1 /*
2  * AppArmor security module
3  *
4  * This file contains AppArmor /sys/kernel/security/apparmor interface functions
5  *
6  * Copyright (C) 1998-2008 Novell/SUSE
7  * Copyright 2009-2010 Canonical Ltd.
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License as
11  * published by the Free Software Foundation, version 2 of the
12  * License.
13  */
14 
15 #include <linux/ctype.h>
16 #include <linux/security.h>
17 #include <linux/vmalloc.h>
18 #include <linux/module.h>
19 #include <linux/seq_file.h>
20 #include <linux/uaccess.h>
21 #include <linux/mount.h>
22 #include <linux/namei.h>
23 #include <linux/capability.h>
24 #include <linux/rcupdate.h>
25 #include <linux/fs.h>
26 #include <linux/poll.h>
27 #include <uapi/linux/major.h>
28 #include <uapi/linux/magic.h>
29 
30 #include "include/apparmor.h"
31 #include "include/apparmorfs.h"
32 #include "include/audit.h"
33 #include "include/context.h"
34 #include "include/crypto.h"
35 #include "include/ipc.h"
36 #include "include/policy_ns.h"
37 #include "include/label.h"
38 #include "include/policy.h"
39 #include "include/policy_ns.h"
40 #include "include/resource.h"
41 #include "include/policy_unpack.h"
42 
43 /*
44  * The apparmor filesystem interface used for policy load and introspection
45  * The interface is split into two main components based on their function
46  * a securityfs component:
47  *   used for static files that are always available, and which allows
48  *   userspace to specificy the location of the security filesystem.
49  *
50  *   fns and data are prefixed with
51  *      aa_sfs_
52  *
53  * an apparmorfs component:
54  *   used loaded policy content and introspection. It is not part of  a
55  *   regular mounted filesystem and is available only through the magic
56  *   policy symlink in the root of the securityfs apparmor/ directory.
57  *   Tasks queries will be magically redirected to the correct portion
58  *   of the policy tree based on their confinement.
59  *
60  *   fns and data are prefixed with
61  *      aafs_
62  *
63  * The aa_fs_ prefix is used to indicate the fn is used by both the
64  * securityfs and apparmorfs filesystems.
65  */
66 
67 
68 /*
69  * support fns
70  */
71 
72 /**
73  * aa_mangle_name - mangle a profile name to std profile layout form
74  * @name: profile name to mangle  (NOT NULL)
75  * @target: buffer to store mangled name, same length as @name (MAYBE NULL)
76  *
77  * Returns: length of mangled name
78  */
79 static int mangle_name(const char *name, char *target)
80 {
81 	char *t = target;
82 
83 	while (*name == '/' || *name == '.')
84 		name++;
85 
86 	if (target) {
87 		for (; *name; name++) {
88 			if (*name == '/')
89 				*(t)++ = '.';
90 			else if (isspace(*name))
91 				*(t)++ = '_';
92 			else if (isalnum(*name) || strchr("._-", *name))
93 				*(t)++ = *name;
94 		}
95 
96 		*t = 0;
97 	} else {
98 		int len = 0;
99 		for (; *name; name++) {
100 			if (isalnum(*name) || isspace(*name) ||
101 			    strchr("/._-", *name))
102 				len++;
103 		}
104 
105 		return len;
106 	}
107 
108 	return t - target;
109 }
110 
111 
112 /*
113  * aafs - core fns and data for the policy tree
114  */
115 
116 #define AAFS_NAME		"apparmorfs"
117 static struct vfsmount *aafs_mnt;
118 static int aafs_count;
119 
120 
121 static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
122 {
123 	struct inode *inode = d_inode(dentry);
124 
125 	seq_printf(seq, "%s:[%lu]", AAFS_NAME, inode->i_ino);
126 	return 0;
127 }
128 
129 static void aafs_evict_inode(struct inode *inode)
130 {
131 	truncate_inode_pages_final(&inode->i_data);
132 	clear_inode(inode);
133 	if (S_ISLNK(inode->i_mode))
134 		kfree(inode->i_link);
135 }
136 
137 static const struct super_operations aafs_super_ops = {
138 	.statfs = simple_statfs,
139 	.evict_inode = aafs_evict_inode,
140 	.show_path = aafs_show_path,
141 };
142 
143 static int fill_super(struct super_block *sb, void *data, int silent)
144 {
145 	static struct tree_descr files[] = { {""} };
146 	int error;
147 
148 	error = simple_fill_super(sb, AAFS_MAGIC, files);
149 	if (error)
150 		return error;
151 	sb->s_op = &aafs_super_ops;
152 
153 	return 0;
154 }
155 
156 static struct dentry *aafs_mount(struct file_system_type *fs_type,
157 				 int flags, const char *dev_name, void *data)
158 {
159 	return mount_single(fs_type, flags, data, fill_super);
160 }
161 
162 static struct file_system_type aafs_ops = {
163 	.owner = THIS_MODULE,
164 	.name = AAFS_NAME,
165 	.mount = aafs_mount,
166 	.kill_sb = kill_anon_super,
167 };
168 
169 /**
170  * __aafs_setup_d_inode - basic inode setup for apparmorfs
171  * @dir: parent directory for the dentry
172  * @dentry: dentry we are seting the inode up for
173  * @mode: permissions the file should have
174  * @data: data to store on inode.i_private, available in open()
175  * @link: if symlink, symlink target string
176  * @fops: struct file_operations that should be used
177  * @iops: struct of inode_operations that should be used
178  */
179 static int __aafs_setup_d_inode(struct inode *dir, struct dentry *dentry,
180 			       umode_t mode, void *data, char *link,
181 			       const struct file_operations *fops,
182 			       const struct inode_operations *iops)
183 {
184 	struct inode *inode = new_inode(dir->i_sb);
185 
186 	AA_BUG(!dir);
187 	AA_BUG(!dentry);
188 
189 	if (!inode)
190 		return -ENOMEM;
191 
192 	inode->i_ino = get_next_ino();
193 	inode->i_mode = mode;
194 	inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
195 	inode->i_private = data;
196 	if (S_ISDIR(mode)) {
197 		inode->i_op = iops ? iops : &simple_dir_inode_operations;
198 		inode->i_fop = &simple_dir_operations;
199 		inc_nlink(inode);
200 		inc_nlink(dir);
201 	} else if (S_ISLNK(mode)) {
202 		inode->i_op = iops ? iops : &simple_symlink_inode_operations;
203 		inode->i_link = link;
204 	} else {
205 		inode->i_fop = fops;
206 	}
207 	d_instantiate(dentry, inode);
208 	dget(dentry);
209 
210 	return 0;
211 }
212 
213 /**
214  * aafs_create - create a dentry in the apparmorfs filesystem
215  *
216  * @name: name of dentry to create
217  * @mode: permissions the file should have
218  * @parent: parent directory for this dentry
219  * @data: data to store on inode.i_private, available in open()
220  * @link: if symlink, symlink target string
221  * @fops: struct file_operations that should be used for
222  * @iops: struct of inode_operations that should be used
223  *
224  * This is the basic "create a xxx" function for apparmorfs.
225  *
226  * Returns a pointer to a dentry if it succeeds, that must be free with
227  * aafs_remove(). Will return ERR_PTR on failure.
228  */
229 static struct dentry *aafs_create(const char *name, umode_t mode,
230 				  struct dentry *parent, void *data, void *link,
231 				  const struct file_operations *fops,
232 				  const struct inode_operations *iops)
233 {
234 	struct dentry *dentry;
235 	struct inode *dir;
236 	int error;
237 
238 	AA_BUG(!name);
239 	AA_BUG(!parent);
240 
241 	if (!(mode & S_IFMT))
242 		mode = (mode & S_IALLUGO) | S_IFREG;
243 
244 	error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
245 	if (error)
246 		return ERR_PTR(error);
247 
248 	dir = d_inode(parent);
249 
250 	inode_lock(dir);
251 	dentry = lookup_one_len(name, parent, strlen(name));
252 	if (IS_ERR(dentry)) {
253 		error = PTR_ERR(dentry);
254 		goto fail_lock;
255 	}
256 
257 	if (d_really_is_positive(dentry)) {
258 		error = -EEXIST;
259 		goto fail_dentry;
260 	}
261 
262 	error = __aafs_setup_d_inode(dir, dentry, mode, data, link, fops, iops);
263 	if (error)
264 		goto fail_dentry;
265 	inode_unlock(dir);
266 
267 	return dentry;
268 
269 fail_dentry:
270 	dput(dentry);
271 
272 fail_lock:
273 	inode_unlock(dir);
274 	simple_release_fs(&aafs_mnt, &aafs_count);
275 
276 	return ERR_PTR(error);
277 }
278 
279 /**
280  * aafs_create_file - create a file in the apparmorfs filesystem
281  *
282  * @name: name of dentry to create
283  * @mode: permissions the file should have
284  * @parent: parent directory for this dentry
285  * @data: data to store on inode.i_private, available in open()
286  * @fops: struct file_operations that should be used for
287  *
288  * see aafs_create
289  */
290 static struct dentry *aafs_create_file(const char *name, umode_t mode,
291 				       struct dentry *parent, void *data,
292 				       const struct file_operations *fops)
293 {
294 	return aafs_create(name, mode, parent, data, NULL, fops, NULL);
295 }
296 
297 /**
298  * aafs_create_dir - create a directory in the apparmorfs filesystem
299  *
300  * @name: name of dentry to create
301  * @parent: parent directory for this dentry
302  *
303  * see aafs_create
304  */
305 static struct dentry *aafs_create_dir(const char *name, struct dentry *parent)
306 {
307 	return aafs_create(name, S_IFDIR | 0755, parent, NULL, NULL, NULL,
308 			   NULL);
309 }
310 
311 /**
312  * aafs_create_symlink - create a symlink in the apparmorfs filesystem
313  * @name: name of dentry to create
314  * @parent: parent directory for this dentry
315  * @target: if symlink, symlink target string
316  * @iops: struct of inode_operations that should be used
317  *
318  * If @target parameter is %NULL, then the @iops parameter needs to be
319  * setup to handle .readlink and .get_link inode_operations.
320  */
321 static struct dentry *aafs_create_symlink(const char *name,
322 					  struct dentry *parent,
323 					  const char *target,
324 					  const struct inode_operations *iops)
325 {
326 	struct dentry *dent;
327 	char *link = NULL;
328 
329 	if (target) {
330 		link = kstrdup(target, GFP_KERNEL);
331 		if (!link)
332 			return ERR_PTR(-ENOMEM);
333 	}
334 	dent = aafs_create(name, S_IFLNK | 0444, parent, NULL, link, NULL,
335 			   iops);
336 	if (IS_ERR(dent))
337 		kfree(link);
338 
339 	return dent;
340 }
341 
342 /**
343  * aafs_remove - removes a file or directory from the apparmorfs filesystem
344  *
345  * @dentry: dentry of the file/directory/symlink to removed.
