label.c 51 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor label definitions
  6. *
  7. * Copyright 2017 Canonical Ltd.
  8. */
  9. #include <linux/audit.h>
  10. #include <linux/seq_file.h>
  11. #include <linux/sort.h>
  12. #include "include/apparmor.h"
  13. #include "include/cred.h"
  14. #include "include/label.h"
  15. #include "include/policy.h"
  16. #include "include/secid.h"
  17. /*
  18. * the aa_label represents the set of profiles confining an object
  19. *
  20. * Labels maintain a reference count to the set of pointers they reference
  21. * Labels are ref counted by
  22. * tasks and object via the security field/security context off the field
  23. * code - will take a ref count on a label if it needs the label
  24. * beyond what is possible with an rcu_read_lock.
  25. * profiles - each profile is a label
  26. * secids - a pinned secid will keep a refcount of the label it is
  27. * referencing
  28. * objects - inode, files, sockets, ...
  29. *
  30. * Labels are not ref counted by the label set, so they maybe removed and
  31. * freed when no longer in use.
  32. *
  33. */
  34. #define PROXY_POISON 97
  35. #define LABEL_POISON 100
  36. static void free_proxy(struct aa_proxy *proxy)
  37. {
  38. if (proxy) {
  39. /* p->label will not updated any more as p is dead */
  40. aa_put_label(rcu_dereference_protected(proxy->label, true));
  41. memset(proxy, 0, sizeof(*proxy));
  42. RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
  43. kfree(proxy);
  44. }
  45. }
  46. void aa_proxy_kref(struct kref *kref)
  47. {
  48. struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
  49. free_proxy(proxy);
  50. }
  51. struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
  52. {
  53. struct aa_proxy *new;
  54. new = kzalloc(sizeof(struct aa_proxy), gfp);
  55. if (new) {
  56. kref_init(&new->count);
  57. rcu_assign_pointer(new->label, aa_get_label(label));
  58. }
  59. return new;
  60. }
  61. /* requires profile list write lock held */
  62. void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
  63. {
  64. struct aa_label *tmp;
  65. AA_BUG(!orig);
  66. AA_BUG(!new);
  67. lockdep_assert_held_write(&labels_set(orig)->lock);
  68. tmp = rcu_dereference_protected(orig->proxy->label,
  69. &labels_ns(orig)->lock);
  70. rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
  71. orig->flags |= FLAG_STALE;
  72. aa_put_label(tmp);
  73. }
  74. static void __proxy_share(struct aa_label *old, struct aa_label *new)
  75. {
  76. struct aa_proxy *proxy = new->proxy;
  77. new->proxy = aa_get_proxy(old->proxy);
  78. __aa_proxy_redirect(old, new);
  79. aa_put_proxy(proxy);
  80. }
  81. /**
  82. * ns_cmp - compare ns for label set ordering
  83. * @a: ns to compare (NOT NULL)
  84. * @b: ns to compare (NOT NULL)
  85. *
  86. * Returns: <0 if a < b
  87. * ==0 if a == b
  88. * >0 if a > b
  89. */
  90. static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
  91. {
  92. int res;
  93. AA_BUG(!a);
  94. AA_BUG(!b);
  95. AA_BUG(!a->base.hname);
  96. AA_BUG(!b->base.hname);
  97. if (a == b)
  98. return 0;
  99. res = a->level - b->level;
  100. if (res)
  101. return res;
  102. return strcmp(a->base.hname, b->base.hname);
  103. }
  104. /**
  105. * profile_cmp - profile comparison for set ordering
  106. * @a: profile to compare (NOT NULL)
  107. * @b: profile to compare (NOT NULL)
  108. *
  109. * Returns: <0 if a < b
  110. * ==0 if a == b
  111. * >0 if a > b
  112. */
  113. static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
  114. {
  115. int res;
  116. AA_BUG(!a);
  117. AA_BUG(!b);
  118. AA_BUG(!a->ns);
  119. AA_BUG(!b->ns);
  120. AA_BUG(!a->base.hname);
  121. AA_BUG(!b->base.hname);
  122. if (a == b || a->base.hname == b->base.hname)
  123. return 0;
  124. res = ns_cmp(a->ns, b->ns);
  125. if (res)
  126. return res;
  127. return strcmp(a->base.hname, b->base.hname);
  128. }
  129. /**
  130. * vec_cmp - label comparison for set ordering
  131. * @a: label to compare (NOT NULL)
  132. * @vec: vector of profiles to compare (NOT NULL)
  133. * @n: length of @vec
  134. *
  135. * Returns: <0 if a < vec
  136. * ==0 if a == vec
  137. * >0 if a > vec
  138. */
  139. static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
  140. {
  141. int i;
  142. AA_BUG(!a);
  143. AA_BUG(!*a);
  144. AA_BUG(!b);
  145. AA_BUG(!*b);
  146. AA_BUG(an <= 0);
  147. AA_BUG(bn <= 0);
  148. for (i = 0; i < an && i < bn; i++) {
  149. int res = profile_cmp(a[i], b[i]);
  150. if (res != 0)
  151. return res;
  152. }
  153. return an - bn;
  154. }
  155. static bool vec_is_stale(struct aa_profile **vec, int n)
  156. {
  157. int i;
  158. AA_BUG(!vec);
  159. for (i = 0; i < n; i++) {
  160. if (profile_is_stale(vec[i]))
  161. return true;
  162. }
  163. return false;
  164. }
  165. static bool vec_unconfined(struct aa_profile **vec, int n)
  166. {
  167. int i;
  168. AA_BUG(!vec);
  169. for (i = 0; i < n; i++) {
  170. if (!profile_unconfined(vec[i]))
  171. return false;
  172. }
  173. return true;
  174. }
  175. static int sort_cmp(const void *a, const void *b)
  176. {
  177. return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
  178. }
  179. /*
  180. * assumes vec is sorted
  181. * Assumes @vec has null terminator at vec[n], and will null terminate
  182. * vec[n - dups]
  183. */
  184. static inline int unique(struct aa_profile **vec, int n)
  185. {
  186. int i, pos, dups = 0;
  187. AA_BUG(n < 1);
  188. AA_BUG(!vec);
  189. pos = 0;
  190. for (i = 1; i < n; i++) {
  191. int res = profile_cmp(vec[pos], vec[i]);
  192. AA_BUG(res > 0, "vec not sorted");
  193. if (res == 0) {
  194. /* drop duplicate */
  195. aa_put_profile(vec[i]);
  196. dups++;
  197. continue;
  198. }
  199. pos++;
  200. if (dups)
  201. vec[pos] = vec[i];
  202. }
  203. AA_BUG(dups < 0);
  204. return dups;
  205. }
  206. /**
  207. * aa_vec_unique - canonical sort and unique a list of profiles
  208. * @n: number of refcounted profiles in the list (@n > 0)
  209. * @vec: list of profiles to sort and merge
  210. *
  211. * Returns: the number of duplicates eliminated == references put
  212. *
  213. * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
  214. * null terminate vec[n - dups]
  215. */
  216. int aa_vec_unique(struct aa_profile **vec, int n, int flags)
  217. {
  218. int i, dups = 0;
  219. AA_BUG(n < 1);
  220. AA_BUG(!vec);
  221. /* vecs are usually small and inorder, have a fallback for larger */
  222. if (n > 8) {
  223. sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
  224. dups = unique(vec, n);
  225. goto out;
  226. }
  227. /* insertion sort + unique in one */
  228. for (i = 1; i < n; i++) {
  229. struct aa_profile *tmp = vec[i];
  230. int pos, j;
  231. for (pos = i - 1 - dups; pos >= 0; pos--) {
  232. int res = profile_cmp(vec[pos], tmp);
  233. if (res == 0) {
  234. /* drop duplicate entry */
  235. aa_put_profile(tmp);
  236. dups++;
  237. goto continue_outer;
  238. } else if (res < 0)
  239. break;
  240. }
  241. /* pos is at entry < tmp, or index -1. Set to insert pos */
  242. pos++;
  243. for (j = i - dups; j > pos; j--)
  244. vec[j] = vec[j - 1];
  245. vec[pos] = tmp;
  246. continue_outer:
  247. ;
  248. }
  249. AA_BUG(dups < 0);
  250. out:
  251. if (flags & VEC_FLAG_TERMINATE)
  252. vec[n - dups] = NULL;
  253. return dups;
  254. }
  255. void aa_label_destroy(struct aa_label *label)
  256. {
  257. AA_BUG(!label);
  258. if (!label_isprofile(label)) {
  259. struct aa_profile *profile;
  260. struct label_it i;
  261. aa_put_str(label->hname);
  262. label_for_each(i, label, profile) {
  263. aa_put_profile(profile);
  264. label->vec[i.i] = (struct aa_profile *)
  265. (LABEL_POISON + (long) i.i);
  266. }
  267. }
  268. if (label->proxy) {
