Loading...
1/*
2 * AppArmor security module
3 *
4 * This file contains AppArmor label definitions
5 *
6 * Copyright 2017 Canonical Ltd.
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
11 * License.
12 */
13
14#include <linux/audit.h>
15#include <linux/seq_file.h>
16#include <linux/sort.h>
17
18#include "include/apparmor.h"
19#include "include/cred.h"
20#include "include/label.h"
21#include "include/policy.h"
22#include "include/secid.h"
23
24
25/*
26 * the aa_label represents the set of profiles confining an object
27 *
28 * Labels maintain a reference count to the set of pointers they reference
29 * Labels are ref counted by
30 * tasks and object via the security field/security context off the field
31 * code - will take a ref count on a label if it needs the label
32 * beyond what is possible with an rcu_read_lock.
33 * profiles - each profile is a label
34 * secids - a pinned secid will keep a refcount of the label it is
35 * referencing
36 * objects - inode, files, sockets, ...
37 *
38 * Labels are not ref counted by the label set, so they maybe removed and
39 * freed when no longer in use.
40 *
41 */
42
43#define PROXY_POISON 97
44#define LABEL_POISON 100
45
46static void free_proxy(struct aa_proxy *proxy)
47{
48 if (proxy) {
49 /* p->label will not updated any more as p is dead */
50 aa_put_label(rcu_dereference_protected(proxy->label, true));
51 memset(proxy, 0, sizeof(*proxy));
52 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
53 kfree(proxy);
54 }
55}
56
57void aa_proxy_kref(struct kref *kref)
58{
59 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
60
61 free_proxy(proxy);
62}
63
64struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
65{
66 struct aa_proxy *new;
67
68 new = kzalloc(sizeof(struct aa_proxy), gfp);
69 if (new) {
70 kref_init(&new->count);
71 rcu_assign_pointer(new->label, aa_get_label(label));
72 }
73 return new;
74}
75
76/* requires profile list write lock held */
77void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
78{
79 struct aa_label *tmp;
80
81 AA_BUG(!orig);
82 AA_BUG(!new);
83 lockdep_assert_held_exclusive(&labels_set(orig)->lock);
84
85 tmp = rcu_dereference_protected(orig->proxy->label,
86 &labels_ns(orig)->lock);
87 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
88 orig->flags |= FLAG_STALE;
89 aa_put_label(tmp);
90}
91
92static void __proxy_share(struct aa_label *old, struct aa_label *new)
93{
94 struct aa_proxy *proxy = new->proxy;
95
96 new->proxy = aa_get_proxy(old->proxy);
97 __aa_proxy_redirect(old, new);
98 aa_put_proxy(proxy);
99}
100
101
102/**
103 * ns_cmp - compare ns for label set ordering
104 * @a: ns to compare (NOT NULL)
105 * @b: ns to compare (NOT NULL)
106 *
107 * Returns: <0 if a < b
108 * ==0 if a == b
109 * >0 if a > b
110 */
111static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
112{
113 int res;
114
115 AA_BUG(!a);
116 AA_BUG(!b);
117 AA_BUG(!a->base.hname);
118 AA_BUG(!b->base.hname);
119
120 if (a == b)
121 return 0;
122
123 res = a->level - b->level;
124 if (res)
125 return res;
126
127 return strcmp(a->base.hname, b->base.hname);
128}
129
130/**
131 * profile_cmp - profile comparision for set ordering
132 * @a: profile to compare (NOT NULL)
133 * @b: profile to compare (NOT NULL)
134 *
135 * Returns: <0 if a < b
136 * ==0 if a == b
137 * >0 if a > b
138 */
139static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
140{
141 int res;
142
143 AA_BUG(!a);
144 AA_BUG(!b);
145 AA_BUG(!a->ns);
146 AA_BUG(!b->ns);
147 AA_BUG(!a->base.hname);
148 AA_BUG(!b->base.hname);
149
150 if (a == b || a->base.hname == b->base.hname)
151 return 0;
152 res = ns_cmp(a->ns, b->ns);
153 if (res)
154 return res;
155
156 return strcmp(a->base.hname, b->base.hname);
157}
158
159/**
160 * vec_cmp - label comparision for set ordering
161 * @a: label to compare (NOT NULL)
162 * @vec: vector of profiles to compare (NOT NULL)
163 * @n: length of @vec
164 *
165 * Returns: <0 if a < vec
166 * ==0 if a == vec
167 * >0 if a > vec
168 */
169static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
170{
171 int i;
172
173 AA_BUG(!a);
174 AA_BUG(!*a);
175 AA_BUG(!b);
176 AA_BUG(!*b);
177 AA_BUG(an <= 0);
178 AA_BUG(bn <= 0);
179
180 for (i = 0; i < an && i < bn; i++) {
181 int res = profile_cmp(a[i], b[i]);
182
183 if (res != 0)
184 return res;
185 }
186
187 return an - bn;
188}
189
190static bool vec_is_stale(struct aa_profile **vec, int n)
191{
192 int i;
193
194 AA_BUG(!vec);
195
196 for (i = 0; i < n; i++) {
197 if (profile_is_stale(vec[i]))
198 return true;
199 }
200
201 return false;
202}
203
204static bool vec_unconfined(struct aa_profile **vec, int n)
205{
206 int i;
207
208 AA_BUG(!vec);
209
210 for (i = 0; i < n; i++) {
211 if (!profile_unconfined(vec[i]))
212 return false;
213 }
214
215 return true;
216}
217
218static int sort_cmp(const void *a, const void *b)
219{
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
221}
222
223/*
224 * assumes vec is sorted
225 * Assumes @vec has null terminator at vec[n], and will null terminate
226 * vec[n - dups]
227 */
228static inline int unique(struct aa_profile **vec, int n)
229{
230 int i, pos, dups = 0;
231
232 AA_BUG(n < 1);
233 AA_BUG(!vec);
234
235 pos = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
238
239 AA_BUG(res > 0, "vec not sorted");
240 if (res == 0) {
241 /* drop duplicate */
242 aa_put_profile(vec[i]);
243 dups++;
244 continue;
245 }
246 pos++;
247 if (dups)
248 vec[pos] = vec[i];
249 }
250
251 AA_BUG(dups < 0);
252
253 return dups;
254}
255
256/**
257 * aa_vec_unique - canonical sort and unique a list of profiles
258 * @n: number of refcounted profiles in the list (@n > 0)
259 * @vec: list of profiles to sort and merge
260 *
261 * Returns: the number of duplicates eliminated == references put
262 *
263 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
264 * null terminate vec[n - dups]
265 */
266int aa_vec_unique(struct aa_profile **vec, int n, int flags)
267{
268 int i, dups = 0;
269
270 AA_BUG(n < 1);
271 AA_BUG(!vec);
272
273 /* vecs are usually small and inorder, have a fallback for larger */
274 if (n > 8) {
275 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
276 dups = unique(vec, n);
277 goto out;
278 }
279
280 /* insertion sort + unique in one */
281 for (i = 1; i < n; i++) {
282 struct aa_profile *tmp = vec[i];
283 int pos, j;
284
285 for (pos = i - 1 - dups; pos >= 0; pos--) {
286 int res = profile_cmp(vec[pos], tmp);
287
288 if (res == 0) {
289 /* drop duplicate entry */
290 aa_put_profile(tmp);
291 dups++;
292 goto continue_outer;
293 } else if (res < 0)
294 break;
295 }
296 /* pos is at entry < tmp, or index -1. Set to insert pos */
297 pos++;
298
299 for (j = i - dups; j > pos; j--)
300 vec[j] = vec[j - 1];
301 vec[pos] = tmp;
302continue_outer:
303 ;
304 }
305
306 AA_BUG(dups < 0);
307
308out:
309 if (flags & VEC_FLAG_TERMINATE)
310 vec[n - dups] = NULL;
311
312 return dups;
313}
314
315
316static void label_destroy(struct aa_label *label)
317{
318 struct aa_label *tmp;
319
320 AA_BUG(!label);
321
322 if (!label_isprofile(label)) {
323 struct aa_profile *profile;
324 struct label_it i;
325
326 aa_put_str(label->hname);
327
328 label_for_each(i, label, profile) {
329 aa_put_profile(profile);
330 label->vec[i.i] = (struct aa_profile *)
331 (LABEL_POISON + (long) i.i);
332 }
333 }
334
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
337
338 aa_free_secid(label->secid);
339
340 tmp = rcu_dereference_protected(label->proxy->label, true);
341 if (tmp == label)
342 rcu_assign_pointer(label->proxy->label, NULL);
343
344 aa_put_proxy(label->proxy);
345 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
346}
347
348void aa_label_free(struct aa_label *label)
349{
350 if (!label)
351 return;
352
353 label_destroy(label);
354 kfree(label);
355}
356
357static void label_free_switch(struct aa_label *label)
358{
359 if (label->flags & FLAG_NS_COUNT)
360 aa_free_ns(labels_ns(label));
361 else if (label_isprofile(label))
362 aa_free_profile(labels_profile(label));
363 else
364 aa_label_free(label);
365}
366
367static void label_free_rcu(struct rcu_head *head)
368{
369 struct aa_label *label = container_of(head, struct aa_label, rcu);
370
371 if (label->flags & FLAG_IN_TREE)
372 (void) aa_label_remove(label);
373 label_free_switch(label);
374}
375
376void aa_label_kref(struct kref *kref)
377{
378 struct aa_label *label = container_of(kref, struct aa_label, count);
379 struct aa_ns *ns = labels_ns(label);
380
381 if (!ns) {
382 /* never live, no rcu callback needed, just using the fn */
383 label_free_switch(label);
384 return;
385 }
386 /* TODO: update labels_profile macro so it works here */
387 AA_BUG(label_isprofile(label) &&
388 on_list_rcu(&label->vec[0]->base.profiles));
389 AA_BUG(label_isprofile(label) &&
390 on_list_rcu(&label->vec[0]->base.list));
391
392 /* TODO: if compound label and not stale add to reclaim cache */
393 call_rcu(&label->rcu, label_free_rcu);
394}
395
396static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
397{
398 if (label != new)
399 /* need to free directly to break circular ref with proxy */
400 aa_label_free(new);
401 else
402 aa_put_label(new);
403}
404
405bool aa_label_init(struct aa_label *label, int size)
406{
407 AA_BUG(!label);
408 AA_BUG(size < 1);
409
410 label->secid = aa_alloc_secid();
411 if (label->secid == AA_SECID_INVALID)
412 return false;
413
414 label->size = size; /* doesn't include null */
415 label->vec[size] = NULL; /* null terminate */
416 kref_init(&label->count);
417 RB_CLEAR_NODE(&label->node);
418
419 return true;
420}
421
422/**
423 * aa_label_alloc - allocate a label with a profile vector of @size length
424 * @size: size of profile vector in the label
425 * @proxy: proxy to use OR null if to allocate a new one
426 * @gfp: memory allocation type
427 *
428 * Returns: new label
429 * else NULL if failed
430 */
431struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
432{
433 struct aa_label *new;
434
435 AA_BUG(size < 1);
436
437 /* + 1 for null terminator entry on vec */
438 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
439 gfp);
440 AA_DEBUG("%s (%p)\n", __func__, new);
441 if (!new)
442 goto fail;
443
444 if (!aa_label_init(new, size))
445 goto fail;
446
447 if (!proxy) {
448 proxy = aa_alloc_proxy(new, gfp);
449 if (!proxy)
450 goto fail;
451 } else
452 aa_get_proxy(proxy);
453 /* just set new's proxy, don't redirect proxy here if it was passed in*/
454 new->proxy = proxy;
455
456 return new;
457
458fail:
459 kfree(new);
460
461 return NULL;
462}
463
464
465/**
466 * label_cmp - label comparision for set ordering
467 * @a: label to compare (NOT NULL)
468 * @b: label to compare (NOT NULL)
469 *
470 * Returns: <0 if a < b
471 * ==0 if a == b
472 * >0 if a > b
473 */
474static int label_cmp(struct aa_label *a, struct aa_label *b)
475{
476 AA_BUG(!b);
477
478 if (a == b)
479 return 0;
480
481 return vec_cmp(a->vec, a->size, b->vec, b->size);
482}
483
484/* helper fn for label_for_each_confined */
485int aa_label_next_confined(struct aa_label *label, int i)
486{
487 AA_BUG(!label);
488 AA_BUG(i < 0);
489
490 for (; i < label->size; i++) {
491 if (!profile_unconfined(label->vec[i]))
492 return i;
493 }
494
495 return i;
496}
497
498/**
499 * aa_label_next_not_in_set - return the next profile of @sub not in @set
500 * @I: label iterator
501 * @set: label to test against
502 * @sub: label to if is subset of @set
503 *
504 * Returns: profile in @sub that is not in @set, with iterator set pos after
505 * else NULL if @sub is a subset of @set
506 */
507struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
508 struct aa_label *set,
509 struct aa_label *sub)
510{
511 AA_BUG(!set);
512 AA_BUG(!I);
513 AA_BUG(I->i < 0);
514 AA_BUG(I->i > set->size);
515 AA_BUG(!sub);
516 AA_BUG(I->j < 0);
517 AA_BUG(I->j > sub->size);
518
519 while (I->j < sub->size && I->i < set->size) {
520 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
521
522 if (res == 0) {
523 (I->j)++;
524 (I->i)++;
525 } else if (res > 0)
526 (I->i)++;
527 else
528 return sub->vec[(I->j)++];
529 }
530
531 if (I->j < sub->size)
532 return sub->vec[(I->j)++];
533
534 return NULL;
535}
536
537/**
538 * aa_label_is_subset - test if @sub is a subset of @set
539 * @set: label to test against
540 * @sub: label to test if is subset of @set
541 *
542 * Returns: true if @sub is subset of @set
543 * else false
544 */
545bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
546{
547 struct label_it i = { };
548
549 AA_BUG(!set);
550 AA_BUG(!sub);
551
552 if (sub == set)
553 return true;
554
555 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
556}
557
558
559
560/**
561 * __label_remove - remove @label from the label set
562 * @l: label to remove
563 * @new: label to redirect to
564 *
565 * Requires: labels_set(@label)->lock write_lock
566 * Returns: true if the label was in the tree and removed
567 */
568static bool __label_remove(struct aa_label *label, struct aa_label *new)
569{
570 struct aa_labelset *ls = labels_set(label);
571
572 AA_BUG(!ls);
573 AA_BUG(!label);
574 lockdep_assert_held_exclusive(&ls->lock);
575
576 if (new)
577 __aa_proxy_redirect(label, new);
578
579 if (!label_is_stale(label))
580 __label_make_stale(label);
581
582 if (label->flags & FLAG_IN_TREE) {
583 rb_erase(&label->node, &ls->root);
584 label->flags &= ~FLAG_IN_TREE;
585 return true;
586 }
587
588 return false;
589}
590
591/**
592 * __label_replace - replace @old with @new in label set
593 * @old: label to remove from label set
594 * @new: label to replace @old with
595 *
596 * Requires: labels_set(@old)->lock write_lock
597 * valid ref count be held on @new
598 * Returns: true if @old was in set and replaced by @new
599 *
600 * Note: current implementation requires label set be order in such a way
601 * that @new directly replaces @old position in the set (ie.
