1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * AppArmor security module
   4 *
   5 * This file contains AppArmor label definitions
   6 *
   7 * Copyright 2017 Canonical Ltd.
   8 */
   9
  10#include <linux/audit.h>
  11#include <linux/seq_file.h>
  12#include <linux/sort.h>
  13
  14#include "include/apparmor.h"
  15#include "include/cred.h"
  16#include "include/label.h"
  17#include "include/policy.h"
  18#include "include/secid.h"
  19
  20
  21/*
  22 * the aa_label represents the set of profiles confining an object
  23 *
  24 * Labels maintain a reference count to the set of pointers they reference
  25 * Labels are ref counted by
  26 *   tasks and object via the security field/security context off the field
  27 *   code - will take a ref count on a label if it needs the label
  28 *          beyond what is possible with an rcu_read_lock.
  29 *   profiles - each profile is a label
  30 *   secids - a pinned secid will keep a refcount of the label it is
  31 *          referencing
  32 *   objects - inode, files, sockets, ...
  33 *
  34 * Labels are not ref counted by the label set, so they maybe removed and
  35 * freed when no longer in use.
  36 *
  37 */
  38
  39#define PROXY_POISON 97
  40#define LABEL_POISON 100
  41
  42static void free_proxy(struct aa_proxy *proxy)
  43{
  44	if (proxy) {
  45		/* p->label will not updated any more as p is dead */
  46		aa_put_label(rcu_dereference_protected(proxy->label, true));
  47		memset(proxy, 0, sizeof(*proxy));
  48		RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
  49		kfree(proxy);
  50	}
  51}
  52
  53void aa_proxy_kref(struct kref *kref)
  54{
  55	struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
  56
  57	free_proxy(proxy);
  58}
  59
  60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
  61{
  62	struct aa_proxy *new;
  63
  64	new = kzalloc(sizeof(struct aa_proxy), gfp);
  65	if (new) {
  66		kref_init(&new->count);
  67		rcu_assign_pointer(new->label, aa_get_label(label));
  68	}
  69	return new;
  70}
  71
  72/* requires profile list write lock held */
  73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
  74{
  75	struct aa_label *tmp;
  76
  77	AA_BUG(!orig);
  78	AA_BUG(!new);
  79	lockdep_assert_held_write(&labels_set(orig)->lock);
  80
  81	tmp = rcu_dereference_protected(orig->proxy->label,
  82					&labels_ns(orig)->lock);
  83	rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
  84	orig->flags |= FLAG_STALE;
  85	aa_put_label(tmp);
  86}
  87
  88static void __proxy_share(struct aa_label *old, struct aa_label *new)
  89{
  90	struct aa_proxy *proxy = new->proxy;
  91
  92	new->proxy = aa_get_proxy(old->proxy);
  93	__aa_proxy_redirect(old, new);
  94	aa_put_proxy(proxy);
  95}
  96
  97
  98/**
  99 * ns_cmp - compare ns for label set ordering
 100 * @a: ns to compare (NOT NULL)
 101 * @b: ns to compare (NOT NULL)
 102 *
 103 * Returns: <0 if a < b
 104 *          ==0 if a == b
 105 *          >0  if a > b
 106 */
 107static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
 108{
 109	int res;
 110
 111	AA_BUG(!a);
 112	AA_BUG(!b);
 113	AA_BUG(!a->base.hname);
 114	AA_BUG(!b->base.hname);
 115
 116	if (a == b)
 117		return 0;
 118
 119	res = a->level - b->level;
 120	if (res)
 121		return res;
 122
 123	return strcmp(a->base.hname, b->base.hname);
 124}
 125
 126/**
 127 * profile_cmp - profile comparison for set ordering
 128 * @a: profile to compare (NOT NULL)
 129 * @b: profile to compare (NOT NULL)
 130 *
 131 * Returns: <0  if a < b
 132 *          ==0 if a == b
 133 *          >0  if a > b
 134 */
 135static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
 136{
 137	int res;
 138
 139	AA_BUG(!a);
 140	AA_BUG(!b);
 141	AA_BUG(!a->ns);
 142	AA_BUG(!b->ns);
 143	AA_BUG(!a->base.hname);
 144	AA_BUG(!b->base.hname);
 145
 146	if (a == b || a->base.hname == b->base.hname)
 147		return 0;
 148	res = ns_cmp(a->ns, b->ns);
 149	if (res)
 150		return res;
 151
 152	return strcmp(a->base.hname, b->base.hname);
 153}
 154
 155/**
 156 * vec_cmp - label comparison for set ordering
 157 * @a: label to compare (NOT NULL)
 158 * @vec: vector of profiles to compare (NOT NULL)
 159 * @n: length of @vec
 160 *
 161 * Returns: <0  if a < vec
 162 *          ==0 if a == vec
 163 *          >0  if a > vec
 164 */
 165static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
 166{
 167	int i;
 168
 169	AA_BUG(!a);
 170	AA_BUG(!*a);
 171	AA_BUG(!b);
 172	AA_BUG(!*b);
 173	AA_BUG(an <= 0);
 174	AA_BUG(bn <= 0);
 175
 176	for (i = 0; i < an && i < bn; i++) {
 177		int res = profile_cmp(a[i], b[i]);
 178
 179		if (res != 0)
 180			return res;
 181	}
 182
 183	return an - bn;
 184}
 185
 186static bool vec_is_stale(struct aa_profile **vec, int n)
 187{
 188	int i;
 189
 190	AA_BUG(!vec);
 191
 192	for (i = 0; i < n; i++) {
 193		if (profile_is_stale(vec[i]))
 194			return true;
 195	}
 196
 197	return false;
 198}
 199
 200static bool vec_unconfined(struct aa_profile **vec, int n)
 201{
 
 202	int i;
 203
 204	AA_BUG(!vec);
 205
 206	for (i = 0; i < n; i++) {
 207		if (!profile_unconfined(vec[i]))
 208			return false;
 
 
 209	}
 210
 211	return true;
 212}
 213
 214static int sort_cmp(const void *a, const void *b)
 215{
 216	return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
 217}
 218
 219/*
 220 * assumes vec is sorted
 221 * Assumes @vec has null terminator at vec[n], and will null terminate
 222 * vec[n - dups]
 223 */
 224static inline int unique(struct aa_profile **vec, int n)
 225{
 226	int i, pos, dups = 0;
 227
 228	AA_BUG(n < 1);
 229	AA_BUG(!vec);
 230
 231	pos = 0;
 232	for (i = 1; i < n; i++) {
 233		int res = profile_cmp(vec[pos], vec[i]);
 234
 235		AA_BUG(res > 0, "vec not sorted");
 236		if (res == 0) {
 237			/* drop duplicate */
 238			aa_put_profile(vec[i]);
 239			dups++;
 240			continue;
 241		}
 242		pos++;
 243		if (dups)
 244			vec[pos] = vec[i];
 245	}
 246
 247	AA_BUG(dups < 0);
 248
 249	return dups;
 250}
 251
 252/**
 253 * aa_vec_unique - canonical sort and unique a list of profiles
 254 * @n: number of refcounted profiles in the list (@n > 0)
 255 * @vec: list of profiles to sort and merge
 256 *
 257 * Returns: the number of duplicates eliminated == references put
 258 *
 259 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
 260 * null terminate vec[n - dups]
 261 */
 262int aa_vec_unique(struct aa_profile **vec, int n, int flags)
 263{
 264	int i, dups = 0;
 265
 266	AA_BUG(n < 1);
 267	AA_BUG(!vec);
 268
 269	/* vecs are usually small and inorder, have a fallback for larger */
 270	if (n > 8) {
 271		sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
 272		dups = unique(vec, n);
 273		goto out;
 274	}
 275
 276	/* insertion sort + unique in one */
 277	for (i = 1; i < n; i++) {
 278		struct aa_profile *tmp = vec[i];
 279		int pos, j;
 280
 281		for (pos = i - 1 - dups; pos >= 0; pos--) {
 282			int res = profile_cmp(vec[pos], tmp);
 283
 284			if (res == 0) {
 285				/* drop duplicate entry */
 286				aa_put_profile(tmp);
 287				dups++;
 288				goto continue_outer;
 289			} else if (res < 0)
 290				break;
 291		}
 292		/* pos is at entry < tmp, or index -1. Set to insert pos */
 293		pos++;
 294
 295		for (j = i - dups; j > pos; j--)
 296			vec[j] = vec[j - 1];
 297		vec[pos] = tmp;
 298continue_outer:
 299		;
 300	}
 301
 302	AA_BUG(dups < 0);
 303
 304out:
 305	if (flags & VEC_FLAG_TERMINATE)
 306		vec[n - dups] = NULL;
 307
 308	return dups;
 309}
