Loading...
Note: File does not exist in v3.15.
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor label definitions
6 *
7 * Copyright 2017 Canonical Ltd.
8 */
9
10#include <linux/audit.h>
11#include <linux/seq_file.h>
12#include <linux/sort.h>
13
14#include "include/apparmor.h"
15#include "include/cred.h"
16#include "include/label.h"
17#include "include/policy.h"
18#include "include/secid.h"
19
20
21/*
22 * the aa_label represents the set of profiles confining an object
23 *
24 * Labels maintain a reference count to the set of pointers they reference
25 * Labels are ref counted by
26 * tasks and object via the security field/security context off the field
27 * code - will take a ref count on a label if it needs the label
28 * beyond what is possible with an rcu_read_lock.
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
31 * referencing
32 * objects - inode, files, sockets, ...
33 *
34 * Labels are not ref counted by the label set, so they maybe removed and
35 * freed when no longer in use.
36 *
37 */
38
39#define PROXY_POISON 97
40#define LABEL_POISON 100
41
42static void free_proxy(struct aa_proxy *proxy)
43{
44 if (proxy) {
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
47 memset(proxy, 0, sizeof(*proxy));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49 kfree(proxy);
50 }
51}
52
53void aa_proxy_kref(struct kref *kref)
54{
55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56
57 free_proxy(proxy);
58}
59
60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61{
62 struct aa_proxy *new;
63
64 new = kzalloc(sizeof(struct aa_proxy), gfp);
65 if (new) {
66 kref_init(&new->count);
67 rcu_assign_pointer(new->label, aa_get_label(label));
68 }
69 return new;
70}
71
72/* requires profile list write lock held */
73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74{
75 struct aa_label *tmp;
76
77 AA_BUG(!orig);
78 AA_BUG(!new);
79 lockdep_assert_held_write(&labels_set(orig)->lock);
80
81 tmp = rcu_dereference_protected(orig->proxy->label,
82 &labels_ns(orig)->lock);
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84 orig->flags |= FLAG_STALE;
85 aa_put_label(tmp);
86}
87
88static void __proxy_share(struct aa_label *old, struct aa_label *new)
89{
90 struct aa_proxy *proxy = new->proxy;
91
92 new->proxy = aa_get_proxy(old->proxy);
93 __aa_proxy_redirect(old, new);
94 aa_put_proxy(proxy);
95}
96
97
98/**
99 * ns_cmp - compare ns for label set ordering
100 * @a: ns to compare (NOT NULL)
101 * @b: ns to compare (NOT NULL)
102 *
103 * Returns: <0 if a < b
104 * ==0 if a == b
105 * >0 if a > b
106 */
107static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108{
109 int res;
110
111 AA_BUG(!a);
112 AA_BUG(!b);
113 AA_BUG(!a->base.hname);
114 AA_BUG(!b->base.hname);
115
116 if (a == b)
117 return 0;
118
119 res = a->level - b->level;
120 if (res)
121 return res;
122
123 return strcmp(a->base.hname, b->base.hname);
124}
125
126/**
127 * profile_cmp - profile comparison for set ordering
128 * @a: profile to compare (NOT NULL)
129 * @b: profile to compare (NOT NULL)
130 *
131 * Returns: <0 if a < b
132 * ==0 if a == b
133 * >0 if a > b
134 */
135static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136{
137 int res;
138
139 AA_BUG(!a);
140 AA_BUG(!b);
141 AA_BUG(!a->ns);
142 AA_BUG(!b->ns);
143 AA_BUG(!a->base.hname);
144 AA_BUG(!b->base.hname);
145
146 if (a == b || a->base.hname == b->base.hname)
147 return 0;
148 res = ns_cmp(a->ns, b->ns);
149 if (res)
150 return res;
151
152 return strcmp(a->base.hname, b->base.hname);
153}
154
155/**
156 * vec_cmp - label comparison for set ordering
157 * @a: label to compare (NOT NULL)
158 * @vec: vector of profiles to compare (NOT NULL)
159 * @n: length of @vec
160 *
161 * Returns: <0 if a < vec
162 * ==0 if a == vec
163 * >0 if a > vec
164 */
165static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
166{
167 int i;
168
169 AA_BUG(!a);
170 AA_BUG(!*a);
171 AA_BUG(!b);
172 AA_BUG(!*b);
173 AA_BUG(an <= 0);
174 AA_BUG(bn <= 0);
175
176 for (i = 0; i < an && i < bn; i++) {
177 int res = profile_cmp(a[i], b[i]);
178
179 if (res != 0)
180 return res;
181 }
182
183 return an - bn;
184}
185
186static bool vec_is_stale(struct aa_profile **vec, int n)
187{
188 int i;
189
190 AA_BUG(!vec);
191
192 for (i = 0; i < n; i++) {
193 if (profile_is_stale(vec[i]))
194 return true;
195 }
196
197 return false;
198}
199
200static bool vec_unconfined(struct aa_profile **vec, int n)
201{
202 int i;
203
204 AA_BUG(!vec);
205
206 for (i = 0; i < n; i++) {
207 if (!profile_unconfined(vec[i]))
208 return false;
209 }
210
211 return true;
212}
213
214static int sort_cmp(const void *a, const void *b)
215{
216 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
217}
218
219/*
220 * assumes vec is sorted
221 * Assumes @vec has null terminator at vec[n], and will null terminate
222 * vec[n - dups]
223 */
224static inline int unique(struct aa_profile **vec, int n)
225{
226 int i, pos, dups = 0;
227
228 AA_BUG(n < 1);
229 AA_BUG(!vec);
230
231 pos = 0;
232 for (i = 1; i < n; i++) {
233 int res = profile_cmp(vec[pos], vec[i]);
234
235 AA_BUG(res > 0, "vec not sorted");
236 if (res == 0) {
237 /* drop duplicate */
238 aa_put_profile(vec[i]);
239 dups++;
240 continue;
241 }
242 pos++;
243 if (dups)
244 vec[pos] = vec[i];
245 }
246
247 AA_BUG(dups < 0);
248
249 return dups;
250}
251
252/**
253 * aa_vec_unique - canonical sort and unique a list of profiles
254 * @n: number of refcounted profiles in the list (@n > 0)
255 * @vec: list of profiles to sort and merge
256 *
257 * Returns: the number of duplicates eliminated == references put
258 *
259 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
260 * null terminate vec[n - dups]
261 */
262int aa_vec_unique(struct aa_profile **vec, int n, int flags)
263{
264 int i, dups = 0;
265
266 AA_BUG(n < 1);
267 AA_BUG(!vec);
268
269 /* vecs are usually small and inorder, have a fallback for larger */
270 if (n > 8) {
271 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
272 dups = unique(vec, n);
273 goto out;
274 }
275
276 /* insertion sort + unique in one */
277 for (i = 1; i < n; i++) {
278 struct aa_profile *tmp = vec[i];
279 int pos, j;
280
281 for (pos = i - 1 - dups; pos >= 0; pos--) {
282 int res = profile_cmp(vec[pos], tmp);
283
284 if (res == 0) {
285 /* drop duplicate entry */
286 aa_put_profile(tmp);
287 dups++;
288 goto continue_outer;
289 } else if (res < 0)
290 break;
291 }
292 /* pos is at entry < tmp, or index -1. Set to insert pos */
293 pos++;
294
295 for (j = i - dups; j > pos; j--)
296 vec[j] = vec[j - 1];
297 vec[pos] = tmp;
298continue_outer:
299 ;
300 }
301
302 AA_BUG(dups < 0);
303
304out:
305 if (flags & VEC_FLAG_TERMINATE)
306 vec[n - dups] = NULL;
307
308 return dups;
309}
310
311
312void aa_label_destroy(struct aa_label *label)
313{
314 AA_BUG(!label);
315
316 if (!label_isprofile(label)) {
317 struct aa_profile *profile;
318 struct label_it i;
319
320 aa_put_str(label->hname);
321
322 label_for_each(i, label, profile) {
323 aa_put_profile(profile);
324 label->vec[i.i] = (struct aa_profile *)
325 (LABEL_POISON + (long) i.i);
326 }
327 }
328
329 if (label->proxy) {
330 if (rcu_dereference_protected(label->proxy->label, true) == label)
