xref: /openbmc/linux/security/apparmor/policy.c (revision 691aada7)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor policy manipulation functions
6  *
7  * Copyright (C) 1998-2008 Novell/SUSE
8  * Copyright 2009-2010 Canonical Ltd.
9  *
10  * AppArmor policy is based around profiles, which contain the rules a
11  * task is confined by.  Every task in the system has a profile attached
12  * to it determined either by matching "unconfined" tasks against the
13  * visible set of profiles or by following a profiles attachment rules.
14  *
15  * Each profile exists in a profile namespace which is a container of
16  * visible profiles.  Each namespace contains a special "unconfined" profile,
17  * which doesn't enforce any confinement on a task beyond DAC.
18  *
19  * Namespace and profile names can be written together in either
20  * of two syntaxes.
21  *	:namespace:profile - used by kernel interfaces for easy detection
22  *	namespace://profile - used by policy
23  *
24  * Profile names can not start with : or @ or ^ and may not contain \0
25  *
26  * Reserved profile names
27  *	unconfined - special automatically generated unconfined profile
28  *	inherit - special name to indicate profile inheritance
29  *	null-XXXX-YYYY - special automatically generated learning profiles
30  *
31  * Namespace names may not start with / or @ and may not contain \0 or :
32  * Reserved namespace names
33  *	user-XXXX - user defined profiles
34  *
35  * a // in a profile or namespace name indicates a hierarchical name with the
36  * name before the // being the parent and the name after the child.
37  *
38  * Profile and namespace hierarchies serve two different but similar purposes.
39  * The namespace contains the set of visible profiles that are considered
40  * for attachment.  The hierarchy of namespaces allows for virtualizing
41  * the namespace so that for example a chroot can have its own set of profiles
42  * which may define some local user namespaces.
43  * The profile hierarchy severs two distinct purposes,
44  * -  it allows for sub profiles or hats, which allows an application to run
45  *    subprograms under its own profile with different restriction than it
46  *    self, and not have it use the system profile.
47  *    eg. if a mail program starts an editor, the policy might make the
48  *        restrictions tighter on the editor tighter than the mail program,
49  *        and definitely different than general editor restrictions
50  * - it allows for binary hierarchy of profiles, so that execution history
51  *   is preserved.  This feature isn't exploited by AppArmor reference policy
52  *   but is allowed.  NOTE: this is currently suboptimal because profile
53  *   aliasing is not currently implemented so that a profile for each
54  *   level must be defined.
55  *   eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started
56  *       from /bin/bash
57  *
58  *   A profile or namespace name that can contain one or more // separators
59  *   is referred to as an hname (hierarchical).
60  *   eg.  /bin/bash//bin/ls
61  *
62  *   An fqname is a name that may contain both namespace and profile hnames.
63  *   eg. :ns:/bin/bash//bin/ls
64  *
65  * NOTES:
66  *   - locking of profile lists is currently fairly coarse.  All profile
67  *     lists within a namespace use the namespace lock.
68  * FIXME: move profile lists to using rcu_lists
69  */
70 
71 #include <linux/slab.h>
72 #include <linux/spinlock.h>
73 #include <linux/string.h>
74 #include <linux/cred.h>
75 #include <linux/rculist.h>
76 #include <linux/user_namespace.h>
77 
78 #include "include/apparmor.h"
79 #include "include/capability.h"
80 #include "include/cred.h"
81 #include "include/file.h"
82 #include "include/ipc.h"
83 #include "include/match.h"
84 #include "include/path.h"
85 #include "include/policy.h"
86 #include "include/policy_ns.h"
87 #include "include/policy_unpack.h"
88 #include "include/resource.h"
89 
90 int unprivileged_userns_apparmor_policy = 1;
91 
92 const char *const aa_profile_mode_names[] = {
93 	"enforce",
94 	"complain",
95 	"kill",
96 	"unconfined",
97 	"user",
98 };
99 
100 
101 /**
102  * __add_profile - add a profiles to list and label tree
103  * @list: list to add it to  (NOT NULL)
104  * @profile: the profile to add  (NOT NULL)
105  *
106  * refcount @profile, should be put by __list_remove_profile
107  *
108  * Requires: namespace lock be held, or list not be shared
109  */
__add_profile(struct list_head * list,struct aa_profile * profile)110 static void __add_profile(struct list_head *list, struct aa_profile *profile)
111 {
112 	struct aa_label *l;
113 
114 	AA_BUG(!list);
115 	AA_BUG(!profile);
116 	AA_BUG(!profile->ns);
117 	AA_BUG(!mutex_is_locked(&profile->ns->lock));
118 
119 	list_add_rcu(&profile->base.list, list);
120 	/* get list reference */
121 	aa_get_profile(profile);
122 	l = aa_label_insert(&profile->ns->labels, &profile->label);
123 	AA_BUG(l != &profile->label);
124 	aa_put_label(l);
125 }
126 
127 /**
128  * __list_remove_profile - remove a profile from the list it is on
129  * @profile: the profile to remove  (NOT NULL)
130  *
131  * remove a profile from the list, warning generally removal should
132  * be done with __replace_profile as most profile removals are
133  * replacements to the unconfined profile.
