Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136// SPDX-License-Identifier: GPL-2.0-only/* * AppArmor security module * * This file contains AppArmor label definitions * * Copyright 2017 Canonical Ltd. */
#include <linux/audit.h>#include <linux/seq_file.h>#include <linux/sort.h>
#include "include/apparmor.h"#include "include/cred.h"#include "include/label.h"#include "include/policy.h"#include "include/secid.h"
/* * the aa_label represents the set of profiles confining an object * * Labels maintain a reference count to the set of pointers they reference * Labels are ref counted by * tasks and object via the security field/security context off the field * code - will take a ref count on a label if it needs the label * beyond what is possible with an rcu_read_lock. * profiles - each profile is a label * secids - a pinned secid will keep a refcount of the label it is * referencing * objects - inode, files, sockets, ... * * Labels are not ref counted by the label set, so they maybe removed and * freed when no longer in use. * */
#define PROXY_POISON 97#define LABEL_POISON 100
static void free_proxy(struct aa_proxy *proxy){ if (proxy) { /* p->label will not updated any more as p is dead */ aa_put_label(rcu_dereference_protected(proxy->label, true)); memset(proxy, 0, sizeof(*proxy)); RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); kfree(proxy); }}
void aa_proxy_kref(struct kref *kref){ struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count.count);
free_proxy(proxy);}
struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp){ struct aa_proxy *new;
new = kzalloc_obj(struct aa_proxy, gfp); if (new) { kref_init(&new->count.count); new->count.reftype = REF_PROXY; rcu_assign_pointer(new->label, aa_get_label(label)); } return new;}
/* requires profile list write lock held */void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new){ struct aa_label *tmp;
AA_BUG(!orig); AA_BUG(!new); lockdep_assert_held_write(&labels_set(orig)->lock);
tmp = rcu_dereference_protected(orig->proxy->label, &labels_ns(orig)->lock); rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); __label_make_stale(orig); aa_put_label(tmp);}
static void __proxy_share(struct aa_label *old, struct aa_label *new){ struct aa_proxy *proxy = new->proxy;
new->proxy = aa_get_proxy(old->proxy); __aa_proxy_redirect(old, new); aa_put_proxy(proxy);}
/** * ns_cmp - compare ns for label set ordering * @a: ns to compare (NOT NULL) * @b: ns to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int ns_cmp(struct aa_ns *a, struct aa_ns *b){ int res;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!a->base.hname); AA_BUG(!b->base.hname);
if (a == b) return 0;
res = a->level - b->level; if (res) return res;
return strcmp(a->base.hname, b->base.hname);}
/** * profile_cmp - profile comparison for set ordering * @a: profile to compare (NOT NULL) * @b: profile to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int profile_cmp(struct aa_profile *a, struct aa_profile *b){ int res;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!a->ns); AA_BUG(!b->ns); AA_BUG(!a->base.hname); AA_BUG(!b->base.hname);
if (a == b || a->base.hname == b->base.hname) return 0; res = ns_cmp(a->ns, b->ns); if (res) return res;
return strcmp(a->base.hname, b->base.hname);}
/** * vec_cmp - label comparison for set ordering * @a: aa_profile to compare (NOT NULL) * @an: length of @a * @b: aa_profile to compare (NOT NULL) * @bn: length of @b * * Returns: <0 if @a < @b * ==0 if @a == @b * >0 if @a > @b */static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn){ int i;
AA_BUG(!a); AA_BUG(!*a); AA_BUG(!b); AA_BUG(!*b); AA_BUG(an <= 0); AA_BUG(bn <= 0);
for (i = 0; i < an && i < bn; i++) { int res = profile_cmp(a[i], b[i]);
if (res != 0) return res; }
return an - bn;}
static bool vec_is_stale(struct aa_profile **vec, int n){ int i;
AA_BUG(!vec);
for (i = 0; i < n; i++) { if (profile_is_stale(vec[i])) return true; }
return false;}
static void accum_label_info(struct aa_label *new){ long u = FLAG_UNCONFINED; int i;
AA_BUG(!new);
/* size == 1 is a profile and flags must be set as part of creation */ if (new->size == 1) return;
for (i = 0; i < new->size; i++) { u |= new->vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 | FLAG_STALE); if (!(u & new->vec[i]->label.flags & FLAG_UNCONFINED)) u &= ~FLAG_UNCONFINED; new->mediates |= new->vec[i]->label.mediates; } new->flags |= u;}
static int sort_cmp(const void *a, const void *b){ return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);}
/* * assumes vec is sorted * Assumes @vec has null terminator at vec[n], and will null terminate * vec[n - dups] */static inline int unique(struct aa_profile **vec, int n){ int i, pos, dups = 0;
AA_BUG(n < 1); AA_BUG(!vec);
pos = 0; for (i = 1; i < n; i++) { int res = profile_cmp(vec[pos], vec[i]);
AA_BUG(res > 0, "vec not sorted"); if (res == 0) { /* drop duplicate */ aa_put_profile(vec[i]); dups++; continue; } pos++; if (dups) vec[pos] = vec[i]; }
AA_BUG(dups < 0);
return dups;}
/** * aa_vec_unique - canonical sort and unique a list of profiles * @n: number of refcounted profiles in the list (@n > 0) * @vec: list of profiles to sort and merge * @flags: null terminator flags of @vec * * Returns: the number of duplicates eliminated == references put * * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will * null terminate vec[n - dups] */int aa_vec_unique(struct aa_profile **vec, int n, int flags){ int i, dups = 0;
AA_BUG(n < 1); AA_BUG(!vec);
/* vecs are usually small and inorder, have a fallback for larger */ if (n > 8) { sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL); dups = unique(vec, n); goto out; }
/* insertion sort + unique in one */ for (i = 1; i < n; i++) { struct aa_profile *tmp = vec[i]; int pos, j;
for (pos = i - 1 - dups; pos >= 0; pos--) { int res = profile_cmp(vec[pos], tmp);