331 rcu_assign_pointer(label->proxy->label, NULL);
332 aa_put_proxy(label->proxy);
333 }
334 aa_free_secid(label->secid);
335
336 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
337}
338
339void aa_label_free(struct aa_label *label)
340{
341 if (!label)
342 return;
343
344 aa_label_destroy(label);
345 kfree(label);
346}
347
348static void label_free_switch(struct aa_label *label)
349{
350 if (label->flags & FLAG_NS_COUNT)
351 aa_free_ns(labels_ns(label));
352 else if (label_isprofile(label))
353 aa_free_profile(labels_profile(label));
354 else
355 aa_label_free(label);
356}
357
358static void label_free_rcu(struct rcu_head *head)
359{
360 struct aa_label *label = container_of(head, struct aa_label, rcu);
361
362 if (label->flags & FLAG_IN_TREE)
363 (void) aa_label_remove(label);
364 label_free_switch(label);
365}
366
367void aa_label_kref(struct kref *kref)
368{
369 struct aa_label *label = container_of(kref, struct aa_label, count);
370 struct aa_ns *ns = labels_ns(label);
371
372 if (!ns) {
373 /* never live, no rcu callback needed, just using the fn */
374 label_free_switch(label);
375 return;
376 }
377 /* TODO: update labels_profile macro so it works here */
378 AA_BUG(label_isprofile(label) &&
379 on_list_rcu(&label->vec[0]->base.profiles));
380 AA_BUG(label_isprofile(label) &&
381 on_list_rcu(&label->vec[0]->base.list));
382
383 /* TODO: if compound label and not stale add to reclaim cache */
384 call_rcu(&label->rcu, label_free_rcu);
385}
386
387static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
388{
389 if (label != new)
390 /* need to free directly to break circular ref with proxy */
391 aa_label_free(new);
392 else
393 aa_put_label(new);
394}
395
396bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
397{
398 AA_BUG(!label);
399 AA_BUG(size < 1);
400
401 if (aa_alloc_secid(label, gfp) < 0)
402 return false;
403
404 label->size = size; /* doesn't include null */
405 label->vec[size] = NULL; /* null terminate */
406 kref_init(&label->count);
407 RB_CLEAR_NODE(&label->node);
408
409 return true;
410}
411
412/**
413 * aa_label_alloc - allocate a label with a profile vector of @size length
414 * @size: size of profile vector in the label
415 * @proxy: proxy to use OR null if to allocate a new one
416 * @gfp: memory allocation type
417 *
418 * Returns: new label
419 * else NULL if failed
420 */
421struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
422{
423 struct aa_label *new;
424
425 AA_BUG(size < 1);
426
427 /* + 1 for null terminator entry on vec */
428 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
429 gfp);
430 AA_DEBUG("%s (%p)\n", __func__, new);
431 if (!new)
432 goto fail;
433
434 if (!aa_label_init(new, size, gfp))
435 goto fail;
436
437 if (!proxy) {
438 proxy = aa_alloc_proxy(new, gfp);
439 if (!proxy)
440 goto fail;
441 } else
442 aa_get_proxy(proxy);
443 /* just set new's proxy, don't redirect proxy here if it was passed in*/
444 new->proxy = proxy;
445
446 return new;
447
448fail:
449 kfree(new);
450
451 return NULL;
452}
453
454
455/**
456 * label_cmp - label comparison for set ordering
457 * @a: label to compare (NOT NULL)
458 * @b: label to compare (NOT NULL)
459 *
460 * Returns: <0 if a < b
461 * ==0 if a == b
462 * >0 if a > b
463 */
464static int label_cmp(struct aa_label *a, struct aa_label *b)
465{
466 AA_BUG(!b);
467
468 if (a == b)
469 return 0;
470
471 return vec_cmp(a->vec, a->size, b->vec, b->size);
472}
473
474/* helper fn for label_for_each_confined */
475int aa_label_next_confined(struct aa_label *label, int i)
476{
477 AA_BUG(!label);
478 AA_BUG(i < 0);
479
480 for (; i < label->size; i++) {
481 if (!profile_unconfined(label->vec[i]))
482 return i;
483 }
484
485 return i;
486}
487
488/**
489 * aa_label_next_not_in_set - return the next profile of @sub not in @set
490 * @I: label iterator
491 * @set: label to test against
492 * @sub: label to if is subset of @set
493 *
494 * Returns: profile in @sub that is not in @set, with iterator set pos after
495 * else NULL if @sub is a subset of @set
496 */
497struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
498 struct aa_label *set,
499 struct aa_label *sub)
500{
501 AA_BUG(!set);
502 AA_BUG(!I);
503 AA_BUG(I->i < 0);
504 AA_BUG(I->i > set->size);
505 AA_BUG(!sub);
506 AA_BUG(I->j < 0);
507 AA_BUG(I->j > sub->size);
508
509 while (I->j < sub->size && I->i < set->size) {
510 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
511
512 if (res == 0) {
513 (I->j)++;
514 (I->i)++;
515 } else if (res > 0)
516 (I->i)++;
517 else
518 return sub->vec[(I->j)++];
519 }
520
521 if (I->j < sub->size)
522 return sub->vec[(I->j)++];
523
524 return NULL;
525}
526
527/**
528 * aa_label_is_subset - test if @sub is a subset of @set
529 * @set: label to test against
530 * @sub: label to test if is subset of @set
531 *
532 * Returns: true if @sub is subset of @set
533 * else false
534 */
535bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
536{
537 struct label_it i = { };
538
539 AA_BUG(!set);
540 AA_BUG(!sub);
541
542 if (sub == set)
543 return true;
544
545 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
546}
547
548/**
549 * aa_label_is_unconfined_subset - test if @sub is a subset of @set
550 * @set: label to test against
551 * @sub: label to test if is subset of @set
552 *
553 * This checks for subset but taking into account unconfined. IF
554 * @sub contains an unconfined profile that does not have a matching
555 * unconfined in @set then this will not cause the test to fail.
556 * Conversely we don't care about an unconfined in @set that is not in
557 * @sub
558 *
559 * Returns: true if @sub is special_subset of @set
560 * else false
561 */
562bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
563{
564 struct label_it i = { };
565 struct aa_profile *p;
566
567 AA_BUG(!set);
568 AA_BUG(!sub);
569
570 if (sub == set)
571 return true;
572
573 do {
574 p = __aa_label_next_not_in_set(&i, set, sub);
575 if (p && !profile_unconfined(p))
576 break;
577 } while (p);
578
579 return p == NULL;
580}
581
582
583/**
584 * __label_remove - remove @label from the label set
585 * @l: label to remove
586 * @new: label to redirect to
587 *
588 * Requires: labels_set(@label)->lock write_lock
589 * Returns: true if the label was in the tree and removed
590 */
591static bool __label_remove(struct aa_label *label, struct aa_label *new)
592{
593 struct aa_labelset *ls = labels_set(label);
594
595 AA_BUG(!ls);
596 AA_BUG(!label);
597 lockdep_assert_held_write(&ls->lock);
598
599 if (new)
600 __aa_proxy_redirect(label, new);
601
602 if (!label_is_stale(label))
603 __label_make_stale(label);
604
605 if (label->flags & FLAG_IN_TREE) {
606 rb_erase(&label->node, &ls->root);
607 label->flags &= ~FLAG_IN_TREE;
608 return true;
609 }
610
611 return false;
612}
613
614/**
615 * __label_replace - replace @old with @new in label set
616 * @old: label to remove from label set
617 * @new: label to replace @old with
618 *
619 * Requires: labels_set(@old)->lock write_lock
620 * valid ref count be held on @new
621 * Returns: true if @old was in set and replaced by @new
622 *
623 * Note: current implementation requires label set be order in such a way
624 * that @new directly replaces @old position in the set (ie.