 310
 311
 312static void label_destroy(struct aa_label *label)
 313{
 314	struct aa_label *tmp;
 315
 316	AA_BUG(!label);
 317
 318	if (!label_isprofile(label)) {
 319		struct aa_profile *profile;
 320		struct label_it i;
 321
 322		aa_put_str(label->hname);
 323
 324		label_for_each(i, label, profile) {
 325			aa_put_profile(profile);
 326			label->vec[i.i] = (struct aa_profile *)
 327					   (LABEL_POISON + (long) i.i);
 328		}
 329	}
 330
 331	if (rcu_dereference_protected(label->proxy->label, true) == label)
 332		rcu_assign_pointer(label->proxy->label, NULL);
 333
 
 
 334	aa_free_secid(label->secid);
 335
 336	tmp = rcu_dereference_protected(label->proxy->label, true);
 337	if (tmp == label)
 338		rcu_assign_pointer(label->proxy->label, NULL);
 339
 340	aa_put_proxy(label->proxy);
 341	label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
 342}
 343
 344void aa_label_free(struct aa_label *label)
 345{
 346	if (!label)
 347		return;
 348
 349	label_destroy(label);
 350	kfree(label);
 351}
 352
 353static void label_free_switch(struct aa_label *label)
 354{
 355	if (label->flags & FLAG_NS_COUNT)
 356		aa_free_ns(labels_ns(label));
 357	else if (label_isprofile(label))
 358		aa_free_profile(labels_profile(label));
 359	else
 360		aa_label_free(label);
 361}
 362
 363static void label_free_rcu(struct rcu_head *head)
 364{
 365	struct aa_label *label = container_of(head, struct aa_label, rcu);
 366
 367	if (label->flags & FLAG_IN_TREE)
 368		(void) aa_label_remove(label);
 369	label_free_switch(label);
 370}
 371
 372void aa_label_kref(struct kref *kref)
 373{
 374	struct aa_label *label = container_of(kref, struct aa_label, count);
 375	struct aa_ns *ns = labels_ns(label);
 376
 377	if (!ns) {
 378		/* never live, no rcu callback needed, just using the fn */
 379		label_free_switch(label);
 380		return;
 381	}
 382	/* TODO: update labels_profile macro so it works here */
 383	AA_BUG(label_isprofile(label) &&
 384	       on_list_rcu(&label->vec[0]->base.profiles));
 385	AA_BUG(label_isprofile(label) &&
 386	       on_list_rcu(&label->vec[0]->base.list));
 387
 388	/* TODO: if compound label and not stale add to reclaim cache */
 389	call_rcu(&label->rcu, label_free_rcu);
 390}
 391
 392static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
 393{
 394	if (label != new)
 395		/* need to free directly to break circular ref with proxy */
 396		aa_label_free(new);
 397	else
 398		aa_put_label(new);
 399}
 400
 401bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
 402{
 403	AA_BUG(!label);
 404	AA_BUG(size < 1);
 405
 406	if (aa_alloc_secid(label, gfp) < 0)
 407		return false;
 408
 409	label->size = size;			/* doesn't include null */
 410	label->vec[size] = NULL;		/* null terminate */
 411	kref_init(&label->count);
 412	RB_CLEAR_NODE(&label->node);
 413
 414	return true;
 415}
 416
 417/**
 418 * aa_label_alloc - allocate a label with a profile vector of @size length
 419 * @size: size of profile vector in the label
 420 * @proxy: proxy to use OR null if to allocate a new one
 421 * @gfp: memory allocation type
 422 *
 423 * Returns: new label
 424 *     else NULL if failed
 425 */
 426struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
 427{
 428	struct aa_label *new;
 429
 430	AA_BUG(size < 1);
 431
 432	/*  + 1 for null terminator entry on vec */
 433	new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
 434			gfp);
 435	AA_DEBUG("%s (%p)\n", __func__, new);
 436	if (!new)
 437		goto fail;
 438
 439	if (!aa_label_init(new, size, gfp))
 440		goto fail;
 441
 442	if (!proxy) {
 443		proxy = aa_alloc_proxy(new, gfp);
 444		if (!proxy)
 445			goto fail;
 446	} else
 447		aa_get_proxy(proxy);
 448	/* just set new's proxy, don't redirect proxy here if it was passed in*/
 449	new->proxy = proxy;
 450
 451	return new;
 452
 453fail:
 454	kfree(new);
 455
 456	return NULL;
 457}
 458
 459
 460/**
 461 * label_cmp - label comparison for set ordering
 462 * @a: label to compare (NOT NULL)
 463 * @b: label to compare (NOT NULL)
 464 *
 465 * Returns: <0  if a < b
 466 *          ==0 if a == b
 467 *          >0  if a > b
 468 */
 469static int label_cmp(struct aa_label *a, struct aa_label *b)
 470{
 471	AA_BUG(!b);
 472
 473	if (a == b)
 474		return 0;
 475
 476	return vec_cmp(a->vec, a->size, b->vec, b->size);
 477}
 478
 479/* helper fn for label_for_each_confined */
 480int aa_label_next_confined(struct aa_label *label, int i)
 481{
 482	AA_BUG(!label);
 483	AA_BUG(i < 0);
 484
 485	for (; i < label->size; i++) {
 486		if (!profile_unconfined(label->vec[i]))
 487			return i;
 488	}
 489
 490	return i;
 491}
 492
 493/**
 494 * aa_label_next_not_in_set - return the next profile of @sub not in @set
 495 * @I: label iterator
 496 * @set: label to test against
 497 * @sub: label to if is subset of @set
 498 *
 499 * Returns: profile in @sub that is not in @set, with iterator set pos after
 500 *     else NULL if @sub is a subset of @set
 501 */
 502struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
 503					      struct aa_label *set,
 504					      struct aa_label *sub)
 505{
 506	AA_BUG(!set);
 507	AA_BUG(!I);
 508	AA_BUG(I->i < 0);
 509	AA_BUG(I->i > set->size);
 510	AA_BUG(!sub);
 511	AA_BUG(I->j < 0);
 512	AA_BUG(I->j > sub->size);
 513
 514	while (I->j < sub->size && I->i < set->size) {
 515		int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
 516
 517		if (res == 0) {
 518			(I->j)++;
 519			(I->i)++;
 520		} else if (res > 0)
 521			(I->i)++;
 522		else
 523			return sub->vec[(I->j)++];
 524	}
 525
 526	if (I->j < sub->size)
 527		return sub->vec[(I->j)++];
 528
 529	return NULL;
 530}
 531
 532/**
 533 * aa_label_is_subset - test if @sub is a subset of @set
 534 * @set: label to test against
 535 * @sub: label to test if is subset of @set
 536 *
 537 * Returns: true if @sub is subset of @set
 538 *     else false
 539 */
 540bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
 541{
 542	struct label_it i = { };
 543
 544	AA_BUG(!set);
 545	AA_BUG(!sub);
 546
 547	if (sub == set)
 548		return true;
 549
 550	return __aa_label_next_not_in_set(&i, set, sub) == NULL;
 551}
 552
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 553
 554
 555/**
 556 * __label_remove - remove @label from the label set
 557 * @l: label to remove
 558 * @new: label to redirect to
 559 *
 560 * Requires: labels_set(@label)->lock write_lock
 561 * Returns:  true if the label was in the tree and removed
 562 */
 563static bool __label_remove(struct aa_label *label, struct aa_label *new)
 564{
 565	struct aa_labelset *ls = labels_set(label);
 566
 567	AA_BUG(!ls);
 568	AA_BUG(!label);
 569	lockdep_assert_held_write(&ls->lock);
 570
 571	if (new)
 572		__aa_proxy_redirect(label, new);
 573
 574	if (!label_is_stale(label))
 575		__label_make_stale(label);
 576
 577	if (label->flags & FLAG_IN_TREE) {
 578		rb_erase(&label->node, &ls->root);
 579		label->flags &= ~FLAG_IN_TREE;
 580		return true;
 581	}
 582
 583	return false;
 584}
 585
 586/**
 587 * __label_replace - replace @old with @new in label set
 588 * @old: label to remove from label set
 589 * @new: label to replace @old with
 590 *
 591 * Requires: labels_set(@old)->lock write_lock
 592 *           valid ref count be held on @new
 593 * Returns: true if @old was in set and replaced by @new
 594 *
 595 * Note: current implementation requires label set be order in such a way
 596 *       that @new directly replaces @old position in the set (ie.
