Something went wrong. Try again.
(I'm so sorry!) Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171// SPDX-License-Identifier: GPL-2.0-only/* * AppArmor security module * * This file contains AppArmor label definitions * * Copyright 2017 Canonical Ltd. */
#include <linux/audit.h>#include <linux/seq_file.h>#include <linux/sort.h>
#include "include/apparmor.h"#include "include/cred.h"#include "include/label.h"#include "include/policy.h"#include "include/secid.h"
/* * the aa_label represents the set of profiles confining an object * * Labels maintain a reference count to the set of pointers they reference * Labels are ref counted by * tasks and object via the security field/security context off the field * code - will take a ref count on a label if it needs the label * beyond what is possible with an rcu_read_lock. * profiles - each profile is a label * secids - a pinned secid will keep a refcount of the label it is * referencing * objects - inode, files, sockets, ... * * Labels are not ref counted by the label set, so they maybe removed and * freed when no longer in use. * */
#define PROXY_POISON 97#define LABEL_POISON 100
static void free_proxy(struct aa_proxy *proxy){ if (proxy) { /* p->label will not updated any more as p is dead */ aa_put_label(rcu_dereference_protected(proxy->label, true)); memset(proxy, 0, sizeof(*proxy)); RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); kfree(proxy); }}
void aa_proxy_kref(struct kref *kref){ struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count.count);
free_proxy(proxy);}
struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp){ struct aa_proxy *new;
new = kzalloc_obj(struct aa_proxy, gfp); if (new) { kref_init(&new->count.count); new->count.reftype = REF_PROXY; rcu_assign_pointer(new->label, aa_get_label(label)); } return new;}
/* requires profile list write lock held */void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new){ struct aa_label *tmp;
AA_BUG(!orig); AA_BUG(!new); lockdep_assert_held_write(&labels_set(orig)->lock);
tmp = rcu_dereference_protected(orig->proxy->label, &labels_ns(orig)->lock); rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); __label_make_stale(orig); aa_put_label(tmp);}
static void __proxy_share(struct aa_label *old, struct aa_label *new){ struct aa_proxy *proxy = new->proxy;
new->proxy = aa_get_proxy(old->proxy); __aa_proxy_redirect(old, new); aa_put_proxy(proxy);}
/** * ns_cmp - compare ns for label set ordering * @a: ns to compare (NOT NULL) * @b: ns to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int ns_cmp(struct aa_ns *a, struct aa_ns *b){ int res;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!a->base.hname); AA_BUG(!b->base.hname);
if (a == b) return 0;
res = a->level - b->level; if (res) return res;
return strcmp(a->base.hname, b->base.hname);}
/** * profile_cmp - profile comparison for set ordering * @a: profile to compare (NOT NULL) * @b: profile to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int profile_cmp(struct aa_profile *a, struct aa_profile *b){ int res;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!a->ns); AA_BUG(!b->ns); AA_BUG(!a->base.hname); AA_BUG(!b->base.hname);
if (a == b || a->base.hname == b->base.hname) return 0; res = ns_cmp(a->ns, b->ns); if (res) return res;
return strcmp(a->base.hname, b->base.hname);}
/** * vec_cmp - label comparison for set ordering * @a: aa_profile to compare (NOT NULL) * @an: length of @a * @b: aa_profile to compare (NOT NULL) * @bn: length of @b * * Returns: <0 if @a < @b * ==0 if @a == @b * >0 if @a > @b */static int vec_cmp(struct aa_profile * const *a, int an, struct aa_profile * const *b, int bn){ int i;
AA_BUG(!a); AA_BUG(!*a); AA_BUG(!b); AA_BUG(!*b); AA_BUG(an <= 0); AA_BUG(bn <= 0);
for (i = 0; i < an && i < bn; i++) { int res = profile_cmp(a[i], b[i]);
if (res != 0) return res; }
return an - bn;}
static bool vec_is_stale(struct aa_profile **vec, int n){ int i;
AA_BUG(!vec);
for (i = 0; i < n; i++) { if (profile_is_stale(vec[i])) return true; }
return false;}
static void accum_label_info(struct aa_label *new){ long u = FLAG_UNCONFINED; int i;
AA_BUG(!new);
/* size == 1 is a profile and flags must be set as part of creation */ if (new->size == 1) return;
for (i = 0; i < new->size; i++) { u |= new->vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 | FLAG_STALE); if (!(u & new->vec[i]->label.flags & FLAG_UNCONFINED)) u &= ~FLAG_UNCONFINED; new->mediates |= new->vec[i]->label.mediates; } new->flags |= u;}
static int sort_cmp(const void *a, const void *b){ return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);}
/* * assumes vec is sorted * Assumes @vec has null terminator at vec[n], and will null terminate * vec[n - dups] */static inline int unique(struct aa_profile **vec, int n){ int i, pos, dups = 0;
AA_BUG(n < 1); AA_BUG(!vec);
pos = 0; for (i = 1; i < n; i++) { int res = profile_cmp(vec[pos], vec[i]);
AA_BUG(res > 0, "vec not sorted"); if (res == 0) { /* drop duplicate */ aa_put_profile(vec[i]); dups++; continue; } pos++; if (dups) vec[pos] = vec[i]; }
AA_BUG(dups < 0);
return dups;}
/** * aa_vec_unique - canonical sort and unique a list of profiles * @n: number of refcounted profiles in the list (@n > 0) * @vec: list of profiles to sort and merge * @flags: null terminator flags of @vec * * Returns: the number of duplicates eliminated == references put * * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will * null terminate vec[n - dups] */int aa_vec_unique(struct aa_profile **vec, int n, int flags){ int i, dups = 0;
AA_BUG(n < 1); AA_BUG(!vec);
/* vecs are usually small and inorder, have a fallback for larger */ if (n > 8) { sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL); dups = unique(vec, n); goto out; }
/* insertion sort + unique in one */ for (i = 1; i < n; i++) { struct aa_profile *tmp = vec[i]; int pos, j;
for (pos = i - 1 - dups; pos >= 0; pos--) { int res = profile_cmp(vec[pos], tmp);