602 * using pointer comparison of the label address would not work)
603 */
604static bool __label_replace(struct aa_label *old, struct aa_label *new)
605{
606 struct aa_labelset *ls = labels_set(old);
607
608 AA_BUG(!ls);
609 AA_BUG(!old);
610 AA_BUG(!new);
611 lockdep_assert_held_exclusive(&ls->lock);
612 AA_BUG(new->flags & FLAG_IN_TREE);
613
614 if (!label_is_stale(old))
615 __label_make_stale(old);
616
617 if (old->flags & FLAG_IN_TREE) {
618 rb_replace_node(&old->node, &new->node, &ls->root);
619 old->flags &= ~FLAG_IN_TREE;
620 new->flags |= FLAG_IN_TREE;
621 return true;
622 }
623
624 return false;
625}
626
627/**
628 * __label_insert - attempt to insert @l into a label set
629 * @ls: set of labels to insert @l into (NOT NULL)
630 * @label: new label to insert (NOT NULL)
631 * @replace: whether insertion should replace existing entry that is not stale
632 *
633 * Requires: @ls->lock
634 * caller to hold a valid ref on l
635 * if @replace is true l has a preallocated proxy associated
636 * Returns: @l if successful in inserting @l - with additional refcount
637 * else ref counted equivalent label that is already in the set,
638 * the else condition only happens if @replace is false
639 */
640static struct aa_label *__label_insert(struct aa_labelset *ls,
641 struct aa_label *label, bool replace)
642{
643 struct rb_node **new, *parent = NULL;
644
645 AA_BUG(!ls);
646 AA_BUG(!label);
647 AA_BUG(labels_set(label) != ls);
648 lockdep_assert_held_exclusive(&ls->lock);
649 AA_BUG(label->flags & FLAG_IN_TREE);
650
651 /* Figure out where to put new node */
652 new = &ls->root.rb_node;
653 while (*new) {
654 struct aa_label *this = rb_entry(*new, struct aa_label, node);
655 int result = label_cmp(label, this);
656
657 parent = *new;
658 if (result == 0) {
659 /* !__aa_get_label means queued for destruction,
660 * so replace in place, however the label has
661 * died before the replacement so do not share
662 * the proxy
663 */
664 if (!replace && !label_is_stale(this)) {
665 if (__aa_get_label(this))
666 return this;
667 } else
668 __proxy_share(this, label);
669 AA_BUG(!__label_replace(this, label));
670 return aa_get_label(label);
671 } else if (result < 0)
672 new = &((*new)->rb_left);
673 else /* (result > 0) */
674 new = &((*new)->rb_right);
675 }
676
677 /* Add new node and rebalance tree. */
678 rb_link_node(&label->node, parent, new);
679 rb_insert_color(&label->node, &ls->root);
680 label->flags |= FLAG_IN_TREE;
681
682 return aa_get_label(label);
683}
684
685/**
686 * __vec_find - find label that matches @vec in label set
687 * @vec: vec of profiles to find matching label for (NOT NULL)
688 * @n: length of @vec
689 *
690 * Requires: @vec_labelset(vec) lock held
691 * caller to hold a valid ref on l
692 *
693 * Returns: ref counted @label if matching label is in tree
694 * ref counted label that is equiv to @l in tree
695 * else NULL if @vec equiv is not in tree
696 */
697static struct aa_label *__vec_find(struct aa_profile **vec, int n)
698{
699 struct rb_node *node;
700
701 AA_BUG(!vec);
702 AA_BUG(!*vec);
703 AA_BUG(n <= 0);
704
705 node = vec_labelset(vec, n)->root.rb_node;
706 while (node) {
707 struct aa_label *this = rb_entry(node, struct aa_label, node);
708 int result = vec_cmp(this->vec, this->size, vec, n);
709
710 if (result > 0)
711 node = node->rb_left;
712 else if (result < 0)
713 node = node->rb_right;
714 else
715 return __aa_get_label(this);
716 }
717
718 return NULL;
719}
720
721/**
722 * __label_find - find label @label in label set
723 * @label: label to find (NOT NULL)
724 *
725 * Requires: labels_set(@label)->lock held
726 * caller to hold a valid ref on l
727 *
728 * Returns: ref counted @label if @label is in tree OR
729 * ref counted label that is equiv to @label in tree
730 * else NULL if @label or equiv is not in tree
731 */
732static struct aa_label *__label_find(struct aa_label *label)
733{
734 AA_BUG(!label);
735
736 return __vec_find(label->vec, label->size);
737}
738
739
740/**
741 * aa_label_remove - remove a label from the labelset
742 * @label: label to remove
743 *
744 * Returns: true if @label was removed from the tree
745 * else @label was not in tree so it could not be removed
746 */
747bool aa_label_remove(struct aa_label *label)
748{
749 struct aa_labelset *ls = labels_set(label);
750 unsigned long flags;
751 bool res;
752
753 AA_BUG(!ls);
754
755 write_lock_irqsave(&ls->lock, flags);
756 res = __label_remove(label, ns_unconfined(labels_ns(label)));
757 write_unlock_irqrestore(&ls->lock, flags);
758
759 return res;
760}
761
762/**
763 * aa_label_replace - replace a label @old with a new version @new
764 * @old: label to replace
765 * @new: label replacing @old
766 *
767 * Returns: true if @old was in tree and replaced
768 * else @old was not in tree, and @new was not inserted
769 */
770bool aa_label_replace(struct aa_label *old, struct aa_label *new)
771{
772 unsigned long flags;
773 bool res;
774
775 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
776 write_lock_irqsave(&labels_set(old)->lock, flags);
777 if (old->proxy != new->proxy)
778 __proxy_share(old, new);
779 else
780 __aa_proxy_redirect(old, new);
781 res = __label_replace(old, new);
782 write_unlock_irqrestore(&labels_set(old)->lock, flags);
783 } else {
784 struct aa_label *l;
785 struct aa_labelset *ls = labels_set(old);
786
787 write_lock_irqsave(&ls->lock, flags);
788 res = __label_remove(old, new);
789 if (labels_ns(old) != labels_ns(new)) {
790 write_unlock_irqrestore(&ls->lock, flags);
791 ls = labels_set(new);
792 write_lock_irqsave(&ls->lock, flags);
793 }
794 l = __label_insert(ls, new, true);
795 res = (l == new);
796 write_unlock_irqrestore(&ls->lock, flags);
797 aa_put_label(l);
798 }
799
800 return res;
801}
802
803/**
804 * vec_find - find label @l in label set
805 * @vec: array of profiles to find equiv label for (NOT NULL)
806 * @n: length of @vec
807 *
808 * Returns: refcounted label if @vec equiv is in tree
809 * else NULL if @vec equiv is not in tree
810 */
811static struct aa_label *vec_find(struct aa_profile **vec, int n)
812{
813 struct aa_labelset *ls;
814 struct aa_label *label;
815 unsigned long flags;
816
817 AA_BUG(!vec);
818 AA_BUG(!*vec);
819 AA_BUG(n <= 0);
820
821 ls = vec_labelset(vec, n);
822 read_lock_irqsave(&ls->lock, flags);
823 label = __vec_find(vec, n);
824 read_unlock_irqrestore(&ls->lock, flags);
825
826 return label;
827}
828
829/* requires sort and merge done first */
830static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
831 int len, gfp_t gfp)
832{
833 struct aa_label *label = NULL;
834 struct aa_labelset *ls;
835 unsigned long flags;
836 struct aa_label *new;
837 int i;
838
839 AA_BUG(!vec);
840
841 if (len == 1)
842 return aa_get_label(&vec[0]->label);
843
844 ls = labels_set(&vec[len - 1]->label);
845
846 /* TODO: enable when read side is lockless
847 * check if label exists before taking locks
848 */
849 new = aa_label_alloc(len, NULL, gfp);
850 if (!new)
851 return NULL;
852
853 for (i = 0; i < len; i++)
854 new->vec[i] = aa_get_profile(vec[i]);
855
856 write_lock_irqsave(&ls->lock, flags);
857 label = __label_insert(ls, new, false);
858 write_unlock_irqrestore(&ls->lock, flags);
859 label_free_or_put_new(label, new);
860
861 return label;
862}
863
864struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
865 gfp_t gfp)
866{
867 struct aa_label *label = vec_find(vec, len);
868
869 if (label)
870 return label;
871
872 return vec_create_and_insert_label(vec, len, gfp);
873}
874
875/**
876 * aa_label_find - find label @label in label set
877 * @label: label to find (NOT NULL)
878 *
879 * Requires: caller to hold a valid ref on l
880 *
881 * Returns: refcounted @label if @label is in tree
882 * refcounted label that is equiv to @label in tree
883 * else NULL if @label or equiv is not in tree
884 */
885struct aa_label *aa_label_find(struct aa_label *label)
886{
887 AA_BUG(!label);
888
889 return vec_find(label->vec, label->size);
890}
891
892
893/**
894 * aa_label_insert - insert label @label into @ls or return existing label
895 * @ls - labelset to insert @label into
896 * @label - label to insert
897 *
898 * Requires: caller to hold a valid ref on @label
899 *
900 * Returns: ref counted @label if successful in inserting @label
901 * else ref counted equivalent label that is already in the set
902 */
903struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
904{
905 struct aa_label *l;
906 unsigned long flags;
907
908 AA_BUG(!ls);
909 AA_BUG(!label);
910
911 /* check if label exists before taking lock */
912 if (!label_is_stale(label)) {
913 read_lock_irqsave(&ls->lock, flags);
914 l = __label_find(label);
915 read_unlock_irqrestore(&ls->lock, flags);
916 if (l)
917 return l;
918 }
919
920 write_lock_irqsave(&ls->lock, flags);
921 l = __label_insert(ls, label, false);
922 write_unlock_irqrestore(&ls->lock, flags);
923
924 return l;
925}
926
927
928/**
929 * aa_label_next_in_merge - find the next profile when merging @a and @b
930 * @I: label iterator
931 * @a: label to merge
932 * @b: label to merge
933 *
934 * Returns: next profile
935 * else null if no more profiles
936 */
937struct aa_profile *aa_label_next_in_merge(struct label_it *I,
938 struct aa_label *a,
939 struct aa_label *b)
940{
941 AA_BUG(!a);
942 AA_BUG(!b);
943 AA_BUG(!I);
944 AA_BUG(I->i < 0);
945 AA_BUG(I->i > a->size);
946 AA_BUG(I->j < 0);
947 AA_BUG(I->j > b->size);
948
949 if (I->i < a->size) {
950 if (I->j < b->size) {
951 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
952
953 if (res > 0)
954 return b->vec[(I->j)++];
955 if (res == 0)
956 (I->j)++;
957 }
958
959 return a->vec[(I->i)++];
960 }
961
962 if (I->j < b->size)
963 return b->vec[(I->j)++];
964
965 return NULL;
966}
967
968/**
969 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
970 * @a: label to merge then compare (NOT NULL)
971 * @b: label to merge then compare (NOT NULL)
972 * @z: label to compare merge against (NOT NULL)
973 *
974 * Assumes: using the most recent versions of @a, @b, and @z
975 *
976 * Returns: <0 if a < b
977 * ==0 if a == b
978 * >0 if a > b
979 */
980static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
981 struct aa_label *z)
982{
983 struct aa_profile *p = NULL;
984 struct label_it i = { };
985 int k;
986
987 AA_BUG(!a);
988 AA_BUG(!b);
989 AA_BUG(!z);
990
991 for (k = 0;
992 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
993 k++) {
994 int res = profile_cmp(p, z->vec[k]);
995
996 if (res != 0)
997 return res;
998 }
999
1000 if (p)
1001 return 1;
1002 else if (k < z->size)
1003 return -1;
1004 return 0;
1005}
1006
1007/**
1008 * label_merge_insert - create a new label by merging @a and @b
1009 * @new: preallocated label to merge into (NOT NULL)
1010 * @a: label to merge with @b (NOT NULL)
1011 * @b: label to merge with @a (NOT NULL)
1012 *
1013 * Requires: preallocated proxy
1014 *
1015 * Returns: ref counted label either @new if merge is unique
1016 * @a if @b is a subset of @a
1017 * @b if @a is a subset of @b
1018 *
1019 * NOTE: will not use @new if the merge results in @new == @a or @b
1020 *
1021 * Must be used within labelset write lock to avoid racing with
1022 * setting labels stale.
1023 */
1024static struct aa_label *label_merge_insert(struct aa_label *new,
1025 struct aa_label *a,
1026 struct aa_label *b)
1027{
1028 struct aa_label *label;
1029 struct aa_labelset *ls;
1030 struct aa_profile *next;
1031 struct label_it i;
1032 unsigned long flags;
1033 int k = 0, invcount = 0;
1034 bool stale = false;
1035
1036 AA_BUG(!a);
1037 AA_BUG(a->size < 0);
1038 AA_BUG(!b);
1039 AA_BUG(b->size < 0);
1040 AA_BUG(!new);
1041 AA_BUG(new->size < a->size + b->size);
1042
1043 label_for_each_in_merge(i, a, b, next) {
1044 AA_BUG(!next);
1045 if (profile_is_stale(next)) {
1046 new->vec[k] = aa_get_newest_profile(next);
1047 AA_BUG(!new->vec[k]->label.proxy);
1048 AA_BUG(!new->vec[k]->label.proxy->label);
1049 if (next->label.proxy != new->vec[k]->label.proxy)
1050 invcount++;
1051 k++;
1052 stale = true;
1053 } else
1054 new->vec[k++] = aa_get_profile(next);
1055 }
1056 /* set to actual size which is <= allocated len */
1057 new->size = k;
1058 new->vec[k] = NULL;
1059
1060 if (invcount) {
1061 new->size -= aa_vec_unique(&new->vec[0], new->size,
1062 VEC_FLAG_TERMINATE);
1063 /* TODO: deal with reference labels */
1064 if (new->size == 1) {
1065 label = aa_get_label(&new->vec[0]->label);
1066 return label;
1067 }
1068 } else if (!stale) {
1069 /*
1070 * merge could be same as a || b, note: it is not possible
1071 * for new->size == a->size == b->size unless a == b
1072 */
1073 if (k == a->size)
1074 return aa_get_label(a);
1075 else if (k == b->size)
1076 return aa_get_label(b);
1077 }
1078 if (vec_unconfined(new->vec, new->size))
1079 new->flags |= FLAG_UNCONFINED;
1080 ls = labels_set(new);
1081 write_lock_irqsave(&ls->lock, flags);
1082 label = __label_insert(labels_set(new), new, false);
1083 write_unlock_irqrestore(&ls->lock, flags);
1084
1085 return label;
1086}
1087
1088/**
1089 * labelset_of_merge - find which labelset a merged label should be inserted
1090 * @a: label to merge and insert
1091 * @b: label to merge and insert
1092 *
1093 * Returns: labelset that the merged label should be inserted into
1094 */
1095static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1096 struct aa_label *b)
1097{
1098 struct aa_ns *nsa = labels_ns(a);
1099 struct aa_ns *nsb = labels_ns(b);
1100
1101 if (ns_cmp(nsa, nsb) <= 0)
1102 return &nsa->labels;
1103 return &nsb->labels;
1104}
1105
1106/**
1107 * __label_find_merge - find label that is equiv to merge of @a and @b
1108 * @ls: set of labels to search (NOT NULL)
1109 * @a: label to merge with @b (NOT NULL)
1110 * @b: label to merge with @a (NOT NULL)
1111 *
1112 * Requires: ls->lock read_lock held
1113 *
1114 * Returns: ref counted label that is equiv to merge of @a and @b
1115 * else NULL if merge of @a and @b is not in set
1116 */
1117static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1118 struct aa_label *a,
1119 struct aa_label *b)
1120{
1121 struct rb_node *node;
1122
1123 AA_BUG(!ls);
1124 AA_BUG(!a);
1125 AA_BUG(!b);
1126
1127 if (a == b)
1128 return __label_find(a);
1129
1130 node = ls->root.rb_node;
1131 while (node) {
1132 struct aa_label *this = container_of(node, struct aa_label,
1133 node);
1134 int result = label_merge_cmp(a, b, this);
1135
1136 if (result < 0)
1137 node = node->rb_left;
1138 else if (result > 0)
1139 node = node->rb_right;
1140 else
1141 return __aa_get_label(this);
1142 }
1143
1144 return NULL;
1145}
1146
1147
1148/**
1149 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1150 * @a: label to merge with @b (NOT NULL)
1151 * @b: label to merge with @a (NOT NULL)
1152 *
1153 * Requires: labels be fully constructed with a valid ns
1154 *
1155 * Returns: ref counted label that is equiv to merge of @a and @b
1156 * else NULL if merge of @a and @b is not in set
1157 */
1158struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1159{
1160 struct aa_labelset *ls;
1161 struct aa_label *label, *ar = NULL, *br = NULL;
1162 unsigned long flags;
1163
1164 AA_BUG(!a);
1165 AA_BUG(!b);
1166
1167 if (label_is_stale(a))
1168 a = ar = aa_get_newest_label(a);
1169 if (label_is_stale(b))
1170 b = br = aa_get_newest_label(b);
1171 ls = labelset_of_merge(a, b);
1172 read_lock_irqsave(&ls->lock, flags);
1173 label = __label_find_merge(ls, a, b);
1174 read_unlock_irqrestore(&ls->lock, flags);
1175 aa_put_label(ar);
1176 aa_put_label(br);
1177
1178 return label;
1179}
1180
1181/**
1182 * aa_label_merge - attempt to insert new merged label of @a and @b
1183 * @ls: set of labels to insert label into (NOT NULL)
1184 * @a: label to merge with @b (NOT NULL)
1185 * @b: label to merge with @a (NOT NULL)
1186 * @gfp: memory allocation type
1187 *
1188 * Requires: caller to hold valid refs on @a and @b
1189 * labels be fully constructed with a valid ns
1190 *
1191 * Returns: ref counted new label if successful in inserting merge of a & b
1192 * else ref counted equivalent label that is already in the set.