 597 *       using pointer comparison of the label address would not work)
 598 */
 599static bool __label_replace(struct aa_label *old, struct aa_label *new)
 600{
 601	struct aa_labelset *ls = labels_set(old);
 602
 603	AA_BUG(!ls);
 604	AA_BUG(!old);
 605	AA_BUG(!new);
 606	lockdep_assert_held_write(&ls->lock);
 607	AA_BUG(new->flags & FLAG_IN_TREE);
 608
 609	if (!label_is_stale(old))
 610		__label_make_stale(old);
 611
 612	if (old->flags & FLAG_IN_TREE) {
 613		rb_replace_node(&old->node, &new->node, &ls->root);
 614		old->flags &= ~FLAG_IN_TREE;
 615		new->flags |= FLAG_IN_TREE;
 616		return true;
 617	}
 618
 619	return false;
 620}
 621
 622/**
 623 * __label_insert - attempt to insert @l into a label set
 624 * @ls: set of labels to insert @l into (NOT NULL)
 625 * @label: new label to insert (NOT NULL)
 626 * @replace: whether insertion should replace existing entry that is not stale
 627 *
 628 * Requires: @ls->lock
 629 *           caller to hold a valid ref on l
 630 *           if @replace is true l has a preallocated proxy associated
 631 * Returns: @l if successful in inserting @l - with additional refcount
 632 *          else ref counted equivalent label that is already in the set,
 633 *          the else condition only happens if @replace is false
 634 */
 635static struct aa_label *__label_insert(struct aa_labelset *ls,
 636				       struct aa_label *label, bool replace)
 637{
 638	struct rb_node **new, *parent = NULL;
 639
 640	AA_BUG(!ls);
 641	AA_BUG(!label);
 642	AA_BUG(labels_set(label) != ls);
 643	lockdep_assert_held_write(&ls->lock);
 644	AA_BUG(label->flags & FLAG_IN_TREE);
 645
 646	/* Figure out where to put new node */
 647	new = &ls->root.rb_node;
 648	while (*new) {
 649		struct aa_label *this = rb_entry(*new, struct aa_label, node);
 650		int result = label_cmp(label, this);
 651
 652		parent = *new;
 653		if (result == 0) {
 654			/* !__aa_get_label means queued for destruction,
 655			 * so replace in place, however the label has
 656			 * died before the replacement so do not share
 657			 * the proxy
 658			 */
 659			if (!replace && !label_is_stale(this)) {
 660				if (__aa_get_label(this))
 661					return this;
 662			} else
 663				__proxy_share(this, label);
 664			AA_BUG(!__label_replace(this, label));
 665			return aa_get_label(label);
 666		} else if (result < 0)
 667			new = &((*new)->rb_left);
 668		else /* (result > 0) */
 669			new = &((*new)->rb_right);
 670	}
 671
 672	/* Add new node and rebalance tree. */
 673	rb_link_node(&label->node, parent, new);
 674	rb_insert_color(&label->node, &ls->root);
 675	label->flags |= FLAG_IN_TREE;
 676
 677	return aa_get_label(label);
 678}
 679
 680/**
 681 * __vec_find - find label that matches @vec in label set
 682 * @vec: vec of profiles to find matching label for (NOT NULL)
 683 * @n: length of @vec
 684 *
 685 * Requires: @vec_labelset(vec) lock held
 686 *           caller to hold a valid ref on l
 687 *
 688 * Returns: ref counted @label if matching label is in tree
 689 *          ref counted label that is equiv to @l in tree
 690 *     else NULL if @vec equiv is not in tree
 691 */
 692static struct aa_label *__vec_find(struct aa_profile **vec, int n)
 693{
 694	struct rb_node *node;
 695
 696	AA_BUG(!vec);
 697	AA_BUG(!*vec);
 698	AA_BUG(n <= 0);
 699
 700	node = vec_labelset(vec, n)->root.rb_node;
 701	while (node) {
 702		struct aa_label *this = rb_entry(node, struct aa_label, node);
 703		int result = vec_cmp(this->vec, this->size, vec, n);
 704
 705		if (result > 0)
 706			node = node->rb_left;
 707		else if (result < 0)
 708			node = node->rb_right;
 709		else
 710			return __aa_get_label(this);
 711	}
 712
 713	return NULL;
 714}
 715
 716/**
 717 * __label_find - find label @label in label set
 718 * @label: label to find (NOT NULL)
 719 *
 720 * Requires: labels_set(@label)->lock held
 721 *           caller to hold a valid ref on l
 722 *
 723 * Returns: ref counted @label if @label is in tree OR
 724 *          ref counted label that is equiv to @label in tree
 725 *     else NULL if @label or equiv is not in tree
 726 */
 727static struct aa_label *__label_find(struct aa_label *label)
 728{
 729	AA_BUG(!label);
 730
 731	return __vec_find(label->vec, label->size);
 732}
 733
 734
 735/**
 736 * aa_label_remove - remove a label from the labelset
 737 * @label: label to remove
 738 *
 739 * Returns: true if @label was removed from the tree
 740 *     else @label was not in tree so it could not be removed
 741 */
 742bool aa_label_remove(struct aa_label *label)
 743{
 744	struct aa_labelset *ls = labels_set(label);
 745	unsigned long flags;
 746	bool res;
 747
 748	AA_BUG(!ls);
 749
 750	write_lock_irqsave(&ls->lock, flags);
 751	res = __label_remove(label, ns_unconfined(labels_ns(label)));
 752	write_unlock_irqrestore(&ls->lock, flags);
 753
 754	return res;
 755}
 756
 757/**
 758 * aa_label_replace - replace a label @old with a new version @new
 759 * @old: label to replace
 760 * @new: label replacing @old
 761 *
 762 * Returns: true if @old was in tree and replaced
 763 *     else @old was not in tree, and @new was not inserted
 764 */
 765bool aa_label_replace(struct aa_label *old, struct aa_label *new)
 766{
 767	unsigned long flags;
 768	bool res;
 769
 770	if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
 771		write_lock_irqsave(&labels_set(old)->lock, flags);
 772		if (old->proxy != new->proxy)
 773			__proxy_share(old, new);
 774		else
 775			__aa_proxy_redirect(old, new);
 776		res = __label_replace(old, new);
 777		write_unlock_irqrestore(&labels_set(old)->lock, flags);
 778	} else {
 779		struct aa_label *l;
 780		struct aa_labelset *ls = labels_set(old);
 781
 782		write_lock_irqsave(&ls->lock, flags);
 783		res = __label_remove(old, new);
 784		if (labels_ns(old) != labels_ns(new)) {
 785			write_unlock_irqrestore(&ls->lock, flags);
 786			ls = labels_set(new);
 787			write_lock_irqsave(&ls->lock, flags);