if (res == 0) { /* drop duplicate entry */ aa_put_profile(tmp); dups++; goto continue_outer; } else if (res < 0) break; } /* pos is at entry < tmp, or index -1. Set to insert pos */ pos++;
for (j = i - dups; j > pos; j--) vec[j] = vec[j - 1]; vec[pos] = tmp;continue_outer: ; }
AA_BUG(dups < 0);
out: if (flags & VEC_FLAG_TERMINATE) vec[n - dups] = NULL;
return dups;}
void aa_label_destroy(struct aa_label *label){ AA_BUG(!label);
if (!label_isprofile(label)) { struct aa_profile *profile; struct label_it i;
aa_put_str(label->hname);
label_for_each(i, label, profile) { aa_put_profile(profile); label->vec[i.i] = (struct aa_profile *) (LABEL_POISON + (long) i.i); } }
if (label->proxy) { if (rcu_dereference_protected(label->proxy->label, true) == label) rcu_assign_pointer(label->proxy->label, NULL); aa_put_proxy(label->proxy); } aa_free_secid(label->secid);
label->proxy = (struct aa_proxy *) PROXY_POISON + 1;}
void aa_label_free(struct aa_label *label){ if (!label) return;
aa_label_destroy(label); kfree(label);}
static void label_free_switch(struct aa_label *label){ if (label->flags & FLAG_NS_COUNT) aa_free_ns(labels_ns(label)); else if (label_isprofile(label)) aa_free_profile(labels_profile(label)); else aa_label_free(label);}
static void label_free_rcu(struct rcu_head *head){ struct aa_label *label = container_of(head, struct aa_label, rcu);
if (label->flags & FLAG_IN_TREE) (void) aa_label_remove(label); label_free_switch(label);}
void aa_label_kref(struct kref *kref){ struct aa_label *label = container_of(kref, struct aa_label, count.count); struct aa_ns *ns = labels_ns(label);
if (!ns) { /* never live, no rcu callback needed, just using the fn */ label_free_switch(label); return; } /* TODO: update labels_profile macro so it works here */ AA_BUG(label_isprofile(label) && on_list_rcu(&label->vec[0]->base.profiles)); AA_BUG(label_isprofile(label) && on_list_rcu(&label->vec[0]->base.list));
/* TODO: if compound label and not stale add to reclaim cache */ call_rcu(&label->rcu, label_free_rcu);}
static void label_free_or_put_new(struct aa_label *label, struct aa_label *new){ if (label != new) /* need to free directly to break circular ref with proxy */ aa_label_free(new); else aa_put_label(new);}
bool aa_label_init(struct aa_label *label, int size, gfp_t gfp){ AA_BUG(!label); AA_BUG(size < 1);
if (aa_alloc_secid(label, gfp) < 0) return false;
label->size = size; /* doesn't include null */ label->vec[size] = NULL; /* null terminate */ kref_init(&label->count.count); label->count.reftype = REF_NS; /* for aafs purposes */ RB_CLEAR_NODE(&label->node);
return true;}
/** * aa_label_alloc - allocate a label with a profile vector of @size length * @size: size of profile vector in the label * @proxy: proxy to use OR null if to allocate a new one * @gfp: memory allocation type * * Returns: new label * else NULL if failed */struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp){ struct aa_label *new;
AA_BUG(size < 1);
/* + 1 for null terminator entry on vec */ new = kzalloc_flex(*new, vec, size + 1, gfp); AA_DEBUG(DEBUG_LABEL, "%s (%p)\n", __func__, new); if (!new) goto fail;
if (!aa_label_init(new, size, gfp)) goto fail;
if (!proxy) { proxy = aa_alloc_proxy(new, gfp); if (!proxy) goto fail; } else aa_get_proxy(proxy); /* just set new's proxy, don't redirect proxy here if it was passed in*/ new->proxy = proxy;
return new;
fail: aa_label_free(new);
return NULL;}
/** * label_cmp - label comparison for set ordering * @a: label to compare (NOT NULL) * @b: label to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int label_cmp(const struct aa_label *a, const struct aa_label *b){ AA_BUG(!b);
if (a == b) return 0;
return vec_cmp(a->vec, a->size, b->vec, b->size);}
/* helper fn for label_for_each_confined */int aa_label_next_confined(const struct aa_label *label, int i){ AA_BUG(!label); AA_BUG(i < 0);
for (; i < label->size; i++) { if (!profile_unconfined(label->vec[i])) return i; }
return i;}
/** * __aa_label_next_not_in_set - return the next profile of @sub not in @set * @I: label iterator * @set: label to test against * @sub: label to if is subset of @set * * Returns: profile in @sub that is not in @set, with iterator set pos after * else NULL if @sub is a subset of @set */struct aa_profile *__aa_label_next_not_in_set(struct label_it *I, const struct aa_label *set, const struct aa_label *sub){ AA_BUG(!set); AA_BUG(!I); AA_BUG(I->i < 0); AA_BUG(I->i > set->size); AA_BUG(!sub); AA_BUG(I->j < 0); AA_BUG(I->j > sub->size);
while (I->j < sub->size && I->i < set->size) { int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
if (res == 0) { (I->j)++; (I->i)++; } else if (res > 0) (I->i)++; else return sub->vec[(I->j)++]; }
if (I->j < sub->size) return sub->vec[(I->j)++];
return NULL;}
/** * aa_label_is_subset - test if @sub is a subset of @set * @set: label to test against * @sub: label to test if is subset of @set * * Returns: true if @sub is subset of @set * else false */bool aa_label_is_subset(const struct aa_label *set, const struct aa_label *sub){ struct label_it i = { };
AA_BUG(!set); AA_BUG(!sub);
if (sub == set) return true;
return __aa_label_next_not_in_set(&i, set, sub) == NULL;}
/** * aa_label_is_unconfined_subset - test if @sub is a subset of @set * @set: label to test against * @sub: label to test if is subset of @set * * This checks for subset but taking into account unconfined. IF * @sub contains an unconfined profile that does not have a matching * unconfined in @set then this will not cause the test to fail. * Conversely we don't care about an unconfined in @set that is not in * @sub * * Returns: true if @sub is special_subset of @set * else false */bool aa_label_is_unconfined_subset(const struct aa_label *set, const struct aa_label *sub){ struct label_it i = { }; struct aa_profile *p;
AA_BUG(!set); AA_BUG(!sub);
if (sub == set) return true;
do { p = __aa_label_next_not_in_set(&i, set, sub); if (p && !profile_unconfined(p)) break; } while (p);
return p == NULL;}
