123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163 |
- // SPDX-License-Identifier: GPL-2.0-only
- /*
- * AppArmor security module
- *
- * This file contains AppArmor label definitions
- *
- * Copyright 2017 Canonical Ltd.
- */
- #include <linux/audit.h>
- #include <linux/seq_file.h>
- #include <linux/sort.h>
- #include "include/apparmor.h"
- #include "include/cred.h"
- #include "include/label.h"
- #include "include/policy.h"
- #include "include/secid.h"
- /*
- * the aa_label represents the set of profiles confining an object
- *
- * Labels maintain a reference count to the set of pointers they reference
- * Labels are ref counted by
- * tasks and object via the security field/security context off the field
- * code - will take a ref count on a label if it needs the label
- * beyond what is possible with an rcu_read_lock.
- * profiles - each profile is a label
- * secids - a pinned secid will keep a refcount of the label it is
- * referencing
- * objects - inode, files, sockets, ...
- *
- * Labels are not ref counted by the label set, so they maybe removed and
- * freed when no longer in use.
- *
- */
- #define PROXY_POISON 97
- #define LABEL_POISON 100
- static void free_proxy(struct aa_proxy *proxy)
- {
- if (proxy) {
- /* p->label will not updated any more as p is dead */
- aa_put_label(rcu_dereference_protected(proxy->label, true));
- memset(proxy, 0, sizeof(*proxy));
- RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
- kfree(proxy);
- }
- }
- void aa_proxy_kref(struct kref *kref)
- {
- struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
- free_proxy(proxy);
- }
- struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
- {
- struct aa_proxy *new;
- new = kzalloc(sizeof(struct aa_proxy), gfp);
- if (new) {
- kref_init(&new->count);
- rcu_assign_pointer(new->label, aa_get_label(label));
- }
- return new;
- }
- /* requires profile list write lock held */
- void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
- {
- struct aa_label *tmp;
- AA_BUG(!orig);
- AA_BUG(!new);
- lockdep_assert_held_write(&labels_set(orig)->lock);
- tmp = rcu_dereference_protected(orig->proxy->label,
- &labels_ns(orig)->lock);
- rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
- orig->flags |= FLAG_STALE;
- aa_put_label(tmp);
- }
- static void __proxy_share(struct aa_label *old, struct aa_label *new)
- {
- struct aa_proxy *proxy = new->proxy;
- new->proxy = aa_get_proxy(old->proxy);
- __aa_proxy_redirect(old, new);
- aa_put_proxy(proxy);
- }
- /**
- * ns_cmp - compare ns for label set ordering
- * @a: ns to compare (NOT NULL)
- * @b: ns to compare (NOT NULL)
- *
- * Returns: <0 if a < b
- * ==0 if a == b
- * >0 if a > b
- */
- static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
- {
- int res;
- AA_BUG(!a);
- AA_BUG(!b);
- AA_BUG(!a->base.hname);
- AA_BUG(!b->base.hname);
- if (a == b)
- return 0;
- res = a->level - b->level;
- if (res)
- return res;
- return strcmp(a->base.hname, b->base.hname);
- }
- /**
- * profile_cmp - profile comparison for set ordering
- * @a: profile to compare (NOT NULL)
- * @b: profile to compare (NOT NULL)
- *
- * Returns: <0 if a < b
- * ==0 if a == b
- * >0 if a > b
- */
- static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
- {
- int res;
- AA_BUG(!a);
- AA_BUG(!b);
- AA_BUG(!a->ns);
- AA_BUG(!b->ns);
- AA_BUG(!a->base.hname);
- AA_BUG(!b->base.hname);
- if (a == b || a->base.hname == b->base.hname)
- return 0;
- res = ns_cmp(a->ns, b->ns);
- if (res)
- return res;
- return strcmp(a->base.hname, b->base.hname);
- }
- /**
- * vec_cmp - label comparison for set ordering
- * @a: label to compare (NOT NULL)
- * @vec: vector of profiles to compare (NOT NULL)
- * @n: length of @vec
- *
- * Returns: <0 if a < vec
- * ==0 if a == vec
- * >0 if a > vec
- */
- static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
- {
- int i;
- AA_BUG(!a);
- AA_BUG(!*a);
- AA_BUG(!b);
- AA_BUG(!*b);
- AA_BUG(an <= 0);
- AA_BUG(bn <= 0);
- for (i = 0; i < an && i < bn; i++) {
- int res = profile_cmp(a[i], b[i]);
- if (res != 0)
- return res;
- }
- return an - bn;
- }
- static bool vec_is_stale(struct aa_profile **vec, int n)
- {
- int i;
- AA_BUG(!vec);
- for (i = 0; i < n; i++) {
- if (profile_is_stale(vec[i]))
- return true;
- }
- return false;
- }
- static long accum_vec_flags(struct aa_profile **vec, int n)
- {
- long u = FLAG_UNCONFINED;
- int i;
- AA_BUG(!vec);
- for (i = 0; i < n; i++) {
- u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
- FLAG_STALE);
- if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
- u &= ~FLAG_UNCONFINED;
- }
- return u;
- }
- static int sort_cmp(const void *a, const void *b)
- {
- return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
- }
- /*
- * assumes vec is sorted
- * Assumes @vec has null terminator at vec[n], and will null terminate
- * vec[n - dups]
- */
- static inline int unique(struct aa_profile **vec, int n)
- {
- int i, pos, dups = 0;
- AA_BUG(n < 1);
- AA_BUG(!vec);
- pos = 0;
- for (i = 1; i < n; i++) {
- int res = profile_cmp(vec[pos], vec[i]);
- AA_BUG(res > 0, "vec not sorted");
- if (res == 0) {
- /* drop duplicate */
- aa_put_profile(vec[i]);
- dups++;
- continue;
- }
- pos++;
- if (dups)
- vec[pos] = vec[i];
- }
- AA_BUG(dups < 0);
- return dups;
- }
- /**
- * aa_vec_unique - canonical sort and unique a list of profiles
- * @n: number of refcounted profiles in the list (@n > 0)
- * @vec: list of profiles to sort and merge
- *
- * Returns: the number of duplicates eliminated == references put
- *
- * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
- * null terminate vec[n - dups]
- */
- int aa_vec_unique(struct aa_profile **vec, int n, int flags)
- {
- int i, dups = 0;
- AA_BUG(n < 1);
- AA_BUG(!vec);
- /* vecs are usually small and inorder, have a fallback for larger */
- if (n > 8) {
- sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
- dups = unique(vec, n);
- goto out;
- }
- /* insertion sort + unique in one */
- for (i = 1; i < n; i++) {