  269. if (rcu_dereference_protected(label->proxy->label, true) == label)
  270. rcu_assign_pointer(label->proxy->label, NULL);
  271. aa_put_proxy(label->proxy);
  272. }
  273. aa_free_secid(label->secid);
  274. label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
  275. }
  276. void aa_label_free(struct aa_label *label)
  277. {
  278. if (!label)
  279. return;
  280. aa_label_destroy(label);
  281. kfree(label);
  282. }
  283. static void label_free_switch(struct aa_label *label)
  284. {
  285. if (label->flags & FLAG_NS_COUNT)
  286. aa_free_ns(labels_ns(label));
  287. else if (label_isprofile(label))
  288. aa_free_profile(labels_profile(label));
  289. else
  290. aa_label_free(label);
  291. }
  292. static void label_free_rcu(struct rcu_head *head)
  293. {
  294. struct aa_label *label = container_of(head, struct aa_label, rcu);
  295. if (label->flags & FLAG_IN_TREE)
  296. (void) aa_label_remove(label);
  297. label_free_switch(label);
  298. }
  299. void aa_label_kref(struct kref *kref)
  300. {
  301. struct aa_label *label = container_of(kref, struct aa_label, count);
  302. struct aa_ns *ns = labels_ns(label);
  303. if (!ns) {
  304. /* never live, no rcu callback needed, just using the fn */
  305. label_free_switch(label);
  306. return;
  307. }
  308. /* TODO: update labels_profile macro so it works here */
  309. AA_BUG(label_isprofile(label) &&
  310. on_list_rcu(&label->vec[0]->base.profiles));
  311. AA_BUG(label_isprofile(label) &&
  312. on_list_rcu(&label->vec[0]->base.list));
  313. /* TODO: if compound label and not stale add to reclaim cache */
  314. call_rcu(&label->rcu, label_free_rcu);
  315. }
  316. static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
  317. {
  318. if (label != new)
  319. /* need to free directly to break circular ref with proxy */
  320. aa_label_free(new);
  321. else
  322. aa_put_label(new);
  323. }
  324. bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
  325. {
  326. AA_BUG(!label);
  327. AA_BUG(size < 1);
  328. if (aa_alloc_secid(label, gfp) < 0)
  329. return false;
  330. label->size = size; /* doesn't include null */
  331. label->vec[size] = NULL; /* null terminate */
  332. kref_init(&label->count);
  333. RB_CLEAR_NODE(&label->node);
  334. return true;
  335. }
  336. /**
  337. * aa_label_alloc - allocate a label with a profile vector of @size length
  338. * @size: size of profile vector in the label
  339. * @proxy: proxy to use OR null if to allocate a new one
  340. * @gfp: memory allocation type
  341. *
  342. * Returns: new label
  343. * else NULL if failed
  344. */
  345. struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
  346. {
  347. struct aa_label *new;
  348. AA_BUG(size < 1);
  349. /* + 1 for null terminator entry on vec */
  350. new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
  351. gfp);
  352. AA_DEBUG("%s (%p)\n", __func__, new);
  353. if (!new)
  354. goto fail;
  355. if (!aa_label_init(new, size, gfp))
  356. goto fail;
  357. if (!proxy) {
  358. proxy = aa_alloc_proxy(new, gfp);
  359. if (!proxy)
  360. goto fail;
  361. } else
  362. aa_get_proxy(proxy);
  363. /* just set new's proxy, don't redirect proxy here if it was passed in*/
  364. new->proxy = proxy;
  365. return new;
  366. fail:
  367. kfree(new);
  368. return NULL;
  369. }
  370. /**
  371. * label_cmp - label comparison for set ordering
  372. * @a: label to compare (NOT NULL)
  373. * @b: label to compare (NOT NULL)
  374. *
  375. * Returns: <0 if a < b
  376. * ==0 if a == b
  377. * >0 if a > b
  378. */
  379. static int label_cmp(struct aa_label *a, struct aa_label *b)
  380. {
  381. AA_BUG(!b);
  382. if (a == b)
  383. return 0;
  384. return vec_cmp(a->vec, a->size, b->vec, b->size);
  385. }
  386. /* helper fn for label_for_each_confined */
  387. int aa_label_next_confined(struct aa_label *label, int i)
  388. {
  389. AA_BUG(!label);
  390. AA_BUG(i < 0);
  391. for (; i < label->size; i++) {
  392. if (!profile_unconfined(label->vec[i]))
  393. return i;
  394. }
  395. return i;
  396. }
  397. /**
  398. * aa_label_next_not_in_set - return the next profile of @sub not in @set
  399. * @I: label iterator
  400. * @set: label to test against
  401. * @sub: label to if is subset of @set
  402. *
  403. * Returns: profile in @sub that is not in @set, with iterator set pos after
  404. * else NULL if @sub is a subset of @set
  405. */
  406. struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
  407. struct aa_label *set,
  408. struct aa_label *sub)
  409. {
  410. AA_BUG(!set);
  411. AA_BUG(!I);
  412. AA_BUG(I->i < 0);
  413. AA_BUG(I->i > set->size);
  414. AA_BUG(!sub);
  415. AA_BUG(I->j < 0);
  416. AA_BUG(I->j > sub->size);
  417. while (I->j < sub->size && I->i < set->size) {
  418. int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
  419. if (res == 0) {
  420. (I->j)++;
  421. (I->i)++;
  422. } else if (res > 0)
  423. (I->i)++;
  424. else
  425. return sub->vec[(I->j)++];
  426. }
  427. if (I->j < sub->size)
  428. return sub->vec[(I->j)++];
  429. return NULL;
  430. }
  431. /**
  432. * aa_label_is_subset - test if @sub is a subset of @set
  433. * @set: label to test against
  434. * @sub: label to test if is subset of @set
  435. *
  436. * Returns: true if @sub is subset of @set
  437. * else false
  438. */
  439. bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
  440. {
  441. struct label_it i = { };
  442. AA_BUG(!set);
  443. AA_BUG(!sub);
  444. if (sub == set)
  445. return true;
  446. return __aa_label_next_not_in_set(&i, set, sub) == NULL;
  447. }
  448. /**
  449. * aa_label_is_unconfined_subset - test if @sub is a subset of @set
  450. * @set: label to test against
  451. * @sub: label to test if is subset of @set
  452. *
  453. * This checks for subset but taking into account unconfined. IF
  454. * @sub contains an unconfined profile that does not have a matching
  455. * unconfined in @set then this will not cause the test to fail.
  456. * Conversely we don't care about an unconfined in @set that is not in
  457. * @sub
  458. *
  459. * Returns: true if @sub is special_subset of @set
  460. * else false
  461. */
  462. bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
  463. {
  464. struct label_it i = { };
  465. struct aa_profile *p;
  466. AA_BUG(!set);
  467. AA_BUG(!sub);
  468. if (sub == set)
  469. return true;
  470. do {
  471. p = __aa_label_next_not_in_set(&i, set, sub);
  472. if (p && !profile_unconfined(p))
  473. break;
  474. } while (p);
  475. return p == NULL;
  476. }
  477. /**
  478. * __label_remove - remove @label from the label set
  479. * @l: label to remove
  480. * @new: label to redirect to
  481. *
  482. * Requires: labels_set(@label)->lock write_lock
  483. * Returns: true if the label was in the tree and removed
  484. */
  485. static bool __label_remove(struct aa_label *label, struct aa_label *new)
  486. {
  487. struct aa_labelset *ls = labels_set(label);
  488. AA_BUG(!ls);
  489. AA_BUG(!label);
  490. lockdep_assert_held_write(&ls->lock);
  491. if (new)
  492. __aa_proxy_redirect(label, new);
  493. if (!label_is_stale(label))
  494. __label_make_stale(label);
  495. if (label->flags & FLAG_IN_TREE) {
  496. rb_erase(&label->node, &ls->root);
  497. label->flags &= ~FLAG_IN_TREE;
  498. return true;
  499. }
  500. return false;
  501. }
  502. /**
  503. * __label_replace - replace @old with @new in label set
  504. * @old: label to remove from label set
  505. * @new: label to replace @old with
  506. *
  507. * Requires: labels_set(@old)->lock write_lock
  508. * valid ref count be held on @new
  509. * Returns: true if @old was in set and replaced by @new
  510. *
  511. * Note: current implementation requires label set be order in such a way
  512. * that @new directly replaces @old position in the set (ie.