1193 * else NULL if could not create label (-ENOMEM)
1194 */
1195struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1196 gfp_t gfp)
1197{
1198 struct aa_label *label = NULL;
1199
1200 AA_BUG(!a);
1201 AA_BUG(!b);
1202
1203 if (a == b)
1204 return aa_get_newest_label(a);
1205
1206 /* TODO: enable when read side is lockless
1207 * check if label exists before taking locks
1208 if (!label_is_stale(a) && !label_is_stale(b))
1209 label = aa_label_find_merge(a, b);
1210 */
1211
1212 if (!label) {
1213 struct aa_label *new;
1214
1215 a = aa_get_newest_label(a);
1216 b = aa_get_newest_label(b);
1217
1218 /* could use label_merge_len(a, b), but requires double
1219 * comparison for small savings
1220 */
1221 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1222 if (!new)
1223 goto out;
1224
1225 label = label_merge_insert(new, a, b);
1226 label_free_or_put_new(label, new);
1227out:
1228 aa_put_label(a);
1229 aa_put_label(b);
1230 }
1231
1232 return label;
1233}
1234
1235static inline bool label_is_visible(struct aa_profile *profile,
1236 struct aa_label *label)
1237{
1238 return aa_ns_visible(profile->ns, labels_ns(label), true);
1239}
1240
1241/* match a profile and its associated ns component if needed
1242 * Assumes visibility test has already been done.
1243 * If a subns profile is not to be matched should be prescreened with
1244 * visibility test.
1245 */
1246static inline unsigned int match_component(struct aa_profile *profile,
1247 struct aa_profile *tp,
1248 unsigned int state)
1249{
1250 const char *ns_name;
1251
1252 if (profile->ns == tp->ns)
1253 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1254
1255 /* try matching with namespace name and then profile */
1256 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1257 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1258 state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1259 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1260 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1261}
1262
1263/**
1264 * label_compound_match - find perms for full compound label
1265 * @profile: profile to find perms for
1266 * @label: label to check access permissions for
1267 * @start: state to start match in
1268 * @subns: whether to do permission checks on components in a subns
1269 * @request: permissions to request
1270 * @perms: perms struct to set
1271 *
1272 * Returns: 0 on success else ERROR
1273 *
1274 * For the label A//&B//&C this does the perm match for A//&B//&C
1275 * @perms should be preinitialized with allperms OR a previous permission
1276 * check to be stacked.
1277 */
1278static int label_compound_match(struct aa_profile *profile,
1279 struct aa_label *label,
1280 unsigned int state, bool subns, u32 request,
1281 struct aa_perms *perms)
1282{
1283 struct aa_profile *tp;
1284 struct label_it i;
1285
1286 /* find first subcomponent that is visible */
1287 label_for_each(i, label, tp) {
1288 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1289 continue;
1290 state = match_component(profile, tp, state);
1291 if (!state)
1292 goto fail;
1293 goto next;
1294 }
1295
1296 /* no component visible */
1297 *perms = allperms;
1298 return 0;
1299
1300next:
1301 label_for_each_cont(i, label, tp) {
1302 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1303 continue;
1304 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1305 state = match_component(profile, tp, state);
1306 if (!state)
1307 goto fail;
1308 }
1309 aa_compute_perms(profile->policy.dfa, state, perms);
1310 aa_apply_modes_to_perms(profile, perms);
1311 if ((perms->allow & request) != request)
1312 return -EACCES;
1313
1314 return 0;
1315
1316fail:
1317 *perms = nullperms;
1318 return state;
1319}
1320
1321/**
1322 * label_components_match - find perms for all subcomponents of a label
1323 * @profile: profile to find perms for
1324 * @label: label to check access permissions for
1325 * @start: state to start match in
1326 * @subns: whether to do permission checks on components in a subns
1327 * @request: permissions to request
1328 * @perms: an initialized perms struct to add accumulation to
1329 *
1330 * Returns: 0 on success else ERROR
1331 *
1332 * For the label A//&B//&C this does the perm match for each of A and B and C
1333 * @perms should be preinitialized with allperms OR a previous permission
1334 * check to be stacked.
1335 */
1336static int label_components_match(struct aa_profile *profile,
1337 struct aa_label *label, unsigned int start,
1338 bool subns, u32 request,
1339 struct aa_perms *perms)
1340{
1341 struct aa_profile *tp;
1342 struct label_it i;
1343 struct aa_perms tmp;
1344 unsigned int state = 0;
1345
1346 /* find first subcomponent to test */
1347 label_for_each(i, label, tp) {
1348 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1349 continue;
1350 state = match_component(profile, tp, start);
1351 if (!state)
1352 goto fail;
1353 goto next;
1354 }
1355
1356 /* no subcomponents visible - no change in perms */
1357 return 0;
1358
1359next:
1360 aa_compute_perms(profile->policy.dfa, state, &tmp);
1361 aa_apply_modes_to_perms(profile, &tmp);
1362 aa_perms_accum(perms, &tmp);
1363 label_for_each_cont(i, label, tp) {
1364 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1365 continue;
1366 state = match_component(profile, tp, start);
1367 if (!state)
1368 goto fail;
1369 aa_compute_perms(profile->policy.dfa, state, &tmp);
1370 aa_apply_modes_to_perms(profile, &tmp);
1371 aa_perms_accum(perms, &tmp);
1372 }
1373
1374 if ((perms->allow & request) != request)
1375 return -EACCES;
1376
1377 return 0;
1378
1379fail:
1380 *perms = nullperms;
1381 return -EACCES;
1382}
1383
1384/**
1385 * aa_label_match - do a multi-component label match
1386 * @profile: profile to match against (NOT NULL)
1387 * @label: label to match (NOT NULL)
1388 * @state: state to start in
1389 * @subns: whether to match subns components
1390 * @request: permission request
1391 * @perms: Returns computed perms (NOT NULL)
1392 *
1393 * Returns: the state the match finished in, may be the none matching state
1394 */
1395int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1396 unsigned int state, bool subns, u32 request,
1397 struct aa_perms *perms)
1398{
1399 int error = label_compound_match(profile, label, state, subns, request,
1400 perms);
1401 if (!error)
1402 return error;
1403
1404 *perms = allperms;
1405 return label_components_match(profile, label, state, subns, request,
1406 perms);
1407}
1408
1409
1410/**
1411 * aa_update_label_name - update a label to have a stored name
1412 * @ns: ns being viewed from (NOT NULL)
1413 * @label: label to update (NOT NULL)
1414 * @gfp: type of memory allocation
1415 *
1416 * Requires: labels_set(label) not locked in caller
1417 *
1418 * note: only updates the label name if it does not have a name already
1419 * and if it is in the labelset
1420 */
1421bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1422{
1423 struct aa_labelset *ls;
1424 unsigned long flags;
1425 char __counted *name;
1426 bool res = false;
1427
1428 AA_BUG(!ns);
1429 AA_BUG(!label);
1430
1431 if (label->hname || labels_ns(label) != ns)
1432 return res;
1433
1434 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1435 return res;
1436
1437 ls = labels_set(label);
1438 write_lock_irqsave(&ls->lock, flags);
1439 if (!label->hname && label->flags & FLAG_IN_TREE) {
1440 label->hname = name;
1441 res = true;
1442 } else
1443 aa_put_str(name);
1444 write_unlock_irqrestore(&ls->lock, flags);
1445
1446 return res;
1447}
1448
1449/*
1450 * cached label name is present and visible
1451 * @label->hname only exists if label is namespace hierachical
1452 */
1453static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1454 int flags)
1455{
1456 if (label->hname && (!ns || labels_ns(label) == ns) &&
1457 !(flags & ~FLAG_SHOW_MODE))
1458 return true;
1459
1460 return false;
1461}
1462
1463/* helper macro for snprint routines */
1464#define update_for_len(total, len, size, str) \
1465do { \
1466 AA_BUG(len < 0); \
1467 total += len; \
1468 len = min(len, size); \
1469 size -= len; \
1470 str += len; \
1471} while (0)
1472
1473/**
1474 * aa_profile_snxprint - print a profile name to a buffer
1475 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1476 * @size: size of buffer
1477 * @view: namespace profile is being viewed from
1478 * @profile: profile to view (NOT NULL)
1479 * @flags: whether to include the mode string
1480 * @prev_ns: last ns printed when used in compound print
1481 *
1482 * Returns: size of name written or would be written if larger than
1483 * available buffer
1484 *
1485 * Note: will not print anything if the profile is not visible
1486 */
1487static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1488 struct aa_profile *profile, int flags,
1489 struct aa_ns **prev_ns)
1490{
1491 const char *ns_name = NULL;
1492
1493 AA_BUG(!str && size != 0);
1494 AA_BUG(!profile);
1495
1496 if (!view)
1497 view = profiles_ns(profile);
1498
1499 if (view != profile->ns &&
1500 (!prev_ns || (*prev_ns != profile->ns))) {
1501 if (prev_ns)
1502 *prev_ns = profile->ns;
1503 ns_name = aa_ns_name(view, profile->ns,
1504 flags & FLAG_VIEW_SUBNS);
1505 if (ns_name == aa_hidden_ns_name) {
1506 if (flags & FLAG_HIDDEN_UNCONFINED)
1507 return snprintf(str, size, "%s", "unconfined");
1508 return snprintf(str, size, "%s", ns_name);
1509 }
1510 }
1511
1512 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1513 const char *modestr = aa_profile_mode_names[profile->mode];
1514
1515 if (ns_name)
1516 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1517 profile->base.hname, modestr);
1518 return snprintf(str, size, "%s (%s)", profile->base.hname,
1519 modestr);
1520 }
1521
1522 if (ns_name)
1523 return snprintf(str, size, ":%s:%s", ns_name,
1524 profile->base.hname);
1525 return snprintf(str, size, "%s", profile->base.hname);
1526}
1527
1528static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1529 int flags)
1530{
1531 struct aa_profile *profile;
1532 struct label_it i;
1533 int mode = -1, count = 0;
1534
1535 label_for_each(i, label, profile) {
1536 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1537 if (profile->mode == APPARMOR_UNCONFINED)
1538 /* special case unconfined so stacks with
1539 * unconfined don't report as mixed. ie.
1540 * profile_foo//&:ns1:unconfined (mixed)
1541 */
1542 continue;
1543 count++;
1544 if (mode == -1)
1545 mode = profile->mode;
1546 else if (mode != profile->mode)
1547 return "mixed";
1548 }
1549 }
1550
1551 if (count == 0)
1552 return "-";
1553 if (mode == -1)
1554 /* everything was unconfined */
1555 mode = APPARMOR_UNCONFINED;
1556
1557 return aa_profile_mode_names[mode];
1558}
1559
1560/* if any visible label is not unconfined the display_mode returns true */
1561static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1562 int flags)
1563{
1564 if ((flags & FLAG_SHOW_MODE)) {
1565 struct aa_profile *profile;
1566 struct label_it i;
1567
1568 label_for_each(i, label, profile) {
1569 if (aa_ns_visible(ns, profile->ns,
1570 flags & FLAG_VIEW_SUBNS) &&
1571 profile != profile->ns->unconfined)
1572 return true;
1573 }
1574 /* only ns->unconfined in set of profiles in ns */
1575 return false;
1576 }
1577
1578 return false;
1579}
1580
1581/**
1582 * aa_label_snxprint - print a label name to a string buffer
1583 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1584 * @size: size of buffer
1585 * @ns: namespace profile is being viewed from
1586 * @label: label to view (NOT NULL)
1587 * @flags: whether to include the mode string
1588 *
1589 * Returns: size of name written or would be written if larger than
1590 * available buffer
1591 *
1592 * Note: labels do not have to be strictly hierarchical to the ns as
1593 * objects may be shared across different namespaces and thus
1594 * pickup labeling from each ns. If a particular part of the
1595 * label is not visible it will just be excluded. And if none
1596 * of the label is visible "---" will be used.