/** * __label_remove - remove @label from the label set * @label: label to remove * @new: label to redirect to * * Requires: labels_set(@label)->lock write_lock * Returns: true if the label was in the tree and removed */static bool __label_remove(struct aa_label *label, struct aa_label *new){ struct aa_labelset *ls = labels_set(label);
AA_BUG(!ls); AA_BUG(!label); lockdep_assert_held_write(&ls->lock);
if (new) __aa_proxy_redirect(label, new);
if (!label_is_stale(label)) __label_make_stale(label);
if (label->flags & FLAG_IN_TREE) { rb_erase(&label->node, &ls->root); label->flags &= ~FLAG_IN_TREE; return true; }
return false;}
/** * __label_replace - replace @old with @new in label set * @old: label to remove from label set * @new: label to replace @old with * * Requires: labels_set(@old)->lock write_lock * valid ref count be held on @new * Returns: true if @old was in set and replaced by @new * * Note: current implementation requires label set be order in such a way * that @new directly replaces @old position in the set (ie. * using pointer comparison of the label address would not work) */static bool __label_replace(struct aa_label *old, struct aa_label *new){ struct aa_labelset *ls = labels_set(old);
AA_BUG(!ls); AA_BUG(!old); AA_BUG(!new); lockdep_assert_held_write(&ls->lock); AA_BUG(new->flags & FLAG_IN_TREE);
if (!label_is_stale(old)) __label_make_stale(old);
if (old->flags & FLAG_IN_TREE) { rb_replace_node(&old->node, &new->node, &ls->root); old->flags &= ~FLAG_IN_TREE; new->flags |= FLAG_IN_TREE; accum_label_info(new); return true; }
return false;}
/** * __label_insert - attempt to insert @l into a label set * @ls: set of labels to insert @l into (NOT NULL) * @label: new label to insert (NOT NULL) * @replace: whether insertion should replace existing entry that is not stale * * Requires: @ls->lock * caller to hold a valid ref on l * if @replace is true l has a preallocated proxy associated * Returns: @l if successful in inserting @l - with additional refcount * else ref counted equivalent label that is already in the set, * the else condition only happens if @replace is false */static struct aa_label *__label_insert(struct aa_labelset *ls, struct aa_label *label, bool replace){ struct rb_node **new, *parent = NULL;
AA_BUG(!ls); AA_BUG(!label); AA_BUG(labels_set(label) != ls); lockdep_assert_held_write(&ls->lock); AA_BUG(label->flags & FLAG_IN_TREE);
/* Figure out where to put new node */ new = &ls->root.rb_node; while (*new) { struct aa_label *this = rb_entry(*new, struct aa_label, node); int result = label_cmp(label, this);
parent = *new; if (result == 0) { /* !__aa_get_label means queued for destruction, * so replace in place, however the label has * died before the replacement so do not share * the proxy */ if (!replace && !label_is_stale(this)) { if (__aa_get_label(this)) return this; } else __proxy_share(this, label); AA_BUG(!__label_replace(this, label)); return aa_get_label(label); } else if (result < 0) new = &((*new)->rb_left); else /* (result > 0) */ new = &((*new)->rb_right); }
/* Add new node and rebalance tree. */ rb_link_node(&label->node, parent, new); rb_insert_color(&label->node, &ls->root); label->flags |= FLAG_IN_TREE; accum_label_info(label);
return aa_get_label(label);}
/** * __vec_find - find label that matches @vec in label set * @vec: vec of profiles to find matching label for (NOT NULL) * @n: length of @vec * * Requires: @vec_labelset(vec) lock held * caller to hold a valid ref on l * * Returns: ref counted @label if matching label is in tree * ref counted label that is equiv to @l in tree * else NULL if @vec equiv is not in tree */static struct aa_label *__vec_find(struct aa_profile **vec, int n){ struct rb_node *node;
AA_BUG(!vec); AA_BUG(!*vec); AA_BUG(n <= 0);
node = vec_labelset(vec, n)->root.rb_node; while (node) { struct aa_label *this = rb_entry(node, struct aa_label, node); int result = vec_cmp(this->vec, this->size, vec, n);
if (result > 0) node = node->rb_left; else if (result < 0) node = node->rb_right; else return __aa_get_label(this); }
return NULL;}
/** * __label_find - find label @label in label set * @label: label to find (NOT NULL) * * Requires: labels_set(@label)->lock held * caller to hold a valid ref on l * * Returns: ref counted @label if @label is in tree OR * ref counted label that is equiv to @label in tree * else NULL if @label or equiv is not in tree */static struct aa_label *__label_find(struct aa_label *label){ AA_BUG(!label);
return __vec_find(label->vec, label->size);}
/** * aa_label_remove - remove a label from the labelset * @label: label to remove * * Returns: true if @label was removed from the tree * else @label was not in tree so it could not be removed */bool aa_label_remove(struct aa_label *label){ struct aa_labelset *ls = labels_set(label); unsigned long flags; bool res;
AA_BUG(!ls);
write_lock_irqsave(&ls->lock, flags); res = __label_remove(label, ns_unconfined(labels_ns(label))); write_unlock_irqrestore(&ls->lock, flags);
return res;}
enum ls_lock_class { AA_LS_LOCK_FIRST, AA_LS_LOCK_SECOND,};
#define write_lock_irqsave_nested(L, F, SC) write_lock_irqsave(L, F)
static void ns_ls_double_lock(struct aa_ns *ns1, struct aa_ns *ns2, unsigned long *flags){ if (likely(ns1 == ns2)) { write_lock_irqsave(&ns1->labels.lock, *flags); return; }
/* ordered by namespace hierarchy (walked in nesting order in * labels_update. If at the same level by address order */ if ((ns1->level > ns2->level) || (ns1->level == ns2->level && ns1 > ns2)) swap(ns1, ns2);
write_lock_irqsave_nested(&ns1->labels.lock, *flags, AA_LS_LOCK_FIRST); write_lock_nested(&ns2->labels.lock, AA_LS_LOCK_SECOND);}
static void ns_ls_double_unlock(struct aa_ns *ns1, struct aa_ns *ns2, unsigned long flags){ if (likely(ns1 == ns2)) { write_unlock_irqrestore(&ns1->labels.lock, flags); return; } /* order doesn't matter on unlock, except flags restore must be last */ write_unlock(&ns2->labels.lock); write_unlock_irqrestore(&ns1->labels.lock, flags);}
