa_get_newest_label(a
);
1187 if (label_is_stale(b
))
1188 b
= br
= aa_get_newest_label(b
);
1189 ls
= labelset_of_merge(a
, b
);
1190 read_lock_irqsave(&ls
->lock
, flags
);
1191 label
= __label_find_merge(ls
, a
, b
);
1192 read_unlock_irqrestore(&ls
->lock
, flags
);
1195 labelsetstats_inc(ls
, msread
);
1201 * aa_label_merge - attempt to insert new merged label of @a and @b
1202 * @ls: set of labels to insert label into (NOT NULL)
1203 * @a: label to merge with @b (NOT NULL)
1204 * @b: label to merge with @a (NOT NULL)
1205 * @gfp: memory allocation type
1207 * Requires: caller to hold valid refs on @a and @b
1208 * labels be fully constructed with a valid ns
1210 * Returns: ref counted new label if successful in inserting merge of a & b
1211 * else ref counted equivalent label that is already in the set.
1212 * else NULL if could not create label (-ENOMEM)
1214 struct aa_label
*aa_label_merge(struct aa_label
*a
, struct aa_label
*b
,
1217 struct aa_label
*label
= NULL
;
1223 return aa_get_newest_label(a
);
1225 /* TODO: enable when read side is lockless
1226 * check if label exists before taking locks
1227 if (!label_is_stale(a) && !label_is_stale(b))
1228 label = aa_label_find_merge(a, b);
1232 struct aa_label
*new;
1234 a
= aa_get_newest_label(a
);
1235 b
= aa_get_newest_label(b
);
1237 /* could use label_merge_len(a, b), but requires double
1238 * comparison for small savings
1240 new = aa_label_alloc(a
->size
+ b
->size
, NULL
, gfp
);
1244 label
= label_merge_insert(new, a
, b
);
1254 static inline bool label_is_visible(struct aa_profile
*profile
,
1255 struct aa_label
*label
)
1257 return aa_ns_visible(profile
->ns
, labels_ns(label
), true);
1260 /* match a profile and its associated ns component if needed
1261 * Assumes visibility test has already been done.
1262 * If a subns profile is not to be matched should be prescreened with
1265 static inline unsigned int match_component(struct aa_profile
*profile
,
1266 struct aa_profile
*tp
,
1269 const char *ns_name
;
1271 if (profile
->ns
== tp
->ns
)
1272 return aa_dfa_match(profile
->policy
.dfa
, state
, tp
->base
.hname
);
1274 /* try matching with namespace name and then profile */
1275 ns_name
= aa_ns_name(profile
->ns
, tp
->ns
, true);
1276 state
= aa_dfa_match_len(profile
->policy
.dfa
, state
, ":", 1);
1277 state
= aa_dfa_match(profile
->policy
.dfa
, state
, ns_name
);
1278 state
= aa_dfa_match_len(profile
->policy
.dfa
, state
, ":", 1);
1279 return aa_dfa_match(profile
->policy
.dfa
, state
, tp
->base
.hname
);
1283 * label_component_match - find perms for full compound label
1284 * @profile: profile to find perms for
1285 * @label: label to check access permissions for
1286 * @start: state to start match in
1287 * @subns: whether to do permission checks on components in a subns
1288 * @request: permissions to request
1289 * @perms: perms struct to set
1291 * Returns: 0 on success else ERROR
1293 * For the label A//&B//&C this does the perm match for A//&B//&C
1294 * @perms should be preinitialized with allperms OR a previous permission
1295 * check to be stacked.
1297 static int label_compound_match(struct aa_profile
*profile
,
1298 struct aa_label
*label
,
1299 unsigned int state
, bool subns
, u32 request
,
1300 struct aa_perms
*perms
)
1302 struct aa_profile
*tp
;
1305 /* find first subcomponent that is visible */
1306 label_for_each(i
, label
, tp
) {
1307 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1309 state
= match_component(profile
, tp
, state
);
1315 /* no component visible */
1320 label_for_each_cont(i
, label
, tp
) {
1321 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1323 state
= aa_dfa_match(profile
->policy
.dfa
, state
, "//&");
1324 state
= match_component(profile
, tp
, state
);
1328 aa_compute_perms(profile
->policy
.dfa
, state
, perms
);
1329 aa_apply_modes_to_perms(profile
, perms
);
1330 if ((perms
->allow
& request
) != request
)
1341 * label_component_match - find perms for all subcomponents of a label
1342 * @profile: profile to find perms for
1343 * @label: label to check access permissions for
1344 * @start: state to start match in
1345 * @subns: whether to do permission checks on components in a subns
1346 * @request: permissions to request
1347 * @perms: an initialized perms struct to add accumulation to
1349 * Returns: 0 on success else ERROR
1351 * For the label A//&B//&C this does the perm match for each of A and B and C
1352 * @perms should be preinitialized with allperms OR a previous permission
1353 * check to be stacked.