1597 */
1598int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1599 struct aa_label *label, int flags)
1600{
1601 struct aa_profile *profile;
1602 struct aa_ns *prev_ns = NULL;
1603 struct label_it i;
1604 int count = 0, total = 0;
1605 size_t len;
1606
1607 AA_BUG(!str && size != 0);
1608 AA_BUG(!label);
1609
1610 if (flags & FLAG_ABS_ROOT) {
1611 ns = root_ns;
1612 len = snprintf(str, size, "=");
1613 update_for_len(total, len, size, str);
1614 } else if (!ns) {
1615 ns = labels_ns(label);
1616 }
1617
1618 label_for_each(i, label, profile) {
1619 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1620 if (count > 0) {
1621 len = snprintf(str, size, "//&");
1622 update_for_len(total, len, size, str);
1623 }
1624 len = aa_profile_snxprint(str, size, ns, profile,
1625 flags & FLAG_VIEW_SUBNS,
1626 &prev_ns);
1627 update_for_len(total, len, size, str);
1628 count++;
1629 }
1630 }
1631
1632 if (count == 0) {
1633 if (flags & FLAG_HIDDEN_UNCONFINED)
1634 return snprintf(str, size, "%s", "unconfined");
1635 return snprintf(str, size, "%s", aa_hidden_ns_name);
1636 }
1637
1638 /* count == 1 && ... is for backwards compat where the mode
1639 * is not displayed for 'unconfined' in the current ns
1640 */
1641 if (display_mode(ns, label, flags)) {
1642 len = snprintf(str, size, " (%s)",
1643 label_modename(ns, label, flags));
1644 update_for_len(total, len, size, str);
1645 }
1646
1647 return total;
1648}
1649#undef update_for_len
1650
1651/**
1652 * aa_label_asxprint - allocate a string buffer and print label into it
1653 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1654 * @ns: namespace profile is being viewed from
1655 * @label: label to view (NOT NULL)
1656 * @flags: flags controlling what label info is printed
1657 * @gfp: kernel memory allocation type
1658 *
1659 * Returns: size of name written or would be written if larger than
1660 * available buffer
1661 */
1662int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1663 int flags, gfp_t gfp)
1664{
1665 int size;
1666
1667 AA_BUG(!strp);
1668 AA_BUG(!label);
1669
1670 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1671 if (size < 0)
1672 return size;
1673
1674 *strp = kmalloc(size + 1, gfp);
1675 if (!*strp)
1676 return -ENOMEM;
1677 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1678}
1679
1680/**
1681 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1682 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1683 * @ns: namespace profile is being viewed from
1684 * @label: label to view (NOT NULL)
1685 * @flags: flags controlling what label info is printed
1686 * @gfp: kernel memory allocation type
1687 *
1688 * Returns: size of name written or would be written if larger than
1689 * available buffer
1690 */
1691int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1692 struct aa_label *label, int flags, gfp_t gfp)
1693{
1694 int size;
1695
1696 AA_BUG(!strp);
1697 AA_BUG(!label);
1698
1699 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1700 if (size < 0)
1701 return size;
1702
1703 *strp = aa_str_alloc(size + 1, gfp);
1704 if (!*strp)
1705 return -ENOMEM;
1706 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1707}
1708
1709
1710void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1711 struct aa_label *label, int flags, gfp_t gfp)
1712{
1713 const char *str;
1714 char *name = NULL;
1715 int len;
1716
1717 AA_BUG(!ab);
1718 AA_BUG(!label);
1719
1720 if (!use_label_hname(ns, label, flags) ||
1721 display_mode(ns, label, flags)) {
1722 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1723 if (len == -1) {
1724 AA_DEBUG("label print error");
1725 return;
1726 }
1727 str = name;
1728 } else {
1729 str = (char *) label->hname;
1730 len = strlen(str);
1731 }
1732 if (audit_string_contains_control(str, len))
1733 audit_log_n_hex(ab, str, len);
1734 else
1735 audit_log_n_string(ab, str, len);
1736
1737 kfree(name);
1738}
1739
1740void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1741 struct aa_label *label, int flags, gfp_t gfp)
1742{
1743 AA_BUG(!f);
1744 AA_BUG(!label);
1745
1746 if (!use_label_hname(ns, label, flags)) {
1747 char *str;
1748 int len;
1749
1750 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1751 if (len == -1) {
1752 AA_DEBUG("label print error");
1753 return;
1754 }
1755 seq_printf(f, "%s", str);
1756 kfree(str);
1757 } else if (display_mode(ns, label, flags))
1758 seq_printf(f, "%s (%s)", label->hname,
1759 label_modename(ns, label, flags));
1760 else
1761 seq_printf(f, "%s", label->hname);
1762}
1763
1764void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1765 gfp_t gfp)
1766{
1767 AA_BUG(!label);
1768
1769 if (!use_label_hname(ns, label, flags)) {
1770 char *str;
1771 int len;
1772
1773 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1774 if (len == -1) {
1775 AA_DEBUG("label print error");
1776 return;
1777 }
1778 pr_info("%s", str);
1779 kfree(str);
1780 } else if (display_mode(ns, label, flags))
1781 pr_info("%s (%s)", label->hname,
1782 label_modename(ns, label, flags));
1783 else
1784 pr_info("%s", label->hname);
1785}
1786
1787void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1788{
1789 struct aa_ns *ns = aa_get_current_ns();
1790
1791 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1792 aa_put_ns(ns);
1793}
1794
1795void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1796{
1797 struct aa_ns *ns = aa_get_current_ns();
1798
1799 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1800 aa_put_ns(ns);
1801}
1802
1803void aa_label_printk(struct aa_label *label, gfp_t gfp)
1804{
1805 struct aa_ns *ns = aa_get_current_ns();
1806
1807 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1808 aa_put_ns(ns);
1809}
1810
1811static int label_count_strn_entries(const char *str, size_t n)
1812{
1813 const char *end = str + n;
1814 const char *split;
1815 int count = 1;
1816
1817 AA_BUG(!str);
1818
1819 for (split = aa_label_strn_split(str, end - str);
1820 split;
1821 split = aa_label_strn_split(str, end - str)) {
1822 count++;
1823 str = split + 3;
1824 }
1825
1826 return count;
1827}
1828
1829/*
1830 * ensure stacks with components like
1831 * :ns:A//&B
1832 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1833 * to the base if the lookup specifies an ns, else making the stacked lookup
1834 * relative to the last embedded ns in the string.
1835 */
1836static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1837 struct aa_label *currentbase,
1838 const char *str, size_t n)
1839{
1840 const char *first = skipn_spaces(str, n);
1841
1842 if (first && *first == ':')
1843 return aa_fqlookupn_profile(base, str, n);
1844
1845 return aa_fqlookupn_profile(currentbase, str, n);
1846}
1847
1848/**
1849 * aa_label_strn_parse - parse, validate and convert a text string to a label
1850 * @base: base label to use for lookups (NOT NULL)
1851 * @str: null terminated text string (NOT NULL)
1852 * @n: length of str to parse, will stop at \0 if encountered before n
1853 * @gfp: allocation type
1854 * @create: true if should create compound labels if they don't exist
1855 * @force_stack: true if should stack even if no leading &
1856 *
1857 * Returns: the matching refcounted label if present
1858 * else ERRPTR
1859 */
1860struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1861 size_t n, gfp_t gfp, bool create,
1862 bool force_stack)
1863{
1864 DEFINE_VEC(profile, vec);
1865 struct aa_label *label, *currbase = base;
1866 int i, len, stack = 0, error;
1867 const char *end = str + n;
1868 const char *split;
1869
1870 AA_BUG(!base);
1871 AA_BUG(!str);
1872
1873 str = skipn_spaces(str, n);
1874 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1875 return ERR_PTR(-EINVAL);
1876
1877 len = label_count_strn_entries(str, end - str);
1878 if (*str == '&' || force_stack) {
1879 /* stack on top of base */
1880 stack = base->size;
1881 len += stack;
1882 if (*str == '&')
1883 str++;
1884 }
1885
1886 error = vec_setup(profile, vec, len, gfp);
1887 if (error)
1888 return ERR_PTR(error);
1889
1890 for (i = 0; i < stack; i++)
1891 vec[i] = aa_get_profile(base->vec[i]);
1892
1893 for (split = aa_label_strn_split(str, end - str), i = stack;
1894 split && i < len; i++) {
1895 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1896 if (!vec[i])
1897 goto fail;
1898 /*
1899 * if component specified a new ns it becomes the new base
1900 * so that subsequent lookups are relative to it
1901 */
1902 if (vec[i]->ns != labels_ns(currbase))
1903 currbase = &vec[i]->label;
1904 str = split + 3;
1905 split = aa_label_strn_split(str, end - str);
1906 }
1907 /* last element doesn't have a split */
1908 if (i < len) {
1909 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1910 if (!vec[i])
1911 goto fail;
1912 }
1913 if (len == 1)
1914 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1915 return &vec[0]->label;
1916
1917 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1918 /* TODO: deal with reference labels */
1919 if (len == 1) {
1920 label = aa_get_label(&vec[0]->label);
1921 goto out;
1922 }
1923
1924 if (create)
1925 label = aa_vec_find_or_create_label(vec, len, gfp);
1926 else
1927 label = vec_find(vec, len);
1928 if (!label)
1929 goto fail;
1930
1931out:
1932 /* use adjusted len from after vec_unique, not original */
1933 vec_cleanup(profile, vec, len);
1934 return label;
1935
1936fail:
1937 label = ERR_PTR(-ENOENT);
1938 goto out;
1939}
1940
1941struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1942 gfp_t gfp, bool create, bool force_stack)
1943{
1944 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1945 force_stack);
1946}
1947
1948/**
1949 * aa_labelset_destroy - remove all labels from the label set
1950 * @ls: label set to cleanup (NOT NULL)
1951 *
1952 * Labels that are removed from the set may still exist beyond the set
1953 * being destroyed depending on their reference counting
1954 */
1955void aa_labelset_destroy(struct aa_labelset *ls)
1956{
1957 struct rb_node *node;
1958 unsigned long flags;
1959
1960 AA_BUG(!ls);
1961
1962 write_lock_irqsave(&ls->lock, flags);
1963 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1964 struct aa_label *this = rb_entry(node, struct aa_label, node);
1965
1966 if (labels_ns(this) != root_ns)
1967 __label_remove(this,
1968 ns_unconfined(labels_ns(this)->parent));
1969 else
1970 __label_remove(this, NULL);
1971 }
1972 write_unlock_irqrestore(&ls->lock, flags);
1973}
1974
1975/*
1976 * @ls: labelset to init (NOT NULL)
1977 */
1978void aa_labelset_init(struct aa_labelset *ls)
1979{
1980 AA_BUG(!ls);
1981
1982 rwlock_init(&ls->lock);
1983 ls->root = RB_ROOT;
1984}
1985
1986static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1987{
1988 struct aa_label *label;
1989 struct rb_node *node;
1990 unsigned long flags;
1991
1992 AA_BUG(!ls);
1993
1994 read_lock_irqsave(&ls->lock, flags);
1995
1996 __labelset_for_each(ls, node) {
1997 label = rb_entry(node, struct aa_label, node);
1998 if ((label_is_stale(label) ||
1999 vec_is_stale(label->vec, label->size)) &&
2000 __aa_get_label(label))
2001 goto out;
2002
2003 }
2004 label = NULL;
2005
2006out:
2007 read_unlock_irqrestore(&ls->lock, flags);
2008
2009 return label;
2010}
2011
2012/**
2013 * __label_update - insert updated version of @label into labelset
2014 * @label - the label to update/repace
2015 *
2016 * Returns: new label that is up to date
2017 * else NULL on failure
2018 *
2019 * Requires: @ns lock be held
2020 *
2021 * Note: worst case is the stale @label does not get updated and has
2022 * to be updated at a later time.
2023 */
2024static struct aa_label *__label_update(struct aa_label *label)
2025{
2026 struct aa_label *new, *tmp;
2027 struct aa_labelset *ls;
2028 unsigned long flags;
2029 int i, invcount = 0;
2030
2031 AA_BUG(!label);
2032 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2033
2034 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2035 if (!new)
2036 return NULL;
2037
2038 /*
2039 * while holding the ns_lock will stop profile replacement, removal,
2040 * and label updates, label merging and removal can be occurring
2041 */
2042 ls = labels_set(label);
2043 write_lock_irqsave(&ls->lock, flags);
2044 for (i = 0; i < label->size; i++) {
2045 AA_BUG(!label->vec[i]);
2046 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2047 AA_BUG(!new->vec[i]);
2048 AA_BUG(!new->vec[i]->label.proxy);
2049 AA_BUG(!new->vec[i]->label.proxy->label);
2050 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2051 invcount++;
2052 }
2053
2054 /* updated stale label by being removed/renamed from labelset */
2055 if (invcount) {
2056 new->size -= aa_vec_unique(&new->vec[0], new->size,
2057 VEC_FLAG_TERMINATE);
2058 /* TODO: deal with reference labels */
2059 if (new->size == 1) {
2060 tmp = aa_get_label(&new->vec[0]->label);
2061 AA_BUG(tmp == label);
2062 goto remove;
2063 }
2064 if (labels_set(label) != labels_set(new)) {
2065 write_unlock_irqrestore(&ls->lock, flags);
2066 tmp = aa_label_insert(labels_set(new), new);
2067 write_lock_irqsave(&ls->lock, flags);
2068 goto remove;
2069 }
2070 } else
2071 AA_BUG(labels_ns(label) != labels_ns(new));
2072
2073 tmp = __label_insert(labels_set(label), new, true);
2074remove:
2075 /* ensure label is removed, and redirected correctly */
2076 __label_remove(label, tmp);
2077 write_unlock_irqrestore(&ls->lock, flags);
2078 label_free_or_put_new(tmp, new);
2079
2080 return tmp;
2081}
2082
2083/**
2084 * __labelset_update - update labels in @ns
2085 * @ns: namespace to update labels in (NOT NULL)
2086 *
2087 * Requires: @ns lock be held
2088 *
2089 * Walk the labelset ensuring that all labels are up to date and valid
2090 * Any label that has a stale component is marked stale and replaced and
2091 * by an updated version.
2092 *
2093 * If failures happen due to memory pressures then stale labels will
2094 * be left in place until the next pass.
2095 */
2096static void __labelset_update(struct aa_ns *ns)
2097{
2098 struct aa_label *label;
2099
2100 AA_BUG(!ns);
2101 AA_BUG(!mutex_is_locked(&ns->lock));
2102
2103 do {
2104 label = labelset_next_stale(&ns->labels);
2105 if (label) {
2106 struct aa_label *l = __label_update(label);
2107
2108 aa_put_label(l);
2109 aa_put_label(label);
2110 }
2111 } while (label);
2112}
2113
2114/**
2115 * __aa_labelset_udate_subtree - update all labels with a stale component
2116 * @ns: ns to start update at (NOT NULL)
2117 *
2118 * Requires: @ns lock be held
2119 *
2120 * Invalidates labels based on @p in @ns and any children namespaces.
2121 */
2122void __aa_labelset_update_subtree(struct aa_ns *ns)
2123{
2124 struct aa_ns *child;
2125
2126 AA_BUG(!ns);
2127 AA_BUG(!mutex_is_locked(&ns->lock));
2128
2129 __labelset_update(ns);
2130
2131 list_for_each_entry(child, &ns->sub_ns, base.list) {
2132 mutex_lock_nested(&child->lock, child->level);
2133 __aa_labelset_update_subtree(child);
2134 mutex_unlock(&child->lock);
2135 }
2136}
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor label definitions
6 *
7 * Copyright 2017 Canonical Ltd.
8 */
9
10#include <linux/audit.h>
11#include <linux/seq_file.h>
12#include <linux/sort.h>
13
14#include "include/apparmor.h"
15#include "include/cred.h"
16#include "include/label.h"
17#include "include/policy.h"
18#include "include/secid.h"
19
20
21/*
22 * the aa_label represents the set of profiles confining an object
23 *
24 * Labels maintain a reference count to the set of pointers they reference
25 * Labels are ref counted by
26 * tasks and object via the security field/security context off the field
27 * code - will take a ref count on a label if it needs the label
28 * beyond what is possible with an rcu_read_lock.