346  */
347 static void aafs_remove(struct dentry *dentry)
348 {
349 	struct inode *dir;
350 
351 	if (!dentry || IS_ERR(dentry))
352 		return;
353 
354 	dir = d_inode(dentry->d_parent);
355 	inode_lock(dir);
356 	if (simple_positive(dentry)) {
357 		if (d_is_dir(dentry))
358 			simple_rmdir(dir, dentry);
359 		else
360 			simple_unlink(dir, dentry);
361 		dput(dentry);
362 	}
363 	inode_unlock(dir);
364 	simple_release_fs(&aafs_mnt, &aafs_count);
365 }
366 
367 
368 /*
369  * aa_fs - policy load/replace/remove
370  */
371 
372 /**
373  * aa_simple_write_to_buffer - common routine for getting policy from user
374  * @userbuf: user buffer to copy data from  (NOT NULL)
375  * @alloc_size: size of user buffer (REQUIRES: @alloc_size >= @copy_size)
376  * @copy_size: size of data to copy from user buffer
377  * @pos: position write is at in the file (NOT NULL)
378  *
379  * Returns: kernel buffer containing copy of user buffer data or an
380  *          ERR_PTR on failure.
381  */
382 static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
383 						     size_t alloc_size,
384 						     size_t copy_size,
385 						     loff_t *pos)
386 {
387 	struct aa_loaddata *data;
388 
389 	AA_BUG(copy_size > alloc_size);
390 
391 	if (*pos != 0)
392 		/* only writes from pos 0, that is complete writes */
393 		return ERR_PTR(-ESPIPE);
394 
395 	/* freed by caller to simple_write_to_buffer */
396 	data = aa_loaddata_alloc(alloc_size);
397 	if (IS_ERR(data))
398 		return data;
399 
400 	data->size = copy_size;
401 	if (copy_from_user(data->data, userbuf, copy_size)) {
402 		kvfree(data);
403 		return ERR_PTR(-EFAULT);
404 	}
405 
406 	return data;
407 }
408 
409 static ssize_t policy_update(u32 mask, const char __user *buf, size_t size,
410 			     loff_t *pos, struct aa_ns *ns)
411 {
412 	struct aa_loaddata *data;
413 	struct aa_label *label;
414 	ssize_t error;
415 
416 	label = begin_current_label_crit_section();
417 
418 	/* high level check about policy management - fine grained in
419 	 * below after unpack
420 	 */
421 	error = aa_may_manage_policy(label, ns, mask);
422 	if (error)
423 		return error;
424 
425 	data = aa_simple_write_to_buffer(buf, size, size, pos);
426 	error = PTR_ERR(data);
427 	if (!IS_ERR(data)) {
428 		error = aa_replace_profiles(ns, label, mask, data);
429 		aa_put_loaddata(data);
430 	}
431 	end_current_label_crit_section(label);
432 
433 	return error;
434 }
435 
436 /* .load file hook fn to load policy */
437 static ssize_t profile_load(struct file *f, const char __user *buf, size_t size,
438 			    loff_t *pos)
439 {
440 	struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
441 	int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns);
442 
443 	aa_put_ns(ns);
444 
445 	return error;
446 }
447 
448 static const struct file_operations aa_fs_profile_load = {
449 	.write = profile_load,
450 	.llseek = default_llseek,
451 };
452 
453 /* .replace file hook fn to load and/or replace policy */
454 static ssize_t profile_replace(struct file *f, const char __user *buf,
455 			       size_t size, loff_t *pos)
456 {
457 	struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
458 	int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY,
459 				  buf, size, pos, ns);
460 	aa_put_ns(ns);
461 
462 	return error;
463 }
464 
465 static const struct file_operations aa_fs_profile_replace = {
466 	.write = profile_replace,
467 	.llseek = default_llseek,
468 };
469 
470 /* .remove file hook fn to remove loaded policy */
471 static ssize_t profile_remove(struct file *f, const char __user *buf,
472 			      size_t size, loff_t *pos)
473 {
474 	struct aa_loaddata *data;
475 	struct aa_label *label;
476 	ssize_t error;
477 	struct aa_ns *ns = aa_get_ns(f->f_inode->i_private);
478 
479 	label = begin_current_label_crit_section();
480 	/* high level check about policy management - fine grained in
481 	 * below after unpack
482 	 */
483 	error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY);
484 	if (error)
485 		goto out;
486 
487 	/*
488 	 * aa_remove_profile needs a null terminated string so 1 extra
489 	 * byte is allocated and the copied data is null terminated.
490 	 */
491 	data = aa_simple_write_to_buffer(buf, size + 1, size, pos);
492 
493 	error = PTR_ERR(data);
494 	if (!IS_ERR(data)) {
495 		data->data[size] = 0;
496 		error = aa_remove_profiles(ns, label, data->data, size);
497 		aa_put_loaddata(data);
498 	}
499  out:
500 	end_current_label_crit_section(label);
501 	aa_put_ns(ns);
502 	return error;
503 }
504 
505 static const struct file_operations aa_fs_profile_remove = {
506 	.write = profile_remove,
507 	.llseek = default_llseek,
508 };
509 
510 struct aa_revision {
511 	struct aa_ns *ns;
512 	long last_read;
513 };
514 
515 /* revision file hook fn for policy loads */
516 static int ns_revision_release(struct inode *inode, struct file *file)
517 {
518 	struct aa_revision *rev = file->private_data;
519 
520 	if (rev) {
521 		aa_put_ns(rev->ns);
522 		kfree(rev);
523 	}
524 
525 	return 0;
526 }
527 
528 static ssize_t ns_revision_read(struct file *file, char __user *buf,
529 				size_t size, loff_t *ppos)
530 {
531 	struct aa_revision *rev = file->private_data;
532 	char buffer[32];
533 	long last_read;
534 	int avail;
535 
536 	mutex_lock_nested(&rev->ns->lock, rev->ns->level);
537 	last_read = rev->last_read;
538 	if (last_read == rev->ns->revision) {
539 		mutex_unlock(&rev->ns->lock);
540 		if (file->f_flags & O_NONBLOCK)
541 			return -EAGAIN;
542 		if (wait_event_interruptible(rev->ns->wait,
543 					     last_read !=
544 					     READ_ONCE(rev->ns->revision)))
545 			return -ERESTARTSYS;
546 		mutex_lock_nested(&rev->ns->lock, rev->ns->level);
547 	}
548 
549 	avail = sprintf(buffer, "%ld\n", rev->ns->revision);
550 	if (*ppos + size > avail) {
551 		rev->last_read = rev->ns->revision;
552 		*ppos = 0;
553 	}
554 	mutex_unlock(&rev->ns->lock);
555 
556 	return simple_read_from_buffer(buf, size, ppos, buffer, avail);
557 }
558 
559 static int ns_revision_open(struct inode *inode, struct file *file)
560 {
561 	struct aa_revision *rev = kzalloc(sizeof(*rev), GFP_KERNEL);
562 
563 	if (!rev)
564 		return -ENOMEM;
565 
566 	rev->ns = aa_get_ns(inode->i_private);
567 	if (!rev->ns)
568 		rev->ns = aa_get_current_ns();
569 	file->private_data = rev;
570 
571 	return 0;
572 }
573 
574 static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
575 {
576 	struct aa_revision *rev = file->private_data;
577 	__poll_t mask = 0;
578 
579 	if (rev) {
580 		mutex_lock_nested(&rev->ns->lock, rev->ns->level);
581 		poll_wait(file, &rev->ns->wait, pt);
582 		if (rev->last_read < rev->ns->revision)
583 			mask |= EPOLLIN | EPOLLRDNORM;
584 		mutex_unlock(&rev->ns->lock);
585 	}
586 
587 	return mask;
588 }
589 
590 void __aa_bump_ns_revision(struct aa_ns *ns)
591 {
592 	ns->revision++;
593 	wake_up_interruptible(&ns->wait);
594 }
595 
596 static const struct file_operations aa_fs_ns_revision_fops = {
597 	.owner		= THIS_MODULE,
598 	.open		= ns_revision_open,
599 	.poll		= ns_revision_poll,
600 	.read		= ns_revision_read,
601 	.llseek		= generic_file_llseek,
602 	.release	= ns_revision_release,
603 };
604 
605 static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
606 			     const char *match_str, size_t match_len)
607 {
608 	struct aa_perms tmp;
609 	struct aa_dfa *dfa;
610 	unsigned int state = 0;
611 
612 	if (profile_unconfined(profile))
613 		return;
614 	if (profile->file.dfa && *match_str == AA_CLASS_FILE) {
615 		dfa = profile->file.dfa;
616 		state = aa_dfa_match_len(dfa, profile->file.start,
617 					 match_str + 1, match_len - 1);
618 		tmp = nullperms;
619 		if (state) {
620 			struct path_cond cond = { };
621 
622 			tmp = aa_compute_fperms(dfa, state, &cond);
623 		}
624 	} else if (profile->policy.dfa) {
625 		if (!PROFILE_MEDIATES_SAFE(profile, *match_str))
626 			return;	/* no change to current perms */
627 		dfa = profile->policy.dfa;
628 		state = aa_dfa_match_len(dfa, profile->policy.start[0],
629 					 match_str, match_len);
630 		if (state)
631 			aa_compute_perms(dfa, state, &tmp);
632 		else
633 			tmp = nullperms;
634 	}
635 	aa_apply_modes_to_perms(profile, &tmp);
636 	aa_perms_accum_raw(perms, &tmp);
637 }
638 
639 
640 /**
641  * query_data - queries a policy and writes its data to buf
642  * @buf: the resulting data is stored here (NOT NULL)
643  * @buf_len: size of buf
644  * @query: query string used to retrieve data
645  * @query_len: size of query including second NUL byte
646  *
647  * The buffers pointed to by buf and query may overlap. The query buffer is
648  * parsed before buf is written to.
649  *
650  * The query should look like "<LABEL>\0<KEY>\0", where <LABEL> is the name of
651  * the security confinement context and <KEY> is the name of the data to
652  * retrieve. <LABEL> and <KEY> must not be NUL-terminated.
653  *
654  * Don't expect the contents of buf to be preserved on failure.
655  *
656  * Returns: number of characters written to buf or -errno on failure
657  */
658 static ssize_t query_data(char *buf, size_t buf_len,
659 			  char *query, size_t query_len)
660 {
661 	char *out;
662 	const char *key;
663 	struct label_it i;
664 	struct aa_label *label, *curr;
665 	struct aa_profile *profile;
666 	struct aa_data *data;
667 	u32 bytes, blocks;
668 	__le32 outle32;
669 
670 	if (!query_len)
671 		return -EINVAL; /* need a query */
672 
673 	key = query + strnlen(query, query_len) + 1;
674 	if (key + 1 >= query + query_len)
675 		return -EINVAL; /* not enough space for a non-empty key */
676 	if (key + strnlen(key, query + query_len - key) >= query + query_len)
677 		return -EINVAL; /* must end with NUL */
678 
679 	if (buf_len < sizeof(bytes) + sizeof(blocks))
680 		return -EINVAL; /* not enough space */
681 
682 	curr = begin_current_label_crit_section();
683 	label = aa_label_parse(curr, query, GFP_KERNEL, false, false);
684 	end_current_label_crit_section(curr);
685 	if (IS_ERR(label))
686 		return PTR_ERR(label);
687 
688 	/* We are going to leave space for two numbers. The first is the total
689 	 * number of bytes we are writing after the first number. This is so
690 	 * users can read the full output without reallocation.