- struct aa_profile *tmp = vec[i];
- int pos, j;
- for (pos = i - 1 - dups; pos >= 0; pos--) {
- int res = profile_cmp(vec[pos], tmp);
- if (res == 0) {
- /* drop duplicate entry */
- aa_put_profile(tmp);
- dups++;
- goto continue_outer;
- } else if (res < 0)
- break;
- }
- /* pos is at entry < tmp, or index -1. Set to insert pos */
- pos++;
- for (j = i - dups; j > pos; j--)
- vec[j] = vec[j - 1];
- vec[pos] = tmp;
- continue_outer:
- ;
- }
- AA_BUG(dups < 0);
- out:
- if (flags & VEC_FLAG_TERMINATE)
- vec[n - dups] = NULL;
- return dups;
- }
- void aa_label_destroy(struct aa_label *label)
- {
- AA_BUG(!label);
- if (!label_isprofile(label)) {
- struct aa_profile *profile;
- struct label_it i;
- aa_put_str(label->hname);
- label_for_each(i, label, profile) {
- aa_put_profile(profile);
- label->vec[i.i] = (struct aa_profile *)
- (LABEL_POISON + (long) i.i);
- }
- }
- if (label->proxy) {
- if (rcu_dereference_protected(label->proxy->label, true) == label)
- rcu_assign_pointer(label->proxy->label, NULL);
- aa_put_proxy(label->proxy);
- }
- aa_free_secid(label->secid);
- label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
- }
- void aa_label_free(struct aa_label *label)
- {
- if (!label)
- return;
- aa_label_destroy(label);
- kfree(label);
- }
- static void label_free_switch(struct aa_label *label)
- {
- if (label->flags & FLAG_NS_COUNT)
- aa_free_ns(labels_ns(label));
- else if (label_isprofile(label))
- aa_free_profile(labels_profile(label));
- else
- aa_label_free(label);
- }
- static void label_free_rcu(struct rcu_head *head)
- {
- struct aa_label *label = container_of(head, struct aa_label, rcu);
- if (label->flags & FLAG_IN_TREE)
- (void) aa_label_remove(label);
- label_free_switch(label);
- }
- void aa_label_kref(struct kref *kref)
- {
- struct aa_label *label = container_of(kref, struct aa_label, count);
- struct aa_ns *ns = labels_ns(label);
- if (!ns) {
- /* never live, no rcu callback needed, just using the fn */
- label_free_switch(label);
- return;
- }
- /* TODO: update labels_profile macro so it works here */
- AA_BUG(label_isprofile(label) &&
- on_list_rcu(&label->vec[0]->base.profiles));
- AA_BUG(label_isprofile(label) &&
- on_list_rcu(&label->vec[0]->base.list));
- /* TODO: if compound label and not stale add to reclaim cache */
- call_rcu(&label->rcu, label_free_rcu);
- }
- static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
- {
- if (label != new)
- /* need to free directly to break circular ref with proxy */
- aa_label_free(new);
- else
- aa_put_label(new);
- }
- bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
- {
- AA_BUG(!label);
- AA_BUG(size < 1);
- if (aa_alloc_secid(label, gfp) < 0)
- return false;
- label->size = size; /* doesn't include null */
- label->vec[size] = NULL; /* null terminate */
- kref_init(&label->count);
- RB_CLEAR_NODE(&label->node);
- return true;
- }
- /**
- * aa_label_alloc - allocate a label with a profile vector of @size length
- * @size: size of profile vector in the label
- * @proxy: proxy to use OR null if to allocate a new one
- * @gfp: memory allocation type
- *
- * Returns: new label
- * else NULL if failed
- */
- struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
- {
- struct aa_label *new;
- AA_BUG(size < 1);
- /* + 1 for null terminator entry on vec */
- new = kzalloc(struct_size(new, vec, size + 1), gfp);
- AA_DEBUG("%s (%p)\n", __func__, new);
- if (!new)
- goto fail;
- if (!aa_label_init(new, size, gfp))
- goto fail;
- if (!proxy) {
- proxy = aa_alloc_proxy(new, gfp);
- if (!proxy)
- goto fail;
- } else
- aa_get_proxy(proxy);
- /* just set new's proxy, don't redirect proxy here if it was passed in*/
- new->proxy = proxy;
- return new;
- fail:
- kfree(new);
- return NULL;
- }
- /**
- * label_cmp - label comparison for set ordering
- * @a: label to compare (NOT NULL)
- * @b: label to compare (NOT NULL)
- *
- * Returns: <0 if a < b
- * ==0 if a == b
- * >0 if a > b
- */
- static int label_cmp(struct aa_label *a, struct aa_label *b)
- {
- AA_BUG(!b);
- if (a == b)
- return 0;
- return vec_cmp(a->vec, a->size, b->vec, b->size);
- }
- /* helper fn for label_for_each_confined */
- int aa_label_next_confined(struct aa_label *label, int i)
- {
- AA_BUG(!label);
- AA_BUG(i < 0);
- for (; i < label->size; i++) {
- if (!profile_unconfined(label->vec[i]))
- return i;
- }
- return i;
- }
- /**
- * __aa_label_next_not_in_set - return the next profile of @sub not in @set
- * @I: label iterator
- * @set: label to test against
- * @sub: label to if is subset of @set
- *
- * Returns: profile in @sub that is not in @set, with iterator set pos after
- * else NULL if @sub is a subset of @set
- */
- struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
- struct aa_label *set,
- struct aa_label *sub)
- {
- AA_BUG(!set);
- AA_BUG(!I);
- AA_BUG(I->i < 0);
- AA_BUG(I->i > set->size);
- AA_BUG(!sub);
- AA_BUG(I->j < 0);
- AA_BUG(I->j > sub->size);
- while (I->j < sub->size && I->i < set->size) {
- int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
- if (res == 0) {
- (I->j)++;
- (I->i)++;
- } else if (res > 0)
- (I->i)++;
- else
- return sub->vec[(I->j)++];
- }
- if (I->j < sub->size)
- return sub->vec[(I->j)++];
- return NULL;
- }
- /**
- * aa_label_is_subset - test if @sub is a subset of @set
- * @set: label to test against
- * @sub: label to test if is subset of @set
- *
- * Returns: true if @sub is subset of @set
- * else false
- */
- bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
- {
- struct label_it i = { };
- AA_BUG(!set);
- AA_BUG(!sub);
- if (sub == set)
- return true;
- return __aa_label_next_not_in_set(&i, set, sub) == NULL;
- }
- /**
- * aa_label_is_unconfined_subset - test if @sub is a subset of @set
- * @set: label to test against
- * @sub: label to test if is subset of @set
- *
- * This checks for subset but taking into account unconfined. IF
- * @sub contains an unconfined profile that does not have a matching
- * unconfined in @set then this will not cause the test to fail.