if (res == 0) { /* drop duplicate entry */ aa_put_profile(tmp); dups++; goto continue_outer; } else if (res < 0) break; } /* pos is at entry < tmp, or index -1. Set to insert pos */ pos++;
for (j = i - dups; j > pos; j--) vec[j] = vec[j - 1]; vec[pos] = tmp;continue_outer: ; }
AA_BUG(dups < 0);
out: if (flags & VEC_FLAG_TERMINATE) vec[n - dups] = NULL;
return dups;}
void aa_label_destroy(struct aa_label *label){ AA_BUG(!label);
if (!label_isprofile(label)) { struct aa_profile *profile; struct label_it i;
aa_put_str(label->hname);
label_for_each(i, label, profile) { aa_put_profile(profile); label->vec[i.i] = (struct aa_profile *) (LABEL_POISON + (long) i.i); } }
if (label->proxy) { if (rcu_dereference_protected(label->proxy->label, true) == label) rcu_assign_pointer(label->proxy->label, NULL); aa_put_proxy(label->proxy); } aa_free_secid(label->secid);
label->proxy = (struct aa_proxy *) PROXY_POISON + 1;}
void aa_label_free(struct aa_label *label){ if (!label) return;
aa_label_destroy(label); kfree(label);}
static void label_free_switch(struct aa_label *label){ if (label->flags & FLAG_NS_COUNT) aa_free_ns(labels_ns(label)); else if (label_isprofile(label)) aa_free_profile(labels_profile(label)); else aa_label_free(label);}
static void label_free_rcu(struct rcu_head *head){ struct aa_label *label = container_of(head, struct aa_label, rcu);
if (label->flags & FLAG_IN_TREE) (void) aa_label_remove(label); label_free_switch(label);}
void aa_label_kref(struct kref *kref){ struct aa_label *label = container_of(kref, struct aa_label, count.count); struct aa_ns *ns = labels_ns(label);
if (!ns) { /* never live, no rcu callback needed, just using the fn */ label_free_switch(label); return; } /* TODO: update labels_profile macro so it works here */ AA_BUG(label_isprofile(label) && on_list_rcu(&label->vec[0]->base.profiles)); AA_BUG(label_isprofile(label) && on_list_rcu(&label->vec[0]->base.list));
/* TODO: if compound label and not stale add to reclaim cache */ call_rcu(&label->rcu, label_free_rcu);}
static void label_free_or_put_new(struct aa_label *label, struct aa_label *new){ if (label != new) /* need to free directly to break circular ref with proxy */ aa_label_free(new); else aa_put_label(new);}
bool aa_label_init(struct aa_label *label, int size, gfp_t gfp){ AA_BUG(!label); AA_BUG(size < 1);
if (aa_alloc_secid(label, gfp) < 0) return false;
label->size = size; /* doesn't include null */ label->vec[size] = NULL; /* null terminate */ kref_init(&label->count.count); label->count.reftype = REF_NS; /* for aafs purposes */ RB_CLEAR_NODE(&label->node);
return true;}
/** * aa_label_alloc - allocate a label with a profile vector of @size length * @size: size of profile vector in the label * @proxy: proxy to use OR null if to allocate a new one * @gfp: memory allocation type * * Returns: new label * else NULL if failed */struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp){ struct aa_label *new;
AA_BUG(size < 1);
/* + 1 for null terminator entry on vec */ new = kzalloc_flex(*new, vec, size + 1, gfp); AA_DEBUG(DEBUG_LABEL, "%s (%p)\n", __func__, new); if (!new) goto fail;
if (!aa_label_init(new, size, gfp)) goto fail;
if (!proxy) { proxy = aa_alloc_proxy(new, gfp); if (!proxy) goto fail; } else aa_get_proxy(proxy); /* just set new's proxy, don't redirect proxy here if it was passed in*/ new->proxy = proxy;
return new;
fail: aa_label_free(new);
return NULL;}
/** * label_cmp - label comparison for set ordering * @a: label to compare (NOT NULL) * @b: label to compare (NOT NULL) * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int label_cmp(struct aa_label *a, struct aa_label *b){ AA_BUG(!b);
if (a == b) return 0;
return vec_cmp(a->vec, a->size, b->vec, b->size);}
/* helper fn for label_for_each_confined */int aa_label_next_confined(struct aa_label *label, int i){ AA_BUG(!label); AA_BUG(i < 0);
for (; i < label->size; i++) { if (!profile_unconfined(label->vec[i])) return i; }
return i;}
/** * __aa_label_next_not_in_set - return the next profile of @sub not in @set * @I: label iterator * @set: label to test against * @sub: label to if is subset of @set * * Returns: profile in @sub that is not in @set, with iterator set pos after * else NULL if @sub is a subset of @set */struct aa_profile *__aa_label_next_not_in_set(struct label_it *I, struct aa_label *set, struct aa_label *sub){ AA_BUG(!set); AA_BUG(!I); AA_BUG(I->i < 0); AA_BUG(I->i > set->size); AA_BUG(!sub); AA_BUG(I->j < 0); AA_BUG(I->j > sub->size);
while (I->j < sub->size && I->i < set->size) { int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
if (res == 0) { (I->j)++; (I->i)++; } else if (res > 0) (I->i)++; else return sub->vec[(I->j)++]; }
if (I->j < sub->size) return sub->vec[(I->j)++];
return NULL;}
/** * aa_label_is_subset - test if @sub is a subset of @set * @set: label to test against * @sub: label to test if is subset of @set * * Returns: true if @sub is subset of @set * else false */bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub){ struct label_it i = { };
AA_BUG(!set); AA_BUG(!sub);
if (sub == set) return true;
return __aa_label_next_not_in_set(&i, set, sub) == NULL;}
/** * aa_label_is_unconfined_subset - test if @sub is a subset of @set * @set: label to test against * @sub: label to test if is subset of @set * * This checks for subset but taking into account unconfined. IF * @sub contains an unconfined profile that does not have a matching * unconfined in @set then this will not cause the test to fail. * Conversely we don't care about an unconfined in @set that is not in * @sub * * Returns: true if @sub is special_subset of @set * else false */bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub){ struct label_it i = { }; struct aa_profile *p;
AA_BUG(!set); AA_BUG(!sub);
if (sub == set) return true;
do { p = __aa_label_next_not_in_set(&i, set, sub); if (p && !profile_unconfined(p)) break; } while (p);
return p == NULL;}