1355 static int label_components_match(struct aa_profile
*profile
,
1356 struct aa_label
*label
, unsigned int start
,
1357 bool subns
, u32 request
,
1358 struct aa_perms
*perms
)
1360 struct aa_profile
*tp
;
1362 struct aa_perms tmp
;
1363 unsigned int state
= 0;
1365 /* find first subcomponent to test */
1366 label_for_each(i
, label
, tp
) {
1367 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1369 state
= match_component(profile
, tp
, start
);
1375 /* no subcomponents visible - no change in perms */
1379 aa_compute_perms(profile
->policy
.dfa
, state
, &tmp
);
1380 aa_apply_modes_to_perms(profile
, &tmp
);
1381 aa_perms_accum(perms
, &tmp
);
1382 label_for_each_cont(i
, label
, tp
) {
1383 if (!aa_ns_visible(profile
->ns
, tp
->ns
, subns
))
1385 state
= match_component(profile
, tp
, start
);
1388 aa_compute_perms(profile
->policy
.dfa
, state
, &tmp
);
1389 aa_apply_modes_to_perms(profile
, &tmp
);
1390 aa_perms_accum(perms
, &tmp
);
1393 if ((perms
->allow
& request
) != request
)
1404 * aa_label_match - do a multi-component label match
1405 * @profile: profile to match against (NOT NULL)
1406 * @label: label to match (NOT NULL)
1407 * @state: state to start in
1408 * @subns: whether to match subns components
1409 * @request: permission request
1410 * @perms: Returns computed perms (NOT NULL)
1412 * Returns: the state the match finished in, may be the none matching state
1414 int aa_label_match(struct aa_profile
*profile
, struct aa_label
*label
,
1415 unsigned int state
, bool subns
, u32 request
,
1416 struct aa_perms
*perms
)
1418 int error
= label_compound_match(profile
, label
, state
, subns
, request
,
1424 return label_components_match(profile
, label
, state
, subns
, request
,
1430 * aa_update_label_name - update a label to have a stored name
1431 * @ns: ns being viewed from (NOT NULL)
1432 * @label: label to update (NOT NULL)
1433 * @gfp: type of memory allocation
1435 * Requires: labels_set(label) not locked in caller
1437 * note: only updates the label name if it does not have a name already
1438 * and if it is in the labelset
1440 bool aa_update_label_name(struct aa_ns
*ns
, struct aa_label
*label
, gfp_t gfp
)
1442 struct aa_labelset
*ls
;
1443 unsigned long flags
;
1444 char __counted
*name
;
1450 if (label
->hname
|| labels_ns(label
) != ns
)
1453 if (aa_label_acntsxprint(&name
, ns
, label
, FLAGS_NONE
, gfp
) == -1)
1456 ls
= labels_set(label
);
1457 write_lock_irqsave(&ls
->lock
, flags
);
1458 if (!label
->hname
&& label
->flags
& FLAG_IN_TREE
) {
1459 label
->hname
= name
;
1463 write_unlock_irqrestore(&ls
->lock
, flags
);
1468 /* cached label name is present and visible
1469 * @label->hname only exists if label is namespace hierachical */
1470 static inline bool use_label_hname(struct aa_ns
*ns
, struct aa_label
*label
)
1472 if (label
->hname
&& labels_ns(label
) == ns
)
1478 /* helper macro for snprint routines */
1479 #define update_for_len(total, len, size, str) \
1483 len = min(len, size); \
1489 * aa_profile_snxprint_profile - print a profile name to a buffer
1490 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1491 * @size: size of buffer