  513. * using pointer comparison of the label address would not work)
  514. */
  515. static bool __label_replace(struct aa_label *old, struct aa_label *new)
  516. {
  517. struct aa_labelset *ls = labels_set(old);
  518. AA_BUG(!ls);
  519. AA_BUG(!old);
  520. AA_BUG(!new);
  521. lockdep_assert_held_write(&ls->lock);
  522. AA_BUG(new->flags & FLAG_IN_TREE);
  523. if (!label_is_stale(old))
  524. __label_make_stale(old);
  525. if (old->flags & FLAG_IN_TREE) {
  526. rb_replace_node(&old->node, &new->node, &ls->root);
  527. old->flags &= ~FLAG_IN_TREE;
  528. new->flags |= FLAG_IN_TREE;
  529. return true;
  530. }
  531. return false;
  532. }
  533. /**
  534. * __label_insert - attempt to insert @l into a label set
  535. * @ls: set of labels to insert @l into (NOT NULL)
  536. * @label: new label to insert (NOT NULL)
  537. * @replace: whether insertion should replace existing entry that is not stale
  538. *
  539. * Requires: @ls->lock
  540. * caller to hold a valid ref on l
  541. * if @replace is true l has a preallocated proxy associated
  542. * Returns: @l if successful in inserting @l - with additional refcount
  543. * else ref counted equivalent label that is already in the set,
  544. * the else condition only happens if @replace is false
  545. */
  546. static struct aa_label *__label_insert(struct aa_labelset *ls,
  547. struct aa_label *label, bool replace)
  548. {
  549. struct rb_node **new, *parent = NULL;
  550. AA_BUG(!ls);
  551. AA_BUG(!label);
  552. AA_BUG(labels_set(label) != ls);
  553. lockdep_assert_held_write(&ls->lock);
  554. AA_BUG(label->flags & FLAG_IN_TREE);
  555. /* Figure out where to put new node */
  556. new = &ls->root.rb_node;
  557. while (*new) {
  558. struct aa_label *this = rb_entry(*new, struct aa_label, node);
  559. int result = label_cmp(label, this);
  560. parent = *new;
  561. if (result == 0) {
  562. /* !__aa_get_label means queued for destruction,
  563. * so replace in place, however the label has
  564. * died before the replacement so do not share
  565. * the proxy
  566. */
  567. if (!replace && !label_is_stale(this)) {
  568. if (__aa_get_label(this))
  569. return this;
  570. } else
  571. __proxy_share(this, label);
  572. AA_BUG(!__label_replace(this, label));
  573. return aa_get_label(label);
  574. } else if (result < 0)
  575. new = &((*new)->rb_left);
  576. else /* (result > 0) */
  577. new = &((*new)->rb_right);
  578. }
  579. /* Add new node and rebalance tree. */
  580. rb_link_node(&label->node, parent, new);
  581. rb_insert_color(&label->node, &ls->root);
  582. label->flags |= FLAG_IN_TREE;
  583. return aa_get_label(label);
  584. }
  585. /**
  586. * __vec_find - find label that matches @vec in label set
  587. * @vec: vec of profiles to find matching label for (NOT NULL)
  588. * @n: length of @vec
  589. *
  590. * Requires: @vec_labelset(vec) lock held
  591. * caller to hold a valid ref on l
  592. *
  593. * Returns: ref counted @label if matching label is in tree
  594. * ref counted label that is equiv to @l in tree
  595. * else NULL if @vec equiv is not in tree
  596. */
  597. static struct aa_label *__vec_find(struct aa_profile **vec, int n)
  598. {
  599. struct rb_node *node;
  600. AA_BUG(!vec);
  601. AA_BUG(!*vec);
  602. AA_BUG(n <= 0);
  603. node = vec_labelset(vec, n)->root.rb_node;
  604. while (node) {
  605. struct aa_label *this = rb_entry(node, struct aa_label, node);
  606. int result = vec_cmp(this->vec, this->size, vec, n);
  607. if (result > 0)
  608. node = node->rb_left;
  609. else if (result < 0)
  610. node = node->rb_right;
  611. else
  612. return __aa_get_label(this);
  613. }
  614. return NULL;
  615. }
  616. /**
  617. * __label_find - find label @label in label set
  618. * @label: label to find (NOT NULL)
  619. *
  620. * Requires: labels_set(@label)->lock held
  621. * caller to hold a valid ref on l
  622. *
  623. * Returns: ref counted @label if @label is in tree OR
  624. * ref counted label that is equiv to @label in tree
  625. * else NULL if @label or equiv is not in tree
  626. */
  627. static struct aa_label *__label_find(struct aa_label *label)
  628. {
  629. AA_BUG(!label);
  630. return __vec_find(label->vec, label->size);
  631. }
  632. /**
  633. * aa_label_remove - remove a label from the labelset
  634. * @label: label to remove
  635. *
  636. * Returns: true if @label was removed from the tree
  637. * else @label was not in tree so it could not be removed
  638. */
  639. bool aa_label_remove(struct aa_label *label)
  640. {
  641. struct aa_labelset *ls = labels_set(label);
  642. unsigned long flags;
  643. bool res;
  644. AA_BUG(!ls);
  645. write_lock_irqsave(&ls->lock, flags);
  646. res = __label_remove(label, ns_unconfined(labels_ns(label)));
  647. write_unlock_irqrestore(&ls->lock, flags);
  648. return res;
  649. }
  650. /**
  651. * aa_label_replace - replace a label @old with a new version @new
  652. * @old: label to replace
  653. * @new: label replacing @old
  654. *
  655. * Returns: true if @old was in tree and replaced
  656. * else @old was not in tree, and @new was not inserted
  657. */
  658. bool aa_label_replace(struct aa_label *old, struct aa_label *new)
  659. {
  660. unsigned long flags;
  661. bool res;
  662. if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
  663. write_lock_irqsave(&labels_set(old)->lock, flags);
  664. if (old->proxy != new->proxy)
  665. __proxy_share(old, new);
  666. else
  667. __aa_proxy_redirect(old, new);
  668. res = __label_replace(old, new);
  669. write_unlock_irqrestore(&labels_set(old)->lock, flags);
  670. } else {
  671. struct aa_label *l;
  672. struct aa_labelset *ls = labels_set(old);
  673. write_lock_irqsave(&ls->lock, flags);
  674. res = __label_remove(old, new);
  675. if (labels_ns(old) != labels_ns(new)) {
  676. write_unlock_irqrestore(&ls->lock, flags);
  677. ls = labels_set(new);
  678. write_lock_irqsave(&ls->lock, flags);
  679. }
  680. l = __label_insert(ls, new, true);
  681. res = (l == new);
  682. write_unlock_irqrestore(&ls->lock, flags);
  683. aa_put_label(l);
  684. }
  685. return res;
  686. }
  687. /**
  688. * vec_find - find label @l in label set
  689. * @vec: array of profiles to find equiv label for (NOT NULL)
  690. * @n: length of @vec
  691. *
  692. * Returns: refcounted label if @vec equiv is in tree
  693. * else NULL if @vec equiv is not in tree
  694. */
  695. static struct aa_label *vec_find(struct aa_profile **vec, int n)
  696. {
  697. struct aa_labelset *ls;
  698. struct aa_label *label;
  699. unsigned long flags;
  700. AA_BUG(!vec);
  701. AA_BUG(!*vec);
  702. AA_BUG(n <= 0);
  703. ls = vec_labelset(vec, n);
  704. read_lock_irqsave(&ls->lock, flags);
  705. label = __vec_find(vec, n);
  706. read_unlock_irqrestore(&ls->lock, flags);
  707. return label;
  708. }
  709. /* requires sort and merge done first */
  710. static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
  711. int len, gfp_t gfp)
  712. {
  713. struct aa_label *label = NULL;
  714. struct aa_labelset *ls;
  715. unsigned long flags;
  716. struct aa_label *new;
  717. int i;
  718. AA_BUG(!vec);
  719. if (len == 1)
  720. return aa_get_label(&vec[0]->label);
