~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/apparmor/label.c

Version: ~ [ linux-5.18 ] ~ [ linux-5.17.9 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.41 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.117 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.195 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.244 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.280 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.315 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-only
  2 /*
  3  * AppArmor security module
  4  *
  5  * This file contains AppArmor label definitions
  6  *
  7  * Copyright 2017 Canonical Ltd.
  8  */
  9 
 10 #include <linux/audit.h>
 11 #include <linux/seq_file.h>
 12 #include <linux/sort.h>
 13 
 14 #include "include/apparmor.h"
 15 #include "include/cred.h"
 16 #include "include/label.h"
 17 #include "include/policy.h"
 18 #include "include/secid.h"
 19 
 20 
 21 /*
 22  * the aa_label represents the set of profiles confining an object
 23  *
 24  * Labels maintain a reference count to the set of pointers they reference
 25  * Labels are ref counted by
 26  *   tasks and object via the security field/security context off the field
 27  *   code - will take a ref count on a label if it needs the label
 28  *          beyond what is possible with an rcu_read_lock.
 29  *   profiles - each profile is a label
 30  *   secids - a pinned secid will keep a refcount of the label it is
 31  *          referencing
 32  *   objects - inode, files, sockets, ...
 33  *
 34  * Labels are not ref counted by the label set, so they maybe removed and
 35  * freed when no longer in use.
 36  *
 37  */
 38 
 39 #define PROXY_POISON 97
 40 #define LABEL_POISON 100
 41 
 42 static void free_proxy(struct aa_proxy *proxy)
 43 {
 44         if (proxy) {
 45                 /* p->label will not updated any more as p is dead */
 46                 aa_put_label(rcu_dereference_protected(proxy->label, true));
 47                 memset(proxy, 0, sizeof(*proxy));
 48                 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
 49                 kfree(proxy);
 50         }
 51 }
 52 
 53 void aa_proxy_kref(struct kref *kref)
 54 {
 55         struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
 56 
 57         free_proxy(proxy);
 58 }
 59 
 60 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
 61 {
 62         struct aa_proxy *new;
 63 
 64         new = kzalloc(sizeof(struct aa_proxy), gfp);
 65         if (new) {
 66                 kref_init(&new->count);
 67                 rcu_assign_pointer(new->label, aa_get_label(label));
 68         }
 69         return new;
 70 }
 71 
 72 /* requires profile list write lock held */
 73 void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
 74 {
 75         struct aa_label *tmp;
 76 
 77         AA_BUG(!orig);
 78         AA_BUG(!new);
 79         lockdep_assert_held_write(&labels_set(orig)->lock);
 80 
 81         tmp = rcu_dereference_protected(orig->proxy->label,
 82                                         &labels_ns(orig)->lock);
 83         rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
 84         orig->flags |= FLAG_STALE;
 85         aa_put_label(tmp);
 86 }
 87 
 88 static void __proxy_share(struct aa_label *old, struct aa_label *new)
 89 {
 90         struct aa_proxy *proxy = new->proxy;
 91 
 92         new->proxy = aa_get_proxy(old->proxy);
 93         __aa_proxy_redirect(old, new);
 94         aa_put_proxy(proxy);
 95 }
 96 
 97 
 98 /**
 99  * ns_cmp - compare ns for label set ordering
100  * @a: ns to compare (NOT NULL)
101  * @b: ns to compare (NOT NULL)
102  *
103  * Returns: <0 if a < b
104  *          ==0 if a == b
105  *          >0  if a > b
106  */
107 static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108 {
109         int res;
110 
111         AA_BUG(!a);
112         AA_BUG(!b);
113         AA_BUG(!a->base.hname);
114         AA_BUG(!b->base.hname);
115 
116         if (a == b)
117                 return 0;
118 
119         res = a->level - b->level;
120         if (res)
121                 return res;
122 
123         return strcmp(a->base.hname, b->base.hname);
124 }
125 
126 /**
127  * profile_cmp - profile comparison for set ordering
128  * @a: profile to compare (NOT NULL)
129  * @b: profile to compare (NOT NULL)
130  *
131  * Returns: <0  if a < b
132  *          ==0 if a == b
133  *          >0  if a > b
134  */
135 static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136 {
137         int res;
138 
139         AA_BUG(!a);
140         AA_BUG(!b);
141         AA_BUG(!a->ns);
142         AA_BUG(!b->ns);
143         AA_BUG(!a->base.hname);
144         AA_BUG(!b->base.hname);
145 
146         if (a == b || a->base.hname == b->base.hname)
147                 return 0;
148         res = ns_cmp(a->ns, b->ns);
149         if (res)
150                 return res;
151 
152         return strcmp(a->base.hname, b->base.hname);
153 }
154 
155 /**
156  * vec_cmp - label comparison for set ordering
157  * @a: label to compare (NOT NULL)
158  * @vec: vector of profiles to compare (NOT NULL)
159  * @n: length of @vec
160  *
161  * Returns: <0  if a < vec
162  *          ==0 if a == vec
163  *          >0  if a > vec
164  */
165 static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
166 {
167         int i;
168 
169         AA_BUG(!a);
170         AA_BUG(!*a);
171         AA_BUG(!b);
172         AA_BUG(!*b);
173         AA_BUG(an <= 0);
174         AA_BUG(bn <= 0);
175 
176         for (i = 0; i < an && i < bn; i++) {
177                 int res = profile_cmp(a[i], b[i]);
178 
179                 if (res != 0)
180                         return res;
181         }
182 
183         return an - bn;
184 }
185 
186 static bool vec_is_stale(struct aa_profile **vec, int n)
187 {
188         int i;
189 
190         AA_BUG(!vec);
191 
192         for (i = 0; i < n; i++) {
193                 if (profile_is_stale(vec[i]))
194                         return true;
195         }
196 
197         return false;
198 }
199 
200 static bool vec_unconfined(struct aa_profile **vec, int n)
201 {
202         int i;
203 
204         AA_BUG(!vec);
205 
206         for (i = 0; i < n; i++) {
207                 if (!profile_unconfined(vec[i]))
208                         return false;
209         }
210 
211         return true;
212 }
213 
214 static int sort_cmp(const void *a, const void *b)
215 {
216         return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
217 }
218 
219 /*
220  * assumes vec is sorted
221  * Assumes @vec has null terminator at vec[n], and will null terminate
222  * vec[n - dups]
223  */
224 static inline int unique(struct aa_profile **vec, int n)
225 {
226         int i, pos, dups = 0;
227 
228         AA_BUG(n < 1);
229         AA_BUG(!vec);
230 
231         pos = 0;
232         for (i = 1; i < n; i++) {
233                 int res = profile_cmp(vec[pos], vec[i]);
234 
235                 AA_BUG(res > 0, "vec not sorted");
236                 if (res == 0) {
237                         /* drop duplicate */
238                         aa_put_profile(vec[i]);
239                         dups++;
240                         continue;
241                 }
242                 pos++;
243                 if (dups)
244                         vec[pos] = vec[i];
245         }
246 
247         AA_BUG(dups < 0);
248 
249         return dups;
250 }
251 
252 /**
253  * aa_vec_unique - canonical sort and unique a list of profiles
254  * @n: number of refcounted profiles in the list (@n > 0)
255  * @vec: list of profiles to sort and merge
256  *
257  * Returns: the number of duplicates eliminated == references put
258  *
259  * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
260  * null terminate vec[n - dups]
261  */
262 int aa_vec_unique(struct aa_profile **vec, int n, int flags)
263 {
264         int i, dups = 0;
265 
266         AA_BUG(n < 1);
267         AA_BUG(!vec);
268 
269         /* vecs are usually small and inorder, have a fallback for larger */
270         if (n > 8) {
271                 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
272                 dups = unique(vec, n);
273                 goto out;
274         }
275 
276         /* insertion sort + unique in one */
277         for (i = 1; i < n; i++) {
278                 struct aa_profile *tmp = vec[i];
279                 int pos, j;
280 
281                 for (pos = i - 1 - dups; pos >= 0; pos--) {
282                         int res = profile_cmp(vec[pos], tmp);