625 * using pointer comparison of the label address would not work)
626 */
627static bool __label_replace(struct aa_label *old, struct aa_label *new)
628{
629 struct aa_labelset *ls = labels_set(old);
630
631 AA_BUG(!ls);
632 AA_BUG(!old);
633 AA_BUG(!new);
634 lockdep_assert_held_write(&ls->lock);
635 AA_BUG(new->flags & FLAG_IN_TREE);
636
637 if (!label_is_stale(old))
638 __label_make_stale(old);
639
640 if (old->flags & FLAG_IN_TREE) {
641 rb_replace_node(&old->node, &new->node, &ls->root);
642 old->flags &= ~FLAG_IN_TREE;
643 new->flags |= FLAG_IN_TREE;
644 return true;
645 }
646
647 return false;
648}
649
650/**
651 * __label_insert - attempt to insert @l into a label set
652 * @ls: set of labels to insert @l into (NOT NULL)
653 * @label: new label to insert (NOT NULL)
654 * @replace: whether insertion should replace existing entry that is not stale
655 *
656 * Requires: @ls->lock
657 * caller to hold a valid ref on l
658 * if @replace is true l has a preallocated proxy associated
659 * Returns: @l if successful in inserting @l - with additional refcount
660 * else ref counted equivalent label that is already in the set,
661 * the else condition only happens if @replace is false
662 */
663static struct aa_label *__label_insert(struct aa_labelset *ls,
664 struct aa_label *label, bool replace)
665{
666 struct rb_node **new, *parent = NULL;
667
668 AA_BUG(!ls);
669 AA_BUG(!label);
670 AA_BUG(labels_set(label) != ls);
671 lockdep_assert_held_write(&ls->lock);
672 AA_BUG(label->flags & FLAG_IN_TREE);
673
674 /* Figure out where to put new node */
675 new = &ls->root.rb_node;
676 while (*new) {
677 struct aa_label *this = rb_entry(*new, struct aa_label, node);
678 int result = label_cmp(label, this);
679
680 parent = *new;
681 if (result == 0) {
682 /* !__aa_get_label means queued for destruction,
683 * so replace in place, however the label has
684 * died before the replacement so do not share
685 * the proxy
686 */
687 if (!replace && !label_is_stale(this)) {
688 if (__aa_get_label(this))
689 return this;
690 } else
691 __proxy_share(this, label);
692 AA_BUG(!__label_replace(this, label));
693 return aa_get_label(label);
694 } else if (result < 0)
695 new = &((*new)->rb_left);
696 else /* (result > 0) */
697 new = &((*new)->rb_right);
698 }
699
700 /* Add new node and rebalance tree. */
701 rb_link_node(&label->node, parent, new);
702 rb_insert_color(&label->node, &ls->root);
703 label->flags |= FLAG_IN_TREE;
704
705 return aa_get_label(label);
706}
707
708/**
709 * __vec_find - find label that matches @vec in label set
710 * @vec: vec of profiles to find matching label for (NOT NULL)
711 * @n: length of @vec
712 *
713 * Requires: @vec_labelset(vec) lock held
714 * caller to hold a valid ref on l
715 *
716 * Returns: ref counted @label if matching label is in tree
717 * ref counted label that is equiv to @l in tree
718 * else NULL if @vec equiv is not in tree
719 */
720static struct aa_label *__vec_find(struct aa_profile **vec, int n)
721{
722 struct rb_node *node;
723
724 AA_BUG(!vec);
725 AA_BUG(!*vec);
726 AA_BUG(n <= 0);
727
728 node = vec_labelset(vec, n)->root.rb_node;
729 while (node) {
730 struct aa_label *this = rb_entry(node, struct aa_label, node);
731 int result = vec_cmp(this->vec, this->size, vec, n);
732
733 if (result > 0)
734 node = node->rb_left;
735 else if (result < 0)
736 node = node->rb_right;
737 else
738 return __aa_get_label(this);
739 }
740
741 return NULL;
742}
743
744/**
745 * __label_find - find label @label in label set
746 * @label: label to find (NOT NULL)
747 *
748 * Requires: labels_set(@label)->lock held
749 * caller to hold a valid ref on l
750 *
751 * Returns: ref counted @label if @label is in tree OR
752 * ref counted label that is equiv to @label in tree
753 * else NULL if @label or equiv is not in tree
754 */
755static struct aa_label *__label_find(struct aa_label *label)
756{
757 AA_BUG(!label);
758
759 return __vec_find(label->vec, label->size);
760}
761
762
763/**
764 * aa_label_remove - remove a label from the labelset
765 * @label: label to remove
766 *
767 * Returns: true if @label was removed from the tree
768 * else @label was not in tree so it could not be removed
769 */
770bool aa_label_remove(struct aa_label *label)
771{
772 struct aa_labelset *ls = labels_set(label);
773 unsigned long flags;
774 bool res;
775
776 AA_BUG(!ls);
777
778 write_lock_irqsave(&ls->lock, flags);
779 res = __label_remove(label, ns_unconfined(labels_ns(label)));
780 write_unlock_irqrestore(&ls->lock, flags);
781
782 return res;
783}
784
785/**
786 * aa_label_replace - replace a label @old with a new version @new
787 * @old: label to replace
788 * @new: label replacing @old
789 *
790 * Returns: true if @old was in tree and replaced
791 * else @old was not in tree, and @new was not inserted
792 */
793bool aa_label_replace(struct aa_label *old, struct aa_label *new)
794{
795 unsigned long flags;
796 bool res;
797
798 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
799 write_lock_irqsave(&labels_set(old)->lock, flags);
800 if (old->proxy != new->proxy)
801 __proxy_share(old, new);
802 else
803 __aa_proxy_redirect(old, new);
804 res = __label_replace(old, new);
805 write_unlock_irqrestore(&labels_set(old)->lock, flags);
806 } else {
807 struct aa_label *l;
808 struct aa_labelset *ls = labels_set(old);
809
810 write_lock_irqsave(&ls->lock, flags);
811 res = __label_remove(old, new);
812 if (labels_ns(old) != labels_ns(new)) {
813 write_unlock_irqrestore(&ls->lock, flags);
814 ls = labels_set(new);
815 write_lock_irqsave(&ls->lock, flags);
816 }
817 l = __label_insert(ls, new, true);
818 res = (l == new);
819 write_unlock_irqrestore(&ls->lock, flags);
820 aa_put_label(l);
821 }
822
823 return res;
824}
825
826/**
827 * vec_find - find label @l in label set
828 * @vec: array of profiles to find equiv label for (NOT NULL)
829 * @n: length of @vec
830 *
831 * Returns: refcounted label if @vec equiv is in tree
832 * else NULL if @vec equiv is not in tree
833 */
834static struct aa_label *vec_find(struct aa_profile **vec, int n)
835{
836 struct aa_labelset *ls;
837 struct aa_label *label;
838 unsigned long flags;
839
840 AA_BUG(!vec);
841 AA_BUG(!*vec);
842 AA_BUG(n <= 0);
843
844 ls = vec_labelset(vec, n);
845 read_lock_irqsave(&ls->lock, flags);
846 label = __vec_find(vec, n);
847 read_unlock_irqrestore(&ls->lock, flags);
848
849 return label;
850}
851
852/* requires sort and merge done first */
853static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
854 int len, gfp_t gfp)
855{
856 struct aa_label *label = NULL;
857 struct aa_labelset *ls;
858 unsigned long flags;
859 struct aa_label *new;
860 int i;
861
862 AA_BUG(!vec);
863
864 if (len == 1)
865 return aa_get_label(&vec[0]->label);
866
867 ls = labels_set(&vec[len - 1]->label);
868