/** * aa_label_replace - replace a label @old with a new version @new * @old: label to replace * @new: label replacing @old * * Returns: true if @old was in tree and replaced * else @old was not in tree, and @new was not inserted * * replacement can involve two different labelsets so has to be * handled very careful, as a double lock may be required. */bool aa_label_replace(struct aa_label *old, struct aa_label *new){ struct aa_ns *ons = labels_ns(old); struct aa_ns *nns = labels_ns(new); unsigned long flags; bool res;
ns_ls_double_lock(ons, nns, &flags); if (ons == nns && name_is_shared(old, new)) { if (old->proxy != new->proxy) __proxy_share(old, new); else __aa_proxy_redirect(old, new); res = __label_replace(old, new); } else { struct aa_label *l;
/* will redirect old proxy to new */ res = __label_remove(old, new); l = __label_insert(&nns->labels, new, true); res = (l == new); aa_put_label(l); } ns_ls_double_unlock(ons, nns, flags);
return res;}
/** * vec_find - find label @l in label set * @vec: array of profiles to find equiv label for (NOT NULL) * @n: length of @vec * * Returns: refcounted label if @vec equiv is in tree * else NULL if @vec equiv is not in tree */static struct aa_label *vec_find(struct aa_profile **vec, int n){ struct aa_labelset *ls; struct aa_label *label; unsigned long flags;
AA_BUG(!vec); AA_BUG(!*vec); AA_BUG(n <= 0);
ls = vec_labelset(vec, n); read_lock_irqsave(&ls->lock, flags); label = __vec_find(vec, n); read_unlock_irqrestore(&ls->lock, flags);
return label;}
/* requires sort and merge done first */static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec, int len, gfp_t gfp){ struct aa_label *label = NULL; struct aa_labelset *ls; unsigned long flags; struct aa_label *new; int i;
AA_BUG(!vec);
if (len == 1) return aa_get_label(&vec[0]->label);
ls = labels_set(&vec[len - 1]->label);
/* TODO: enable when read side is lockless * check if label exists before taking locks */ new = aa_label_alloc(len, NULL, gfp); if (!new) return NULL;
for (i = 0; i < len; i++) new->vec[i] = aa_get_profile(vec[i]);
write_lock_irqsave(&ls->lock, flags); label = __label_insert(ls, new, false); write_unlock_irqrestore(&ls->lock, flags); label_free_or_put_new(label, new);
return label;}
struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len, gfp_t gfp){ struct aa_label *label = vec_find(vec, len);
if (label) return label;
return vec_create_and_insert_label(vec, len, gfp);}
/** * aa_label_insert - insert label @label into @ls or return existing label * @ls: labelset to insert @label into * @label: label to insert * * Requires: caller to hold a valid ref on @label * * Returns: ref counted @label if successful in inserting @label * else ref counted equivalent label that is already in the set */struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label){ struct aa_label *l; unsigned long flags;
AA_BUG(!ls); AA_BUG(!label);
/* check if label exists before taking lock */ if (!label_is_stale(label)) { read_lock_irqsave(&ls->lock, flags); l = __label_find(label); read_unlock_irqrestore(&ls->lock, flags); if (l) return l; }
write_lock_irqsave(&ls->lock, flags); l = __label_insert(ls, label, false); write_unlock_irqrestore(&ls->lock, flags);
return l;}
/** * aa_label_next_in_merge - find the next profile when merging @a and @b * @I: label iterator * @a: label to merge * @b: label to merge * * Returns: next profile * else null if no more profiles */struct aa_profile *aa_label_next_in_merge(struct label_it *I, const struct aa_label *a, const struct aa_label *b){ AA_BUG(!a); AA_BUG(!b); AA_BUG(!I); AA_BUG(I->i < 0); AA_BUG(I->i > a->size); AA_BUG(I->j < 0); AA_BUG(I->j > b->size);
if (I->i < a->size) { if (I->j < b->size) { int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
if (res > 0) return b->vec[(I->j)++]; if (res == 0) (I->j)++; }
return a->vec[(I->i)++]; }
if (I->j < b->size) return b->vec[(I->j)++];
return NULL;}
/** * label_merge_cmp - cmp of @a merging with @b against @z for set ordering * @a: label to merge then compare (NOT NULL) * @b: label to merge then compare (NOT NULL) * @z: label to compare merge against (NOT NULL) * * Assumes: using the most recent versions of @a, @b, and @z * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int label_merge_cmp(struct aa_label *a, struct aa_label *b, struct aa_label *z){ struct aa_profile *p = NULL; struct label_it i = { }; int k;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!z);
for (k = 0; k < z->size && (p = aa_label_next_in_merge(&i, a, b)); k++) { int res = profile_cmp(p, z->vec[k]);
if (res != 0) return res; }
if (p) return 1; else if (k < z->size) return -1; return 0;}
/** * label_merge_insert - create a new label by merging @a and @b * @new: preallocated label to merge into (NOT NULL) * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: preallocated proxy * * Returns: ref counted label either @new if merge is unique * @a if @b is a subset of @a * @b if @a is a subset of @b * * NOTE: will not use @new if the merge results in @new == @a or @b * * Must be used within labelset write lock to avoid racing with * setting labels stale. */static struct aa_label *label_merge_insert(struct aa_label *new, struct aa_label *a, struct aa_label *b){ struct aa_label *label; struct aa_labelset *ls; struct aa_profile *next; struct label_it i; unsigned long flags; int k = 0, invcount = 0; bool stale = false;
AA_BUG(!a); AA_BUG(a->size < 0); AA_BUG(!b); AA_BUG(b->size < 0); AA_BUG(!new); AA_BUG(new->size < a->size + b->size);
label_for_each_in_merge(i, a, b, next) { AA_BUG(!next); if (profile_is_stale(next)) { new->vec[k] = aa_get_newest_profile(next); AA_BUG(!new->vec[k]->label.proxy); AA_BUG(!new->vec[k]->label.proxy->label); if (next->label.proxy != new->vec[k]->label.proxy) invcount++; k++; stale = true; } else new->vec[k++] = aa_get_profile(next); } /* set to actual size which is <= allocated len */ new->size = k; new->vec[k] = NULL;