- * Conversely we don't care about an unconfined in @set that is not in
- * @sub
- *
- * Returns: true if @sub is special_subset of @set
- * else false
- */
- bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
- {
- struct label_it i = { };
- struct aa_profile *p;
- AA_BUG(!set);
- AA_BUG(!sub);
- if (sub == set)
- return true;
- do {
- p = __aa_label_next_not_in_set(&i, set, sub);
- if (p && !profile_unconfined(p))
- break;
- } while (p);
- return p == NULL;
- }
- /**
- * __label_remove - remove @label from the label set
- * @l: label to remove
- * @new: label to redirect to
- *
- * Requires: labels_set(@label)->lock write_lock
- * Returns: true if the label was in the tree and removed
- */
- static bool __label_remove(struct aa_label *label, struct aa_label *new)
- {
- struct aa_labelset *ls = labels_set(label);
- AA_BUG(!ls);
- AA_BUG(!label);
- lockdep_assert_held_write(&ls->lock);
- if (new)
- __aa_proxy_redirect(label, new);
- if (!label_is_stale(label))
- __label_make_stale(label);
- if (label->flags & FLAG_IN_TREE) {
- rb_erase(&label->node, &ls->root);
- label->flags &= ~FLAG_IN_TREE;
- return true;
- }
- return false;
- }
- /**
- * __label_replace - replace @old with @new in label set
- * @old: label to remove from label set
- * @new: label to replace @old with
- *
- * Requires: labels_set(@old)->lock write_lock
- * valid ref count be held on @new
- * Returns: true if @old was in set and replaced by @new
- *
- * Note: current implementation requires label set be order in such a way
- * that @new directly replaces @old position in the set (ie.
- * using pointer comparison of the label address would not work)
- */
- static bool __label_replace(struct aa_label *old, struct aa_label *new)
- {
- struct aa_labelset *ls = labels_set(old);
- AA_BUG(!ls);
- AA_BUG(!old);
- AA_BUG(!new);
- lockdep_assert_held_write(&ls->lock);
- AA_BUG(new->flags & FLAG_IN_TREE);
- if (!label_is_stale(old))
- __label_make_stale(old);
- if (old->flags & FLAG_IN_TREE) {
- rb_replace_node(&old->node, &new->node, &ls->root);
- old->flags &= ~FLAG_IN_TREE;
- new->flags |= FLAG_IN_TREE;
- return true;
- }
- return false;
- }
- /**
- * __label_insert - attempt to insert @l into a label set
- * @ls: set of labels to insert @l into (NOT NULL)
- * @label: new label to insert (NOT NULL)
- * @replace: whether insertion should replace existing entry that is not stale
- *
- * Requires: @ls->lock
- * caller to hold a valid ref on l
- * if @replace is true l has a preallocated proxy associated
- * Returns: @l if successful in inserting @l - with additional refcount
- * else ref counted equivalent label that is already in the set,
- * the else condition only happens if @replace is false
- */
- static struct aa_label *__label_insert(struct aa_labelset *ls,
- struct aa_label *label, bool replace)
- {
- struct rb_node **new, *parent = NULL;
- AA_BUG(!ls);
- AA_BUG(!label);
- AA_BUG(labels_set(label) != ls);
- lockdep_assert_held_write(&ls->lock);
- AA_BUG(label->flags & FLAG_IN_TREE);
- /* Figure out where to put new node */
- new = &ls->root.rb_node;
- while (*new) {
- struct aa_label *this = rb_entry(*new, struct aa_label, node);
- int result = label_cmp(label, this);
- parent = *new;
- if (result == 0) {
- /* !__aa_get_label means queued for destruction,
- * so replace in place, however the label has
- * died before the replacement so do not share
- * the proxy
- */
- if (!replace && !label_is_stale(this)) {
- if (__aa_get_label(this))
- return this;
- } else
- __proxy_share(this, label);
- AA_BUG(!__label_replace(this, label));
- return aa_get_label(label);
- } else if (result < 0)
- new = &((*new)->rb_left);
- else /* (result > 0) */
- new = &((*new)->rb_right);
- }
- /* Add new node and rebalance tree. */
- rb_link_node(&label->node, parent, new);
- rb_insert_color(&label->node, &ls->root);
- label->flags |= FLAG_IN_TREE;
- return aa_get_label(label);
- }
- /**
- * __vec_find - find label that matches @vec in label set
- * @vec: vec of profiles to find matching label for (NOT NULL)
- * @n: length of @vec
- *
- * Requires: @vec_labelset(vec) lock held
- * caller to hold a valid ref on l
- *
- * Returns: ref counted @label if matching label is in tree
- * ref counted label that is equiv to @l in tree
- * else NULL if @vec equiv is not in tree
- */
- static struct aa_label *__vec_find(struct aa_profile **vec, int n)
- {
- struct rb_node *node;
- AA_BUG(!vec);
- AA_BUG(!*vec);
- AA_BUG(n <= 0);
- node = vec_labelset(vec, n)->root.rb_node;
- while (node) {
- struct aa_label *this = rb_entry(node, struct aa_label, node);
- int result = vec_cmp(this->vec, this->size, vec, n);
- if (result > 0)
- node = node->rb_left;
- else if (result < 0)
- node = node->rb_right;
- else
- return __aa_get_label(this);
- }
- return NULL;
- }
- /**
- * __label_find - find label @label in label set
- * @label: label to find (NOT NULL)
- *
- * Requires: labels_set(@label)->lock held
- * caller to hold a valid ref on l
- *
- * Returns: ref counted @label if @label is in tree OR
- * ref counted label that is equiv to @label in tree
- * else NULL if @label or equiv is not in tree
- */
- static struct aa_label *__label_find(struct aa_label *label)
- {
- AA_BUG(!label);
- return __vec_find(label->vec, label->size);
- }
- /**
- * aa_label_remove - remove a label from the labelset
- * @label: label to remove
- *
- * Returns: true if @label was removed from the tree
- * else @label was not in tree so it could not be removed
- */
- bool aa_label_remove(struct aa_label *label)
- {
- struct aa_labelset *ls = labels_set(label);
- unsigned long flags;
- bool res;
- AA_BUG(!ls);
- write_lock_irqsave(&ls->lock, flags);
- res = __label_remove(label, ns_unconfined(labels_ns(label)));
- write_unlock_irqrestore(&ls->lock, flags);
- return res;
- }
- /**
- * aa_label_replace - replace a label @old with a new version @new
- * @old: label to replace
- * @new: label replacing @old