134  *
135  * put @profile list refcount
136  *
137  * Requires: namespace lock be held, or list not have been live
138  */
__list_remove_profile(struct aa_profile * profile)139 static void __list_remove_profile(struct aa_profile *profile)
140 {
141 	AA_BUG(!profile);
142 	AA_BUG(!profile->ns);
143 	AA_BUG(!mutex_is_locked(&profile->ns->lock));
144 
145 	list_del_rcu(&profile->base.list);
146 	aa_put_profile(profile);
147 }
148 
149 /**
150  * __remove_profile - remove old profile, and children
151  * @profile: profile to be replaced  (NOT NULL)
152  *
153  * Requires: namespace list lock be held, or list not be shared
154  */
__remove_profile(struct aa_profile * profile)155 static void __remove_profile(struct aa_profile *profile)
156 {
157 	AA_BUG(!profile);
158 	AA_BUG(!profile->ns);
159 	AA_BUG(!mutex_is_locked(&profile->ns->lock));
160 
161 	/* release any children lists first */
162 	__aa_profile_list_release(&profile->base.profiles);
163 	/* released by free_profile */
164 	aa_label_remove(&profile->label);
165 	__aafs_profile_rmdir(profile);
166 	__list_remove_profile(profile);
167 }
168 
169 /**
170  * __aa_profile_list_release - remove all profiles on the list and put refs
171  * @head: list of profiles  (NOT NULL)
172  *
173  * Requires: namespace lock be held
174  */
__aa_profile_list_release(struct list_head * head)175 void __aa_profile_list_release(struct list_head *head)
176 {
177 	struct aa_profile *profile, *tmp;
178 	list_for_each_entry_safe(profile, tmp, head, base.list)
179 		__remove_profile(profile);
180 }
181 
182 /**
183  * aa_free_data - free a data blob
184  * @ptr: data to free
185  * @arg: unused
186  */
aa_free_data(void * ptr,void * arg)187 static void aa_free_data(void *ptr, void *arg)
188 {
189 	struct aa_data *data = ptr;
190 
191 	kvfree_sensitive(data->data, data->size);
192 	kfree_sensitive(data->key);
193 	kfree_sensitive(data);
194 }
195 
free_attachment(struct aa_attachment * attach)196 static void free_attachment(struct aa_attachment *attach)
197 {
198 	int i;
199 
200 	for (i = 0; i < attach->xattr_count; i++)
201 		kfree_sensitive(attach->xattrs[i]);
202 	kfree_sensitive(attach->xattrs);
203 	aa_destroy_policydb(&attach->xmatch);
204 }
205 
free_ruleset(struct aa_ruleset * rules)206 static void free_ruleset(struct aa_ruleset *rules)
207 {
208 	int i;
209 
210 	aa_destroy_policydb(&rules->file);
211 	aa_destroy_policydb(&rules->policy);
212 	aa_free_cap_rules(&rules->caps);
213 	aa_free_rlimit_rules(&rules->rlimits);
214 
215 	for (i = 0; i < rules->secmark_count; i++)
216 		kfree_sensitive(rules->secmark[i].label);
217 	kfree_sensitive(rules->secmark);
218 	kfree_sensitive(rules);
219 }
220 
aa_alloc_ruleset(gfp_t gfp)221 struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp)
222 {
223 	struct aa_ruleset *rules;
224 
225 	rules = kzalloc(sizeof(*rules), gfp);
226 	if (rules)
227 		INIT_LIST_HEAD(&rules->list);
228 
229 	return rules;
230 }
231 
232 /**
233  * aa_free_profile - free a profile
234  * @profile: the profile to free  (MAYBE NULL)
235  *
236  * Free a profile, its hats and null_profile. All references to the profile,
237  * its hats and null_profile must have been put.
238  *
239  * If the profile was referenced from a task context, free_profile() will
240  * be called from an rcu callback routine, so we must not sleep here.
241  */
aa_free_profile(struct aa_profile * profile)242 void aa_free_profile(struct aa_profile *profile)
243 {
244 	struct aa_ruleset *rule, *tmp;
245 	struct rhashtable *rht;
246 
247 	AA_DEBUG("%s(%p)\n", __func__, profile);
248 
249 	if (!profile)
250 		return;
251 
252 	/* free children profiles */
253 	aa_policy_destroy(&profile->base);
254 	aa_put_profile(rcu_access_pointer(profile->parent));
255 
256 	aa_put_ns(profile->ns);
257 	kfree_sensitive(profile->rename);
258 	kfree_sensitive(profile->disconnected);
259 
260 	free_attachment(&profile->attach);
261 
262 	/*
263 	 * at this point there are no tasks that can have a reference
264 	 * to rules
265 	 */
266 	list_for_each_entry_safe(rule, tmp, &profile->rules, list) {
267 		list_del_init(&rule->list);
268 		free_ruleset(rule);
269 	}
270 	kfree_sensitive(profile->dirname);
271 
272 	if (profile->data) {
273 		rht = profile->data;
274 		profile->data = NULL;
275 		rhashtable_free_and_destroy(rht, aa_free_data, NULL);
276 		kfree_sensitive(rht);
277 	}
278 
279 	kfree_sensitive(profile->hash);
280 	aa_put_loaddata(profile->rawdata);
281 	aa_label_destroy(&profile->label);
282 
283 	kfree_sensitive(profile);
284 }
285 
286 /**
287  * aa_alloc_profile - allocate, initialize and return a new profile
288  * @hname: name of the profile  (NOT NULL)
289  * @proxy: proxy to use OR null if to allocate a new one
290  * @gfp: allocation type
291  *
292  * Returns: refcount profile or NULL on failure
293  */
aa_alloc_profile(const char * hname,struct aa_proxy * proxy,gfp_t gfp)294 struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,
295 				    gfp_t gfp)
296 {
297 	struct aa_profile *profile;
298 	struct aa_ruleset *rules;
299 
300 	/* freed by free_profile - usually through aa_put_profile */
301 	profile = kzalloc(struct_size(profile, label.vec, 2), gfp);
302 	if (!profile)
303 		return NULL;
304 
305 	if (!aa_policy_init(&profile->base, NULL, hname, gfp))
306 		goto fail;
307 	if (!aa_label_init(&profile->label, 1, gfp))
308 		goto fail;
309 
310 	INIT_LIST_HEAD(&profile->rules);
311 
312 	/* allocate the first ruleset, but leave it empty */