869 /* TODO: enable when read side is lockless
870 * check if label exists before taking locks
871 */
872 new = aa_label_alloc(len, NULL, gfp);
873 if (!new)
874 return NULL;
875
876 for (i = 0; i < len; i++)
877 new->vec[i] = aa_get_profile(vec[i]);
878
879 write_lock_irqsave(&ls->lock, flags);
880 label = __label_insert(ls, new, false);
881 write_unlock_irqrestore(&ls->lock, flags);
882 label_free_or_put_new(label, new);
883
884 return label;
885}
886
887struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
888 gfp_t gfp)
889{
890 struct aa_label *label = vec_find(vec, len);
891
892 if (label)
893 return label;
894
895 return vec_create_and_insert_label(vec, len, gfp);
896}
897
898/**
899 * aa_label_find - find label @label in label set
900 * @label: label to find (NOT NULL)
901 *
902 * Requires: caller to hold a valid ref on l
903 *
904 * Returns: refcounted @label if @label is in tree
905 * refcounted label that is equiv to @label in tree
906 * else NULL if @label or equiv is not in tree
907 */
908struct aa_label *aa_label_find(struct aa_label *label)
909{
910 AA_BUG(!label);
911
912 return vec_find(label->vec, label->size);
913}
914
915
916/**
917 * aa_label_insert - insert label @label into @ls or return existing label
918 * @ls - labelset to insert @label into
919 * @label - label to insert
920 *
921 * Requires: caller to hold a valid ref on @label
922 *
923 * Returns: ref counted @label if successful in inserting @label
924 * else ref counted equivalent label that is already in the set
925 */
926struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
927{
928 struct aa_label *l;
929 unsigned long flags;
930
931 AA_BUG(!ls);
932 AA_BUG(!label);
933
934 /* check if label exists before taking lock */
935 if (!label_is_stale(label)) {
936 read_lock_irqsave(&ls->lock, flags);
937 l = __label_find(label);
938 read_unlock_irqrestore(&ls->lock, flags);
939 if (l)
940 return l;
941 }
942
943 write_lock_irqsave(&ls->lock, flags);
944 l = __label_insert(ls, label, false);
945 write_unlock_irqrestore(&ls->lock, flags);
946
947 return l;
948}
949
950
951/**
952 * aa_label_next_in_merge - find the next profile when merging @a and @b
953 * @I: label iterator
954 * @a: label to merge
955 * @b: label to merge
956 *
957 * Returns: next profile
958 * else null if no more profiles
959 */
960struct aa_profile *aa_label_next_in_merge(struct label_it *I,
961 struct aa_label *a,
962 struct aa_label *b)
963{
964 AA_BUG(!a);
965 AA_BUG(!b);
966 AA_BUG(!I);
967 AA_BUG(I->i < 0);
968 AA_BUG(I->i > a->size);
969 AA_BUG(I->j < 0);
970 AA_BUG(I->j > b->size);
971
972 if (I->i < a->size) {
973 if (I->j < b->size) {
974 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
975
976 if (res > 0)
977 return b->vec[(I->j)++];
978 if (res == 0)
979 (I->j)++;
980 }
981
982 return a->vec[(I->i)++];
983 }
984
985 if (I->j < b->size)
986 return b->vec[(I->j)++];
987
988 return NULL;
989}
990
991/**
992 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
993 * @a: label to merge then compare (NOT NULL)
994 * @b: label to merge then compare (NOT NULL)
995 * @z: label to compare merge against (NOT NULL)
996 *
997 * Assumes: using the most recent versions of @a, @b, and @z
998 *
999 * Returns: <0 if a < b
1000 * ==0 if a == b
1001 * >0 if a > b
1002 */
1003static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1004 struct aa_label *z)
1005{
1006 struct aa_profile *p = NULL;
1007 struct label_it i = { };
1008 int k;
1009
1010 AA_BUG(!a);
1011 AA_BUG(!b);
1012 AA_BUG(!z);
1013
1014 for (k = 0;
1015 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1016 k++) {
1017 int res = profile_cmp(p, z->vec[k]);
1018
1019 if (res != 0)
1020 return res;
1021 }
1022
1023 if (p)
1024 return 1;
1025 else if (k < z->size)
1026 return -1;
1027 return 0;
1028}
1029
1030/**
1031 * label_merge_insert - create a new label by merging @a and @b
1032 * @new: preallocated label to merge into (NOT NULL)
1033 * @a: label to merge with @b (NOT NULL)
1034 * @b: label to merge with @a (NOT NULL)
1035 *
1036 * Requires: preallocated proxy
1037 *
1038 * Returns: ref counted label either @new if merge is unique
1039 * @a if @b is a subset of @a
1040 * @b if @a is a subset of @b
1041 *
1042 * NOTE: will not use @new if the merge results in @new == @a or @b
1043 *
1044 * Must be used within labelset write lock to avoid racing with
1045 * setting labels stale.
1046 */
1047static struct aa_label *label_merge_insert(struct aa_label *new,
1048 struct aa_label *a,
1049 struct aa_label *b)
1050{
1051 struct aa_label *label;
1052 struct aa_labelset *ls;
1053 struct aa_profile *next;
1054 struct label_it i;
1055 unsigned long flags;
1056 int k = 0, invcount = 0;
1057 bool stale = false;
1058
1059 AA_BUG(!a);
1060 AA_BUG(a->size < 0);
1061 AA_BUG(!b);
1062 AA_BUG(b->size < 0);
1063 AA_BUG(!new);
1064 AA_BUG(new->size < a->size + b->size);
1065
1066 label_for_each_in_merge(i, a, b, next) {
1067 AA_BUG(!next);
1068 if (profile_is_stale(next)) {
1069 new->vec[k] = aa_get_newest_profile(next);
1070 AA_BUG(!new->vec[k]->label.proxy);
1071 AA_BUG(!new->vec[k]->label.proxy->label);
1072 if (next->label.proxy != new->vec[k]->label.proxy)
1073 invcount++;
1074 k++;
1075 stale = true;
1076 } else
1077 new->vec[k++] = aa_get_profile(next);
1078 }
1079 /* set to actual size which is <= allocated len */
1080 new->size = k;
1081 new->vec[k] = NULL;
1082
1083 if (invcount) {
1084 new->size -= aa_vec_unique(&new->vec[0], new->size,
1085 VEC_FLAG_TERMINATE);
1086 /* TODO: deal with reference labels */
1087 if (new->size == 1) {
1088 label = aa_get_label(&new->vec[0]->label);
1089 return label;
1090 }
1091 } else if (!stale) {
1092 /*
1093 * merge could be same as a || b, note: it is not possible
1094 * for new->size == a->size == b->size unless a == b
1095 */
1096 if (k == a->size)
1097 return aa_get_label(a);
1098 else if (k == b->size)
1099 return aa_get_label(b);
1100 }
1101 if (vec_unconfined(new->vec, new->size))
1102 new->flags |= FLAG_UNCONFINED;
1103 ls = labels_set(new);
1104 write_lock_irqsave(&ls->lock, flags);
1105 label = __label_insert(labels_set(new), new, false);
1106 write_unlock_irqrestore(&ls->lock, flags);
1107
1108 return label;
1109}
1110
1111/**
1112 * labelset_of_merge - find which labelset a merged label should be inserted
1113 * @a: label to merge and insert
1114 * @b: label to merge and insert
1115 *
1116 * Returns: labelset that the merged label should be inserted into
1117 */
1118static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1119 struct aa_label *b)
1120{
1121 struct aa_ns *nsa = labels_ns(a);
1122 struct aa_ns *nsb = labels_ns(b);
1123
1124 if (ns_cmp(nsa, nsb) <= 0)
1125 return &nsa->labels;
1126 return &nsb->labels;
1127}
1128
1129/**
1130 * __label_find_merge - find label that is equiv to merge of @a and @b