691 	 *
692 	 * The second number is the number of data blocks we're writing. An
693 	 * application might be confined by multiple policies having data in
694 	 * the same key.
695 	 */
696 	memset(buf, 0, sizeof(bytes) + sizeof(blocks));
697 	out = buf + sizeof(bytes) + sizeof(blocks);
698 
699 	blocks = 0;
700 	label_for_each_confined(i, label, profile) {
701 		if (!profile->data)
702 			continue;
703 
704 		data = rhashtable_lookup_fast(profile->data, &key,
705 					      profile->data->p);
706 
707 		if (data) {
708 			if (out + sizeof(outle32) + data->size > buf +
709 			    buf_len) {
710 				aa_put_label(label);
711 				return -EINVAL; /* not enough space */
712 			}
713 			outle32 = __cpu_to_le32(data->size);
714 			memcpy(out, &outle32, sizeof(outle32));
715 			out += sizeof(outle32);
716 			memcpy(out, data->data, data->size);
717 			out += data->size;
718 			blocks++;
719 		}
720 	}
721 	aa_put_label(label);
722 
723 	outle32 = __cpu_to_le32(out - buf - sizeof(bytes));
724 	memcpy(buf, &outle32, sizeof(outle32));
725 	outle32 = __cpu_to_le32(blocks);
726 	memcpy(buf + sizeof(bytes), &outle32, sizeof(outle32));
727 
728 	return out - buf;
729 }
730 
731 /**
732  * query_label - queries a label and writes permissions to buf
733  * @buf: the resulting permissions string is stored here (NOT NULL)
734  * @buf_len: size of buf
735  * @query: binary query string to match against the dfa
736  * @query_len: size of query
737  * @view_only: only compute for querier's view
738  *
739  * The buffers pointed to by buf and query may overlap. The query buffer is
740  * parsed before buf is written to.
741  *
742  * The query should look like "LABEL_NAME\0DFA_STRING" where LABEL_NAME is
743  * the name of the label, in the current namespace, that is to be queried and
744  * DFA_STRING is a binary string to match against the label(s)'s DFA.
745  *
746  * LABEL_NAME must be NUL terminated. DFA_STRING may contain NUL characters
747  * but must *not* be NUL terminated.
748  *
749  * Returns: number of characters written to buf or -errno on failure
750  */
751 static ssize_t query_label(char *buf, size_t buf_len,
752 			   char *query, size_t query_len, bool view_only)
753 {
754 	struct aa_profile *profile;
755 	struct aa_label *label, *curr;
756 	char *label_name, *match_str;
757 	size_t label_name_len, match_len;
758 	struct aa_perms perms;
759 	struct label_it i;
760 
761 	if (!query_len)
762 		return -EINVAL;
763 
764 	label_name = query;
765 	label_name_len = strnlen(query, query_len);
766 	if (!label_name_len || label_name_len == query_len)
767 		return -EINVAL;
768 
769 	/**
770 	 * The extra byte is to account for the null byte between the
771 	 * profile name and dfa string. profile_name_len is greater
772 	 * than zero and less than query_len, so a byte can be safely
773 	 * added or subtracted.
774 	 */
775 	match_str = label_name + label_name_len + 1;
776 	match_len = query_len - label_name_len - 1;
777 
778 	curr = begin_current_label_crit_section();
779 	label = aa_label_parse(curr, label_name, GFP_KERNEL, false, false);
780 	end_current_label_crit_section(curr);
781 	if (IS_ERR(label))
782 		return PTR_ERR(label);
783 
784 	perms = allperms;
785 	if (view_only) {
786 		label_for_each_in_ns(i, labels_ns(label), label, profile) {
787 			profile_query_cb(profile, &perms, match_str, match_len);
788 		}
789 	} else {
790 		label_for_each(i, label, profile) {
791 			profile_query_cb(profile, &perms, match_str, match_len);
792 		}
793 	}
794 	aa_put_label(label);
795 
796 	return scnprintf(buf, buf_len,
797 		      "allow 0x%08x\ndeny 0x%08x\naudit 0x%08x\nquiet 0x%08x\n",
798 		      perms.allow, perms.deny, perms.audit, perms.quiet);
799 }
800 
801 /*
802  * Transaction based IO.
803  * The file expects a write which triggers the transaction, and then
804  * possibly a read(s) which collects the result - which is stored in a
805  * file-local buffer. Once a new write is performed, a new set of results
806  * are stored in the file-local buffer.
807  */
808 struct multi_transaction {
809 	struct kref count;
810 	ssize_t size;
811 	char data[0];
812 };
813 
814 #define MULTI_TRANSACTION_LIMIT (PAGE_SIZE - sizeof(struct multi_transaction))
815 /* TODO: replace with per file lock */
816 static DEFINE_SPINLOCK(multi_transaction_lock);
817 
818 static void multi_transaction_kref(struct kref *kref)
819 {
820 	struct multi_transaction *t;
821 
822 	t = container_of(kref, struct multi_transaction, count);
823 	free_page((unsigned long) t);
824 }
825 
826 static struct multi_transaction *
827 get_multi_transaction(struct multi_transaction *t)
828 {
829 	if  (t)
830 		kref_get(&(t->count));
831 
832 	return t;
833 }
834 
835 static void put_multi_transaction(struct multi_transaction *t)
836 {
837 	if (t)
838 		kref_put(&(t->count), multi_transaction_kref);
839 }
840 
841 /* does not increment @new's count */
842 static void multi_transaction_set(struct file *file,
843 				  struct multi_transaction *new, size_t n)
844 {
845 	struct multi_transaction *old;
846 
847 	AA_BUG(n > MULTI_TRANSACTION_LIMIT);
848 
849 	new->size = n;
850 	spin_lock(&multi_transaction_lock);
851 	old = (struct multi_transaction *) file->private_data;
852 	file->private_data = new;
853 	spin_unlock(&multi_transaction_lock);
854 	put_multi_transaction(old);
855 }
856 
857 static struct multi_transaction *multi_transaction_new(struct file *file,
858 						       const char __user *buf,
859 						       size_t size)
860 {
861 	struct multi_transaction *t;
862 
863 	if (size > MULTI_TRANSACTION_LIMIT - 1)
864 		return ERR_PTR(-EFBIG);
865 
866 	t = (struct multi_transaction *)get_zeroed_page(GFP_KERNEL);
867 	if (!t)
868 		return ERR_PTR(-ENOMEM);
869 	kref_init(&t->count);
870 	if (copy_from_user(t->data, buf, size))
871 		return ERR_PTR(-EFAULT);
872 
873 	return t;
874 }
875 
876 static ssize_t multi_transaction_read(struct file *file, char __user *buf,
877 				       size_t size, loff_t *pos)
878 {
879 	struct multi_transaction *t;
880 	ssize_t ret;
881 
882 	spin_lock(&multi_transaction_lock);
883 	t = get_multi_transaction(file->private_data);
884 	spin_unlock(&multi_transaction_lock);
885 	if (!t)
886 		return 0;
887 
888 	ret = simple_read_from_buffer(buf, size, pos, t->data, t->size);
889 	put_multi_transaction(t);
890 
891 	return ret;
892 }
893 
894 static int multi_transaction_release(struct inode *inode, struct file *file)
895 {
896 	put_multi_transaction(file->private_data);
897 
898 	return 0;
899 }
900 
901 #define QUERY_CMD_LABEL		"label\0"
902 #define QUERY_CMD_LABEL_LEN	6
903 #define QUERY_CMD_PROFILE	"profile\0"
904 #define QUERY_CMD_PROFILE_LEN	8
905 #define QUERY_CMD_LABELALL	"labelall\0"
906 #define QUERY_CMD_LABELALL_LEN	9
907 #define QUERY_CMD_DATA		"data\0"
908 #define QUERY_CMD_DATA_LEN	5
909 
910 /**
911  * aa_write_access - generic permissions and data query
912  * @file: pointer to open apparmorfs/access file
913  * @ubuf: user buffer containing the complete query string (NOT NULL)
914  * @count: size of ubuf
915  * @ppos: position in the file (MUST BE ZERO)
916  *
917  * Allows for one permissions or data query per open(), write(), and read()
918  * sequence. The only queries currently supported are label-based queries for
919  * permissions or data.
920  *
921  * For permissions queries, ubuf must begin with "label\0", followed by the
922  * profile query specific format described in the query_label() function
923  * documentation.
924  *
925  * For data queries, ubuf must have the form "data\0<LABEL>\0<KEY>\0", where
926  * <LABEL> is the name of the security confinement context and <KEY> is the
927  * name of the data to retrieve.