- *
- * Returns: true if @old was in tree and replaced
- * else @old was not in tree, and @new was not inserted
- */
- bool aa_label_replace(struct aa_label *old, struct aa_label *new)
- {
- unsigned long flags;
- bool res;
- if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
- write_lock_irqsave(&labels_set(old)->lock, flags);
- if (old->proxy != new->proxy)
- __proxy_share(old, new);
- else
- __aa_proxy_redirect(old, new);
- res = __label_replace(old, new);
- write_unlock_irqrestore(&labels_set(old)->lock, flags);
- } else {
- struct aa_label *l;
- struct aa_labelset *ls = labels_set(old);
- write_lock_irqsave(&ls->lock, flags);
- res = __label_remove(old, new);
- if (labels_ns(old) != labels_ns(new)) {
- write_unlock_irqrestore(&ls->lock, flags);
- ls = labels_set(new);
- write_lock_irqsave(&ls->lock, flags);
- }
- l = __label_insert(ls, new, true);
- res = (l == new);
- write_unlock_irqrestore(&ls->lock, flags);
- aa_put_label(l);
- }
- return res;
- }
- /**
- * vec_find - find label @l in label set
- * @vec: array of profiles to find equiv label for (NOT NULL)
- * @n: length of @vec
- *
- * Returns: refcounted label if @vec equiv is in tree
- * else NULL if @vec equiv is not in tree
- */
- static struct aa_label *vec_find(struct aa_profile **vec, int n)
- {
- struct aa_labelset *ls;
- struct aa_label *label;
- unsigned long flags;
- AA_BUG(!vec);
- AA_BUG(!*vec);
- AA_BUG(n <= 0);
- ls = vec_labelset(vec, n);
- read_lock_irqsave(&ls->lock, flags);
- label = __vec_find(vec, n);
- read_unlock_irqrestore(&ls->lock, flags);
- return label;
- }
- /* requires sort and merge done first */
- static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
- int len, gfp_t gfp)
- {
- struct aa_label *label = NULL;
- struct aa_labelset *ls;
- unsigned long flags;
- struct aa_label *new;
- int i;
- AA_BUG(!vec);
- if (len == 1)
- return aa_get_label(&vec[0]->label);
- ls = labels_set(&vec[len - 1]->label);
- /* TODO: enable when read side is lockless
- * check if label exists before taking locks
- */
- new = aa_label_alloc(len, NULL, gfp);
- if (!new)
- return NULL;
- for (i = 0; i < len; i++)
- new->vec[i] = aa_get_profile(vec[i]);
- write_lock_irqsave(&ls->lock, flags);
- label = __label_insert(ls, new, false);
- write_unlock_irqrestore(&ls->lock, flags);
- label_free_or_put_new(label, new);
- return label;
- }
- struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
- gfp_t gfp)
- {
- struct aa_label *label = vec_find(vec, len);
- if (label)
- return label;
- return vec_create_and_insert_label(vec, len, gfp);
- }
- /**
- * aa_label_find - find label @label in label set
- * @label: label to find (NOT NULL)
- *
- * Requires: caller to hold a valid ref on l
- *
- * Returns: refcounted @label if @label is in tree
- * refcounted label that is equiv to @label in tree
- * else NULL if @label or equiv is not in tree
- */
- struct aa_label *aa_label_find(struct aa_label *label)
- {
- AA_BUG(!label);
- return vec_find(label->vec, label->size);
- }
- /**
- * aa_label_insert - insert label @label into @ls or return existing label
- * @ls - labelset to insert @label into
- * @label - label to insert
- *
- * Requires: caller to hold a valid ref on @label
- *
- * Returns: ref counted @label if successful in inserting @label
- * else ref counted equivalent label that is already in the set
- */
- struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
- {
- struct aa_label *l;
- unsigned long flags;
- AA_BUG(!ls);
- AA_BUG(!label);
- /* check if label exists before taking lock */
- if (!label_is_stale(label)) {
- read_lock_irqsave(&ls->lock, flags);
- l = __label_find(label);
- read_unlock_irqrestore(&ls->lock, flags);
- if (l)
- return l;
- }
- write_lock_irqsave(&ls->lock, flags);
- l = __label_insert(ls, label, false);
- write_unlock_irqrestore(&ls->lock, flags);
- return l;
- }
- /**
- * aa_label_next_in_merge - find the next profile when merging @a and @b
- * @I: label iterator
- * @a: label to merge
- * @b: label to merge
- *
- * Returns: next profile
- * else null if no more profiles
- */
- struct aa_profile *aa_label_next_in_merge(struct label_it *I,
- struct aa_label *a,
- struct aa_label *b)
- {
- AA_BUG(!a);
- AA_BUG(!b);
- AA_BUG(!I);
- AA_BUG(I->i < 0);
- AA_BUG(I->i > a->size);
- AA_BUG(I->j < 0);
- AA_BUG(I->j > b->size);
- if (I->i < a->size) {
- if (I->j < b->size) {
- int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
- if (res > 0)
- return b->vec[(I->j)++];
- if (res == 0)
- (I->j)++;
- }
- return a->vec[(I->i)++];
- }
- if (I->j < b->size)
- return b->vec[(I->j)++];
- return NULL;
- }
- /**
- * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
- * @a: label to merge then compare (NOT NULL)
- * @b: label to merge then compare (NOT NULL)
- * @z: label to compare merge against (NOT NULL)
- *
- * Assumes: using the most recent versions of @a, @b, and @z
- *
- * Returns: <0 if a < b
- * ==0 if a == b
- * >0 if a > b
- */
- static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
- struct aa_label *z)
- {
- struct aa_profile *p = NULL;
- struct label_it i = { };
- int k;
- AA_BUG(!a);
- AA_BUG(!b);
- AA_BUG(!z);
- for (k = 0;
- k < z->size && (p = aa_label_next_in_merge(&i, a, b));
- k++) {
- int res = profile_cmp(p, z->vec[k]);
- if (res != 0)
- return res;
- }
- if (p)
- return 1;
- else if (k < z->size)
- return -1;
- return 0;
- }
- /**
- * label_merge_insert - create a new label by merging @a and @b
- * @new: preallocated label to merge into (NOT NULL)
- * @a: label to merge with @b (NOT NULL)
- * @b: label to merge with @a (NOT NULL)
- *
- * Requires: preallocated proxy
- *
- * Returns: ref counted label either @new if merge is unique
- * @a if @b is a subset of @a
- * @b if @a is a subset of @b
- *
- * NOTE: will not use @new if the merge results in @new == @a or @b
- *
- * Must be used within labelset write lock to avoid racing with
- * setting labels stale.