313 	rules = aa_alloc_ruleset(gfp);
314 	if (!rules)
315 		goto fail;
316 	list_add(&rules->list, &profile->rules);
317 
318 	/* update being set needed by fs interface */
319 	if (!proxy) {
320 		proxy = aa_alloc_proxy(&profile->label, gfp);
321 		if (!proxy)
322 			goto fail;
323 	} else
324 		aa_get_proxy(proxy);
325 	profile->label.proxy = proxy;
326 
327 	profile->label.hname = profile->base.hname;
328 	profile->label.flags |= FLAG_PROFILE;
329 	profile->label.vec[0] = profile;
330 
331 	/* refcount released by caller */
332 	return profile;
333 
334 fail:
335 	aa_free_profile(profile);
336 
337 	return NULL;
338 }
339 
340 /* TODO: profile accounting - setup in remove */
341 
342 /**
343  * __strn_find_child - find a profile on @head list using substring of @name
344  * @head: list to search  (NOT NULL)
345  * @name: name of profile (NOT NULL)
346  * @len: length of @name substring to match
347  *
348  * Requires: rcu_read_lock be held
349  *
350  * Returns: unrefcounted profile ptr, or NULL if not found
351  */
__strn_find_child(struct list_head * head,const char * name,int len)352 static struct aa_profile *__strn_find_child(struct list_head *head,
353 					    const char *name, int len)
354 {
355 	return (struct aa_profile *)__policy_strn_find(head, name, len);
356 }
357 
358 /**
359  * __find_child - find a profile on @head list with a name matching @name
360  * @head: list to search  (NOT NULL)
361  * @name: name of profile (NOT NULL)
362  *
363  * Requires: rcu_read_lock be held
364  *
365  * Returns: unrefcounted profile ptr, or NULL if not found
366  */
__find_child(struct list_head * head,const char * name)367 static struct aa_profile *__find_child(struct list_head *head, const char *name)
368 {
369 	return __strn_find_child(head, name, strlen(name));
370 }
371 
372 /**
373  * aa_find_child - find a profile by @name in @parent
374  * @parent: profile to search  (NOT NULL)
375  * @name: profile name to search for  (NOT NULL)
376  *
377  * Returns: a refcounted profile or NULL if not found
378  */
aa_find_child(struct aa_profile * parent,const char * name)379 struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
380 {
381 	struct aa_profile *profile;
382 
383 	rcu_read_lock();
384 	do {
385 		profile = __find_child(&parent->base.profiles, name);
386 	} while (profile && !aa_get_profile_not0(profile));
387 	rcu_read_unlock();
388 
389 	/* refcount released by caller */
390 	return profile;
391 }
392 
393 /**
394  * __lookup_parent - lookup the parent of a profile of name @hname
395  * @ns: namespace to lookup profile in  (NOT NULL)
396  * @hname: hierarchical profile name to find parent of  (NOT NULL)
397  *
398  * Lookups up the parent of a fully qualified profile name, the profile
399  * that matches hname does not need to exist, in general this
400  * is used to load a new profile.
401  *
402  * Requires: rcu_read_lock be held
403  *
404  * Returns: unrefcounted policy or NULL if not found
405  */
__lookup_parent(struct aa_ns * ns,const char * hname)406 static struct aa_policy *__lookup_parent(struct aa_ns *ns,
407 					 const char *hname)
408 {
409 	struct aa_policy *policy;
410 	struct aa_profile *profile = NULL;
411 	char *split;
412 
413 	policy = &ns->base;
414 
415 	for (split = strstr(hname, "//"); split;) {
416 		profile = __strn_find_child(&policy->profiles, hname,
417 					    split - hname);
418 		if (!profile)
419 			return NULL;
420 		policy = &profile->base;
421 		hname = split + 2;
422 		split = strstr(hname, "//");
423 	}
424 	if (!profile)
425 		return &ns->base;
426 	return &profile->base;
427 }
428 
429 /**
430  * __create_missing_ancestors - create place holders for missing ancestores
431  * @ns: namespace to lookup profile in (NOT NULL)
432  * @hname: hierarchical profile name to find parent of (NOT NULL)
433  * @gfp: type of allocation.
434  *
435  * Requires: ns mutex lock held
436  *
437  * Return: unrefcounted parent policy on success or %NULL if error creating
438  *          place holder profiles.
439  */
__create_missing_ancestors(struct aa_ns * ns,const char * hname,gfp_t gfp)440 static struct aa_policy *__create_missing_ancestors(struct aa_ns *ns,
441 						    const char *hname,
442 						    gfp_t gfp)
443 {
444 	struct aa_policy *policy;
445 	struct aa_profile *parent, *profile = NULL;
446 	char *split;
447 
448 	AA_BUG(!ns);
449 	AA_BUG(!hname);
450 
451 	policy = &ns->base;
452 
453 	for (split = strstr(hname, "//"); split;) {
454 		parent = profile;
455 		profile = __strn_find_child(&policy->profiles, hname,
456 					    split - hname);
457 		if (!profile) {
458 			const char *name = kstrndup(hname, split - hname,
459 						    gfp);
460 			if (!name)
461 				return NULL;
462 			profile = aa_alloc_null(parent, name, gfp);
463 			kfree(name);
464 			if (!profile)
465 				return NULL;
466 			if (!parent)
467 				profile->ns = aa_get_ns(ns);
468 		}
469 		policy = &profile->base;
470 		hname = split + 2;
471 		split = strstr(hname, "//");
472 	}
473 	if (!profile)
474 		return &ns->base;
475 	return &profile->base;
476 }
477 
478 /**
479  * __lookupn_profile - lookup the profile matching @hname
480  * @base: base list to start looking up profile name from  (NOT NULL)
481  * @hname: hierarchical profile name  (NOT NULL)
482  * @n: length of @hname
483  *
484  * Requires: rcu_read_lock be held
485  *
486  * Returns: unrefcounted profile pointer or NULL if not found
487  *
488  * Do a relative name lookup, recursing through profile tree.