928  *
929  * Returns: number of bytes written or -errno on failure
930  */
931 static ssize_t aa_write_access(struct file *file, const char __user *ubuf,
932 			       size_t count, loff_t *ppos)
933 {
934 	struct multi_transaction *t;
935 	ssize_t len;
936 
937 	if (*ppos)
938 		return -ESPIPE;
939 
940 	t = multi_transaction_new(file, ubuf, count);
941 	if (IS_ERR(t))
942 		return PTR_ERR(t);
943 
944 	if (count > QUERY_CMD_PROFILE_LEN &&
945 	    !memcmp(t->data, QUERY_CMD_PROFILE, QUERY_CMD_PROFILE_LEN)) {
946 		len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
947 				  t->data + QUERY_CMD_PROFILE_LEN,
948 				  count - QUERY_CMD_PROFILE_LEN, true);
949 	} else if (count > QUERY_CMD_LABEL_LEN &&
950 		   !memcmp(t->data, QUERY_CMD_LABEL, QUERY_CMD_LABEL_LEN)) {
951 		len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
952 				  t->data + QUERY_CMD_LABEL_LEN,
953 				  count - QUERY_CMD_LABEL_LEN, true);
954 	} else if (count > QUERY_CMD_LABELALL_LEN &&
955 		   !memcmp(t->data, QUERY_CMD_LABELALL,
956 			   QUERY_CMD_LABELALL_LEN)) {
957 		len = query_label(t->data, MULTI_TRANSACTION_LIMIT,
958 				  t->data + QUERY_CMD_LABELALL_LEN,
959 				  count - QUERY_CMD_LABELALL_LEN, false);
960 	} else if (count > QUERY_CMD_DATA_LEN &&
961 		   !memcmp(t->data, QUERY_CMD_DATA, QUERY_CMD_DATA_LEN)) {
962 		len = query_data(t->data, MULTI_TRANSACTION_LIMIT,
963 				 t->data + QUERY_CMD_DATA_LEN,
964 				 count - QUERY_CMD_DATA_LEN);
965 	} else
966 		len = -EINVAL;
967 
968 	if (len < 0) {
969 		put_multi_transaction(t);
970 		return len;
971 	}
972 
973 	multi_transaction_set(file, t, len);
974 
975 	return count;
976 }
977 
978 static const struct file_operations aa_sfs_access = {
979 	.write		= aa_write_access,
980 	.read		= multi_transaction_read,
981 	.release	= multi_transaction_release,
982 	.llseek		= generic_file_llseek,
983 };
984 
985 static int aa_sfs_seq_show(struct seq_file *seq, void *v)
986 {
987 	struct aa_sfs_entry *fs_file = seq->private;
988 
989 	if (!fs_file)
990 		return 0;
991 
992 	switch (fs_file->v_type) {
993 	case AA_SFS_TYPE_BOOLEAN:
994 		seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
995 		break;
996 	case AA_SFS_TYPE_STRING:
997 		seq_printf(seq, "%s\n", fs_file->v.string);
998 		break;
999 	case AA_SFS_TYPE_U64:
1000 		seq_printf(seq, "%#08lx\n", fs_file->v.u64);
1001 		break;
1002 	default:
1003 		/* Ignore unpritable entry types. */
1004 		break;
1005 	}
1006 
1007 	return 0;
1008 }
1009 
1010 static int aa_sfs_seq_open(struct inode *inode, struct file *file)
1011 {
1012 	return single_open(file, aa_sfs_seq_show, inode->i_private);
1013 }
1014 
1015 const struct file_operations aa_sfs_seq_file_ops = {
1016 	.owner		= THIS_MODULE,
1017 	.open		= aa_sfs_seq_open,
1018 	.read		= seq_read,
1019 	.llseek		= seq_lseek,
1020 	.release	= single_release,
1021 };
1022 
1023 /*
1024  * profile based file operations
1025  *     policy/profiles/XXXX/profiles/ *
1026  */
1027 
1028 #define SEQ_PROFILE_FOPS(NAME)						      \
1029 static int seq_profile_ ##NAME ##_open(struct inode *inode, struct file *file)\
1030 {									      \
1031 	return seq_profile_open(inode, file, seq_profile_ ##NAME ##_show);    \
1032 }									      \
1033 									      \
1034 static const struct file_operations seq_profile_ ##NAME ##_fops = {	      \
1035 	.owner		= THIS_MODULE,					      \
1036 	.open		= seq_profile_ ##NAME ##_open,			      \
1037 	.read		= seq_read,					      \
1038 	.llseek		= seq_lseek,					      \
1039 	.release	= seq_profile_release,				      \
1040 }									      \
1041 
1042 static int seq_profile_open(struct inode *inode, struct file *file,
1043 			    int (*show)(struct seq_file *, void *))
1044 {
1045 	struct aa_proxy *proxy = aa_get_proxy(inode->i_private);
1046 	int error = single_open(file, show, proxy);
1047 
1048 	if (error) {
1049 		file->private_data = NULL;
1050 		aa_put_proxy(proxy);
1051 	}
1052 
1053 	return error;
1054 }
1055 
1056 static int seq_profile_release(struct inode *inode, struct file *file)
1057 {
1058 	struct seq_file *seq = (struct seq_file *) file->private_data;
1059 	if (seq)
1060 		aa_put_proxy(seq->private);
1061 	return single_release(inode, file);
1062 }
1063 
1064 static int seq_profile_name_show(struct seq_file *seq, void *v)
1065 {
1066 	struct aa_proxy *proxy = seq->private;
1067 	struct aa_label *label = aa_get_label_rcu(&proxy->label);
1068 	struct aa_profile *profile = labels_profile(label);
1069 	seq_printf(seq, "%s\n", profile->base.name);
1070 	aa_put_label(label);
1071 
1072 	return 0;
1073 }
1074 
1075 static int seq_profile_mode_show(struct seq_file *seq, void *v)
1076 {
1077 	struct aa_proxy *proxy = seq->private;
1078 	struct aa_label *label = aa_get_label_rcu(&proxy->label);
1079 	struct aa_profile *profile = labels_profile(label);
1080 	seq_printf(seq, "%s\n", aa_profile_mode_names[profile->mode]);
1081 	aa_put_label(label);
1082 
1083 	return 0;
1084 }
1085 
1086 static int seq_profile_attach_show(struct seq_file *seq, void *v)
1087 {
1088 	struct aa_proxy *proxy = seq->private;
1089 	struct aa_label *label = aa_get_label_rcu(&proxy->label);
1090 	struct aa_profile *profile = labels_profile(label);
1091 	if (profile->attach)
1092 		seq_printf(seq, "%s\n", profile->attach);
1093 	else if (profile->xmatch)
1094 		seq_puts(seq, "<unknown>\n");
1095 	else
1096 		seq_printf(seq, "%s\n", profile->base.name);
1097 	aa_put_label(label);
1098 
1099 	return 0;
1100 }
1101 
1102 static int seq_profile_hash_show(struct seq_file *seq, void *v)
1103 {
1104 	struct aa_proxy *proxy = seq->private;
1105 	struct aa_label *label = aa_get_label_rcu(&proxy->label);
1106 	struct aa_profile *profile = labels_profile(label);
1107 	unsigned int i, size = aa_hash_size();
1108 
1109 	if (profile->hash) {
1110 		for (i = 0; i < size; i++)
1111 			seq_printf(seq, "%.2x", profile->hash[i]);
1112 		seq_putc(seq, '\n');
1113 	}
1114 	aa_put_label(label);
1115 
1116 	return 0;
1117 }
1118 
1119 SEQ_PROFILE_FOPS(name);
1120 SEQ_PROFILE_FOPS(mode);
1121 SEQ_PROFILE_FOPS(attach);
1122 SEQ_PROFILE_FOPS(hash);
1123 
1124 /*
1125  * namespace based files
1126  *     several root files and
1127  *     policy/ *
1128  */
1129 
1130 #define SEQ_NS_FOPS(NAME)						      \
1131 static int seq_ns_ ##NAME ##_open(struct inode *inode, struct file *file)     \
1132 {									      \
1133 	return single_open(file, seq_ns_ ##NAME ##_show, inode->i_private);   \
1134 }									      \
1135 									      \
1136 static const struct file_operations seq_ns_ ##NAME ##_fops = {	      \
1137 	.owner		= THIS_MODULE,					      \
1138 	.open		= seq_ns_ ##NAME ##_open,			      \
1139 	.read		= seq_read,					      \
1140 	.llseek		= seq_lseek,					      \
1141 	.release	= single_release,				      \
1142 }									      \
1143 
1144 static int seq_ns_stacked_show(struct seq_file *seq, void *v)
1145 {
1146 	struct aa_label *label;
1147 
1148 	label = begin_current_label_crit_section();
1149 	seq_printf(seq, "%s\n", label->size > 1 ? "yes" : "no");
1150 	end_current_label_crit_section(label);
1151 
1152 	return 0;
1153 }
1154 
1155 static int seq_ns_nsstacked_show(struct seq_file *seq, void *v)
1156 {
1157 	struct aa_label *label;
1158 	struct aa_profile *profile;
1159 	struct label_it it;
1160 	int count = 1;
1161 
1162 	label = begin_current_label_crit_section();
1163 
1164 	if (label->size > 1) {
1165 		label_for_each(it, label, profile)
1166 			if (profile->ns != labels_ns(label)) {
1167 				count++;
1168 				break;
1169 			}
1170 	}
1171 
1172 	seq_printf(seq, "%s\n", count > 1 ? "yes" : "no");
1173 	end_current_label_crit_section(label);
1174 
1175 	return 0;
1176 }
1177 
1178 static int seq_ns_level_show(struct seq_file *seq, void *v)
1179 {
1180 	struct aa_label *label;
1181 
1182 	label = begin_current_label_crit_section();
1183 	seq_printf(seq, "%d\n", labels_ns(label)->level);
1184 	end_current_label_crit_section(label);
1185 
1186 	return 0;
1187 }
1188 
1189 static int seq_ns_name_show(struct seq_file *seq, void *v)
1190 {
1191 	struct aa_label *label = begin_current_label_crit_section();
1192 
1193 	seq_printf(seq, "%s\n", aa_ns_name(labels_ns(label),
1194 					   labels_ns(label), true));
1195 	end_current_label_crit_section(label);
1196 
1197 	return 0;
1198 }
1199 
1200 SEQ_NS_FOPS(stacked);
1201 SEQ_NS_FOPS(nsstacked);
1202 SEQ_NS_FOPS(level);
1203 SEQ_NS_FOPS(name);
1204 
1205 
1206 /* policy/raw_data/ * file ops */
1207 
1208 #define SEQ_RAWDATA_FOPS(NAME)						      \
1209 static int seq_rawdata_ ##NAME ##_open(struct inode *inode, struct file *file)\
1210 {									      \
1211 	return seq_rawdata_open(inode, file, seq_rawdata_ ##NAME ##_show);    \
1212 }									      \
1213 									      \
1214 static const struct file_operations seq_rawdata_ ##NAME ##_fops = {	      \
1215 	.owner		= THIS_MODULE,					      \
1216 	.open		= seq_rawdata_ ##NAME ##_open,			      \
1217 	.read		= seq_read,					      \
1218 	.llseek		= seq_lseek,					      \
1219 	.release	= seq_rawdata_release,				      \
1220 }									      \
1221 
1222 static int seq_rawdata_open(struct inode *inode, struct file *file,
1223 			    int (*show)(struct seq_file *, void *))
1224 {
1225 	struct aa_loaddata *data = __aa_get_loaddata(inode->i_private);
1226 	int error;
1227 
1228 	if (!data)
1229 		/* lost race this ent is being reaped */
1230 		return -ENOENT;
1231 
1232 	error = single_open(file, show, data);
1233 	if (error) {
1234 		AA_BUG(file->private_data &&
1235 		       ((struct seq_file *)file->private_data)->private);
1236 		aa_put_loaddata(data);
1237 	}
1238 
1239 	return error;
1240 }
1241 
1242 static int seq_rawdata_release(struct inode *inode, struct file *file)
1243 {
1244 	struct seq_file *seq = (struct seq_file *) file->private_data;
1245 
1246 	if (seq)
1247 		aa_put_loaddata(seq->private);
1248 
1249 	return single_release(inode, file);
1250 }
1251 
1252 static int seq_rawdata_abi_show(struct seq_file *seq, void *v)
1253 {
1254 	struct aa_loaddata *data = seq->private;
1255 
1256 	seq_printf(seq, "v%d\n", data->abi);
1257 
1258 	return 0;
1259 }
1260 
1261 static int seq_rawdata_revision_show(struct seq_file *seq, void *v)
1262 {
1263 	struct aa_loaddata *data = seq->private;
1264 
1265 	seq_printf(seq, "%ld\n", data->revision);
1266 
1267 	return 0;
1268 }
1269 
1270 static int seq_rawdata_hash_show(struct seq_file *seq, void *v)
1271 {
1272 	struct aa_loaddata *data = seq->private;
1273 	unsigned int i, size = aa_hash_size();
1274 
1275 	if (data->hash) {
1276 		for (i = 0; i < size; i++)
1277 			seq_printf(seq, "%.2x", data->hash[i]);
1278 		seq_putc(seq, '\n');
1279 	}
1280 
1281 	return 0;
1282 }
1283 
1284 SEQ_RAWDATA_FOPS(abi);
1285 SEQ_RAWDATA_FOPS(revision);
1286 SEQ_RAWDATA_FOPS(hash);
1287 
1288 static ssize_t rawdata_read(struct file *file, char __user *buf, size_t size,
1289 			    loff_t *ppos)
1290 {
1291 	struct aa_loaddata *rawdata = file->private_data;
1292 
1293 	return simple_read_from_buffer(buf, size, ppos, rawdata->data,
1294 				       rawdata->size);
1295 }
1296 
1297 static int rawdata_release(struct inode *inode, struct file *file)
1298 {
1299 	aa_put_loaddata(file->private_data);