if (invcount) { new->size -= aa_vec_unique(&new->vec[0], new->size, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (new->size == 1) { label = aa_get_label(&new->vec[0]->label); return label; } } else if (!stale) { /* * merge could be same as a || b, note: it is not possible * for new->size == a->size == b->size unless a == b */ if (k == a->size) return aa_get_label(a); else if (k == b->size) return aa_get_label(b); } ls = labels_set(new); write_lock_irqsave(&ls->lock, flags); label = __label_insert(labels_set(new), new, false); write_unlock_irqrestore(&ls->lock, flags);
return label;}
/** * labelset_of_merge - find which labelset a merged label should be inserted * @a: label to merge and insert * @b: label to merge and insert * * Returns: labelset that the merged label should be inserted into */static struct aa_labelset *labelset_of_merge(struct aa_label *a, struct aa_label *b){ struct aa_ns *nsa = labels_ns(a); struct aa_ns *nsb = labels_ns(b);
if (ns_cmp(nsa, nsb) <= 0) return &nsa->labels; return &nsb->labels;}
/** * __label_find_merge - find label that is equiv to merge of @a and @b * @ls: set of labels to search (NOT NULL) * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: ls->lock read_lock held * * Returns: ref counted label that is equiv to merge of @a and @b * else NULL if merge of @a and @b is not in set */static struct aa_label *__label_find_merge(struct aa_labelset *ls, struct aa_label *a, struct aa_label *b){ struct rb_node *node;
AA_BUG(!ls); AA_BUG(!a); AA_BUG(!b);
if (a == b) return __label_find(a);
node = ls->root.rb_node; while (node) { struct aa_label *this = container_of(node, struct aa_label, node); int result = label_merge_cmp(a, b, this);
if (result < 0) node = node->rb_left; else if (result > 0) node = node->rb_right; else return __aa_get_label(this); }
return NULL;}
/** * aa_label_find_merge - find label that is equiv to merge of @a and @b * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: labels be fully constructed with a valid ns * * Returns: ref counted label that is equiv to merge of @a and @b * else NULL if merge of @a and @b is not in set */struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b){ struct aa_labelset *ls; struct aa_label *label; unsigned long flags; bool a_needput, b_needput;
AA_BUG(!a); AA_BUG(!b);
a = aa_get_newest_label_condref(a, &a_needput); b = aa_get_newest_label_condref(b, &b_needput); ls = labelset_of_merge(a, b); read_lock_irqsave(&ls->lock, flags); label = __label_find_merge(ls, a, b); read_unlock_irqrestore(&ls->lock, flags); aa_put_label_condref(a, a_needput); aa_put_label_condref(b, b_needput);
return label;}
/** * aa_label_merge - attempt to insert new merged label of @a and @b * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * @gfp: memory allocation type * * Requires: caller to hold valid refs on @a and @b * labels be fully constructed with a valid ns * * Returns: ref counted new label if successful in inserting merge of a & b * else ref counted equivalent label that is already in the set. * else NULL if could not create label (-ENOMEM) */struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b, gfp_t gfp){ struct aa_label *label = NULL;
AA_BUG(!a); AA_BUG(!b);
if (a == b) return aa_get_newest_label(a);
/* TODO: enable when read side is lockless * check if label exists before taking locks if (!label_is_stale(a) && !label_is_stale(b)) label = aa_label_find_merge(a, b); */
if (!label) { struct aa_label *new; bool a_needput, b_needput;
a = aa_get_newest_label_condref(a, &a_needput); b = aa_get_newest_label_condref(b, &b_needput);
/* could use label_merge_len(a, b), but requires double * comparison for small savings */ new = aa_label_alloc(a->size + b->size, NULL, gfp); if (!new) goto out;
label = label_merge_insert(new, a, b); label_free_or_put_new(label, new);out: aa_put_label_condref(a, a_needput); aa_put_label_condref(b, b_needput); }
return label;}
/* match a profile and its associated ns component if needed * Assumes visibility test has already been done. * If a subns profile is not to be matched should be prescreened with * visibility test. */static inline aa_state_t match_component(const struct aa_profile *profile, struct aa_ruleset *rules, const struct aa_profile *tp, aa_state_t state){ const char *ns_name;
if (profile->ns == tp->ns) return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
/* try matching with namespace name and then profile */ ns_name = aa_ns_name(profile->ns, tp->ns, true); state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); state = aa_dfa_match(rules->policy->dfa, state, ns_name); state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);}
/** * label_compound_match - find perms for full compound label * @profile: profile to find perms for * @rules: ruleset to search * @label: label to check access permissions for * @state: state to start match in * @inview: whether to match labels in view or only in scope * @request: permissions to request * @perms: perms struct to set * * Returns: state match stopped at or DFA_NOMATCH if aborted early * * For the label A//&B//&C this does the perm match for A//&B//&C * @perms should be preinitialized with allperms OR a previous permission * check to be stacked. */static int label_compound_match(const struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t state, bool inview, u32 request, struct aa_perms *perms){ struct aa_profile *tp; struct label_it i;
/* find first subcomponent that is visible */ label_for_each(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, state); if (!state) goto fail; goto next; }
/* no component visible */ *perms = allperms; return state;
next: label_for_each_cont(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = aa_dfa_match(rules->policy->dfa, state, "//&"); state = match_component(profile, rules, tp, state); if (!state) goto fail; } *perms = *aa_lookup_perms(rules->policy, state); return state;
fail: *perms = nullperms; return DFA_NOMATCH;}