/** * __label_remove - remove @label from the label set * @label: label to remove * @new: label to redirect to * * Requires: labels_set(@label)->lock write_lock * Returns: true if the label was in the tree and removed */static bool __label_remove(struct aa_label *label, struct aa_label *new){ struct aa_labelset *ls = labels_set(label);
AA_BUG(!ls); AA_BUG(!label); lockdep_assert_held_write(&ls->lock);
if (new) __aa_proxy_redirect(label, new);
if (!label_is_stale(label)) __label_make_stale(label);
if (label->flags & FLAG_IN_TREE) { rb_erase(&label->node, &ls->root); label->flags &= ~FLAG_IN_TREE; return true; }
return false;}
/** * __label_replace - replace @old with @new in label set * @old: label to remove from label set * @new: label to replace @old with * * Requires: labels_set(@old)->lock write_lock * valid ref count be held on @new * Returns: true if @old was in set and replaced by @new * * Note: current implementation requires label set be order in such a way * that @new directly replaces @old position in the set (ie. * using pointer comparison of the label address would not work) */static bool __label_replace(struct aa_label *old, struct aa_label *new){ struct aa_labelset *ls = labels_set(old);
AA_BUG(!ls); AA_BUG(!old); AA_BUG(!new); lockdep_assert_held_write(&ls->lock); AA_BUG(new->flags & FLAG_IN_TREE);
if (!label_is_stale(old)) __label_make_stale(old);
if (old->flags & FLAG_IN_TREE) { rb_replace_node(&old->node, &new->node, &ls->root); old->flags &= ~FLAG_IN_TREE; new->flags |= FLAG_IN_TREE; accum_label_info(new); return true; }
return false;}
/** * __label_insert - attempt to insert @l into a label set * @ls: set of labels to insert @l into (NOT NULL) * @label: new label to insert (NOT NULL) * @replace: whether insertion should replace existing entry that is not stale * * Requires: @ls->lock * caller to hold a valid ref on l * if @replace is true l has a preallocated proxy associated * Returns: @l if successful in inserting @l - with additional refcount * else ref counted equivalent label that is already in the set, * the else condition only happens if @replace is false */static struct aa_label *__label_insert(struct aa_labelset *ls, struct aa_label *label, bool replace){ struct rb_node **new, *parent = NULL;
AA_BUG(!ls); AA_BUG(!label); AA_BUG(labels_set(label) != ls); lockdep_assert_held_write(&ls->lock); AA_BUG(label->flags & FLAG_IN_TREE);
/* Figure out where to put new node */ new = &ls->root.rb_node; while (*new) { struct aa_label *this = rb_entry(*new, struct aa_label, node); int result = label_cmp(label, this);
parent = *new; if (result == 0) { /* !__aa_get_label means queued for destruction, * so replace in place, however the label has * died before the replacement so do not share * the proxy */ if (!replace && !label_is_stale(this)) { if (__aa_get_label(this)) return this; } else __proxy_share(this, label); AA_BUG(!__label_replace(this, label)); return aa_get_label(label); } else if (result < 0) new = &((*new)->rb_left); else /* (result > 0) */ new = &((*new)->rb_right); }
/* Add new node and rebalance tree. */ rb_link_node(&label->node, parent, new); rb_insert_color(&label->node, &ls->root); label->flags |= FLAG_IN_TREE; accum_label_info(label);
return aa_get_label(label);}
/** * __vec_find - find label that matches @vec in label set * @vec: vec of profiles to find matching label for (NOT NULL) * @n: length of @vec * * Requires: @vec_labelset(vec) lock held * caller to hold a valid ref on l * * Returns: ref counted @label if matching label is in tree * ref counted label that is equiv to @l in tree * else NULL if @vec equiv is not in tree */static struct aa_label *__vec_find(struct aa_profile **vec, int n){ struct rb_node *node;
AA_BUG(!vec); AA_BUG(!*vec); AA_BUG(n <= 0);
node = vec_labelset(vec, n)->root.rb_node; while (node) { struct aa_label *this = rb_entry(node, struct aa_label, node); int result = vec_cmp(this->vec, this->size, vec, n);
if (result > 0) node = node->rb_left; else if (result < 0) node = node->rb_right; else return __aa_get_label(this); }
return NULL;}
/** * __label_find - find label @label in label set * @label: label to find (NOT NULL) * * Requires: labels_set(@label)->lock held * caller to hold a valid ref on l * * Returns: ref counted @label if @label is in tree OR * ref counted label that is equiv to @label in tree * else NULL if @label or equiv is not in tree */static struct aa_label *__label_find(struct aa_label *label){ AA_BUG(!label);
return __vec_find(label->vec, label->size);}
/** * aa_label_remove - remove a label from the labelset * @label: label to remove * * Returns: true if @label was removed from the tree * else @label was not in tree so it could not be removed */bool aa_label_remove(struct aa_label *label){ struct aa_labelset *ls = labels_set(label); unsigned long flags; bool res;
AA_BUG(!ls);
write_lock_irqsave(&ls->lock, flags); res = __label_remove(label, ns_unconfined(labels_ns(label))); write_unlock_irqrestore(&ls->lock, flags);
return res;}
/** * aa_label_replace - replace a label @old with a new version @new * @old: label to replace * @new: label replacing @old * * Returns: true if @old was in tree and replaced * else @old was not in tree, and @new was not inserted */bool aa_label_replace(struct aa_label *old, struct aa_label *new){ unsigned long flags; bool res;
if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) { write_lock_irqsave(&labels_set(old)->lock, flags); if (old->proxy != new->proxy) __proxy_share(old, new); else __aa_proxy_redirect(old, new); res = __label_replace(old, new); write_unlock_irqrestore(&labels_set(old)->lock, flags); } else { struct aa_label *l; struct aa_labelset *ls = labels_set(old);
write_lock_irqsave(&ls->lock, flags); res = __label_remove(old, new); if (labels_ns(old) != labels_ns(new)) { write_unlock_irqrestore(&ls->lock, flags); ls = labels_set(new); write_lock_irqsave(&ls->lock, flags); } l = __label_insert(ls, new, true); res = (l == new); write_unlock_irqrestore(&ls->lock, flags); aa_put_label(l); }