489  */
__lookupn_profile(struct aa_policy * base,const char * hname,size_t n)490 static struct aa_profile *__lookupn_profile(struct aa_policy *base,
491 					    const char *hname, size_t n)
492 {
493 	struct aa_profile *profile = NULL;
494 	const char *split;
495 
496 	for (split = strnstr(hname, "//", n); split;
497 	     split = strnstr(hname, "//", n)) {
498 		profile = __strn_find_child(&base->profiles, hname,
499 					    split - hname);
500 		if (!profile)
501 			return NULL;
502 
503 		base = &profile->base;
504 		n -= split + 2 - hname;
505 		hname = split + 2;
506 	}
507 
508 	if (n)
509 		return __strn_find_child(&base->profiles, hname, n);
510 	return NULL;
511 }
512 
__lookup_profile(struct aa_policy * base,const char * hname)513 static struct aa_profile *__lookup_profile(struct aa_policy *base,
514 					   const char *hname)
515 {
516 	return __lookupn_profile(base, hname, strlen(hname));
517 }
518 
519 /**
520  * aa_lookupn_profile - find a profile by its full or partial name
521  * @ns: the namespace to start from (NOT NULL)
522  * @hname: name to do lookup on.  Does not contain namespace prefix (NOT NULL)
523  * @n: size of @hname
524  *
525  * Returns: refcounted profile or NULL if not found
526  */
aa_lookupn_profile(struct aa_ns * ns,const char * hname,size_t n)527 struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
528 				      size_t n)
529 {
530 	struct aa_profile *profile;
531 
532 	rcu_read_lock();
533 	do {
534 		profile = __lookupn_profile(&ns->base, hname, n);
535 	} while (profile && !aa_get_profile_not0(profile));
536 	rcu_read_unlock();
537 
538 	/* the unconfined profile is not in the regular profile list */
539 	if (!profile && strncmp(hname, "unconfined", n) == 0)
540 		profile = aa_get_newest_profile(ns->unconfined);
541 
542 	/* refcount released by caller */
543 	return profile;
544 }
545 
aa_lookup_profile(struct aa_ns * ns,const char * hname)546 struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *hname)
547 {
548 	return aa_lookupn_profile(ns, hname, strlen(hname));
549 }
550 
aa_fqlookupn_profile(struct aa_label * base,const char * fqname,size_t n)551 struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
552 					const char *fqname, size_t n)
553 {
554 	struct aa_profile *profile;
555 	struct aa_ns *ns;
556 	const char *name, *ns_name;
557 	size_t ns_len;
558 
559 	name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len);
560 	if (ns_name) {
561 		ns = aa_lookupn_ns(labels_ns(base), ns_name, ns_len);
562 		if (!ns)
563 			return NULL;
564 	} else
565 		ns = aa_get_ns(labels_ns(base));
566 
567 	if (name)
568 		profile = aa_lookupn_profile(ns, name, n - (name - fqname));
569 	else if (ns)
570 		/* default profile for ns, currently unconfined */
571 		profile = aa_get_newest_profile(ns->unconfined);
572 	else
573 		profile = NULL;
574 	aa_put_ns(ns);
575 
576 	return profile;
577 }
578 
579 
aa_alloc_null(struct aa_profile * parent,const char * name,gfp_t gfp)580 struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
581 				 gfp_t gfp)
582 {
583 	struct aa_profile *profile;
584 	struct aa_ruleset *rules;
585 
586 	profile = aa_alloc_profile(name, NULL, gfp);
587 	if (!profile)
588 		return NULL;
589 
590 	/* TODO: ideally we should inherit abi from parent */
591 	profile->label.flags |= FLAG_NULL;
592 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
593 	rules->file.dfa = aa_get_dfa(nulldfa);
594 	rules->file.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL);
595 	if (!rules->file.perms)
596 		goto fail;
597 	rules->file.size = 2;
598 	rules->policy.dfa = aa_get_dfa(nulldfa);
599 	rules->policy.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL);
600 	if (!rules->policy.perms)
601 		goto fail;
602 	rules->policy.size = 2;
603 
604 	if (parent) {
605 		profile->path_flags = parent->path_flags;
606 
607 		/* released on free_profile */
608 		rcu_assign_pointer(profile->parent, aa_get_profile(parent));
609 		profile->ns = aa_get_ns(parent->ns);
610 	}
611 
612 	return profile;
613 
614 fail:
615 	aa_free_profile(profile);
616 
617 	return NULL;
618 }
619 
620 /**
621  * aa_new_learning_profile - create or find a null-X learning profile
622  * @parent: profile that caused this profile to be created (NOT NULL)
623  * @hat: true if the null- learning profile is a hat
624  * @base: name to base the null profile off of
625  * @gfp: type of allocation
626  *
627  * Find/Create a null- complain mode profile used in learning mode.  The
628  * name of the profile is unique and follows the format of parent//null-XXX.
629  * where XXX is based on the @name or if that fails or is not supplied
630  * a unique number
631  *
632  * null profiles are added to the profile list but the list does not
633  * hold a count on them so that they are automatically released when
634  * not in use.
635  *
636  * Returns: new refcounted profile else NULL on failure
637  */
aa_new_learning_profile(struct aa_profile * parent,bool hat,const char * base,gfp_t gfp)638 struct aa_profile *aa_new_learning_profile(struct aa_profile *parent, bool hat,
639 					   const char *base, gfp_t gfp)
640 {
641 	struct aa_profile *p, *profile;
642 	const char *bname;
643 	char *name = NULL;
644 
645 	AA_BUG(!parent);
646 
647 	if (base) {
648 		name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
649 			       gfp);
650 		if (name) {
651 			sprintf(name, "%s//null-%s", parent->base.hname, base);
652 			goto name;
653 		}
654 		/* fall through to try shorter uniq */
655 	}
656 
657 	name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
658 	if (!name)
659 		return NULL;
660 	sprintf(name, "%s//null-%x", parent->base.hname,
661 		atomic_inc_return(&parent->ns->uniq_null));
662 
663 name:
664 	/* lookup to see if this is a dup creation */
665 	bname = basename(name);
666 	profile = aa_find_child(parent, bname);
667 	if (profile)
668 		goto out;
669 
670 	profile = aa_alloc_null(parent, name, gfp);
671 	if (!profile)
672 		goto fail;
673 	profile->mode = APPARMOR_COMPLAIN;
674 	if (hat)
675 		profile->label.flags |= FLAG_HAT;
676 
677 	mutex_lock_nested(&profile->ns->lock, profile->ns->level);
678 	p = __find_child(&parent->base.profiles, bname);
679 	if (p) {
680 		aa_free_profile(profile);
681 		profile = aa_get_profile(p);
682 	} else {
683 		__add_profile(&parent->base.profiles, profile);
684 	}
685 	mutex_unlock(&profile->ns->lock);
686 
687 	/* refcount released by caller */
688 out:
689 	kfree(name);
690 
691 	return profile;
692 
693 fail:
694 	kfree(name);
695 	aa_free_profile(profile);
696 	return NULL;
697 }
698 
699 /**
700  * replacement_allowed - test to see if replacement is allowed
701  * @profile: profile to test if it can be replaced  (MAYBE NULL)
702  * @noreplace: true if replacement shouldn't be allowed but addition is okay
703  * @info: Returns - info about why replacement failed (NOT NULL)
704  *
705  * Returns: %0 if replacement allowed else error code
706  */
replacement_allowed(struct aa_profile * profile,int noreplace,const char ** info)707 static int replacement_allowed(struct aa_profile *profile, int noreplace,