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
31 * referencing
32 * objects - inode, files, sockets, ...
33 *
34 * Labels are not ref counted by the label set, so they maybe removed and
35 * freed when no longer in use.
36 *
37 */
38
39#define PROXY_POISON 97
40#define LABEL_POISON 100
41
42static void free_proxy(struct aa_proxy *proxy)
43{
44 if (proxy) {
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
47 memset(proxy, 0, sizeof(*proxy));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49 kfree(proxy);
50 }
51}
52
53void aa_proxy_kref(struct kref *kref)
54{
55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56
57 free_proxy(proxy);
58}
59
60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61{
62 struct aa_proxy *new;
63
64 new = kzalloc(sizeof(struct aa_proxy), gfp);
65 if (new) {
66 kref_init(&new->count);
67 rcu_assign_pointer(new->label, aa_get_label(label));
68 }
69 return new;
70}
71
72/* requires profile list write lock held */
73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74{
75 struct aa_label *tmp;
76
77 AA_BUG(!orig);
78 AA_BUG(!new);
79 lockdep_assert_held_write(&labels_set(orig)->lock);
80
81 tmp = rcu_dereference_protected(orig->proxy->label,
82 &labels_ns(orig)->lock);
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84 orig->flags |= FLAG_STALE;
85 aa_put_label(tmp);
86}
87
88static void __proxy_share(struct aa_label *old, struct aa_label *new)
89{
90 struct aa_proxy *proxy = new->proxy;
91
92 new->proxy = aa_get_proxy(old->proxy);
93 __aa_proxy_redirect(old, new);
94 aa_put_proxy(proxy);
95}
96
97
98/**
99 * ns_cmp - compare ns for label set ordering
100 * @a: ns to compare (NOT NULL)
101 * @b: ns to compare (NOT NULL)
102 *
103 * Returns: <0 if a < b
104 * ==0 if a == b
105 * >0 if a > b
106 */
107static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108{
109 int res;
110
111 AA_BUG(!a);
112 AA_BUG(!b);
113 AA_BUG(!a->base.hname);
114 AA_BUG(!b->base.hname);
115
116 if (a == b)
117 return 0;
118
119 res = a->level - b->level;
120 if (res)
121 return res;
122
123 return strcmp(a->base.hname, b->base.hname);
124}
125
126/**
127 * profile_cmp - profile comparison for set ordering
128 * @a: profile to compare (NOT NULL)
129 * @b: profile to compare (NOT NULL)
130 *
131 * Returns: <0 if a < b
132 * ==0 if a == b
133 * >0 if a > b
134 */
135static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136{
137 int res;
138
139 AA_BUG(!a);
140 AA_BUG(!b);
141 AA_BUG(!a->ns);
142 AA_BUG(!b->ns);
143 AA_BUG(!a->base.hname);
144 AA_BUG(!b->base.hname);
145
146 if (a == b || a->base.hname == b->base.hname)
147 return 0;
148 res = ns_cmp(a->ns, b->ns);
149 if (res)
150 return res;
151
152 return strcmp(a->base.hname, b->base.hname);
153}
154
155/**
156 * vec_cmp - label comparison for set ordering
157 * @a: aa_profile to compare (NOT NULL)
158 * @an: length of @a
159 * @b: aa_profile to compare (NOT NULL)
160 * @bn: length of @b
161 *
162 * Returns: <0 if @a < @b
163 * ==0 if @a == @b
164 * >0 if @a > @b
165 */
166static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
167{
168 int i;
169
170 AA_BUG(!a);
171 AA_BUG(!*a);
172 AA_BUG(!b);
173 AA_BUG(!*b);
174 AA_BUG(an <= 0);
175 AA_BUG(bn <= 0);
176
177 for (i = 0; i < an && i < bn; i++) {
178 int res = profile_cmp(a[i], b[i]);
179
180 if (res != 0)
181 return res;
182 }
183
184 return an - bn;
185}
186
187static bool vec_is_stale(struct aa_profile **vec, int n)
188{
189 int i;
190
191 AA_BUG(!vec);
192
193 for (i = 0; i < n; i++) {
194 if (profile_is_stale(vec[i]))
195 return true;
196 }
197
198 return false;
199}
200
201static long accum_vec_flags(struct aa_profile **vec, int n)
202{
203 long u = FLAG_UNCONFINED;
204 int i;
205
206 AA_BUG(!vec);
207
208 for (i = 0; i < n; i++) {
209 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
210 FLAG_STALE);
211 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
212 u &= ~FLAG_UNCONFINED;
213 }
214
215 return u;
216}
217
218static int sort_cmp(const void *a, const void *b)
219{
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
221}
222
223/*
224 * assumes vec is sorted
225 * Assumes @vec has null terminator at vec[n], and will null terminate
226 * vec[n - dups]
227 */
228static inline int unique(struct aa_profile **vec, int n)
229{
230 int i, pos, dups = 0;
231
232 AA_BUG(n < 1);
233 AA_BUG(!vec);
234
235 pos = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
238
239 AA_BUG(res > 0, "vec not sorted");
240 if (res == 0) {
241 /* drop duplicate */
242 aa_put_profile(vec[i]);
243 dups++;
244 continue;
245 }
246 pos++;
247 if (dups)
248 vec[pos] = vec[i];
249 }
250
251 AA_BUG(dups < 0);
252
253 return dups;
254}
255
256/**
257 * aa_vec_unique - canonical sort and unique a list of profiles
258 * @n: number of refcounted profiles in the list (@n > 0)
259 * @vec: list of profiles to sort and merge
260 * @flags: null terminator flags of @vec
261 *
262 * Returns: the number of duplicates eliminated == references put
263 *
264 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
265 * null terminate vec[n - dups]
266 */
267int aa_vec_unique(struct aa_profile **vec, int n, int flags)
268{
269 int i, dups = 0;
270
271 AA_BUG(n < 1);
272 AA_BUG(!vec);
273
274 /* vecs are usually small and inorder, have a fallback for larger */
275 if (n > 8) {
276 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
277 dups = unique(vec, n);
278 goto out;
279 }
280
281 /* insertion sort + unique in one */
282 for (i = 1; i < n; i++) {
283 struct aa_profile *tmp = vec[i];
284 int pos, j;
285
286 for (pos = i - 1 - dups; pos >= 0; pos--) {
287 int res = profile_cmp(vec[pos], tmp);
288
289 if (res == 0) {
290 /* drop duplicate entry */
291 aa_put_profile(tmp);
292 dups++;
293 goto continue_outer;
294 } else if (res < 0)
295 break;
296 }
297 /* pos is at entry < tmp, or index -1. Set to insert pos */
298 pos++;
299
300 for (j = i - dups; j > pos; j--)
301 vec[j] = vec[j - 1];
302 vec[pos] = tmp;
303continue_outer:
304 ;
305 }
306
307 AA_BUG(dups < 0);
308
309out:
310 if (flags & VEC_FLAG_TERMINATE)
311 vec[n - dups] = NULL;
312
313 return dups;
314}
315
316
317void aa_label_destroy(struct aa_label *label)
318{
319 AA_BUG(!label);
320
321 if (!label_isprofile(label)) {
322 struct aa_profile *profile;
323 struct label_it i;
324
325 aa_put_str(label->hname);
326
327 label_for_each(i, label, profile) {
328 aa_put_profile(profile);
329 label->vec[i.i] = (struct aa_profile *)
330 (LABEL_POISON + (long) i.i);
331 }
332 }
333
334 if (label->proxy) {
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
337 aa_put_proxy(label->proxy);
338 }
339 aa_free_secid(label->secid);
340
341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
342}
343
344void aa_label_free(struct aa_label *label)
345{
346 if (!label)
347 return;
348
349 aa_label_destroy(label);
350 kfree(label);
351}
352
353static void label_free_switch(struct aa_label *label)
354{
355 if (label->flags & FLAG_NS_COUNT)
356 aa_free_ns(labels_ns(label));
357 else if (label_isprofile(label))
358 aa_free_profile(labels_profile(label));
359 else
360 aa_label_free(label);
361}
362
363static void label_free_rcu(struct rcu_head *head)
364{
365 struct aa_label *label = container_of(head, struct aa_label, rcu);
366
367 if (label->flags & FLAG_IN_TREE)
368 (void) aa_label_remove(label);
369 label_free_switch(label);
370}
371
372void aa_label_kref(struct kref *kref)
373{
374 struct aa_label *label = container_of(kref, struct aa_label, count);
375 struct aa_ns *ns = labels_ns(label);
376
377 if (!ns) {
378 /* never live, no rcu callback needed, just using the fn */
379 label_free_switch(label);
380 return;
381 }
382 /* TODO: update labels_profile macro so it works here */
383 AA_BUG(label_isprofile(label) &&
384 on_list_rcu(&label->vec[0]->base.profiles));
385 AA_BUG(label_isprofile(label) &&
386 on_list_rcu(&label->vec[0]->base.list));
387
388 /* TODO: if compound label and not stale add to reclaim cache */
389 call_rcu(&label->rcu, label_free_rcu);
390}
391
392static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
393{
394 if (label != new)
395 /* need to free directly to break circular ref with proxy */
396 aa_label_free(new);
397 else
398 aa_put_label(new);
399}
400
401bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
402{
403 AA_BUG(!label);
404 AA_BUG(size < 1);
405
406 if (aa_alloc_secid(label, gfp) < 0)
407 return false;
408
409 label->size = size; /* doesn't include null */
410 label->vec[size] = NULL; /* null terminate */
411 kref_init(&label->count);
412 RB_CLEAR_NODE(&label->node);
413
414 return true;
415}
416
417/**
418 * aa_label_alloc - allocate a label with a profile vector of @size length
419 * @size: size of profile vector in the label
420 * @proxy: proxy to use OR null if to allocate a new one
421 * @gfp: memory allocation type
422 *
423 * Returns: new label
424 * else NULL if failed
425 */
426struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
427{
428 struct aa_label *new;
429
430 AA_BUG(size < 1);
431
432 /* + 1 for null terminator entry on vec */
433 new = kzalloc(struct_size(new, vec, size + 1), gfp);
434 AA_DEBUG("%s (%p)\n", __func__, new);
435 if (!new)
436 goto fail;
437
438 if (!aa_label_init(new, size, gfp))
439 goto fail;
440
441 if (!proxy) {
442 proxy = aa_alloc_proxy(new, gfp);
443 if (!proxy)
444 goto fail;
445 } else
446 aa_get_proxy(proxy);
447 /* just set new's proxy, don't redirect proxy here if it was passed in*/
448 new->proxy = proxy;
449
450 return new;
451
452fail:
453 kfree(new);
454
455 return NULL;
456}
457
458
459/**
460 * label_cmp - label comparison for set ordering
461 * @a: label to compare (NOT NULL)
462 * @b: label to compare (NOT NULL)
463 *
464 * Returns: <0 if a < b
465 * ==0 if a == b
466 * >0 if a > b
467 */
468static int label_cmp(struct aa_label *a, struct aa_label *b)
469{
470 AA_BUG(!b);
471
472 if (a == b)
473 return 0;
474
475 return vec_cmp(a->vec, a->size, b->vec, b->size);
476}
477
478/* helper fn for label_for_each_confined */
479int aa_label_next_confined(struct aa_label *label, int i)
480{
481 AA_BUG(!label);
482 AA_BUG(i < 0);
483
484 for (; i < label->size; i++) {
485 if (!profile_unconfined(label->vec[i]))
486 return i;
487 }
488
489 return i;
490}
491
492/**
493 * __aa_label_next_not_in_set - return the next profile of @sub not in @set
494 * @I: label iterator
495 * @set: label to test against
496 * @sub: label to if is subset of @set
497 *
498 * Returns: profile in @sub that is not in @set, with iterator set pos after
499 * else NULL if @sub is a subset of @set
500 */
501struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
502 struct aa_label *set,
503 struct aa_label *sub)
504{
505 AA_BUG(!set);
506 AA_BUG(!I);
507 AA_BUG(I->i < 0);
508 AA_BUG(I->i > set->size);
509 AA_BUG(!sub);
510 AA_BUG(I->j < 0);
511 AA_BUG(I->j > sub->size);
512
513 while (I->j < sub->size && I->i < set->size) {
514 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
515
516 if (res == 0) {
517 (I->j)++;
518 (I->i)++;
519 } else if (res > 0)
520 (I->i)++;
521 else
522 return sub->vec[(I->j)++];
523 }
524
525 if (I->j < sub->size)
526 return sub->vec[(I->j)++];
527
528 return NULL;
529}
530
531/**
532 * aa_label_is_subset - test if @sub is a subset of @set
533 * @set: label to test against
534 * @sub: label to test if is subset of @set
535 *
536 * Returns: true if @sub is subset of @set
537 * else false
538 */
539bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
540{
541 struct label_it i = { };
542
543 AA_BUG(!set);
544 AA_BUG(!sub);
545
546 if (sub == set)
547 return true;
548
549 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
550}
551
552/**
553 * aa_label_is_unconfined_subset - test if @sub is a subset of @set
554 * @set: label to test against
555 * @sub: label to test if is subset of @set
556 *
557 * This checks for subset but taking into account unconfined. IF
558 * @sub contains an unconfined profile that does not have a matching
559 * unconfined in @set then this will not cause the test to fail.
560 * Conversely we don't care about an unconfined in @set that is not in
561 * @sub
562 *
563 * Returns: true if @sub is special_subset of @set
564 * else false
565 */
566bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
567{
568 struct label_it i = { };
569 struct aa_profile *p;
570
571 AA_BUG(!set);
572 AA_BUG(!sub);
573
574 if (sub == set)
575 return true;
576
577 do {
578 p = __aa_label_next_not_in_set(&i, set, sub);
579 if (p && !profile_unconfined(p))
580 break;
581 } while (p);
582
583 return p == NULL;
584}
585
586
587/**
588 * __label_remove - remove @label from the label set
589 * @label: label to remove
590 * @new: label to redirect to
591 *
592 * Requires: labels_set(@label)->lock write_lock
593 * Returns: true if the label was in the tree and removed
594 */
595static bool __label_remove(struct aa_label *label, struct aa_label *new)
596{
597 struct aa_labelset *ls = labels_set(label);
598
599 AA_BUG(!ls);
600 AA_BUG(!label);
601 lockdep_assert_held_write(&ls->lock);
602
603 if (new)
604 __aa_proxy_redirect(label, new);
605
606 if (!label_is_stale(label))
607 __label_make_stale(label);
608
609 if (label->flags & FLAG_IN_TREE) {
610 rb_erase(&label->node, &ls->root);
611 label->flags &= ~FLAG_IN_TREE;
612 return true;
613 }
614
615 return false;
616}
617
618/**
619 * __label_replace - replace @old with @new in label set
620 * @old: label to remove from label set
621 * @new: label to replace @old with
622 *
623 * Requires: labels_set(@old)->lock write_lock
624 * valid ref count be held on @new
625 * Returns: true if @old was in set and replaced by @new
626 *
627 * Note: current implementation requires label set be order in such a way
628 * that @new directly replaces @old position in the set (ie.