1492 * @ns: namespace profile is being viewed from
1493 * @profile: profile to view (NOT NULL)
1494 * @flags: whether to include the mode string
1496 * Returns: size of name written or would be written if larger than
1499 * Note: will not print anything if the profile is not visible
1501 int aa_profile_snxprint(char *str
, size_t size
, struct aa_ns
*ns
,
1502 struct aa_profile
*profile
, int flags
)
1504 const char *ns_name
= "";
1506 AA_BUG(!str
&& size
!= 0);
1510 ns
= profiles_ns(profile
);
1512 if (ns
!= profile
->ns
) {
1513 ns_name
= aa_ns_name(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
);
1514 if (ns_name
== aa_hidden_ns_name
) {
1515 if (flags
& FLAG_HIDDEN_UNCONFINED
)
1516 return snprintf(str
, size
, "%s", "unconfined");
1517 return snprintf(str
, size
, "%s", ns_name
);
1521 if ((flags
& FLAG_SHOW_MODE
) && profile
!= profile
->ns
->unconfined
) {
1522 const char *modestr
= aa_profile_mode_names
[profile
->mode
];
1523 if (strlen(ns_name
))
1524 return snprintf(str
, size
, ":%s://%s (%s)", ns_name
,
1525 profile
->base
.hname
, modestr
);
1526 return snprintf(str
, size
, "%s (%s)", profile
->base
.hname
,
1530 if (strlen(ns_name
))
1531 return snprintf(str
, size
, ":%s://%s", ns_name
,
1532 profile
->base
.hname
);
1533 return snprintf(str
, size
, "%s", profile
->base
.hname
);
1536 static const char *label_modename(struct aa_ns
*ns
, struct aa_label
*label
,
1539 struct aa_profile
*profile
;
1541 int mode
= -1, count
= 0;
1543 label_for_each(i
, label
, profile
) {
1544 if (aa_ns_visible(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
)) {
1545 if (profile
->mode
== APPARMOR_UNCONFINED
)
1546 /* special case unconfined so stacks with
1547 * unconfined don't report as mixed. ie.
1548 * profile_foo//&:ns1://unconfined (mixed)
1553 mode
= profile
->mode
;
1554 else if (mode
!= profile
->mode
)
1562 /* everything was unconfined */
1563 mode
= APPARMOR_UNCONFINED
;
1565 return aa_profile_mode_names
[mode
];
1568 /* if any visible label is not unconfined the display_mode returns true */
1569 static inline bool display_mode(struct aa_ns
*ns
, struct aa_label
*label
,
1572 if ((flags
& FLAG_SHOW_MODE
)) {
1573 struct aa_profile
*profile
;
1576 label_for_each(i
, label
, profile
) {
1577 if (aa_ns_visible(ns
, profile
->ns
,
1578 flags
& FLAG_VIEW_SUBNS
) &&
1579 profile
!= profile
->ns
->unconfined
)
1582 /* only ns->unconfined in set of profiles in ns */
1590 * aa_label_snxprint - print a label name to a string buffer
1591 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1592 * @size: size of buffer
1593 * @ns: namespace profile is being viewed from
1594 * @label: label to view (NOT NULL)
1595 * @flags: whether to include the mode string
1597 * Returns: size of name written or would be written if larger than
1600 * Note: labels do not have to be strictly hierarchical to the ns as
1601 * objects may be shared across different namespaces and thus
1602 * pickup labeling from each ns. If a particular part of the
1603 * label is not visible it will just be excluded. And if none
1604 * of the label is visible "---" will be used.
