1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor label definitions
   5 *
   6 * Copyright 2017 Canonical Ltd.
   7 *
   8 * This program is free software; you can redistribute it and/or
   9 * modify it under the terms of the GNU General Public License as
  10 * published by the Free Software Foundation, version 2 of the
  11 * License.
  12 */
  13
  14#include <linux/audit.h>
  15#include <linux/seq_file.h>
  16#include <linux/sort.h>
  17
  18#include "include/apparmor.h"
  19#include "include/cred.h"
  20#include "include/label.h"
  21#include "include/policy.h"
  22#include "include/secid.h"
  23
  24
  25/*
  26 * the aa_label represents the set of profiles confining an object
  27 *
  28 * Labels maintain a reference count to the set of pointers they reference
  29 * Labels are ref counted by
  30 *   tasks and object via the security field/security context off the field
  31 *   code - will take a ref count on a label if it needs the label
  32 *          beyond what is possible with an rcu_read_lock.
  33 *   profiles - each profile is a label
  34 *   secids - a pinned secid will keep a refcount of the label it is
  35 *          referencing
  36 *   objects - inode, files, sockets, ...
  37 *
  38 * Labels are not ref counted by the label set, so they maybe removed and
  39 * freed when no longer in use.
  40 *
  41 */
  42
  43#define PROXY_POISON 97
  44#define LABEL_POISON 100
  45
  46static void free_proxy(struct aa_proxy *proxy)
  47{
  48	if (proxy) {
  49		/* p->label will not updated any more as p is dead */
  50		aa_put_label(rcu_dereference_protected(proxy->label, true));
  51		memset(proxy, 0, sizeof(*proxy));
  52		RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
  53		kfree(proxy);
  54	}
  55}
  56
  57void aa_proxy_kref(struct kref *kref)
  58{
  59	struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
  60
  61	free_proxy(proxy);
  62}
  63
  64struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
  65{
  66	struct aa_proxy *new;
  67
  68	new = kzalloc(sizeof(struct aa_proxy), gfp);
  69	if (new) {
  70		kref_init(&new->count);
  71		rcu_assign_pointer(new->label, aa_get_label(label));
  72	}
  73	return new;
  74}
  75
  76/* requires profile list write lock held */
  77void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
  78{
  79	struct aa_label *tmp;
  80
  81	AA_BUG(!orig);
  82	AA_BUG(!new);
  83	lockdep_assert_held_exclusive(&labels_set(orig)->lock);
  84
  85	tmp = rcu_dereference_protected(orig->proxy->label,
  86					&labels_ns(orig)->lock);
  87	rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
  88	orig->flags |= FLAG_STALE;
  89	aa_put_label(tmp);
  90}
  91
  92static void __proxy_share(struct aa_label *old, struct aa_label *new)
  93{
  94	struct aa_proxy *proxy = new->proxy;
  95
  96	new->proxy = aa_get_proxy(old->proxy);
  97	__aa_proxy_redirect(old, new);
  98	aa_put_proxy(proxy);
  99}
 100
 101
 102/**
 103 * ns_cmp - compare ns for label set ordering
 104 * @a: ns to compare (NOT NULL)
 105 * @b: ns to compare (NOT NULL)
 106 *
 107 * Returns: <0 if a < b
 108 *          ==0 if a == b
 109 *          >0  if a > b
 110 */
 111static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
 112{
 113	int res;
 114
 115	AA_BUG(!a);
 116	AA_BUG(!b);
 117	AA_BUG(!a->base.hname);
 118	AA_BUG(!b->base.hname);
 119
 120	if (a == b)
 121		return 0;
 122
 123	res = a->level - b->level;
 124	if (res)
 125		return res;
 126
 127	return strcmp(a->base.hname, b->base.hname);
 128}
 129
 130/**
 131 * profile_cmp - profile comparision for set ordering
 132 * @a: profile to compare (NOT NULL)
 133 * @b: profile to compare (NOT NULL)
 134 *
 135 * Returns: <0  if a < b
 136 *          ==0 if a == b
 137 *          >0  if a > b
 138 */
 139static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
 140{
 141	int res;
 142
 143	AA_BUG(!a);
 144	AA_BUG(!b);
 145	AA_BUG(!a->ns);
 146	AA_BUG(!b->ns);
 147	AA_BUG(!a->base.hname);
 148	AA_BUG(!b->base.hname);
 149
 150	if (a == b || a->base.hname == b->base.hname)
 151		return 0;
 152	res = ns_cmp(a->ns, b->ns);
 153	if (res)
 154		return res;
 155
 156	return strcmp(a->base.hname, b->base.hname);
 157}
 158
 159/**
 160 * vec_cmp - label comparision for set ordering
 161 * @a: label to compare (NOT NULL)
 162 * @vec: vector of profiles to compare (NOT NULL)
 163 * @n: length of @vec
 164 *
 165 * Returns: <0  if a < vec
 166 *          ==0 if a == vec
 167 *          >0  if a > vec
 168 */
 169static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
 170{
 171	int i;
 172
 173	AA_BUG(!a);
 174	AA_BUG(!*a);
 175	AA_BUG(!b);
 176	AA_BUG(!*b);
 177	AA_BUG(an <= 0);
 178	AA_BUG(bn <= 0);
 179
 180	for (i = 0; i < an && i < bn; i++) {
 181		int res = profile_cmp(a[i], b[i]);
 182
 183		if (res != 0)
 184			return res;
 185	}
 186
 187	return an - bn;
 188}
 189
 190static bool vec_is_stale(struct aa_profile **vec, int n)
 191{
 192	int i;
 193
 194	AA_BUG(!vec);
 195
 196	for (i = 0; i < n; i++) {
 197		if (profile_is_stale(vec[i]))
 198			return true;
 199	}
 200
 201	return false;
 202}
 203
 204static bool vec_unconfined(struct aa_profile **vec, int n)
 205{
 
 206	int i;
 207
 208	AA_BUG(!vec);
 209
 210	for (i = 0; i < n; i++) {
 211		if (!profile_unconfined(vec[i]))
 212			return false;
 
 
 213	}
 214
 215	return true;
 216}
 217
 218static int sort_cmp(const void *a, const void *b)
 219{
 220	return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
 221}
 222
 223/*
 224 * assumes vec is sorted
 225 * Assumes @vec has null terminator at vec[n], and will null terminate
 226 * vec[n - dups]
 227 */
 228static inline int unique(struct aa_profile **vec, int n)
 229{
 230	int i, pos, dups = 0;
 231
 232	AA_BUG(n < 1);
 233	AA_BUG(!vec);
 234
 235	pos = 0;
 236	for (i = 1; i < n; i++) {
 237		int res = profile_cmp(vec[pos], vec[i]);
 238
 239		AA_BUG(res > 0, "vec not sorted");
 240		if (res == 0) {
 241			/* drop duplicate */
 242			aa_put_profile(vec[i]);
 243			dups++;
 244			continue;
 245		}
 246		pos++;
 247		if (dups)
 248			vec[pos] = vec[i];
 249	}
 250
 251	AA_BUG(dups < 0);
 252
 253	return dups;
 254}
 255
 256/**
 257 * aa_vec_unique - canonical sort and unique a list of profiles
 258 * @n: number of refcounted profiles in the list (@n > 0)
 259 * @vec: list of profiles to sort and merge
 260 *
 261 * Returns: the number of duplicates eliminated == references put
 262 *
 263 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
 264 * null terminate vec[n - dups]
 265 */
 266int aa_vec_unique(struct aa_profile **vec, int n, int flags)
 267{
 268	int i, dups = 0;
 269
 270	AA_BUG(n < 1);
 271	AA_BUG(!vec);
 272
 273	/* vecs are usually small and inorder, have a fallback for larger */
 274	if (n > 8) {
 275		sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
 276		dups = unique(vec, n);
 277		goto out;
 278	}
 279
 280	/* insertion sort + unique in one */
 281	for (i = 1; i < n; i++) {
 282		struct aa_profile *tmp = vec[i];
 283		int pos, j;
 284
 285		for (pos = i - 1 - dups; pos >= 0; pos--) {
 286			int res = profile_cmp(vec[pos], tmp);
 287
 288			if (res == 0) {
 289				/* drop duplicate entry */
 290				aa_put_profile(tmp);
 291				dups++;
 292				goto continue_outer;
 293			} else if (res < 0)
 294				break;
 295		}
 296		/* pos is at entry < tmp, or index -1. Set to insert pos */
 297		pos++;
 298
 299		for (j = i - dups; j > pos; j--)
 300			vec[j] = vec[j - 1];
 301		vec[pos] = tmp;
 302continue_outer:
 303		;
 304	}
 305
 306	AA_BUG(dups < 0);
 307
 308out:
 309	if (flags & VEC_FLAG_TERMINATE)