629 * using pointer comparison of the label address would not work)
630 */
631static bool __label_replace(struct aa_label *old, struct aa_label *new)
632{
633 struct aa_labelset *ls = labels_set(old);
634
635 AA_BUG(!ls);
636 AA_BUG(!old);
637 AA_BUG(!new);
638 lockdep_assert_held_write(&ls->lock);
639 AA_BUG(new->flags & FLAG_IN_TREE);
640
641 if (!label_is_stale(old))
642 __label_make_stale(old);
643
644 if (old->flags & FLAG_IN_TREE) {
645 rb_replace_node(&old->node, &new->node, &ls->root);
646 old->flags &= ~FLAG_IN_TREE;
647 new->flags |= FLAG_IN_TREE;
648 return true;
649 }
650
651 return false;
652}
653
654/**
655 * __label_insert - attempt to insert @l into a label set
656 * @ls: set of labels to insert @l into (NOT NULL)
657 * @label: new label to insert (NOT NULL)
658 * @replace: whether insertion should replace existing entry that is not stale
659 *
660 * Requires: @ls->lock
661 * caller to hold a valid ref on l
662 * if @replace is true l has a preallocated proxy associated
663 * Returns: @l if successful in inserting @l - with additional refcount
664 * else ref counted equivalent label that is already in the set,
665 * the else condition only happens if @replace is false
666 */
667static struct aa_label *__label_insert(struct aa_labelset *ls,
668 struct aa_label *label, bool replace)
669{
670 struct rb_node **new, *parent = NULL;
671
672 AA_BUG(!ls);
673 AA_BUG(!label);
674 AA_BUG(labels_set(label) != ls);
675 lockdep_assert_held_write(&ls->lock);
676 AA_BUG(label->flags & FLAG_IN_TREE);
677
678 /* Figure out where to put new node */
679 new = &ls->root.rb_node;
680 while (*new) {
681 struct aa_label *this = rb_entry(*new, struct aa_label, node);
682 int result = label_cmp(label, this);
683
684 parent = *new;
685 if (result == 0) {
686 /* !__aa_get_label means queued for destruction,
687 * so replace in place, however the label has
688 * died before the replacement so do not share
689 * the proxy
690 */
691 if (!replace && !label_is_stale(this)) {
692 if (__aa_get_label(this))
693 return this;
694 } else
695 __proxy_share(this, label);
696 AA_BUG(!__label_replace(this, label));
697 return aa_get_label(label);
698 } else if (result < 0)
699 new = &((*new)->rb_left);
700 else /* (result > 0) */
701 new = &((*new)->rb_right);
702 }
703
704 /* Add new node and rebalance tree. */
705 rb_link_node(&label->node, parent, new);
706 rb_insert_color(&label->node, &ls->root);
707 label->flags |= FLAG_IN_TREE;
708
709 return aa_get_label(label);
710}
711
712/**
713 * __vec_find - find label that matches @vec in label set
714 * @vec: vec of profiles to find matching label for (NOT NULL)
715 * @n: length of @vec
716 *
717 * Requires: @vec_labelset(vec) lock held
718 * caller to hold a valid ref on l
719 *
720 * Returns: ref counted @label if matching label is in tree
721 * ref counted label that is equiv to @l in tree
722 * else NULL if @vec equiv is not in tree
723 */
724static struct aa_label *__vec_find(struct aa_profile **vec, int n)
725{
726 struct rb_node *node;
727
728 AA_BUG(!vec);
729 AA_BUG(!*vec);
730 AA_BUG(n <= 0);
731
732 node = vec_labelset(vec, n)->root.rb_node;
733 while (node) {
734 struct aa_label *this = rb_entry(node, struct aa_label, node);
735 int result = vec_cmp(this->vec, this->size, vec, n);
736
737 if (result > 0)
738 node = node->rb_left;
739 else if (result < 0)
740 node = node->rb_right;
741 else
742 return __aa_get_label(this);
743 }
744
745 return NULL;
746}
747
748/**
749 * __label_find - find label @label in label set
750 * @label: label to find (NOT NULL)
751 *
752 * Requires: labels_set(@label)->lock held
753 * caller to hold a valid ref on l
754 *
755 * Returns: ref counted @label if @label is in tree OR
756 * ref counted label that is equiv to @label in tree
757 * else NULL if @label or equiv is not in tree
758 */
759static struct aa_label *__label_find(struct aa_label *label)
760{
761 AA_BUG(!label);
762
763 return __vec_find(label->vec, label->size);
764}
765
766
767/**
768 * aa_label_remove - remove a label from the labelset
769 * @label: label to remove
770 *
771 * Returns: true if @label was removed from the tree
772 * else @label was not in tree so it could not be removed
773 */
774bool aa_label_remove(struct aa_label *label)
775{
776 struct aa_labelset *ls = labels_set(label);
777 unsigned long flags;
778 bool res;
779
780 AA_BUG(!ls);
781
782 write_lock_irqsave(&ls->lock, flags);
783 res = __label_remove(label, ns_unconfined(labels_ns(label)));
784 write_unlock_irqrestore(&ls->lock, flags);
785
786 return res;
787}
788
789/**
790 * aa_label_replace - replace a label @old with a new version @new
791 * @old: label to replace
792 * @new: label replacing @old
793 *
794 * Returns: true if @old was in tree and replaced
795 * else @old was not in tree, and @new was not inserted
796 */
797bool aa_label_replace(struct aa_label *old, struct aa_label *new)
798{
799 unsigned long flags;
800 bool res;
801
802 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
803 write_lock_irqsave(&labels_set(old)->lock, flags);
804 if (old->proxy != new->proxy)
805 __proxy_share(old, new);
806 else
807 __aa_proxy_redirect(old, new);
808 res = __label_replace(old, new);
809 write_unlock_irqrestore(&labels_set(old)->lock, flags);
810 } else {
811 struct aa_label *l;
812 struct aa_labelset *ls = labels_set(old);
813
814 write_lock_irqsave(&ls->lock, flags);
815 res = __label_remove(old, new);
816 if (labels_ns(old) != labels_ns(new)) {
817 write_unlock_irqrestore(&ls->lock, flags);
818 ls = labels_set(new);
819 write_lock_irqsave(&ls->lock, flags);
820 }
821 l = __label_insert(ls, new, true);
822 res = (l == new);
823 write_unlock_irqrestore(&ls->lock, flags);
824 aa_put_label(l);
825 }
826
827 return res;
828}
829
830/**
831 * vec_find - find label @l in label set
832 * @vec: array of profiles to find equiv label for (NOT NULL)
833 * @n: length of @vec
834 *
835 * Returns: refcounted label if @vec equiv is in tree
836 * else NULL if @vec equiv is not in tree
837 */
838static struct aa_label *vec_find(struct aa_profile **vec, int n)
839{
840 struct aa_labelset *ls;
841 struct aa_label *label;
842 unsigned long flags;
843
844 AA_BUG(!vec);
845 AA_BUG(!*vec);
846 AA_BUG(n <= 0);
847
848 ls = vec_labelset(vec, n);
849 read_lock_irqsave(&ls->lock, flags);
850 label = __vec_find(vec, n);
851 read_unlock_irqrestore(&ls->lock, flags);
852
853 return label;
854}
855
856/* requires sort and merge done first */
857static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
858 int len, gfp_t gfp)
859{
860 struct aa_label *label = NULL;
861 struct aa_labelset *ls;
862 unsigned long flags;
863 struct aa_label *new;
864 int i;
865
866 AA_BUG(!vec);
867
868 if (len == 1)
869 return aa_get_label(&vec[0]->label);
870
871 ls = labels_set(&vec[len - 1]->label);
872
873 /* TODO: enable when read side is lockless
874 * check if label exists before taking locks
875 */
876 new = aa_label_alloc(len, NULL, gfp);
877 if (!new)
878 return NULL;
879
880 for (i = 0; i < len; i++)
881 new->vec[i] = aa_get_profile(vec[i]);
882
883 write_lock_irqsave(&ls->lock, flags);
884 label = __label_insert(ls, new, false);
885 write_unlock_irqrestore(&ls->lock, flags);
886 label_free_or_put_new(label, new);
887
888 return label;
889}
890
891struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
892 gfp_t gfp)
893{
894 struct aa_label *label = vec_find(vec, len);
895
896 if (label)
897 return label;
898
899 return vec_create_and_insert_label(vec, len, gfp);
900}
901
902/**
903 * aa_label_find - find label @label in label set
904 * @label: label to find (NOT NULL)
905 *
906 * Requires: caller to hold a valid ref on l
907 *
908 * Returns: refcounted @label if @label is in tree
909 * refcounted label that is equiv to @label in tree
910 * else NULL if @label or equiv is not in tree
911 */
912struct aa_label *aa_label_find(struct aa_label *label)
913{
914 AA_BUG(!label);
915
916 return vec_find(label->vec, label->size);
917}
918
919
920/**
921 * aa_label_insert - insert label @label into @ls or return existing label
922 * @ls: labelset to insert @label into
923 * @label: label to insert
924 *
925 * Requires: caller to hold a valid ref on @label
926 *
927 * Returns: ref counted @label if successful in inserting @label
928 * else ref counted equivalent label that is already in the set
929 */
930struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
931{
932 struct aa_label *l;
933 unsigned long flags;
934
935 AA_BUG(!ls);
936 AA_BUG(!label);
937
938 /* check if label exists before taking lock */
939 if (!label_is_stale(label)) {
940 read_lock_irqsave(&ls->lock, flags);
941 l = __label_find(label);
942 read_unlock_irqrestore(&ls->lock, flags);
943 if (l)
944 return l;
945 }
946
947 write_lock_irqsave(&ls->lock, flags);
948 l = __label_insert(ls, label, false);
949 write_unlock_irqrestore(&ls->lock, flags);
950
951 return l;
952}
953
954
955/**
956 * aa_label_next_in_merge - find the next profile when merging @a and @b
957 * @I: label iterator
958 * @a: label to merge
959 * @b: label to merge
960 *
961 * Returns: next profile
962 * else null if no more profiles
963 */
964struct aa_profile *aa_label_next_in_merge(struct label_it *I,
965 struct aa_label *a,
966 struct aa_label *b)
967{
968 AA_BUG(!a);
969 AA_BUG(!b);
970 AA_BUG(!I);
971 AA_BUG(I->i < 0);
972 AA_BUG(I->i > a->size);
973 AA_BUG(I->j < 0);
974 AA_BUG(I->j > b->size);
975
976 if (I->i < a->size) {
977 if (I->j < b->size) {
978 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
979
980 if (res > 0)
981 return b->vec[(I->j)++];
982 if (res == 0)
983 (I->j)++;
984 }
985
986 return a->vec[(I->i)++];
987 }
988
989 if (I->j < b->size)
990 return b->vec[(I->j)++];
991
992 return NULL;
993}
994
995/**
996 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
997 * @a: label to merge then compare (NOT NULL)
998 * @b: label to merge then compare (NOT NULL)
999 * @z: label to compare merge against (NOT NULL)
1000 *
1001 * Assumes: using the most recent versions of @a, @b, and @z
1002 *
1003 * Returns: <0 if a < b
1004 * ==0 if a == b
1005 * >0 if a > b
1006 */
1007static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1008 struct aa_label *z)
1009{
1010 struct aa_profile *p = NULL;
1011 struct label_it i = { };
1012 int k;
1013
1014 AA_BUG(!a);
1015 AA_BUG(!b);
1016 AA_BUG(!z);
1017
1018 for (k = 0;
1019 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1020 k++) {
1021 int res = profile_cmp(p, z->vec[k]);
1022
1023 if (res != 0)
1024 return res;
1025 }
1026
1027 if (p)
1028 return 1;
1029 else if (k < z->size)
1030 return -1;
1031 return 0;
1032}
1033
1034/**
1035 * label_merge_insert - create a new label by merging @a and @b
1036 * @new: preallocated label to merge into (NOT NULL)
1037 * @a: label to merge with @b (NOT NULL)
1038 * @b: label to merge with @a (NOT NULL)
1039 *
1040 * Requires: preallocated proxy
1041 *
1042 * Returns: ref counted label either @new if merge is unique
1043 * @a if @b is a subset of @a
1044 * @b if @a is a subset of @b
1045 *
1046 * NOTE: will not use @new if the merge results in @new == @a or @b
1047 *
1048 * Must be used within labelset write lock to avoid racing with
1049 * setting labels stale.
1050 */
1051static struct aa_label *label_merge_insert(struct aa_label *new,
1052 struct aa_label *a,
1053 struct aa_label *b)
1054{
1055 struct aa_label *label;
1056 struct aa_labelset *ls;
1057 struct aa_profile *next;
1058 struct label_it i;
1059 unsigned long flags;
1060 int k = 0, invcount = 0;
1061 bool stale = false;
1062
1063 AA_BUG(!a);
1064 AA_BUG(a->size < 0);
1065 AA_BUG(!b);
1066 AA_BUG(b->size < 0);
1067 AA_BUG(!new);
1068 AA_BUG(new->size < a->size + b->size);
1069
1070 label_for_each_in_merge(i, a, b, next) {
1071 AA_BUG(!next);
1072 if (profile_is_stale(next)) {
1073 new->vec[k] = aa_get_newest_profile(next);
1074 AA_BUG(!new->vec[k]->label.proxy);
1075 AA_BUG(!new->vec[k]->label.proxy->label);
1076 if (next->label.proxy != new->vec[k]->label.proxy)
1077 invcount++;
1078 k++;
1079 stale = true;
1080 } else
1081 new->vec[k++] = aa_get_profile(next);
1082 }
1083 /* set to actual size which is <= allocated len */
1084 new->size = k;
1085 new->vec[k] = NULL;
1086
1087 if (invcount) {
1088 new->size -= aa_vec_unique(&new->vec[0], new->size,
1089 VEC_FLAG_TERMINATE);
1090 /* TODO: deal with reference labels */
1091 if (new->size == 1) {
1092 label = aa_get_label(&new->vec[0]->label);
1093 return label;
1094 }
1095 } else if (!stale) {
1096 /*
1097 * merge could be same as a || b, note: it is not possible
1098 * for new->size == a->size == b->size unless a == b
1099 */
1100 if (k == a->size)
1101 return aa_get_label(a);
1102 else if (k == b->size)
1103 return aa_get_label(b);
1104 }
1105 new->flags |= accum_vec_flags(new->vec, new->size);
1106 ls = labels_set(new);
1107 write_lock_irqsave(&ls->lock, flags);
1108 label = __label_insert(labels_set(new), new, false);
1109 write_unlock_irqrestore(&ls->lock, flags);
1110
1111 return label;
1112}
1113
1114/**
1115 * labelset_of_merge - find which labelset a merged label should be inserted
1116 * @a: label to merge and insert
1117 * @b: label to merge and insert
1118 *
1119 * Returns: labelset that the merged label should be inserted into
1120 */
1121static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1122 struct aa_label *b)
1123{
1124 struct aa_ns *nsa = labels_ns(a);
1125 struct aa_ns *nsb = labels_ns(b);
1126
1127 if (ns_cmp(nsa, nsb) <= 0)
1128 return &nsa->labels;
1129 return &nsb->labels;
1130}
1131
1132/**
1133 * __label_find_merge - find label that is equiv to merge of @a and @b
1134 * @ls: set of labels to search (NOT NULL)
1135 * @a: label to merge with @b (NOT NULL)
1136 * @b: label to merge with @a (NOT NULL)
1137 *
1138 * Requires: ls->lock read_lock held
1139 *
1140 * Returns: ref counted label that is equiv to merge of @a and @b
1141 * else NULL if merge of @a and @b is not in set
1142 */
1143static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1144 struct aa_label *a,
1145 struct aa_label *b)
1146{
1147 struct rb_node *node;
1148
1149 AA_BUG(!ls);
1150 AA_BUG(!a);
1151 AA_BUG(!b);
1152
1153 if (a == b)
1154 return __label_find(a);
1155
1156 node = ls->root.rb_node;
1157 while (node) {
1158 struct aa_label *this = container_of(node, struct aa_label,
1159 node);
1160 int result = label_merge_cmp(a, b, this);
1161
1162 if (result < 0)
1163 node = node->rb_left;
1164 else if (result > 0)
1165 node = node->rb_right;
1166 else
1167 return __aa_get_label(this);
1168 }
1169
1170 return NULL;
1171}
1172
1173
1174/**
1175 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1176 * @a: label to merge with @b (NOT NULL)
1177 * @b: label to merge with @a (NOT NULL)
1178 *
1179 * Requires: labels be fully constructed with a valid ns
1180 *
1181 * Returns: ref counted label that is equiv to merge of @a and @b
1182 * else NULL if merge of @a and @b is not in set
1183 */
1184struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1185{
1186 struct aa_labelset *ls;
1187 struct aa_label *label, *ar = NULL, *br = NULL;
1188 unsigned long flags;
1189
1190 AA_BUG(!a);
1191 AA_BUG(!b);
1192
1193 if (label_is_stale(a))
1194 a = ar = aa_get_newest_label(a);
1195 if (label_is_stale(b))
1196 b = br = aa_get_newest_label(b);
1197 ls = labelset_of_merge(a, b);
1198 read_lock_irqsave(&ls->lock, flags);
1199 label = __label_find_merge(ls, a, b);
1200 read_unlock_irqrestore(&ls->lock, flags);
1201 aa_put_label(ar);
1202 aa_put_label(br);
1203
1204 return label;
1205}
1206
1207/**
1208 * aa_label_merge - attempt to insert new merged label of @a and @b
1209 * @a: label to merge with @b (NOT NULL)
1210 * @b: label to merge with @a (NOT NULL)
1211 * @gfp: memory allocation type
1212 *
1213 * Requires: caller to hold valid refs on @a and @b
1214 * labels be fully constructed with a valid ns
1215 *
1216 * Returns: ref counted new label if successful in inserting merge of a & b
1217 * else ref counted equivalent label that is already in the set.