1606 int aa_label_snxprint(char *str
, size_t size
, struct aa_ns
*ns
,
1607 struct aa_label
*label
, int flags
)
1609 struct aa_profile
*profile
;
1611 int count
= 0, total
= 0;
1614 AA_BUG(!str
&& size
!= 0);
1618 ns
= labels_ns(label
);
1620 label_for_each(i
, label
, profile
) {
1621 if (aa_ns_visible(ns
, profile
->ns
, flags
& FLAG_VIEW_SUBNS
)) {
1623 len
= snprintf(str
, size
, "//&");
1624 update_for_len(total
, len
, size
, str
);
1626 len
= aa_profile_snxprint(str
, size
, ns
, profile
,
1627 flags
& FLAG_VIEW_SUBNS
);
1628 update_for_len(total
, len
, size
, str
);
1634 if (flags
& FLAG_HIDDEN_UNCONFINED
)
1635 return snprintf(str
, size
, "%s", "unconfined");
1636 return snprintf(str
, size
, "%s", aa_hidden_ns_name
);
1639 /* count == 1 && ... is for backwards compat where the mode
1640 * is not displayed for 'unconfined' in the current ns
1642 if (display_mode(ns
, label
, flags
)) {
1643 len
= snprintf(str
, size
, " (%s)",
1644 label_modename(ns
, label
, flags
));
1645 update_for_len(total
, len
, size
, str
);
1650 #undef update_for_len
1653 * aa_label_asxprint - allocate a string buffer and print label into it
1654 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1655 * @ns: namespace profile is being viewed from
1656 * @label: label to view (NOT NULL)
1657 * @flags: flags controlling what label info is printed
1658 * @gfp: kernel memory allocation type
1660 * Returns: size of name written or would be written if larger than
1663 int aa_label_asxprint(char **strp
, struct aa_ns
*ns
, struct aa_label
*label
,
1664 int flags
, gfp_t gfp
)
1671 size
= aa_label_snxprint(NULL
, 0, ns
, label
, flags
);
1675 *strp
= kmalloc(size
+ 1, gfp
);
1678 return aa_label_snxprint(*strp
, size
+ 1, ns
, label
, flags
);
1682 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1683 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1684 * @ns: namespace profile is being viewed from
1685 * @label: label to view (NOT NULL)
1686 * @flags: flags controlling what label info is printed
1687 * @gfp: kernel memory allocation type
1689 * Returns: size of name written or would be written if larger than
1692 int aa_label_acntsxprint(char __counted
**strp
, struct aa_ns
*ns
,
1693 struct aa_label
*label
, int flags
, gfp_t gfp
)
1700 size
= aa_label_snxprint(NULL
, 0, ns
, label
, flags
);
1704 *strp
= aa_str_alloc(size
+ 1, gfp
);
1707 return aa_label_snxprint(*strp
, size
+ 1, ns
, label
, flags
);
1711 void aa_label_xaudit(struct audit_buffer
*ab
, struct aa_ns
*ns
,
1712 struct aa_label
*label
, int flags
, gfp_t gfp
)
1722 ns
= labels_ns(label
);
1724 if (!use_label_hname(ns
, label
) || display_mode(ns
, label
, flags
)) {
1725 labelstats_inc(audit_name_alloc
);
1726 len
= aa_label_asxprint(&name
, ns
, label
, flags
, gfp
);
1728 labelstats_inc(audit_name_fail
);
1729 AA_DEBUG("label print error");
1734 str
= (char *) label
->hname
;
1737 if (audit_string_contains_control(str
, len
))
1738 audit_log_n_hex(ab
, str
, len
);
1740 audit_log_n_string(ab
, str
, len
);
1745 void aa_label_seq_xprint(struct seq_file
*f
, struct aa_ns
*ns
,
1746 struct aa_label
*label
, int flags
, gfp_t gfp
)
1752 ns
= labels_ns(label
);
1754 if (!use_label_hname(ns
, label
)) {
1758 labelstats_inc(seq_print_name_alloc
);
1759 len
= aa_label_asxprint(&str
, ns
, label
, flags
, gfp
);
1761 labelstats_inc(seq_print_name_fail
);
1762 AA_DEBUG("label print error");
1765 seq_printf(f
, "%s", str
);
1767 } else if (display_mode(ns
, label
, flags
))
1768 seq_printf(f
, "%s (%s)", label
->hname
,
1769 label_modename(ns
, label
, flags
));
1771 seq_printf(f
, "%s", label
->hname
);
1774 void aa_label_xprintk(struct aa_ns
*ns
, struct aa_label
*label
, int flags
,
1780 ns
= labels_ns(label
);
1782 if (!use_label_hname(ns
, label
)) {
1786 labelstats_inc(printk_name_alloc
);
1787 len
= aa_label_asxprint(&str
, ns
, label
, flags
, gfp
);
1789 labelstats_inc(printk_name_fail
);
1790 AA_DEBUG("label print error");
1795 } else if (display_mode(ns
, label
, flags
))
1796 printk("%s (%s)", label
->hname
,
1797 label_modename(ns
, label
, flags
));
1799 printk("%s", label
->hname
);
1802 void aa_label_audit(struct audit_buffer
