Lines Matching full:profile
33 * may_change_ptraced_domain - check if can change profile on ptraced task
35 * @to_label: profile to change to (NOT NULL)
82 /* match a profile and its associated ns component if needed
84 * If a subns profile is not to be matched should be prescreened with
87 static inline aa_state_t match_component(struct aa_profile *profile, in match_component() argument
91 struct aa_ruleset *rules = list_first_entry(&profile->rules, in match_component()
97 if (profile->ns == tp->ns) in match_component()
100 /* try matching with namespace name and then profile */ in match_component()
101 ns_name = aa_ns_name(profile->ns, tp->ns, true); in match_component()
110 * @profile: profile to find perms for
124 static int label_compound_match(struct aa_profile *profile, in label_compound_match() argument
129 struct aa_ruleset *rules = list_first_entry(&profile->rules, in label_compound_match()
137 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
139 state = match_component(profile, tp, stack, state); in label_compound_match()
151 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
154 state = match_component(profile, tp, false, state); in label_compound_match()
159 aa_apply_modes_to_perms(profile, perms); in label_compound_match()
172 * @profile: profile to find perms for
186 static int label_components_match(struct aa_profile *profile, in label_components_match() argument
191 struct aa_ruleset *rules = list_first_entry(&profile->rules, in label_components_match()
201 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
203 state = match_component(profile, tp, stack, start); in label_components_match()
214 aa_apply_modes_to_perms(profile, &tmp); in label_components_match()
217 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
219 state = match_component(profile, tp, stack, start); in label_components_match()
223 aa_apply_modes_to_perms(profile, &tmp); in label_components_match()
239 * @profile: profile to match against (NOT NULL)
249 static int label_match(struct aa_profile *profile, struct aa_label *label, in label_match() argument
256 error = label_compound_match(profile, label, stack, state, subns, in label_match()
262 return label_components_match(profile, label, stack, state, subns, in label_match()
270 * @profile: the current profile (NOT NULL)
282 static int change_profile_perms(struct aa_profile *profile, in change_profile_perms() argument
287 if (profile_unconfined(profile)) { in change_profile_perms()
293 /* TODO: add profile in ns screening */ in change_profile_perms()
294 return label_match(profile, target, stack, start, true, request, perms); in change_profile_perms()
298 * aa_xattrs_match - check whether a file matches the xattrs defined in profile
300 * @profile: profile to match against (NOT NULL)
306 struct aa_profile *profile, aa_state_t state) in aa_xattrs_match() argument
311 struct aa_attachment *attach = &profile->attach; in aa_xattrs_match()
371 * @head - profile list to walk (NOT NULL)
390 struct aa_profile *profile, *candidate = NULL; in find_attach() local
397 list_for_each_entry_rcu(profile, head, base.list) { in find_attach()
398 struct aa_attachment *attach = &profile->attach; in find_attach()
400 if (profile->label.flags & FLAG_NULL && in find_attach()
401 &profile->label == ns_unconfined(profile->ns)) in find_attach()
404 /* Find the "best" matching profile. Profiles must in find_attach()
412 * as another profile, signal a conflict and refuse to in find_attach()
435 if (!aa_get_profile_not0(profile)) in find_attach()
438 ret = aa_xattrs_match(bprm, profile, in find_attach()
441 aa_put_profile(profile); in find_attach()
470 candidate = profile; in find_attach()
475 } else if (!strcmp(profile->base.name, name)) { in find_attach()
480 candidate = profile; in find_attach()
487 *info = "conflicting profile attachments"; in find_attach()
506 * @profile: current profile (NOT NULL)
512 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex, in x_table_lookup() argument
515 struct aa_ruleset *rules = list_first_entry(&profile->rules, in x_table_lookup()
532 new_profile = aa_find_child(profile, *name); in x_table_lookup()
537 label = aa_label_parse(&profile->label, *name, GFP_KERNEL, in x_table_lookup()
550 * @profile: current profile (NOT NULL)
560 static struct aa_label *x_to_label(struct aa_profile *profile, in x_to_label() argument
566 struct aa_ruleset *rules = list_first_entry(&profile->rules, in x_to_label()
569 struct aa_ns *ns = profile->ns; in x_to_label()
583 new = x_table_lookup(profile, xindex, lookupname); in x_to_label()
591 new = find_attach(bprm, ns, &profile->base.profiles, in x_to_label()
603 /* (p|c|n)ix - don't change profile but do in x_to_label()
607 /* no profile && no error */ in x_to_label()
608 new = aa_get_newest_label(&profile->label); in x_to_label()
610 new = aa_get_newest_label(ns_unconfined(profile->ns)); in x_to_label()
630 struct aa_profile *profile, in profile_transition() argument
635 struct aa_ruleset *rules = list_first_entry(&profile->rules, in profile_transition()
644 AA_BUG(!profile); in profile_transition()
648 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, in profile_transition()
649 &name, &info, profile->disconnected); in profile_transition()
651 if (profile_unconfined(profile) || in profile_transition()
652 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_transition()
655 new = aa_get_newest_label(&profile->label); in profile_transition()
661 if (profile_unconfined(profile)) { in profile_transition()
662 new = find_attach(bprm, profile->ns, in profile_transition()
663 &profile->ns->base.profiles, name, &info); in profile_transition()
669 return aa_get_newest_label(&profile->label); in profile_transition()
676 new = x_to_label(profile, bprm, name, perms.xindex, &target, in profile_transition()
678 if (new && new->proxy == profile->label.proxy && info) { in profile_transition()
683 info = "profile transition not found"; in profile_transition()