1218 * else NULL if could not create label (-ENOMEM)
1219 */
1220struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1221 gfp_t gfp)
1222{
1223 struct aa_label *label = NULL;
1224
1225 AA_BUG(!a);
1226 AA_BUG(!b);
1227
1228 if (a == b)
1229 return aa_get_newest_label(a);
1230
1231 /* TODO: enable when read side is lockless
1232 * check if label exists before taking locks
1233 if (!label_is_stale(a) && !label_is_stale(b))
1234 label = aa_label_find_merge(a, b);
1235 */
1236
1237 if (!label) {
1238 struct aa_label *new;
1239
1240 a = aa_get_newest_label(a);
1241 b = aa_get_newest_label(b);
1242
1243 /* could use label_merge_len(a, b), but requires double
1244 * comparison for small savings
1245 */
1246 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1247 if (!new)
1248 goto out;
1249
1250 label = label_merge_insert(new, a, b);
1251 label_free_or_put_new(label, new);
1252out:
1253 aa_put_label(a);
1254 aa_put_label(b);
1255 }
1256
1257 return label;
1258}
1259
1260/* match a profile and its associated ns component if needed
1261 * Assumes visibility test has already been done.
1262 * If a subns profile is not to be matched should be prescreened with
1263 * visibility test.
1264 */
1265static inline aa_state_t match_component(struct aa_profile *profile,
1266 struct aa_ruleset *rules,
1267 struct aa_profile *tp,
1268 aa_state_t state)
1269{
1270 const char *ns_name;
1271
1272 if (profile->ns == tp->ns)
1273 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1274
1275 /* try matching with namespace name and then profile */
1276 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1277 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1278 state = aa_dfa_match(rules->policy->dfa, state, ns_name);
1279 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1280 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1281}
1282
1283/**
1284 * label_compound_match - find perms for full compound label
1285 * @profile: profile to find perms for
1286 * @rules: ruleset to search
1287 * @label: label to check access permissions for
1288 * @state: state to start match in
1289 * @subns: whether to do permission checks on components in a subns
1290 * @request: permissions to request
1291 * @perms: perms struct to set
1292 *
1293 * Returns: 0 on success else ERROR
1294 *
1295 * For the label A//&B//&C this does the perm match for A//&B//&C
1296 * @perms should be preinitialized with allperms OR a previous permission
1297 * check to be stacked.
1298 */
1299static int label_compound_match(struct aa_profile *profile,
1300 struct aa_ruleset *rules,
1301 struct aa_label *label,
1302 aa_state_t state, bool subns, u32 request,
1303 struct aa_perms *perms)
1304{
1305 struct aa_profile *tp;
1306 struct label_it i;
1307
1308 /* find first subcomponent that is visible */
1309 label_for_each(i, label, tp) {
1310 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1311 continue;
1312 state = match_component(profile, rules, tp, state);
1313 if (!state)
1314 goto fail;
1315 goto next;
1316 }
1317
1318 /* no component visible */
1319 *perms = allperms;
1320 return 0;
1321
1322next:
1323 label_for_each_cont(i, label, tp) {
1324 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1325 continue;
1326 state = aa_dfa_match(rules->policy->dfa, state, "//&");
1327 state = match_component(profile, rules, tp, state);
1328 if (!state)
1329 goto fail;
1330 }
1331 *perms = *aa_lookup_perms(rules->policy, state);
1332 aa_apply_modes_to_perms(profile, perms);
1333 if ((perms->allow & request) != request)
1334 return -EACCES;
1335
1336 return 0;
1337
1338fail:
1339 *perms = nullperms;
1340 return state;
1341}
1342
1343/**
1344 * label_components_match - find perms for all subcomponents of a label
1345 * @profile: profile to find perms for
1346 * @rules: ruleset to search
1347 * @label: label to check access permissions for
1348 * @start: state to start match in
1349 * @subns: whether to do permission checks on components in a subns
1350 * @request: permissions to request
1351 * @perms: an initialized perms struct to add accumulation to
1352 *
1353 * Returns: 0 on success else ERROR
1354 *
1355 * For the label A//&B//&C this does the perm match for each of A and B and C
1356 * @perms should be preinitialized with allperms OR a previous permission
1357 * check to be stacked.
1358 */
1359static int label_components_match(struct aa_profile *profile,
1360 struct aa_ruleset *rules,
1361 struct aa_label *label, aa_state_t start,
1362 bool subns, u32 request,
1363 struct aa_perms *perms)
1364{
1365 struct aa_profile *tp;
1366 struct label_it i;
1367 struct aa_perms tmp;
1368 aa_state_t state = 0;
1369
1370 /* find first subcomponent to test */
1371 label_for_each(i, label, tp) {
1372 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1373 continue;
1374 state = match_component(profile, rules, tp, start);
1375 if (!state)
1376 goto fail;
1377 goto next;
1378 }
1379
1380 /* no subcomponents visible - no change in perms */
1381 return 0;
1382
1383next:
1384 tmp = *aa_lookup_perms(rules->policy, state);
1385 aa_apply_modes_to_perms(profile, &tmp);
1386 aa_perms_accum(perms, &tmp);
1387 label_for_each_cont(i, label, tp) {
1388 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1389 continue;
1390 state = match_component(profile, rules, tp, start);
1391 if (!state)
1392 goto fail;
1393 tmp = *aa_lookup_perms(rules->policy, state);
1394 aa_apply_modes_to_perms(profile, &tmp);
1395 aa_perms_accum(perms, &tmp);
1396 }
1397
1398 if ((perms->allow & request) != request)
1399 return -EACCES;
1400
1401 return 0;
1402
1403fail:
1404 *perms = nullperms;
1405 return -EACCES;
1406}
1407
1408/**
1409 * aa_label_match - do a multi-component label match
1410 * @profile: profile to match against (NOT NULL)
1411 * @rules: ruleset to search
1412 * @label: label to match (NOT NULL)
1413 * @state: state to start in
1414 * @subns: whether to match subns components
1415 * @request: permission request
1416 * @perms: Returns computed perms (NOT NULL)
1417 *
1418 * Returns: the state the match finished in, may be the none matching state
1419 */
1420int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
1421 struct aa_label *label, aa_state_t state, bool subns,
1422 u32 request, struct aa_perms *perms)
1423{
1424 int error = label_compound_match(profile, rules, label, state, subns,
1425 request, perms);
1426 if (!error)
1427 return error;
1428
1429 *perms = allperms;
1430 return label_components_match(profile, rules, label, state, subns,
1431 request, perms);
1432}
1433
1434
1435/**
1436 * aa_update_label_name - update a label to have a stored name
1437 * @ns: ns being viewed from (NOT NULL)
1438 * @label: label to update (NOT NULL)
1439 * @gfp: type of memory allocation
1440 *
1441 * Requires: labels_set(label) not locked in caller
1442 *
1443 * note: only updates the label name if it does not have a name already
1444 * and if it is in the labelset
1445 */
1446bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1447{
1448 struct aa_labelset *ls;
1449 unsigned long flags;
1450 char __counted *name;
1451 bool res = false;
1452
1453 AA_BUG(!ns);
1454 AA_BUG(!label);
1455
1456 if (label->hname || labels_ns(label) != ns)
1457 return res;
1458
1459 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1460 return res;
1461
1462 ls = labels_set(label);
1463 write_lock_irqsave(&ls->lock, flags);
1464 if (!label->hname && label->flags & FLAG_IN_TREE) {
1465 label->hname = name;
1466 res = true;
1467 } else
1468 aa_put_str(name);
1469 write_unlock_irqrestore(&ls->lock, flags);
1470
1471 return res;
1472}
1473
1474/*
1475 * cached label name is present and visible
1476 * @label->hname only exists if label is namespace hierachical
1477 */
1478static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1479 int flags)
1480{
1481 if (label->hname && (!ns || labels_ns(label) == ns) &&
1482 !(flags & ~FLAG_SHOW_MODE))
1483 return true;
1484
1485 return false;
1486}
1487
1488/* helper macro for snprint routines */
1489#define update_for_len(total, len, size, str) \
1490do { \
1491 size_t ulen = len; \
1492 \
1493 AA_BUG(len < 0); \
1494 total += ulen; \
1495 ulen = min(ulen, size); \
1496 size -= ulen; \
1497 str += ulen; \
1498} while (0)
1499
1500/**
1501 * aa_profile_snxprint - print a profile name to a buffer
1502 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1503 * @size: size of buffer
1504 * @view: namespace profile is being viewed from
1505 * @profile: profile to view (NOT NULL)
1506 * @flags: whether to include the mode string
1507 * @prev_ns: last ns printed when used in compound print
1508 *
1509 * Returns: size of name written or would be written if larger than
1510 * available buffer
1511 *
1512 * Note: will not print anything if the profile is not visible
1513 */
1514static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1515 struct aa_profile *profile, int flags,
1516 struct aa_ns **prev_ns)
1517{
1518 const char *ns_name = NULL;
1519
1520 AA_BUG(!str && size != 0);
1521 AA_BUG(!profile);
1522
1523 if (!view)
1524 view = profiles_ns(profile);
1525
1526 if (view != profile->ns &&
1527 (!prev_ns || (*prev_ns != profile->ns))) {
1528 if (prev_ns)
1529 *prev_ns = profile->ns;
1530 ns_name = aa_ns_name(view, profile->ns,
1531 flags & FLAG_VIEW_SUBNS);
1532 if (ns_name == aa_hidden_ns_name) {
1533 if (flags & FLAG_HIDDEN_UNCONFINED)
1534 return snprintf(str, size, "%s", "unconfined");
1535 return snprintf(str, size, "%s", ns_name);
1536 }
1537 }
1538
1539 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1540 const char *modestr = aa_profile_mode_names[profile->mode];
1541
1542 if (ns_name)
1543 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1544 profile->base.hname, modestr);
1545 return snprintf(str, size, "%s (%s)", profile->base.hname,
1546 modestr);
1547 }
1548
1549 if (ns_name)
1550 return snprintf(str, size, ":%s:%s", ns_name,
1551 profile->base.hname);
1552 return snprintf(str, size, "%s", profile->base.hname);
1553}
1554
1555static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1556 int flags)
1557{
1558 struct aa_profile *profile;
1559 struct label_it i;
1560 int mode = -1, count = 0;
1561
1562 label_for_each(i, label, profile) {
1563 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1564 count++;
1565 if (profile == profile->ns->unconfined)
1566 /* special case unconfined so stacks with
1567 * unconfined don't report as mixed. ie.
1568 * profile_foo//&:ns1:unconfined (mixed)
1569 */
1570 continue;
1571 if (mode == -1)
1572 mode = profile->mode;
1573 else if (mode != profile->mode)
1574 return "mixed";
1575 }
1576 }
1577
1578 if (count == 0)
1579 return "-";
1580 if (mode == -1)
1581 /* everything was unconfined */
1582 mode = APPARMOR_UNCONFINED;
1583
1584 return aa_profile_mode_names[mode];
1585}
1586
1587/* if any visible label is not unconfined the display_mode returns true */
1588static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1589 int flags)
1590{
1591 if ((flags & FLAG_SHOW_MODE)) {
1592 struct aa_profile *profile;
1593 struct label_it i;
1594
1595 label_for_each(i, label, profile) {
1596 if (aa_ns_visible(ns, profile->ns,
1597 flags & FLAG_VIEW_SUBNS) &&
1598 profile != profile->ns->unconfined)
1599 return true;
1600 }
1601 /* only ns->unconfined in set of profiles in ns */
1602 return false;
1603 }
1604
1605 return false;
1606}
1607
1608/**
1609 * aa_label_snxprint - print a label name to a string buffer
1610 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1611 * @size: size of buffer
1612 * @ns: namespace profile is being viewed from
1613 * @label: label to view (NOT NULL)
1614 * @flags: whether to include the mode string
1615 *
1616 * Returns: size of name written or would be written if larger than
1617 * available buffer
1618 *
1619 * Note: labels do not have to be strictly hierarchical to the ns as
1620 * objects may be shared across different namespaces and thus
1621 * pickup labeling from each ns. If a particular part of the
1622 * label is not visible it will just be excluded. And if none
1623 * of the label is visible "---" will be used.