 788		}
 789		l = __label_insert(ls, new, true);
 790		res = (l == new);
 791		write_unlock_irqrestore(&ls->lock, flags);
 792		aa_put_label(l);
 793	}
 794
 795	return res;
 796}
 797
 798/**
 799 * vec_find - find label @l in label set
 800 * @vec: array of profiles to find equiv label for (NOT NULL)
 801 * @n: length of @vec
 802 *
 803 * Returns: refcounted label if @vec equiv is in tree
 804 *     else NULL if @vec equiv is not in tree
 805 */
 806static struct aa_label *vec_find(struct aa_profile **vec, int n)
 807{
 808	struct aa_labelset *ls;
 809	struct aa_label *label;
 810	unsigned long flags;
 811
 812	AA_BUG(!vec);
 813	AA_BUG(!*vec);
 814	AA_BUG(n <= 0);
 815
 816	ls = vec_labelset(vec, n);
 817	read_lock_irqsave(&ls->lock, flags);
 818	label = __vec_find(vec, n);
 819	read_unlock_irqrestore(&ls->lock, flags);
 820
 821	return label;
 822}
 823
 824/* requires sort and merge done first */
 825static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
 826						    int len, gfp_t gfp)
 827{
 828	struct aa_label *label = NULL;
 829	struct aa_labelset *ls;
 830	unsigned long flags;
 831	struct aa_label *new;
 832	int i;
 833
 834	AA_BUG(!vec);
 835
 836	if (len == 1)
 837		return aa_get_label(&vec[0]->label);
 838
 839	ls = labels_set(&vec[len - 1]->label);
 840
 841	/* TODO: enable when read side is lockless
 842	 * check if label exists before taking locks
 843	 */
 844	new = aa_label_alloc(len, NULL, gfp);
 845	if (!new)
 846		return NULL;
 847
 848	for (i = 0; i < len; i++)
 849		new->vec[i] = aa_get_profile(vec[i]);
 850
 851	write_lock_irqsave(&ls->lock, flags);
 852	label = __label_insert(ls, new, false);
 853	write_unlock_irqrestore(&ls->lock, flags);
 854	label_free_or_put_new(label, new);
 855
 856	return label;
 857}
 858
 859struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
 860					     gfp_t gfp)
 861{
 862	struct aa_label *label = vec_find(vec, len);
 863
 864	if (label)
 865		return label;
 866
 867	return vec_create_and_insert_label(vec, len, gfp);
 868}
 869
 870/**
 871 * aa_label_find - find label @label in label set
 872 * @label: label to find (NOT NULL)
 873 *
 874 * Requires: caller to hold a valid ref on l
 875 *
 876 * Returns: refcounted @label if @label is in tree
 877 *          refcounted label that is equiv to @label in tree
 878 *     else NULL if @label or equiv is not in tree
 879 */
 880struct aa_label *aa_label_find(struct aa_label *label)
 881{
 882	AA_BUG(!label);
 883
 884	return vec_find(label->vec, label->size);
 885}
 886
 887
 888/**
 889 * aa_label_insert - insert label @label into @ls or return existing label
 890 * @ls - labelset to insert @label into
 891 * @label - label to insert
 892 *
 893 * Requires: caller to hold a valid ref on @label
 894 *
 895 * Returns: ref counted @label if successful in inserting @label
 896 *     else ref counted equivalent label that is already in the set
 897 */
 898struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
 899{
 900	struct aa_label *l;
 901	unsigned long flags;
 902
 903	AA_BUG(!ls);
 904	AA_BUG(!label);
 905
 906	/* check if label exists before taking lock */
 907	if (!label_is_stale(label)) {
 908		read_lock_irqsave(&ls->lock, flags);
 909		l = __label_find(label);
 910		read_unlock_irqrestore(&ls->lock, flags);
 911		if (l)
 912			return l;
 913	}
 914
 915	write_lock_irqsave(&ls->lock, flags);
 916	l = __label_insert(ls, label, false);
 917	write_unlock_irqrestore(&ls->lock, flags);
 918
 919	return l;
 920}
 921
 922
 923/**
 924 * aa_label_next_in_merge - find the next profile when merging @a and @b
 925 * @I: label iterator
 926 * @a: label to merge
 927 * @b: label to merge
 928 *
 929 * Returns: next profile
 930 *     else null if no more profiles
 931 */
 932struct aa_profile *aa_label_next_in_merge(struct label_it *I,
 933					  struct aa_label *a,
 934					  struct aa_label *b)
 935{
 936	AA_BUG(!a);
 937	AA_BUG(!b);
 938	AA_BUG(!I);
 939	AA_BUG(I->i < 0);
 940	AA_BUG(I->i > a->size);
 941	AA_BUG(I->j < 0);
 942	AA_BUG(I->j > b->size);
 943
 944	if (I->i < a->size) {
 945		if (I->j < b->size) {
 946			int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
 947
 948			if (res > 0)
 949				return b->vec[(I->j)++];
 950			if (res == 0)
 951				(I->j)++;
 952		}
 953
 954		return a->vec[(I->i)++];
 955	}
 956
 957	if (I->j < b->size)
 958		return b->vec[(I->j)++];
 959
 960	return NULL;
 961}
 962
 963/**
 964 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
 965 * @a: label to merge then compare (NOT NULL)
 966 * @b: label to merge then compare (NOT NULL)
 967 * @z: label to compare merge against (NOT NULL)
 968 *
 969 * Assumes: using the most recent versions of @a, @b, and @z
 970 *
 971 * Returns: <0  if a < b
 972 *          ==0 if a == b
 973 *          >0  if a > b
 974 */
 975static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
 976			   struct aa_label *z)
 977{
 978	struct aa_profile *p = NULL;
 979	struct label_it i = { };
 980	int k;
 981
 982	AA_BUG(!a);
 983	AA_BUG(!b);
 984	AA_BUG(!z);
 985
 986	for (k = 0;
 987	     k < z->size && (p = aa_label_next_in_merge(&i, a, b));
 988	     k++) {
 989		int res = profile_cmp(p, z->vec[k]);
 990
 991		if (res != 0)
 992			return res;
 993	}
 994
 995	if (p)
 996		return 1;
 997	else if (k < z->size)
 998		return -1;
 999	return 0;
1000}
1001
1002/**
1003 * label_merge_insert - create a new label by merging @a and @b
1004 * @new: preallocated label to merge into (NOT NULL)
1005 * @a: label to merge with @b  (NOT NULL)
1006 * @b: label to merge with @a  (NOT NULL)
1007 *
1008 * Requires: preallocated proxy
1009 *
1010 * Returns: ref counted label either @new if merge is unique
1011 *          @a if @b is a subset of @a
1012 *          @b if @a is a subset of @b
1013 *
1014 * NOTE: will not use @new if the merge results in @new == @a or @b
1015 *
1016 *       Must be used within labelset write lock to avoid racing with
1017 *       setting labels stale.