  721. ls = labels_set(&vec[len - 1]->label);
  722. /* TODO: enable when read side is lockless
  723. * check if label exists before taking locks
  724. */
  725. new = aa_label_alloc(len, NULL, gfp);
  726. if (!new)
  727. return NULL;
  728. for (i = 0; i < len; i++)
  729. new->vec[i] = aa_get_profile(vec[i]);
  730. write_lock_irqsave(&ls->lock, flags);
  731. label = __label_insert(ls, new, false);
  732. write_unlock_irqrestore(&ls->lock, flags);
  733. label_free_or_put_new(label, new);
  734. return label;
  735. }
  736. struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
  737. gfp_t gfp)
  738. {
  739. struct aa_label *label = vec_find(vec, len);
  740. if (label)
  741. return label;
  742. return vec_create_and_insert_label(vec, len, gfp);
  743. }
  744. /**
  745. * aa_label_find - find label @label in label set
  746. * @label: label to find (NOT NULL)
  747. *
  748. * Requires: caller to hold a valid ref on l
  749. *
  750. * Returns: refcounted @label if @label is in tree
  751. * refcounted label that is equiv to @label in tree
  752. * else NULL if @label or equiv is not in tree
  753. */
  754. struct aa_label *aa_label_find(struct aa_label *label)
  755. {
  756. AA_BUG(!label);
  757. return vec_find(label->vec, label->size);
  758. }
  759. /**
  760. * aa_label_insert - insert label @label into @ls or return existing label
  761. * @ls - labelset to insert @label into
  762. * @label - label to insert
  763. *
  764. * Requires: caller to hold a valid ref on @label
  765. *
  766. * Returns: ref counted @label if successful in inserting @label
  767. * else ref counted equivalent label that is already in the set
  768. */
  769. struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
  770. {
  771. struct aa_label *l;
  772. unsigned long flags;
  773. AA_BUG(!ls);
  774. AA_BUG(!label);
  775. /* check if label exists before taking lock */
  776. if (!label_is_stale(label)) {
  777. read_lock_irqsave(&ls->lock, flags);
  778. l = __label_find(label);
  779. read_unlock_irqrestore(&ls->lock, flags);
  780. if (l)
  781. return l;
  782. }
  783. write_lock_irqsave(&ls->lock, flags);
  784. l = __label_insert(ls, label, false);
  785. write_unlock_irqrestore(&ls->lock, flags);
  786. return l;
  787. }
  788. /**
  789. * aa_label_next_in_merge - find the next profile when merging @a and @b
  790. * @I: label iterator
  791. * @a: label to merge
  792. * @b: label to merge
  793. *
  794. * Returns: next profile
  795. * else null if no more profiles
  796. */
  797. struct aa_profile *aa_label_next_in_merge(struct label_it *I,
  798. struct aa_label *a,
  799. struct aa_label *b)
  800. {
  801. AA_BUG(!a);
  802. AA_BUG(!b);
  803. AA_BUG(!I);
  804. AA_BUG(I->i < 0);
  805. AA_BUG(I->i > a->size);
  806. AA_BUG(I->j < 0);
  807. AA_BUG(I->j > b->size);
  808. if (I->i < a->size) {
  809. if (I->j < b->size) {
  810. int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
  811. if (res > 0)
  812. return b->vec[(I->j)++];
  813. if (res == 0)
  814. (I->j)++;
  815. }
  816. return a->vec[(I->i)++];
  817. }
  818. if (I->j < b->size)
  819. return b->vec[(I->j)++];
  820. return NULL;
  821. }
  822. /**
  823. * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
  824. * @a: label to merge then compare (NOT NULL)
  825. * @b: label to merge then compare (NOT NULL)
  826. * @z: label to compare merge against (NOT NULL)
  827. *
  828. * Assumes: using the most recent versions of @a, @b, and @z
  829. *
  830. * Returns: <0 if a < b
  831. * ==0 if a == b
  832. * >0 if a > b
  833. */
  834. static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
  835. struct aa_label *z)
  836. {
  837. struct aa_profile *p = NULL;
  838. struct label_it i = { };
  839. int k;
  840. AA_BUG(!a);
  841. AA_BUG(!b);
  842. AA_BUG(!z);
  843. for (k = 0;
  844. k < z->size && (p = aa_label_next_in_merge(&i, a, b));
  845. k++) {
  846. int res = profile_cmp(p, z->vec[k]);
  847. if (res != 0)
  848. return res;
  849. }
  850. if (p)
  851. return 1;
  852. else if (k < z->size)
  853. return -1;
  854. return 0;
  855. }
  856. /**
  857. * label_merge_insert - create a new label by merging @a and @b
  858. * @new: preallocated label to merge into (NOT NULL)
  859. * @a: label to merge with @b (NOT NULL)
  860. * @b: label to merge with @a (NOT NULL)
  861. *
  862. * Requires: preallocated proxy
  863. *
  864. * Returns: ref counted label either @new if merge is unique
  865. * @a if @b is a subset of @a
  866. * @b if @a is a subset of @b
  867. *
  868. * NOTE: will not use @new if the merge results in @new == @a or @b
  869. *
  870. * Must be used within labelset write lock to avoid racing with
  871. * setting labels stale.
  872. */
  873. static struct aa_label *label_merge_insert(struct aa_label *new,
  874. struct aa_label *a,
  875. struct aa_label *b)
  876. {
  877. struct aa_label *label;
  878. struct aa_labelset *ls;
  879. struct aa_profile *next;
  880. struct label_it i;
  881. unsigned long flags;
  882. int k = 0, invcount = 0;
  883. bool stale = false;
  884. AA_BUG(!a);
  885. AA_BUG(a->size < 0);
  886. AA_BUG(!b);
  887. AA_BUG(b->size < 0);
  888. AA_BUG(!new);
  889. AA_BUG(new->size < a->size + b->size);
  890. label_for_each_in_merge(i, a, b, next) {
  891. AA_BUG(!next);
  892. if (profile_is_stale(next)) {
  893. new->vec[k] = aa_get_newest_profile(next);
  894. AA_BUG(!new->vec[k]->label.proxy);
  895. AA_BUG(!new->vec[k]->label.proxy->label);
  896. if (next->label.proxy != new->vec[k]->label.proxy)
  897. invcount++;
  898. k++;
  899. stale = true;
  900. } else
  901. new->vec[k++] = aa_get_profile(next);
  902. }
  903. /* set to actual size which is <= allocated len */
  904. new->size = k;
  905. new->vec[k] = NULL;
  906. if (invcount) {
  907. new->size -= aa_vec_unique(&new->vec[0], new->size,
  908. VEC_FLAG_TERMINATE);
  909. /* TODO: deal with reference labels */
  910. if (new->size == 1) {
  911. label = aa_get_label(&new->vec[0]->label);
  912. return label;
  913. }
  914. } else if (!stale) {
  915. /*
  916. * merge could be same as a || b, note: it is not possible
  917. * for new->size == a->size == b->size unless a == b
  918. */
  919. if (k == a->size)
  920. return aa_get_label(a);
  921. else if (k == b->size)
  922. return aa_get_label(b);
  923. }
  924. if (vec_unconfined(new->vec, new->size))
  925. new->flags |= FLAG_UNCONFINED;
  926. ls = labels_set(new);
  927. write_lock_irqsave(&ls->lock, flags);
  928. label = __label_insert(labels_set(new), new, false);
  929. write_unlock_irqrestore(&ls->lock, flags);
  930. return label;
  931. }
  932. /**
  933. * labelset_of_merge - find which labelset a merged label should be inserted
  934. * @a: label to merge and insert
  935. * @b: label to merge and insert
  936. *
  937. * Returns: labelset that the merged label should be inserted into
  938. */
  939. static struct aa_labelset *labelset_of_merge(struct aa_label *a,
  940. struct aa_label *b)
  941. {
  942. struct aa_ns *nsa = labels_ns(a);
  943. struct aa_ns *nsb = labels_ns(b);
  944. if (ns_cmp(nsa, nsb) <= 0)
  945. return &nsa->labels;
  946. return &nsb->labels;
  947. }
  948. /**
  949. * __label_find_merge - find label that is equiv to merge of @a and @b