- */
- static struct aa_label *label_merge_insert(struct aa_label *new,
- struct aa_label *a,
- struct aa_label *b)
- {
- struct aa_label *label;
- struct aa_labelset *ls;
- struct aa_profile *next;
- struct label_it i;
- unsigned long flags;
- int k = 0, invcount = 0;
- bool stale = false;
- AA_BUG(!a);
- AA_BUG(a->size < 0);
- AA_BUG(!b);
- AA_BUG(b->size < 0);
- AA_BUG(!new);
- AA_BUG(new->size < a->size + b->size);
- label_for_each_in_merge(i, a, b, next) {
- AA_BUG(!next);
- if (profile_is_stale(next)) {
- new->vec[k] = aa_get_newest_profile(next);
- AA_BUG(!new->vec[k]->label.proxy);
- AA_BUG(!new->vec[k]->label.proxy->label);
- if (next->label.proxy != new->vec[k]->label.proxy)
- invcount++;
- k++;
- stale = true;
- } else
- new->vec[k++] = aa_get_profile(next);
- }
- /* set to actual size which is <= allocated len */
- new->size = k;
- new->vec[k] = NULL;
- if (invcount) {
- new->size -= aa_vec_unique(&new->vec[0], new->size,
- VEC_FLAG_TERMINATE);
- /* TODO: deal with reference labels */
- if (new->size == 1) {
- label = aa_get_label(&new->vec[0]->label);
- return label;
- }
- } else if (!stale) {
- /*
- * merge could be same as a || b, note: it is not possible
- * for new->size == a->size == b->size unless a == b
- */
- if (k == a->size)
- return aa_get_label(a);
- else if (k == b->size)
- return aa_get_label(b);
- }
- new->flags |= accum_vec_flags(new->vec, new->size);
- ls = labels_set(new);
- write_lock_irqsave(&ls->lock, flags);
- label = __label_insert(labels_set(new), new, false);
- write_unlock_irqrestore(&ls->lock, flags);
- return label;
- }
- /**
- * labelset_of_merge - find which labelset a merged label should be inserted
- * @a: label to merge and insert
- * @b: label to merge and insert
- *
- * Returns: labelset that the merged label should be inserted into
- */
- static struct aa_labelset *labelset_of_merge(struct aa_label *a,
- struct aa_label *b)
- {
- struct aa_ns *nsa = labels_ns(a);
- struct aa_ns *nsb = labels_ns(b);
- if (ns_cmp(nsa, nsb) <= 0)
- return &nsa->labels;
- return &nsb->labels;
- }
- /**
- * __label_find_merge - find label that is equiv to merge of @a and @b
- * @ls: set of labels to search (NOT NULL)
- * @a: label to merge with @b (NOT NULL)
- * @b: label to merge with @a (NOT NULL)
- *
- * Requires: ls->lock read_lock held
- *
- * Returns: ref counted label that is equiv to merge of @a and @b
- * else NULL if merge of @a and @b is not in set
- */
- static struct aa_label *__label_find_merge(struct aa_labelset *ls,
- struct aa_label *a,
- struct aa_label *b)
- {
- struct rb_node *node;
- AA_BUG(!ls);
- AA_BUG(!a);
- AA_BUG(!b);
- if (a == b)
- return __label_find(a);
- node = ls->root.rb_node;
- while (node) {
- struct aa_label *this = container_of(node, struct aa_label,
- node);
- int result = label_merge_cmp(a, b, this);
- if (result < 0)
- node = node->rb_left;
- else if (result > 0)
- node = node->rb_right;
- else
- return __aa_get_label(this);
- }
- return NULL;
- }
- /**
- * aa_label_find_merge - find label that is equiv to merge of @a and @b
- * @a: label to merge with @b (NOT NULL)
- * @b: label to merge with @a (NOT NULL)
- *
- * Requires: labels be fully constructed with a valid ns
- *
- * Returns: ref counted label that is equiv to merge of @a and @b
- * else NULL if merge of @a and @b is not in set
- */
- struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
- {
- struct aa_labelset *ls;
- struct aa_label *label, *ar = NULL, *br = NULL;
- unsigned long flags;
- AA_BUG(!a);
- AA_BUG(!b);
- if (label_is_stale(a))
- a = ar = aa_get_newest_label(a);
- if (label_is_stale(b))
- b = br = aa_get_newest_label(b);
- ls = labelset_of_merge(a, b);
- read_lock_irqsave(&ls->lock, flags);
- label = __label_find_merge(ls, a, b);
- read_unlock_irqrestore(&ls->lock, flags);
- aa_put_label(ar);
- aa_put_label(br);
- return label;
- }
- /**
- * aa_label_merge - attempt to insert new merged label of @a and @b
- * @ls: set of labels to insert label into (NOT NULL)
- * @a: label to merge with @b (NOT NULL)
- * @b: label to merge with @a (NOT NULL)
- * @gfp: memory allocation type
- *
- * Requires: caller to hold valid refs on @a and @b
- * labels be fully constructed with a valid ns
- *
- * Returns: ref counted new label if successful in inserting merge of a & b
- * else ref counted equivalent label that is already in the set.
- * else NULL if could not create label (-ENOMEM)
- */
- struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
- gfp_t gfp)
- {
- struct aa_label *label = NULL;
- AA_BUG(!a);
- AA_BUG(!b);
- if (a == b)
- return aa_get_newest_label(a);
- /* TODO: enable when read side is lockless
- * check if label exists before taking locks
- if (!label_is_stale(a) && !label_is_stale(b))
- label = aa_label_find_merge(a, b);
- */
- if (!label) {
- struct aa_label *new;
- a = aa_get_newest_label(a);
- b = aa_get_newest_label(b);
- /* could use label_merge_len(a, b), but requires double
- * comparison for small savings
- */
- new = aa_label_alloc(a->size + b->size, NULL, gfp);
- if (!new)
- goto out;
- label = label_merge_insert(new, a, b);
- label_free_or_put_new(label, new);
- out:
- aa_put_label(a);
- aa_put_label(b);
- }
- return label;
- }
- static inline bool label_is_visible(struct aa_profile *profile,
- struct aa_label *label)
- {
- return aa_ns_visible(profile->ns, labels_ns(label), true);
- }
- /* match a profile and its associated ns component if needed
- * Assumes visibility test has already been done.
- * If a subns profile is not to be matched should be prescreened with
- * visibility test.
- */
- static inline unsigned int match_component(struct aa_profile *profile,
- struct aa_profile *tp,
- unsigned int state)
- {
- const char *ns_name;
- if (profile->ns == tp->ns)
- return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
- /* try matching with namespace name and then profile */
- ns_name = aa_ns_name(profile->ns, tp->ns, true);
- state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
- state = aa_dfa_match(profile->policy.dfa, state, ns_name);
- state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
- return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
- }
- /**
- * label_compound_match - find perms for full compound label
- * @profile: profile to find perms for
- * @label: label to check access permissions for
- * @start: state to start match in
- * @subns: whether to do permission checks on components in a subns
- * @request: permissions to request
- * @perms: perms struct to set
- *
- * Returns: 0 on success else ERROR
- *
- * For the label A//&B//&C this does the perm match for A//&B//&C
- * @perms should be preinitialized with allperms OR a previous permission
- * check to be stacked.
- */
- static int label_compound_match(struct aa_profile *profile,
- struct aa_label *label,
- unsigned int state, bool subns, u32 request,
- struct aa_perms *perms)
- {
- struct aa_profile *tp;
- struct label_it i;
- /* find first subcomponent that is visible */
- label_for_each(i, label, tp) {
- if (!aa_ns_visible(profile->ns, tp->ns, subns))
- continue;
- state = match_component(profile, tp, state);
- if (!state)
- goto fail;
- goto next;
- }
- /* no component visible */
- *perms = allperms;
- return 0;
- next:
- label_for_each_cont(i, label, tp) {
- if (!aa_ns_visible(profile->ns, tp->ns, subns))
- continue;
- state = aa_dfa_match(profile->policy.dfa, state, "//&");
- state = match_component(profile, tp, state);
- if (!state)
- goto fail;
- }
- aa_compute_perms(profile->policy.dfa, state, perms);
- aa_apply_modes_to_perms(profile, perms);
- if ((perms->allow & request) != request)
- return -EACCES;
- return 0;
- fail:
- *perms = nullperms;
- return state;
- }
- /**
- * label_components_match - find perms for all subcomponents of a label
- * @profile: profile to find perms for
- * @label: label to check access permissions for
- * @start: state to start match in
- * @subns: whether to do permission checks on components in a subns
- * @request: permissions to request
- * @perms: an initialized perms struct to add accumulation to
- *
- * Returns: 0 on success else ERROR
- *
- * For the label A//&B//&C this does the perm match for each of A and B and C
- * @perms should be preinitialized with allperms OR a previous permission
- * check to be stacked.