1018 */
1019static struct aa_label *label_merge_insert(struct aa_label *new,
1020					   struct aa_label *a,
1021					   struct aa_label *b)
1022{
1023	struct aa_label *label;
1024	struct aa_labelset *ls;
1025	struct aa_profile *next;
1026	struct label_it i;
1027	unsigned long flags;
1028	int k = 0, invcount = 0;
1029	bool stale = false;
1030
1031	AA_BUG(!a);
1032	AA_BUG(a->size < 0);
1033	AA_BUG(!b);
1034	AA_BUG(b->size < 0);
1035	AA_BUG(!new);
1036	AA_BUG(new->size < a->size + b->size);
1037
1038	label_for_each_in_merge(i, a, b, next) {
1039		AA_BUG(!next);
1040		if (profile_is_stale(next)) {
1041			new->vec[k] = aa_get_newest_profile(next);
1042			AA_BUG(!new->vec[k]->label.proxy);
1043			AA_BUG(!new->vec[k]->label.proxy->label);
1044			if (next->label.proxy != new->vec[k]->label.proxy)
1045				invcount++;
1046			k++;
1047			stale = true;
1048		} else
1049			new->vec[k++] = aa_get_profile(next);
1050	}
1051	/* set to actual size which is <= allocated len */
1052	new->size = k;
1053	new->vec[k] = NULL;
1054
1055	if (invcount) {
1056		new->size -= aa_vec_unique(&new->vec[0], new->size,
1057					   VEC_FLAG_TERMINATE);
1058		/* TODO: deal with reference labels */
1059		if (new->size == 1) {
1060			label = aa_get_label(&new->vec[0]->label);
1061			return label;
1062		}
1063	} else if (!stale) {
1064		/*
1065		 * merge could be same as a || b, note: it is not possible
1066		 * for new->size == a->size == b->size unless a == b
1067		 */
1068		if (k == a->size)
1069			return aa_get_label(a);
1070		else if (k == b->size)
1071			return aa_get_label(b);
1072	}
1073	if (vec_unconfined(new->vec, new->size))
1074		new->flags |= FLAG_UNCONFINED;
1075	ls = labels_set(new);
1076	write_lock_irqsave(&ls->lock, flags);
1077	label = __label_insert(labels_set(new), new, false);
1078	write_unlock_irqrestore(&ls->lock, flags);
1079
1080	return label;
1081}
1082
1083/**
1084 * labelset_of_merge - find which labelset a merged label should be inserted
1085 * @a: label to merge and insert
1086 * @b: label to merge and insert
1087 *
1088 * Returns: labelset that the merged label should be inserted into
1089 */
1090static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1091					     struct aa_label *b)
1092{
1093	struct aa_ns *nsa = labels_ns(a);
1094	struct aa_ns *nsb = labels_ns(b);
1095
1096	if (ns_cmp(nsa, nsb) <= 0)
1097		return &nsa->labels;
1098	return &nsb->labels;
1099}
1100
1101/**
1102 * __label_find_merge - find label that is equiv to merge of @a and @b
1103 * @ls: set of labels to search (NOT NULL)
1104 * @a: label to merge with @b  (NOT NULL)
1105 * @b: label to merge with @a  (NOT NULL)
1106 *
1107 * Requires: ls->lock read_lock held
1108 *
1109 * Returns: ref counted label that is equiv to merge of @a and @b
1110 *     else NULL if merge of @a and @b is not in set
1111 */
1112static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1113					   struct aa_label *a,
1114					   struct aa_label *b)
1115{
1116	struct rb_node *node;
1117
1118	AA_BUG(!ls);
1119	AA_BUG(!a);
1120	AA_BUG(!b);
1121
1122	if (a == b)
1123		return __label_find(a);
1124
1125	node  = ls->root.rb_node;
1126	while (node) {
1127		struct aa_label *this = container_of(node, struct aa_label,
1128						     node);
1129		int result = label_merge_cmp(a, b, this);
1130
1131		if (result < 0)
1132			node = node->rb_left;
1133		else if (result > 0)
1134			node = node->rb_right;
1135		else
1136			return __aa_get_label(this);
1137	}
1138
1139	return NULL;
1140}
1141
1142
1143/**
1144 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1145 * @a: label to merge with @b  (NOT NULL)
1146 * @b: label to merge with @a  (NOT NULL)
1147 *
1148 * Requires: labels be fully constructed with a valid ns
1149 *
1150 * Returns: ref counted label that is equiv to merge of @a and @b
1151 *     else NULL if merge of @a and @b is not in set
1152 */
1153struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1154{
1155	struct aa_labelset *ls;
1156	struct aa_label *label, *ar = NULL, *br = NULL;
1157	unsigned long flags;
1158
1159	AA_BUG(!a);
1160	AA_BUG(!b);
1161
1162	if (label_is_stale(a))
1163		a = ar = aa_get_newest_label(a);
1164	if (label_is_stale(b))
1165		b = br = aa_get_newest_label(b);
1166	ls = labelset_of_merge(a, b);
1167	read_lock_irqsave(&ls->lock, flags);
1168	label = __label_find_merge(ls, a, b);
1169	read_unlock_irqrestore(&ls->lock, flags);
1170	aa_put_label(ar);
1171	aa_put_label(br);
1172
1173	return label;
1174}
1175
1176/**
1177 * aa_label_merge - attempt to insert new merged label of @a and @b
1178 * @ls: set of labels to insert label into (NOT NULL)
1179 * @a: label to merge with @b  (NOT NULL)
1180 * @b: label to merge with @a  (NOT NULL)
1181 * @gfp: memory allocation type
1182 *
1183 * Requires: caller to hold valid refs on @a and @b
1184 *           labels be fully constructed with a valid ns
1185 *
1186 * Returns: ref counted new label if successful in inserting merge of a & b
1187 *     else ref counted equivalent label that is already in the set.
1188 *     else NULL if could not create label (-ENOMEM)
1189 */
1190struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1191				gfp_t gfp)
1192{
1193	struct aa_label *label = NULL;
1194
1195	AA_BUG(!a);
1196	AA_BUG(!b);
1197
1198	if (a == b)
1199		return aa_get_newest_label(a);
1200
1201	/* TODO: enable when read side is lockless
1202	 * check if label exists before taking locks
1203	if (!label_is_stale(a) && !label_is_stale(b))
1204		label = aa_label_find_merge(a, b);
1205	*/
1206
1207	if (!label) {
1208		struct aa_label *new;
1209
1210		a = aa_get_newest_label(a);
1211		b = aa_get_newest_label(b);
1212
1213		/* could use label_merge_len(a, b), but requires double
1214		 * comparison for small savings
1215		 */
1216		new = aa_label_alloc(a->size + b->size, NULL, gfp);
1217		if (!new)
1218			goto out;
1219
1220		label = label_merge_insert(new, a, b);
1221		label_free_or_put_new(label, new);
1222out:
1223		aa_put_label(a);
1224		aa_put_label(b);
1225	}
1226
1227	return label;
1228}
1229
1230static inline bool label_is_visible(struct aa_profile *profile,
1231				    struct aa_label *label)
1232{
1233	return aa_ns_visible(profile->ns, labels_ns(label), true);
1234}
1235
1236/* match a profile and its associated ns component if needed
1237 * Assumes visibility test has already been done.
1238 * If a subns profile is not to be matched should be prescreened with
1239 * visibility test.
1240 */
1241static inline unsigned int match_component(struct aa_profile *profile,
1242					   struct aa_profile *tp,
1243					   unsigned int state)
 
1244{
1245	const char *ns_name;
1246
1247	if (profile->ns == tp->ns)
1248		return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1249
1250	/* try matching with namespace name and then profile */
1251	ns_name = aa_ns_name(profile->ns, tp->ns, true);
1252	state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1253	state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1254	state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1255	return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1256}
1257
1258/**
1259 * label_compound_match - find perms for full compound label
1260 * @profile: profile to find perms for
1261 * @label: label to check access permissions for
1262 * @start: state to start match in
1263 * @subns: whether to do permission checks on components in a subns
1264 * @request: permissions to request
1265 * @perms: perms struct to set
1266 *
1267 * Returns: 0 on success else ERROR
1268 *
1269 * For the label A//&B//&C this does the perm match for A//&B//&C
1270 * @perms should be preinitialized with allperms OR a previous permission
1271 *        check to be stacked.
1272 */
1273static int label_compound_match(struct aa_profile *profile,
 
1274				struct aa_label *label,
1275				unsigned int state, bool subns, u32 request,
1276				struct aa_perms *perms)
1277{
1278	struct aa_profile *tp;
1279	struct label_it i;
1280
1281	/* find first subcomponent that is visible */
1282	label_for_each(i, label, tp) {
1283		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1284			continue;
1285		state = match_component(profile, tp, state);
1286		if (!state)
1287			goto fail;
1288		goto next;
1289	}
1290
1291	/* no component visible */
1292	*perms = allperms;
1293	return 0;
1294
1295next:
1296	label_for_each_cont(i, label, tp) {
1297		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1298			continue;
1299		state = aa_dfa_match(profile->policy.dfa, state, "//&");
1300		state = match_component(profile, tp, state);
1301		if (!state)
1302			goto fail;
1303	}
1304	aa_compute_perms(profile->policy.dfa, state, perms);
1305	aa_apply_modes_to_perms(profile, perms);
1306	if ((perms->allow & request) != request)
1307		return -EACCES;
1308
1309	return 0;
1310
1311fail:
1312	*perms = nullperms;
1313	return state;
1314}
1315
1316/**
1317 * label_components_match - find perms for all subcomponents of a label
1318 * @profile: profile to find perms for
 
1319 * @label: label to check access permissions for
1320 * @start: state to start match in
1321 * @subns: whether to do permission checks on components in a subns
1322 * @request: permissions to request
1323 * @perms: an initialized perms struct to add accumulation to
1324 *
1325 * Returns: 0 on success else ERROR
1326 *
1327 * For the label A//&B//&C this does the perm match for each of A and B and C
1328 * @perms should be preinitialized with allperms OR a previous permission
1329 *        check to be stacked.