  950. * @ls: set of labels to search (NOT NULL)
  951. * @a: label to merge with @b (NOT NULL)
  952. * @b: label to merge with @a (NOT NULL)
  953. *
  954. * Requires: ls->lock read_lock held
  955. *
  956. * Returns: ref counted label that is equiv to merge of @a and @b
  957. * else NULL if merge of @a and @b is not in set
  958. */
  959. static struct aa_label *__label_find_merge(struct aa_labelset *ls,
  960. struct aa_label *a,
  961. struct aa_label *b)
  962. {
  963. struct rb_node *node;
  964. AA_BUG(!ls);
  965. AA_BUG(!a);
  966. AA_BUG(!b);
  967. if (a == b)
  968. return __label_find(a);
  969. node = ls->root.rb_node;
  970. while (node) {
  971. struct aa_label *this = container_of(node, struct aa_label,
  972. node);
  973. int result = label_merge_cmp(a, b, this);
  974. if (result < 0)
  975. node = node->rb_left;
  976. else if (result > 0)
  977. node = node->rb_right;
  978. else
  979. return __aa_get_label(this);
  980. }
  981. return NULL;
  982. }
  983. /**
  984. * aa_label_find_merge - find label that is equiv to merge of @a and @b
  985. * @a: label to merge with @b (NOT NULL)
  986. * @b: label to merge with @a (NOT NULL)
  987. *
  988. * Requires: labels be fully constructed with a valid ns
  989. *
  990. * Returns: ref counted label that is equiv to merge of @a and @b
  991. * else NULL if merge of @a and @b is not in set
  992. */
  993. struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
  994. {
  995. struct aa_labelset *ls;
  996. struct aa_label *label, *ar = NULL, *br = NULL;
  997. unsigned long flags;
  998. AA_BUG(!a);
  999. AA_BUG(!b);
  1000. if (label_is_stale(a))
  1001. a = ar = aa_get_newest_label(a);
  1002. if (label_is_stale(b))
  1003. b = br = aa_get_newest_label(b);
  1004. ls = labelset_of_merge(a, b);
  1005. read_lock_irqsave(&ls->lock, flags);
  1006. label = __label_find_merge(ls, a, b);
  1007. read_unlock_irqrestore(&ls->lock, flags);
  1008. aa_put_label(ar);
  1009. aa_put_label(br);
  1010. return label;
  1011. }
  1012. /**
  1013. * aa_label_merge - attempt to insert new merged label of @a and @b
  1014. * @ls: set of labels to insert label into (NOT NULL)
  1015. * @a: label to merge with @b (NOT NULL)
  1016. * @b: label to merge with @a (NOT NULL)
  1017. * @gfp: memory allocation type
  1018. *
  1019. * Requires: caller to hold valid refs on @a and @b
  1020. * labels be fully constructed with a valid ns
  1021. *
  1022. * Returns: ref counted new label if successful in inserting merge of a & b
  1023. * else ref counted equivalent label that is already in the set.
  1024. * else NULL if could not create label (-ENOMEM)
  1025. */
  1026. struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
  1027. gfp_t gfp)
  1028. {
  1029. struct aa_label *label = NULL;
  1030. AA_BUG(!a);
  1031. AA_BUG(!b);
  1032. if (a == b)
  1033. return aa_get_newest_label(a);
  1034. /* TODO: enable when read side is lockless
  1035. * check if label exists before taking locks
  1036. if (!label_is_stale(a) && !label_is_stale(b))
  1037. label = aa_label_find_merge(a, b);
  1038. */
  1039. if (!label) {
  1040. struct aa_label *new;
  1041. a = aa_get_newest_label(a);
  1042. b = aa_get_newest_label(b);
  1043. /* could use label_merge_len(a, b), but requires double
  1044. * comparison for small savings
  1045. */
  1046. new = aa_label_alloc(a->size + b->size, NULL, gfp);
  1047. if (!new)
  1048. goto out;
  1049. label = label_merge_insert(new, a, b);
  1050. label_free_or_put_new(label, new);
  1051. out:
  1052. aa_put_label(a);
  1053. aa_put_label(b);
  1054. }
  1055. return label;
  1056. }
  1057. static inline bool label_is_visible(struct aa_profile *profile,
  1058. struct aa_label *label)
  1059. {
  1060. return aa_ns_visible(profile->ns, labels_ns(label), true);
  1061. }
  1062. /* match a profile and its associated ns component if needed
  1063. * Assumes visibility test has already been done.
  1064. * If a subns profile is not to be matched should be prescreened with
  1065. * visibility test.
  1066. */
  1067. static inline unsigned int match_component(struct aa_profile *profile,
  1068. struct aa_profile *tp,
  1069. unsigned int state)
  1070. {
  1071. const char *ns_name;
  1072. if (profile->ns == tp->ns)
  1073. return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
  1074. /* try matching with namespace name and then profile */
  1075. ns_name = aa_ns_name(profile->ns, tp->ns, true);
  1076. state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
  1077. state = aa_dfa_match(profile->policy.dfa, state, ns_name);
  1078. state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
  1079. return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
  1080. }
  1081. /**
  1082. * label_compound_match - find perms for full compound label
  1083. * @profile: profile to find perms for
  1084. * @label: label to check access permissions for
  1085. * @start: state to start match in
  1086. * @subns: whether to do permission checks on components in a subns
  1087. * @request: permissions to request
  1088. * @perms: perms struct to set
  1089. *
  1090. * Returns: 0 on success else ERROR
  1091. *
  1092. * For the label A//&B//&C this does the perm match for A//&B//&C
  1093. * @perms should be preinitialized with allperms OR a previous permission
  1094. * check to be stacked.
  1095. */
  1096. static int label_compound_match(struct aa_profile *profile,
  1097. struct aa_label *label,
  1098. unsigned int state, bool subns, u32 request,
  1099. struct aa_perms *perms)
  1100. {
  1101. struct aa_profile *tp;
  1102. struct label_it i;
  1103. /* find first subcomponent that is visible */
  1104. label_for_each(i, label, tp) {
  1105. if (!aa_ns_visible(profile->ns, tp->ns, subns))
  1106. continue;
  1107. state = match_component(profile, tp, state);
  1108. if (!state)
  1109. goto fail;
  1110. goto next;
  1111. }
  1112. /* no component visible */
  1113. *perms = allperms;
  1114. return 0;
  1115. next:
  1116. label_for_each_cont(i, label, tp) {
  1117. if (!aa_ns_visible(profile->ns, tp->ns, subns))
  1118. continue;
  1119. state = aa_dfa_match(profile->policy.dfa, state, "//&");
  1120. state = match_component(profile, tp, state);
  1121. if (!state)
  1122. goto fail;
  1123. }
  1124. aa_compute_perms(profile->policy.dfa, state, perms);
  1125. aa_apply_modes_to_perms(profile, perms);
  1126. if ((perms->allow & request) != request)
  1127. return -EACCES;
  1128. return 0;
  1129. fail:
  1130. *perms = nullperms;
  1131. return state;
  1132. }
  1133. /**
  1134. * label_components_match - find perms for all subcomponents of a label
  1135. * @profile: profile to find perms for
  1136. * @label: label to check access permissions for
  1137. * @start: state to start match in
  1138. * @subns: whether to do permission checks on components in a subns
  1139. * @request: permissions to request
  1140. * @perms: an initialized perms struct to add accumulation to
  1141. *
  1142. * Returns: 0 on success else ERROR
  1143. *
  1144. * For the label A//&B//&C this does the perm match for each of A and B and C
  1145. * @perms should be preinitialized with allperms OR a previous permission
  1146. * check to be stacked.