1300 
1301 	return 0;
1302 }
1303 
1304 static int rawdata_open(struct inode *inode, struct file *file)
1305 {
1306 	if (!policy_view_capable(NULL))
1307 		return -EACCES;
1308 	file->private_data = __aa_get_loaddata(inode->i_private);
1309 	if (!file->private_data)
1310 		/* lost race: this entry is being reaped */
1311 		return -ENOENT;
1312 
1313 	return 0;
1314 }
1315 
1316 static const struct file_operations rawdata_fops = {
1317 	.open = rawdata_open,
1318 	.read = rawdata_read,
1319 	.llseek = generic_file_llseek,
1320 	.release = rawdata_release,
1321 };
1322 
1323 static void remove_rawdata_dents(struct aa_loaddata *rawdata)
1324 {
1325 	int i;
1326 
1327 	for (i = 0; i < AAFS_LOADDATA_NDENTS; i++) {
1328 		if (!IS_ERR_OR_NULL(rawdata->dents[i])) {
1329 			/* no refcounts on i_private */
1330 			aafs_remove(rawdata->dents[i]);
1331 			rawdata->dents[i] = NULL;
1332 		}
1333 	}
1334 }
1335 
1336 void __aa_fs_remove_rawdata(struct aa_loaddata *rawdata)
1337 {
1338 	AA_BUG(rawdata->ns && !mutex_is_locked(&rawdata->ns->lock));
1339 
1340 	if (rawdata->ns) {
1341 		remove_rawdata_dents(rawdata);
1342 		list_del_init(&rawdata->list);
1343 		aa_put_ns(rawdata->ns);
1344 		rawdata->ns = NULL;
1345 	}
1346 }
1347 
1348 int __aa_fs_create_rawdata(struct aa_ns *ns, struct aa_loaddata *rawdata)
1349 {
1350 	struct dentry *dent, *dir;
1351 
1352 	AA_BUG(!ns);
1353 	AA_BUG(!rawdata);
1354 	AA_BUG(!mutex_is_locked(&ns->lock));
1355 	AA_BUG(!ns_subdata_dir(ns));
1356 
1357 	/*
1358 	 * just use ns revision dir was originally created at. This is
1359 	 * under ns->lock and if load is successful revision will be
1360 	 * bumped and is guaranteed to be unique
1361 	 */
1362 	rawdata->name = kasprintf(GFP_KERNEL, "%ld", ns->revision);
1363 	if (!rawdata->name)
1364 		return -ENOMEM;
1365 
1366 	dir = aafs_create_dir(rawdata->name, ns_subdata_dir(ns));
1367 	if (IS_ERR(dir))
1368 		/* ->name freed when rawdata freed */
1369 		return PTR_ERR(dir);
1370 	rawdata->dents[AAFS_LOADDATA_DIR] = dir;
1371 
1372 	dent = aafs_create_file("abi", S_IFREG | 0444, dir, rawdata,
1373 				      &seq_rawdata_abi_fops);
1374 	if (IS_ERR(dent))
1375 		goto fail;
1376 	rawdata->dents[AAFS_LOADDATA_ABI] = dent;
1377 
1378 	dent = aafs_create_file("revision", S_IFREG | 0444, dir, rawdata,
1379 				      &seq_rawdata_revision_fops);
1380 	if (IS_ERR(dent))
1381 		goto fail;
1382 	rawdata->dents[AAFS_LOADDATA_REVISION] = dent;
1383 
1384 	if (aa_g_hash_policy) {
1385 		dent = aafs_create_file("sha1", S_IFREG | 0444, dir,
1386 					      rawdata, &seq_rawdata_hash_fops);
1387 		if (IS_ERR(dent))
1388 			goto fail;
1389 		rawdata->dents[AAFS_LOADDATA_HASH] = dent;
1390 	}
1391 
1392 	dent = aafs_create_file("raw_data", S_IFREG | 0444,
1393 				      dir, rawdata, &rawdata_fops);
1394 	if (IS_ERR(dent))
1395 		goto fail;
1396 	rawdata->dents[AAFS_LOADDATA_DATA] = dent;
1397 	d_inode(dent)->i_size = rawdata->size;
1398 
1399 	rawdata->ns = aa_get_ns(ns);
1400 	list_add(&rawdata->list, &ns->rawdata_list);
1401 	/* no refcount on inode rawdata */
1402 
1403 	return 0;
1404 
1405 fail:
1406 	remove_rawdata_dents(rawdata);
1407 
1408 	return PTR_ERR(dent);
1409 }
1410 
1411 /** fns to setup dynamic per profile/namespace files **/
1412 
1413 /**
1414  *
1415  * Requires: @profile->ns->lock held
1416  */
1417 void __aafs_profile_rmdir(struct aa_profile *profile)
1418 {
1419 	struct aa_profile *child;
1420 	int i;
1421 
1422 	if (!profile)
1423 		return;
1424 
1425 	list_for_each_entry(child, &profile->base.profiles, base.list)
1426 		__aafs_profile_rmdir(child);
1427 
1428 	for (i = AAFS_PROF_SIZEOF - 1; i >= 0; --i) {
1429 		struct aa_proxy *proxy;
1430 		if (!profile->dents[i])
1431 			continue;
1432 
1433 		proxy = d_inode(profile->dents[i])->i_private;
1434 		aafs_remove(profile->dents[i]);
1435 		aa_put_proxy(proxy);
1436 		profile->dents[i] = NULL;
1437 	}
1438 }
1439 
1440 /**
1441  *
1442  * Requires: @old->ns->lock held
1443  */
1444 void __aafs_profile_migrate_dents(struct aa_profile *old,
1445 				  struct aa_profile *new)
1446 {
1447 	int i;
1448 
1449 	AA_BUG(!old);
1450 	AA_BUG(!new);
1451 	AA_BUG(!mutex_is_locked(&profiles_ns(old)->lock));
1452 
1453 	for (i = 0; i < AAFS_PROF_SIZEOF; i++) {
1454 		new->dents[i] = old->dents[i];
1455 		if (new->dents[i])
1456 			new->dents[i]->d_inode->i_mtime = current_time(new->dents[i]->d_inode);
1457 		old->dents[i] = NULL;
1458 	}
1459 }
1460 
1461 static struct dentry *create_profile_file(struct dentry *dir, const char *name,
1462 					  struct aa_profile *profile,
1463 					  const struct file_operations *fops)
1464 {
1465 	struct aa_proxy *proxy = aa_get_proxy(profile->label.proxy);
1466 	struct dentry *dent;
1467 
1468 	dent = aafs_create_file(name, S_IFREG | 0444, dir, proxy, fops);
1469 	if (IS_ERR(dent))
1470 		aa_put_proxy(proxy);
1471 
1472 	return dent;
1473 }
1474 
1475 static int profile_depth(struct aa_profile *profile)
1476 {
1477 	int depth = 0;
1478 
1479 	rcu_read_lock();
1480 	for (depth = 0; profile; profile = rcu_access_pointer(profile->parent))
1481 		depth++;
1482 	rcu_read_unlock();
1483 
1484 	return depth;
1485 }
1486 
1487 static int gen_symlink_name(char *buffer, size_t bsize, int depth,
1488 			    const char *dirname, const char *fname)
1489 {
1490 	int error;
1491 
1492 	for (; depth > 0; depth--) {
1493 		if (bsize < 7)
1494 			return -ENAMETOOLONG;
1495 		strcpy(buffer, "../../");
1496 		buffer += 6;
1497 		bsize -= 6;
1498 	}
1499 
1500 	error = snprintf(buffer, bsize, "raw_data/%s/%s", dirname, fname);
1501 	if (error >= bsize || error < 0)
1502 		return -ENAMETOOLONG;
1503 
1504 	return 0;
1505 }
1506 
1507 /*
1508  * Requires: @profile->ns->lock held
1509  */
1510 int __aafs_profile_mkdir(struct aa_profile *profile, struct dentry *parent)
1511 {
1512 	struct aa_profile *child;
1513 	struct dentry *dent = NULL, *dir;
1514 	int error;
1515 
1516 	AA_BUG(!profile);
1517 	AA_BUG(!mutex_is_locked(&profiles_ns(profile)->lock));
1518 
1519 	if (!parent) {
1520 		struct aa_profile *p;
1521 		p = aa_deref_parent(profile);
1522 		dent = prof_dir(p);
1523 		/* adding to parent that previously didn't have children */
1524 		dent = aafs_create_dir("profiles", dent);
1525 		if (IS_ERR(dent))
1526 			goto fail;
1527 		prof_child_dir(p) = parent = dent;
1528 	}
1529 
1530 	if (!profile->dirname) {
1531 		int len, id_len;
1532 		len = mangle_name(profile->base.name, NULL);
1533 		id_len = snprintf(NULL, 0, ".%ld", profile->ns->uniq_id);
1534 
1535 		profile->dirname = kmalloc(len + id_len + 1, GFP_KERNEL);
1536 		if (!profile->dirname) {
1537 			error = -ENOMEM;
1538 			goto fail2;
1539 		}
1540 
1541 		mangle_name(profile->base.name, profile->dirname);
1542 		sprintf(profile->dirname + len, ".%ld", profile->ns->uniq_id++);
1543 	}
1544 
1545 	dent = aafs_create_dir(profile->dirname, parent);
1546 	if (IS_ERR(dent))
1547 		goto fail;
1548 	prof_dir(profile) = dir = dent;
1549 
1550 	dent = create_profile_file(dir, "name", profile,
1551 				   &seq_profile_name_fops);
1552 	if (IS_ERR(dent))
1553 		goto fail;
1554 	profile->dents[AAFS_PROF_NAME] = dent;
1555 
1556 	dent = create_profile_file(dir, "mode", profile,
1557 				   &seq_profile_mode_fops);
1558 	if (IS_ERR(dent))
1559 		goto fail;
1560 	profile->dents[AAFS_PROF_MODE] = dent;
1561 
1562 	dent = create_profile_file(dir, "attach", profile,
1563 				   &seq_profile_attach_fops);
1564 	if (IS_ERR(dent))
1565 		goto fail;
1566 	profile->dents[AAFS_PROF_ATTACH] = dent;
1567 
1568 	if (profile->hash) {
1569 		dent = create_profile_file(dir, "sha1", profile,
1570 					   &seq_profile_hash_fops);
1571 		if (IS_ERR(dent))
1572 			goto fail;
1573 		profile->dents[AAFS_PROF_HASH] = dent;
1574 	}
1575 
1576 	if (profile->rawdata) {
1577 		char target[64];
1578 		int depth = profile_depth(profile);
1579 
1580 		error = gen_symlink_name(target, sizeof(target), depth,
1581 					 profile->rawdata->name, "sha1");
1582 		if (error < 0)
1583 			goto fail2;
1584 		dent = aafs_create_symlink("raw_sha1", dir, target, NULL);
1585 		if (IS_ERR(dent))
1586 			goto fail;
1587 		profile->dents[AAFS_PROF_RAW_HASH] = dent;
1588 
1589 		error = gen_symlink_name(target, sizeof(target), depth,
1590 					 profile->rawdata->name, "abi");
1591 		if (error < 0)
1592 			goto fail2;
1593 		dent = aafs_create_symlink("raw_abi", dir, target, NULL);
1594 		if (IS_ERR(dent))
1595 			goto fail;
1596 		profile->dents[AAFS_PROF_RAW_ABI] = dent;
1597 
1598 		error = gen_symlink_name(target, sizeof(target), depth,
1599 					 profile->rawdata->name, "raw_data");
1600 		if (error < 0)
1601 			goto fail2;
1602 		dent = aafs_create_symlink("raw_data", dir, target, NULL);
1603 		if (IS_ERR(dent))
1604 			goto fail;
1605 		profile->dents[AAFS_PROF_RAW_DATA] = dent;
1606 	}
1607 
1608 	list_for_each_entry(child, &profile->base.profiles, base.list) {
1609 		error = __aafs_profile_mkdir(child, prof_child_dir(profile));
1610 		if (error)
1611 			goto fail2;
1612 	}
1613 
1614 	return 0;
1615 
1616 fail:
1617 	error = PTR_ERR(dent);
1618 
1619 fail2:
1620 	__aafs_profile_rmdir(profile);
1621 
1622 	return error;
1623 }
1624 
1625 static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
1626 {
1627 	struct aa_ns *ns, *parent;
1628 	/* TODO: improve permission check */
1629 	struct aa_label *label;
1630 	int error;
1631 
1632 	label = begin_current_label_crit_section();
1633 	error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
1634 	end_current_label_crit_section(label);
1635 	if (error)
1636 		return error;
1637 
1638 	parent = aa_get_ns(dir->i_private);
1639 	AA_BUG(d_inode(ns_subns_dir(parent)) != dir);
1640 
1641 	/* we have to unlock and then relock to get locking order right
1642 	 * for pin_fs
1643 	 */
1644 	inode_unlock(dir);
1645 	error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
1646 	mutex_lock_nested(&parent->lock, parent->level);
1647 	inode_lock_nested(dir, I_MUTEX_PARENT);
1648 	if (error)
1649 		goto out;
1650 
1651 	error = __aafs_setup_d_inode(dir, dentry, mode | S_IFDIR,  NULL,
1652 				     NULL, NULL, NULL);
1653 	if (error)
1654 		goto out_pin;
1655 
1656 	ns = __aa_find_or_create_ns(parent, READ_ONCE(dentry->d_name.name),
1657 				    dentry);
1658 	if (IS_ERR(ns)) {
1659 		error = PTR_ERR(ns);
1660 		ns = NULL;
1661 	}
1662 
1663 	aa_put_ns(ns);		/* list ref remains */
1664 out_pin:
1665 	if (error)
1666 		simple_release_fs(&aafs_mnt, &aafs_count);
1667 out:
1668 	mutex_unlock(&parent->lock);
1669 	aa_put_ns(parent);
1670 
1671 	return error;
1672 }
1673 
1674 static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
1675 {
1676 	struct aa_ns *ns, *parent;
1677 	/* TODO: improve permission check */
1678 	struct aa_label *label;
1679 	int error;
1680 
1681 	label = begin_current_label_crit_section();
1682 	error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY);
1683 	end_current_label_crit_section(label);
1684 	if (error)
1685 		return error;
1686 
1687 	 parent = aa_get_ns(dir->i_private);
1688 	/* rmdir calls the generic securityfs functions to remove files
1689 	 * from the apparmor dir. It is up to the apparmor ns locking
1690 	 * to avoid races.