708 			       const char **info)
709 {
710 	if (profile) {
711 		if (profile->label.flags & FLAG_IMMUTIBLE) {
712 			*info = "cannot replace immutable profile";
713 			return -EPERM;
714 		} else if (noreplace) {
715 			*info = "profile already exists";
716 			return -EEXIST;
717 		}
718 	}
719 	return 0;
720 }
721 
722 /* audit callback for net specific fields */
audit_cb(struct audit_buffer * ab,void * va)723 static void audit_cb(struct audit_buffer *ab, void *va)
724 {
725 	struct common_audit_data *sa = va;
726 	struct apparmor_audit_data *ad = aad(sa);
727 
728 	if (ad->iface.ns) {
729 		audit_log_format(ab, " ns=");
730 		audit_log_untrustedstring(ab, ad->iface.ns);
731 	}
732 }
733 
734 /**
735  * audit_policy - Do auditing of policy changes
736  * @subj_label: label to check if it can manage policy
737  * @op: policy operation being performed
738  * @ns_name: name of namespace being manipulated
739  * @name: name of profile being manipulated (NOT NULL)
740  * @info: any extra information to be audited (MAYBE NULL)
741  * @error: error code
742  *
743  * Returns: the error to be returned after audit is done
744  */
audit_policy(struct aa_label * subj_label,const char * op,const char * ns_name,const char * name,const char * info,int error)745 static int audit_policy(struct aa_label *subj_label, const char *op,
746 			const char *ns_name, const char *name,
747 			const char *info, int error)
748 {
749 	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, op);
750 
751 	ad.iface.ns = ns_name;
752 	ad.name = name;
753 	ad.info = info;
754 	ad.error = error;
755 	ad.subj_label = subj_label;
756 
757 	aa_audit_msg(AUDIT_APPARMOR_STATUS, &ad, audit_cb);
758 
759 	return error;
760 }
761 
762 /* don't call out to other LSMs in the stack for apparmor policy admin
763  * permissions
764  */
policy_ns_capable(const struct cred * subj_cred,struct aa_label * label,struct user_namespace * userns,int cap)765 static int policy_ns_capable(const struct cred *subj_cred,
766 			     struct aa_label *label,
767 			     struct user_namespace *userns, int cap)
768 {
769 	int err;
770 
771 	/* check for MAC_ADMIN cap in cred */
772 	err = cap_capable(subj_cred, userns, cap, CAP_OPT_NONE);
773 	if (!err)
774 		err = aa_capable(subj_cred, label, cap, CAP_OPT_NONE);
775 
776 	return err;
777 }
778 
779 /**
780  * aa_policy_view_capable - check if viewing policy in at @ns is allowed
781  * @subj_cred: cred of subject
782  * @label: label that is trying to view policy in ns
783  * @ns: namespace being viewed by @label (may be NULL if @label's ns)
784  *
785  * Returns: true if viewing policy is allowed
786  *
787  * If @ns is NULL then the namespace being viewed is assumed to be the
788  * tasks current namespace.
789  */
aa_policy_view_capable(const struct cred * subj_cred,struct aa_label * label,struct aa_ns * ns)790 bool aa_policy_view_capable(const struct cred *subj_cred,
791 			     struct aa_label *label, struct aa_ns *ns)
792 {
793 	struct user_namespace *user_ns = subj_cred->user_ns;
794 	struct aa_ns *view_ns = labels_view(label);
795 	bool root_in_user_ns = uid_eq(current_euid(), make_kuid(user_ns, 0)) ||
796 			       in_egroup_p(make_kgid(user_ns, 0));
797 	bool response = false;
798 	if (!ns)
799 		ns = view_ns;
800 
801 	if (root_in_user_ns && aa_ns_visible(view_ns, ns, true) &&
802 	    (user_ns == &init_user_ns ||
803 	     (unprivileged_userns_apparmor_policy != 0 &&
804 	      user_ns->level == view_ns->level)))
805 		response = true;
806 
807 	return response;
808 }
809 
aa_policy_admin_capable(const struct cred * subj_cred,struct aa_label * label,struct aa_ns * ns)810 bool aa_policy_admin_capable(const struct cred *subj_cred,
811 			     struct aa_label *label, struct aa_ns *ns)
812 {
813 	struct user_namespace *user_ns = subj_cred->user_ns;
814 	bool capable = policy_ns_capable(subj_cred, label, user_ns,
815 					 CAP_MAC_ADMIN) == 0;
816 
817 	AA_DEBUG("cap_mac_admin? %d\n", capable);
818 	AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);
819 
820 	return aa_policy_view_capable(subj_cred, label, ns) && capable &&
821 		!aa_g_lock_policy;
822 }
823 
aa_current_policy_view_capable(struct aa_ns * ns)824 bool aa_current_policy_view_capable(struct aa_ns *ns)
825 {
826 	struct aa_label *label;
827 	bool res;
828 
829 	label = __begin_current_label_crit_section();
830 	res = aa_policy_view_capable(current_cred(), label, ns);
831 	__end_current_label_crit_section(label);
832 
833 	return res;
834 }
835 
aa_current_policy_admin_capable(struct aa_ns * ns)836 bool aa_current_policy_admin_capable(struct aa_ns *ns)
837 {
838 	struct aa_label *label;
839 	bool res;
840 
841 	label = __begin_current_label_crit_section();
842 	res = aa_policy_admin_capable(current_cred(), label, ns);
843 	__end_current_label_crit_section(label);
844 
845 	return res;
846 }
847 
848 /**
849  * aa_may_manage_policy - can the current task manage policy
850  * @subj_cred; subjects cred
851  * @label: label to check if it can manage policy
852  * @ns: namespace being managed by @label (may be NULL if @label's ns)
853  * @mask: contains the policy manipulation operation being done
854  *
855  * Returns: 0 if the task is allowed to manipulate policy else error
856  */
aa_may_manage_policy(const struct cred * subj_cred,struct aa_label * label,struct aa_ns * ns,u32 mask)857 int aa_may_manage_policy(const struct cred *subj_cred, struct aa_label *label,
858 			 struct aa_ns *ns, u32 mask)
859 {
860 	const char *op;
861 
862 	if (mask & AA_MAY_REMOVE_POLICY)
863 		op = OP_PROF_RM;
864 	else if (mask & AA_MAY_REPLACE_POLICY)
865 		op = OP_PROF_REPL;
866 	else
867 		op = OP_PROF_LOAD;
868 
869 	/* check if loading policy is locked out */
870 	if (aa_g_lock_policy)
871 		return audit_policy(label, op, NULL, NULL, "policy_locked",
872 				    -EACCES);
873 
874 	if (!aa_policy_admin_capable(subj_cred, label, ns))
875 		return audit_policy(label, op, NULL, NULL, "not policy admin",
876 				    -EACCES);
877 
878 	/* TODO: add fine grained mediation of policy loads */
879 	return 0;
880 }
881 
__list_lookup_parent(struct list_head * lh,struct aa_profile * profile)882 static struct aa_profile *__list_lookup_parent(struct list_head *lh,
883 					       struct aa_profile *profile)
884 {
885 	const char *base = basename(profile->base.hname);
886 	long len = base - profile->base.hname;
887 	struct aa_load_ent *ent;
888 
889 	/* parent won't have trailing // so remove from len */
890 	if (len <= 2)
891 		return NULL;
892 	len -= 2;
893 
894 	list_for_each_entry(ent, lh, list) {
895 		if (ent->new == profile)
896 			continue;
897 		if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
898 		    0 && ent->new->base.hname[len] == 0)
899 			return ent->new;
900 	}
901 
902 	return NULL;
903 }
904 
905 /**
906  * __replace_profile - replace @old with @new on a list
907  * @old: profile to be replaced  (NOT NULL)
908  * @new: profile to replace @old with  (NOT NULL)
909  *
910  * Will duplicate and refcount elements that @new inherits from @old
911  * and will inherit @old children.