687 } else if (COMPLAIN_MODE(profile)) { in profile_transition()
691 new_profile = aa_new_learning_profile(profile, false, name, in profile_transition()
695 info = "could not create null profile"; in profile_transition()
712 " for %s profile=", name); in profile_transition()
720 aa_audit_file(subj_cred, profile, &perms, OP_EXEC, MAY_EXEC, name, in profile_transition()
732 struct aa_profile *profile, struct aa_label *onexec, in profile_onexec() argument
737 struct aa_ruleset *rules = list_first_entry(&profile->rules, in profile_onexec()
744 AA_BUG(!profile); in profile_onexec()
749 if (profile_unconfined(profile)) { in profile_onexec()
759 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, in profile_onexec()
760 &xname, &info, profile->disconnected); in profile_onexec()
762 if (profile_unconfined(profile) || in profile_onexec()
763 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_onexec()
782 error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC, in profile_onexec()
800 return aa_audit_file(subj_cred, profile, &perms, OP_EXEC, in profile_onexec()
814 struct aa_profile *profile; in handle_onexec() local
824 error = fn_for_each_in_ns(label, profile, in handle_onexec()
825 profile_onexec(subj_cred, profile, onexec, stack, in handle_onexec()
829 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
831 profile_transition(subj_cred, profile, bprm, in handle_onexec()
837 error = fn_for_each_in_ns(label, profile, in handle_onexec()
838 profile_onexec(subj_cred, profile, onexec, stack, bprm, in handle_onexec()
842 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
843 aa_label_merge(&profile->label, onexec, in handle_onexec()
845 profile_transition(subj_cred, profile, bprm, in handle_onexec()
854 error = fn_for_each_in_ns(label, profile, in handle_onexec()
855 aa_audit_file(subj_cred, profile, &nullperms, in handle_onexec()
876 struct aa_profile *profile; in apparmor_bprm_creds_for_exec() local
918 new = fn_label_build(label, profile, GFP_KERNEL, in apparmor_bprm_creds_for_exec()
919 profile_transition(subj_cred, profile, bprm, in apparmor_bprm_creds_for_exec()
954 /* TODO: test needs to be profile of label to new */ in apparmor_bprm_creds_for_exec()
991 error = fn_for_each(label, profile, in apparmor_bprm_creds_for_exec()
992 aa_audit_file(current_cred(), profile, &nullperms, in apparmor_bprm_creds_for_exec()
1001 * Functions for self directed profile change
1010 struct aa_profile *profile, in build_change_hat() argument
1017 if (sibling && PROFILE_IS_HAT(profile)) { in build_change_hat()
1018 root = aa_get_profile_rcu(&profile->parent); in build_change_hat()
1019 } else if (!sibling && !PROFILE_IS_HAT(profile)) { in build_change_hat()
1020 root = aa_get_profile(profile); in build_change_hat()
1030 if (COMPLAIN_MODE(profile)) { in build_change_hat()
1031 hat = aa_new_learning_profile(profile, true, name, in build_change_hat()
1034 info = "failed null profile create"; in build_change_hat()
1042 aa_audit_file(subj_cred, profile, &nullperms, OP_CHANGE_HAT, in build_change_hat()
1063 struct aa_profile *profile, *root, *hat = NULL; in change_hat() local
1080 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1081 if (sibling && PROFILE_IS_HAT(profile)) { in change_hat()
1082 root = aa_get_profile_rcu(&profile->parent); in change_hat()
1083 } else if (!sibling && !PROFILE_IS_HAT(profile)) { in change_hat()
1084 root = aa_get_profile(profile); in change_hat()
1093 if (!COMPLAIN_MODE(profile)) in change_hat()
1116 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1117 if (!list_empty(&profile->base.profiles)) { in change_hat()
1127 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1135 if (count > 1 || COMPLAIN_MODE(profile)) { in change_hat()
1136 aa_audit_file(subj_cred, profile, &nullperms, in change_hat()
1145 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in change_hat()
1146 build_change_hat(subj_cred, profile, name, in change_hat()
1148 aa_get_label(&profile->label)); in change_hat()
1167 * Change to the first profile specified in @hats that exists, and store
1170 * top level profile.
1172 * change_hat only applies to profiles in the current ns, and each profile
1180 struct aa_profile *profile; in aa_change_hat() local
1264 } /* else ignore @flags && restores when there is no saved profile */ in aa_change_hat()
1279 fn_for_each_in_ns(label, profile, in aa_change_hat()
1280 aa_audit_file(subj_cred, profile, &perms, OP_CHANGE_HAT, in aa_change_hat()
1290 struct aa_profile *profile, in change_profile_perms_wrapper() argument
1294 struct aa_ruleset *rules = list_first_entry(&profile->rules, in change_profile_perms_wrapper()
1300 error = change_profile_perms(profile, target, stack, request, in change_profile_perms_wrapper()
1304 error = aa_audit_file(subj_cred, profile, perms, op, request, in change_profile_perms_wrapper()
1313 * aa_change_profile - perform a one-way profile transition
1314 * @fqname: name of profile may include namespace (NOT NULL)
1317 * Change to new profile @name. Unlike with hats, there is no way
1318 * to change back. If @name isn't specified the current profile name is
1328 struct aa_profile *profile; in aa_change_profile() local
1353 AA_DEBUG("no profile name"); in aa_change_profile()
1384 * TODO: fixme using labels_profile is not right - do profile in aa_change_profile()
1385 * per complain profile in aa_change_profile()
1394 info = "failed null profile create"; in aa_change_profile()
1410 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1413 profile, target, stack, in aa_change_profile()
1424 if (error && !fn_for_each_in_ns(label, profile, in aa_change_profile()
1425 COMPLAIN_MODE(profile))) in aa_change_profile()
1440 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in aa_change_profile()
1442 aa_get_label(&profile->label)); in aa_change_profile()
1482 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1484 profile, &perms, op, request, auditname, in aa_change_profile()