  1147. */
  1148. static int label_components_match(struct aa_profile *profile,
  1149. struct aa_label *label, unsigned int start,
  1150. bool subns, u32 request,
  1151. struct aa_perms *perms)
  1152. {
  1153. struct aa_profile *tp;
  1154. struct label_it i;
  1155. struct aa_perms tmp;
  1156. unsigned int state = 0;
  1157. /* find first subcomponent to test */
  1158. label_for_each(i, label, tp) {
  1159. if (!aa_ns_visible(profile->ns, tp->ns, subns))
  1160. continue;
  1161. state = match_component(profile, tp, start);
  1162. if (!state)
  1163. goto fail;
  1164. goto next;
  1165. }
  1166. /* no subcomponents visible - no change in perms */
  1167. return 0;
  1168. next:
  1169. aa_compute_perms(profile->policy.dfa, state, &tmp);
  1170. aa_apply_modes_to_perms(profile, &tmp);
  1171. aa_perms_accum(perms, &tmp);
  1172. label_for_each_cont(i, label, tp) {
  1173. if (!aa_ns_visible(profile->ns, tp->ns, subns))
  1174. continue;
  1175. state = match_component(profile, tp, start);
  1176. if (!state)
  1177. goto fail;
  1178. aa_compute_perms(profile->policy.dfa, state, &tmp);
  1179. aa_apply_modes_to_perms(profile, &tmp);
  1180. aa_perms_accum(perms, &tmp);
  1181. }
  1182. if ((perms->allow & request) != request)
  1183. return -EACCES;
  1184. return 0;
  1185. fail:
  1186. *perms = nullperms;
  1187. return -EACCES;
  1188. }
  1189. /**
  1190. * aa_label_match - do a multi-component label match
  1191. * @profile: profile to match against (NOT NULL)
  1192. * @label: label to match (NOT NULL)
  1193. * @state: state to start in
  1194. * @subns: whether to match subns components
  1195. * @request: permission request
  1196. * @perms: Returns computed perms (NOT NULL)
  1197. *
  1198. * Returns: the state the match finished in, may be the none matching state
  1199. */
  1200. int aa_label_match(struct aa_profile *profile, struct aa_label *label,
  1201. unsigned int state, bool subns, u32 request,
  1202. struct aa_perms *perms)
  1203. {
  1204. int error = label_compound_match(profile, label, state, subns, request,
  1205. perms);
  1206. if (!error)
  1207. return error;
  1208. *perms = allperms;
  1209. return label_components_match(profile, label, state, subns, request,
  1210. perms);
  1211. }
  1212. /**
  1213. * aa_update_label_name - update a label to have a stored name
  1214. * @ns: ns being viewed from (NOT NULL)
  1215. * @label: label to update (NOT NULL)
  1216. * @gfp: type of memory allocation
  1217. *
  1218. * Requires: labels_set(label) not locked in caller
  1219. *
  1220. * note: only updates the label name if it does not have a name already
  1221. * and if it is in the labelset
  1222. */
  1223. bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
  1224. {
  1225. struct aa_labelset *ls;
  1226. unsigned long flags;
  1227. char __counted *name;
  1228. bool res = false;
  1229. AA_BUG(!ns);
  1230. AA_BUG(!label);
  1231. if (label->hname || labels_ns(label) != ns)
  1232. return res;
  1233. if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
  1234. return res;
  1235. ls = labels_set(label);
  1236. write_lock_irqsave(&ls->lock, flags);
  1237. if (!label->hname && label->flags & FLAG_IN_TREE) {
  1238. label->hname = name;
  1239. res = true;
  1240. } else
  1241. aa_put_str(name);
  1242. write_unlock_irqrestore(&ls->lock, flags);
  1243. return res;
  1244. }
  1245. /*
  1246. * cached label name is present and visible
  1247. * @label->hname only exists if label is namespace hierachical
  1248. */
  1249. static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
  1250. int flags)
  1251. {
  1252. if (label->hname && (!ns || labels_ns(label) == ns) &&
  1253. !(flags & ~FLAG_SHOW_MODE))
  1254. return true;
  1255. return false;
  1256. }
  1257. /* helper macro for snprint routines */
  1258. #define update_for_len(total, len, size, str) \
  1259. do { \
  1260. size_t ulen = len; \
  1261. \
  1262. AA_BUG(len < 0); \
  1263. total += ulen; \
  1264. ulen = min(ulen, size); \
  1265. size -= ulen; \
  1266. str += ulen; \
  1267. } while (0)
  1268. /**
  1269. * aa_profile_snxprint - print a profile name to a buffer
  1270. * @str: buffer to write to. (MAY BE NULL if @size == 0)
  1271. * @size: size of buffer
  1272. * @view: namespace profile is being viewed from
  1273. * @profile: profile to view (NOT NULL)
  1274. * @flags: whether to include the mode string
  1275. * @prev_ns: last ns printed when used in compound print
  1276. *
  1277. * Returns: size of name written or would be written if larger than
  1278. * available buffer
  1279. *
  1280. * Note: will not print anything if the profile is not visible
  1281. */
  1282. static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
  1283. struct aa_profile *profile, int flags,
  1284. struct aa_ns **prev_ns)
  1285. {
  1286. const char *ns_name = NULL;
  1287. AA_BUG(!str && size != 0);
  1288. AA_BUG(!profile);
  1289. if (!view)
  1290. view = profiles_ns(profile);
  1291. if (view != profile->ns &&
  1292. (!prev_ns || (*prev_ns != profile->ns))) {
  1293. if (prev_ns)
  1294. *prev_ns = profile->ns;
  1295. ns_name = aa_ns_name(view, profile->ns,
  1296. flags & FLAG_VIEW_SUBNS);
  1297. if (ns_name == aa_hidden_ns_name) {
  1298. if (flags & FLAG_HIDDEN_UNCONFINED)
  1299. return snprintf(str, size, "%s", "unconfined");
  1300. return snprintf(str, size, "%s", ns_name);
  1301. }
  1302. }
  1303. if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
  1304. const char *modestr = aa_profile_mode_names[profile->mode];
  1305. if (ns_name)
  1306. return snprintf(str, size, ":%s:%s (%s)", ns_name,
  1307. profile->base.hname, modestr);
  1308. return snprintf(str, size, "%s (%s)", profile->base.hname,
  1309. modestr);
  1310. }
  1311. if (ns_name)
  1312. return snprintf(str, size, ":%s:%s", ns_name,
  1313. profile->base.hname);
  1314. return snprintf(str, size, "%s", profile->base.hname);
  1315. }
  1316. static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
  1317. int flags)
  1318. {
  1319. struct aa_profile *profile;
  1320. struct label_it i;
  1321. int mode = -1, count = 0;
  1322. label_for_each(i, label, profile) {
  1323. if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
  1324. count++;
  1325. if (profile == profile->ns->unconfined)
  1326. /* special case unconfined so stacks with
  1327. * unconfined don't report as mixed. ie.
  1328. * profile_foo//&:ns1:unconfined (mixed)
  1329. */
  1330. continue;
  1331. if (mode == -1)
  1332. mode = profile->mode;
  1333. else if (mode != profile->mode)
  1334. return "mixed";
  1335. }
  1336. }
  1337. if (count == 0)
  1338. return "-";
  1339. if (mode == -1)
  1340. /* everything was unconfined */
  1341. mode = APPARMOR_UNCONFINED;
  1342. return aa_profile_mode_names[mode];
  1343. }
  1344. /* if any visible label is not unconfined the display_mode returns true */
  1345. static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
  1346. int flags)
  1347. {
  1348. if ((flags & FLAG_SHOW_MODE)) {
  1349. struct aa_profile *profile;
  1350. struct label_it i;
  1351. label_for_each(i, label, profile) {
  1352. if (aa_ns_visible(ns, profile->ns,
  1353. flags & FLAG_VIEW_SUBNS) &&
  1354. profile != profile->ns->unconfined)
  1355. return true;
  1356. }
  1357. /* only ns->unconfined in set of profiles in ns */
  1358. return false;
  1359. }
  1360. return false;
  1361. }
  1362. /**
  1363. * aa_label_snxprint - print a label name to a string buffer
  1364. * @str: buffer to write to. (MAY BE NULL if @size == 0)
  1365. * @size: size of buffer
  1366. * @ns: namespace profile is being viewed from
  1367. * @label: label to view (NOT NULL)
  1368. * @flags: whether to include the mode string
  1369. *
  1370. * Returns: size of name written or would be written if larger than
  1371. * available buffer
  1372. *
  1373. * Note: labels do not have to be strictly hierarchical to the ns as
  1374. * objects may be shared across different namespaces and thus
  1375. * pickup labeling from each ns. If a particular part of the
  1376. * label is not visible it will just be excluded. And if none
  1377. * of the label is visible "---" will be used.