*ab
, struct aa_label
*label
, gfp_t gfp
)
1804 struct aa_ns
*ns
= aa_get_current_ns();
1805 aa_label_xaudit(ab
, ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1809 void aa_label_seq_print(struct seq_file
*f
, struct aa_label
*label
, gfp_t gfp
)
1811 struct aa_ns
*ns
= aa_get_current_ns();
1812 aa_label_seq_xprint(f
, ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1816 void aa_label_printk(struct aa_label
*label
, gfp_t gfp
)
1818 struct aa_ns
*ns
= aa_get_current_ns();
1819 aa_label_xprintk(ns
, label
, FLAG_VIEW_SUBNS
, gfp
);
1823 static int label_count_str_entries(const char *str
)
1830 for (split
= strstr(str
, "//&"); split
; split
= strstr(str
, "//&")) {
1839 * aa_label_parse - parse, validate and convert a text string to a label
1840 * @base: base label to use for lookups (NOT NULL)
1841 * @str: null terminated text string (NOT NULL)
1842 * @gfp: allocation type
1843 * @create: true if should create compound labels if they don't exist
1844 * @force_stack: true if should stack even if no leading &
1846 * Returns: the matching refcounted label if present
1849 struct aa_label
*aa_label_parse(struct aa_label
*base
, const char *str
,
1850 gfp_t gfp
, bool create
, bool force_stack
)
1852 DEFINE_VEC(profile
, vec
);
1853 struct aa_label
*label
;
1854 int i
, len
, stack
= 0, error
;
1860 str
= skip_spaces(str
);
1861 len
= label_count_str_entries(str
);
1862 if (*str
== '&' || force_stack
) {
1863 /* stack on top of base */
1869 error
= vec_setup(profile
, vec
, len
, gfp
);
1871 return ERR_PTR(error
);
1873 for (i
= 0; i
< stack
; i
++)
1874 vec
[i
] = aa_get_profile(base
->vec
[i
]);
1876 for (split
= strstr(str
, "//&"), i
= stack
; split
&& i
< len
; i
++) {
1877 vec
[i
] = aa_fqlookupn_profile(base
, str
, split
- str
);
1881 split
= strstr(str
, "//&");
1883 /* last element doesn't have a split so this should be the case but just to be safe */
1885 vec
[i
] = aa_fqlookupn_profile(base
, str
, strlen(str
));
1890 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1891 return &vec
[0]->label
;
1893 len
-= aa_vec_unique(vec
, len
, VEC_FLAG_TERMINATE
);
1894 /* TODO: deal with reference labels */
1896 label
= aa_get_label(&vec
[0]->label
);
1901 label
= aa_vec_find_or_create_label(vec
, len
, gfp
);
1903 label
= vec_find(vec
, len
);
1908 /* use adjusted len from after vec_unique, not original */
1909 vec_cleanup(profile
, vec
, len
);
1913 label
= ERR_PTR(-ENOENT
);
1919 * aa_labelset_destroy - remove all labels from the label set
1920 * @ls: label set to cleanup (NOT NULL)
1922 * Labels that are removed from the set may still exist beyond the set
1923 * being destroyed depending on their reference counting
1925 void aa_labelset_destroy(struct aa_labelset
*ls
)
1927 struct rb_node
*node
;
1928 unsigned long flags
;
1932 write_lock_irqsave(&ls
->lock
, flags
);
1933 for (node
= rb_first(&ls
->root
); node
; node
= rb_first(&ls
->root
)) {
1934 struct aa_label
*this = rb_entry(node
, struct aa_label
, node
);
1935 if (labels_ns(this) != root_ns
)
1936 __label_remove(this,
1937 ns_unconfined(labels_ns(this)->parent
));
1939 __label_remove(this, NULL
);
1941 write_unlock_irqrestore(&ls
->lock
, flags
);
1945 * @ls: labelset to init (NOT NULL)
1947 void aa_labelset_init(struct aa_labelset
*ls
)
1951 rwlock_init(&ls
->lock
);
1953 labelstats_init(&ls
);
1956 static struct aa_label
*labelset_next_stale(struct aa_labelset
*ls
)
1958 struct aa_label
*label
;
1959 struct rb_node
*node
;
1960 unsigned long flags
;
1964 read_lock_irqsave(&ls
->lock
, flags
);
1966 __labelset_for_each(ls
, node
) {
1967 label
= rb_entry(node
, struct aa_label
, node
);
1968 if ((label_is_stale(label
) || vec_is_stale(label
->vec
, label
->size
)) &&
1969 aa_get_label_not0(label
))
1976 read_unlock_irqrestore(&ls
->lock
, flags
);
1982 * __label_update - insert updated version of @label into labelset
1983 * @label - the label to update/repace
1985 * Returns: new label that is up to date
1986 * else NULL on failure
1988 * Requires: @ns lock be held
1990 * Note: worst case is the stale @label does not get updated and has
1991 * to be updated at a later time.