 310		vec[n - dups] = NULL;
 311
 312	return dups;
 313}
 314
 315
 316static void label_destroy(struct aa_label *label)
 317{
 318	struct aa_label *tmp;
 319
 320	AA_BUG(!label);
 321
 322	if (!label_isprofile(label)) {
 323		struct aa_profile *profile;
 324		struct label_it i;
 325
 326		aa_put_str(label->hname);
 327
 328		label_for_each(i, label, profile) {
 329			aa_put_profile(profile);
 330			label->vec[i.i] = (struct aa_profile *)
 331					   (LABEL_POISON + (long) i.i);
 332		}
 333	}
 334
 335	if (rcu_dereference_protected(label->proxy->label, true) == label)
 336		rcu_assign_pointer(label->proxy->label, NULL);
 337
 
 
 338	aa_free_secid(label->secid);
 339
 340	tmp = rcu_dereference_protected(label->proxy->label, true);
 341	if (tmp == label)
 342		rcu_assign_pointer(label->proxy->label, NULL);
 343
 344	aa_put_proxy(label->proxy);
 345	label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
 346}
 347
 348void aa_label_free(struct aa_label *label)
 349{
 350	if (!label)
 351		return;
 352
 353	label_destroy(label);
 354	kfree(label);
 355}
 356
 357static void label_free_switch(struct aa_label *label)
 358{
 359	if (label->flags & FLAG_NS_COUNT)
 360		aa_free_ns(labels_ns(label));
 361	else if (label_isprofile(label))
 362		aa_free_profile(labels_profile(label));
 363	else
 364		aa_label_free(label);
 365}
 366
 367static void label_free_rcu(struct rcu_head *head)
 368{
 369	struct aa_label *label = container_of(head, struct aa_label, rcu);
 370
 371	if (label->flags & FLAG_IN_TREE)
 372		(void) aa_label_remove(label);
 373	label_free_switch(label);
 374}
 375
 376void aa_label_kref(struct kref *kref)
 377{
 378	struct aa_label *label = container_of(kref, struct aa_label, count);
 379	struct aa_ns *ns = labels_ns(label);
 380
 381	if (!ns) {
 382		/* never live, no rcu callback needed, just using the fn */
 383		label_free_switch(label);
 384		return;
 385	}
 386	/* TODO: update labels_profile macro so it works here */
 387	AA_BUG(label_isprofile(label) &&
 388	       on_list_rcu(&label->vec[0]->base.profiles));
 389	AA_BUG(label_isprofile(label) &&
 390	       on_list_rcu(&label->vec[0]->base.list));
 391
 392	/* TODO: if compound label and not stale add to reclaim cache */
 393	call_rcu(&label->rcu, label_free_rcu);
 394}
 395
 396static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
 397{
 398	if (label != new)
 399		/* need to free directly to break circular ref with proxy */
 400		aa_label_free(new);
 401	else
 402		aa_put_label(new);
 403}
 404
 405bool aa_label_init(struct aa_label *label, int size)
 406{
 407	AA_BUG(!label);
 408	AA_BUG(size < 1);
 409
 410	label->secid = aa_alloc_secid();
 411	if (label->secid == AA_SECID_INVALID)
 412		return false;
 413
 414	label->size = size;			/* doesn't include null */
 415	label->vec[size] = NULL;		/* null terminate */
 416	kref_init(&label->count);
 417	RB_CLEAR_NODE(&label->node);
 418
 419	return true;
 420}
 421
 422/**
 423 * aa_label_alloc - allocate a label with a profile vector of @size length
 424 * @size: size of profile vector in the label
 425 * @proxy: proxy to use OR null if to allocate a new one
 426 * @gfp: memory allocation type
 427 *
 428 * Returns: new label
 429 *     else NULL if failed
 430 */
 431struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
 432{
 433	struct aa_label *new;
 434
 435	AA_BUG(size < 1);
 436
 437	/*  + 1 for null terminator entry on vec */
 438	new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
 439			gfp);
 440	AA_DEBUG("%s (%p)\n", __func__, new);
 441	if (!new)
 442		goto fail;
 443
 444	if (!aa_label_init(new, size))
 445		goto fail;
 446
 447	if (!proxy) {
 448		proxy = aa_alloc_proxy(new, gfp);
 449		if (!proxy)
 450			goto fail;
 451	} else
 452		aa_get_proxy(proxy);
 453	/* just set new's proxy, don't redirect proxy here if it was passed in*/
 454	new->proxy = proxy;
 455
 456	return new;
 457
 458fail:
 459	kfree(new);
 460
 461	return NULL;
 462}
 463
 464
 465/**
 466 * label_cmp - label comparision for set ordering
 467 * @a: label to compare (NOT NULL)
 468 * @b: label to compare (NOT NULL)
 469 *
 470 * Returns: <0  if a < b
 471 *          ==0 if a == b
 472 *          >0  if a > b
 473 */
 474static int label_cmp(struct aa_label *a, struct aa_label *b)
 475{
 476	AA_BUG(!b);
 477
 478	if (a == b)
 479		return 0;
 480
 481	return vec_cmp(a->vec, a->size, b->vec, b->size);
 482}
 483
 484/* helper fn for label_for_each_confined */
 485int aa_label_next_confined(struct aa_label *label, int i)
 486{
 487	AA_BUG(!label);
 488	AA_BUG(i < 0);
 489
 490	for (; i < label->size; i++) {
 491		if (!profile_unconfined(label->vec[i]))
 492			return i;
 493	}
 494
 495	return i;
 496}
 497
 498/**
 499 * aa_label_next_not_in_set - return the next profile of @sub not in @set
 500 * @I: label iterator
 501 * @set: label to test against
 502 * @sub: label to if is subset of @set
 503 *
 504 * Returns: profile in @sub that is not in @set, with iterator set pos after
 505 *     else NULL if @sub is a subset of @set
 506 */
 507struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
 508					      struct aa_label *set,
 509					      struct aa_label *sub)
 510{
 511	AA_BUG(!set);
 512	AA_BUG(!I);
 513	AA_BUG(I->i < 0);
 514	AA_BUG(I->i > set->size);
 515	AA_BUG(!sub);
 516	AA_BUG(I->j < 0);
 517	AA_BUG(I->j > sub->size);
 518
 519	while (I->j < sub->size && I->i < set->size) {
 520		int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
 521
 522		if (res == 0) {
 523			(I->j)++;
 524			(I->i)++;
 525		} else if (res > 0)
 526			(I->i)++;
 527		else
 528			return sub->vec[(I->j)++];
 529	}
 530
 531	if (I->j < sub->size)
 532		return sub->vec[(I->j)++];
 533
 534	return NULL;
 535}
 536
 537/**
 538 * aa_label_is_subset - test if @sub is a subset of @set
 539 * @set: label to test against
 540 * @sub: label to test if is subset of @set
 541 *
 542 * Returns: true if @sub is subset of @set
 543 *     else false
 544 */
 545bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
 546{
 547	struct label_it i = { };
 548
 549	AA_BUG(!set);
 550	AA_BUG(!sub);
 551
 552	if (sub == set)
 553		return true;
 554
 555	return __aa_label_next_not_in_set(&i, set, sub) == NULL;
 556}
 557
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 558
 559
 560/**
 561 * __label_remove - remove @label from the label set
 562 * @l: label to remove
 563 * @new: label to redirect to
 564 *
 565 * Requires: labels_set(@label)->lock write_lock
 566 * Returns:  true if the label was in the tree and removed
 567 */
 568static bool __label_remove(struct aa_label *label, struct aa_label *new)
 569{
 570	struct aa_labelset *ls = labels_set(label);
 571
 572	AA_BUG(!ls);
 573	AA_BUG(!label);
 574	lockdep_assert_held_exclusive(&ls->lock);
 575
 576	if (new)
 577		__aa_proxy_redirect(label, new);
 578
 579	if (!label_is_stale(label))
 580		__label_make_stale(label);
 581
 582	if (label->flags & FLAG_IN_TREE) {
 583		rb_erase(&label->node, &ls->root);
 584		label->flags &= ~FLAG_IN_TREE;
 585		return true;
 586	}
 587
 588	return false;
 589}
 590
 591/**
 592 * __label_replace - replace @old with @new in label set
 593 * @old: label to remove from label set
 594 * @new: label to replace @old with
 595 *
 596 * Requires: labels_set(@old)->lock write_lock
 597 *           valid ref count be held on @new
 598 * Returns: true if @old was in set and replaced by @new
 599 *
 600 * Note: current implementation requires label set be order in such a way
 601 *       that @new directly replaces @old position in the set (ie.