912  *
913  * refcount @new for list, put @old list refcount
914  *
915  * Requires: namespace list lock be held, or list not be shared
916  */
__replace_profile(struct aa_profile * old,struct aa_profile * new)917 static void __replace_profile(struct aa_profile *old, struct aa_profile *new)
918 {
919 	struct aa_profile *child, *tmp;
920 
921 	if (!list_empty(&old->base.profiles)) {
922 		LIST_HEAD(lh);
923 		list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu);
924 
925 		list_for_each_entry_safe(child, tmp, &lh, base.list) {
926 			struct aa_profile *p;
927 
928 			list_del_init(&child->base.list);
929 			p = __find_child(&new->base.profiles, child->base.name);
930 			if (p) {
931 				/* @p replaces @child  */
932 				__replace_profile(child, p);
933 				continue;
934 			}
935 
936 			/* inherit @child and its children */
937 			/* TODO: update hname of inherited children */
938 			/* list refcount transferred to @new */
939 			p = aa_deref_parent(child);
940 			rcu_assign_pointer(child->parent, aa_get_profile(new));
941 			list_add_rcu(&child->base.list, &new->base.profiles);
942 			aa_put_profile(p);
943 		}
944 	}
945 
946 	if (!rcu_access_pointer(new->parent)) {
947 		struct aa_profile *parent = aa_deref_parent(old);
948 		rcu_assign_pointer(new->parent, aa_get_profile(parent));
949 	}
950 	aa_label_replace(&old->label, &new->label);
951 	/* migrate dents must come after label replacement b/c update */
952 	__aafs_profile_migrate_dents(old, new);
953 
954 	if (list_empty(&new->base.list)) {
955 		/* new is not on a list already */
956 		list_replace_rcu(&old->base.list, &new->base.list);
957 		aa_get_profile(new);
958 		aa_put_profile(old);
959 	} else
960 		__list_remove_profile(old);
961 }
962 
963 /**
964  * __lookup_replace - lookup replacement information for a profile
965  * @ns: namespace the lookup occurs in
966  * @hname: name of profile to lookup
967  * @noreplace: true if not replacing an existing profile
968  * @p: Returns - profile to be replaced
969  * @info: Returns - info string on why lookup failed
970  *
971  * Returns: profile to replace (no ref) on success else ptr error
972  */
__lookup_replace(struct aa_ns * ns,const char * hname,bool noreplace,struct aa_profile ** p,const char ** info)973 static int __lookup_replace(struct aa_ns *ns, const char *hname,
974 			    bool noreplace, struct aa_profile **p,
975 			    const char **info)
976 {
977 	*p = aa_get_profile(__lookup_profile(&ns->base, hname));
978 	if (*p) {
979 		int error = replacement_allowed(*p, noreplace, info);
980 		if (error) {
981 			*info = "profile can not be replaced";
982 			return error;
983 		}
984 	}
985 
986 	return 0;
987 }
988 
share_name(struct aa_profile * old,struct aa_profile * new)989 static void share_name(struct aa_profile *old, struct aa_profile *new)
990 {
991 	aa_put_str(new->base.hname);
992 	aa_get_str(old->base.hname);
993 	new->base.hname = old->base.hname;
994 	new->base.name = old->base.name;
995 	new->label.hname = old->label.hname;
996 }
997 
998 /* Update to newest version of parent after previous replacements
999  * Returns: unrefcount newest version of parent
1000  */
update_to_newest_parent(struct aa_profile * new)1001 static struct aa_profile *update_to_newest_parent(struct aa_profile *new)
1002 {
1003 	struct aa_profile *parent, *newest;
1004 
1005 	parent = rcu_dereference_protected(new->parent,
1006 					   mutex_is_locked(&new->ns->lock));
1007 	newest = aa_get_newest_profile(parent);
1008 
1009 	/* parent replaced in this atomic set? */
1010 	if (newest != parent) {
1011 		aa_put_profile(parent);
1012 		rcu_assign_pointer(new->parent, newest);
1013 	} else
1014 		aa_put_profile(newest);
1015 
1016 	return newest;
1017 }
1018 
1019 /**
1020  * aa_replace_profiles - replace profile(s) on the profile list
1021  * @policy_ns: namespace load is occurring on
1022  * @label: label that is attempting to load/replace policy
1023  * @mask: permission mask
1024  * @udata: serialized data stream  (NOT NULL)
1025  *
1026  * unpack and replace a profile on the profile list and uses of that profile
1027  * by any task creds via invalidating the old version of the profile, which
1028  * tasks will notice to update their own cred.  If the profile does not exist
1029  * on the profile list it is added.