283 
284                         if (res == 0) {
285                                 /* drop duplicate entry */
286                                 aa_put_profile(tmp);
287                                 dups++;
288                                 goto continue_outer;
289                         } else if (res < 0)
290                                 break;
291                 }
292                 /* pos is at entry < tmp, or index -1. Set to insert pos */
293                 pos++;
294 
295                 for (j = i - dups; j > pos; j--)
296                         vec[j] = vec[j - 1];
297                 vec[pos] = tmp;
298 continue_outer:
299                 ;
300         }
301 
302         AA_BUG(dups < 0);
303 
304 out:
305         if (flags & VEC_FLAG_TERMINATE)
306                 vec[n - dups] = NULL;
307 
308         return dups;
309 }
310 
311 
312 void aa_label_destroy(struct aa_label *label)
313 {
314         AA_BUG(!label);
315 
316         if (!label_isprofile(label)) {
317                 struct aa_profile *profile;
318                 struct label_it i;
319 
320                 aa_put_str(label->hname);
321 
322                 label_for_each(i, label, profile) {
323                         aa_put_profile(profile);
324                         label->vec[i.i] = (struct aa_profile *)
325                                            (LABEL_POISON + (long) i.i);
326                 }
327         }
328 
329         if (label->proxy) {
330                 if (rcu_dereference_protected(label->proxy->label, true) == label)
331                         rcu_assign_pointer(label->proxy->label, NULL);
332                 aa_put_proxy(label->proxy);
333         }
334         aa_free_secid(label->secid);
335 
336         label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
337 }
338 
339 void aa_label_free(struct aa_label *label)
340 {
341         if (!label)
342                 return;
343 
344         aa_label_destroy(label);
345         kfree(label);
346 }
347 
348 static void label_free_switch(struct aa_label *label)
349 {
350         if (label->flags & FLAG_NS_COUNT)
351                 aa_free_ns(labels_ns(label));
352         else if (label_isprofile(label))
353                 aa_free_profile(labels_profile(label));
354         else
355                 aa_label_free(label);
356 }
357 
358 static void label_free_rcu(struct rcu_head *head)
359 {
360         struct aa_label *label = container_of(head, struct aa_label, rcu);
361 
362         if (label->flags & FLAG_IN_TREE)
363                 (void) aa_label_remove(label);
364         label_free_switch(label);
365 }
366 
367 void aa_label_kref(struct kref *kref)
368 {
369         struct aa_label *label = container_of(kref, struct aa_label, count);
370         struct aa_ns *ns = labels_ns(label);
371 
372         if (!ns) {
373                 /* never live, no rcu callback needed, just using the fn */
374                 label_free_switch(label);
375                 return;
376         }
377         /* TODO: update labels_profile macro so it works here */
378         AA_BUG(label_isprofile(label) &&
379                on_list_rcu(&label->vec[0]->base.profiles));
380         AA_BUG(label_isprofile(label) &&
381                on_list_rcu(&label->vec[0]->base.list));
382 
383         /* TODO: if compound label and not stale add to reclaim cache */
384         call_rcu(&label->rcu, label_free_rcu);
385 }
386 
387 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
388 {
389         if (label != new)
390                 /* need to free directly to break circular ref with proxy */
391                 aa_label_free(new);
392         else
393                 aa_put_label(new);
394 }
395 
396 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
397 {
398         AA_BUG(!label);
399         AA_BUG(size < 1);
400 
401         if (aa_alloc_secid(label, gfp) < 0)
402                 return false;
403 
404         label->size = size;                     /* doesn't include null */
405         label->vec[size] = NULL;                /* null terminate */
406         kref_init(&label->count);
407         RB_CLEAR_NODE(&label->node);
408 
409         return true;
410 }
411 
412 /**
413  * aa_label_alloc - allocate a label with a profile vector of @size length
414  * @size: size of profile vector in the label
415  * @proxy: proxy to use OR null if to allocate a new one
416  * @gfp: memory allocation type
417  *
418  * Returns: new label
419  *     else NULL if failed
420  */
421 struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
422 {
423         struct aa_label *new;
424 
425         AA_BUG(size < 1);
426 
427         /*  + 1 for null terminator entry on vec */
428         new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
429                         gfp);
430         AA_DEBUG("%s (%p)\n", __func__, new);
431         if (!new)
432                 goto fail;
433 
434         if (!aa_label_init(new, size, gfp))
435                 goto fail;
436 
437         if (!proxy) {
438                 proxy = aa_alloc_proxy(new, gfp);
439                 if (!proxy)
440                         goto fail;
441         } else
442                 aa_get_proxy(proxy);
443         /* just set new's proxy, don't redirect proxy here if it was passed in*/
444         new->proxy = proxy;
445 
446         return new;
447 
448 fail:
449         kfree(new);
450 
451         return NULL;
452 }
453 
454 
455 /**
456  * label_cmp - label comparison for set ordering
457  * @a: label to compare (NOT NULL)
458  * @b: label to compare (NOT NULL)
459  *
460  * Returns: <0  if a < b
461  *          ==0 if a == b
462  *          >0  if a > b
463  */
464 static int label_cmp(struct aa_label *a, struct aa_label *b)
465 {
466         AA_BUG(!b);
467 
468         if (a == b)
469                 return 0;
470 
471         return vec_cmp(a->vec, a->size, b->vec, b->size);
472 }
473 
474 /* helper fn for label_for_each_confined */
475 int aa_label_next_confined(struct aa_label *label, int i)
476 {
477         AA_BUG(!label);
478         AA_BUG(i < 0);
479 
480         for (; i < label->size; i++) {
481                 if (!profile_unconfined(label->vec[i]))
482                         return i;
483         }
484 
485         return i;
486 }
487 
488 /**
489  * aa_label_next_not_in_set - return the next profile of @sub not in @set
490  * @I: label iterator
491  * @set: label to test against
492  * @sub: label to if is subset of @set
493  *
494  * Returns: profile in @sub that is not in @set, with iterator set pos after
495  *     else NULL if @sub is a subset of @set
496  */
497 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
498                                               struct aa_label *set,
499                                               struct aa_label *sub)
500 {
501         AA_BUG(!set);
502         AA_BUG(!I);
503         AA_BUG(I->i < 0);
504         AA_BUG(I->i > set->size);
505         AA_BUG(!sub);
506         AA_BUG(I->j < 0);
507         AA_BUG(I->j > sub->size);
508 
509         while (I->j < sub->size && I->i < set->size) {
510                 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
511 
512                 if (res == 0) {
513                         (I->j)++;
514                         (I->i)++;
515                 } else if (res > 0)
516                         (I->i)++;
517                 else
518                         return sub->vec[(I->j)++];
519         }
520 
521         if (I->j < sub->size)
522                 return sub->vec[(I->j)++];
523 
524         return NULL;
525 }
526 
527 /**
528  * aa_label_is_subset - test if @sub is a subset of @set
529  * @set: label to test against
530  * @sub: label to test if is subset of @set
531  *
532  * Returns: true if @sub is subset of @set
533  *     else false
534  */
535 bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
536 {
537         struct label_it i = { };
538 
539         AA_BUG(!set);
540         AA_BUG(!sub);
541 
542         if (sub == set)
543                 return true;
544 
545         return __aa_label_next_not_in_set(&i, set, sub) == NULL;
546 }
547 
548 /**
549  * aa_label_is_unconfined_subset - test if @sub is a subset of @set
550  * @set: label to test against
551  * @sub: label to test if is subset of @set
552  *
553  * This checks for subset but taking into account unconfined. IF
554  * @sub contains an unconfined profile that does not have a matching
555  * unconfined in @set then this will not cause the test to fail.