/** * label_components_match - find perms for all subcomponents of a label * @profile: profile to find perms for * @rules: ruleset to search * @label: label to check access permissions for * @start: state to start match in * @inview: whether to match labels in view or only in scope * @request: permissions to request * @perms: an initialized perms struct to add accumulation to * * Returns: the state the match finished in, may be the none matching state * * For the label A//&B//&C this does the perm match for each of A and B and C * @perms should be preinitialized with allperms OR a previous permission * check to be stacked. */static int label_components_match(const struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t start, bool inview, u32 request, struct aa_perms *perms){ struct aa_profile *tp; struct label_it i; struct aa_perms tmp; aa_state_t state = 0;
/* find first subcomponent to test */ label_for_each(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, start); if (!state) goto fail; goto next; }
/* no subcomponents visible - no change in perms */ return state;
next: tmp = *aa_lookup_perms(rules->policy, state); aa_perms_accum(perms, &tmp); label_for_each_cont(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, start); if (!state) goto fail; tmp = *aa_lookup_perms(rules->policy, state); aa_perms_accum(perms, &tmp); }
if ((perms->allow & request) != request) return DFA_NOMATCH;
return state;
fail: *perms = nullperms; return DFA_NOMATCH;}
/** * aa_label_match - do a multi-component label match * @profile: profile to match against (NOT NULL) * @rules: ruleset to search * @label: label to match (NOT NULL) * @state: state to start in * @inview: whether to match labels in view or only in scope * @request: permission request * @perms: Returns computed perms (NOT NULL) * * Returns: the state the match finished in, may be the none matching state */int aa_label_match(const struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t state, bool inview, u32 request, struct aa_perms *perms){ aa_state_t tmp = label_compound_match(profile, rules, label, state, inview, request, perms); if ((perms->allow & request) == request) return tmp;
/* failed compound_match try component matches */ *perms = allperms; return label_components_match(profile, rules, label, state, inview, request, perms);}
/** * aa_update_label_name - update a label to have a stored name * @ns: ns being viewed from (NOT NULL) * @label: label to update (NOT NULL) * @gfp: type of memory allocation * * Requires: labels_set(label) not locked in caller * * note: only updates the label name if it does not have a name already * and if it is in the labelset */bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp){ struct aa_labelset *ls; unsigned long flags; char __counted *name; bool res = false;
AA_BUG(!ns); AA_BUG(!label);
if (label->hname || labels_ns(label) != ns) return res;
if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) return res;
ls = labels_set(label); write_lock_irqsave(&ls->lock, flags); if (!label->hname && label->flags & FLAG_IN_TREE) { label->hname = name; res = true; } else aa_put_str(name); write_unlock_irqrestore(&ls->lock, flags);
return res;}
/* * cached label name is present and visible * @label->hname only exists if label is namespace hierarchical */static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, int flags){ if (label->hname && (!ns || labels_ns(label) == ns) && !(flags & ~FLAG_SHOW_MODE)) return true;
return false;}
/* helper macro for snprint routines */#define update_for_len(total, len, size, str) \do { \ size_t ulen = len; \ \ AA_BUG(len < 0); \ total += ulen; \ ulen = min(ulen, size); \ size -= ulen; \ str += ulen; \} while (0)
/** * aa_profile_snxprint - print a profile name to a buffer * @str: buffer to write to. (MAY BE NULL if @size == 0) * @size: size of buffer * @view: namespace profile is being viewed from * @profile: profile to view (NOT NULL) * @flags: whether to include the mode string * @prev_ns: last ns printed when used in compound print * * Returns: size of name written or would be written if larger than * available buffer * * Note: will not print anything if the profile is not visible */static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view, struct aa_profile *profile, int flags, struct aa_ns **prev_ns){ const char *ns_name = NULL;
AA_BUG(!str && size != 0); AA_BUG(!profile);
if (!view) view = profiles_ns(profile);
if (view != profile->ns && (!prev_ns || (*prev_ns != profile->ns))) { if (prev_ns) *prev_ns = profile->ns; ns_name = aa_ns_name(view, profile->ns, flags & FLAG_VIEW_SUBNS); if (ns_name == aa_hidden_ns_name) { if (flags & FLAG_HIDDEN_UNCONFINED) return snprintf(str, size, "%s", "unconfined"); return snprintf(str, size, "%s", ns_name); } }
if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) { const char *modestr = aa_profile_mode_names[profile->mode];
if (ns_name) return snprintf(str, size, ":%s:%s (%s)", ns_name, profile->base.hname, modestr); return snprintf(str, size, "%s (%s)", profile->base.hname, modestr); }
if (ns_name) return snprintf(str, size, ":%s:%s", ns_name, profile->base.hname); return snprintf(str, size, "%s", profile->base.hname);}
static const char *label_modename(struct aa_ns *ns, struct aa_label *label, int flags){ struct aa_profile *profile; struct label_it i; int mode = -1, count = 0;
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { count++; if (profile == profile->ns->unconfined) /* special case unconfined so stacks with * unconfined don't report as mixed. ie. * profile_foo//&:ns1:unconfined (mixed) */ continue; if (mode == -1) mode = profile->mode; else if (mode != profile->mode) return "mixed"; } }
if (count == 0) return "-"; if (mode == -1) /* everything was unconfined */ mode = APPARMOR_UNCONFINED;
return aa_profile_mode_names[mode];}
/* if any visible label is not unconfined the display_mode returns true */static inline bool display_mode(struct aa_ns *ns, struct aa_label *label, int flags){ if ((flags & FLAG_SHOW_MODE)) { struct aa_profile *profile; struct label_it i;
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS) && profile != profile->ns->unconfined) return true; } /* only ns->unconfined in set of profiles in ns */ return false; }
return false;}