return res;}
/** * vec_find - find label @l in label set * @vec: array of profiles to find equiv label for (NOT NULL) * @n: length of @vec * * Returns: refcounted label if @vec equiv is in tree * else NULL if @vec equiv is not in tree */static struct aa_label *vec_find(struct aa_profile **vec, int n){ struct aa_labelset *ls; struct aa_label *label; unsigned long flags;
AA_BUG(!vec); AA_BUG(!*vec); AA_BUG(n <= 0);
ls = vec_labelset(vec, n); read_lock_irqsave(&ls->lock, flags); label = __vec_find(vec, n); read_unlock_irqrestore(&ls->lock, flags);
return label;}
/* requires sort and merge done first */static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec, int len, gfp_t gfp){ struct aa_label *label = NULL; struct aa_labelset *ls; unsigned long flags; struct aa_label *new; int i;
AA_BUG(!vec);
if (len == 1) return aa_get_label(&vec[0]->label);
ls = labels_set(&vec[len - 1]->label);
/* TODO: enable when read side is lockless * check if label exists before taking locks */ new = aa_label_alloc(len, NULL, gfp); if (!new) return NULL;
for (i = 0; i < len; i++) new->vec[i] = aa_get_profile(vec[i]);
write_lock_irqsave(&ls->lock, flags); label = __label_insert(ls, new, false); write_unlock_irqrestore(&ls->lock, flags); label_free_or_put_new(label, new);
return label;}
struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len, gfp_t gfp){ struct aa_label *label = vec_find(vec, len);
if (label) return label;
return vec_create_and_insert_label(vec, len, gfp);}
/** * aa_label_insert - insert label @label into @ls or return existing label * @ls: labelset to insert @label into * @label: label to insert * * Requires: caller to hold a valid ref on @label * * Returns: ref counted @label if successful in inserting @label * else ref counted equivalent label that is already in the set */struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label){ struct aa_label *l; unsigned long flags;
AA_BUG(!ls); AA_BUG(!label);
/* check if label exists before taking lock */ if (!label_is_stale(label)) { read_lock_irqsave(&ls->lock, flags); l = __label_find(label); read_unlock_irqrestore(&ls->lock, flags); if (l) return l; }
write_lock_irqsave(&ls->lock, flags); l = __label_insert(ls, label, false); write_unlock_irqrestore(&ls->lock, flags);
return l;}
/** * aa_label_next_in_merge - find the next profile when merging @a and @b * @I: label iterator * @a: label to merge * @b: label to merge * * Returns: next profile * else null if no more profiles */struct aa_profile *aa_label_next_in_merge(struct label_it *I, struct aa_label *a, struct aa_label *b){ AA_BUG(!a); AA_BUG(!b); AA_BUG(!I); AA_BUG(I->i < 0); AA_BUG(I->i > a->size); AA_BUG(I->j < 0); AA_BUG(I->j > b->size);
if (I->i < a->size) { if (I->j < b->size) { int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
if (res > 0) return b->vec[(I->j)++]; if (res == 0) (I->j)++; }
return a->vec[(I->i)++]; }
if (I->j < b->size) return b->vec[(I->j)++];
return NULL;}
/** * label_merge_cmp - cmp of @a merging with @b against @z for set ordering * @a: label to merge then compare (NOT NULL) * @b: label to merge then compare (NOT NULL) * @z: label to compare merge against (NOT NULL) * * Assumes: using the most recent versions of @a, @b, and @z * * Returns: <0 if a < b * ==0 if a == b * >0 if a > b */static int label_merge_cmp(struct aa_label *a, struct aa_label *b, struct aa_label *z){ struct aa_profile *p = NULL; struct label_it i = { }; int k;
AA_BUG(!a); AA_BUG(!b); AA_BUG(!z);
for (k = 0; k < z->size && (p = aa_label_next_in_merge(&i, a, b)); k++) { int res = profile_cmp(p, z->vec[k]);
if (res != 0) return res; }
if (p) return 1; else if (k < z->size) return -1; return 0;}
/** * label_merge_insert - create a new label by merging @a and @b * @new: preallocated label to merge into (NOT NULL) * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: preallocated proxy * * Returns: ref counted label either @new if merge is unique * @a if @b is a subset of @a * @b if @a is a subset of @b * * NOTE: will not use @new if the merge results in @new == @a or @b * * Must be used within labelset write lock to avoid racing with * setting labels stale. */static struct aa_label *label_merge_insert(struct aa_label *new, struct aa_label *a, struct aa_label *b){ struct aa_label *label; struct aa_labelset *ls; struct aa_profile *next; struct label_it i; unsigned long flags; int k = 0, invcount = 0; bool stale = false;
AA_BUG(!a); AA_BUG(a->size < 0); AA_BUG(!b); AA_BUG(b->size < 0); AA_BUG(!new); AA_BUG(new->size < a->size + b->size);
label_for_each_in_merge(i, a, b, next) { AA_BUG(!next); if (profile_is_stale(next)) { new->vec[k] = aa_get_newest_profile(next); AA_BUG(!new->vec[k]->label.proxy); AA_BUG(!new->vec[k]->label.proxy->label); if (next->label.proxy != new->vec[k]->label.proxy) invcount++; k++; stale = true; } else new->vec[k++] = aa_get_profile(next); } /* set to actual size which is <= allocated len */ new->size = k; new->vec[k] = NULL;
if (invcount) { new->size -= aa_vec_unique(&new->vec[0], new->size, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (new->size == 1) { label = aa_get_label(&new->vec[0]->label); return label; } } else if (!stale) { /* * merge could be same as a || b, note: it is not possible * for new->size == a->size == b->size unless a == b */ if (k == a->size) return aa_get_label(a); else if (k == b->size) return aa_get_label(b); } ls = labels_set(new); write_lock_irqsave(&ls->lock, flags); label = __label_insert(labels_set(new), new, false); write_unlock_irqrestore(&ls->lock, flags);
return label;}
/** * labelset_of_merge - find which labelset a merged label should be inserted * @a: label to merge and insert * @b: label to merge and insert * * Returns: labelset that the merged label should be inserted into */static struct aa_labelset *labelset_of_merge(struct aa_label *a, struct aa_label *b){ struct aa_ns *nsa = labels_ns(a); struct aa_ns *nsb = labels_ns(b);