 602 *       using pointer comparison of the label address would not work)
 603 */
 604static bool __label_replace(struct aa_label *old, struct aa_label *new)
 605{
 606	struct aa_labelset *ls = labels_set(old);
 607
 608	AA_BUG(!ls);
 609	AA_BUG(!old);
 610	AA_BUG(!new);
 611	lockdep_assert_held_exclusive(&ls->lock);
 612	AA_BUG(new->flags & FLAG_IN_TREE);
 613
 614	if (!label_is_stale(old))
 615		__label_make_stale(old);
 616
 617	if (old->flags & FLAG_IN_TREE) {
 618		rb_replace_node(&old->node, &new->node, &ls->root);
 619		old->flags &= ~FLAG_IN_TREE;
 620		new->flags |= FLAG_IN_TREE;
 621		return true;
 622	}
 623
 624	return false;
 625}
 626
 627/**
 628 * __label_insert - attempt to insert @l into a label set
 629 * @ls: set of labels to insert @l into (NOT NULL)
 630 * @label: new label to insert (NOT NULL)
 631 * @replace: whether insertion should replace existing entry that is not stale
 632 *
 633 * Requires: @ls->lock
 634 *           caller to hold a valid ref on l
 635 *           if @replace is true l has a preallocated proxy associated
 636 * Returns: @l if successful in inserting @l - with additional refcount
 637 *          else ref counted equivalent label that is already in the set,
 638 *          the else condition only happens if @replace is false
 639 */
 640static struct aa_label *__label_insert(struct aa_labelset *ls,
 641				       struct aa_label *label, bool replace)
 642{
 643	struct rb_node **new, *parent = NULL;
 644
 645	AA_BUG(!ls);
 646	AA_BUG(!label);
 647	AA_BUG(labels_set(label) != ls);
 648	lockdep_assert_held_exclusive(&ls->lock);
 649	AA_BUG(label->flags & FLAG_IN_TREE);
 650
 651	/* Figure out where to put new node */
 652	new = &ls->root.rb_node;
 653	while (*new) {
 654		struct aa_label *this = rb_entry(*new, struct aa_label, node);
 655		int result = label_cmp(label, this);
 656
 657		parent = *new;
 658		if (result == 0) {
 659			/* !__aa_get_label means queued for destruction,
 660			 * so replace in place, however the label has
 661			 * died before the replacement so do not share
 662			 * the proxy
 663			 */
 664			if (!replace && !label_is_stale(this)) {
 665				if (__aa_get_label(this))
 666					return this;
 667			} else
 668				__proxy_share(this, label);
 669			AA_BUG(!__label_replace(this, label));
 670			return aa_get_label(label);
 671		} else if (result < 0)
 672			new = &((*new)->rb_left);
 673		else /* (result > 0) */
 674			new = &((*new)->rb_right);
 675	}
 676
 677	/* Add new node and rebalance tree. */
 678	rb_link_node(&label->node, parent, new);
 679	rb_insert_color(&label->node, &ls->root);
 680	label->flags |= FLAG_IN_TREE;
 681
 682	return aa_get_label(label);
 683}
 684
 685/**
 686 * __vec_find - find label that matches @vec in label set
 687 * @vec: vec of profiles to find matching label for (NOT NULL)
 688 * @n: length of @vec
 689 *
 690 * Requires: @vec_labelset(vec) lock held
 691 *           caller to hold a valid ref on l
 692 *
 693 * Returns: ref counted @label if matching label is in tree
 694 *          ref counted label that is equiv to @l in tree
 695 *     else NULL if @vec equiv is not in tree
 696 */
 697static struct aa_label *__vec_find(struct aa_profile **vec, int n)
 698{
 699	struct rb_node *node;
 700
 701	AA_BUG(!vec);
 702	AA_BUG(!*vec);
 703	AA_BUG(n <= 0);
 704
 705	node = vec_labelset(vec, n)->root.rb_node;
 706	while (node) {
 707		struct aa_label *this = rb_entry(node, struct aa_label, node);
 708		int result = vec_cmp(this->vec, this->size, vec, n);
 709
 710		if (result > 0)
 711			node = node->rb_left;
 712		else if (result < 0)
 713			node = node->rb_right;
 714		else
 715			return __aa_get_label(this);
 716	}
 717
 718	return NULL;
 719}
 720
 721/**
 722 * __label_find - find label @label in label set
 723 * @label: label to find (NOT NULL)
 724 *
 725 * Requires: labels_set(@label)->lock held
 726 *           caller to hold a valid ref on l
 727 *
 728 * Returns: ref counted @label if @label is in tree OR
 729 *          ref counted label that is equiv to @label in tree
 730 *     else NULL if @label or equiv is not in tree
 731 */
 732static struct aa_label *__label_find(struct aa_label *label)
 733{
 734	AA_BUG(!label);
 735
 736	return __vec_find(label->vec, label->size);
 737}
 738
 739
 740/**
 741 * aa_label_remove - remove a label from the labelset
 742 * @label: label to remove
 743 *
 744 * Returns: true if @label was removed from the tree
 745 *     else @label was not in tree so it could not be removed
 746 */
 747bool aa_label_remove(struct aa_label *label)
 748{
 749	struct aa_labelset *ls = labels_set(label);
 750	unsigned long flags;
 751	bool res;
 752
 753	AA_BUG(!ls);
 754
 755	write_lock_irqsave(&ls->lock, flags);
 756	res = __label_remove(label, ns_unconfined(labels_ns(label)));
 757	write_unlock_irqrestore(&ls->lock, flags);
 758
 759	return res;
 760}
 761
 762/**
 763 * aa_label_replace - replace a label @old with a new version @new
 764 * @old: label to replace
 765 * @new: label replacing @old
 766 *
 767 * Returns: true if @old was in tree and replaced
 768 *     else @old was not in tree, and @new was not inserted
 769 */
 770bool aa_label_replace(struct aa_label *old, struct aa_label *new)
 771{
 772	unsigned long flags;
 773	bool res;
 774
 775	if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
 776		write_lock_irqsave(&labels_set(old)->lock, flags);
 777		if (old->proxy != new->proxy)
 778			__proxy_share(old, new);
 779		else
 780			__aa_proxy_redirect(old, new);
 781		res = __label_replace(old, new);
 782		write_unlock_irqrestore(&labels_set(old)->lock, flags);
 783	} else {
 784		struct aa_label *l;
 785		struct aa_labelset *ls = labels_set(old);
 786
 787		write_lock_irqsave(&ls->lock, flags);
 788		res = __label_remove(old, new);
 789		if (labels_ns(old) != labels_ns(new)) {
 790			write_unlock_irqrestore(&ls->lock, flags);
 791			ls = labels_set(new);
 792			write_lock_irqsave(&ls->lock, flags);