1030  *
1031  * Returns: size of data consumed else error code on failure.
1032  */
aa_replace_profiles(struct aa_ns * policy_ns,struct aa_label * label,u32 mask,struct aa_loaddata * udata)1033 ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
1034 			    u32 mask, struct aa_loaddata *udata)
1035 {
1036 	const char *ns_name = NULL, *info = NULL;
1037 	struct aa_ns *ns = NULL;
1038 	struct aa_load_ent *ent, *tmp;
1039 	struct aa_loaddata *rawdata_ent;
1040 	const char *op;
1041 	ssize_t count, error;
1042 	LIST_HEAD(lh);
1043 
1044 	op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
1045 	aa_get_loaddata(udata);
1046 	/* released below */
1047 	error = aa_unpack(udata, &lh, &ns_name);
1048 	if (error)
1049 		goto out;
1050 
1051 	/* ensure that profiles are all for the same ns
1052 	 * TODO: update locking to remove this constaint. All profiles in
1053 	 *       the load set must succeed as a set or the load will
1054 	 *       fail. Sort ent list and take ns locks in hierarchy order
1055 	 */
1056 	count = 0;
1057 	list_for_each_entry(ent, &lh, list) {
1058 		if (ns_name) {
1059 			if (ent->ns_name &&
1060 			    strcmp(ent->ns_name, ns_name) != 0) {
1061 				info = "policy load has mixed namespaces";
1062 				error = -EACCES;
1063 				goto fail;
1064 			}
1065 		} else if (ent->ns_name) {
1066 			if (count) {
1067 				info = "policy load has mixed namespaces";
1068 				error = -EACCES;
1069 				goto fail;
1070 			}
1071 			ns_name = ent->ns_name;
1072 		} else
1073 			count++;
1074 	}
1075 	if (ns_name) {
1076 		ns = aa_prepare_ns(policy_ns ? policy_ns : labels_ns(label),
1077 				   ns_name);
1078 		if (IS_ERR(ns)) {
1079 			op = OP_PROF_LOAD;
1080 			info = "failed to prepare namespace";
1081 			error = PTR_ERR(ns);
1082 			ns = NULL;
1083 			ent = NULL;
1084 			goto fail;
1085 		}
1086 	} else
1087 		ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label));
1088 
1089 	mutex_lock_nested(&ns->lock, ns->level);
1090 	/* check for duplicate rawdata blobs: space and file dedup */
1091 	if (!list_empty(&ns->rawdata_list)) {
1092 		list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) {
1093 			if (aa_rawdata_eq(rawdata_ent, udata)) {
1094 				struct aa_loaddata *tmp;
1095 
1096 				tmp = __aa_get_loaddata(rawdata_ent);
1097 				/* check we didn't fail the race */
1098 				if (tmp) {
1099 					aa_put_loaddata(udata);
1100 					udata = tmp;
1101 					break;
1102 				}
1103 			}
1104 		}
1105 	}
1106 	/* setup parent and ns info */
1107 	list_for_each_entry(ent, &lh, list) {
1108 		struct aa_policy *policy;
1109 		struct aa_profile *p;
1110 
1111 		if (aa_g_export_binary)
1112 			ent->new->rawdata = aa_get_loaddata(udata);
1113 		error = __lookup_replace(ns, ent->new->base.hname,
1114 					 !(mask & AA_MAY_REPLACE_POLICY),
1115 					 &ent->old, &info);
1116 		if (error)
1117 			goto fail_lock;
1118 
1119 		if (ent->new->rename) {
1120 			error = __lookup_replace(ns, ent->new->rename,
1121 						!(mask & AA_MAY_REPLACE_POLICY),
1122 						&ent->rename, &info);
1123 			if (error)
1124 				goto fail_lock;
1125 		}
1126 
1127 		/* released when @new is freed */
1128 		ent->new->ns = aa_get_ns(ns);
1129 
1130 		if (ent->old || ent->rename)
1131 			continue;
1132 
1133 		/* no ref on policy only use inside lock */
1134 		p = NULL;
1135 		policy = __lookup_parent(ns, ent->new->base.hname);
1136 		if (!policy) {
1137 			/* first check for parent in the load set */
1138 			p = __list_lookup_parent(&lh, ent->new);
1139 			if (!p) {
1140 				/*
1141 				 * fill in missing parent with null
1142 				 * profile that doesn't have
1143 				 * permissions. This allows for
1144 				 * individual profile loading where
1145 				 * the child is loaded before the
1146 				 * parent, and outside of the current
1147 				 * atomic set. This unfortunately can
1148 				 * happen with some userspaces.  The
1149 				 * null profile will be replaced once
1150 				 * the parent is loaded.