1131 * @ls: set of labels to search (NOT NULL)
1132 * @a: label to merge with @b (NOT NULL)
1133 * @b: label to merge with @a (NOT NULL)
1134 *
1135 * Requires: ls->lock read_lock held
1136 *
1137 * Returns: ref counted label that is equiv to merge of @a and @b
1138 * else NULL if merge of @a and @b is not in set
1139 */
1140static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1141 struct aa_label *a,
1142 struct aa_label *b)
1143{
1144 struct rb_node *node;
1145
1146 AA_BUG(!ls);
1147 AA_BUG(!a);
1148 AA_BUG(!b);
1149
1150 if (a == b)
1151 return __label_find(a);
1152
1153 node = ls->root.rb_node;
1154 while (node) {
1155 struct aa_label *this = container_of(node, struct aa_label,
1156 node);
1157 int result = label_merge_cmp(a, b, this);
1158
1159 if (result < 0)
1160 node = node->rb_left;
1161 else if (result > 0)
1162 node = node->rb_right;
1163 else
1164 return __aa_get_label(this);
1165 }
1166
1167 return NULL;
1168}
1169
1170
1171/**
1172 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1173 * @a: label to merge with @b (NOT NULL)
1174 * @b: label to merge with @a (NOT NULL)
1175 *
1176 * Requires: labels be fully constructed with a valid ns
1177 *
1178 * Returns: ref counted label that is equiv to merge of @a and @b
1179 * else NULL if merge of @a and @b is not in set
1180 */
1181struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1182{
1183 struct aa_labelset *ls;
1184 struct aa_label *label, *ar = NULL, *br = NULL;
1185 unsigned long flags;
1186
1187 AA_BUG(!a);
1188 AA_BUG(!b);
1189
1190 if (label_is_stale(a))
1191 a = ar = aa_get_newest_label(a);
1192 if (label_is_stale(b))
1193 b = br = aa_get_newest_label(b);
1194 ls = labelset_of_merge(a, b);
1195 read_lock_irqsave(&ls->lock, flags);
1196 label = __label_find_merge(ls, a, b);
1197 read_unlock_irqrestore(&ls->lock, flags);
1198 aa_put_label(ar);
1199 aa_put_label(br);
1200
1201 return label;
1202}
1203
1204/**
1205 * aa_label_merge - attempt to insert new merged label of @a and @b
1206 * @ls: set of labels to insert label into (NOT NULL)
1207 * @a: label to merge with @b (NOT NULL)
1208 * @b: label to merge with @a (NOT NULL)
1209 * @gfp: memory allocation type
1210 *
1211 * Requires: caller to hold valid refs on @a and @b
1212 * labels be fully constructed with a valid ns
1213 *
1214 * Returns: ref counted new label if successful in inserting merge of a & b
1215 * else ref counted equivalent label that is already in the set.
1216 * else NULL if could not create label (-ENOMEM)
1217 */
1218struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1219 gfp_t gfp)
1220{
1221 struct aa_label *label = NULL;
1222
1223 AA_BUG(!a);
1224 AA_BUG(!b);
1225
1226 if (a == b)
1227 return aa_get_newest_label(a);
1228
1229 /* TODO: enable when read side is lockless
1230 * check if label exists before taking locks
1231 if (!label_is_stale(a) && !label_is_stale(b))
1232 label = aa_label_find_merge(a, b);
1233 */
1234
1235 if (!label) {
1236 struct aa_label *new;
1237
1238 a = aa_get_newest_label(a);
1239 b = aa_get_newest_label(b);
1240
1241 /* could use label_merge_len(a, b), but requires double
1242 * comparison for small savings
1243 */
1244 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1245 if (!new)
1246 goto out;
1247
1248 label = label_merge_insert(new, a, b);
1249 label_free_or_put_new(label, new);
1250out:
1251 aa_put_label(a);
1252 aa_put_label(b);
1253 }
1254
1255 return label;
1256}
1257
1258static inline bool label_is_visible(struct aa_profile *profile,
1259 struct aa_label *label)
1260{
1261 return aa_ns_visible(profile->ns, labels_ns(label), true);
1262}
1263
1264/* match a profile and its associated ns component if needed
1265 * Assumes visibility test has already been done.
1266 * If a subns profile is not to be matched should be prescreened with
1267 * visibility test.
1268 */
1269static inline unsigned int match_component(struct aa_profile *profile,
1270 struct aa_profile *tp,
1271 unsigned int state)
1272{
1273 const char *ns_name;
1274
1275 if (profile->ns == tp->ns)
1276 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1277
1278 /* try matching with namespace name and then profile */
1279 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1280 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1281 state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1282 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1283 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1284}
1285
1286/**
1287 * label_compound_match - find perms for full compound label
1288 * @profile: profile to find perms for
1289 * @label: label to check access permissions for
1290 * @start: state to start match in
1291 * @subns: whether to do permission checks on components in a subns
1292 * @request: permissions to request
1293 * @perms: perms struct to set
1294 *
1295 * Returns: 0 on success else ERROR
1296 *
1297 * For the label A//&B//&C this does the perm match for A//&B//&C
1298 * @perms should be preinitialized with allperms OR a previous permission
1299 * check to be stacked.
1300 */
1301static int label_compound_match(struct aa_profile *profile,
1302 struct aa_label *label,
1303 unsigned int state, bool subns, u32 request,
1304 struct aa_perms *perms)
1305{
1306 struct aa_profile *tp;
1307 struct label_it i;
1308
1309 /* find first subcomponent that is visible */
1310 label_for_each(i, label, tp) {
1311 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1312 continue;
1313 state = match_component(profile, tp, state);
1314 if (!state)
1315 goto fail;
1316 goto next;
1317 }
1318
1319 /* no component visible */
1320 *perms = allperms;
1321 return 0;
1322
1323next:
1324 label_for_each_cont(i, label, tp) {
1325 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1326 continue;
1327 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1328 state = match_component(profile, tp, state);
1329 if (!state)
1330 goto fail;
1331 }
1332 aa_compute_perms(profile->policy.dfa, state, perms);
1333 aa_apply_modes_to_perms(profile, perms);
1334 if ((perms->allow & request) != request)
1335 return -EACCES;
1336
1337 return 0;
1338
1339fail:
1340 *perms = nullperms;
1341 return state;
1342}
1343
1344/**
1345 * label_components_match - find perms for all subcomponents of a label
1346 * @profile: profile to find perms for
1347 * @label: label to check access permissions for
1348 * @start: state to start match in
1349 * @subns: whether to do permission checks on components in a subns
1350 * @request: permissions to request
1351 * @perms: an initialized perms struct to add accumulation to
1352 *
1353 * Returns: 0 on success else ERROR
1354 *
1355 * For the label A//&B//&C this does the perm match for each of A and B and C
1356 * @perms should be preinitialized with allperms OR a previous permission
1357 * check to be stacked.