1691 	 */
1692 	inode_unlock(dir);
1693 	inode_unlock(dentry->d_inode);
1694 
1695 	mutex_lock_nested(&parent->lock, parent->level);
1696 	ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name,
1697 				     dentry->d_name.len));
1698 	if (!ns) {
1699 		error = -ENOENT;
1700 		goto out;
1701 	}
1702 	AA_BUG(ns_dir(ns) != dentry);
1703 
1704 	__aa_remove_ns(ns);
1705 	aa_put_ns(ns);
1706 
1707 out:
1708 	mutex_unlock(&parent->lock);
1709 	inode_lock_nested(dir, I_MUTEX_PARENT);
1710 	inode_lock(dentry->d_inode);
1711 	aa_put_ns(parent);
1712 
1713 	return error;
1714 }
1715 
1716 static const struct inode_operations ns_dir_inode_operations = {
1717 	.lookup		= simple_lookup,
1718 	.mkdir		= ns_mkdir_op,
1719 	.rmdir		= ns_rmdir_op,
1720 };
1721 
1722 static void __aa_fs_list_remove_rawdata(struct aa_ns *ns)
1723 {
1724 	struct aa_loaddata *ent, *tmp;
1725 
1726 	AA_BUG(!mutex_is_locked(&ns->lock));
1727 
1728 	list_for_each_entry_safe(ent, tmp, &ns->rawdata_list, list)
1729 		__aa_fs_remove_rawdata(ent);
1730 }
1731 
1732 /**
1733  *
1734  * Requires: @ns->lock held
1735  */
1736 void __aafs_ns_rmdir(struct aa_ns *ns)
1737 {
1738 	struct aa_ns *sub;
1739 	struct aa_profile *child;
1740 	int i;
1741 
1742 	if (!ns)
1743 		return;
1744 	AA_BUG(!mutex_is_locked(&ns->lock));
1745 
1746 	list_for_each_entry(child, &ns->base.profiles, base.list)
1747 		__aafs_profile_rmdir(child);
1748 
1749 	list_for_each_entry(sub, &ns->sub_ns, base.list) {
1750 		mutex_lock_nested(&sub->lock, sub->level);
1751 		__aafs_ns_rmdir(sub);
1752 		mutex_unlock(&sub->lock);
1753 	}
1754 
1755 	__aa_fs_list_remove_rawdata(ns);
1756 
1757 	if (ns_subns_dir(ns)) {
1758 		sub = d_inode(ns_subns_dir(ns))->i_private;
1759 		aa_put_ns(sub);
1760 	}
1761 	if (ns_subload(ns)) {
1762 		sub = d_inode(ns_subload(ns))->i_private;
1763 		aa_put_ns(sub);
1764 	}
1765 	if (ns_subreplace(ns)) {
1766 		sub = d_inode(ns_subreplace(ns))->i_private;
1767 		aa_put_ns(sub);
1768 	}
1769 	if (ns_subremove(ns)) {
1770 		sub = d_inode(ns_subremove(ns))->i_private;
1771 		aa_put_ns(sub);
1772 	}
1773 	if (ns_subrevision(ns)) {
1774 		sub = d_inode(ns_subrevision(ns))->i_private;
1775 		aa_put_ns(sub);
1776 	}
1777 
1778 	for (i = AAFS_NS_SIZEOF - 1; i >= 0; --i) {
1779 		aafs_remove(ns->dents[i]);
1780 		ns->dents[i] = NULL;
1781 	}
1782 }
1783 
1784 /* assumes cleanup in caller */
1785 static int __aafs_ns_mkdir_entries(struct aa_ns *ns, struct dentry *dir)
1786 {
1787 	struct dentry *dent;
1788 
1789 	AA_BUG(!ns);
1790 	AA_BUG(!dir);
1791 
1792 	dent = aafs_create_dir("profiles", dir);
1793 	if (IS_ERR(dent))
1794 		return PTR_ERR(dent);
1795 	ns_subprofs_dir(ns) = dent;
1796 
1797 	dent = aafs_create_dir("raw_data", dir);
1798 	if (IS_ERR(dent))
1799 		return PTR_ERR(dent);
1800 	ns_subdata_dir(ns) = dent;
1801 
1802 	dent = aafs_create_file("revision", 0444, dir, ns,
1803 				&aa_fs_ns_revision_fops);
1804 	if (IS_ERR(dent))
1805 		return PTR_ERR(dent);
1806 	aa_get_ns(ns);
1807 	ns_subrevision(ns) = dent;
1808 
1809 	dent = aafs_create_file(".load", 0640, dir, ns,
1810 				      &aa_fs_profile_load);
1811 	if (IS_ERR(dent))
1812 		return PTR_ERR(dent);
1813 	aa_get_ns(ns);
1814 	ns_subload(ns) = dent;
1815 
1816 	dent = aafs_create_file(".replace", 0640, dir, ns,
1817 				      &aa_fs_profile_replace);
1818 	if (IS_ERR(dent))
1819 		return PTR_ERR(dent);
1820 	aa_get_ns(ns);
1821 	ns_subreplace(ns) = dent;
1822 
1823 	dent = aafs_create_file(".remove", 0640, dir, ns,
1824 				      &aa_fs_profile_remove);
1825 	if (IS_ERR(dent))
1826 		return PTR_ERR(dent);
1827 	aa_get_ns(ns);
1828 	ns_subremove(ns) = dent;
1829 
1830 	  /* use create_dentry so we can supply private data */
1831 	dent = aafs_create("namespaces", S_IFDIR | 0755, dir, ns, NULL, NULL,
1832 			   &ns_dir_inode_operations);
1833 	if (IS_ERR(dent))
1834 		return PTR_ERR(dent);
1835 	aa_get_ns(ns);
1836 	ns_subns_dir(ns) = dent;
1837 
1838 	return 0;
1839 }
1840 
1841 /*
1842  * Requires: @ns->lock held
1843  */
1844 int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
1845 		    struct dentry *dent)
1846 {
1847 	struct aa_ns *sub;
1848 	struct aa_profile *child;
1849 	struct dentry *dir;
1850 	int error;
1851 
1852 	AA_BUG(!ns);
1853 	AA_BUG(!parent);
1854 	AA_BUG(!mutex_is_locked(&ns->lock));
1855 
1856 	if (!name)
1857 		name = ns->base.name;
1858 
1859 	if (!dent) {
1860 		/* create ns dir if it doesn't already exist */
1861 		dent = aafs_create_dir(name, parent);
1862 		if (IS_ERR(dent))
1863 			goto fail;
1864 	} else
1865 		dget(dent);
1866 	ns_dir(ns) = dir = dent;
1867 	error = __aafs_ns_mkdir_entries(ns, dir);
1868 	if (error)
1869 		goto fail2;
1870 
1871 	/* profiles */
1872 	list_for_each_entry(child, &ns->base.profiles, base.list) {
1873 		error = __aafs_profile_mkdir(child, ns_subprofs_dir(ns));
1874 		if (error)
1875 			goto fail2;
1876 	}
1877 
1878 	/* subnamespaces */
1879 	list_for_each_entry(sub, &ns->sub_ns, base.list) {
1880 		mutex_lock_nested(&sub->lock, sub->level);
1881 		error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL);
1882 		mutex_unlock(&sub->lock);
1883 		if (error)
1884 			goto fail2;
1885 	}
1886 
1887 	return 0;
1888 
1889 fail:
1890 	error = PTR_ERR(dent);
1891 
1892 fail2:
1893 	__aafs_ns_rmdir(ns);
1894 
1895 	return error;
1896 }
1897 
1898 
1899 #define list_entry_is_head(pos, head, member) (&pos->member == (head))
1900 
1901 /**
1902  * __next_ns - find the next namespace to list
1903  * @root: root namespace to stop search at (NOT NULL)
1904  * @ns: current ns position (NOT NULL)
1905  *
1906  * Find the next namespace from @ns under @root and handle all locking needed
1907  * while switching current namespace.