1151 				 */
1152 				policy = __create_missing_ancestors(ns,
1153 							ent->new->base.hname,
1154 							GFP_KERNEL);
1155 				if (!policy) {
1156 					error = -ENOENT;
1157 					info = "parent does not exist";
1158 					goto fail_lock;
1159 				}
1160 			}
1161 		}
1162 		if (!p && policy != &ns->base)
1163 			/* released on profile replacement or free_profile */
1164 			p = (struct aa_profile *) policy;
1165 		rcu_assign_pointer(ent->new->parent, aa_get_profile(p));
1166 	}
1167 
1168 	/* create new fs entries for introspection if needed */
1169 	if (!udata->dents[AAFS_LOADDATA_DIR] && aa_g_export_binary) {
1170 		error = __aa_fs_create_rawdata(ns, udata);
1171 		if (error) {
1172 			info = "failed to create raw_data dir and files";
1173 			ent = NULL;
1174 			goto fail_lock;
1175 		}
1176 	}
1177 	list_for_each_entry(ent, &lh, list) {
1178 		if (!ent->old) {
1179 			struct dentry *parent;
1180 			if (rcu_access_pointer(ent->new->parent)) {
1181 				struct aa_profile *p;
1182 				p = aa_deref_parent(ent->new);
1183 				parent = prof_child_dir(p);
1184 			} else
1185 				parent = ns_subprofs_dir(ent->new->ns);
1186 			error = __aafs_profile_mkdir(ent->new, parent);
1187 		}
1188 
1189 		if (error) {
1190 			info = "failed to create";
1191 			goto fail_lock;
1192 		}
1193 	}
1194 
1195 	/* Done with checks that may fail - do actual replacement */
1196 	__aa_bump_ns_revision(ns);
1197 	if (aa_g_export_binary)
1198 		__aa_loaddata_update(udata, ns->revision);
1199 	list_for_each_entry_safe(ent, tmp, &lh, list) {
1200 		list_del_init(&ent->list);
1201 		op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;
1202 
1203 		if (ent->old && ent->old->rawdata == ent->new->rawdata &&
1204 		    ent->new->rawdata) {
1205 			/* dedup actual profile replacement */
1206 			audit_policy(label, op, ns_name, ent->new->base.hname,
1207 				     "same as current profile, skipping",
1208 				     error);
1209 			/* break refcount cycle with proxy. */
1210 			aa_put_proxy(ent->new->label.proxy);
1211 			ent->new->label.proxy = NULL;
1212 			goto skip;
1213 		}
1214 
1215 		/*
1216 		 * TODO: finer dedup based on profile range in data. Load set
1217 		 * can differ but profile may remain unchanged
1218 		 */
1219 		audit_policy(label, op, ns_name, ent->new->base.hname, NULL,
1220 			     error);
1221 
1222 		if (ent->old) {
1223 			share_name(ent->old, ent->new);
1224 			__replace_profile(ent->old, ent->new);
1225 		} else {
1226 			struct list_head *lh;
1227 
1228 			if (rcu_access_pointer(ent->new->parent)) {
1229 				struct aa_profile *parent;
1230 
1231 				parent = update_to_newest_parent(ent->new);
1232 				lh = &parent->base.profiles;
1233 			} else
1234 				lh = &ns->base.profiles;
1235 			__add_profile(lh, ent->new);
1236 		}
1237 	skip:
1238 		aa_load_ent_free(ent);
1239 	}
1240 	__aa_labelset_update_subtree(ns);
1241 	mutex_unlock(&ns->lock);
1242 
1243 out:
1244 	aa_put_ns(ns);
1245 	aa_put_loaddata(udata);
1246 	kfree(ns_name);
1247 
1248 	if (error)
1249 		return error;
1250 	return udata->size;
1251 
1252 fail_lock:
1253 	mutex_unlock(&ns->lock);
1254 
1255 	/* audit cause of failure */
1256 	op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
1257 fail:
1258 	  audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL,
1259 		       info, error);
1260 	/* audit status that rest of profiles in the atomic set failed too */
1261 	info = "valid profile in failed atomic policy load";
1262 	list_for_each_entry(tmp, &lh, list) {
1263 		if (tmp == ent) {
1264 			info = "unchecked profile in failed atomic policy load";
1265 			/* skip entry that caused failure */
1266 			continue;
1267 		}
1268 		op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
1269 		audit_policy(label, op, ns_name, tmp->new->base.hname, info,
1270 			     error);
1271 	}
1272 	list_for_each_entry_safe(ent, tmp, &lh, list) {
1273 		list_del_init(&ent->list);
1274 		aa_load_ent_free(ent);
1275 	}
1276 
1277 	goto out;
1278 }
1279 
1280 /**
1281  * aa_remove_profiles - remove profile(s) from the system
1282  * @policy_ns: namespace the remove is being done from
1283  * @subj: label attempting to remove policy
1284  * @fqname: name of the profile or namespace to remove  (NOT NULL)
1285  * @size: size of the name
1286  *
1287  * Remove a profile or sub namespace from the current namespace, so that
1288  * they can not be found anymore and mark them as replaced by unconfined
1289  *
1290  * NOTE: removing confinement does not restore rlimits to preconfinement values
1291  *
1292  * Returns: size of data consume else error code if fails
1293  */
aa_remove_profiles(struct aa_ns * policy_ns,struct aa_label * subj,char * fqname,size_t size)1294 ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
1295 			   char *fqname, size_t size)
1296 {
1297 	struct aa_ns *ns = NULL;
1298 	struct aa_profile *profile = NULL;
1299 	const char *name = fqname, *info = NULL;
1300 	const char *ns_name = NULL;
1301 	ssize_t error = 0;
1302 
1303 	if (*fqname == 0) {
1304 		info = "no profile specified";
1305 		error = -ENOENT;
1306 		goto fail;
1307 	}
1308 
1309 	if (fqname[0] == ':') {
1310 		size_t ns_len;
1311 
1312 		name = aa_splitn_fqname(fqname, size, &ns_name, &ns_len);
1313 		/* released below */
1314 		ns = aa_lookupn_ns(policy_ns ? policy_ns : labels_ns(subj),
1315 				   ns_name, ns_len);
1316 		if (!ns) {
1317 			info = "namespace does not exist";
1318 			error = -ENOENT;
1319 			goto fail;
1320 		}
1321 	} else
1322 		/* released below */
1323 		ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(subj));
1324 
1325 	if (!name) {
1326 		/* remove namespace - can only happen if fqname[0] == ':' */
1327 		mutex_lock_nested(&ns->parent->lock, ns->parent->level);
1328 		__aa_bump_ns_revision(ns);
1329 		__aa_remove_ns(ns);
1330 		mutex_unlock(&ns->parent->lock);
1331 	} else {
1332 		/* remove profile */
1333 		mutex_lock_nested(&ns->lock, ns->level);
1334 		profile = aa_get_profile(__lookup_profile(&ns->base, name));
1335 		if (!profile) {
1336 			error = -ENOENT;
1337 			info = "profile does not exist";
1338 			goto fail_ns_lock;
1339 		}
1340 		name = profile->base.hname;
1341 		__aa_bump_ns_revision(ns);
1342 		__remove_profile(profile);
1343 		__aa_labelset_update_subtree(ns);
1344 		mutex_unlock(&ns->lock);
1345 	}
1346 
1347 	/* don't fail removal if audit fails */
1348 	(void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
1349 			    error);
1350 	aa_put_ns(ns);
1351 	aa_put_profile(profile);
1352 	return size;
1353 
1354 fail_ns_lock:
1355 	mutex_unlock(&ns->lock);
1356 	aa_put_ns(ns);
1357 
1358 fail:
1359 	(void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
1360 			    error);
1361 	return error;
1362 }
1363