if (ns_cmp(nsa, nsb) <= 0) return &nsa->labels; return &nsb->labels;}
/** * __label_find_merge - find label that is equiv to merge of @a and @b * @ls: set of labels to search (NOT NULL) * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: ls->lock read_lock held * * Returns: ref counted label that is equiv to merge of @a and @b * else NULL if merge of @a and @b is not in set */static struct aa_label *__label_find_merge(struct aa_labelset *ls, struct aa_label *a, struct aa_label *b){ struct rb_node *node;
AA_BUG(!ls); AA_BUG(!a); AA_BUG(!b);
if (a == b) return __label_find(a);
node = ls->root.rb_node; while (node) { struct aa_label *this = container_of(node, struct aa_label, node); int result = label_merge_cmp(a, b, this);
if (result < 0) node = node->rb_left; else if (result > 0) node = node->rb_right; else return __aa_get_label(this); }
return NULL;}
/** * aa_label_find_merge - find label that is equiv to merge of @a and @b * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * * Requires: labels be fully constructed with a valid ns * * Returns: ref counted label that is equiv to merge of @a and @b * else NULL if merge of @a and @b is not in set */struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b){ struct aa_labelset *ls; struct aa_label *label; unsigned long flags; bool a_needput, b_needput;
AA_BUG(!a); AA_BUG(!b);
a = aa_get_newest_label_condref(a, &a_needput); b = aa_get_newest_label_condref(b, &b_needput); ls = labelset_of_merge(a, b); read_lock_irqsave(&ls->lock, flags); label = __label_find_merge(ls, a, b); read_unlock_irqrestore(&ls->lock, flags); aa_put_label_condref(a, a_needput); aa_put_label_condref(b, b_needput);
return label;}
/** * aa_label_merge - attempt to insert new merged label of @a and @b * @a: label to merge with @b (NOT NULL) * @b: label to merge with @a (NOT NULL) * @gfp: memory allocation type * * Requires: caller to hold valid refs on @a and @b * labels be fully constructed with a valid ns * * Returns: ref counted new label if successful in inserting merge of a & b * else ref counted equivalent label that is already in the set. * else NULL if could not create label (-ENOMEM) */struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b, gfp_t gfp){ struct aa_label *label = NULL;
AA_BUG(!a); AA_BUG(!b);
if (a == b) return aa_get_newest_label(a);
/* TODO: enable when read side is lockless * check if label exists before taking locks if (!label_is_stale(a) && !label_is_stale(b)) label = aa_label_find_merge(a, b); */
if (!label) { struct aa_label *new; bool a_needput, b_needput;
a = aa_get_newest_label_condref(a, &a_needput); b = aa_get_newest_label_condref(b, &b_needput);
/* could use label_merge_len(a, b), but requires double * comparison for small savings */ new = aa_label_alloc(a->size + b->size, NULL, gfp); if (!new) goto out;
label = label_merge_insert(new, a, b); label_free_or_put_new(label, new);out: aa_put_label_condref(a, a_needput); aa_put_label_condref(b, b_needput); }
return label;}
/* match a profile and its associated ns component if needed * Assumes visibility test has already been done. * If a subns profile is not to be matched should be prescreened with * visibility test. */static inline aa_state_t match_component(struct aa_profile *profile, struct aa_ruleset *rules, struct aa_profile *tp, aa_state_t state){ const char *ns_name;
if (profile->ns == tp->ns) return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
/* try matching with namespace name and then profile */ ns_name = aa_ns_name(profile->ns, tp->ns, true); state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); state = aa_dfa_match(rules->policy->dfa, state, ns_name); state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);}
/** * label_compound_match - find perms for full compound label * @profile: profile to find perms for * @rules: ruleset to search * @label: label to check access permissions for * @state: state to start match in * @inview: whether to match labels in view or only in scope * @request: permissions to request * @perms: perms struct to set * * Returns: state match stopped at or DFA_NOMATCH if aborted early * * For the label A//&B//&C this does the perm match for A//&B//&C * @perms should be preinitialized with allperms OR a previous permission * check to be stacked. */static int label_compound_match(struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t state, bool inview, u32 request, struct aa_perms *perms){ struct aa_profile *tp; struct label_it i;
/* find first subcomponent that is visible */ label_for_each(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, state); if (!state) goto fail; goto next; }
/* no component visible */ *perms = allperms; return state;
next: label_for_each_cont(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = aa_dfa_match(rules->policy->dfa, state, "//&"); state = match_component(profile, rules, tp, state); if (!state) goto fail; } *perms = *aa_lookup_perms(rules->policy, state); return state;
fail: *perms = nullperms; return DFA_NOMATCH;}
/** * label_components_match - find perms for all subcomponents of a label * @profile: profile to find perms for * @rules: ruleset to search * @label: label to check access permissions for * @start: state to start match in * @inview: whether to match labels in view or only in scope * @request: permissions to request * @perms: an initialized perms struct to add accumulation to * * Returns: the state the match finished in, may be the none matching state * * For the label A//&B//&C this does the perm match for each of A and B and C * @perms should be preinitialized with allperms OR a previous permission * check to be stacked. */static int label_components_match(struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t start, bool inview, u32 request, struct aa_perms *perms){ struct aa_profile *tp; struct label_it i; struct aa_perms tmp; aa_state_t state = 0;