1908  *
1909  * Returns: next namespace or NULL if at last namespace under @root
1910  * Requires: ns->parent->lock to be held
1911  * NOTE: will not unlock root->lock
1912  */
1913 static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
1914 {
1915 	struct aa_ns *parent, *next;
1916 
1917 	AA_BUG(!root);
1918 	AA_BUG(!ns);
1919 	AA_BUG(ns != root && !mutex_is_locked(&ns->parent->lock));
1920 
1921 	/* is next namespace a child */
1922 	if (!list_empty(&ns->sub_ns)) {
1923 		next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
1924 		mutex_lock_nested(&next->lock, next->level);
1925 		return next;
1926 	}
1927 
1928 	/* check if the next ns is a sibling, parent, gp, .. */
1929 	parent = ns->parent;
1930 	while (ns != root) {
1931 		mutex_unlock(&ns->lock);
1932 		next = list_next_entry(ns, base.list);
1933 		if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
1934 			mutex_lock_nested(&next->lock, next->level);
1935 			return next;
1936 		}
1937 		ns = parent;
1938 		parent = parent->parent;
1939 	}
1940 
1941 	return NULL;
1942 }
1943 
1944 /**
1945  * __first_profile - find the first profile in a namespace
1946  * @root: namespace that is root of profiles being displayed (NOT NULL)
1947  * @ns: namespace to start in   (NOT NULL)
1948  *
1949  * Returns: unrefcounted profile or NULL if no profile
1950  * Requires: profile->ns.lock to be held
1951  */
1952 static struct aa_profile *__first_profile(struct aa_ns *root,
1953 					  struct aa_ns *ns)
1954 {
1955 	AA_BUG(!root);
1956 	AA_BUG(ns && !mutex_is_locked(&ns->lock));
1957 
1958 	for (; ns; ns = __next_ns(root, ns)) {
1959 		if (!list_empty(&ns->base.profiles))
1960 			return list_first_entry(&ns->base.profiles,
1961 						struct aa_profile, base.list);
1962 	}
1963 	return NULL;
1964 }
1965 
1966 /**
1967  * __next_profile - step to the next profile in a profile tree
1968  * @profile: current profile in tree (NOT NULL)
1969  *
1970  * Perform a depth first traversal on the profile tree in a namespace
1971  *
1972  * Returns: next profile or NULL if done
1973  * Requires: profile->ns.lock to be held
1974  */
1975 static struct aa_profile *__next_profile(struct aa_profile *p)
1976 {
1977 	struct aa_profile *parent;
1978 	struct aa_ns *ns = p->ns;
1979 
1980 	AA_BUG(!mutex_is_locked(&profiles_ns(p)->lock));
1981 
1982 	/* is next profile a child */
1983 	if (!list_empty(&p->base.profiles))
1984 		return list_first_entry(&p->base.profiles, typeof(*p),
1985 					base.list);
1986 
1987 	/* is next profile a sibling, parent sibling, gp, sibling, .. */
1988 	parent = rcu_dereference_protected(p->parent,
1989 					   mutex_is_locked(&p->ns->lock));
1990 	while (parent) {
1991 		p = list_next_entry(p, base.list);
1992 		if (!list_entry_is_head(p, &parent->base.profiles, base.list))
1993 			return p;
1994 		p = parent;
1995 		parent = rcu_dereference_protected(parent->parent,
1996 					    mutex_is_locked(&parent->ns->lock));
1997 	}
1998 
1999 	/* is next another profile in the namespace */
2000 	p = list_next_entry(p, base.list);
2001 	if (!list_entry_is_head(p, &ns->base.profiles, base.list))
2002 		return p;
2003 
2004 	return NULL;
2005 }
2006 
2007 /**
2008  * next_profile - step to the next profile in where ever it may be
2009  * @root: root namespace  (NOT NULL)
2010  * @profile: current profile  (NOT NULL)
2011  *
2012  * Returns: next profile or NULL if there isn't one
2013  */
2014 static struct aa_profile *next_profile(struct aa_ns *root,
2015 				       struct aa_profile *profile)
2016 {
2017 	struct aa_profile *next = __next_profile(profile);
2018 	if (next)
2019 		return next;
2020 
2021 	/* finished all profiles in namespace move to next namespace */
2022 	return __first_profile(root, __next_ns(root, profile->ns));
2023 }
2024 
2025 /**
2026  * p_start - start a depth first traversal of profile tree
2027  * @f: seq_file to fill
2028  * @pos: current position
2029  *
2030  * Returns: first profile under current namespace or NULL if none found
2031  *
2032  * acquires first ns->lock
2033  */
2034 static void *p_start(struct seq_file *f, loff_t *pos)
2035 {
2036 	struct aa_profile *profile = NULL;
2037 	struct aa_ns *root = aa_get_current_ns();
2038 	loff_t l = *pos;
2039 	f->private = root;
2040 
2041 	/* find the first profile */
2042 	mutex_lock_nested(&root->lock, root->level);
2043 	profile = __first_profile(root, root);
2044 
2045 	/* skip to position */
2046 	for (; profile && l > 0; l--)
2047 		profile = next_profile(root, profile);
2048 
2049 	return profile;
2050 }
2051 
2052 /**
2053  * p_next - read the next profile entry
2054  * @f: seq_file to fill
2055  * @p: profile previously returned
2056  * @pos: current position
2057  *
2058  * Returns: next profile after @p or NULL if none
2059  *
2060  * may acquire/release locks in namespace tree as necessary
2061  */
2062 static void *p_next(struct seq_file *f, void *p, loff_t *pos)
2063 {
2064 	struct aa_profile *profile = p;
2065 	struct aa_ns *ns = f->private;
2066 	(*pos)++;
2067 
2068 	return next_profile(ns, profile);
2069 }
2070 
2071 /**
2072  * p_stop - stop depth first traversal
2073  * @f: seq_file we are filling
2074  * @p: the last profile writen
2075  *
2076  * Release all locking done by p_start/p_next on namespace tree
2077  */
2078 static void p_stop(struct seq_file *f, void *p)
2079 {
2080 	struct aa_profile *profile = p;
2081 	struct aa_ns *root = f->private, *ns;
2082 
2083 	if (profile) {
2084 		for (ns = profile->ns; ns && ns != root; ns = ns->parent)
2085 			mutex_unlock(&ns->lock);
2086 	}
2087 	mutex_unlock(&root->lock);
2088 	aa_put_ns(root);
2089 }
2090 
2091 /**
2092  * seq_show_profile - show a profile entry
2093  * @f: seq_file to file
2094  * @p: current position (profile)    (NOT NULL)
2095  *
2096  * Returns: error on failure
2097  */
2098 static int seq_show_profile(struct seq_file *f, void *p)
2099 {
2100 	struct aa_profile *profile = (struct aa_profile *)p;
2101 	struct aa_ns *root = f->private;
2102 
2103 	aa_label_seq_xprint(f, root, &profile->label,
2104 			    FLAG_SHOW_MODE | FLAG_VIEW_SUBNS, GFP_KERNEL);
2105 	seq_putc(f, '\n');
2106 
2107 	return 0;
2108 }
2109 
2110 static const struct seq_operations aa_sfs_profiles_op = {
2111 	.start = p_start,
2112 	.next = p_next,
2113 	.stop = p_stop,
2114 	.show = seq_show_profile,
2115 };
2116 
2117 static int profiles_open(struct inode *inode, struct file *file)
2118 {
2119 	if (!policy_view_capable(NULL))
2120 		return -EACCES;
2121 
2122 	return seq_open(file, &aa_sfs_profiles_op);
2123 }
2124 
2125 static int profiles_release(struct inode *inode, struct file *file)
2126 {
2127 	return seq_release(inode, file);
2128 }
2129 
2130 static const struct file_operations aa_sfs_profiles_fops = {
2131 	.open = profiles_open,
2132 	.read = seq_read,
2133 	.llseek = seq_lseek,
2134 	.release = profiles_release,
2135 };
2136 
2137 
2138 /** Base file system setup **/
2139 static struct aa_sfs_entry aa_sfs_entry_file[] = {
2140 	AA_SFS_FILE_STRING("mask",
2141 			   "create read write exec append mmap_exec link lock"),
2142 	{ }
2143 };
2144 
2145 static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
2146 	AA_SFS_FILE_STRING("mask", "read trace"),
2147 	{ }
2148 };
2149 
2150 static struct aa_sfs_entry aa_sfs_entry_signal[] = {
2151 	AA_SFS_FILE_STRING("mask", AA_SFS_SIG_MASK),
2152 	{ }
2153 };
2154 
2155 static struct aa_sfs_entry aa_sfs_entry_domain[] = {
2156 	AA_SFS_FILE_BOOLEAN("change_hat",	1),
2157 	AA_SFS_FILE_BOOLEAN("change_hatv",	1),
2158 	AA_SFS_FILE_BOOLEAN("change_onexec",	1),
2159 	AA_SFS_FILE_BOOLEAN("change_profile",	1),
2160 	AA_SFS_FILE_BOOLEAN("stack",		1),
2161 	AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap",	1),
2162 	AA_SFS_FILE_STRING("version", "1.2"),
2163 	{ }
2164 };
2165 
2166 static struct aa_sfs_entry aa_sfs_entry_versions[] = {
2167 	AA_SFS_FILE_BOOLEAN("v5",	1),
2168 	AA_SFS_FILE_BOOLEAN("v6",	1),
2169 	AA_SFS_FILE_BOOLEAN("v7",	1),
2170 	{ }
2171 };
2172 
2173 static struct aa_sfs_entry aa_sfs_entry_policy[] = {
2174 	AA_SFS_DIR("versions",			aa_sfs_entry_versions),
2175 	AA_SFS_FILE_BOOLEAN("set_load",		1),
2176 	{ }
2177 };
2178 
2179 static struct aa_sfs_entry aa_sfs_entry_mount[] = {
2180 	AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
2181 	{ }
2182 };
2183 
2184 static struct aa_sfs_entry aa_sfs_entry_ns[] = {
2185 	AA_SFS_FILE_BOOLEAN("profile",		1),
2186 	AA_SFS_FILE_BOOLEAN("pivot_root",	0),
2187 	{ }
2188 };
2189 
2190 static struct aa_sfs_entry aa_sfs_entry_query_label[] = {
2191 	AA_SFS_FILE_STRING("perms", "allow deny audit quiet"),
2192 	AA_SFS_FILE_BOOLEAN("data",		1),
2193 	AA_SFS_FILE_BOOLEAN("multi_transaction",	1),
2194 	{ }
2195 };
2196 
2197 static struct aa_sfs_entry aa_sfs_entry_query[] = {
2198 	AA_SFS_DIR("label",			aa_sfs_entry_query_label),
2199 	{ }
2200 };
2201 static struct aa_sfs_entry aa_sfs_entry_features[] = {
2202 	AA_SFS_DIR("policy",			aa_sfs_entry_policy),
2203 	AA_SFS_DIR("domain",			aa_sfs_entry_domain),
2204 	AA_SFS_DIR("file",			aa_sfs_entry_file),
2205 	AA_SFS_DIR("mount",			aa_sfs_entry_mount),
2206 	AA_SFS_DIR("namespaces",		aa_sfs_entry_ns),
2207 	AA_SFS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),
2208 	AA_SFS_DIR("rlimit",			aa_sfs_entry_rlimit),
2209 	AA_SFS_DIR("caps",			aa_sfs_entry_caps),
2210 	AA_SFS_DIR("ptrace",			aa_sfs_entry_ptrace),
2211 	AA_SFS_DIR("signal",			aa_sfs_entry_signal),
2212 	AA_SFS_DIR("query",			aa_sfs_entry_query),
2213 	{ }
2214 };
2215 
2216 static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
2217 	AA_SFS_FILE_FOPS(".access", 0666, &aa_sfs_access),
2218 	AA_SFS_FILE_FOPS(".stacked", 0444, &seq_ns_stacked_fops),
2219 	AA_SFS_FILE_FOPS(".ns_stacked", 0444, &seq_ns_nsstacked_fops),
2220 	AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
2221 	AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
2222 	AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
2223 	AA_SFS_DIR("features", aa_sfs_entry_features),
2224 	{ }
2225 };
2226 
2227 static struct aa_sfs_entry aa_sfs_entry =
2228 	AA_SFS_DIR("apparmor", aa_sfs_entry_apparmor);
2229 
2230 /**
2231  * entry_create_file - create a file entry in the apparmor securityfs
2232  * @fs_file: aa_sfs_entry to build an entry for (NOT NULL)
2233  * @parent: the parent dentry in the securityfs
2234  *
2235  * Use entry_remove_file to remove entries created with this fn.