556  * Conversely we don't care about an unconfined in @set that is not in
557  * @sub
558  *
559  * Returns: true if @sub is special_subset of @set
560  *     else false
561  */
562 bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
563 {
564         struct label_it i = { };
565         struct aa_profile *p;
566 
567         AA_BUG(!set);
568         AA_BUG(!sub);
569 
570         if (sub == set)
571                 return true;
572 
573         do {
574                 p = __aa_label_next_not_in_set(&i, set, sub);
575                 if (p && !profile_unconfined(p))
576                         break;
577         } while (p);
578 
579         return p == NULL;
580 }
581 
582 
583 /**
584  * __label_remove - remove @label from the label set
585  * @l: label to remove
586  * @new: label to redirect to
587  *
588  * Requires: labels_set(@label)->lock write_lock
589  * Returns:  true if the label was in the tree and removed
590  */
591 static bool __label_remove(struct aa_label *label, struct aa_label *new)
592 {
593         struct aa_labelset *ls = labels_set(label);
594 
595         AA_BUG(!ls);
596         AA_BUG(!label);
597         lockdep_assert_held_write(&ls->lock);
598 
599         if (new)
600                 __aa_proxy_redirect(label, new);
601 
602         if (!label_is_stale(label))
603                 __label_make_stale(label);
604 
605         if (label->flags & FLAG_IN_TREE) {
606                 rb_erase(&label->node, &ls->root);
607                 label->flags &= ~FLAG_IN_TREE;
608                 return true;
609         }
610 
611         return false;
612 }
613 
614 /**
615  * __label_replace - replace @old with @new in label set
616  * @old: label to remove from label set
617  * @new: label to replace @old with
618  *
619  * Requires: labels_set(@old)->lock write_lock
620  *           valid ref count be held on @new
621  * Returns: true if @old was in set and replaced by @new
622  *
623  * Note: current implementation requires label set be order in such a way
624  *       that @new directly replaces @old position in the set (ie.
625  *       using pointer comparison of the label address would not work)
626  */
627 static bool __label_replace(struct aa_label *old, struct aa_label *new)
628 {
629         struct aa_labelset *ls = labels_set(old);
630 
631         AA_BUG(!ls);
632         AA_BUG(!old);
633         AA_BUG(!new);
634         lockdep_assert_held_write(&ls->lock);
635         AA_BUG(new->flags & FLAG_IN_TREE);
636 
637         if (!label_is_stale(old))
638                 __label_make_stale(old);
639 
640         if (old->flags & FLAG_IN_TREE) {
641                 rb_replace_node(&old->node, &new->node, &ls->root);
642                 old->flags &= ~FLAG_IN_TREE;
643                 new->flags |= FLAG_IN_TREE;
644                 return true;
645         }
646 
647         return false;
648 }
649 
650 /**
651  * __label_insert - attempt to insert @l into a label set
652  * @ls: set of labels to insert @l into (NOT NULL)
653  * @label: new label to insert (NOT NULL)
654  * @replace: whether insertion should replace existing entry that is not stale
655  *
656  * Requires: @ls->lock
657  *           caller to hold a valid ref on l
658  *           if @replace is true l has a preallocated proxy associated
659  * Returns: @l if successful in inserting @l - with additional refcount
660  *          else ref counted equivalent label that is already in the set,
661  *          the else condition only happens if @replace is false
662  */
663 static struct aa_label *__label_insert(struct aa_labelset *ls,
664                                        struct aa_label *label, bool replace)
665 {
666         struct rb_node **new, *parent = NULL;
667 
668         AA_BUG(!ls);
669         AA_BUG(!label);
670         AA_BUG(labels_set(label) != ls);
671         lockdep_assert_held_write(&ls->lock);
672         AA_BUG(label->flags & FLAG_IN_TREE);
673 
674         /* Figure out where to put new node */
675         new = &ls->root.rb_node;
676         while (*new) {
677                 struct aa_label *this = rb_entry(*new, struct aa_label, node);
678                 int result = label_cmp(label, this);
679 
680                 parent = *new;
681                 if (result == 0) {
682                         /* !__aa_get_label means queued for destruction,
683                          * so replace in place, however the label has
684                          * died before the replacement so do not share
685                          * the proxy
686                          */
687                         if (!replace && !label_is_stale(this)) {
688                                 if (__aa_get_label(this))
689                                         return this;
690                         } else
691                                 __proxy_share(this, label);
692                         AA_BUG(!__label_replace(this, label));
693                         return aa_get_label(label);
694                 } else if (result < 0)
695                         new = &((*new)->rb_left);
696                 else /* (result > 0) */
697                         new = &((*new)->rb_right);
698         }
699 
700         /* Add new node and rebalance tree. */
701         rb_link_node(&label->node, parent, new);
702         rb_insert_color(&label->node, &ls->root);
703         label->flags |= FLAG_IN_TREE;
704 
705         return aa_get_label(label);
706 }
707 
708 /**
709  * __vec_find - find label that matches @vec in label set
710  * @vec: vec of profiles to find matching label for (NOT NULL)
711  * @n: length of @vec
712  *
713  * Requires: @vec_labelset(vec) lock held
714  *           caller to hold a valid ref on l
715  *
716  * Returns: ref counted @label if matching label is in tree
717  *          ref counted label that is equiv to @l in tree
718  *     else NULL if @vec equiv is not in tree
719  */
720 static struct aa_label *__vec_find(struct aa_profile **vec, int n)
721 {
722         struct rb_node *node;
723 
724         AA_BUG(!vec);
725         AA_BUG(!*vec);
726         AA_BUG(n <= 0);
727 
728         node = vec_labelset(vec, n)->root.rb_node;
729         while (node) {
730                 struct aa_label *this = rb_entry(node, struct aa_label, node);
731                 int result = vec_cmp(this->vec, this->size, vec, n);
732 
733                 if (result > 0)
734                         node = node->rb_left;
735                 else if (result < 0)
736                         node = node->rb_right;
737                 else
738                         return __aa_get_label(this);
739         }
740 
741         return NULL;
742 }
743 
744 /**
745  * __label_find - find label @label in label set
746  * @label: label to find (NOT NULL)
747  *
748  * Requires: labels_set(@label)->lock held
749  *           caller to hold a valid ref on l
750  *
751  * Returns: ref counted @label if @label is in tree OR
752  *          ref counted label that is equiv to @label in tree
753  *     else NULL if @label or equiv is not in tree
754  */
755 static struct aa_label *__label_find(struct aa_label *label)
756 {
757         AA_BUG(!label);
758 
759         return __vec_find(label->vec, label->size);
760 }
761 
762 
763 /**
764  * aa_label_remove - remove a label from the labelset
765  * @label: label to remove
766  *
767  * Returns: true if @label was removed from the tree
768  *     else @label was not in tree so it could not be removed
769  */
770 bool aa_label_remove(struct aa_label *label)
771 {
772         struct aa_labelset *ls = labels_set(label);
773         unsigned long flags;
774         bool res;
775 
776         AA_BUG(!ls);
777 
778         write_lock_irqsave(&ls->lock, flags);
779         res = __label_remove(label, ns_unconfined(labels_ns(label)));
780         write_unlock_irqrestore(&ls->lock, flags);
781 
782         return res;
783 }
784 
785 /**
786  * aa_label_replace - replace a label @old with a new version @new
787  * @old: label to replace
788  * @new: label replacing @old
789  *
790  * Returns: true if @old was in tree and replaced
791  *     else @old was not in tree, and @new was not inserted
792  */
793 bool aa_label_replace(struct aa_label *old, struct aa_label *new)
794 {
795         unsigned long flags;
796         bool res;
797 
798         if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
799                 write_lock_irqsave(&labels_set(old)->lock, flags);
800                 if (old->proxy != new->proxy)
801                         __proxy_share(old, new);
802                 else
803                         __aa_proxy_redirect(old, new);
804                 res = __label_replace(old, new);
805                 write_unlock_irqrestore(&labels_set(old)->lock, flags);
806         } else {
807                 struct aa_label *l;
808                 struct aa_labelset *ls = labels_set(old);
809 
810                 write_lock_irqsave(&ls->lock, flags);
811                 res = __label_remove(old, new);
812                 if (labels_ns(old) != labels_ns(new)) {
813                         write_unlock_irqrestore(&ls->lock, flags);
814                         ls = labels_set(new);
815                         write_lock_irqsave(&ls->lock, flags);
816                 }
817                 l = __label_insert(ls, new, true);
818                 res = (l == new);
819                 write_unlock_irqrestore(&ls->lock, flags);