/* find first subcomponent to test */ label_for_each(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, start); if (!state) goto fail; goto next; }
/* no subcomponents visible - no change in perms */ return state;
next: tmp = *aa_lookup_perms(rules->policy, state); aa_perms_accum(perms, &tmp); label_for_each_cont(i, label, tp) { if (!aa_ns_visible(profile->ns, tp->ns, inview)) continue; state = match_component(profile, rules, tp, start); if (!state) goto fail; tmp = *aa_lookup_perms(rules->policy, state); aa_perms_accum(perms, &tmp); }
if ((perms->allow & request) != request) return DFA_NOMATCH;
return state;
fail: *perms = nullperms; return DFA_NOMATCH;}
/** * aa_label_match - do a multi-component label match * @profile: profile to match against (NOT NULL) * @rules: ruleset to search * @label: label to match (NOT NULL) * @state: state to start in * @inview: whether to match labels in view or only in scope * @request: permission request * @perms: Returns computed perms (NOT NULL) * * Returns: the state the match finished in, may be the none matching state */int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules, struct aa_label *label, aa_state_t state, bool inview, u32 request, struct aa_perms *perms){ aa_state_t tmp = label_compound_match(profile, rules, label, state, inview, request, perms); if ((perms->allow & request) == request) return tmp;
/* failed compound_match try component matches */ *perms = allperms; return label_components_match(profile, rules, label, state, inview, request, perms);}
/** * aa_update_label_name - update a label to have a stored name * @ns: ns being viewed from (NOT NULL) * @label: label to update (NOT NULL) * @gfp: type of memory allocation * * Requires: labels_set(label) not locked in caller * * note: only updates the label name if it does not have a name already * and if it is in the labelset */bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp){ struct aa_labelset *ls; unsigned long flags; char __counted *name; bool res = false;
AA_BUG(!ns); AA_BUG(!label);
if (label->hname || labels_ns(label) != ns) return res;
if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) return res;
ls = labels_set(label); write_lock_irqsave(&ls->lock, flags); if (!label->hname && label->flags & FLAG_IN_TREE) { label->hname = name; res = true; } else aa_put_str(name); write_unlock_irqrestore(&ls->lock, flags);
return res;}
/* * cached label name is present and visible * @label->hname only exists if label is namespace hierarchical */static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, int flags){ if (label->hname && (!ns || labels_ns(label) == ns) && !(flags & ~FLAG_SHOW_MODE)) return true;
return false;}
/* helper macro for snprint routines */#define update_for_len(total, len, size, str) \do { \ size_t ulen = len; \ \ AA_BUG(len < 0); \ total += ulen; \ ulen = min(ulen, size); \ size -= ulen; \ str += ulen; \} while (0)
/** * aa_profile_snxprint - print a profile name to a buffer * @str: buffer to write to. (MAY BE NULL if @size == 0) * @size: size of buffer * @view: namespace profile is being viewed from * @profile: profile to view (NOT NULL) * @flags: whether to include the mode string * @prev_ns: last ns printed when used in compound print * * Returns: size of name written or would be written if larger than * available buffer * * Note: will not print anything if the profile is not visible */static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view, struct aa_profile *profile, int flags, struct aa_ns **prev_ns){ const char *ns_name = NULL;
AA_BUG(!str && size != 0); AA_BUG(!profile);
if (!view) view = profiles_ns(profile);
if (view != profile->ns && (!prev_ns || (*prev_ns != profile->ns))) { if (prev_ns) *prev_ns = profile->ns; ns_name = aa_ns_name(view, profile->ns, flags & FLAG_VIEW_SUBNS); if (ns_name == aa_hidden_ns_name) { if (flags & FLAG_HIDDEN_UNCONFINED) return snprintf(str, size, "%s", "unconfined"); return snprintf(str, size, "%s", ns_name); } }
if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) { const char *modestr = aa_profile_mode_names[profile->mode];
if (ns_name) return snprintf(str, size, ":%s:%s (%s)", ns_name, profile->base.hname, modestr); return snprintf(str, size, "%s (%s)", profile->base.hname, modestr); }
if (ns_name) return snprintf(str, size, ":%s:%s", ns_name, profile->base.hname); return snprintf(str, size, "%s", profile->base.hname);}
static const char *label_modename(struct aa_ns *ns, struct aa_label *label, int flags){ struct aa_profile *profile; struct label_it i; int mode = -1, count = 0;
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { count++; if (profile == profile->ns->unconfined) /* special case unconfined so stacks with * unconfined don't report as mixed. ie. * profile_foo//&:ns1:unconfined (mixed) */ continue; if (mode == -1) mode = profile->mode; else if (mode != profile->mode) return "mixed"; } }
if (count == 0) return "-"; if (mode == -1) /* everything was unconfined */ mode = APPARMOR_UNCONFINED;
return aa_profile_mode_names[mode];}
/* if any visible label is not unconfined the display_mode returns true */static inline bool display_mode(struct aa_ns *ns, struct aa_label *label, int flags){ if ((flags & FLAG_SHOW_MODE)) { struct aa_profile *profile; struct label_it i;
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS) && profile != profile->ns->unconfined) return true; } /* only ns->unconfined in set of profiles in ns */ return false; }
return false;}
/** * aa_label_snxprint - print a label name to a string buffer * @str: buffer to write to. (MAY BE NULL if @size == 0) * @size: size of buffer * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: whether to include the mode string * * Returns: size of name written or would be written if larger than * available buffer * * Note: labels do not have to be strictly hierarchical to the ns as * objects may be shared across different namespaces and thus * pickup labeling from each ns. If a particular part of the * label is not visible it will just be excluded. And if none * of the label is visible "---" will be used. */int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, struct aa_label *label, int flags){ struct aa_profile *profile; struct aa_ns *prev_ns = NULL; struct label_it i; int count = 0, total = 0; ssize_t len;