1330 */
1331static int label_components_match(struct aa_profile *profile,
1332				  struct aa_label *label, unsigned int start,
 
1333				  bool subns, u32 request,
1334				  struct aa_perms *perms)
1335{
1336	struct aa_profile *tp;
1337	struct label_it i;
1338	struct aa_perms tmp;
1339	unsigned int state = 0;
1340
1341	/* find first subcomponent to test */
1342	label_for_each(i, label, tp) {
1343		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1344			continue;
1345		state = match_component(profile, tp, start);
1346		if (!state)
1347			goto fail;
1348		goto next;
1349	}
1350
1351	/* no subcomponents visible - no change in perms */
1352	return 0;
1353
1354next:
1355	aa_compute_perms(profile->policy.dfa, state, &tmp);
1356	aa_apply_modes_to_perms(profile, &tmp);
1357	aa_perms_accum(perms, &tmp);
1358	label_for_each_cont(i, label, tp) {
1359		if (!aa_ns_visible(profile->ns, tp->ns, subns))
1360			continue;
1361		state = match_component(profile, tp, start);
1362		if (!state)
1363			goto fail;
1364		aa_compute_perms(profile->policy.dfa, state, &tmp);
1365		aa_apply_modes_to_perms(profile, &tmp);
1366		aa_perms_accum(perms, &tmp);
1367	}
1368
1369	if ((perms->allow & request) != request)
1370		return -EACCES;
1371
1372	return 0;
1373
1374fail:
1375	*perms = nullperms;
1376	return -EACCES;
1377}
1378
1379/**
1380 * aa_label_match - do a multi-component label match
1381 * @profile: profile to match against (NOT NULL)
 
1382 * @label: label to match (NOT NULL)
1383 * @state: state to start in
1384 * @subns: whether to match subns components
1385 * @request: permission request
1386 * @perms: Returns computed perms (NOT NULL)
1387 *
1388 * Returns: the state the match finished in, may be the none matching state
1389 */
1390int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1391		   unsigned int state, bool subns, u32 request,
1392		   struct aa_perms *perms)
1393{
1394	int error = label_compound_match(profile, label, state, subns, request,
1395					 perms);
1396	if (!error)
1397		return error;
1398
1399	*perms = allperms;
1400	return label_components_match(profile, label, state, subns, request,
1401				      perms);
1402}
1403
1404
1405/**
1406 * aa_update_label_name - update a label to have a stored name
1407 * @ns: ns being viewed from (NOT NULL)
1408 * @label: label to update (NOT NULL)
1409 * @gfp: type of memory allocation
1410 *
1411 * Requires: labels_set(label) not locked in caller
1412 *
1413 * note: only updates the label name if it does not have a name already
1414 *       and if it is in the labelset
1415 */
1416bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1417{
1418	struct aa_labelset *ls;
1419	unsigned long flags;
1420	char __counted *name;
1421	bool res = false;
1422
1423	AA_BUG(!ns);
1424	AA_BUG(!label);
1425
1426	if (label->hname || labels_ns(label) != ns)
1427		return res;
1428
1429	if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1430		return res;
1431
1432	ls = labels_set(label);
1433	write_lock_irqsave(&ls->lock, flags);
1434	if (!label->hname && label->flags & FLAG_IN_TREE) {
1435		label->hname = name;
1436		res = true;
1437	} else
1438		aa_put_str(name);
1439	write_unlock_irqrestore(&ls->lock, flags);
1440
1441	return res;
1442}
1443
1444/*
1445 * cached label name is present and visible
1446 * @label->hname only exists if label is namespace hierachical
1447 */
1448static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1449				   int flags)
1450{
1451	if (label->hname && (!ns || labels_ns(label) == ns) &&
1452	    !(flags & ~FLAG_SHOW_MODE))
1453		return true;
1454
1455	return false;
1456}
1457
1458/* helper macro for snprint routines */
1459#define update_for_len(total, len, size, str)	\
1460do {					\
 
 
1461	AA_BUG(len < 0);		\
1462	total += len;			\
1463	len = min(len, size);		\
1464	size -= len;			\
1465	str += len;			\
1466} while (0)
1467
1468/**
1469 * aa_profile_snxprint - print a profile name to a buffer
1470 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1471 * @size: size of buffer
1472 * @view: namespace profile is being viewed from
1473 * @profile: profile to view (NOT NULL)
1474 * @flags: whether to include the mode string
1475 * @prev_ns: last ns printed when used in compound print
1476 *
1477 * Returns: size of name written or would be written if larger than
1478 *          available buffer
1479 *
1480 * Note: will not print anything if the profile is not visible
1481 */
1482static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1483			       struct aa_profile *profile, int flags,
1484			       struct aa_ns **prev_ns)
1485{
1486	const char *ns_name = NULL;
1487
1488	AA_BUG(!str && size != 0);
1489	AA_BUG(!profile);
1490
1491	if (!view)
1492		view = profiles_ns(profile);
1493
1494	if (view != profile->ns &&
1495	    (!prev_ns || (*prev_ns != profile->ns))) {
1496		if (prev_ns)
1497			*prev_ns = profile->ns;
1498		ns_name = aa_ns_name(view, profile->ns,
1499				     flags & FLAG_VIEW_SUBNS);
1500		if (ns_name == aa_hidden_ns_name) {
1501			if (flags & FLAG_HIDDEN_UNCONFINED)
1502				return snprintf(str, size, "%s", "unconfined");
1503			return snprintf(str, size, "%s", ns_name);
1504		}
1505	}
1506
1507	if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1508		const char *modestr = aa_profile_mode_names[profile->mode];
1509
1510		if (ns_name)
1511			return snprintf(str, size, ":%s:%s (%s)", ns_name,
1512					profile->base.hname, modestr);
1513		return snprintf(str, size, "%s (%s)", profile->base.hname,
1514				modestr);
1515	}
1516
1517	if (ns_name)
1518		return snprintf(str, size, ":%s:%s", ns_name,
1519				profile->base.hname);
1520	return snprintf(str, size, "%s", profile->base.hname);
1521}
1522
1523static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1524				  int flags)
1525{
1526	struct aa_profile *profile;
1527	struct label_it i;
1528	int mode = -1, count = 0;
1529
1530	label_for_each(i, label, profile) {
1531		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1532			if (profile->mode == APPARMOR_UNCONFINED)
 
1533				/* special case unconfined so stacks with
1534				 * unconfined don't report as mixed. ie.
1535				 * profile_foo//&:ns1:unconfined (mixed)
1536				 */
1537				continue;
1538			count++;
1539			if (mode == -1)
1540				mode = profile->mode;
1541			else if (mode != profile->mode)
1542				return "mixed";
1543		}
1544	}
1545
1546	if (count == 0)
1547		return "-";
1548	if (mode == -1)
1549		/* everything was unconfined */
1550		mode = APPARMOR_UNCONFINED;
1551
1552	return aa_profile_mode_names[mode];
1553}
1554
1555/* if any visible label is not unconfined the display_mode returns true */
1556static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1557				int flags)
1558{
1559	if ((flags & FLAG_SHOW_MODE)) {
1560		struct aa_profile *profile;
1561		struct label_it i;
1562
1563		label_for_each(i, label, profile) {
1564			if (aa_ns_visible(ns, profile->ns,
1565					  flags & FLAG_VIEW_SUBNS) &&
1566			    profile != profile->ns->unconfined)
1567				return true;
1568		}
1569		/* only ns->unconfined in set of profiles in ns */
1570		return false;
1571	}
1572
1573	return false;
1574}
1575
1576/**
1577 * aa_label_snxprint - print a label name to a string buffer
1578 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1579 * @size: size of buffer
1580 * @ns: namespace profile is being viewed from
1581 * @label: label to view (NOT NULL)
1582 * @flags: whether to include the mode string
1583 *
1584 * Returns: size of name written or would be written if larger than
1585 *          available buffer
1586 *
1587 * Note: labels do not have to be strictly hierarchical to the ns as
1588 *       objects may be shared across different namespaces and thus
1589 *       pickup labeling from each ns.  If a particular part of the
1590 *       label is not visible it will just be excluded.  And if none
1591 *       of the label is visible "---" will be used.