1358 */
1359static int label_components_match(struct aa_profile *profile,
1360 struct aa_label *label, unsigned int start,
1361 bool subns, u32 request,
1362 struct aa_perms *perms)
1363{
1364 struct aa_profile *tp;
1365 struct label_it i;
1366 struct aa_perms tmp;
1367 unsigned int state = 0;
1368
1369 /* find first subcomponent to test */
1370 label_for_each(i, label, tp) {
1371 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1372 continue;
1373 state = match_component(profile, tp, start);
1374 if (!state)
1375 goto fail;
1376 goto next;
1377 }
1378
1379 /* no subcomponents visible - no change in perms */
1380 return 0;
1381
1382next:
1383 aa_compute_perms(profile->policy.dfa, state, &tmp);
1384 aa_apply_modes_to_perms(profile, &tmp);
1385 aa_perms_accum(perms, &tmp);
1386 label_for_each_cont(i, label, tp) {
1387 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1388 continue;
1389 state = match_component(profile, tp, start);
1390 if (!state)
1391 goto fail;
1392 aa_compute_perms(profile->policy.dfa, state, &tmp);
1393 aa_apply_modes_to_perms(profile, &tmp);
1394 aa_perms_accum(perms, &tmp);
1395 }
1396
1397 if ((perms->allow & request) != request)
1398 return -EACCES;
1399
1400 return 0;
1401
1402fail:
1403 *perms = nullperms;
1404 return -EACCES;
1405}
1406
1407/**
1408 * aa_label_match - do a multi-component label match
1409 * @profile: profile to match against (NOT NULL)
1410 * @label: label to match (NOT NULL)
1411 * @state: state to start in
1412 * @subns: whether to match subns components
1413 * @request: permission request
1414 * @perms: Returns computed perms (NOT NULL)
1415 *
1416 * Returns: the state the match finished in, may be the none matching state
1417 */
1418int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1419 unsigned int state, bool subns, u32 request,
1420 struct aa_perms *perms)
1421{
1422 int error = label_compound_match(profile, label, state, subns, request,
1423 perms);
1424 if (!error)
1425 return error;
1426
1427 *perms = allperms;
1428 return label_components_match(profile, label, state, subns, request,
1429 perms);
1430}
1431
1432
1433/**
1434 * aa_update_label_name - update a label to have a stored name
1435 * @ns: ns being viewed from (NOT NULL)
1436 * @label: label to update (NOT NULL)
1437 * @gfp: type of memory allocation
1438 *
1439 * Requires: labels_set(label) not locked in caller
1440 *
1441 * note: only updates the label name if it does not have a name already
1442 * and if it is in the labelset
1443 */
1444bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1445{
1446 struct aa_labelset *ls;
1447 unsigned long flags;
1448 char __counted *name;
1449 bool res = false;
1450
1451 AA_BUG(!ns);
1452 AA_BUG(!label);
1453
1454 if (label->hname || labels_ns(label) != ns)
1455 return res;
1456
1457 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1458 return res;
1459
1460 ls = labels_set(label);
1461 write_lock_irqsave(&ls->lock, flags);
1462 if (!label->hname && label->flags & FLAG_IN_TREE) {
1463 label->hname = name;
1464 res = true;
1465 } else
1466 aa_put_str(name);
1467 write_unlock_irqrestore(&ls->lock, flags);
1468
1469 return res;
1470}
1471
1472/*
1473 * cached label name is present and visible
1474 * @label->hname only exists if label is namespace hierachical
1475 */
1476static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1477 int flags)
1478{
1479 if (label->hname && (!ns || labels_ns(label) == ns) &&
1480 !(flags & ~FLAG_SHOW_MODE))
1481 return true;
1482
1483 return false;
1484}
1485
1486/* helper macro for snprint routines */
1487#define update_for_len(total, len, size, str) \
1488do { \
1489 size_t ulen = len; \
1490 \
1491 AA_BUG(len < 0); \
1492 total += ulen; \
1493 ulen = min(ulen, size); \
1494 size -= ulen; \
1495 str += ulen; \
1496} while (0)
1497
1498/**
1499 * aa_profile_snxprint - print a profile name to a buffer
1500 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1501 * @size: size of buffer
1502 * @view: namespace profile is being viewed from
1503 * @profile: profile to view (NOT NULL)
1504 * @flags: whether to include the mode string
1505 * @prev_ns: last ns printed when used in compound print
1506 *
1507 * Returns: size of name written or would be written if larger than
1508 * available buffer
1509 *
1510 * Note: will not print anything if the profile is not visible
1511 */
1512static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1513 struct aa_profile *profile, int flags,
1514 struct aa_ns **prev_ns)
1515{
1516 const char *ns_name = NULL;
1517
1518 AA_BUG(!str && size != 0);
1519 AA_BUG(!profile);
1520
1521 if (!view)
1522 view = profiles_ns(profile);
1523
1524 if (view != profile->ns &&
1525 (!prev_ns || (*prev_ns != profile->ns))) {
1526 if (prev_ns)
1527 *prev_ns = profile->ns;
1528 ns_name = aa_ns_name(view, profile->ns,
1529 flags & FLAG_VIEW_SUBNS);
1530 if (ns_name == aa_hidden_ns_name) {
1531 if (flags & FLAG_HIDDEN_UNCONFINED)
1532 return snprintf(str, size, "%s", "unconfined");
1533 return snprintf(str, size, "%s", ns_name);
1534 }
1535 }
1536
1537 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1538 const char *modestr = aa_profile_mode_names[profile->mode];
1539
1540 if (ns_name)
1541 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1542 profile->base.hname, modestr);
1543 return snprintf(str, size, "%s (%s)", profile->base.hname,
1544 modestr);
1545 }
1546
1547 if (ns_name)
1548 return snprintf(str, size, ":%s:%s", ns_name,
1549 profile->base.hname);
1550 return snprintf(str, size, "%s", profile->base.hname);
1551}
1552
1553static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1554 int flags)
1555{
1556 struct aa_profile *profile;
1557 struct label_it i;
1558 int mode = -1, count = 0;
1559
1560 label_for_each(i, label, profile) {
1561 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1562 count++;
1563 if (profile == profile->ns->unconfined)
1564 /* special case unconfined so stacks with
1565 * unconfined don't report as mixed. ie.
1566 * profile_foo//&:ns1:unconfined (mixed)
1567 */
1568 continue;
1569 if (mode == -1)
1570 mode = profile->mode;
1571 else if (mode != profile->mode)
1572 return "mixed";
1573 }
1574 }
1575
1576 if (count == 0)
1577 return "-";
1578 if (mode == -1)
1579 /* everything was unconfined */
1580 mode = APPARMOR_UNCONFINED;
1581
1582 return aa_profile_mode_names[mode];
1583}
1584
1585/* if any visible label is not unconfined the display_mode returns true */
1586static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1587 int flags)
1588{
1589 if ((flags & FLAG_SHOW_MODE)) {
1590 struct aa_profile *profile;
1591 struct label_it i;
1592
1593 label_for_each(i, label, profile) {
1594 if (aa_ns_visible(ns, profile->ns,
1595 flags & FLAG_VIEW_SUBNS) &&
1596 profile != profile->ns->unconfined)
1597 return true;
1598 }
1599 /* only ns->unconfined in set of profiles in ns */
1600 return false;
1601 }
1602
1603 return false;
1604}
1605
1606/**
1607 * aa_label_snxprint - print a label name to a string buffer
1608 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1609 * @size: size of buffer
1610 * @ns: namespace profile is being viewed from
1611 * @label: label to view (NOT NULL)
1612 * @flags: whether to include the mode string
1613 *
1614 * Returns: size of name written or would be written if larger than
1615 * available buffer
1616 *
1617 * Note: labels do not have to be strictly hierarchical to the ns as
1618 * objects may be shared across different namespaces and thus
1619 * pickup labeling from each ns. If a particular part of the
1620 * label is not visible it will just be excluded. And if none
1621 * of the label is visible "---" will be used.