  1378. */
  1379. int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
  1380. struct aa_label *label, int flags)
  1381. {
  1382. struct aa_profile *profile;
  1383. struct aa_ns *prev_ns = NULL;
  1384. struct label_it i;
  1385. int count = 0, total = 0;
  1386. ssize_t len;
  1387. AA_BUG(!str && size != 0);
  1388. AA_BUG(!label);
  1389. if (flags & FLAG_ABS_ROOT) {
  1390. ns = root_ns;
  1391. len = snprintf(str, size, "=");
  1392. update_for_len(total, len, size, str);
  1393. } else if (!ns) {
  1394. ns = labels_ns(label);
  1395. }
  1396. label_for_each(i, label, profile) {
  1397. if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
  1398. if (count > 0) {
  1399. len = snprintf(str, size, "//&");
  1400. update_for_len(total, len, size, str);
  1401. }
  1402. len = aa_profile_snxprint(str, size, ns, profile,
  1403. flags & FLAG_VIEW_SUBNS,
  1404. &prev_ns);
  1405. update_for_len(total, len, size, str);
  1406. count++;
  1407. }
  1408. }
  1409. if (count == 0) {
  1410. if (flags & FLAG_HIDDEN_UNCONFINED)
  1411. return snprintf(str, size, "%s", "unconfined");
  1412. return snprintf(str, size, "%s", aa_hidden_ns_name);
  1413. }
  1414. /* count == 1 && ... is for backwards compat where the mode
  1415. * is not displayed for 'unconfined' in the current ns
  1416. */
  1417. if (display_mode(ns, label, flags)) {
  1418. len = snprintf(str, size, " (%s)",
  1419. label_modename(ns, label, flags));
  1420. update_for_len(total, len, size, str);
  1421. }
  1422. return total;
  1423. }
  1424. #undef update_for_len
  1425. /**
  1426. * aa_label_asxprint - allocate a string buffer and print label into it
  1427. * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
  1428. * @ns: namespace profile is being viewed from
  1429. * @label: label to view (NOT NULL)
  1430. * @flags: flags controlling what label info is printed
  1431. * @gfp: kernel memory allocation type
  1432. *
  1433. * Returns: size of name written or would be written if larger than
  1434. * available buffer
  1435. */
  1436. int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
  1437. int flags, gfp_t gfp)
  1438. {
  1439. int size;
  1440. AA_BUG(!strp);
  1441. AA_BUG(!label);
  1442. size = aa_label_snxprint(NULL, 0, ns, label, flags);
  1443. if (size < 0)
  1444. return size;
  1445. *strp = kmalloc(size + 1, gfp);
  1446. if (!*strp)
  1447. return -ENOMEM;
  1448. return aa_label_snxprint(*strp, size + 1, ns, label, flags);
  1449. }
  1450. /**
  1451. * aa_label_acntsxprint - allocate a __counted string buffer and print label
  1452. * @strp: buffer to write to.
  1453. * @ns: namespace profile is being viewed from
  1454. * @label: label to view (NOT NULL)
  1455. * @flags: flags controlling what label info is printed
  1456. * @gfp: kernel memory allocation type
  1457. *
  1458. * Returns: size of name written or would be written if larger than
  1459. * available buffer
  1460. */
  1461. int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
  1462. struct aa_label *label, int flags, gfp_t gfp)
  1463. {
  1464. int size;
  1465. AA_BUG(!strp);
  1466. AA_BUG(!label);
  1467. size = aa_label_snxprint(NULL, 0, ns, label, flags);
  1468. if (size < 0)
  1469. return size;
  1470. *strp = aa_str_alloc(size + 1, gfp);
  1471. if (!*strp)
  1472. return -ENOMEM;
  1473. return aa_label_snxprint(*strp, size + 1, ns, label, flags);
  1474. }
  1475. void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
  1476. struct aa_label *label, int flags, gfp_t gfp)
  1477. {
  1478. const char *str;
  1479. char *name = NULL;
  1480. int len;
  1481. AA_BUG(!ab);
  1482. AA_BUG(!label);
  1483. if (!use_label_hname(ns, label, flags) ||
  1484. display_mode(ns, label, flags)) {
  1485. len = aa_label_asxprint(&name, ns, label, flags, gfp);
  1486. if (len == -1) {
  1487. AA_DEBUG("label print error");
  1488. return;
  1489. }
  1490. str = name;
  1491. } else {
  1492. str = (char *) label->hname;
  1493. len = strlen(str);
  1494. }
  1495. if (audit_string_contains_control(str, len))
  1496. audit_log_n_hex(ab, str, len);
  1497. else
  1498. audit_log_n_string(ab, str, len);
  1499. kfree(name);
  1500. }
  1501. void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
  1502. struct aa_label *label, int flags, gfp_t gfp)
  1503. {
  1504. AA_BUG(!f);
  1505. AA_BUG(!label);
  1506. if (!use_label_hname(ns, label, flags)) {
  1507. char *str;
  1508. int len;
  1509. len = aa_label_asxprint(&str, ns, label, flags, gfp);
  1510. if (len == -1) {
  1511. AA_DEBUG("label print error");
  1512. return;
  1513. }
  1514. seq_puts(f, str);
  1515. kfree(str);
  1516. } else if (display_mode(ns, label, flags))
  1517. seq_printf(f, "%s (%s)", label->hname,
  1518. label_modename(ns, label, flags));
  1519. else
  1520. seq_puts(f, label->hname);
  1521. }
  1522. void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
  1523. gfp_t gfp)
  1524. {
  1525. AA_BUG(!label);
  1526. if (!use_label_hname(ns, label, flags)) {
  1527. char *str;
  1528. int len;
  1529. len = aa_label_asxprint(&str, ns, label, flags, gfp);
  1530. if (len == -1) {
  1531. AA_DEBUG("label print error");
  1532. return;
  1533. }
  1534. pr_info("%s", str);
  1535. kfree(str);
  1536. } else if (display_mode(ns, label, flags))
  1537. pr_info("%s (%s)", label->hname,
  1538. label_modename(ns, label, flags));
  1539. else
  1540. pr_info("%s", label->hname);
  1541. }
  1542. void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
  1543. {
  1544. struct aa_ns *ns = aa_get_current_ns();
  1545. aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
  1546. aa_put_ns(ns);
  1547. }
  1548. void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
  1549. {
  1550. struct aa_ns *ns = aa_get_current_ns();
  1551. aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
  1552. aa_put_ns(ns);
  1553. }
  1554. void aa_label_printk(struct aa_label *label, gfp_t gfp)
  1555. {
  1556. struct aa_ns *ns = aa_get_current_ns();
  1557. aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
  1558. aa_put_ns(ns);
  1559. }
  1560. static int label_count_strn_entries(const char *str, size_t n)
  1561. {
  1562. const char *end = str + n;
  1563. const char *split;
  1564. int count = 1;
  1565. AA_BUG(!str);
  1566. for (split = aa_label_strn_split(str, end - str);
  1567. split;
  1568. split = aa_label_strn_split(str, end - str)) {
  1569. count++;
  1570. str = split + 3;
  1571. }
  1572. return count;
  1573. }
  1574. /*
  1575. * ensure stacks with components like
  1576. * :ns:A//&B
  1577. * have :ns: applied to both 'A' and 'B' by making the lookup relative
  1578. * to the base if the lookup specifies an ns, else making the stacked lookup
  1579. * relative to the last embedded ns in the string.