- */
- static int label_components_match(struct aa_profile *profile,
- struct aa_label *label, unsigned int start,
- bool subns, u32 request,
- struct aa_perms *perms)
- {
- struct aa_profile *tp;
- struct label_it i;
- struct aa_perms tmp;
- unsigned int state = 0;
- /* find first subcomponent to test */
- label_for_each(i, label, tp) {
- if (!aa_ns_visible(profile->ns, tp->ns, subns))
- continue;
- state = match_component(profile, tp, start);
- if (!state)
- goto fail;
- goto next;
- }
- /* no subcomponents visible - no change in perms */
- return 0;
- next:
- aa_compute_perms(profile->policy.dfa, state, &tmp);
- aa_apply_modes_to_perms(profile, &tmp);
- aa_perms_accum(perms, &tmp);
- label_for_each_cont(i, label, tp) {
- if (!aa_ns_visible(profile->ns, tp->ns, subns))
- continue;
- state = match_component(profile, tp, start);
- if (!state)
- goto fail;
- aa_compute_perms(profile->policy.dfa, state, &tmp);
- aa_apply_modes_to_perms(profile, &tmp);
- aa_perms_accum(perms, &tmp);
- }
- if ((perms->allow & request) != request)
- return -EACCES;
- return 0;
- fail:
- *perms = nullperms;
- return -EACCES;
- }
- /**
- * aa_label_match - do a multi-component label match
- * @profile: profile to match against (NOT NULL)
- * @label: label to match (NOT NULL)
- * @state: state to start in
- * @subns: whether to match subns components
- * @request: permission request
- * @perms: Returns computed perms (NOT NULL)
- *
- * Returns: the state the match finished in, may be the none matching state
- */
- int aa_label_match(struct aa_profile *profile, struct aa_label *label,
- unsigned int state, bool subns, u32 request,
- struct aa_perms *perms)
- {
- int error = label_compound_match(profile, label, state, subns, request,
- perms);
- if (!error)
- return error;
- *perms = allperms;
- return label_components_match(profile, label, state, subns, request,
- perms);
- }
- /**
- * aa_update_label_name - update a label to have a stored name
- * @ns: ns being viewed from (NOT NULL)
- * @label: label to update (NOT NULL)
- * @gfp: type of memory allocation
- *
- * Requires: labels_set(label) not locked in caller
- *
- * note: only updates the label name if it does not have a name already
- * and if it is in the labelset
- */
- bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
- {
- struct aa_labelset *ls;
- unsigned long flags;
- char __counted *name;
- bool res = false;
- AA_BUG(!ns);
- AA_BUG(!label);
- if (label->hname || labels_ns(label) != ns)
- return res;
- if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
- return res;
- ls = labels_set(label);
- write_lock_irqsave(&ls->lock, flags);
- if (!label->hname && label->flags & FLAG_IN_TREE) {
- label->hname = name;
- res = true;
- } else
- aa_put_str(name);
- write_unlock_irqrestore(&ls->lock, flags);
- return res;
- }
- /*
- * cached label name is present and visible
- * @label->hname only exists if label is namespace hierachical
- */
- static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
- int flags)
- {
- if (label->hname && (!ns || labels_ns(label) == ns) &&
- !(flags & ~FLAG_SHOW_MODE))
- return true;
- return false;
- }
- /* helper macro for snprint routines */
- #define update_for_len(total, len, size, str) \
- do { \
- size_t ulen = len; \
- \
- AA_BUG(len < 0); \
- total += ulen; \
- ulen = min(ulen, size); \
- size -= ulen; \
- str += ulen; \
- } while (0)
- /**
- * aa_profile_snxprint - print a profile name to a buffer
- * @str: buffer to write to. (MAY BE NULL if @size == 0)
- * @size: size of buffer
- * @view: namespace profile is being viewed from
- * @profile: profile to view (NOT NULL)
- * @flags: whether to include the mode string
- * @prev_ns: last ns printed when used in compound print
- *
- * Returns: size of name written or would be written if larger than
- * available buffer
- *
- * Note: will not print anything if the profile is not visible
- */
- static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
- struct aa_profile *profile, int flags,
- struct aa_ns **prev_ns)
- {
- const char *ns_name = NULL;
- AA_BUG(!str && size != 0);
- AA_BUG(!profile);
- if (!view)
- view = profiles_ns(profile);
- if (view != profile->ns &&
- (!prev_ns || (*prev_ns != profile->ns))) {
- if (prev_ns)
- *prev_ns = profile->ns;
- ns_name = aa_ns_name(view, profile->ns,
- flags & FLAG_VIEW_SUBNS);
- if (ns_name == aa_hidden_ns_name) {
- if (flags & FLAG_HIDDEN_UNCONFINED)
- return snprintf(str, size, "%s", "unconfined");
- return snprintf(str, size, "%s", ns_name);
- }
- }
- if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
- const char *modestr = aa_profile_mode_names[profile->mode];
- if (ns_name)
- return snprintf(str, size, ":%s:%s (%s)", ns_name,
- profile->base.hname, modestr);
- return snprintf(str, size, "%s (%s)", profile->base.hname,
- modestr);
- }
- if (ns_name)
- return snprintf(str, size, ":%s:%s", ns_name,
- profile->base.hname);
- return snprintf(str, size, "%s", profile->base.hname);
- }
- static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
- int flags)
- {
- struct aa_profile *profile;
- struct label_it i;
- int mode = -1, count = 0;
- label_for_each(i, label, profile) {
- if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
- count++;
- if (profile == profile->ns->unconfined)
- /* special case unconfined so stacks with
- * unconfined don't report as mixed. ie.
- * profile_foo//&:ns1:unconfined (mixed)
- */
- continue;
- if (mode == -1)
- mode = profile->mode;
- else if (mode != profile->mode)
- return "mixed";
- }
- }
- if (count == 0)
- return "-";
- if (mode == -1)
- /* everything was unconfined */
- mode = APPARMOR_UNCONFINED;
- return aa_profile_mode_names[mode];
- }
- /* if any visible label is not unconfined the display_mode returns true */
- static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
- int flags)
- {
- if ((flags & FLAG_SHOW_MODE)) {
- struct aa_profile *profile;
- struct label_it i;
- label_for_each(i, label, profile) {
- if (aa_ns_visible(ns, profile->ns,
- flags & FLAG_VIEW_SUBNS) &&
- profile != profile->ns->unconfined)
- return true;
- }
- /* only ns->unconfined in set of profiles in ns */
- return false;
- }
- return false;
- }
- /**
- * aa_label_snxprint - print a label name to a string buffer
- * @str: buffer to write to. (MAY BE NULL if @size == 0)
- * @size: size of buffer
- * @ns: namespace profile is being viewed from
- * @label: label to view (NOT NULL)
- * @flags: whether to include the mode string
- *
- * Returns: size of name written or would be written if larger than
- * available buffer
- *
- * Note: labels do not have to be strictly hierarchical to the ns as
- * objects may be shared across different namespaces and thus
- * pickup labeling from each ns. If a particular part of the
- * label is not visible it will just be excluded. And if none
- * of the label is visible "---" will be used.