820                 aa_put_label(l);
821         }
822 
823         return res;
824 }
825 
826 /**
827  * vec_find - find label @l in label set
828  * @vec: array of profiles to find equiv label for (NOT NULL)
829  * @n: length of @vec
830  *
831  * Returns: refcounted label if @vec equiv is in tree
832  *     else NULL if @vec equiv is not in tree
833  */
834 static struct aa_label *vec_find(struct aa_profile **vec, int n)
835 {
836         struct aa_labelset *ls;
837         struct aa_label *label;
838         unsigned long flags;
839 
840         AA_BUG(!vec);
841         AA_BUG(!*vec);
842         AA_BUG(n <= 0);
843 
844         ls = vec_labelset(vec, n);
845         read_lock_irqsave(&ls->lock, flags);
846         label = __vec_find(vec, n);
847         read_unlock_irqrestore(&ls->lock, flags);
848 
849         return label;
850 }
851 
852 /* requires sort and merge done first */
853 static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
854                                                     int len, gfp_t gfp)
855 {
856         struct aa_label *label = NULL;
857         struct aa_labelset *ls;
858         unsigned long flags;
859         struct aa_label *new;
860         int i;
861 
862         AA_BUG(!vec);
863 
864         if (len == 1)
865                 return aa_get_label(&vec[0]->label);
866 
867         ls = labels_set(&vec[len - 1]->label);
868 
869         /* TODO: enable when read side is lockless
870          * check if label exists before taking locks
871          */
872         new = aa_label_alloc(len, NULL, gfp);
873         if (!new)
874                 return NULL;
875 
876         for (i = 0; i < len; i++)
877                 new->vec[i] = aa_get_profile(vec[i]);
878 
879         write_lock_irqsave(&ls->lock, flags);
880         label = __label_insert(ls, new, false);
881         write_unlock_irqrestore(&ls->lock, flags);
882         label_free_or_put_new(label, new);
883 
884         return label;
885 }
886 
887 struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
888                                              gfp_t gfp)
889 {
890         struct aa_label *label = vec_find(vec, len);
891 
892         if (label)
893                 return label;
894 
895         return vec_create_and_insert_label(vec, len, gfp);
896 }
897 
898 /**
899  * aa_label_find - find label @label in label set
900  * @label: label to find (NOT NULL)
901  *
902  * Requires: caller to hold a valid ref on l
903  *
904  * Returns: refcounted @label if @label is in tree
905  *          refcounted label that is equiv to @label in tree
906  *     else NULL if @label or equiv is not in tree
907  */
908 struct aa_label *aa_label_find(struct aa_label *label)
909 {
910         AA_BUG(!label);
911 
912         return vec_find(label->vec, label->size);
913 }
914 
915 
916 /**
917  * aa_label_insert - insert label @label into @ls or return existing label
918  * @ls - labelset to insert @label into
919  * @label - label to insert
920  *
921  * Requires: caller to hold a valid ref on @label
922  *
923  * Returns: ref counted @label if successful in inserting @label
924  *     else ref counted equivalent label that is already in the set
925  */
926 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
927 {
928         struct aa_label *l;
929         unsigned long flags;
930 
931         AA_BUG(!ls);
932         AA_BUG(!label);
933 
934         /* check if label exists before taking lock */
935         if (!label_is_stale(label)) {
936                 read_lock_irqsave(&ls->lock, flags);
937                 l = __label_find(label);
938                 read_unlock_irqrestore(&ls->lock, flags);
939                 if (l)
940                         return l;
941         }
942 
943         write_lock_irqsave(&ls->lock, flags);
944         l = __label_insert(ls, label, false);
945         write_unlock_irqrestore(&ls->lock, flags);
946 
947         return l;
948 }
949 
950 
951 /**
952  * aa_label_next_in_merge - find the next profile when merging @a and @b
953  * @I: label iterator
954  * @a: label to merge
955  * @b: label to merge
956  *
957  * Returns: next profile
958  *     else null if no more profiles
959  */
960 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
961                                           struct aa_label *a,
962                                           struct aa_label *b)
963 {
964         AA_BUG(!a);
965         AA_BUG(!b);
966         AA_BUG(!I);
967         AA_BUG(I->i < 0);
968         AA_BUG(I->i > a->size);
969         AA_BUG(I->j < 0);
970         AA_BUG(I->j > b->size);
971 
972         if (I->i < a->size) {
973                 if (I->j < b->size) {
974                         int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
975 
976                         if (res > 0)
977                                 return b->vec[(I->j)++];
978                         if (res == 0)
979                                 (I->j)++;
980                 }
981 
982                 return a->vec[(I->i)++];
983         }
984 
985         if (I->j < b->size)
986                 return b->vec[(I->j)++];
987 
988         return NULL;
989 }
990 
991 /**
992  * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
993  * @a: label to merge then compare (NOT NULL)
994  * @b: label to merge then compare (NOT NULL)
995  * @z: label to compare merge against (NOT NULL)
996  *
997  * Assumes: using the most recent versions of @a, @b, and @z
998  *
999  * Returns: <0  if a < b
1000  *          ==0 if a == b
1001  *          >0  if a > b
1002  */
1003 static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1004                            struct aa_label *z)
1005 {
1006         struct aa_profile *p = NULL;
1007         struct label_it i = { };
1008         int k;
1009 
1010         AA_BUG(!a);
1011         AA_BUG(!b);
1012         AA_BUG(!z);
1013 
1014         for (k = 0;
1015              k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1016              k++) {
1017                 int res = profile_cmp(p, z->vec[k]);
1018 
1019                 if (res != 0)
1020                         return res;
1021         }
1022 
1023         if (p)
1024                 return 1;
1025         else if (k < z->size)
1026                 return -1;
1027         return 0;
1028 }
1029 
1030 /**
1031  * label_merge_insert - create a new label by merging @a and @b
1032  * @new: preallocated label to merge into (NOT NULL)
1033  * @a: label to merge with @b  (NOT NULL)
1034  * @b: label to merge with @a  (NOT NULL)
1035  *
1036  * Requires: preallocated proxy
1037  *
1038  * Returns: ref counted label either @new if merge is unique
1039  *          @a if @b is a subset of @a
1040  *          @b if @a is a subset of @b
1041  *
1042  * NOTE: will not use @new if the merge results in @new == @a or @b
1043  *
1044  *       Must be used within labelset write lock to avoid racing with
1045  *       setting labels stale.
1046  */
1047 static struct aa_label *label_merge_insert(struct aa_label *new,
1048                                            struct aa_label *a,
1049                                            struct aa_label *b)
1050 {
1051         struct aa_label *label;
1052         struct aa_labelset *ls;
1053         struct aa_profile *next;
1054         struct label_it i;
1055         unsigned long flags;
1056         int k = 0, invcount = 0;
1057         bool stale = false;
1058 
1059         AA_BUG(!a);
1060         AA_BUG(a->size < 0);
1061         AA_BUG(!b);
1062         AA_BUG(b->size < 0);
1063         AA_BUG(!new);
1064         AA_BUG(new->size < a->size + b->size);
1065 
1066         label_for_each_in_merge(i, a, b, next) {
1067                 AA_BUG(!next);
1068                 if (profile_is_stale(next)) {
1069                         new->vec[k] = aa_get_newest_profile(next);
1070                         AA_BUG(!new->vec[k]->label.proxy);
1071                         AA_BUG(!new->vec[k]->label.proxy->label);
1072                         if (next->label.proxy != new->vec[k]->label.proxy)
1073                                 invcount++;
1074                         k++;
1075                         stale = true;
1076                 } else
1077                         new->vec[k++] = aa_get_profile(next);
1078         }
1079         /* set to actual size which is <= allocated len */
1080         new->size = k;
1081         new->vec[k] = NULL;
1082 
1083         if (invcount) {
1084                 new->size -= aa_vec_unique(&new->vec[0], new->size,
1085                                            VEC_FLAG_TERMINATE);
1086                 /* TODO: deal with reference labels */
1087                 if (new->size == 1) {
1088                         label = aa_get_label(&new->vec[0]->label);
1089                         return label;
1090                 }
1091         } else if (!stale) {
1092                 /*
1093                  * merge could be same as a || b, note: it is not possible
1094                  * for new->size == a->size == b->size unless a == b
1095                  */
1096                 if (k == a->size)
1097                         return aa_get_label(a);
1098                 else if (k == b->size)
1099                         return aa_get_label(b);
1100         }
1101         if (vec_unconfined(new->vec, new->size))
1102                 new->flags |= FLAG_UNCONFINED;
1103         ls = labels_set(new);
1104         write_lock_irqsave(&ls->lock, flags);