  1580. */
  1581. static struct aa_profile *fqlookupn_profile(struct aa_label *base,
  1582. struct aa_label *currentbase,
  1583. const char *str, size_t n)
  1584. {
  1585. const char *first = skipn_spaces(str, n);
  1586. if (first && *first == ':')
  1587. return aa_fqlookupn_profile(base, str, n);
  1588. return aa_fqlookupn_profile(currentbase, str, n);
  1589. }
  1590. /**
  1591. * aa_label_strn_parse - parse, validate and convert a text string to a label
  1592. * @base: base label to use for lookups (NOT NULL)
  1593. * @str: null terminated text string (NOT NULL)
  1594. * @n: length of str to parse, will stop at \0 if encountered before n
  1595. * @gfp: allocation type
  1596. * @create: true if should create compound labels if they don't exist
  1597. * @force_stack: true if should stack even if no leading &
  1598. *
  1599. * Returns: the matching refcounted label if present
  1600. * else ERRPTR
  1601. */
  1602. struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
  1603. size_t n, gfp_t gfp, bool create,
  1604. bool force_stack)
  1605. {
  1606. DEFINE_VEC(profile, vec);
  1607. struct aa_label *label, *currbase = base;
  1608. int i, len, stack = 0, error;
  1609. const char *end = str + n;
  1610. const char *split;
  1611. AA_BUG(!base);
  1612. AA_BUG(!str);
  1613. str = skipn_spaces(str, n);
  1614. if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
  1615. return ERR_PTR(-EINVAL);
  1616. len = label_count_strn_entries(str, end - str);
  1617. if (*str == '&' || force_stack) {
  1618. /* stack on top of base */
  1619. stack = base->size;
  1620. len += stack;
  1621. if (*str == '&')
  1622. str++;
  1623. }
  1624. error = vec_setup(profile, vec, len, gfp);
  1625. if (error)
  1626. return ERR_PTR(error);
  1627. for (i = 0; i < stack; i++)
  1628. vec[i] = aa_get_profile(base->vec[i]);
  1629. for (split = aa_label_strn_split(str, end - str), i = stack;
  1630. split && i < len; i++) {
  1631. vec[i] = fqlookupn_profile(base, currbase, str, split - str);
  1632. if (!vec[i])
  1633. goto fail;
  1634. /*
  1635. * if component specified a new ns it becomes the new base
  1636. * so that subsequent lookups are relative to it
  1637. */
  1638. if (vec[i]->ns != labels_ns(currbase))
  1639. currbase = &vec[i]->label;
  1640. str = split + 3;
  1641. split = aa_label_strn_split(str, end - str);
  1642. }
  1643. /* last element doesn't have a split */
  1644. if (i < len) {
  1645. vec[i] = fqlookupn_profile(base, currbase, str, end - str);
  1646. if (!vec[i])
  1647. goto fail;
  1648. }
  1649. if (len == 1)
  1650. /* no need to free vec as len < LOCAL_VEC_ENTRIES */
  1651. return &vec[0]->label;
  1652. len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
  1653. /* TODO: deal with reference labels */
  1654. if (len == 1) {
  1655. label = aa_get_label(&vec[0]->label);
  1656. goto out;
  1657. }
  1658. if (create)
  1659. label = aa_vec_find_or_create_label(vec, len, gfp);
  1660. else
  1661. label = vec_find(vec, len);
  1662. if (!label)
  1663. goto fail;
  1664. out:
  1665. /* use adjusted len from after vec_unique, not original */
  1666. vec_cleanup(profile, vec, len);
  1667. return label;
  1668. fail:
  1669. label = ERR_PTR(-ENOENT);
  1670. goto out;
  1671. }
  1672. struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
  1673. gfp_t gfp, bool create, bool force_stack)
  1674. {
  1675. return aa_label_strn_parse(base, str, strlen(str), gfp, create,
  1676. force_stack);
  1677. }
  1678. /**
  1679. * aa_labelset_destroy - remove all labels from the label set
  1680. * @ls: label set to cleanup (NOT NULL)
  1681. *
  1682. * Labels that are removed from the set may still exist beyond the set
  1683. * being destroyed depending on their reference counting
  1684. */
  1685. void aa_labelset_destroy(struct aa_labelset *ls)
  1686. {
  1687. struct rb_node *node;
  1688. unsigned long flags;
  1689. AA_BUG(!ls);
  1690. write_lock_irqsave(&ls->lock, flags);
  1691. for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
  1692. struct aa_label *this = rb_entry(node, struct aa_label, node);
  1693. if (labels_ns(this) != root_ns)
  1694. __label_remove(this,
  1695. ns_unconfined(labels_ns(this)->parent));
  1696. else
  1697. __label_remove(this, NULL);
  1698. }
  1699. write_unlock_irqrestore(&ls->lock, flags);
  1700. }
  1701. /*
  1702. * @ls: labelset to init (NOT NULL)
  1703. */
  1704. void aa_labelset_init(struct aa_labelset *ls)
  1705. {
  1706. AA_BUG(!ls);
  1707. rwlock_init(&ls->lock);
  1708. ls->root = RB_ROOT;
  1709. }
  1710. static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
  1711. {
  1712. struct aa_label *label;
  1713. struct rb_node *node;
  1714. unsigned long flags;
  1715. AA_BUG(!ls);
  1716. read_lock_irqsave(&ls->lock, flags);
  1717. __labelset_for_each(ls, node) {
  1718. label = rb_entry(node, struct aa_label, node);
  1719. if ((label_is_stale(label) ||
  1720. vec_is_stale(label->vec, label->size)) &&
  1721. __aa_get_label(label))
  1722. goto out;
  1723. }
  1724. label = NULL;
  1725. out:
  1726. read_unlock_irqrestore(&ls->lock, flags);
  1727. return label;
  1728. }
  1729. /**
  1730. * __label_update - insert updated version of @label into labelset
  1731. * @label - the label to update/replace
  1732. *
  1733. * Returns: new label that is up to date
  1734. * else NULL on failure
  1735. *
  1736. * Requires: @ns lock be held
  1737. *
  1738. * Note: worst case is the stale @label does not get updated and has
  1739. * to be updated at a later time.
  1740. */
  1741. static struct aa_label *__label_update(struct aa_label *label)
  1742. {
  1743. struct aa_label *new, *tmp;
  1744. struct aa_labelset *ls;
  1745. unsigned long flags;
  1746. int i, invcount = 0;
  1747. AA_BUG(!label);
  1748. AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
  1749. new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
  1750. if (!new)
  1751. return NULL;
  1752. /*
  1753. * while holding the ns_lock will stop profile replacement, removal,
  1754. * and label updates, label merging and removal can be occurring
  1755. */
  1756. ls = labels_set(label);
  1757. write_lock_irqsave(&ls->lock, flags);
  1758. for (i = 0; i < label->size; i++) {
  1759. AA_BUG(!label->vec[i]);
  1760. new->vec[i] = aa_get_newest_profile(label->vec[i]);
  1761. AA_BUG(!new->vec[i]);
  1762. AA_BUG(!new->vec[i]->label.proxy);
  1763. AA_BUG(!new->vec[i]->label.proxy->label);
  1764. if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
  1765. invcount++;
  1766. }
  1767. /* updated stale label by being removed/renamed from labelset */
  1768. if (invcount) {
  1769. new->size -= aa_vec_unique(&new->vec[0], new->size,
  1770. VEC_FLAG_TERMINATE);
  1771. /* TODO: deal with reference labels */
  1772. if (new->size == 1) {
  1773. tmp = aa_get_label(&new->vec[0]->label);
  1774. AA_BUG(tmp == label);
  1775. goto remove;
  1776. }
  1777. if (labels_set(label) != labels_set(new)) {
  1778. write_unlock_irqrestore(&ls->lock, flags);
  1779. tmp = aa_label_insert(labels_set(new), new);
  1780. write_lock_irqsave(&ls->lock, flags);
  1781. goto remove;
  1782. }
  1783. } else
  1784. AA_BUG(labels_ns(label) != labels_ns(new));
  1785. tmp = __label_insert(labels_set(label), new, true);
  1786. remove:
  1787. /* ensure label is removed, and redirected correctly */
  1788. __label_remove(label, tmp);
  1789. write_unlock_irqrestore(&ls->lock, flags);
  1790. label_free_or_put_new(tmp, new);
  1791. return tmp;
  1792. }
  1793. /**
  1794. * __labelset_update - update labels in @ns
  1795. * @ns: namespace to update labels in (NOT NULL)
  1796. *
  1797. * Requires: @ns lock be held
  1798. *
  1799. * Walk the labelset ensuring that all labels are up to date and valid
  1800. * Any label that has a stale component is marked stale and replaced and
  1801. * by an updated version.
  1802. *
  1803. * If failures happen due to memory pressures then stale labels will
  1804. * be left in place until the next pass.
  1805. */
  1806. static void __labelset_update(struct aa_ns *ns)
  1807. {
  1808. struct aa_label *label;
  1809. AA_BUG(!ns);
  1810. AA_BUG(!mutex_is_locked(&ns->lock));
  1811. do {
  1812. label = labelset_next_stale(&ns->labels);
  1813. if (label) {
  1814. struct aa_label *l = __label_update(label);
  1815. aa_put_label(l);
  1816. aa_put_label(label);
  1817. }
  1818. } while (label);
  1819. }
  1820. /**
  1821. * __aa_labelset_udate_subtree - update all labels with a stale component
  1822. * @ns: ns to start update at (NOT NULL)
  1823. *
  1824. * Requires: @ns lock be held
  1825. *
  1826. * Invalidates labels based on @p in @ns and any children namespaces.
  1827. */
  1828. void __aa_labelset_update_subtree(struct aa_ns *ns)
  1829. {
  1830. struct aa_ns *child;
  1831. AA_BUG(!ns);
  1832. AA_BUG(!mutex_is_locked(&ns->lock));
  1833. __labelset_update(ns);
  1834. list_for_each_entry(child, &ns->sub_ns, base.list) {
  1835. mutex_lock_nested(&child->lock, child->level);
  1836. __aa_labelset_update_subtree(child);
  1837. mutex_unlock(&child->lock);
  1838. }
  1839. }