- */
- int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
- struct aa_label *label, int flags)
- {
- struct aa_profile *profile;
- struct aa_ns *prev_ns = NULL;
- struct label_it i;
- int count = 0, total = 0;
- ssize_t len;
- AA_BUG(!str && size != 0);
- AA_BUG(!label);
- if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
- ns = root_ns;
- len = snprintf(str, size, "_");
- update_for_len(total, len, size, str);
- } else if (!ns) {
- ns = labels_ns(label);
- }
- label_for_each(i, label, profile) {
- if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
- if (count > 0) {
- len = snprintf(str, size, "//&");
- update_for_len(total, len, size, str);
- }
- len = aa_profile_snxprint(str, size, ns, profile,
- flags & FLAG_VIEW_SUBNS,
- &prev_ns);
- update_for_len(total, len, size, str);
- count++;
- }
- }
- if (count == 0) {
- if (flags & FLAG_HIDDEN_UNCONFINED)
- return snprintf(str, size, "%s", "unconfined");
- return snprintf(str, size, "%s", aa_hidden_ns_name);
- }
- /* count == 1 && ... is for backwards compat where the mode
- * is not displayed for 'unconfined' in the current ns
- */
- if (display_mode(ns, label, flags)) {
- len = snprintf(str, size, " (%s)",
- label_modename(ns, label, flags));
- update_for_len(total, len, size, str);
- }
- return total;
- }
- #undef update_for_len
- /**
- * aa_label_asxprint - allocate a string buffer and print label into it
- * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
- * @ns: namespace profile is being viewed from
- * @label: label to view (NOT NULL)
- * @flags: flags controlling what label info is printed
- * @gfp: kernel memory allocation type
- *
- * Returns: size of name written or would be written if larger than
- * available buffer
- */
- int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
- int flags, gfp_t gfp)
- {
- int size;
- AA_BUG(!strp);
- AA_BUG(!label);
- size = aa_label_snxprint(NULL, 0, ns, label, flags);
- if (size < 0)
- return size;
- *strp = kmalloc(size + 1, gfp);
- if (!*strp)
- return -ENOMEM;
- return aa_label_snxprint(*strp, size + 1, ns, label, flags);
- }
- /**
- * aa_label_acntsxprint - allocate a __counted string buffer and print label
- * @strp: buffer to write to.
- * @ns: namespace profile is being viewed from
- * @label: label to view (NOT NULL)
- * @flags: flags controlling what label info is printed
- * @gfp: kernel memory allocation type
- *
- * Returns: size of name written or would be written if larger than
- * available buffer
- */
- int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
- struct aa_label *label, int flags, gfp_t gfp)
- {
- int size;
- AA_BUG(!strp);
- AA_BUG(!label);
- size = aa_label_snxprint(NULL, 0, ns, label, flags);
- if (size < 0)
- return size;
- *strp = aa_str_alloc(size + 1, gfp);
- if (!*strp)
- return -ENOMEM;
- return aa_label_snxprint(*strp, size + 1, ns, label, flags);
- }
- void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
- struct aa_label *label, int flags, gfp_t gfp)
- {
- const char *str;
- char *name = NULL;
- int len;
- AA_BUG(!ab);
- AA_BUG(!label);
- if (!use_label_hname(ns, label, flags) ||
- display_mode(ns, label, flags)) {
- len = aa_label_asxprint(&name, ns, label, flags, gfp);
- if (len < 0) {
- AA_DEBUG("label print error");
- return;
- }
- str = name;
- } else {
- str = (char *) label->hname;
- len = strlen(str);
- }
- if (audit_string_contains_control(str, len))
- audit_log_n_hex(ab, str, len);
- else
- audit_log_n_string(ab, str, len);
- kfree(name);
- }
- void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
- struct aa_label *label, int flags, gfp_t gfp)
- {
- AA_BUG(!f);
- AA_BUG(!label);
- if (!use_label_hname(ns, label, flags)) {
- char *str;
- int len;
- len = aa_label_asxprint(&str, ns, label, flags, gfp);
- if (len < 0) {
- AA_DEBUG("label print error");
- return;
- }
- seq_puts(f, str);
- kfree(str);
- } else if (display_mode(ns, label, flags))
- seq_printf(f, "%s (%s)", label->hname,
- label_modename(ns, label, flags));
- else
- seq_puts(f, label->hname);
- }
- void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
- gfp_t gfp)
- {
- AA_BUG(!label);
- if (!use_label_hname(ns, label, flags)) {
- char *str;
- int len;
- len = aa_label_asxprint(&str, ns, label, flags, gfp);
- if (len < 0) {
- AA_DEBUG("label print error");
- return;
- }
- pr_info("%s", str);
- kfree(str);
- } else if (display_mode(ns, label, flags))
- pr_info("%s (%s)", label->hname,
- label_modename(ns, label, flags));
- else
- pr_info("%s", label->hname);
- }
- void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
- {
- struct aa_ns *ns = aa_get_current_ns();
- aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
- aa_put_ns(ns);
- }
- void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
- {
- struct aa_ns *ns = aa_get_current_ns();
- aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
- aa_put_ns(ns);
- }
- void aa_label_printk(struct aa_label *label, gfp_t gfp)
- {
- struct aa_ns *ns = aa_get_current_ns();
- aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
- aa_put_ns(ns);
- }
- static int label_count_strn_entries(const char *str, size_t n)
- {
- const char *end = str + n;
- const char *split;
- int count = 1;
- AA_BUG(!str);
- for (split = aa_label_strn_split(str, end - str);
- split;
- split = aa_label_strn_split(str, end - str)) {
- count++;
- str = split + 3;
- }
- return count;
- }
- /*
- * ensure stacks with components like
- * :ns:A//&B
- * have :ns: applied to both 'A' and 'B' by making the lookup relative
- * to the base if the lookup specifies an ns, else making the stacked lookup
- * relative to the last embedded ns in the string.