AA_BUG(!str && size != 0); AA_BUG(!label);
if (DEBUG_ABS_ROOT && (flags & FLAG_ABS_ROOT)) { ns = root_ns; len = snprintf(str, size, "_"); update_for_len(total, len, size, str); } else if (!ns) { ns = labels_ns(label); }
label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { if (count > 0) { len = snprintf(str, size, "//&"); update_for_len(total, len, size, str); } len = aa_profile_snxprint(str, size, ns, profile, flags & FLAG_VIEW_SUBNS, &prev_ns); update_for_len(total, len, size, str); count++; } }
if (count == 0) { if (flags & FLAG_HIDDEN_UNCONFINED) return snprintf(str, size, "%s", "unconfined"); return snprintf(str, size, "%s", aa_hidden_ns_name); }
/* count == 1 && ... is for backwards compat where the mode * is not displayed for 'unconfined' in the current ns */ if (display_mode(ns, label, flags)) { len = snprintf(str, size, " (%s)", label_modename(ns, label, flags)); update_for_len(total, len, size, str); }
return total;}#undef update_for_len
/** * aa_label_asxprint - allocate a string buffer and print label into it * @strp: Returns - the allocated buffer with the label name. (NOT NULL) * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: flags controlling what label info is printed * @gfp: kernel memory allocation type * * Returns: size of name written or would be written if larger than * available buffer */int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ int size;
AA_BUG(!strp); AA_BUG(!label);
size = aa_label_snxprint(NULL, 0, ns, label, flags); if (size < 0) return size;
*strp = kmalloc(size + 1, gfp); if (!*strp) return -ENOMEM; return aa_label_snxprint(*strp, size + 1, ns, label, flags);}
/** * aa_label_acntsxprint - allocate a __counted string buffer and print label * @strp: buffer to write to. * @ns: namespace profile is being viewed from * @label: label to view (NOT NULL) * @flags: flags controlling what label info is printed * @gfp: kernel memory allocation type * * Returns: size of name written or would be written if larger than * available buffer */int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ int size;
AA_BUG(!strp); AA_BUG(!label);
size = aa_label_snxprint(NULL, 0, ns, label, flags); if (size < 0) return size;
*strp = aa_str_alloc(size + 1, gfp); if (!*strp) return -ENOMEM; return aa_label_snxprint(*strp, size + 1, ns, label, flags);}
void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ const char *str; char *name = NULL; int len;
AA_BUG(!ab); AA_BUG(!label);
if (!use_label_hname(ns, label, flags) || display_mode(ns, label, flags)) { len = aa_label_asxprint(&name, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } str = name; } else { str = (char *) label->hname; len = strlen(str); } if (audit_string_contains_control(str, len)) audit_log_n_hex(ab, str, len); else audit_log_n_string(ab, str, len);
kfree(name);}
void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ AA_BUG(!f); AA_BUG(!label);
if (!use_label_hname(ns, label, flags)) { char *str; int len;
len = aa_label_asxprint(&str, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } seq_puts(f, str); kfree(str); } else if (display_mode(ns, label, flags)) seq_printf(f, "%s (%s)", label->hname, label_modename(ns, label, flags)); else seq_puts(f, label->hname);}
void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, gfp_t gfp){ AA_BUG(!label);
if (!use_label_hname(ns, label, flags)) { char *str; int len;
len = aa_label_asxprint(&str, ns, label, flags, gfp); if (len < 0) { AA_DEBUG(DEBUG_LABEL, "label print error"); return; } pr_info("%s", str); kfree(str); } else if (display_mode(ns, label, flags)) pr_info("%s (%s)", label->hname, label_modename(ns, label, flags)); else pr_info("%s", label->hname);}
void aa_label_printk(struct aa_label *label, gfp_t gfp){ struct aa_ns *ns = aa_get_current_ns();
aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp); aa_put_ns(ns);}
static int label_count_strn_entries(const char *str, size_t n){ const char *end = str + n; const char *split; int count = 1;
AA_BUG(!str);
for (split = aa_label_strn_split(str, end - str); split; split = aa_label_strn_split(str, end - str)) { count++; str = split + 3; }
return count;}
/* * ensure stacks with components like * :ns:A//&B * have :ns: applied to both 'A' and 'B' by making the lookup relative * to the base if the lookup specifies an ns, else making the stacked lookup * relative to the last embedded ns in the string. */static struct aa_profile *fqlookupn_profile(struct aa_label *base, struct aa_label *currentbase, const char *str, size_t n){ const char *first = skipn_spaces(str, n);
if (first && *first == ':') return aa_fqlookupn_profile(base, str, n);
return aa_fqlookupn_profile(currentbase, str, n);}
/** * aa_label_strn_parse - parse, validate and convert a text string to a label * @base: base label to use for lookups (NOT NULL) * @str: null terminated text string (NOT NULL) * @n: length of str to parse, will stop at \0 if encountered before n * @gfp: allocation type * @create: true if should create compound labels if they don't exist * @force_stack: true if should stack even if no leading & * * Returns: the matching refcounted label if present * else ERRPTR */struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, size_t n, gfp_t gfp, bool create, bool force_stack){ DEFINE_VEC(profile, vec); struct aa_label *label, *currbase = base; int i, len, stack = 0, error; const char *end = str + n; const char *split;
AA_BUG(!base); AA_BUG(!str);
str = skipn_spaces(str, n); if (str == NULL || (DEBUG_ABS_ROOT && *str == '_' && base != &root_ns->unconfined->label)) return ERR_PTR(-EINVAL);