1622 */
1623int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1624 struct aa_label *label, int flags)
1625{
1626 struct aa_profile *profile;
1627 struct aa_ns *prev_ns = NULL;
1628 struct label_it i;
1629 int count = 0, total = 0;
1630 ssize_t len;
1631
1632 AA_BUG(!str && size != 0);
1633 AA_BUG(!label);
1634
1635 if (flags & FLAG_ABS_ROOT) {
1636 ns = root_ns;
1637 len = snprintf(str, size, "=");
1638 update_for_len(total, len, size, str);
1639 } else if (!ns) {
1640 ns = labels_ns(label);
1641 }
1642
1643 label_for_each(i, label, profile) {
1644 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1645 if (count > 0) {
1646 len = snprintf(str, size, "//&");
1647 update_for_len(total, len, size, str);
1648 }
1649 len = aa_profile_snxprint(str, size, ns, profile,
1650 flags & FLAG_VIEW_SUBNS,
1651 &prev_ns);
1652 update_for_len(total, len, size, str);
1653 count++;
1654 }
1655 }
1656
1657 if (count == 0) {
1658 if (flags & FLAG_HIDDEN_UNCONFINED)
1659 return snprintf(str, size, "%s", "unconfined");
1660 return snprintf(str, size, "%s", aa_hidden_ns_name);
1661 }
1662
1663 /* count == 1 && ... is for backwards compat where the mode
1664 * is not displayed for 'unconfined' in the current ns
1665 */
1666 if (display_mode(ns, label, flags)) {
1667 len = snprintf(str, size, " (%s)",
1668 label_modename(ns, label, flags));
1669 update_for_len(total, len, size, str);
1670 }
1671
1672 return total;
1673}
1674#undef update_for_len
1675
1676/**
1677 * aa_label_asxprint - allocate a string buffer and print label into it
1678 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1679 * @ns: namespace profile is being viewed from
1680 * @label: label to view (NOT NULL)
1681 * @flags: flags controlling what label info is printed
1682 * @gfp: kernel memory allocation type
1683 *
1684 * Returns: size of name written or would be written if larger than
1685 * available buffer
1686 */
1687int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1688 int flags, gfp_t gfp)
1689{
1690 int size;
1691
1692 AA_BUG(!strp);
1693 AA_BUG(!label);
1694
1695 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1696 if (size < 0)
1697 return size;
1698
1699 *strp = kmalloc(size + 1, gfp);
1700 if (!*strp)
1701 return -ENOMEM;
1702 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1703}
1704
1705/**
1706 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1707 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1708 * @ns: namespace profile is being viewed from
1709 * @label: label to view (NOT NULL)
1710 * @flags: flags controlling what label info is printed
1711 * @gfp: kernel memory allocation type
1712 *
1713 * Returns: size of name written or would be written if larger than
1714 * available buffer
1715 */
1716int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1717 struct aa_label *label, int flags, gfp_t gfp)
1718{
1719 int size;
1720
1721 AA_BUG(!strp);
1722 AA_BUG(!label);
1723
1724 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1725 if (size < 0)
1726 return size;
1727
1728 *strp = aa_str_alloc(size + 1, gfp);
1729 if (!*strp)
1730 return -ENOMEM;
1731 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1732}
1733
1734
1735void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1736 struct aa_label *label, int flags, gfp_t gfp)
1737{
1738 const char *str;
1739 char *name = NULL;
1740 int len;
1741
1742 AA_BUG(!ab);
1743 AA_BUG(!label);
1744
1745 if (!use_label_hname(ns, label, flags) ||
1746 display_mode(ns, label, flags)) {
1747 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1748 if (len == -1) {
1749 AA_DEBUG("label print error");
1750 return;
1751 }
1752 str = name;
1753 } else {
1754 str = (char *) label->hname;
1755 len = strlen(str);
1756 }
1757 if (audit_string_contains_control(str, len))
1758 audit_log_n_hex(ab, str, len);
1759 else
1760 audit_log_n_string(ab, str, len);
1761
1762 kfree(name);
1763}
1764
1765void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1766 struct aa_label *label, int flags, gfp_t gfp)
1767{
1768 AA_BUG(!f);
1769 AA_BUG(!label);
1770
1771 if (!use_label_hname(ns, label, flags)) {
1772 char *str;
1773 int len;
1774
1775 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1776 if (len == -1) {
1777 AA_DEBUG("label print error");
1778 return;
1779 }
1780 seq_puts(f, str);
1781 kfree(str);
1782 } else if (display_mode(ns, label, flags))
1783 seq_printf(f, "%s (%s)", label->hname,
1784 label_modename(ns, label, flags));
1785 else
1786 seq_puts(f, label->hname);
1787}
1788
1789void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1790 gfp_t gfp)
1791{
1792 AA_BUG(!label);
1793
1794 if (!use_label_hname(ns, label, flags)) {
1795 char *str;
1796 int len;
1797
1798 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1799 if (len == -1) {
1800 AA_DEBUG("label print error");
1801 return;
1802 }
1803 pr_info("%s", str);
1804 kfree(str);
1805 } else if (display_mode(ns, label, flags))
1806 pr_info("%s (%s)", label->hname,
1807 label_modename(ns, label, flags));
1808 else
1809 pr_info("%s", label->hname);
1810}
1811
1812void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1813{
1814 struct aa_ns *ns = aa_get_current_ns();
1815
1816 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1817 aa_put_ns(ns);
1818}
1819
1820void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1821{
1822 struct aa_ns *ns = aa_get_current_ns();
1823
1824 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1825 aa_put_ns(ns);
1826}
1827
1828void aa_label_printk(struct aa_label *label, gfp_t gfp)
1829{
1830 struct aa_ns *ns = aa_get_current_ns();
1831
1832 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1833 aa_put_ns(ns);
1834}
1835
1836static int label_count_strn_entries(const char *str, size_t n)
1837{
1838 const char *end = str + n;
1839 const char *split;
1840 int count = 1;
1841
1842 AA_BUG(!str);
1843
1844 for (split = aa_label_strn_split(str, end - str);
1845 split;
1846 split = aa_label_strn_split(str, end - str)) {
1847 count++;
1848 str = split + 3;
1849 }
1850
1851 return count;
1852}
1853
1854/*
1855 * ensure stacks with components like
1856 * :ns:A//&B
1857 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1858 * to the base if the lookup specifies an ns, else making the stacked lookup
1859 * relative to the last embedded ns in the string.