1105         label = __label_insert(labels_set(new), new, false);
1106         write_unlock_irqrestore(&ls->lock, flags);
1107 
1108         return label;
1109 }
1110 
1111 /**
1112  * labelset_of_merge - find which labelset a merged label should be inserted
1113  * @a: label to merge and insert
1114  * @b: label to merge and insert
1115  *
1116  * Returns: labelset that the merged label should be inserted into
1117  */
1118 static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1119                                              struct aa_label *b)
1120 {
1121         struct aa_ns *nsa = labels_ns(a);
1122         struct aa_ns *nsb = labels_ns(b);
1123 
1124         if (ns_cmp(nsa, nsb) <= 0)
1125                 return &nsa->labels;
1126         return &nsb->labels;
1127 }
1128 
1129 /**
1130  * __label_find_merge - find label that is equiv to merge of @a and @b
1131  * @ls: set of labels to search (NOT NULL)
1132  * @a: label to merge with @b  (NOT NULL)
1133  * @b: label to merge with @a  (NOT NULL)
1134  *
1135  * Requires: ls->lock read_lock held
1136  *
1137  * Returns: ref counted label that is equiv to merge of @a and @b
1138  *     else NULL if merge of @a and @b is not in set
1139  */
1140 static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1141                                            struct aa_label *a,
1142                                            struct aa_label *b)
1143 {
1144         struct rb_node *node;
1145 
1146         AA_BUG(!ls);
1147         AA_BUG(!a);
1148         AA_BUG(!b);
1149 
1150         if (a == b)
1151                 return __label_find(a);
1152 
1153         node  = ls->root.rb_node;
1154         while (node) {
1155                 struct aa_label *this = container_of(node, struct aa_label,
1156                                                      node);
1157                 int result = label_merge_cmp(a, b, this);
1158 
1159                 if (result < 0)
1160                         node = node->rb_left;
1161                 else if (result > 0)
1162                         node = node->rb_right;
1163                 else
1164                         return __aa_get_label(this);
1165         }
1166 
1167         return NULL;
1168 }
1169 
1170 
1171 /**
1172  * aa_label_find_merge - find label that is equiv to merge of @a and @b
1173  * @a: label to merge with @b  (NOT NULL)
1174  * @b: label to merge with @a  (NOT NULL)
1175  *
1176  * Requires: labels be fully constructed with a valid ns
1177  *
1178  * Returns: ref counted label that is equiv to merge of @a and @b
1179  *     else NULL if merge of @a and @b is not in set
1180  */
1181 struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1182 {
1183         struct aa_labelset *ls;
1184         struct aa_label *label, *ar = NULL, *br = NULL;
1185         unsigned long flags;
1186 
1187         AA_BUG(!a);
1188         AA_BUG(!b);
1189 
1190         if (label_is_stale(a))
1191                 a = ar = aa_get_newest_label(a);
1192         if (label_is_stale(b))
1193                 b = br = aa_get_newest_label(b);
1194         ls = labelset_of_merge(a, b);
1195         read_lock_irqsave(&ls->lock, flags);
1196         label = __label_find_merge(ls, a, b);
1197         read_unlock_irqrestore(&ls->lock, flags);
1198         aa_put_label(ar);
1199         aa_put_label(br);
1200 
1201         return label;
1202 }
1203 
1204 /**
1205  * aa_label_merge - attempt to insert new merged label of @a and @b
1206  * @ls: set of labels to insert label into (NOT NULL)
1207  * @a: label to merge with @b  (NOT NULL)
1208  * @b: label to merge with @a  (NOT NULL)
1209  * @gfp: memory allocation type
1210  *
1211  * Requires: caller to hold valid refs on @a and @b
1212  *           labels be fully constructed with a valid ns
1213  *
1214  * Returns: ref counted new label if successful in inserting merge of a & b
1215  *     else ref counted equivalent label that is already in the set.
1216  *     else NULL if could not create label (-ENOMEM)
1217  */
1218 struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1219                                 gfp_t gfp)
1220 {
1221         struct aa_label *label = NULL;
1222 
1223         AA_BUG(!a);
1224         AA_BUG(!b);
1225 
1226         if (a == b)
1227                 return aa_get_newest_label(a);
1228 
1229         /* TODO: enable when read side is lockless
1230          * check if label exists before taking locks
1231         if (!label_is_stale(a) && !label_is_stale(b))
1232                 label = aa_label_find_merge(a, b);
1233         */
1234 
1235         if (!label) {
1236                 struct aa_label *new;
1237 
1238                 a = aa_get_newest_label(a);
1239                 b = aa_get_newest_label(b);
1240 
1241                 /* could use label_merge_len(a, b), but requires double
1242                  * comparison for small savings
1243                  */
1244                 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1245                 if (!new)
1246                         goto out;
1247 
1248                 label = label_merge_insert(new, a, b);
1249                 label_free_or_put_new(label, new);
1250 out:
1251                 aa_put_label(a);
1252                 aa_put_label(b);
1253         }
1254 
1255         return label;
1256 }
1257 
1258 static inline bool label_is_visible(struct aa_profile *profile,
1259                                     struct aa_label *label)
1260 {
1261         return aa_ns_visible(profile->ns, labels_ns(label), true);
1262 }
1263 
1264 /* match a profile and its associated ns component if needed
1265  * Assumes visibility test has already been done.
1266  * If a subns profile is not to be matched should be prescreened with
1267  * visibility test.
1268  */
1269 static inline unsigned int match_component(struct aa_profile *profile,
1270                                            struct aa_profile *tp,
1271                                            unsigned int state)
1272 {
1273         const char *ns_name;
1274 
1275         if (profile->ns == tp->ns)
1276                 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1277 
1278         /* try matching with namespace name and then profile */
1279         ns_name = aa_ns_name(profile->ns, tp->ns, true);
1280         state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1281         state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1282         state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1283         return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1284 }
1285 
1286 /**
1287  * label_compound_match - find perms for full compound label
1288  * @profile: profile to find perms for
1289  * @label: label to check access permissions for
1290  * @start: state to start match in
1291  * @subns: whether to do permission checks on components in a subns
1292  * @request: permissions to request
1293  * @perms: perms struct to set
1294  *
1295  * Returns: 0 on success else ERROR
1296  *
1297  * For the label A//&B//&C this does the perm match for A//&B//&C
1298  * @perms should be preinitialized with allperms OR a previous permission
1299  *        check to be stacked.
1300  */
1301 static int label_compound_match(struct aa_profile *profile,
1302                                 struct aa_label *label,
1303                                 unsigned int state, bool subns, u32 request,
1304                                 struct aa_perms *perms)
1305 {
1306         struct aa_profile *tp;
1307         struct label_it i;
1308 
1309         /* find first subcomponent that is visible */
1310         label_for_each(i, label, tp) {
1311                 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1312                         continue;
1313                 state = match_component(profile, tp, state);
1314                 if (!state)
1315                         goto fail;
1316                 goto next;
1317         }
1318 
1319         /* no component visible */
1320         *perms = allperms;
1321         return 0;
1322 
1323 next:
1324         label_for_each_cont(i, label, tp) {
1325                 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1326                         continue;
1327                 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1328                 state = match_component(profile, tp, state);
1329                 if (!state)
1330                         goto fail;
1331         }
1332         aa_compute_perms(profile->policy.dfa, state, perms);
1333         aa_apply_modes_to_perms(profile, perms);
1334         if ((perms->allow & request) != request)
1335                 return -EACCES;
1336 
1337         return 0;
1338 
1339 fail:
1340         *perms = nullperms;
1341         return state;
1342 }
1343 
1344 /**
1345  * label_components_match - find perms for all subcomponents of a label
1346  * @profile: profile to find perms for
1347  * @label: label to check access permissions for
1348  * @start: state to start match in
1349  * @subns: whether to do permission checks on components in a subns
1350  * @request: permissions to request
1351  * @perms: an initialized perms struct to add accumulation to
1352  *
1353  * Returns: 0 on success else ERROR
1354  *
1355  * For the label A//&B//&C this does the perm match for each of A and B and C
1356  * @perms should be preinitialized with allperms OR a previous permission
1357  *        check to be stacked.