/** * aa_label_snxprint - print a label name to a string buffer * @str: buffer to write to. (MAY BE NULL if @size == 0) * @size: size of buffer * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: whether to include the mode string * * Returns: size of name written or would be written if larger than * available buffer * * Note: labels do not have to be strictly hierarchical to the ns as * objects may be shared across different namespaces and thus * pickup labeling from each ns. If a particular part of the * label is not visible it will just be excluded. And if none * of the label is visible "---" will be used. */int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, struct aa_label *label, int flags){ struct aa_profile *profile; struct aa_ns *prev_ns = NULL; struct label_it i; int count = 0, total = 0; ssize_t len;
AA_BUG(!str && size != 0); AA_BUG(!label);
if (DEBUG_ABS_ROOT && (flags & FLAG_ABS_ROOT)) { ns = root_ns; len = snprintf(str, size, "_"); update_for_len(total, len, size, str); } else if (!ns) { ns = labels_ns(label); }
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { if (count > 0) { len = snprintf(str, size, "//&"); update_for_len(total, len, size, str); } len = aa_profile_snxprint(str, size, ns, profile, flags & FLAG_VIEW_SUBNS, &prev_ns); update_for_len(total, len, size, str); count++; } }
if (count == 0) { if (flags & FLAG_HIDDEN_UNCONFINED) return snprintf(str, size, "%s", "unconfined"); return snprintf(str, size, "%s", aa_hidden_ns_name); }
/* count == 1 && ... is for backwards compat where the mode * is not displayed for 'unconfined' in the current ns */ if (display_mode(ns, label, flags)) { len = snprintf(str, size, " (%s)", label_modename(ns, label, flags)); update_for_len(total, len, size, str); }
return total;}#undef update_for_len
/** * aa_label_asxprint - allocate a string buffer and print label into it * @strp: Returns - the allocated buffer with the label name. (NOT NULL) * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: flags controlling what label info is printed * @gfp: kernel memory allocation type * * Returns: size of name written or would be written if larger than * available buffer */int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ int size;
AA_BUG(!strp); AA_BUG(!label);
size = aa_label_snxprint(NULL, 0, ns, label, flags); if (size < 0) return size;
*strp = kmalloc(size + 1, gfp); if (!*strp) return -ENOMEM; return aa_label_snxprint(*strp, size + 1, ns, label, flags);}
/** * aa_label_acntsxprint - allocate a __counted string buffer and print label * @strp: buffer to write to. * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: flags controlling what label info is printed * @gfp: kernel memory allocation type * * Returns: size of name written or would be written if larger than * available buffer */int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ int size;
AA_BUG(!strp); AA_BUG(!label);
size = aa_label_snxprint(NULL, 0, ns, label, flags); if (size < 0) return size;
*strp = aa_str_alloc(size + 1, gfp); if (!*strp) return -ENOMEM; return aa_label_snxprint(*strp, size + 1, ns, label, flags);}
void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ const char *str; char *name = NULL; int len;
AA_BUG(!ab); AA_BUG(!label);
if (!use_label_hname(ns, label, flags) || display_mode(ns, label, flags)) { len = aa_label_asxprint(&name, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } str = name; } else { str = (char *) label->hname; len = strlen(str); } audit_log_n_untrustedstring(ab, str, len);
kfree(name);}
void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ AA_BUG(!f); AA_BUG(!label);
if (!use_label_hname(ns, label, flags)) { char *str; int len;
len = aa_label_asxprint(&str, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } seq_puts(f, str); kfree(str); } else if (display_mode(ns, label, flags)) seq_printf(f, "%s (%s)", label->hname, label_modename(ns, label, flags)); else seq_puts(f, label->hname);}
void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ AA_BUG(!label);
if (!use_label_hname(ns, label, flags)) { char *str; int len;
len = aa_label_asxprint(&str, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } pr_info("%s", str); kfree(str); } else if (display_mode(ns, label, flags)) pr_info("%s (%s)", label->hname, label_modename(ns, label, flags)); else pr_info("%s", label->hname);}
void aa_label_printk(struct aa_label *label, gfp_t gfp){ struct aa_ns *ns = aa_get_current_ns();
aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp); aa_put_ns(ns);}
static int label_count_strn_entries(const char *str, size_t n){ const char *end = str + n; const char *split; int count = 1;
AA_BUG(!str);
for (split = aa_label_strn_split(str, end - str); split; split = aa_label_strn_split(str, end - str)) { count++; str = split + 3; }
return count;}
/* * ensure stacks with components like * :ns:A//&B * have :ns: applied to both 'A' and 'B' by making the lookup relative * to the base if the lookup specifies an ns, else making the stacked lookup * relative to the last embedded ns in the string. */static struct aa_profile *fqlookupn_profile(struct aa_label *base, struct aa_label *currentbase, const char *str, size_t n){ const char *first = skipn_spaces(str, n);
if (first && *first == ':') return aa_fqlookupn_profile(base, str, n);
return aa_fqlookupn_profile(currentbase, str, n);}
/** * aa_label_strn_parse - parse, validate and convert a text string to a label * @base: base label to use for lookups (NOT NULL) * @str: null terminated text string (NOT NULL) * @n: length of str to parse, will stop at \0 if encountered before n * @gfp: allocation type * @create: true if should create compound labels if they don't exist * @force_stack: true if should stack even if no leading & * * Returns: the matching refcounted label if present * else ERRPTR */struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, size_t n, gfp_t gfp, bool create, bool force_stack){ DEFINE_VEC(profile, vec); struct aa_label *label, *currbase = base; int i, len, stack = 0, error; const char *end = str + n; const char *split;