1624 */
1625int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1626 struct aa_label *label, int flags)
1627{
1628 struct aa_profile *profile;
1629 struct aa_ns *prev_ns = NULL;
1630 struct label_it i;
1631 int count = 0, total = 0;
1632 ssize_t len;
1633
1634 AA_BUG(!str && size != 0);
1635 AA_BUG(!label);
1636
1637 if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
1638 ns = root_ns;
1639 len = snprintf(str, size, "_");
1640 update_for_len(total, len, size, str);
1641 } else if (!ns) {
1642 ns = labels_ns(label);
1643 }
1644
1645 label_for_each(i, label, profile) {
1646 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1647 if (count > 0) {
1648 len = snprintf(str, size, "//&");
1649 update_for_len(total, len, size, str);
1650 }
1651 len = aa_profile_snxprint(str, size, ns, profile,
1652 flags & FLAG_VIEW_SUBNS,
1653 &prev_ns);
1654 update_for_len(total, len, size, str);
1655 count++;
1656 }
1657 }
1658
1659 if (count == 0) {
1660 if (flags & FLAG_HIDDEN_UNCONFINED)
1661 return snprintf(str, size, "%s", "unconfined");
1662 return snprintf(str, size, "%s", aa_hidden_ns_name);
1663 }
1664
1665 /* count == 1 && ... is for backwards compat where the mode
1666 * is not displayed for 'unconfined' in the current ns
1667 */
1668 if (display_mode(ns, label, flags)) {
1669 len = snprintf(str, size, " (%s)",
1670 label_modename(ns, label, flags));
1671 update_for_len(total, len, size, str);
1672 }
1673
1674 return total;
1675}
1676#undef update_for_len
1677
1678/**
1679 * aa_label_asxprint - allocate a string buffer and print label into it
1680 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1681 * @ns: namespace profile is being viewed from
1682 * @label: label to view (NOT NULL)
1683 * @flags: flags controlling what label info is printed
1684 * @gfp: kernel memory allocation type
1685 *
1686 * Returns: size of name written or would be written if larger than
1687 * available buffer
1688 */
1689int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1690 int flags, gfp_t gfp)
1691{
1692 int size;
1693
1694 AA_BUG(!strp);
1695 AA_BUG(!label);
1696
1697 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1698 if (size < 0)
1699 return size;
1700
1701 *strp = kmalloc(size + 1, gfp);
1702 if (!*strp)
1703 return -ENOMEM;
1704 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1705}
1706
1707/**
1708 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1709 * @strp: buffer to write to.
1710 * @ns: namespace profile is being viewed from
1711 * @label: label to view (NOT NULL)
1712 * @flags: flags controlling what label info is printed
1713 * @gfp: kernel memory allocation type
1714 *
1715 * Returns: size of name written or would be written if larger than
1716 * available buffer
1717 */
1718int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1719 struct aa_label *label, int flags, gfp_t gfp)
1720{
1721 int size;
1722
1723 AA_BUG(!strp);
1724 AA_BUG(!label);
1725
1726 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1727 if (size < 0)
1728 return size;
1729
1730 *strp = aa_str_alloc(size + 1, gfp);
1731 if (!*strp)
1732 return -ENOMEM;
1733 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1734}
1735
1736
1737void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1738 struct aa_label *label, int flags, gfp_t gfp)
1739{
1740 const char *str;
1741 char *name = NULL;
1742 int len;
1743
1744 AA_BUG(!ab);
1745 AA_BUG(!label);
1746
1747 if (!use_label_hname(ns, label, flags) ||
1748 display_mode(ns, label, flags)) {
1749 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1750 if (len < 0) {
1751 AA_DEBUG("label print error");
1752 return;
1753 }
1754 str = name;
1755 } else {
1756 str = (char *) label->hname;
1757 len = strlen(str);
1758 }
1759 if (audit_string_contains_control(str, len))
1760 audit_log_n_hex(ab, str, len);
1761 else
1762 audit_log_n_string(ab, str, len);
1763
1764 kfree(name);
1765}
1766
1767void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1768 struct aa_label *label, int flags, gfp_t gfp)
1769{
1770 AA_BUG(!f);
1771 AA_BUG(!label);
1772
1773 if (!use_label_hname(ns, label, flags)) {
1774 char *str;
1775 int len;
1776
1777 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1778 if (len < 0) {
1779 AA_DEBUG("label print error");
1780 return;
1781 }
1782 seq_puts(f, str);
1783 kfree(str);
1784 } else if (display_mode(ns, label, flags))
1785 seq_printf(f, "%s (%s)", label->hname,
1786 label_modename(ns, label, flags));
1787 else
1788 seq_puts(f, label->hname);
1789}
1790
1791void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1792 gfp_t gfp)
1793{
1794 AA_BUG(!label);
1795
1796 if (!use_label_hname(ns, label, flags)) {
1797 char *str;
1798 int len;
1799
1800 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1801 if (len < 0) {
1802 AA_DEBUG("label print error");
1803 return;
1804 }
1805 pr_info("%s", str);
1806 kfree(str);
1807 } else if (display_mode(ns, label, flags))
1808 pr_info("%s (%s)", label->hname,
1809 label_modename(ns, label, flags));
1810 else
1811 pr_info("%s", label->hname);
1812}
1813
1814void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1815{
1816 struct aa_ns *ns = aa_get_current_ns();
1817
1818 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1819 aa_put_ns(ns);
1820}
1821
1822void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1823{
1824 struct aa_ns *ns = aa_get_current_ns();
1825
1826 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1827 aa_put_ns(ns);
1828}
1829
1830void aa_label_printk(struct aa_label *label, gfp_t gfp)
1831{
1832 struct aa_ns *ns = aa_get_current_ns();
1833
1834 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1835 aa_put_ns(ns);
1836}
1837
1838static int label_count_strn_entries(const char *str, size_t n)
1839{
1840 const char *end = str + n;
1841 const char *split;
1842 int count = 1;
1843
1844 AA_BUG(!str);
1845
1846 for (split = aa_label_strn_split(str, end - str);
1847 split;
1848 split = aa_label_strn_split(str, end - str)) {
1849 count++;
1850 str = split + 3;
1851 }
1852
1853 return count;
1854}
1855
1856/*
1857 * ensure stacks with components like
1858 * :ns:A//&B
1859 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1860 * to the base if the lookup specifies an ns, else making the stacked lookup
1861 * relative to the last embedded ns in the string.
1862 */
1863static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1864 struct aa_label *currentbase,
1865 const char *str, size_t n)
1866{
1867 const char *first = skipn_spaces(str, n);
1868
1869 if (first && *first == ':')
1870 return aa_fqlookupn_profile(base, str, n);
1871
1872 return aa_fqlookupn_profile(currentbase, str, n);
1873}
1874
1875/**
1876 * aa_label_strn_parse - parse, validate and convert a text string to a label
1877 * @base: base label to use for lookups (NOT NULL)
1878 * @str: null terminated text string (NOT NULL)
1879 * @n: length of str to parse, will stop at \0 if encountered before n
1880 * @gfp: allocation type
1881 * @create: true if should create compound labels if they don't exist
1882 * @force_stack: true if should stack even if no leading &
1883 *
1884 * Returns: the matching refcounted label if present
1885 * else ERRPTR
1886 */
1887struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1888 size_t n, gfp_t gfp, bool create,
1889 bool force_stack)
1890{
1891 DEFINE_VEC(profile, vec);
1892 struct aa_label *label, *currbase = base;
1893 int i, len, stack = 0, error;
1894 const char *end = str + n;
1895 const char *split;
1896
1897 AA_BUG(!base);
1898 AA_BUG(!str);
1899
1900 str = skipn_spaces(str, n);
1901 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
1902 base != &root_ns->unconfined->label))
1903 return ERR_PTR(-EINVAL);
1904
1905 len = label_count_strn_entries(str, end - str);
1906 if (*str == '&' || force_stack) {
1907 /* stack on top of base */
1908 stack = base->size;
1909 len += stack;
1910 if (*str == '&')
1911 str++;
1912 }
1913
1914 error = vec_setup(profile, vec, len, gfp);
1915 if (error)
1916 return ERR_PTR(error);
1917
1918 for (i = 0; i < stack; i++)
1919 vec[i] = aa_get_profile(base->vec[i]);
1920
1921 for (split = aa_label_strn_split(str, end - str), i = stack;
1922 split && i < len; i++) {
1923 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1924 if (!vec[i])
1925 goto fail;
1926 /*
1927 * if component specified a new ns it becomes the new base
1928 * so that subsequent lookups are relative to it
1929 */
1930 if (vec[i]->ns != labels_ns(currbase))
1931 currbase = &vec[i]->label;
1932 str = split + 3;
1933 split = aa_label_strn_split(str, end - str);
1934 }
1935 /* last element doesn't have a split */
1936 if (i < len) {
1937 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1938 if (!vec[i])
1939 goto fail;
1940 }
1941 if (len == 1)
1942 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1943 return &vec[0]->label;
1944
1945 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1946 /* TODO: deal with reference labels */
1947 if (len == 1) {
1948 label = aa_get_label(&vec[0]->label);
1949 goto out;
1950 }
1951
1952 if (create)
1953 label = aa_vec_find_or_create_label(vec, len, gfp);
1954 else
1955 label = vec_find(vec, len);
1956 if (!label)
1957 goto fail;
1958
1959out:
1960 /* use adjusted len from after vec_unique, not original */
1961 vec_cleanup(profile, vec, len);
1962 return label;
1963
1964fail:
1965 label = ERR_PTR(-ENOENT);
1966 goto out;
1967}
1968
1969struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1970 gfp_t gfp, bool create, bool force_stack)
1971{
1972 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1973 force_stack);
1974}
1975
1976/**
1977 * aa_labelset_destroy - remove all labels from the label set
1978 * @ls: label set to cleanup (NOT NULL)
1979 *
1980 * Labels that are removed from the set may still exist beyond the set
1981 * being destroyed depending on their reference counting
1982 */
1983void aa_labelset_destroy(struct aa_labelset *ls)
1984{
1985 struct rb_node *node;
1986 unsigned long flags;
1987
1988 AA_BUG(!ls);
1989
1990 write_lock_irqsave(&ls->lock, flags);
1991 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1992 struct aa_label *this = rb_entry(node, struct aa_label, node);
1993
1994 if (labels_ns(this) != root_ns)
1995 __label_remove(this,
1996 ns_unconfined(labels_ns(this)->parent));
1997 else
1998 __label_remove(this, NULL);
1999 }
2000 write_unlock_irqrestore(&ls->lock, flags);
2001}
2002
2003/*
2004 * @ls: labelset to init (NOT NULL)
2005 */
2006void aa_labelset_init(struct aa_labelset *ls)
2007{
2008 AA_BUG(!ls);
2009
2010 rwlock_init(&ls->lock);
2011 ls->root = RB_ROOT;
2012}
2013
2014static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2015{
2016 struct aa_label *label;
2017 struct rb_node *node;
2018 unsigned long flags;
2019
2020 AA_BUG(!ls);
2021
2022 read_lock_irqsave(&ls->lock, flags);
2023
2024 __labelset_for_each(ls, node) {
2025 label = rb_entry(node, struct aa_label, node);
2026 if ((label_is_stale(label) ||
2027 vec_is_stale(label->vec, label->size)) &&
2028 __aa_get_label(label))
2029 goto out;
2030
2031 }
2032 label = NULL;
2033
2034out:
2035 read_unlock_irqrestore(&ls->lock, flags);
2036
2037 return label;
2038}
2039
2040/**
2041 * __label_update - insert updated version of @label into labelset
2042 * @label: the label to update/replace
2043 *
2044 * Returns: new label that is up to date
2045 * else NULL on failure
2046 *
2047 * Requires: @ns lock be held
2048 *
2049 * Note: worst case is the stale @label does not get updated and has
2050 * to be updated at a later time.
2051 */
2052static struct aa_label *__label_update(struct aa_label *label)
2053{
2054 struct aa_label *new, *tmp;
2055 struct aa_labelset *ls;
2056 unsigned long flags;
2057 int i, invcount = 0;
2058
2059 AA_BUG(!label);
2060 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2061
2062 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2063 if (!new)
2064 return NULL;
2065
2066 /*
2067 * while holding the ns_lock will stop profile replacement, removal,
2068 * and label updates, label merging and removal can be occurring
2069 */
2070 ls = labels_set(label);
2071 write_lock_irqsave(&ls->lock, flags);
2072 for (i = 0; i < label->size; i++) {
2073 AA_BUG(!label->vec[i]);
2074 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2075 AA_BUG(!new->vec[i]);
2076 AA_BUG(!new->vec[i]->label.proxy);
2077 AA_BUG(!new->vec[i]->label.proxy->label);
2078 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2079 invcount++;
2080 }
2081
2082 /* updated stale label by being removed/renamed from labelset */
2083 if (invcount) {
2084 new->size -= aa_vec_unique(&new->vec[0], new->size,
2085 VEC_FLAG_TERMINATE);
2086 /* TODO: deal with reference labels */
2087 if (new->size == 1) {
2088 tmp = aa_get_label(&new->vec[0]->label);
2089 AA_BUG(tmp == label);
2090 goto remove;
2091 }
2092 if (labels_set(label) != labels_set(new)) {
2093 write_unlock_irqrestore(&ls->lock, flags);
2094 tmp = aa_label_insert(labels_set(new), new);
2095 write_lock_irqsave(&ls->lock, flags);
2096 goto remove;
2097 }
2098 } else
2099 AA_BUG(labels_ns(label) != labels_ns(new));
2100
2101 tmp = __label_insert(labels_set(label), new, true);
2102remove:
2103 /* ensure label is removed, and redirected correctly */
2104 __label_remove(label, tmp);
2105 write_unlock_irqrestore(&ls->lock, flags);
2106 label_free_or_put_new(tmp, new);
2107
2108 return tmp;
2109}
2110
2111/**
2112 * __labelset_update - update labels in @ns
2113 * @ns: namespace to update labels in (NOT NULL)
2114 *
2115 * Requires: @ns lock be held
2116 *
2117 * Walk the labelset ensuring that all labels are up to date and valid
2118 * Any label that has a stale component is marked stale and replaced and
2119 * by an updated version.
2120 *
2121 * If failures happen due to memory pressures then stale labels will
2122 * be left in place until the next pass.
2123 */
2124static void __labelset_update(struct aa_ns *ns)
2125{
2126 struct aa_label *label;
2127
2128 AA_BUG(!ns);
2129 AA_BUG(!mutex_is_locked(&ns->lock));
2130
2131 do {
2132 label = labelset_next_stale(&ns->labels);
2133 if (label) {
2134 struct aa_label *l = __label_update(label);
2135
2136 aa_put_label(l);
2137 aa_put_label(label);
2138 }
2139 } while (label);
2140}
2141
2142/**
2143 * __aa_labelset_update_subtree - update all labels with a stale component
2144 * @ns: ns to start update at (NOT NULL)
2145 *
2146 * Requires: @ns lock be held
2147 *
2148 * Invalidates labels based on @p in @ns and any children namespaces.
2149 */
2150void __aa_labelset_update_subtree(struct aa_ns *ns)
2151{
2152 struct aa_ns *child;
2153
2154 AA_BUG(!ns);
2155 AA_BUG(!mutex_is_locked(&ns->lock));
2156
2157 __labelset_update(ns);
2158
2159 list_for_each_entry(child, &ns->sub_ns, base.list) {
2160 mutex_lock_nested(&child->lock, child->level);
2161 __aa_labelset_update_subtree(child);
2162 mutex_unlock(&child->lock);
2163 }
2164}