len = label_count_strn_entries(str, end - str); if (*str == '&' || force_stack) { /* stack on top of base */ stack = base->size; len += stack; if (*str == '&') str++; }
error = vec_setup(profile, vec, len, gfp); if (error) return ERR_PTR(error);
for (i = 0; i < stack; i++) vec[i] = aa_get_profile(base->vec[i]);
for (split = aa_label_strn_split(str, end - str), i = stack; split && i < len; i++) { vec[i] = fqlookupn_profile(base, currbase, str, split - str); if (!vec[i]) goto fail; /* * if component specified a new ns it becomes the new base * so that subsequent lookups are relative to it */ if (vec[i]->ns != labels_ns(currbase)) currbase = &vec[i]->label; str = split + 3; split = aa_label_strn_split(str, end - str); } /* last element doesn't have a split */ if (i < len) { vec[i] = fqlookupn_profile(base, currbase, str, end - str); if (!vec[i]) goto fail; } if (len == 1) /* no need to free vec as len < LOCAL_VEC_ENTRIES */ return &vec[0]->label;
len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (len == 1) { label = aa_get_label(&vec[0]->label); goto out; }
if (create) label = aa_vec_find_or_create_label(vec, len, gfp); else label = vec_find(vec, len); if (!label) goto fail;
out: /* use adjusted len from after vec_unique, not original */ vec_cleanup(profile, vec, len); return label;
fail: label = ERR_PTR(-ENOENT); goto out;}
struct aa_label *aa_label_parse(struct aa_label *base, const char *str, gfp_t gfp, bool create, bool force_stack){ return aa_label_strn_parse(base, str, strlen(str), gfp, create, force_stack);}
/** * aa_labelset_destroy - remove all labels from the label set * @ls: label set to cleanup (NOT NULL) * * Labels that are removed from the set may still exist beyond the set * being destroyed depending on their reference counting */void aa_labelset_destroy(struct aa_labelset *ls){ struct rb_node *node; unsigned long flags;
AA_BUG(!ls);
write_lock_irqsave(&ls->lock, flags); for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) { struct aa_label *this = rb_entry(node, struct aa_label, node);
if (labels_ns(this) != root_ns) __label_remove(this, ns_unconfined(labels_ns(this)->parent)); else __label_remove(this, NULL); } write_unlock_irqrestore(&ls->lock, flags);}
/* * @ls: labelset to init (NOT NULL) */void aa_labelset_init(struct aa_labelset *ls){ AA_BUG(!ls);
rwlock_init(&ls->lock); ls->root = RB_ROOT;}
static struct aa_label *labelset_next_stale(struct aa_labelset *ls){ struct aa_label *label; struct rb_node *node; unsigned long flags;
AA_BUG(!ls);
read_lock_irqsave(&ls->lock, flags);
__labelset_for_each(ls, node) { label = rb_entry(node, struct aa_label, node); if ((label_is_stale(label) || vec_is_stale(label->vec, label->size)) && __aa_get_label(label)) goto out;
} label = NULL;
out: read_unlock_irqrestore(&ls->lock, flags);
return label;}
/** * __label_update - insert updated version of @label into labelset * @label: the label to update/replace * * Returns: new label that is up to date * else NULL on failure * * Requires: @ns lock be held * * Note: worst case is the stale @label does not get updated and has * to be updated at a later time. */static struct aa_label *__label_update(struct aa_label *label){ struct aa_label *new, *tmp; struct aa_labelset *ls; unsigned long flags; int i, invcount = 0;
AA_BUG(!label); AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); if (!new) return NULL;
/* * while holding the ns_lock will stop profile replacement, removal, * and label updates, label merging and removal can be occurring */ ls = labels_set(label); write_lock_irqsave(&ls->lock, flags); for (i = 0; i < label->size; i++) { AA_BUG(!label->vec[i]); new->vec[i] = aa_get_newest_profile(label->vec[i]); AA_BUG(!new->vec[i]); AA_BUG(!new->vec[i]->label.proxy); AA_BUG(!new->vec[i]->label.proxy->label); if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) invcount++; }
/* updated stale label by being removed/renamed from labelset */ if (invcount) { new->size -= aa_vec_unique(&new->vec[0], new->size, VEC_FLAG_TERMINATE); /* TODO: deal with reference labels */ if (new->size == 1) { tmp = aa_get_label(&new->vec[0]->label); AA_BUG(tmp == label); goto remove; } if (labels_set(label) != labels_set(new)) { write_unlock_irqrestore(&ls->lock, flags); tmp = aa_label_insert(labels_set(new), new); write_lock_irqsave(&ls->lock, flags); goto remove; } } else AA_BUG(labels_ns(label) != labels_ns(new));
tmp = __label_insert(labels_set(label), new, true);remove: /* ensure label is removed, and redirected correctly */ __label_remove(label, tmp); write_unlock_irqrestore(&ls->lock, flags); label_free_or_put_new(tmp, new);
return tmp;}
/** * __labelset_update - update labels in @ns * @ns: namespace to update labels in (NOT NULL) * * Requires: @ns lock be held * * Walk the labelset ensuring that all labels are up to date and valid * Any label that has a stale component is marked stale and replaced and * by an updated version. * * If failures happen due to memory pressures then stale labels will * be left in place until the next pass. */static void __labelset_update(struct aa_ns *ns){ struct aa_label *label;
AA_BUG(!ns); AA_BUG(!mutex_is_locked(&ns->lock));
do { label = labelset_next_stale(&ns->labels); if (label) { struct aa_label *l = __label_update(label);
aa_put_label(l); aa_put_label(label); } } while (label);}
/** * __aa_labelset_update_subtree - update all labels with a stale component * @ns: ns to start update at (NOT NULL) * * Requires: @ns lock be held * * Invalidates labels based on @p in @ns and any children namespaces. */void __aa_labelset_update_subtree(struct aa_ns *ns){ struct aa_ns *child;
AA_BUG(!ns); AA_BUG(!mutex_is_locked(&ns->lock));
__labelset_update(ns);
list_for_each_entry(child, &ns->sub_ns, base.list) { mutex_lock_nested(&child->lock, child->level); __aa_labelset_update_subtree(child); mutex_unlock(&child->lock); }}