- */
- static struct aa_profile *fqlookupn_profile(struct aa_label *base,
- struct aa_label *currentbase,
- const char *str, size_t n)
- {
- const char *first = skipn_spaces(str, n);
- if (first && *first == ':')
- return aa_fqlookupn_profile(base, str, n);
- return aa_fqlookupn_profile(currentbase, str, n);
- }
- /**
- * aa_label_strn_parse - parse, validate and convert a text string to a label
- * @base: base label to use for lookups (NOT NULL)
- * @str: null terminated text string (NOT NULL)
- * @n: length of str to parse, will stop at \0 if encountered before n
- * @gfp: allocation type
- * @create: true if should create compound labels if they don't exist
- * @force_stack: true if should stack even if no leading &
- *
- * Returns: the matching refcounted label if present
- * else ERRPTR
- */
- struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
- size_t n, gfp_t gfp, bool create,
- bool force_stack)
- {
- DEFINE_VEC(profile, vec);
- struct aa_label *label, *currbase = base;
- int i, len, stack = 0, error;
- const char *end = str + n;
- const char *split;
- AA_BUG(!base);
- AA_BUG(!str);
- str = skipn_spaces(str, n);
- if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
- base != &root_ns->unconfined->label))
- return ERR_PTR(-EINVAL);
- len = label_count_strn_entries(str, end - str);
- if (*str == '&' || force_stack) {
- /* stack on top of base */
- stack = base->size;
- len += stack;
- if (*str == '&')
- str++;
- }
- error = vec_setup(profile, vec, len, gfp);
- if (error)
- return ERR_PTR(error);
- for (i = 0; i < stack; i++)
- vec[i] = aa_get_profile(base->vec[i]);
- for (split = aa_label_strn_split(str, end - str), i = stack;
- split && i < len; i++) {
- vec[i] = fqlookupn_profile(base, currbase, str, split - str);
- if (!vec[i])
- goto fail;
- /*
- * if component specified a new ns it becomes the new base
- * so that subsequent lookups are relative to it
- */
- if (vec[i]->ns != labels_ns(currbase))
- currbase = &vec[i]->label;
- str = split + 3;
- split = aa_label_strn_split(str, end - str);
- }
- /* last element doesn't have a split */
- if (i < len) {
- vec[i] = fqlookupn_profile(base, currbase, str, end - str);
- if (!vec[i])
- goto fail;
- }
- if (len == 1)
- /* no need to free vec as len < LOCAL_VEC_ENTRIES */
- return &vec[0]->label;
- len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
- /* TODO: deal with reference labels */
- if (len == 1) {
- label = aa_get_label(&vec[0]->label);
- goto out;
- }
- if (create)
- label = aa_vec_find_or_create_label(vec, len, gfp);
- else
- label = vec_find(vec, len);
- if (!label)
- goto fail;
- out:
- /* use adjusted len from after vec_unique, not original */
- vec_cleanup(profile, vec, len);
- return label;
- fail:
- label = ERR_PTR(-ENOENT);
- goto out;
- }
- struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
- gfp_t gfp, bool create, bool force_stack)
- {
- return aa_label_strn_parse(base, str, strlen(str), gfp, create,
- force_stack);
- }
- /**
- * aa_labelset_destroy - remove all labels from the label set
- * @ls: label set to cleanup (NOT NULL)
- *
- * Labels that are removed from the set may still exist beyond the set
- * being destroyed depending on their reference counting
- */
- void aa_labelset_destroy(struct aa_labelset *ls)
- {
- struct rb_node *node;
- unsigned long flags;
- AA_BUG(!ls);
- write_lock_irqsave(&ls->lock, flags);
- for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
- struct aa_label *this = rb_entry(node, struct aa_label, node);
- if (labels_ns(this) != root_ns)
- __label_remove(this,
- ns_unconfined(labels_ns(this)->parent));
- else
- __label_remove(this, NULL);
- }
- write_unlock_irqrestore(&ls->lock, flags);
- }
- /*
- * @ls: labelset to init (NOT NULL)
- */
- void aa_labelset_init(struct aa_labelset *ls)
- {
- AA_BUG(!ls);
- rwlock_init(&ls->lock);
- ls->root = RB_ROOT;
- }
- static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
- {
- struct aa_label *label;
- struct rb_node *node;
- unsigned long flags;
- AA_BUG(!ls);
- read_lock_irqsave(&ls->lock, flags);
- __labelset_for_each(ls, node) {
- label = rb_entry(node, struct aa_label, node);
- if ((label_is_stale(label) ||
- vec_is_stale(label->vec, label->size)) &&
- __aa_get_label(label))
- goto out;
- }
- label = NULL;
- out:
- read_unlock_irqrestore(&ls->lock, flags);
- return label;
- }
- /**
- * __label_update - insert updated version of @label into labelset
- * @label - the label to update/replace
- *
- * Returns: new label that is up to date
- * else NULL on failure
- *
- * Requires: @ns lock be held
- *
- * Note: worst case is the stale @label does not get updated and has
- * to be updated at a later time.
- */
- static struct aa_label *__label_update(struct aa_label *label)
- {
- struct aa_label *new, *tmp;
- struct aa_labelset *ls;
- unsigned long flags;
- int i, invcount = 0;
- AA_BUG(!label);
- AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
- new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
- if (!new)
- return NULL;
- /*
- * while holding the ns_lock will stop profile replacement, removal,
- * and label updates, label merging and removal can be occurring
- */
- ls = labels_set(label);
- write_lock_irqsave(&ls->lock, flags);
- for (i = 0; i < label->size; i++) {
- AA_BUG(!label->vec[i]);
- new->vec[i] = aa_get_newest_profile(label->vec[i]);
- AA_BUG(!new->vec[i]);
- AA_BUG(!new->vec[i]->label.proxy);
- AA_BUG(!new->vec[i]->label.proxy->label);
- if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
- invcount++;
- }
- /* updated stale label by being removed/renamed from labelset */
- if (invcount) {
- new->size -= aa_vec_unique(&new->vec[0], new->size,
- VEC_FLAG_TERMINATE);
- /* TODO: deal with reference labels */
- if (new->size == 1) {
- tmp = aa_get_label(&new->vec[0]->label);
- AA_BUG(tmp == label);
- goto remove;
- }
- if (labels_set(label) != labels_set(new)) {
- write_unlock_irqrestore(&ls->lock, flags);
- tmp = aa_label_insert(labels_set(new), new);
- write_lock_irqsave(&ls->lock, flags);
- goto remove;
- }
- } else
- AA_BUG(labels_ns(label) != labels_ns(new));
- tmp = __label_insert(labels_set(label), new, true);
- remove:
- /* ensure label is removed, and redirected correctly */
- __label_remove(label, tmp);
- write_unlock_irqrestore(&ls->lock, flags);
- label_free_or_put_new(tmp, new);
- return tmp;
- }
- /**
- * __labelset_update - update labels in @ns
- * @ns: namespace to update labels in (NOT NULL)
- *
- * Requires: @ns lock be held
- *
- * Walk the labelset ensuring that all labels are up to date and valid
- * Any label that has a stale component is marked stale and replaced and
- * by an updated version.
- *
- * If failures happen due to memory pressures then stale labels will
- * be left in place until the next pass.
- */
- static void __labelset_update(struct aa_ns *ns)
- {
- struct aa_label *label;
- AA_BUG(!ns);
- AA_BUG(!mutex_is_locked(&ns->lock));
- do {
- label = labelset_next_stale(&ns->labels);
- if (label) {
- struct aa_label *l = __label_update(label);
- aa_put_label(l);
- aa_put_label(label);
- }
- } while (label);
- }
- /**
- * __aa_labelset_update_subtree - update all labels with a stale component
- * @ns: ns to start update at (NOT NULL)
- *
- * Requires: @ns lock be held
- *
- * Invalidates labels based on @p in @ns and any children namespaces.
- */
- void __aa_labelset_update_subtree(struct aa_ns *ns)
- {
- struct aa_ns *child;
- AA_BUG(!ns);
- AA_BUG(!mutex_is_locked(&ns->lock));
- __labelset_update(ns);
- list_for_each_entry(child, &ns->sub_ns, base.list) {
- mutex_lock_nested(&child->lock, child->level);
- __aa_labelset_update_subtree(child);
- mutex_unlock(&child->lock);
- }
- }
|