1860 */
1861static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1862 struct aa_label *currentbase,
1863 const char *str, size_t n)
1864{
1865 const char *first = skipn_spaces(str, n);
1866
1867 if (first && *first == ':')
1868 return aa_fqlookupn_profile(base, str, n);
1869
1870 return aa_fqlookupn_profile(currentbase, str, n);
1871}
1872
1873/**
1874 * aa_label_strn_parse - parse, validate and convert a text string to a label
1875 * @base: base label to use for lookups (NOT NULL)
1876 * @str: null terminated text string (NOT NULL)
1877 * @n: length of str to parse, will stop at \0 if encountered before n
1878 * @gfp: allocation type
1879 * @create: true if should create compound labels if they don't exist
1880 * @force_stack: true if should stack even if no leading &
1881 *
1882 * Returns: the matching refcounted label if present
1883 * else ERRPTR
1884 */
1885struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1886 size_t n, gfp_t gfp, bool create,
1887 bool force_stack)
1888{
1889 DEFINE_VEC(profile, vec);
1890 struct aa_label *label, *currbase = base;
1891 int i, len, stack = 0, error;
1892 const char *end = str + n;
1893 const char *split;
1894
1895 AA_BUG(!base);
1896 AA_BUG(!str);
1897
1898 str = skipn_spaces(str, n);
1899 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1900 return ERR_PTR(-EINVAL);
1901
1902 len = label_count_strn_entries(str, end - str);
1903 if (*str == '&' || force_stack) {
1904 /* stack on top of base */
1905 stack = base->size;
1906 len += stack;
1907 if (*str == '&')
1908 str++;
1909 }
1910
1911 error = vec_setup(profile, vec, len, gfp);
1912 if (error)
1913 return ERR_PTR(error);
1914
1915 for (i = 0; i < stack; i++)
1916 vec[i] = aa_get_profile(base->vec[i]);
1917
1918 for (split = aa_label_strn_split(str, end - str), i = stack;
1919 split && i < len; i++) {
1920 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1921 if (!vec[i])
1922 goto fail;
1923 /*
1924 * if component specified a new ns it becomes the new base
1925 * so that subsequent lookups are relative to it
1926 */
1927 if (vec[i]->ns != labels_ns(currbase))
1928 currbase = &vec[i]->label;
1929 str = split + 3;
1930 split = aa_label_strn_split(str, end - str);
1931 }
1932 /* last element doesn't have a split */
1933 if (i < len) {
1934 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1935 if (!vec[i])
1936 goto fail;
1937 }
1938 if (len == 1)
1939 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1940 return &vec[0]->label;
1941
1942 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1943 /* TODO: deal with reference labels */
1944 if (len == 1) {
1945 label = aa_get_label(&vec[0]->label);
1946 goto out;
1947 }
1948
1949 if (create)
1950 label = aa_vec_find_or_create_label(vec, len, gfp);
1951 else
1952 label = vec_find(vec, len);
1953 if (!label)
1954 goto fail;
1955
1956out:
1957 /* use adjusted len from after vec_unique, not original */
1958 vec_cleanup(profile, vec, len);
1959 return label;
1960
1961fail:
1962 label = ERR_PTR(-ENOENT);
1963 goto out;
1964}
1965
1966struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1967 gfp_t gfp, bool create, bool force_stack)
1968{
1969 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1970 force_stack);
1971}
1972
1973/**
1974 * aa_labelset_destroy - remove all labels from the label set
1975 * @ls: label set to cleanup (NOT NULL)
1976 *
1977 * Labels that are removed from the set may still exist beyond the set
1978 * being destroyed depending on their reference counting
1979 */
1980void aa_labelset_destroy(struct aa_labelset *ls)
1981{
1982 struct rb_node *node;
1983 unsigned long flags;
1984
1985 AA_BUG(!ls);
1986
1987 write_lock_irqsave(&ls->lock, flags);
1988 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1989 struct aa_label *this = rb_entry(node, struct aa_label, node);
1990
1991 if (labels_ns(this) != root_ns)
1992 __label_remove(this,
1993 ns_unconfined(labels_ns(this)->parent));
1994 else
1995 __label_remove(this, NULL);
1996 }
1997 write_unlock_irqrestore(&ls->lock, flags);
1998}
1999
2000/*
2001 * @ls: labelset to init (NOT NULL)
2002 */
2003void aa_labelset_init(struct aa_labelset *ls)
2004{
2005 AA_BUG(!ls);
2006
2007 rwlock_init(&ls->lock);
2008 ls->root = RB_ROOT;
2009}
2010
2011static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2012{
2013 struct aa_label *label;
2014 struct rb_node *node;
2015 unsigned long flags;
2016
2017 AA_BUG(!ls);
2018
2019 read_lock_irqsave(&ls->lock, flags);
2020
2021 __labelset_for_each(ls, node) {
2022 label = rb_entry(node, struct aa_label, node);
2023 if ((label_is_stale(label) ||
2024 vec_is_stale(label->vec, label->size)) &&
2025 __aa_get_label(label))
2026 goto out;
2027
2028 }
2029 label = NULL;
2030
2031out:
2032 read_unlock_irqrestore(&ls->lock, flags);
2033
2034 return label;
2035}
2036
2037/**
2038 * __label_update - insert updated version of @label into labelset
2039 * @label - the label to update/replace
2040 *
2041 * Returns: new label that is up to date
2042 * else NULL on failure
2043 *
2044 * Requires: @ns lock be held
2045 *
2046 * Note: worst case is the stale @label does not get updated and has
2047 * to be updated at a later time.
2048 */
2049static struct aa_label *__label_update(struct aa_label *label)
2050{
2051 struct aa_label *new, *tmp;
2052 struct aa_labelset *ls;
2053 unsigned long flags;
2054 int i, invcount = 0;
2055
2056 AA_BUG(!label);
2057 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2058
2059 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2060 if (!new)
2061 return NULL;
2062
2063 /*
2064 * while holding the ns_lock will stop profile replacement, removal,
2065 * and label updates, label merging and removal can be occurring
2066 */
2067 ls = labels_set(label);
2068 write_lock_irqsave(&ls->lock, flags);
2069 for (i = 0; i < label->size; i++) {
2070 AA_BUG(!label->vec[i]);
2071 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2072 AA_BUG(!new->vec[i]);
2073 AA_BUG(!new->vec[i]->label.proxy);
2074 AA_BUG(!new->vec[i]->label.proxy->label);
2075 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2076 invcount++;
2077 }
2078
2079 /* updated stale label by being removed/renamed from labelset */
2080 if (invcount) {
2081 new->size -= aa_vec_unique(&new->vec[0], new->size,
2082 VEC_FLAG_TERMINATE);
2083 /* TODO: deal with reference labels */
2084 if (new->size == 1) {
2085 tmp = aa_get_label(&new->vec[0]->label);
2086 AA_BUG(tmp == label);
2087 goto remove;
2088 }
2089 if (labels_set(label) != labels_set(new)) {
2090 write_unlock_irqrestore(&ls->lock, flags);
2091 tmp = aa_label_insert(labels_set(new), new);
2092 write_lock_irqsave(&ls->lock, flags);
2093 goto remove;
2094 }
2095 } else
2096 AA_BUG(labels_ns(label) != labels_ns(new));
2097
2098 tmp = __label_insert(labels_set(label), new, true);
2099remove:
2100 /* ensure label is removed, and redirected correctly */
2101 __label_remove(label, tmp);
2102 write_unlock_irqrestore(&ls->lock, flags);
2103 label_free_or_put_new(tmp, new);
2104
2105 return tmp;
2106}
2107
2108/**
2109 * __labelset_update - update labels in @ns
2110 * @ns: namespace to update labels in (NOT NULL)
2111 *
2112 * Requires: @ns lock be held
2113 *
2114 * Walk the labelset ensuring that all labels are up to date and valid
2115 * Any label that has a stale component is marked stale and replaced and
2116 * by an updated version.
2117 *
2118 * If failures happen due to memory pressures then stale labels will
2119 * be left in place until the next pass.
2120 */
2121static void __labelset_update(struct aa_ns *ns)
2122{
2123 struct aa_label *label;
2124
2125 AA_BUG(!ns);
2126 AA_BUG(!mutex_is_locked(&ns->lock));
2127
2128 do {
2129 label = labelset_next_stale(&ns->labels);
2130 if (label) {
2131 struct aa_label *l = __label_update(label);
2132
2133 aa_put_label(l);
2134 aa_put_label(label);
2135 }
2136 } while (label);
2137}
2138
2139/**
2140 * __aa_labelset_udate_subtree - update all labels with a stale component
2141 * @ns: ns to start update at (NOT NULL)
2142 *
2143 * Requires: @ns lock be held
2144 *
2145 * Invalidates labels based on @p in @ns and any children namespaces.
2146 */
2147void __aa_labelset_update_subtree(struct aa_ns *ns)
2148{
2149 struct aa_ns *child;
2150
2151 AA_BUG(!ns);
2152 AA_BUG(!mutex_is_locked(&ns->lock));
2153
2154 __labelset_update(ns);
2155
2156 list_for_each_entry(child, &ns->sub_ns, base.list) {
2157 mutex_lock_nested(&child->lock, child->level);
2158 __aa_labelset_update_subtree(child);
2159 mutex_unlock(&child->lock);
2160 }
2161}