 793		}
 794		l = __label_insert(ls, new, true);
 795		res = (l == new);
 796		write_unlock_irqrestore(&ls->lock, flags);
 797		aa_put_label(l);
 798	}
 799
 800	return res;
 801}
 802
 803/**
 804 * vec_find - find label @l in label set
 805 * @vec: array of profiles to find equiv label for (NOT NULL)
 806 * @n: length of @vec
 807 *
 808 * Returns: refcounted label if @vec equiv is in tree
 809 *     else NULL if @vec equiv is not in tree
 810 */
 811static struct aa_label *vec_find(struct aa_profile **vec, int n)
 812{
 813	struct aa_labelset *ls;
 814	struct aa_label *label;
 815	unsigned long flags;
 816
 817	AA_BUG(!vec);
 818	AA_BUG(!*vec);
 819	AA_BUG(n <= 0);
 820
 821	ls = vec_labelset(vec, n);
 822	read_lock_irqsave(&ls->lock, flags);
 823	label = __vec_find(vec, n);
 824	read_unlock_irqrestore(&ls->lock, flags);
 825
 826	return label;
 827}
 828
 829/* requires sort and merge done first */
 830static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
 831						    int len, gfp_t gfp)
 832{
 833	struct aa_label *label = NULL;
 834	struct aa_labelset *ls;
 835	unsigned long flags;
 836	struct aa_label *new;
 837	int i;
 838
 839	AA_BUG(!vec);
 840
 841	if (len == 1)
 842		return aa_get_label(&vec[0]->label);
 843
 844	ls = labels_set(&vec[len - 1]->label);
 845
 846	/* TODO: enable when read side is lockless
 847	 * check if label exists before taking locks
 848	 */
 849	new = aa_label_alloc(len, NULL, gfp);
 850	if (!new)
 851		return NULL;
 852
 853	for (i = 0; i < len; i++)
 854		new->vec[i] = aa_get_profile(vec[i]);
 855
 856	write_lock_irqsave(&ls->lock, flags);
 857	label = __label_insert(ls, new, false);
 858	write_unlock_irqrestore(&ls->lock, flags);
 859	label_free_or_put_new(label, new);
 860
 861	return label;
 862}
 863
 864struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
 865					     gfp_t gfp)
 866{
 867	struct aa_label *label = vec_find(vec, len);
 868
 869	if (label)
 870		return label;
 871
 872	return vec_create_and_insert_label(vec, len, gfp);
 873}
 874
 875/**
 876 * aa_label_find - find label @label in label set
 877 * @label: label to find (NOT NULL)
 878 *
 879 * Requires: caller to hold a valid ref on l
 880 *
 881 * Returns: refcounted @label if @label is in tree
 882 *          refcounted label that is equiv to @label in tree
 883 *     else NULL if @label or equiv is not in tree
 884 */
 885struct aa_label *aa_label_find(struct aa_label *label)
 886{
 887	AA_BUG(!label);
 888
 889	return vec_find(label->vec, label->size);
 890}
 891
 892
 893/**
 894 * aa_label_insert - insert label @label into @ls or return existing label
 895 * @ls - labelset to insert @label into
 896 * @label - label to insert
 897 *
 898 * Requires: caller to hold a valid ref on @label
 899 *
 900 * Returns: ref counted @label if successful in inserting @label
 901 *     else ref counted equivalent label that is already in the set
 902 */
 903struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
 904{
 905	struct aa_label *l;
 906	unsigned long flags;
 907
 908	AA_BUG(!ls);
 909	AA_BUG(!label);
 910
 911	/* check if label exists before taking lock */
 912	if (!label_is_stale(label)) {
 913		read_lock_irqsave(&ls->lock, flags);
 914		l = __label_find(label);
 915		read_unlock_irqrestore(&ls->lock, flags);
 916		if (l)
 917			return l;
 918	}
 919
 920	write_lock_irqsave(&ls->lock, flags);
 921	l = __label_insert(ls, label, false);
 922	write_unlock_irqrestore(&ls->lock, flags);
 923
 924	return l;
 925}
 926
 927
 928/**
 929 * aa_label_next_in_merge - find the next profile when merging @a and @b
 930 * @I: label iterator
 931 * @a: label to merge
 932 * @b: label to merge
 933 *
 934 * Returns: next profile
 935 *     else null if no more profiles
 936 */
 937struct aa_profile *aa_label_next_in_merge(struct label_it *I,
 938					  struct aa_label *a,
 939					  struct aa_label *b)
 940{
 941	AA_BUG(!a);
 942	AA_BUG(!b);
 943	AA_BUG(!I);
 944	AA_BUG(I->i < 0);
 945	AA_BUG(I->i > a->size);
 946	AA_BUG(I->j < 0);
 947	AA_BUG(I->j > b->size);
 948
 949	if (I->i < a->size) {
 950		if (I->j < b->size) {
 951			int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
 952
 953			if (res > 0)
 954				return b->vec[(I->j)++];
 955			if (res == 0)
 956				(I->j)++;
 957		}
 958
 959		return a->vec[(I->i)++];
 960	}
 961
 962	if (I->j < b->size)
 963		return b->vec[(I->j)++];
 964
 965	return NULL;
 966}
 967
 968/**
 969 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
 970 * @a: label to merge then compare (NOT NULL)
 971 * @b: label to merge then compare (NOT NULL)
 972 * @z: label to compare merge against (NOT NULL)
 973 *
 974 * Assumes: using the most recent versions of @a, @b, and @z
 975 *
 976 * Returns: <0  if a < b
 977 *          ==0 if a == b
 978 *          >0  if a > b
 979 */
 980static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
 981			   struct aa_label *z)
 982{
 983	struct aa_profile *p = NULL;
 984	struct label_it i = { };
 985	int k;
 986
 987	AA_BUG(!a);
 988	AA_BUG(!b);
 989	AA_BUG(!z);
 990
 991	for (k = 0;
 992	     k < z->size && (p = aa_label_next_in_merge(&i, a, b));
 993	     k++) {
 994		int res = profile_cmp(p, z->vec[k]);
 995
 996		if (res != 0)
 997			return res;
 998	}
 999
1000	if (p)
1001		return 1;
1002	else if (k < z->size)
1003		return -1;
1004	return 0;
1005}
1006
1007/**
1008 * label_merge_insert - create a new label by merging @a and @b
1009 * @new: preallocated label to merge into (NOT NULL)
1010 * @a: label to merge with @b  (NOT NULL)
1011 * @b: label to merge with @a  (NOT NULL)
1012 *
1013 * Requires: preallocated proxy
1014 *
1015 * Returns: ref counted label either @new if merge is unique
1016 *          @a if @b is a subset of @a
1017 *          @b if @a is a subset of @b
1018 *
1019 * NOTE: will not use @new if the merge results in @new == @a or @b
1020 *
1021 *       Must be used within labelset write lock to avoid racing with
1022 *       setting labels stale.