1993 static struct aa_label
*__label_update(struct aa_label
*label
)
1995 struct aa_label
*new, *tmp
;
1996 struct aa_labelset
*ls
;
1997 unsigned long flags
;
1998 int i
, invcount
= 0;
2001 AA_BUG(!mutex_is_locked(&labels_ns(label
)->lock
));
2003 new = aa_label_alloc(label
->size
, label
->proxy
, GFP_KERNEL
);
2007 /* while holding the ns_lock will stop profile replacement, removal,
2008 * and label updates, label merging and removal can be occuring
2010 ls
= labels_set(label
);
2011 write_lock_irqsave(&ls
->lock
, flags
);
2012 for (i
= 0; i
< label
->size
; i
++) {
2013 AA_BUG(!label
->vec
[i
]);
2014 new->vec
[i
] = aa_get_newest_profile(label
->vec
[i
]);
2015 AA_BUG(!new->vec
[i
]);
2016 AA_BUG(!new->vec
[i
]->label
.proxy
);
2017 AA_BUG(!new->vec
[i
]->label
.proxy
->label
);
2018 if (new->vec
[i
]->label
.proxy
!= label
->vec
[i
]->label
.proxy
)
2022 /* updated stale label by being removed/renamed from labelset */
2024 new->size
-= aa_vec_unique(&new->vec
[0], new->size
,
2025 VEC_FLAG_TERMINATE
);
2026 /* TODO: deal with reference labels */
2027 if (new->size
== 1) {
2028 tmp
= aa_get_label(&new->vec
[0]->label
);
2029 AA_BUG(tmp
== label
);
2032 if (labels_set(label
) != labels_set(new)) {
2033 write_unlock_irqrestore(&ls
->lock
, flags
);
2034 tmp
= aa_label_insert(labels_set(new), new);
2035 write_lock_irqsave(&ls
->lock
, flags
);
2039 AA_BUG(labels_ns(label
) != labels_ns(new));
2041 tmp
= __label_insert(labels_set(label
), new, true);
2043 /* ensure label is removed, and redirected correctly */
2044 __label_remove(label
, tmp
);
2045 write_unlock_irqrestore(&ls
->lock
, flags
);
2053 * __labelset_update - update labels in @ns
2054 * @ns: namespace to update labels in (NOT NULL)
2056 * Requires: @ns lock be held
2058 * Walk the labelset ensuring that all labels are up to date and valid
2059 * Any label that has a stale component is marked stale and replaced and
2060 * by an updated version.
2062 * If failures happen due to memory pressures then stale labels will
2063 * be left in place until the next pass.
2065 static void __labelset_update(struct aa_ns
*ns
)
2067 struct aa_label
*label
;
2070 AA_BUG(!mutex_is_locked(&ns
->lock
));
2073 label
= labelset_next_stale(&ns
->labels
);
2076 l
= __label_update(label
);
2078 aa_put_label(label
);
2084 * __aa_labelset_udate_subtree - update all labels with a stale component
2085 * @ns: ns to start update at (NOT NULL)
2087 * Requires: @ns lock be held
2089 * Invalidates labels based on @p in @ns and any children namespaces.
2091 void __aa_labelset_update_subtree(struct aa_ns
*ns
)
2093 struct aa_ns
*child
;
2096 AA_BUG(!mutex_is_locked(&ns
->lock
));
2098 __labelset_update(ns
);
2100 list_for_each_entry(child
, &ns
->sub_ns
, base
.list
) {
2101 mutex_lock(&child
->lock
);
2102 __aa_labelset_update_subtree(child
);
2103 mutex_unlock(&child
->lock
);