1592 */
1593int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1594		      struct aa_label *label, int flags)
1595{
1596	struct aa_profile *profile;
1597	struct aa_ns *prev_ns = NULL;
1598	struct label_it i;
1599	int count = 0, total = 0;
1600	size_t len;
1601
1602	AA_BUG(!str && size != 0);
1603	AA_BUG(!label);
1604
1605	if (flags & FLAG_ABS_ROOT) {
1606		ns = root_ns;
1607		len = snprintf(str, size, "=");
1608		update_for_len(total, len, size, str);
1609	} else if (!ns) {
1610		ns = labels_ns(label);
1611	}
1612
1613	label_for_each(i, label, profile) {
1614		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1615			if (count > 0) {
1616				len = snprintf(str, size, "//&");
1617				update_for_len(total, len, size, str);
1618			}
1619			len = aa_profile_snxprint(str, size, ns, profile,
1620						  flags & FLAG_VIEW_SUBNS,
1621						  &prev_ns);
1622			update_for_len(total, len, size, str);
1623			count++;
1624		}
1625	}
1626
1627	if (count == 0) {
1628		if (flags & FLAG_HIDDEN_UNCONFINED)
1629			return snprintf(str, size, "%s", "unconfined");
1630		return snprintf(str, size, "%s", aa_hidden_ns_name);
1631	}
1632
1633	/* count == 1 && ... is for backwards compat where the mode
1634	 * is not displayed for 'unconfined' in the current ns
1635	 */
1636	if (display_mode(ns, label, flags)) {
1637		len = snprintf(str, size, " (%s)",
1638			       label_modename(ns, label, flags));
1639		update_for_len(total, len, size, str);
1640	}
1641
1642	return total;
1643}
1644#undef update_for_len
1645
1646/**
1647 * aa_label_asxprint - allocate a string buffer and print label into it
1648 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1649 * @ns: namespace profile is being viewed from
1650 * @label: label to view (NOT NULL)
1651 * @flags: flags controlling what label info is printed
1652 * @gfp: kernel memory allocation type
1653 *
1654 * Returns: size of name written or would be written if larger than
1655 *          available buffer
1656 */
1657int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1658		      int flags, gfp_t gfp)
1659{
1660	int size;
1661
1662	AA_BUG(!strp);
1663	AA_BUG(!label);
1664
1665	size = aa_label_snxprint(NULL, 0, ns, label, flags);
1666	if (size < 0)
1667		return size;
1668
1669	*strp = kmalloc(size + 1, gfp);
1670	if (!*strp)
1671		return -ENOMEM;
1672	return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1673}
1674
1675/**
1676 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1677 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1678 * @ns: namespace profile is being viewed from
1679 * @label: label to view (NOT NULL)
1680 * @flags: flags controlling what label info is printed
1681 * @gfp: kernel memory allocation type
1682 *
1683 * Returns: size of name written or would be written if larger than
1684 *          available buffer
1685 */
1686int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1687			 struct aa_label *label, int flags, gfp_t gfp)
1688{
1689	int size;
1690
1691	AA_BUG(!strp);
1692	AA_BUG(!label);
1693
1694	size = aa_label_snxprint(NULL, 0, ns, label, flags);
1695	if (size < 0)
1696		return size;
1697
1698	*strp = aa_str_alloc(size + 1, gfp);
1699	if (!*strp)
1700		return -ENOMEM;
1701	return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1702}
1703
1704
1705void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1706		     struct aa_label *label, int flags, gfp_t gfp)
1707{
1708	const char *str;
1709	char *name = NULL;
1710	int len;
1711
1712	AA_BUG(!ab);
1713	AA_BUG(!label);
1714
1715	if (!use_label_hname(ns, label, flags) ||
1716	    display_mode(ns, label, flags)) {
1717		len  = aa_label_asxprint(&name, ns, label, flags, gfp);
1718		if (len == -1) {
1719			AA_DEBUG("label print error");
1720			return;
1721		}
1722		str = name;
1723	} else {
1724		str = (char *) label->hname;
1725		len = strlen(str);
1726	}
1727	if (audit_string_contains_control(str, len))
1728		audit_log_n_hex(ab, str, len);
1729	else
1730		audit_log_n_string(ab, str, len);
1731
1732	kfree(name);
1733}
1734
1735void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1736			 struct aa_label *label, int flags, gfp_t gfp)
1737{
1738	AA_BUG(!f);
1739	AA_BUG(!label);
1740
1741	if (!use_label_hname(ns, label, flags)) {
1742		char *str;
1743		int len;
1744
1745		len = aa_label_asxprint(&str, ns, label, flags, gfp);
1746		if (len == -1) {
1747			AA_DEBUG("label print error");
1748			return;
1749		}
1750		seq_printf(f, "%s", str);
1751		kfree(str);
1752	} else if (display_mode(ns, label, flags))
1753		seq_printf(f, "%s (%s)", label->hname,
1754			   label_modename(ns, label, flags));
1755	else
1756		seq_printf(f, "%s", label->hname);
1757}
1758
1759void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1760		      gfp_t gfp)
1761{
1762	AA_BUG(!label);
1763
1764	if (!use_label_hname(ns, label, flags)) {
1765		char *str;
1766		int len;
1767
1768		len = aa_label_asxprint(&str, ns, label, flags, gfp);
1769		if (len == -1) {
1770			AA_DEBUG("label print error");
1771			return;
1772		}
1773		pr_info("%s", str);
1774		kfree(str);
1775	} else if (display_mode(ns, label, flags))
1776		pr_info("%s (%s)", label->hname,
1777		       label_modename(ns, label, flags));
1778	else
1779		pr_info("%s", label->hname);
1780}
1781
1782void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1783{
1784	struct aa_ns *ns = aa_get_current_ns();
1785
1786	aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1787	aa_put_ns(ns);
1788}
1789
1790void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1791{
1792	struct aa_ns *ns = aa_get_current_ns();
1793
1794	aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1795	aa_put_ns(ns);
1796}
1797
1798void aa_label_printk(struct aa_label *label, gfp_t gfp)
1799{
1800	struct aa_ns *ns = aa_get_current_ns();
1801
1802	aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1803	aa_put_ns(ns);
1804}
1805
1806static int label_count_strn_entries(const char *str, size_t n)
1807{
1808	const char *end = str + n;
1809	const char *split;
1810	int count = 1;
1811
1812	AA_BUG(!str);
1813
1814	for (split = aa_label_strn_split(str, end - str);
1815	     split;
1816	     split = aa_label_strn_split(str, end - str)) {
1817		count++;
1818		str = split + 3;
1819	}
1820
1821	return count;
1822}
1823
1824/*
1825 * ensure stacks with components like
1826 *   :ns:A//&B
1827 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1828 * to the base if the lookup specifies an ns, else making the stacked lookup
1829 * relative to the last embedded ns in the string.