1023 */
1024static struct aa_label *label_merge_insert(struct aa_label *new,
1025					   struct aa_label *a,
1026					   struct aa_label *b)
1027{
1028	struct aa_label *label;
1029	struct aa_labelset *ls;
1030	struct aa_profile *next;
1031	struct label_it i;
1032	unsigned long flags;
1033	int k = 0, invcount = 0;
1034	bool stale = false;
1035
1036	AA_BUG(!a);
1037	AA_BUG(a->size < 0);
1038	AA_BUG(!b);
1039	AA_BUG(b->size < 0);
1040	AA_BUG(!new);
1041	AA_BUG(new->size < a->size + b->size);
1042
1043	label_for_each_in_merge(i, a, b, next) {
1044		AA_BUG(!next);
1045		if (profile_is_stale(next)) {
1046			new->vec[k] = aa_get_newest_profile(next);
1047			AA_BUG(!new->vec[k]->label.proxy);
1048			AA_BUG(!new->vec[k]->label.proxy->label);
1049			if (next->label.proxy != new->vec[k]->label.proxy)
1050				invcount++;
1051			k++;
1052			stale = true;
1053		} else
1054			new->vec[k++] = aa_get_profile(next);
1055	}
1056	/* set to actual size which is <= allocated len */
1057	new->size = k;
1058	new->vec[k] = NULL;
1059
1060	if (invcount) {
1061		new->size -= aa_vec_unique(&new->vec[0], new->size,
1062					   VEC_FLAG_TERMINATE);
1063		/* TODO: deal with reference labels */
1064		if (new->size == 1) {
1065			label = aa_get_label(&new->vec[0]->label);
1066			return label;
1067		}
1068	} else if (!stale) {
1069		/*
1070		 * merge could be same as a || b, note: it is not possible
1071		 * for new->size == a->size == b->size unless a == b
1072		 */
1073		if (k == a->size)
1074			return aa_get_label(a);
1075		else if (k == b->size)
1076			return aa_get_label(b);
1077	}
1078	if (vec_unconfined(new->vec, new->size))
1079		new->flags |= FLAG_UNCONFINED;
1080	ls = labels_set(new);
1081	write_lock_irqsave(&ls->lock, flags);
1082	label = __label_insert(labels_set(new), new, false);
1083	write_unlock_irqrestore(&ls->lock, flags);
1084
1085	return label;
1086}
1087
1088/**
1089 * labelset_of_merge - find which labelset a merged label should be inserted
1090 * @a: label to merge and insert
1091 * @b: label to merge and insert
1092 *
1093 * Returns: labelset that the merged label should be inserted into
1094 */
1095static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1096					     struct aa_label *b)
1097{
1098	struct aa_ns *nsa = labels_ns(a);
1099	struct aa_ns *nsb = labels_ns(b);
1100
1101	if (ns_cmp(nsa, nsb) <= 0)
1102		return &nsa->labels;
1103	return &nsb->labels;
1104}
1105
1106/**
1107 * __label_find_merge - find label that is equiv to merge of @a and @b
1108 * @ls: set of labels to search (NOT NULL)
1109 * @a: label to merge with @b  (NOT NULL)
1110 * @b: label to merge with @a  (NOT NULL)
1111 *
1112 * Requires: ls->lock read_lock held
1113 *
1114 * Returns: ref counted label that is equiv to merge of @a and @b
1115 *     else NULL if merge of @a and @b is not in set
1116 */
1117static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1118					   struct aa_label *a,
1119					   struct aa_label *b)
1120{
1121	struct rb_node *node;
1122
1123	AA_BUG(!ls);
1124	AA_BUG(!a);
1125	AA_BUG(!b);
1126
1127	if (a == b)
1128		return __label_find(a);
1129
1130	node  = ls->root.rb_node;
1131	while (node) {
1132		struct aa_label *this = container_of(node, struct aa_label,
1133						     node);
1134		int result = label_merge_cmp(a, b, this);
1135
1136		if (result < 0)
1137			node = node->rb_left;
1138		else if (result > 0)
1139			node = node->rb_right;
1140		else
1141			return __aa_get_label(this);
1142	}
1143
1144	return NULL;
1145}
1146
1147
1148/**
1149 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1150 * @a: label to merge with @b  (NOT NULL)
1151 * @b: label to merge with @a  (NOT NULL)
1152 *
1153 * Requires: labels be fully constructed with a valid ns
1154 *
1155 * Returns: ref counted label that is equiv to merge of @a and @b
1156 *     else NULL if merge of @a and @b is not in set
1157 */
1158struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1159{
1160	struct aa_labelset *ls;
1161	struct aa_label *label, *ar = NULL, *br = NULL;
1162	unsigned long flags;
1163
1164	AA_BUG(!a);
1165	AA_BUG(!b);
1166
1167	if (label_is_stale(a))
1168		a = ar = aa_get_newest_label(a);
1169	if (label_is_stale(b))
1170		b = br = aa_get_newest_label(b);
1171	ls = labelset_of_merge(a, b);
1172	read_lock_irqsave(&ls->lock, flags);
1173	label = __label_find_merge(ls, a, b);
1174	read_unlock_irqrestore(&ls->lock, flags);
1175	aa_put_label(ar);
1176	aa_put_label(br);
1177
1178	return label;
1179}
1180
1181/**
1182 * aa_label_merge - attempt to insert new merged label of @a and @b
1183 * @ls: set of labels to insert label into (NOT NULL)
1184 * @a: label to merge with @b  (NOT NULL)
1185 * @b: label to merge with @a  (NOT NULL)
1186 * @gfp: memory allocation type
1187 *
1188 * Requires: caller to hold valid refs on @a and @b
1189 *           labels be fully constructed with a valid ns
1190 *
1191 * Returns: ref counted new label if successful in inserting merge of a & b
1192 *     else ref counted equivalent label that is already in the set.
1193 *     else NULL if could not create label (-ENOMEM)
1194 */
1195struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1196				gfp_t gfp)
1197{
1198	struct aa_label *label = NULL;
1199
1200	AA_BUG(!a);
1201	AA_BUG(!b);
1202
1203	if (a == b)
1204		return aa_get_newest_label(a);
1205
1206	/* TODO: enable when read side is lockless
1207	 * check if label exists before taking locks
1208	if (!label_is_stale(a) && !label_is_stale(b))
1209		label = aa_label_find_merge(a, b);
1210	*/
1211
1212	if (!label) {
1213		struct aa_label *new;
1214
1215		a = aa_get_newest_label(a);
1216		b = aa_get_newest_label(b);
1217
1218		/* could use label_merge_len(a, b), but requires double
1219		 * comparison for small savings
1220		 */
1221		new = aa_label_alloc(a->size + b->size, NULL, gfp);
1222		if (!new)
1223			goto out;
1224
1225		label = label_merge_insert(new, a, b);
1226		label_free_or_put_new(label, new);
1227out:
1228		aa_put_label(a);
1229		aa_put_label(b);
1230	}
1231
1232	return label;
1233}
1234
1235static inline bool label_is_visible(struct aa_profile *profile,
1236				    struct aa_label *label)
1237{
1238	return aa_ns_visible(profile->ns, labels_ns(label), true);
1239}
1240
1241/* match a profile and its associated ns component if needed
1242 * Assumes visibility test has already been done.
1243 * If a subns profile is not to be matched should be prescreened with
1244 * visibility test.
1245 */
1246static inline unsigned int match_component(struct aa_profile *profile,
1247					   struct aa_profile *tp,
1248					   unsigned int state)
 
1249{
1250	const char *ns_name;
1251
1252	if (profile->ns == tp->ns)
1253		return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1254
1255	/* try matching with namespace name and then profile */
1256	ns_name = aa_ns_name(profile->ns, tp->ns, true);
1257	state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1258	state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1259	state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1260	return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1261}
1262
1263/**
1264 * label_compound_match - find perms for full compound label
1265 * @profile: profile to find perms for
1266 * @label: label to check access permissions for
1267 * @start: state to start match in
1268 * @subns: whether to do permission checks on components in a subns
1269 * @request: permissions to request
1270 * @perms: perms struct to set
1271 *
1272 * Returns: 0 on success else ERROR
1273 *
1274 * For the label A//&B//&C this does the perm match for A//&B//&C
1275 * @perms should be preinitialized with allperms OR a previous permission
1276 *        check to be stacked.
1277 */
1278static int label_compound_match(struct aa_profile *profile,
 
1279				struct aa_label *label,
1280				unsigned int state, bool subns, u32 request,
1281				struct aa_perms *perms)
1282{
1283	struct aa_profile *tp;
1284	struct label_it i;
1285
1286	/* find first subcomponent that is visible */
1287	label_for_each(i, label, tp) {
1288		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1289			continue;
1290		state = match_component(profile, tp, state);
1291		if (!state)
1292			goto fail;
1293		goto next;
1294	}
1295
1296	/* no component visible */
1297	*perms = allperms;
1298	return 0;
1299
1300next:
1301	label_for_each_cont(i, label, tp) {
1302		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1303			continue;
1304		state = aa_dfa_match(profile->policy.dfa, state, "//&");
1305		state = match_component(profile, tp, state);
1306		if (!state)
1307			goto fail;
1308	}
1309	aa_compute_perms(profile->policy.dfa, state, perms);
1310	aa_apply_modes_to_perms(profile, perms);
1311	if ((perms->allow & request) != request)
1312		return -EACCES;
1313
1314	return 0;
1315
1316fail:
1317	*perms = nullperms;
1318	return state;
1319}
1320
1321/**
1322 * label_components_match - find perms for all subcomponents of a label
1323 * @profile: profile to find perms for
 
1324 * @label: label to check access permissions for
1325 * @start: state to start match in
1326 * @subns: whether to do permission checks on components in a subns
1327 * @request: permissions to request
1328 * @perms: an initialized perms struct to add accumulation to
1329 *
1330 * Returns: 0 on success else ERROR
1331 *
1332 * For the label A//&B//&C this does the perm match for each of A and B and C
1333 * @perms should be preinitialized with allperms OR a previous permission
1334 *        check to be stacked.