2236  */
2237 static int __init entry_create_file(struct aa_sfs_entry *fs_file,
2238 				    struct dentry *parent)
2239 {
2240 	int error = 0;
2241 
2242 	fs_file->dentry = securityfs_create_file(fs_file->name,
2243 						 S_IFREG | fs_file->mode,
2244 						 parent, fs_file,
2245 						 fs_file->file_ops);
2246 	if (IS_ERR(fs_file->dentry)) {
2247 		error = PTR_ERR(fs_file->dentry);
2248 		fs_file->dentry = NULL;
2249 	}
2250 	return error;
2251 }
2252 
2253 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir);
2254 /**
2255  * entry_create_dir - recursively create a directory entry in the securityfs
2256  * @fs_dir: aa_sfs_entry (and all child entries) to build (NOT NULL)
2257  * @parent: the parent dentry in the securityfs
2258  *
2259  * Use entry_remove_dir to remove entries created with this fn.
2260  */
2261 static int __init entry_create_dir(struct aa_sfs_entry *fs_dir,
2262 				   struct dentry *parent)
2263 {
2264 	struct aa_sfs_entry *fs_file;
2265 	struct dentry *dir;
2266 	int error;
2267 
2268 	dir = securityfs_create_dir(fs_dir->name, parent);
2269 	if (IS_ERR(dir))
2270 		return PTR_ERR(dir);
2271 	fs_dir->dentry = dir;
2272 
2273 	for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2274 		if (fs_file->v_type == AA_SFS_TYPE_DIR)
2275 			error = entry_create_dir(fs_file, fs_dir->dentry);
2276 		else
2277 			error = entry_create_file(fs_file, fs_dir->dentry);
2278 		if (error)
2279 			goto failed;
2280 	}
2281 
2282 	return 0;
2283 
2284 failed:
2285 	entry_remove_dir(fs_dir);
2286 
2287 	return error;
2288 }
2289 
2290 /**
2291  * entry_remove_file - drop a single file entry in the apparmor securityfs
2292  * @fs_file: aa_sfs_entry to detach from the securityfs (NOT NULL)
2293  */
2294 static void __init entry_remove_file(struct aa_sfs_entry *fs_file)
2295 {
2296 	if (!fs_file->dentry)
2297 		return;
2298 
2299 	securityfs_remove(fs_file->dentry);
2300 	fs_file->dentry = NULL;
2301 }
2302 
2303 /**
2304  * entry_remove_dir - recursively drop a directory entry from the securityfs
2305  * @fs_dir: aa_sfs_entry (and all child entries) to detach (NOT NULL)
2306  */
2307 static void __init entry_remove_dir(struct aa_sfs_entry *fs_dir)
2308 {
2309 	struct aa_sfs_entry *fs_file;
2310 
2311 	for (fs_file = fs_dir->v.files; fs_file && fs_file->name; ++fs_file) {
2312 		if (fs_file->v_type == AA_SFS_TYPE_DIR)
2313 			entry_remove_dir(fs_file);
2314 		else
2315 			entry_remove_file(fs_file);
2316 	}
2317 
2318 	entry_remove_file(fs_dir);
2319 }
2320 
2321 /**
2322  * aa_destroy_aafs - cleanup and free aafs
2323  *
2324  * releases dentries allocated by aa_create_aafs
2325  */
2326 void __init aa_destroy_aafs(void)
2327 {
2328 	entry_remove_dir(&aa_sfs_entry);
2329 }
2330 
2331 
2332 #define NULL_FILE_NAME ".null"
2333 struct path aa_null;
2334 
2335 static int aa_mk_null_file(struct dentry *parent)
2336 {
2337 	struct vfsmount *mount = NULL;
2338 	struct dentry *dentry;
2339 	struct inode *inode;
2340 	int count = 0;
2341 	int error = simple_pin_fs(parent->d_sb->s_type, &mount, &count);
2342 
2343 	if (error)
2344 		return error;
2345 
2346 	inode_lock(d_inode(parent));
2347 	dentry = lookup_one_len(NULL_FILE_NAME, parent, strlen(NULL_FILE_NAME));
2348 	if (IS_ERR(dentry)) {
2349 		error = PTR_ERR(dentry);
2350 		goto out;
2351 	}
2352 	inode = new_inode(parent->d_inode->i_sb);
2353 	if (!inode) {
2354 		error = -ENOMEM;
2355 		goto out1;
2356 	}
2357 
2358 	inode->i_ino = get_next_ino();
2359 	inode->i_mode = S_IFCHR | S_IRUGO | S_IWUGO;
2360 	inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
2361 	init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO,
2362 			   MKDEV(MEM_MAJOR, 3));
2363 	d_instantiate(dentry, inode);
2364 	aa_null.dentry = dget(dentry);
2365 	aa_null.mnt = mntget(mount);
2366 
2367 	error = 0;
2368 
2369 out1:
2370 	dput(dentry);
2371 out:
2372 	inode_unlock(d_inode(parent));
2373 	simple_release_fs(&mount, &count);
2374 	return error;
2375 }
2376 
2377 
2378 
2379 static const char *policy_get_link(struct dentry *dentry,
2380 				   struct inode *inode,
2381 				   struct delayed_call *done)
2382 {
2383 	struct aa_ns *ns;
2384 	struct path path;
2385 
2386 	if (!dentry)
2387 		return ERR_PTR(-ECHILD);
2388 	ns = aa_get_current_ns();
2389 	path.mnt = mntget(aafs_mnt);
2390 	path.dentry = dget(ns_dir(ns));
2391 	nd_jump_link(&path);
2392 	aa_put_ns(ns);
2393 
2394 	return NULL;
2395 }
2396 
2397 static int ns_get_name(char *buf, size_t size, struct aa_ns *ns,
2398 		       struct inode *inode)
2399 {
2400 	int res = snprintf(buf, size, "%s:[%lu]", AAFS_NAME, inode->i_ino);
2401 
2402 	if (res < 0 || res >= size)
2403 		res = -ENOENT;
2404 
2405 	return res;
2406 }
2407 
2408 static int policy_readlink(struct dentry *dentry, char __user *buffer,
2409 			   int buflen)
2410 {
2411 	struct aa_ns *ns;
2412 	char name[32];
2413 	int res;
2414 
2415 	ns = aa_get_current_ns();
2416 	res = ns_get_name(name, sizeof(name), ns, d_inode(dentry));
2417 	if (res >= 0)
2418 		res = readlink_copy(buffer, buflen, name);
2419 	aa_put_ns(ns);
2420 
2421 	return res;
2422 }
2423 
2424 static const struct inode_operations policy_link_iops = {
2425 	.readlink	= policy_readlink,
2426 	.get_link	= policy_get_link,
2427 };
2428 
2429 
2430 /**
2431  * aa_create_aafs - create the apparmor security filesystem
2432  *
2433  * dentries created here are released by aa_destroy_aafs
2434  *
2435  * Returns: error on failure
2436  */
2437 static int __init aa_create_aafs(void)
2438 {
2439 	struct dentry *dent;
2440 	int error;
2441 
2442 	if (!apparmor_initialized)
2443 		return 0;
2444 
2445 	if (aa_sfs_entry.dentry) {
2446 		AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
2447 		return -EEXIST;
2448 	}
2449 
2450 	/* setup apparmorfs used to virtualize policy/ */
2451 	aafs_mnt = kern_mount(&aafs_ops);
2452 	if (IS_ERR(aafs_mnt))
2453 		panic("can't set apparmorfs up\n");
2454 	aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
2455 
2456 	/* Populate fs tree. */
2457 	error = entry_create_dir(&aa_sfs_entry, NULL);
2458 	if (error)
2459 		goto error;
2460 
2461 	dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry,
2462 				      NULL, &aa_fs_profile_load);
2463 	if (IS_ERR(dent)) {
2464 		error = PTR_ERR(dent);
2465 		goto error;
2466 	}
2467 	ns_subload(root_ns) = dent;
2468 
2469 	dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry,
2470 				      NULL, &aa_fs_profile_replace);
2471 	if (IS_ERR(dent)) {
2472 		error = PTR_ERR(dent);
2473 		goto error;
2474 	}
2475 	ns_subreplace(root_ns) = dent;
2476 
2477 	dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry,
2478 				      NULL, &aa_fs_profile_remove);
2479 	if (IS_ERR(dent)) {
2480 		error = PTR_ERR(dent);
2481 		goto error;
2482 	}
2483 	ns_subremove(root_ns) = dent;
2484 
2485 	dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry,
2486 				      NULL, &aa_fs_ns_revision_fops);
2487 	if (IS_ERR(dent)) {
2488 		error = PTR_ERR(dent);
2489 		goto error;
2490 	}
2491 	ns_subrevision(root_ns) = dent;
2492 
2493 	/* policy tree referenced by magic policy symlink */
2494 	mutex_lock_nested(&root_ns->lock, root_ns->level);
2495 	error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy",
2496 				aafs_mnt->mnt_root);
2497 	mutex_unlock(&root_ns->lock);
2498 	if (error)
2499 		goto error;
2500 
2501 	/* magic symlink similar to nsfs redirects based on task policy */
2502 	dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry,
2503 					 NULL, &policy_link_iops);
2504 	if (IS_ERR(dent)) {
2505 		error = PTR_ERR(dent);
2506 		goto error;
2507 	}
2508 
2509 	error = aa_mk_null_file(aa_sfs_entry.dentry);
2510 	if (error)
2511 		goto error;
2512 
2513 	/* TODO: add default profile to apparmorfs */
2514 
2515 	/* Report that AppArmor fs is enabled */
2516 	aa_info_message("AppArmor Filesystem Enabled");
2517 	return 0;
2518 
2519 error:
2520 	aa_destroy_aafs();
2521 	AA_ERROR("Error creating AppArmor securityfs\n");
2522 	return error;
2523 }
2524 
2525 fs_initcall(aa_create_aafs);
2526