AA_BUG(!base); AA_BUG(!str);
str = skipn_spaces(str, n); if (str == NULL || (DEBUG_ABS_ROOT && *str == '_' && base != &root_ns->unconfined->label)) return ERR_PTR(-EINVAL);
len = label_count_strn_entries(str, end - str); if (*str == '&' || force_stack) { /* stack on top of base */ stack = base->size; len += stack; if (*str == '&') str++; }
error = vec_setup(profile, vec, len, gfp); if (error) return ERR_PTR(error);
for (i = 0; i < stack; i++) vec[i] = aa_get_profile(base->vec[i]);
for (split = aa_label_strn_split(str, end - str), i = stack; split && i < len; i++) { vec[i] = fqlookupn_profile(base, currbase, str, split - str); if (!vec[i]) goto fail; /* * if component specified a new ns it becomes the new base * so that subsequent lookups are relative to it */ if (vec[i]->ns != labels_ns(currbase)) currbase = &vec[i]->label; str = split + 3; split = aa_label_strn_split(str, end - str); } /* last element doesn't have a split */ if (i < len) { vec[i] = fqlookupn_profile(base, currbase, str, end - str); if (!vec[i]) goto fail; } if (len == 1) /* no need to free vec as len < LOCAL_VEC_ENTRIES */ return &vec[0]->label;
len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (len == 1) { label = aa_get_label(&vec[0]->label); goto out; }
if (create) label = aa_vec_find_or_create_label(vec, len, gfp); else label = vec_find(vec, len); if (!label) goto fail;
out: /* use adjusted len from after vec_unique, not original */ vec_cleanup(profile, vec, len); return label;
fail: label = ERR_PTR(-ENOENT); goto out;}
struct aa_label *aa_label_parse(struct aa_label *base, const char *str, gfp_t gfp, bool create, bool force_stack){ return aa_label_strn_parse(base, str, strlen(str), gfp, create, force_stack);}
/** * aa_labelset_destroy - remove all labels from the label set * @ls: label set to cleanup (NOT NULL) * * Labels that are removed from the set may still exist beyond the set * being destroyed depending on their reference counting */void aa_labelset_destroy(struct aa_labelset *ls){ struct rb_node *node; unsigned long flags;
AA_BUG(!ls);
write_lock_irqsave(&ls->lock, flags); for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) { struct aa_label *this = rb_entry(node, struct aa_label, node);
if (labels_ns(this) != root_ns) __label_remove(this, ns_unconfined(labels_ns(this)->parent)); else __label_remove(this, NULL); } write_unlock_irqrestore(&ls->lock, flags);}
/* * @ls: labelset to init (NOT NULL) */void aa_labelset_init(struct aa_labelset *ls){ AA_BUG(!ls);
rwlock_init(&ls->lock); ls->root = RB_ROOT;}
static struct aa_label *labelset_next_stale(struct aa_labelset *ls){ struct aa_label *label; struct rb_node *node; unsigned long flags;
AA_BUG(!ls);
read_lock_irqsave(&ls->lock, flags);
__labelset_for_each(ls, node) { label = rb_entry(node, struct aa_label, node); if ((label_is_stale(label) || vec_is_stale(label->vec, label->size)) && __aa_get_label(label)) goto out;
} label = NULL;
out: read_unlock_irqrestore(&ls->lock, flags);
return label;}
/** * __label_update - insert updated version of @label into labelset * @label: the label to update/replace * * Returns: new label that is up to date * else NULL on failure * * Requires: @ns lock be held * * Note: worst case is the stale @label does not get updated and has * to be updated at a later time. */static struct aa_label *__label_update(struct aa_label *label){ struct aa_label *new, *tmp; struct aa_labelset *ls; unsigned long flags; int i, invcount = 0;
AA_BUG(!label); AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); if (!new) return NULL;
/* * while holding the ns_lock will stop profile replacement, removal, * and label updates, label merging and removal can be occurring */ ls = labels_set(label); write_lock_irqsave(&ls->lock, flags); for (i = 0; i < label->size; i++) { AA_BUG(!label->vec[i]); new->vec[i] = aa_get_newest_profile(label->vec[i]); AA_BUG(!new->vec[i]); AA_BUG(!new->vec[i]->label.proxy); AA_BUG(!new->vec[i]->label.proxy->label); if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) invcount++; }
/* updated stale label by being removed/renamed from labelset */ if (invcount) { new->size -= aa_vec_unique(&new->vec[0], new->size, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (new->size == 1) { tmp = aa_get_label(&new->vec[0]->label); AA_BUG(tmp == label); goto remove; } if (labels_set(label) != labels_set(new)) { write_unlock_irqrestore(&ls->lock, flags); tmp = aa_label_insert(labels_set(new), new); write_lock_irqsave(&ls->lock, flags); goto remove; } } else AA_BUG(labels_ns(label) != labels_ns(new));
tmp = __label_insert(labels_set(label), new, true);remove: /* ensure label is removed, and redirected correctly */ __label_remove(label, tmp); write_unlock_irqrestore(&ls->lock, flags); label_free_or_put_new(tmp, new);
return tmp;}
/** * __labelset_update - update labels in @ns * @ns: namespace to update labels in (NOT NULL) * * Requires: @ns lock be held * * Walk the labelset ensuring that all labels are up to date and valid * Any label that has a stale component is marked stale and replaced and * by an updated version. * * If failures happen due to memory pressures then stale labels will * be left in place until the next pass. */static void __labelset_update(struct aa_ns *ns){ struct aa_label *label;
AA_BUG(!ns); AA_BUG(!mutex_is_locked(&ns->lock));
do { label = labelset_next_stale(&ns->labels); if (label) { struct aa_label *l = __label_update(label);
aa_put_label(l); aa_put_label(label); } } while (label);}
/** * __aa_labelset_update_subtree - update all labels with a stale component * @ns: ns to start update at (NOT NULL) * * Requires: @ns lock be held * * Invalidates labels based on @p in @ns and any children namespaces. */void __aa_labelset_update_subtree(struct aa_ns *ns){ struct aa_ns *child;
AA_BUG(!ns); AA_BUG(!mutex_is_locked(&ns->lock));
__labelset_update(ns);
list_for_each_entry(child, &ns->sub_ns, base.list) { mutex_lock_nested(&child->lock, child->level); __aa_labelset_update_subtree(child); mutex_unlock(&child->lock); }}