1335 */
1336static int label_components_match(struct aa_profile *profile,
1337				  struct aa_label *label, unsigned int start,
 
1338				  bool subns, u32 request,
1339				  struct aa_perms *perms)
1340{
1341	struct aa_profile *tp;
1342	struct label_it i;
1343	struct aa_perms tmp;
1344	unsigned int state = 0;
1345
1346	/* find first subcomponent to test */
1347	label_for_each(i, label, tp) {
1348		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1349			continue;
1350		state = match_component(profile, tp, start);
1351		if (!state)
1352			goto fail;
1353		goto next;
1354	}
1355
1356	/* no subcomponents visible - no change in perms */
1357	return 0;
1358
1359next:
1360	aa_compute_perms(profile->policy.dfa, state, &tmp);
1361	aa_apply_modes_to_perms(profile, &tmp);
1362	aa_perms_accum(perms, &tmp);
1363	label_for_each_cont(i, label, tp) {
1364		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1365			continue;
1366		state = match_component(profile, tp, start);
1367		if (!state)
1368			goto fail;
1369		aa_compute_perms(profile->policy.dfa, state, &tmp);
1370		aa_apply_modes_to_perms(profile, &tmp);
1371		aa_perms_accum(perms, &tmp);
1372	}
1373
1374	if ((perms->allow & request) != request)
1375		return -EACCES;
1376
1377	return 0;
1378
1379fail:
1380	*perms = nullperms;
1381	return -EACCES;
1382}
1383
1384/**
1385 * aa_label_match - do a multi-component label match
1386 * @profile: profile to match against (NOT NULL)
 
1387 * @label: label to match (NOT NULL)
1388 * @state: state to start in
1389 * @subns: whether to match subns components
1390 * @request: permission request
1391 * @perms: Returns computed perms (NOT NULL)
1392 *
1393 * Returns: the state the match finished in, may be the none matching state
1394 */
1395int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1396		   unsigned int state, bool subns, u32 request,
1397		   struct aa_perms *perms)
1398{
1399	int error = label_compound_match(profile, label, state, subns, request,
1400					 perms);
1401	if (!error)
1402		return error;
1403
1404	*perms = allperms;
1405	return label_components_match(profile, label, state, subns, request,
1406				      perms);
1407}
1408
1409
1410/**
1411 * aa_update_label_name - update a label to have a stored name
1412 * @ns: ns being viewed from (NOT NULL)
1413 * @label: label to update (NOT NULL)
1414 * @gfp: type of memory allocation
1415 *
1416 * Requires: labels_set(label) not locked in caller
1417 *
1418 * note: only updates the label name if it does not have a name already
1419 *       and if it is in the labelset
1420 */
1421bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1422{
1423	struct aa_labelset *ls;
1424	unsigned long flags;
1425	char __counted *name;
1426	bool res = false;
1427
1428	AA_BUG(!ns);
1429	AA_BUG(!label);
1430
1431	if (label->hname || labels_ns(label) != ns)
1432		return res;
1433
1434	if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1435		return res;
1436
1437	ls = labels_set(label);
1438	write_lock_irqsave(&ls->lock, flags);
1439	if (!label->hname && label->flags & FLAG_IN_TREE) {
1440		label->hname = name;
1441		res = true;
1442	} else
1443		aa_put_str(name);
1444	write_unlock_irqrestore(&ls->lock, flags);
1445
1446	return res;
1447}
1448
1449/*
1450 * cached label name is present and visible
1451 * @label->hname only exists if label is namespace hierachical
1452 */
1453static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1454				   int flags)
1455{
1456	if (label->hname && (!ns || labels_ns(label) == ns) &&
1457	    !(flags & ~FLAG_SHOW_MODE))
1458		return true;
1459
1460	return false;
1461}
1462
1463/* helper macro for snprint routines */
1464#define update_for_len(total, len, size, str)	\
1465do {					\
 
 
1466	AA_BUG(len < 0);		\
1467	total += len;			\
1468	len = min(len, size);		\
1469	size -= len;			\
1470	str += len;			\
1471} while (0)
1472
1473/**
1474 * aa_profile_snxprint - print a profile name to a buffer
1475 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1476 * @size: size of buffer
1477 * @view: namespace profile is being viewed from
1478 * @profile: profile to view (NOT NULL)
1479 * @flags: whether to include the mode string
1480 * @prev_ns: last ns printed when used in compound print
1481 *
1482 * Returns: size of name written or would be written if larger than
1483 *          available buffer
1484 *
1485 * Note: will not print anything if the profile is not visible
1486 */
1487static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1488			       struct aa_profile *profile, int flags,
1489			       struct aa_ns **prev_ns)
1490{
1491	const char *ns_name = NULL;
1492
1493	AA_BUG(!str && size != 0);
1494	AA_BUG(!profile);
1495
1496	if (!view)
1497		view = profiles_ns(profile);
1498
1499	if (view != profile->ns &&
1500	    (!prev_ns || (*prev_ns != profile->ns))) {
1501		if (prev_ns)
1502			*prev_ns = profile->ns;
1503		ns_name = aa_ns_name(view, profile->ns,
1504				     flags & FLAG_VIEW_SUBNS);
1505		if (ns_name == aa_hidden_ns_name) {
1506			if (flags & FLAG_HIDDEN_UNCONFINED)
1507				return snprintf(str, size, "%s", "unconfined");
1508			return snprintf(str, size, "%s", ns_name);
1509		}
1510	}
1511
1512	if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1513		const char *modestr = aa_profile_mode_names[profile->mode];
1514
1515		if (ns_name)
1516			return snprintf(str, size, ":%s:%s (%s)", ns_name,
1517					profile->base.hname, modestr);
1518		return snprintf(str, size, "%s (%s)", profile->base.hname,
1519				modestr);
1520	}
1521
1522	if (ns_name)
1523		return snprintf(str, size, ":%s:%s", ns_name,
1524				profile->base.hname);
1525	return snprintf(str, size, "%s", profile->base.hname);
1526}
1527
1528static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1529				  int flags)
1530{
1531	struct aa_profile *profile;
1532	struct label_it i;
1533	int mode = -1, count = 0;
1534
1535	label_for_each(i, label, profile) {
1536		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1537			if (profile->mode == APPARMOR_UNCONFINED)
 
1538				/* special case unconfined so stacks with
1539				 * unconfined don't report as mixed. ie.
1540				 * profile_foo//&:ns1:unconfined (mixed)
1541				 */
1542				continue;
1543			count++;
1544			if (mode == -1)
1545				mode = profile->mode;
1546			else if (mode != profile->mode)
1547				return "mixed";
1548		}
1549	}
1550
1551	if (count == 0)
1552		return "-";
1553	if (mode == -1)
1554		/* everything was unconfined */
1555		mode = APPARMOR_UNCONFINED;
1556
1557	return aa_profile_mode_names[mode];
1558}
1559
1560/* if any visible label is not unconfined the display_mode returns true */
1561static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1562				int flags)
1563{
1564	if ((flags & FLAG_SHOW_MODE)) {
1565		struct aa_profile *profile;
1566		struct label_it i;
1567
1568		label_for_each(i, label, profile) {
1569			if (aa_ns_visible(ns, profile->ns,
1570					  flags & FLAG_VIEW_SUBNS) &&
1571			    profile != profile->ns->unconfined)
1572				return true;
1573		}
1574		/* only ns->unconfined in set of profiles in ns */
1575		return false;
1576	}
1577
1578	return false;
1579}
1580
1581/**
1582 * aa_label_snxprint - print a label name to a string buffer
1583 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1584 * @size: size of buffer
1585 * @ns: namespace profile is being viewed from
1586 * @label: label to view (NOT NULL)
1587 * @flags: whether to include the mode string
1588 *
1589 * Returns: size of name written or would be written if larger than
1590 *          available buffer
1591 *
1592 * Note: labels do not have to be strictly hierarchical to the ns as
1593 *       objects may be shared across different namespaces and thus
1594 *       pickup labeling from each ns.  If a particular part of the
1595 *       label is not visible it will just be excluded.  And if none
1596 *       of the label is visible "---" will be used.