1358  */
1359 static int label_components_match(struct aa_profile *profile,
1360                                   struct aa_label *label, unsigned int start,
1361                                   bool subns, u32 request,
1362                                   struct aa_perms *perms)
1363 {
1364         struct aa_profile *tp;
1365         struct label_it i;
1366         struct aa_perms tmp;
1367         unsigned int state = 0;
1368 
1369         /* find first subcomponent to test */
1370         label_for_each(i, label, tp) {
1371                 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1372                         continue;
1373                 state = match_component(profile, tp, start);
1374                 if (!state)
1375                         goto fail;
1376                 goto next;
1377         }
1378 
1379         /* no subcomponents visible - no change in perms */
1380         return 0;
1381 
1382 next:
1383         aa_compute_perms(profile->policy.dfa, state, &tmp);
1384         aa_apply_modes_to_perms(profile, &tmp);
1385         aa_perms_accum(perms, &tmp);
1386         label_for_each_cont(i, label, tp) {
1387                 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1388                         continue;
1389                 state = match_component(profile, tp, start);
1390                 if (!state)
1391                         goto fail;
1392                 aa_compute_perms(profile->policy.dfa, state, &tmp);
1393                 aa_apply_modes_to_perms(profile, &tmp);
1394                 aa_perms_accum(perms, &tmp);
1395         }
1396 
1397         if ((perms->allow & request) != request)
1398                 return -EACCES;
1399 
1400         return 0;
1401 
1402 fail:
1403         *perms = nullperms;
1404         return -EACCES;
1405 }
1406 
1407 /**
1408  * aa_label_match - do a multi-component label match
1409  * @profile: profile to match against (NOT NULL)
1410  * @label: label to match (NOT NULL)
1411  * @state: state to start in
1412  * @subns: whether to match subns components
1413  * @request: permission request
1414  * @perms: Returns computed perms (NOT NULL)
1415  *
1416  * Returns: the state the match finished in, may be the none matching state
1417  */
1418 int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1419                    unsigned int state, bool subns, u32 request,
1420                    struct aa_perms *perms)
1421 {
1422         int error = label_compound_match(profile, label, state, subns, request,
1423                                          perms);
1424         if (!error)
1425                 return error;
1426 
1427         *perms = allperms;
1428         return label_components_match(profile, label, state, subns, request,
1429                                       perms);
1430 }
1431 
1432 
1433 /**
1434  * aa_update_label_name - update a label to have a stored name
1435  * @ns: ns being viewed from (NOT NULL)
1436  * @label: label to update (NOT NULL)
1437  * @gfp: type of memory allocation
1438  *
1439  * Requires: labels_set(label) not locked in caller
1440  *
1441  * note: only updates the label name if it does not have a name already
1442  *       and if it is in the labelset
1443  */
1444 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1445 {
1446         struct aa_labelset *ls;
1447         unsigned long flags;
1448         char __counted *name;
1449         bool res = false;
1450 
1451         AA_BUG(!ns);
1452         AA_BUG(!label);
1453 
1454         if (label->hname || labels_ns(label) != ns)
1455                 return res;
1456 
1457         if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1458                 return res;
1459 
1460         ls = labels_set(label);
1461         write_lock_irqsave(&ls->lock, flags);
1462         if (!label->hname && label->flags & FLAG_IN_TREE) {
1463                 label->hname = name;
1464                 res = true;
1465         } else
1466                 aa_put_str(name);
1467         write_unlock_irqrestore(&ls->lock, flags);
1468 
1469         return res;
1470 }
1471 
1472 /*
1473  * cached label name is present and visible
1474  * @label->hname only exists if label is namespace hierachical
1475  */
1476 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1477                                    int flags)
1478 {
1479         if (label->hname && (!ns || labels_ns(label) == ns) &&
1480             !(flags & ~FLAG_SHOW_MODE))
1481                 return true;
1482 
1483         return false;
1484 }
1485 
1486 /* helper macro for snprint routines */
1487 #define update_for_len(total, len, size, str)   \
1488 do {                                    \
1489         size_t ulen = len;              \
1490                                         \
1491         AA_BUG(len < 0);                \
1492         total += ulen;                  \
1493         ulen = min(ulen, size);         \
1494         size -= ulen;                   \
1495         str += ulen;                    \
1496 } while (0)
1497 
1498 /**
1499  * aa_profile_snxprint - print a profile name to a buffer
1500  * @str: buffer to write to. (MAY BE NULL if @size == 0)
1501  * @size: size of buffer
1502  * @view: namespace profile is being viewed from
1503  * @profile: profile to view (NOT NULL)
1504  * @flags: whether to include the mode string
1505  * @prev_ns: last ns printed when used in compound print
1506  *
1507  * Returns: size of name written or would be written if larger than
1508  *          available buffer
1509  *
1510  * Note: will not print anything if the profile is not visible
1511  */
1512 static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1513                                struct aa_profile *profile, int flags,
1514                                struct aa_ns **prev_ns)
1515 {
1516         const char *ns_name = NULL;
1517 
1518         AA_BUG(!str && size != 0);
1519         AA_BUG(!profile);
1520 
1521         if (!view)
1522                 view = profiles_ns(profile);
1523 
1524         if (view != profile->ns &&
1525             (!prev_ns || (*prev_ns != profile->ns))) {
1526                 if (prev_ns)
1527                         *prev_ns = profile->ns;
1528                 ns_name = aa_ns_name(view, profile->ns,
1529                                      flags & FLAG_VIEW_SUBNS);
1530                 if (ns_name == aa_hidden_ns_name) {
1531                         if (flags & FLAG_HIDDEN_UNCONFINED)
1532                                 return snprintf(str, size, "%s", "unconfined");
1533                         return snprintf(str, size, "%s", ns_name);
1534                 }
1535         }
1536 
1537         if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1538                 const char *modestr = aa_profile_mode_names[profile->mode];
1539 
1540                 if (ns_name)
1541                         return snprintf(str, size, ":%s:%s (%s)", ns_name,
1542                                         profile->base.hname, modestr);
1543                 return snprintf(str, size, "%s (%s)", profile->base.hname,
1544                                 modestr);
1545         }
1546 
1547         if (ns_name)
1548                 return snprintf(str, size, ":%s:%s", ns_name,
1549                                 profile->base.hname);
1550         return snprintf(str, size, "%s", profile->base.hname);
1551 }
1552 
1553 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1554                                   int flags)
1555 {
1556         struct aa_profile *profile;
1557         struct label_it i;
1558         int mode = -1, count = 0;
1559 
1560         label_for_each(i, label, profile) {
1561                 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1562                         count++;
1563                         if (profile == profile->ns->unconfined)
1564                                 /* special case unconfined so stacks with
1565                                  * unconfined don't report as mixed. ie.
1566                                  * profile_foo//&:ns1:unconfined (mixed)
1567                                  */
1568                                 continue;
1569                         if (mode == -1)
1570                                 mode = profile->mode;
1571                         else if (mode != profile->mode)
1572                                 return "mixed";
1573                 }
1574         }
1575 
1576         if (count == 0)
1577                 return "-";
1578         if (mode == -1)
1579                 /* everything was unconfined */
1580                 mode = APPARMOR_UNCONFINED;
1581 
1582         return aa_profile_mode_names[mode];
1583 }
1584 
1585 /* if any visible label is not unconfined the display_mode returns true */
1586 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1587                                 int flags)
1588 {
1589         if ((flags & FLAG_SHOW_MODE)) {
1590                 struct aa_profile *profile;
1591                 struct label_it i;
1592 
1593                 label_for_each(i, label, profile) {
1594                         if (aa_ns_visible(ns, profile->ns,
1595                                           flags & FLAG_VIEW_SUBNS) &&
1596                             profile != profile->ns->unconfined)
1597                                 return true;
1598                 }
1599                 /* only ns->unconfined in set of profiles in ns */
1600                 return false;
1601         }
1602 
1603         return false;
1604 }
1605 
1606 /**
1607  * aa_label_snxprint - print a label name to a string buffer
1608  * @str: buffer to write to. (MAY BE NULL if @size == 0)
1609  * @size: size of buffer
1610  * @ns: namespace profile is being viewed from
1611  * @label: label to view (NOT NULL)
1612  * @flags: whether to include the mode string
1613  *
1614  * Returns: size of name written or would be written if larger than
1615  *          available buffer
1616  *
1617  * Note: labels do not have to be strictly hierarchical to the ns as
1618  *       objects may be shared across different namespaces and thus
1619  *       pickup labeling from each ns.  If a particular part of the
1620  *       label is not visible it will just be excluded.  And if none
1621  *       of the label is visible "---" will be used.