1830 */
1831static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1832					    struct aa_label *currentbase,
1833					    const char *str, size_t n)
1834{
1835	const char *first = skipn_spaces(str, n);
1836
1837	if (first && *first == ':')
1838		return aa_fqlookupn_profile(base, str, n);
1839
1840	return aa_fqlookupn_profile(currentbase, str, n);
1841}
1842
1843/**
1844 * aa_label_strn_parse - parse, validate and convert a text string to a label
1845 * @base: base label to use for lookups (NOT NULL)
1846 * @str: null terminated text string (NOT NULL)
1847 * @n: length of str to parse, will stop at \0 if encountered before n
1848 * @gfp: allocation type
1849 * @create: true if should create compound labels if they don't exist
1850 * @force_stack: true if should stack even if no leading &
1851 *
1852 * Returns: the matching refcounted label if present
1853 *     else ERRPTR
1854 */
1855struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1856				     size_t n, gfp_t gfp, bool create,
1857				     bool force_stack)
1858{
1859	DEFINE_VEC(profile, vec);
1860	struct aa_label *label, *currbase = base;
1861	int i, len, stack = 0, error;
1862	const char *end = str + n;
1863	const char *split;
1864
1865	AA_BUG(!base);
1866	AA_BUG(!str);
1867
1868	str = skipn_spaces(str, n);
1869	if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
 
1870		return ERR_PTR(-EINVAL);
1871
1872	len = label_count_strn_entries(str, end - str);
1873	if (*str == '&' || force_stack) {
1874		/* stack on top of base */
1875		stack = base->size;
1876		len += stack;
1877		if (*str == '&')
1878			str++;
1879	}
1880
1881	error = vec_setup(profile, vec, len, gfp);
1882	if (error)
1883		return ERR_PTR(error);
1884
1885	for (i = 0; i < stack; i++)
1886		vec[i] = aa_get_profile(base->vec[i]);
1887
1888	for (split = aa_label_strn_split(str, end - str), i = stack;
1889	     split && i < len; i++) {
1890		vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1891		if (!vec[i])
1892			goto fail;
1893		/*
1894		 * if component specified a new ns it becomes the new base
1895		 * so that subsequent lookups are relative to it
1896		 */
1897		if (vec[i]->ns != labels_ns(currbase))
1898			currbase = &vec[i]->label;
1899		str = split + 3;
1900		split = aa_label_strn_split(str, end - str);
1901	}
1902	/* last element doesn't have a split */
1903	if (i < len) {
1904		vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1905		if (!vec[i])
1906			goto fail;
1907	}
1908	if (len == 1)
1909		/* no need to free vec as len < LOCAL_VEC_ENTRIES */
1910		return &vec[0]->label;
1911
1912	len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1913	/* TODO: deal with reference labels */
1914	if (len == 1) {
1915		label = aa_get_label(&vec[0]->label);
1916		goto out;
1917	}
1918
1919	if (create)
1920		label = aa_vec_find_or_create_label(vec, len, gfp);
1921	else
1922		label = vec_find(vec, len);
1923	if (!label)
1924		goto fail;
1925
1926out:
1927	/* use adjusted len from after vec_unique, not original */
1928	vec_cleanup(profile, vec, len);
1929	return label;
1930
1931fail:
1932	label = ERR_PTR(-ENOENT);
1933	goto out;
1934}
1935
1936struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1937				gfp_t gfp, bool create, bool force_stack)
1938{
1939	return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1940				   force_stack);
1941}
1942
1943/**
1944 * aa_labelset_destroy - remove all labels from the label set
1945 * @ls: label set to cleanup (NOT NULL)
1946 *
1947 * Labels that are removed from the set may still exist beyond the set
1948 * being destroyed depending on their reference counting
1949 */
1950void aa_labelset_destroy(struct aa_labelset *ls)
1951{
1952	struct rb_node *node;
1953	unsigned long flags;
1954
1955	AA_BUG(!ls);
1956
1957	write_lock_irqsave(&ls->lock, flags);
1958	for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1959		struct aa_label *this = rb_entry(node, struct aa_label, node);
1960
1961		if (labels_ns(this) != root_ns)
1962			__label_remove(this,
1963				       ns_unconfined(labels_ns(this)->parent));
1964		else
1965			__label_remove(this, NULL);
1966	}
1967	write_unlock_irqrestore(&ls->lock, flags);
1968}
1969
1970/*
1971 * @ls: labelset to init (NOT NULL)
1972 */
1973void aa_labelset_init(struct aa_labelset *ls)
1974{
1975	AA_BUG(!ls);
1976
1977	rwlock_init(&ls->lock);
1978	ls->root = RB_ROOT;
1979}
1980
1981static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1982{
1983	struct aa_label *label;
1984	struct rb_node *node;
1985	unsigned long flags;
1986
1987	AA_BUG(!ls);
1988
1989	read_lock_irqsave(&ls->lock, flags);
1990
1991	__labelset_for_each(ls, node) {
1992		label = rb_entry(node, struct aa_label, node);
1993		if ((label_is_stale(label) ||
1994		     vec_is_stale(label->vec, label->size)) &&
1995		    __aa_get_label(label))
1996			goto out;
1997
1998	}
1999	label = NULL;
2000
2001out:
2002	read_unlock_irqrestore(&ls->lock, flags);
2003
2004	return label;
2005}
2006
2007/**
2008 * __label_update - insert updated version of @label into labelset
2009 * @label - the label to update/replace
2010 *
2011 * Returns: new label that is up to date
2012 *     else NULL on failure
2013 *
2014 * Requires: @ns lock be held
2015 *
2016 * Note: worst case is the stale @label does not get updated and has
2017 *       to be updated at a later time.
2018 */
2019static struct aa_label *__label_update(struct aa_label *label)
2020{
2021	struct aa_label *new, *tmp;
2022	struct aa_labelset *ls;
2023	unsigned long flags;
2024	int i, invcount = 0;
2025
2026	AA_BUG(!label);
2027	AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2028
2029	new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2030	if (!new)
2031		return NULL;
2032
2033	/*
2034	 * while holding the ns_lock will stop profile replacement, removal,
2035	 * and label updates, label merging and removal can be occurring
2036	 */
2037	ls = labels_set(label);
2038	write_lock_irqsave(&ls->lock, flags);
2039	for (i = 0; i < label->size; i++) {
2040		AA_BUG(!label->vec[i]);
2041		new->vec[i] = aa_get_newest_profile(label->vec[i]);
2042		AA_BUG(!new->vec[i]);
2043		AA_BUG(!new->vec[i]->label.proxy);
2044		AA_BUG(!new->vec[i]->label.proxy->label);
2045		if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2046			invcount++;
2047	}
2048
2049	/* updated stale label by being removed/renamed from labelset */
2050	if (invcount) {
2051		new->size -= aa_vec_unique(&new->vec[0], new->size,
2052					   VEC_FLAG_TERMINATE);
2053		/* TODO: deal with reference labels */
2054		if (new->size == 1) {
2055			tmp = aa_get_label(&new->vec[0]->label);
2056			AA_BUG(tmp == label);
2057			goto remove;
2058		}
2059		if (labels_set(label) != labels_set(new)) {
2060			write_unlock_irqrestore(&ls->lock, flags);
2061			tmp = aa_label_insert(labels_set(new), new);
2062			write_lock_irqsave(&ls->lock, flags);
2063			goto remove;
2064		}
2065	} else
2066		AA_BUG(labels_ns(label) != labels_ns(new));
2067
2068	tmp = __label_insert(labels_set(label), new, true);
2069remove:
2070	/* ensure label is removed, and redirected correctly */
2071	__label_remove(label, tmp);
2072	write_unlock_irqrestore(&ls->lock, flags);
2073	label_free_or_put_new(tmp, new);
2074
2075	return tmp;
2076}
2077
2078/**
2079 * __labelset_update - update labels in @ns
2080 * @ns: namespace to update labels in  (NOT NULL)
2081 *
2082 * Requires: @ns lock be held
2083 *
2084 * Walk the labelset ensuring that all labels are up to date and valid
2085 * Any label that has a stale component is marked stale and replaced and
2086 * by an updated version.
2087 *
2088 * If failures happen due to memory pressures then stale labels will
2089 * be left in place until the next pass.
2090 */
2091static void __labelset_update(struct aa_ns *ns)
2092{
2093	struct aa_label *label;
2094
2095	AA_BUG(!ns);
2096	AA_BUG(!mutex_is_locked(&ns->lock));
2097
2098	do {
2099		label = labelset_next_stale(&ns->labels);
2100		if (label) {
2101			struct aa_label *l = __label_update(label);
2102
2103			aa_put_label(l);
2104			aa_put_label(label);
2105		}
2106	} while (label);
2107}
2108
2109/**
2110 * __aa_labelset_udate_subtree - update all labels with a stale component
2111 * @ns: ns to start update at (NOT NULL)
2112 *
2113 * Requires: @ns lock be held
2114 *
2115 * Invalidates labels based on @p in @ns and any children namespaces.
2116 */
2117void __aa_labelset_update_subtree(struct aa_ns *ns)
2118{
2119	struct aa_ns *child;
2120
2121	AA_BUG(!ns);
2122	AA_BUG(!mutex_is_locked(&ns->lock));
2123
2124	__labelset_update(ns);
2125
2126	list_for_each_entry(child, &ns->sub_ns, base.list) {
2127		mutex_lock_nested(&child->lock, child->level);
2128		__aa_labelset_update_subtree(child);
2129		mutex_unlock(&child->lock);
2130	}
2131}