1597 */
1598int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1599		      struct aa_label *label, int flags)
1600{
1601	struct aa_profile *profile;
1602	struct aa_ns *prev_ns = NULL;
1603	struct label_it i;
1604	int count = 0, total = 0;
1605	size_t len;
1606
1607	AA_BUG(!str && size != 0);
1608	AA_BUG(!label);
1609
1610	if (flags & FLAG_ABS_ROOT) {
1611		ns = root_ns;
1612		len = snprintf(str, size, "=");
1613		update_for_len(total, len, size, str);
1614	} else if (!ns) {
1615		ns = labels_ns(label);
1616	}
1617
1618	label_for_each(i, label, profile) {
1619		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1620			if (count > 0) {
1621				len = snprintf(str, size, "//&");
1622				update_for_len(total, len, size, str);
1623			}
1624			len = aa_profile_snxprint(str, size, ns, profile,
1625						  flags & FLAG_VIEW_SUBNS,
1626						  &prev_ns);
1627			update_for_len(total, len, size, str);
1628			count++;
1629		}
1630	}
1631
1632	if (count == 0) {
1633		if (flags & FLAG_HIDDEN_UNCONFINED)
1634			return snprintf(str, size, "%s", "unconfined");
1635		return snprintf(str, size, "%s", aa_hidden_ns_name);
1636	}
1637
1638	/* count == 1 && ... is for backwards compat where the mode
1639	 * is not displayed for 'unconfined' in the current ns
1640	 */
1641	if (display_mode(ns, label, flags)) {
1642		len = snprintf(str, size, " (%s)",
1643			       label_modename(ns, label, flags));
1644		update_for_len(total, len, size, str);
1645	}
1646
1647	return total;
1648}
1649#undef update_for_len
1650
1651/**
1652 * aa_label_asxprint - allocate a string buffer and print label into it
1653 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1654 * @ns: namespace profile is being viewed from
1655 * @label: label to view (NOT NULL)
1656 * @flags: flags controlling what label info is printed
1657 * @gfp: kernel memory allocation type
1658 *
1659 * Returns: size of name written or would be written if larger than
1660 *          available buffer
1661 */
1662int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1663		      int flags, gfp_t gfp)
1664{
1665	int size;
1666
1667	AA_BUG(!strp);
1668	AA_BUG(!label);
1669
1670	size = aa_label_snxprint(NULL, 0, ns, label, flags);
1671	if (size < 0)
1672		return size;
1673
1674	*strp = kmalloc(size + 1, gfp);
1675	if (!*strp)
1676		return -ENOMEM;
1677	return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1678}
1679
1680/**
1681 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1682 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1683 * @ns: namespace profile is being viewed from
1684 * @label: label to view (NOT NULL)
1685 * @flags: flags controlling what label info is printed
1686 * @gfp: kernel memory allocation type
1687 *
1688 * Returns: size of name written or would be written if larger than
1689 *          available buffer
1690 */
1691int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1692			 struct aa_label *label, int flags, gfp_t gfp)
1693{
1694	int size;
1695
1696	AA_BUG(!strp);
1697	AA_BUG(!label);
1698
1699	size = aa_label_snxprint(NULL, 0, ns, label, flags);
1700	if (size < 0)
1701		return size;
1702
1703	*strp = aa_str_alloc(size + 1, gfp);
1704	if (!*strp)
1705		return -ENOMEM;
1706	return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1707}
1708
1709
1710void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1711		     struct aa_label *label, int flags, gfp_t gfp)
1712{
1713	const char *str;
1714	char *name = NULL;
1715	int len;
1716
1717	AA_BUG(!ab);
1718	AA_BUG(!label);
1719
1720	if (!use_label_hname(ns, label, flags) ||
1721	    display_mode(ns, label, flags)) {
1722		len  = aa_label_asxprint(&name, ns, label, flags, gfp);
1723		if (len == -1) {
1724			AA_DEBUG("label print error");
1725			return;
1726		}
1727		str = name;
1728	} else {
1729		str = (char *) label->hname;
1730		len = strlen(str);
1731	}
1732	if (audit_string_contains_control(str, len))
1733		audit_log_n_hex(ab, str, len);
1734	else
1735		audit_log_n_string(ab, str, len);
1736
1737	kfree(name);
1738}
1739
1740void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1741			 struct aa_label *label, int flags, gfp_t gfp)
1742{
1743	AA_BUG(!f);
1744	AA_BUG(!label);
1745
1746	if (!use_label_hname(ns, label, flags)) {
1747		char *str;
1748		int len;
1749
1750		len = aa_label_asxprint(&str, ns, label, flags, gfp);
1751		if (len == -1) {
1752			AA_DEBUG("label print error");
1753			return;
1754		}
1755		seq_printf(f, "%s", str);
1756		kfree(str);
1757	} else if (display_mode(ns, label, flags))
1758		seq_printf(f, "%s (%s)", label->hname,
1759			   label_modename(ns, label, flags));
1760	else
1761		seq_printf(f, "%s", label->hname);
1762}
1763
1764void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1765		      gfp_t gfp)
1766{
1767	AA_BUG(!label);
1768
1769	if (!use_label_hname(ns, label, flags)) {
1770		char *str;
1771		int len;
1772
1773		len = aa_label_asxprint(&str, ns, label, flags, gfp);
1774		if (len == -1) {
1775			AA_DEBUG("label print error");
1776			return;
1777		}
1778		pr_info("%s", str);
1779		kfree(str);
1780	} else if (display_mode(ns, label, flags))
1781		pr_info("%s (%s)", label->hname,
1782		       label_modename(ns, label, flags));
1783	else
1784		pr_info("%s", label->hname);
1785}
1786
1787void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1788{
1789	struct aa_ns *ns = aa_get_current_ns();
1790
1791	aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1792	aa_put_ns(ns);
1793}
1794
1795void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1796{
1797	struct aa_ns *ns = aa_get_current_ns();
1798
1799	aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1800	aa_put_ns(ns);
1801}
1802
1803void aa_label_printk(struct aa_label *label, gfp_t gfp)
1804{
1805	struct aa_ns *ns = aa_get_current_ns();
1806
1807	aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1808	aa_put_ns(ns);
1809}
1810
1811static int label_count_strn_entries(const char *str, size_t n)
1812{
1813	const char *end = str + n;
1814	const char *split;
1815	int count = 1;
1816
1817	AA_BUG(!str);
1818
1819	for (split = aa_label_strn_split(str, end - str);
1820	     split;
1821	     split = aa_label_strn_split(str, end - str)) {
1822		count++;
1823		str = split + 3;
1824	}
1825
1826	return count;
1827}
1828
1829/*
1830 * ensure stacks with components like
1831 *   :ns:A//&B
1832 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1833 * to the base if the lookup specifies an ns, else making the stacked lookup
1834 * relative to the last embedded ns in the string.