1622  */
1623 int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1624                       struct aa_label *label, int flags)
1625 {
1626         struct aa_profile *profile;
1627         struct aa_ns *prev_ns = NULL;
1628         struct label_it i;
1629         int count = 0, total = 0;
1630         ssize_t len;
1631 
1632         AA_BUG(!str && size != 0);
1633         AA_BUG(!label);
1634 
1635         if (flags & FLAG_ABS_ROOT) {
1636                 ns = root_ns;
1637                 len = snprintf(str, size, "=");
1638                 update_for_len(total, len, size, str);
1639         } else if (!ns) {
1640                 ns = labels_ns(label);
1641         }
1642 
1643         label_for_each(i, label, profile) {
1644                 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1645                         if (count > 0) {
1646                                 len = snprintf(str, size, "//&");
1647                                 update_for_len(total, len, size, str);
1648                         }
1649                         len = aa_profile_snxprint(str, size, ns, profile,
1650                                                   flags & FLAG_VIEW_SUBNS,
1651                                                   &prev_ns);
1652                         update_for_len(total, len, size, str);
1653                         count++;
1654                 }
1655         }
1656 
1657         if (count == 0) {
1658                 if (flags & FLAG_HIDDEN_UNCONFINED)
1659                         return snprintf(str, size, "%s", "unconfined");
1660                 return snprintf(str, size, "%s", aa_hidden_ns_name);
1661         }
1662 
1663         /* count == 1 && ... is for backwards compat where the mode
1664          * is not displayed for 'unconfined' in the current ns
1665          */
1666         if (display_mode(ns, label, flags)) {
1667                 len = snprintf(str, size, " (%s)",
1668                                label_modename(ns, label, flags));
1669                 update_for_len(total, len, size, str);
1670         }
1671 
1672         return total;
1673 }
1674 #undef update_for_len
1675 
1676 /**
1677  * aa_label_asxprint - allocate a string buffer and print label into it
1678  * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1679  * @ns: namespace profile is being viewed from
1680  * @label: label to view (NOT NULL)
1681  * @flags: flags controlling what label info is printed
1682  * @gfp: kernel memory allocation type
1683  *
1684  * Returns: size of name written or would be written if larger than
1685  *          available buffer
1686  */
1687 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1688                       int flags, gfp_t gfp)
1689 {
1690         int size;
1691 
1692         AA_BUG(!strp);
1693         AA_BUG(!label);
1694 
1695         size = aa_label_snxprint(NULL, 0, ns, label, flags);
1696         if (size < 0)
1697                 return size;
1698 
1699         *strp = kmalloc(size + 1, gfp);
1700         if (!*strp)
1701                 return -ENOMEM;
1702         return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1703 }
1704 
1705 /**
1706  * aa_label_acntsxprint - allocate a __counted string buffer and print label
1707  * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1708  * @ns: namespace profile is being viewed from
1709  * @label: label to view (NOT NULL)
1710  * @flags: flags controlling what label info is printed
1711  * @gfp: kernel memory allocation type
1712  *
1713  * Returns: size of name written or would be written if larger than
1714  *          available buffer
1715  */
1716 int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1717                          struct aa_label *label, int flags, gfp_t gfp)
1718 {
1719         int size;
1720 
1721         AA_BUG(!strp);
1722         AA_BUG(!label);
1723 
1724         size = aa_label_snxprint(NULL, 0, ns, label, flags);
1725         if (size < 0)
1726                 return size;
1727 
1728         *strp = aa_str_alloc(size + 1, gfp);
1729         if (!*strp)
1730                 return -ENOMEM;
1731         return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1732 }
1733 
1734 
1735 void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1736                      struct aa_label *label, int flags, gfp_t gfp)
1737 {
1738         const char *str;
1739         char *name = NULL;
1740         int len;
1741 
1742         AA_BUG(!ab);
1743         AA_BUG(!label);
1744 
1745         if (!use_label_hname(ns, label, flags) ||
1746             display_mode(ns, label, flags)) {
1747                 len  = aa_label_asxprint(&name, ns, label, flags, gfp);
1748                 if (len == -1) {
1749                         AA_DEBUG("label print error");
1750                         return;
1751                 }
1752                 str = name;
1753         } else {
1754                 str = (char *) label->hname;
1755                 len = strlen(str);
1756         }
1757         if (audit_string_contains_control(str, len))
1758                 audit_log_n_hex(ab, str, len);
1759         else
1760                 audit_log_n_string(ab, str, len);
1761 
1762         kfree(name);
1763 }
1764 
1765 void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1766                          struct aa_label *label, int flags, gfp_t gfp)
1767 {
1768         AA_BUG(!f);
1769         AA_BUG(!label);
1770 
1771         if (!use_label_hname(ns, label, flags)) {
1772                 char *str;
1773                 int len;
1774 
1775                 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1776                 if (len == -1) {
1777                         AA_DEBUG("label print error");
1778                         return;
1779                 }
1780                 seq_puts(f, str);
1781                 kfree(str);
1782         } else if (display_mode(ns, label, flags))
1783                 seq_printf(f, "%s (%s)", label->hname,
1784                            label_modename(ns, label, flags));
1785         else
1786                 seq_puts(f, label->hname);
1787 }
1788 
1789 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1790                       gfp_t gfp)
1791 {
1792         AA_BUG(!label);
1793 
1794         if (!use_label_hname(ns, label, flags)) {
1795                 char *str;
1796                 int len;
1797 
1798                 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1799                 if (len == -1) {
1800                         AA_DEBUG("label print error");
1801                         return;
1802                 }
1803                 pr_info("%s", str);
1804                 kfree(str);
1805         } else if (display_mode(ns, label, flags))
1806                 pr_info("%s (%s)", label->hname,
1807                        label_modename(ns, label, flags));
1808         else
1809                 pr_info("%s", label->hname);
1810 }
1811 
1812 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1813 {
1814         struct aa_ns *ns = aa_get_current_ns();
1815 
1816         aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1817         aa_put_ns(ns);
1818 }
1819 
1820 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1821 {
1822         struct aa_ns *ns = aa_get_current_ns();
1823 
1824         aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1825         aa_put_ns(ns);
1826 }
1827 
1828 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1829 {
1830         struct aa_ns *ns = aa_get_current_ns();
1831 
1832         aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1833         aa_put_ns(ns);
1834 }
1835 
1836 static int label_count_strn_entries(const char *str, size_t n)
1837 {
1838         const char *end = str + n;
1839         const char *split;
1840         int count = 1;
1841 
1842         AA_BUG(!str);
1843 
1844         for (split = aa_label_strn_split(str, end - str);
1845              split;
1846              split = aa_label_strn_split(str, end - str)) {
1847                 count++;
1848                 str = split + 3;
1849         }
1850 
1851         return count;
1852 }
1853 
1854 /*
1855  * ensure stacks with components like
1856  *   :ns:A//&B
1857  * have :ns: applied to both 'A' and 'B' by making the lookup relative
1858  * to the base if the lookup specifies an ns, else making the stacked lookup
1859  * relative to the last embedded ns in the string.