1835 */
1836static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1837					    struct aa_label *currentbase,
1838					    const char *str, size_t n)
1839{
1840	const char *first = skipn_spaces(str, n);
1841
1842	if (first && *first == ':')
1843		return aa_fqlookupn_profile(base, str, n);
1844
1845	return aa_fqlookupn_profile(currentbase, str, n);
1846}
1847
1848/**
1849 * aa_label_strn_parse - parse, validate and convert a text string to a label
1850 * @base: base label to use for lookups (NOT NULL)
1851 * @str: null terminated text string (NOT NULL)
1852 * @n: length of str to parse, will stop at \0 if encountered before n
1853 * @gfp: allocation type
1854 * @create: true if should create compound labels if they don't exist
1855 * @force_stack: true if should stack even if no leading &
1856 *
1857 * Returns: the matching refcounted label if present
1858 *     else ERRPTR
1859 */
1860struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1861				     size_t n, gfp_t gfp, bool create,
1862				     bool force_stack)
1863{
1864	DEFINE_VEC(profile, vec);
1865	struct aa_label *label, *currbase = base;
1866	int i, len, stack = 0, error;
1867	const char *end = str + n;
1868	const char *split;
1869
1870	AA_BUG(!base);
1871	AA_BUG(!str);
1872
1873	str = skipn_spaces(str, n);
1874	if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
 
1875		return ERR_PTR(-EINVAL);
1876
1877	len = label_count_strn_entries(str, end - str);
1878	if (*str == '&' || force_stack) {
1879		/* stack on top of base */
1880		stack = base->size;
1881		len += stack;
1882		if (*str == '&')
1883			str++;
1884	}
1885
1886	error = vec_setup(profile, vec, len, gfp);
1887	if (error)
1888		return ERR_PTR(error);
1889
1890	for (i = 0; i < stack; i++)
1891		vec[i] = aa_get_profile(base->vec[i]);
1892
1893	for (split = aa_label_strn_split(str, end - str), i = stack;
1894	     split && i < len; i++) {
1895		vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1896		if (!vec[i])
1897			goto fail;
1898		/*
1899		 * if component specified a new ns it becomes the new base
1900		 * so that subsequent lookups are relative to it
1901		 */
1902		if (vec[i]->ns != labels_ns(currbase))
1903			currbase = &vec[i]->label;
1904		str = split + 3;
1905		split = aa_label_strn_split(str, end - str);
1906	}
1907	/* last element doesn't have a split */
1908	if (i < len) {
1909		vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1910		if (!vec[i])
1911			goto fail;
1912	}
1913	if (len == 1)
1914		/* no need to free vec as len < LOCAL_VEC_ENTRIES */
1915		return &vec[0]->label;
1916
1917	len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1918	/* TODO: deal with reference labels */
1919	if (len == 1) {
1920		label = aa_get_label(&vec[0]->label);
1921		goto out;
1922	}
1923
1924	if (create)
1925		label = aa_vec_find_or_create_label(vec, len, gfp);
1926	else
1927		label = vec_find(vec, len);
1928	if (!label)
1929		goto fail;
1930
1931out:
1932	/* use adjusted len from after vec_unique, not original */
1933	vec_cleanup(profile, vec, len);
1934	return label;
1935
1936fail:
1937	label = ERR_PTR(-ENOENT);
1938	goto out;
1939}
1940
1941struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1942				gfp_t gfp, bool create, bool force_stack)
1943{
1944	return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1945				   force_stack);
1946}
1947
1948/**
1949 * aa_labelset_destroy - remove all labels from the label set
1950 * @ls: label set to cleanup (NOT NULL)
1951 *
1952 * Labels that are removed from the set may still exist beyond the set
1953 * being destroyed depending on their reference counting
1954 */
1955void aa_labelset_destroy(struct aa_labelset *ls)
1956{
1957	struct rb_node *node;
1958	unsigned long flags;
1959
1960	AA_BUG(!ls);
1961
1962	write_lock_irqsave(&ls->lock, flags);
1963	for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1964		struct aa_label *this = rb_entry(node, struct aa_label, node);
1965
1966		if (labels_ns(this) != root_ns)
1967			__label_remove(this,
1968				       ns_unconfined(labels_ns(this)->parent));
1969		else
1970			__label_remove(this, NULL);
1971	}
1972	write_unlock_irqrestore(&ls->lock, flags);
1973}
1974
1975/*
1976 * @ls: labelset to init (NOT NULL)
1977 */
1978void aa_labelset_init(struct aa_labelset *ls)
1979{
1980	AA_BUG(!ls);
1981
1982	rwlock_init(&ls->lock);
1983	ls->root = RB_ROOT;
1984}
1985
1986static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1987{
1988	struct aa_label *label;
1989	struct rb_node *node;
1990	unsigned long flags;
1991
1992	AA_BUG(!ls);
1993
1994	read_lock_irqsave(&ls->lock, flags);
1995
1996	__labelset_for_each(ls, node) {
1997		label = rb_entry(node, struct aa_label, node);
1998		if ((label_is_stale(label) ||
1999		     vec_is_stale(label->vec, label->size)) &&
2000		    __aa_get_label(label))
2001			goto out;
2002
2003	}
2004	label = NULL;
2005
2006out:
2007	read_unlock_irqrestore(&ls->lock, flags);
2008
2009	return label;
2010}
2011
2012/**
2013 * __label_update - insert updated version of @label into labelset
2014 * @label - the label to update/repace
2015 *
2016 * Returns: new label that is up to date
2017 *     else NULL on failure
2018 *
2019 * Requires: @ns lock be held
2020 *
2021 * Note: worst case is the stale @label does not get updated and has
2022 *       to be updated at a later time.
2023 */
2024static struct aa_label *__label_update(struct aa_label *label)
2025{
2026	struct aa_label *new, *tmp;
2027	struct aa_labelset *ls;
2028	unsigned long flags;
2029	int i, invcount = 0;
2030
2031	AA_BUG(!label);
2032	AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2033
2034	new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2035	if (!new)
2036		return NULL;
2037
2038	/*
2039	 * while holding the ns_lock will stop profile replacement, removal,
2040	 * and label updates, label merging and removal can be occurring
2041	 */
2042	ls = labels_set(label);
2043	write_lock_irqsave(&ls->lock, flags);
2044	for (i = 0; i < label->size; i++) {
2045		AA_BUG(!label->vec[i]);
2046		new->vec[i] = aa_get_newest_profile(label->vec[i]);
2047		AA_BUG(!new->vec[i]);
2048		AA_BUG(!new->vec[i]->label.proxy);
2049		AA_BUG(!new->vec[i]->label.proxy->label);
2050		if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2051			invcount++;
2052	}
2053
2054	/* updated stale label by being removed/renamed from labelset */
2055	if (invcount) {
2056		new->size -= aa_vec_unique(&new->vec[0], new->size,
2057					   VEC_FLAG_TERMINATE);
2058		/* TODO: deal with reference labels */
2059		if (new->size == 1) {
2060			tmp = aa_get_label(&new->vec[0]->label);
2061			AA_BUG(tmp == label);
2062			goto remove;
2063		}
2064		if (labels_set(label) != labels_set(new)) {
2065			write_unlock_irqrestore(&ls->lock, flags);
2066			tmp = aa_label_insert(labels_set(new), new);
2067			write_lock_irqsave(&ls->lock, flags);
2068			goto remove;
2069		}
2070	} else
2071		AA_BUG(labels_ns(label) != labels_ns(new));
2072
2073	tmp = __label_insert(labels_set(label), new, true);
2074remove:
2075	/* ensure label is removed, and redirected correctly */
2076	__label_remove(label, tmp);
2077	write_unlock_irqrestore(&ls->lock, flags);
2078	label_free_or_put_new(tmp, new);
2079
2080	return tmp;
2081}
2082
2083/**
2084 * __labelset_update - update labels in @ns
2085 * @ns: namespace to update labels in  (NOT NULL)
2086 *
2087 * Requires: @ns lock be held
2088 *
2089 * Walk the labelset ensuring that all labels are up to date and valid
2090 * Any label that has a stale component is marked stale and replaced and
2091 * by an updated version.
2092 *
2093 * If failures happen due to memory pressures then stale labels will
2094 * be left in place until the next pass.
2095 */
2096static void __labelset_update(struct aa_ns *ns)
2097{
2098	struct aa_label *label;
2099
2100	AA_BUG(!ns);
2101	AA_BUG(!mutex_is_locked(&ns->lock));
2102
2103	do {
2104		label = labelset_next_stale(&ns->labels);
2105		if (label) {
2106			struct aa_label *l = __label_update(label);
2107
2108			aa_put_label(l);
2109			aa_put_label(label);
2110		}
2111	} while (label);
2112}
2113
2114/**
2115 * __aa_labelset_udate_subtree - update all labels with a stale component
2116 * @ns: ns to start update at (NOT NULL)
2117 *
2118 * Requires: @ns lock be held
2119 *
2120 * Invalidates labels based on @p in @ns and any children namespaces.
2121 */
2122void __aa_labelset_update_subtree(struct aa_ns *ns)
2123{
2124	struct aa_ns *child;
2125
2126	AA_BUG(!ns);
2127	AA_BUG(!mutex_is_locked(&ns->lock));
2128
2129	__labelset_update(ns);
2130
2131	list_for_each_entry(child, &ns->sub_ns, base.list) {
2132		mutex_lock_nested(&child->lock, child->level);
2133		__aa_labelset_update_subtree(child);
2134		mutex_unlock(&child->lock);
2135	}
2136}