1860  */
1861 static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1862                                             struct aa_label *currentbase,
1863                                             const char *str, size_t n)
1864 {
1865         const char *first = skipn_spaces(str, n);
1866 
1867         if (first && *first == ':')
1868                 return aa_fqlookupn_profile(base, str, n);
1869 
1870         return aa_fqlookupn_profile(currentbase, str, n);
1871 }
1872 
1873 /**
1874  * aa_label_strn_parse - parse, validate and convert a text string to a label
1875  * @base: base label to use for lookups (NOT NULL)
1876  * @str: null terminated text string (NOT NULL)
1877  * @n: length of str to parse, will stop at \0 if encountered before n
1878  * @gfp: allocation type
1879  * @create: true if should create compound labels if they don't exist
1880  * @force_stack: true if should stack even if no leading &
1881  *
1882  * Returns: the matching refcounted label if present
1883  *     else ERRPTR
1884  */
1885 struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1886                                      size_t n, gfp_t gfp, bool create,
1887                                      bool force_stack)
1888 {
1889         DEFINE_VEC(profile, vec);
1890         struct aa_label *label, *currbase = base;
1891         int i, len, stack = 0, error;
1892         const char *end = str + n;
1893         const char *split;
1894 
1895         AA_BUG(!base);
1896         AA_BUG(!str);
1897 
1898         str = skipn_spaces(str, n);
1899         if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1900                 return ERR_PTR(-EINVAL);
1901 
1902         len = label_count_strn_entries(str, end - str);
1903         if (*str == '&' || force_stack) {
1904                 /* stack on top of base */
1905                 stack = base->size;
1906                 len += stack;
1907                 if (*str == '&')
1908                         str++;
1909         }
1910 
1911         error = vec_setup(profile, vec, len, gfp);
1912         if (error)
1913                 return ERR_PTR(error);
1914 
1915         for (i = 0; i < stack; i++)
1916                 vec[i] = aa_get_profile(base->vec[i]);
1917 
1918         for (split = aa_label_strn_split(str, end - str), i = stack;
1919              split && i < len; i++) {
1920                 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1921                 if (!vec[i])
1922                         goto fail;
1923                 /*
1924                  * if component specified a new ns it becomes the new base
1925                  * so that subsequent lookups are relative to it
1926                  */
1927                 if (vec[i]->ns != labels_ns(currbase))
1928                         currbase = &vec[i]->label;
1929                 str = split + 3;
1930                 split = aa_label_strn_split(str, end - str);
1931         }
1932         /* last element doesn't have a split */
1933         if (i < len) {
1934                 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1935                 if (!vec[i])
1936                         goto fail;
1937         }
1938         if (len == 1)
1939                 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1940                 return &vec[0]->label;
1941 
1942         len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1943         /* TODO: deal with reference labels */
1944         if (len == 1) {
1945                 label = aa_get_label(&vec[0]->label);
1946                 goto out;
1947         }
1948 
1949         if (create)
1950                 label = aa_vec_find_or_create_label(vec, len, gfp);
1951         else
1952                 label = vec_find(vec, len);
1953         if (!label)
1954                 goto fail;
1955 
1956 out:
1957         /* use adjusted len from after vec_unique, not original */
1958         vec_cleanup(profile, vec, len);
1959         return label;
1960 
1961 fail:
1962         label = ERR_PTR(-ENOENT);
1963         goto out;
1964 }
1965 
1966 struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1967                                 gfp_t gfp, bool create, bool force_stack)
1968 {
1969         return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1970                                    force_stack);
1971 }
1972 
1973 /**
1974  * aa_labelset_destroy - remove all labels from the label set
1975  * @ls: label set to cleanup (NOT NULL)
1976  *
1977  * Labels that are removed from the set may still exist beyond the set
1978  * being destroyed depending on their reference counting
1979  */
1980 void aa_labelset_destroy(struct aa_labelset *ls)
1981 {
1982         struct rb_node *node;
1983         unsigned long flags;
1984 
1985         AA_BUG(!ls);
1986 
1987         write_lock_irqsave(&ls->lock, flags);
1988         for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1989                 struct aa_label *this = rb_entry(node, struct aa_label, node);
1990 
1991                 if (labels_ns(this) != root_ns)
1992                         __label_remove(this,
1993                                        ns_unconfined(labels_ns(this)->parent));
1994                 else
1995                         __label_remove(this, NULL);
1996         }
1997         write_unlock_irqrestore(&ls->lock, flags);
1998 }
1999 
2000 /*
2001  * @ls: labelset to init (NOT NULL)
2002  */
2003 void aa_labelset_init(struct aa_labelset *ls)
2004 {
2005         AA_BUG(!ls);
2006 
2007         rwlock_init(&ls->lock);
2008         ls->root = RB_ROOT;
2009 }
2010 
2011 static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2012 {
2013         struct aa_label *label;
2014         struct rb_node *node;
2015         unsigned long flags;
2016 
2017         AA_BUG(!ls);
2018 
2019         read_lock_irqsave(&ls->lock, flags);
2020 
2021         __labelset_for_each(ls, node) {
2022                 label = rb_entry(node, struct aa_label, node);
2023                 if ((label_is_stale(label) ||
2024                      vec_is_stale(label->vec, label->size)) &&
2025                     __aa_get_label(label))
2026                         goto out;
2027 
2028         }
2029         label = NULL;
2030 
2031 out:
2032         read_unlock_irqrestore(&ls->lock, flags);
2033 
2034         return label;
2035 }
2036 
2037 /**
2038  * __label_update - insert updated version of @label into labelset
2039  * @label - the label to update/replace
2040  *
2041  * Returns: new label that is up to date
2042  *     else NULL on failure
2043  *
2044  * Requires: @ns lock be held
2045  *
2046  * Note: worst case is the stale @label does not get updated and has
2047  *       to be updated at a later time.
2048  */
2049 static struct aa_label *__label_update(struct aa_label *label)
2050 {
2051         struct aa_label *new, *tmp;
2052         struct aa_labelset *ls;
2053         unsigned long flags;
2054         int i, invcount = 0;
2055 
2056         AA_BUG(!label);
2057         AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2058 
2059         new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2060         if (!new)
2061                 return NULL;
2062 
2063         /*
2064          * while holding the ns_lock will stop profile replacement, removal,
2065          * and label updates, label merging and removal can be occurring
2066          */
2067         ls = labels_set(label);
2068         write_lock_irqsave(&ls->lock, flags);
2069         for (i = 0; i < label->size; i++) {
2070                 AA_BUG(!label->vec[i]);
2071                 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2072                 AA_BUG(!new->vec[i]);
2073                 AA_BUG(!new->vec[i]->label.proxy);
2074                 AA_BUG(!new->vec[i]->label.proxy->label);
2075                 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2076                         invcount++;
2077         }
2078 
2079         /* updated stale label by being removed/renamed from labelset */
2080         if (invcount) {
2081                 new->size -= aa_vec_unique(&new->vec[0], new->size,
2082                                            VEC_FLAG_TERMINATE);
2083                 /* TODO: deal with reference labels */
2084                 if (new->size == 1) {
2085                         tmp = aa_get_label(&new->vec[0]->label);
2086                         AA_BUG(tmp == label);
2087                         goto remove;
2088                 }
2089                 if (labels_set(label) != labels_set(new)) {
2090                         write_unlock_irqrestore(&ls->lock, flags);
2091                         tmp = aa_label_insert(labels_set(new), new);
2092                         write_lock_irqsave(&ls->lock, flags);
2093                         goto remove;
2094                 }
2095         } else
2096                 AA_BUG(labels_ns(label) != labels_ns(new));
2097 
2098         tmp = __label_insert(labels_set(label), new, true);
2099 remove:
2100         /* ensure label is removed, and redirected correctly */
2101         __label_remove(label, tmp);
2102         write_unlock_irqrestore(&ls->lock, flags);
2103         label_free_or_put_new(tmp, new);
2104 
2105         return tmp;
2106 }
2107 
2108 /**
2109  * __labelset_update - update labels in @ns
2110  * @ns: namespace to update labels in  (NOT NULL)
2111  *
2112  * Requires: @ns lock be held
2113  *
2114  * Walk the labelset ensuring that all labels are up to date and valid
2115  * Any label that has a stale component is marked stale and replaced and
2116  * by an updated version.
2117  *
2118  * If failures happen due to memory pressures then stale labels will
2119  * be left in place until the next pass.
2120  */
2121 static void __labelset_update(struct aa_ns *ns)
2122 {
2123         struct aa_label *label;
2124 
2125         AA_BUG(!ns);
2126         AA_BUG(!mutex_is_locked(&ns->lock));
2127 
2128         do {
2129                 label = labelset_next_stale(&ns->labels);
2130                 if (label) {
2131                         struct aa_label *l = __label_update(label);
2132 
2133                         aa_put_label(l);
2134                         aa_put_label(label);
2135                 }
2136         } while (label);
2137 }
2138 
2139 /**
2140  * __aa_labelset_udate_subtree - update all labels with a stale component
2141  * @ns: ns to start update at (NOT NULL)
2142  *
2143  * Requires: @ns lock be held
2144  *
2145  * Invalidates labels based on @p in @ns and any children namespaces.
2146  */
2147 void __aa_labelset_update_subtree(struct aa_ns *ns)
2148 {
2149         struct aa_ns *child;
2150 
2151         AA_BUG(!ns);
2152         AA_BUG(!mutex_is_locked(&ns->lock));
2153 
2154         __labelset_update(ns);
2155 
2156         list_for_each_entry(child, &ns->sub_ns, base.list) {
2157                 mutex_lock_nested(&child->lock, child->level);
2158                 __aa_labelset_update_subtree(child);
2159                 mutex_unlock(&child->lock);
2160         }
2161 }
2162 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp