1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2f1bd9041SJohn Johansen /*
3f1bd9041SJohn Johansen * AppArmor security module
4f1bd9041SJohn Johansen *
5f1bd9041SJohn Johansen * This file contains AppArmor label definitions
6f1bd9041SJohn Johansen *
7f1bd9041SJohn Johansen * Copyright 2017 Canonical Ltd.
8f1bd9041SJohn Johansen */
9f1bd9041SJohn Johansen
10f1bd9041SJohn Johansen #include <linux/audit.h>
11f1bd9041SJohn Johansen #include <linux/seq_file.h>
12f1bd9041SJohn Johansen #include <linux/sort.h>
13f1bd9041SJohn Johansen
14f1bd9041SJohn Johansen #include "include/apparmor.h"
15d8889d49SJohn Johansen #include "include/cred.h"
16f1bd9041SJohn Johansen #include "include/label.h"
17f1bd9041SJohn Johansen #include "include/policy.h"
18f1bd9041SJohn Johansen #include "include/secid.h"
19f1bd9041SJohn Johansen
20f1bd9041SJohn Johansen
21f1bd9041SJohn Johansen /*
22f1bd9041SJohn Johansen * the aa_label represents the set of profiles confining an object
23f1bd9041SJohn Johansen *
24f1bd9041SJohn Johansen * Labels maintain a reference count to the set of pointers they reference
25f1bd9041SJohn Johansen * Labels are ref counted by
26f1bd9041SJohn Johansen * tasks and object via the security field/security context off the field
27f1bd9041SJohn Johansen * code - will take a ref count on a label if it needs the label
28f1bd9041SJohn Johansen * beyond what is possible with an rcu_read_lock.
29f1bd9041SJohn Johansen * profiles - each profile is a label
30f1bd9041SJohn Johansen * secids - a pinned secid will keep a refcount of the label it is
31f1bd9041SJohn Johansen * referencing
32f1bd9041SJohn Johansen * objects - inode, files, sockets, ...
33f1bd9041SJohn Johansen *
34f1bd9041SJohn Johansen * Labels are not ref counted by the label set, so they maybe removed and
35f1bd9041SJohn Johansen * freed when no longer in use.
36f1bd9041SJohn Johansen *
37f1bd9041SJohn Johansen */
38f1bd9041SJohn Johansen
39f1bd9041SJohn Johansen #define PROXY_POISON 97
40f1bd9041SJohn Johansen #define LABEL_POISON 100
41f1bd9041SJohn Johansen
free_proxy(struct aa_proxy * proxy)42f1bd9041SJohn Johansen static void free_proxy(struct aa_proxy *proxy)
43f1bd9041SJohn Johansen {
44f1bd9041SJohn Johansen if (proxy) {
45f1bd9041SJohn Johansen /* p->label will not updated any more as p is dead */
46f1bd9041SJohn Johansen aa_put_label(rcu_dereference_protected(proxy->label, true));
47f1bd9041SJohn Johansen memset(proxy, 0, sizeof(*proxy));
48bc4d82fbSJohn Johansen RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49f1bd9041SJohn Johansen kfree(proxy);
50f1bd9041SJohn Johansen }
51f1bd9041SJohn Johansen }
52f1bd9041SJohn Johansen
aa_proxy_kref(struct kref * kref)53f1bd9041SJohn Johansen void aa_proxy_kref(struct kref *kref)
54f1bd9041SJohn Johansen {
55f1bd9041SJohn Johansen struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56f1bd9041SJohn Johansen
57f1bd9041SJohn Johansen free_proxy(proxy);
58f1bd9041SJohn Johansen }
59f1bd9041SJohn Johansen
aa_alloc_proxy(struct aa_label * label,gfp_t gfp)60f1bd9041SJohn Johansen struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61f1bd9041SJohn Johansen {
62f1bd9041SJohn Johansen struct aa_proxy *new;
63f1bd9041SJohn Johansen
64f1bd9041SJohn Johansen new = kzalloc(sizeof(struct aa_proxy), gfp);
65f1bd9041SJohn Johansen if (new) {
66f1bd9041SJohn Johansen kref_init(&new->count);
67f1bd9041SJohn Johansen rcu_assign_pointer(new->label, aa_get_label(label));
68f1bd9041SJohn Johansen }
69f1bd9041SJohn Johansen return new;
70f1bd9041SJohn Johansen }
71f1bd9041SJohn Johansen
72f1bd9041SJohn Johansen /* requires profile list write lock held */
__aa_proxy_redirect(struct aa_label * orig,struct aa_label * new)73f1bd9041SJohn Johansen void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74f1bd9041SJohn Johansen {
75f1bd9041SJohn Johansen struct aa_label *tmp;
76f1bd9041SJohn Johansen
77f1bd9041SJohn Johansen AA_BUG(!orig);
78f1bd9041SJohn Johansen AA_BUG(!new);
799ffbe8acSNikolay Borisov lockdep_assert_held_write(&labels_set(orig)->lock);
80f1bd9041SJohn Johansen
81f1bd9041SJohn Johansen tmp = rcu_dereference_protected(orig->proxy->label,
82f1bd9041SJohn Johansen &labels_ns(orig)->lock);
83f1bd9041SJohn Johansen rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84f1bd9041SJohn Johansen orig->flags |= FLAG_STALE;
85f1bd9041SJohn Johansen aa_put_label(tmp);
86f1bd9041SJohn Johansen }
87f1bd9041SJohn Johansen
__proxy_share(struct aa_label * old,struct aa_label * new)88f1bd9041SJohn Johansen static void __proxy_share(struct aa_label *old, struct aa_label *new)
89f1bd9041SJohn Johansen {
90f1bd9041SJohn Johansen struct aa_proxy *proxy = new->proxy;
91f1bd9041SJohn Johansen
92f1bd9041SJohn Johansen new->proxy = aa_get_proxy(old->proxy);
93f1bd9041SJohn Johansen __aa_proxy_redirect(old, new);
94f1bd9041SJohn Johansen aa_put_proxy(proxy);
95f1bd9041SJohn Johansen }
96f1bd9041SJohn Johansen
97f1bd9041SJohn Johansen
98f1bd9041SJohn Johansen /**
99f1bd9041SJohn Johansen * ns_cmp - compare ns for label set ordering
100f1bd9041SJohn Johansen * @a: ns to compare (NOT NULL)
101f1bd9041SJohn Johansen * @b: ns to compare (NOT NULL)
102f1bd9041SJohn Johansen *
103f1bd9041SJohn Johansen * Returns: <0 if a < b
104f1bd9041SJohn Johansen * ==0 if a == b
105f1bd9041SJohn Johansen * >0 if a > b
106f1bd9041SJohn Johansen */
ns_cmp(struct aa_ns * a,struct aa_ns * b)107f1bd9041SJohn Johansen static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108f1bd9041SJohn Johansen {
109f1bd9041SJohn Johansen int res;
110f1bd9041SJohn Johansen
111f1bd9041SJohn Johansen AA_BUG(!a);
112f1bd9041SJohn Johansen AA_BUG(!b);
113f1bd9041SJohn Johansen AA_BUG(!a->base.hname);
114f1bd9041SJohn Johansen AA_BUG(!b->base.hname);
115f1bd9041SJohn Johansen
116f1bd9041SJohn Johansen if (a == b)
117f1bd9041SJohn Johansen return 0;
118f1bd9041SJohn Johansen
119f1bd9041SJohn Johansen res = a->level - b->level;
120f1bd9041SJohn Johansen if (res)
121f1bd9041SJohn Johansen return res;
122f1bd9041SJohn Johansen
123f1bd9041SJohn Johansen return strcmp(a->base.hname, b->base.hname);
124f1bd9041SJohn Johansen }
125f1bd9041SJohn Johansen
126f1bd9041SJohn Johansen /**
127a18f9028SZygmunt Krynicki * profile_cmp - profile comparison for set ordering
128f1bd9041SJohn Johansen * @a: profile to compare (NOT NULL)
129f1bd9041SJohn Johansen * @b: profile to compare (NOT NULL)
130f1bd9041SJohn Johansen *
131f1bd9041SJohn Johansen * Returns: <0 if a < b
132f1bd9041SJohn Johansen * ==0 if a == b
133f1bd9041SJohn Johansen * >0 if a > b
134f1bd9041SJohn Johansen */
profile_cmp(struct aa_profile * a,struct aa_profile * b)135f1bd9041SJohn Johansen static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136f1bd9041SJohn Johansen {
137f1bd9041SJohn Johansen int res;
138f1bd9041SJohn Johansen
139f1bd9041SJohn Johansen AA_BUG(!a);
140f1bd9041SJohn Johansen AA_BUG(!b);
141f1bd9041SJohn Johansen AA_BUG(!a->ns);
142f1bd9041SJohn Johansen AA_BUG(!b->ns);
143f1bd9041SJohn Johansen AA_BUG(!a->base.hname);
144f1bd9041SJohn Johansen AA_BUG(!b->base.hname);
145f1bd9041SJohn Johansen
146f1bd9041SJohn Johansen if (a == b || a->base.hname == b->base.hname)
147f1bd9041SJohn Johansen return 0;
148f1bd9041SJohn Johansen res = ns_cmp(a->ns, b->ns);
149f1bd9041SJohn Johansen if (res)
150f1bd9041SJohn Johansen return res;
151f1bd9041SJohn Johansen
152f1bd9041SJohn Johansen return strcmp(a->base.hname, b->base.hname);
153f1bd9041SJohn Johansen }
154f1bd9041SJohn Johansen
155f1bd9041SJohn Johansen /**
156a18f9028SZygmunt Krynicki * vec_cmp - label comparison for set ordering
157f1bd9041SJohn Johansen * @a: label to compare (NOT NULL)
158f1bd9041SJohn Johansen * @vec: vector of profiles to compare (NOT NULL)
159f1bd9041SJohn Johansen * @n: length of @vec
160f1bd9041SJohn Johansen *
161f1bd9041SJohn Johansen * Returns: <0 if a < vec
162f1bd9041SJohn Johansen * ==0 if a == vec
163f1bd9041SJohn Johansen * >0 if a > vec
164f1bd9041SJohn Johansen */
vec_cmp(struct aa_profile ** a,int an,struct aa_profile ** b,int bn)165f1bd9041SJohn Johansen static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
166f1bd9041SJohn Johansen {
167f1bd9041SJohn Johansen int i;
168f1bd9041SJohn Johansen
169f1bd9041SJohn Johansen AA_BUG(!a);
170f1bd9041SJohn Johansen AA_BUG(!*a);
171f1bd9041SJohn Johansen AA_BUG(!b);
172f1bd9041SJohn Johansen AA_BUG(!*b);
173f1bd9041SJohn Johansen AA_BUG(an <= 0);
174f1bd9041SJohn Johansen AA_BUG(bn <= 0);
175f1bd9041SJohn Johansen
176f1bd9041SJohn Johansen for (i = 0; i < an && i < bn; i++) {
177f1bd9041SJohn Johansen int res = profile_cmp(a[i], b[i]);
178f1bd9041SJohn Johansen
179f1bd9041SJohn Johansen if (res != 0)
180f1bd9041SJohn Johansen return res;
181f1bd9041SJohn Johansen }
182f1bd9041SJohn Johansen
183f1bd9041SJohn Johansen return an - bn;
184f1bd9041SJohn Johansen }
185f1bd9041SJohn Johansen
vec_is_stale(struct aa_profile ** vec,int n)186f1bd9041SJohn Johansen static bool vec_is_stale(struct aa_profile **vec, int n)
187f1bd9041SJohn Johansen {
188f1bd9041SJohn Johansen int i;
189f1bd9041SJohn Johansen
190f1bd9041SJohn Johansen AA_BUG(!vec);
191f1bd9041SJohn Johansen
192f1bd9041SJohn Johansen for (i = 0; i < n; i++) {
193f1bd9041SJohn Johansen if (profile_is_stale(vec[i]))
194f1bd9041SJohn Johansen return true;
195f1bd9041SJohn Johansen }
196f1bd9041SJohn Johansen
197f1bd9041SJohn Johansen return false;
198f1bd9041SJohn Johansen }
199f1bd9041SJohn Johansen
accum_vec_flags(struct aa_profile ** vec,int n)200*1f939c6bSJohn Johansen static long accum_vec_flags(struct aa_profile **vec, int n)
201f1bd9041SJohn Johansen {
202*1f939c6bSJohn Johansen long u = FLAG_UNCONFINED;
203f1bd9041SJohn Johansen int i;
204f1bd9041SJohn Johansen
205f1bd9041SJohn Johansen AA_BUG(!vec);
206f1bd9041SJohn Johansen
207f1bd9041SJohn Johansen for (i = 0; i < n; i++) {
208*1f939c6bSJohn Johansen u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
209*1f939c6bSJohn Johansen FLAG_STALE);
210*1f939c6bSJohn Johansen if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
211*1f939c6bSJohn Johansen u &= ~FLAG_UNCONFINED;
212f1bd9041SJohn Johansen }
213f1bd9041SJohn Johansen
214c1ed5da1SJohn Johansen return u;
215f1bd9041SJohn Johansen }
216f1bd9041SJohn Johansen
sort_cmp(const void * a,const void * b)217f1bd9041SJohn Johansen static int sort_cmp(const void *a, const void *b)
218f1bd9041SJohn Johansen {
219f1bd9041SJohn Johansen return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
220f1bd9041SJohn Johansen }
221f1bd9041SJohn Johansen
222f1bd9041SJohn Johansen /*
223f1bd9041SJohn Johansen * assumes vec is sorted
224f1bd9041SJohn Johansen * Assumes @vec has null terminator at vec[n], and will null terminate
225f1bd9041SJohn Johansen * vec[n - dups]
226f1bd9041SJohn Johansen */
unique(struct aa_profile ** vec,int n)227f1bd9041SJohn Johansen static inline int unique(struct aa_profile **vec, int n)
228f1bd9041SJohn Johansen {
229f1bd9041SJohn Johansen int i, pos, dups = 0;
230f1bd9041SJohn Johansen
231f1bd9041SJohn Johansen AA_BUG(n < 1);
232f1bd9041SJohn Johansen AA_BUG(!vec);
233f1bd9041SJohn Johansen
234f1bd9041SJohn Johansen pos = 0;
235f1bd9041SJohn Johansen for (i = 1; i < n; i++) {
236f1bd9041SJohn Johansen int res = profile_cmp(vec[pos], vec[i]);
237f1bd9041SJohn Johansen
238f1bd9041SJohn Johansen AA_BUG(res > 0, "vec not sorted");
239f1bd9041SJohn Johansen if (res == 0) {
240f1bd9041SJohn Johansen /* drop duplicate */
241f1bd9041SJohn Johansen aa_put_profile(vec[i]);
242f1bd9041SJohn Johansen dups++;
243f1bd9041SJohn Johansen continue;
244f1bd9041SJohn Johansen }
245f1bd9041SJohn Johansen pos++;
246f1bd9041SJohn Johansen if (dups)
247f1bd9041SJohn Johansen vec[pos] = vec[i];
248f1bd9041SJohn Johansen }
249f1bd9041SJohn Johansen
250f1bd9041SJohn Johansen AA_BUG(dups < 0);
251f1bd9041SJohn Johansen
252f1bd9041SJohn Johansen return dups;
253f1bd9041SJohn Johansen }
254f1bd9041SJohn Johansen
255f1bd9041SJohn Johansen /**
256f1bd9041SJohn Johansen * aa_vec_unique - canonical sort and unique a list of profiles
257f1bd9041SJohn Johansen * @n: number of refcounted profiles in the list (@n > 0)
258f1bd9041SJohn Johansen * @vec: list of profiles to sort and merge
259f1bd9041SJohn Johansen *
260f1bd9041SJohn Johansen * Returns: the number of duplicates eliminated == references put
261f1bd9041SJohn Johansen *
262f1bd9041SJohn Johansen * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
263f1bd9041SJohn Johansen * null terminate vec[n - dups]
264f1bd9041SJohn Johansen */
aa_vec_unique(struct aa_profile ** vec,int n,int flags)265f1bd9041SJohn Johansen int aa_vec_unique(struct aa_profile **vec, int n, int flags)
266f1bd9041SJohn Johansen {
267f1bd9041SJohn Johansen int i, dups = 0;
268f1bd9041SJohn Johansen
269f1bd9041SJohn Johansen AA_BUG(n < 1);
270f1bd9041SJohn Johansen AA_BUG(!vec);
271f1bd9041SJohn Johansen
272f1bd9041SJohn Johansen /* vecs are usually small and inorder, have a fallback for larger */
273f1bd9041SJohn Johansen if (n > 8) {
274f1bd9041SJohn Johansen sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
275f1bd9041SJohn Johansen dups = unique(vec, n);
276f1bd9041SJohn Johansen goto out;
277f1bd9041SJohn Johansen }
278f1bd9041SJohn Johansen
279f1bd9041SJohn Johansen /* insertion sort + unique in one */
280f1bd9041SJohn Johansen for (i = 1; i < n; i++) {
281f1bd9041SJohn Johansen struct aa_profile *tmp = vec[i];
282f1bd9041SJohn Johansen int pos, j;
283f1bd9041SJohn Johansen
284f1bd9041SJohn Johansen for (pos = i - 1 - dups; pos >= 0; pos--) {
285f1bd9041SJohn Johansen int res = profile_cmp(vec[pos], tmp);
286f1bd9041SJohn Johansen
287f1bd9041SJohn Johansen if (res == 0) {
288f1bd9041SJohn Johansen /* drop duplicate entry */
289f1bd9041SJohn Johansen aa_put_profile(tmp);
290f1bd9041SJohn Johansen dups++;
291f1bd9041SJohn Johansen goto continue_outer;
292f1bd9041SJohn Johansen } else if (res < 0)
293f1bd9041SJohn Johansen break;
294f1bd9041SJohn Johansen }
295f1bd9041SJohn Johansen /* pos is at entry < tmp, or index -1. Set to insert pos */
296f1bd9041SJohn Johansen pos++;
297f1bd9041SJohn Johansen
298f1bd9041SJohn Johansen for (j = i - dups; j > pos; j--)
299f1bd9041SJohn Johansen vec[j] = vec[j - 1];
300f1bd9041SJohn Johansen vec[pos] = tmp;
301f1bd9041SJohn Johansen continue_outer:
302f1bd9041SJohn Johansen ;
303f1bd9041SJohn Johansen }
304f1bd9041SJohn Johansen
305f1bd9041SJohn Johansen AA_BUG(dups < 0);
306f1bd9041SJohn Johansen
307f1bd9041SJohn Johansen out:
308f1bd9041SJohn Johansen if (flags & VEC_FLAG_TERMINATE)
309f1bd9041SJohn Johansen vec[n - dups] = NULL;
310f1bd9041SJohn Johansen
311f1bd9041SJohn Johansen return dups;
312f1bd9041SJohn Johansen }
313f1bd9041SJohn Johansen
314f1bd9041SJohn Johansen
aa_label_destroy(struct aa_label * label)3153622ad25SJohn Johansen void aa_label_destroy(struct aa_label *label)
316f1bd9041SJohn Johansen {
317f1bd9041SJohn Johansen AA_BUG(!label);
318f1bd9041SJohn Johansen
319f1bd9041SJohn Johansen if (!label_isprofile(label)) {
320f1bd9041SJohn Johansen struct aa_profile *profile;
321f1bd9041SJohn Johansen struct label_it i;
322f1bd9041SJohn Johansen
323f1bd9041SJohn Johansen aa_put_str(label->hname);
324f1bd9041SJohn Johansen
325f1bd9041SJohn Johansen label_for_each(i, label, profile) {
326f1bd9041SJohn Johansen aa_put_profile(profile);
327f1bd9041SJohn Johansen label->vec[i.i] = (struct aa_profile *)
328f1bd9041SJohn Johansen (LABEL_POISON + (long) i.i);
329f1bd9041SJohn Johansen }
330f1bd9041SJohn Johansen }
331f1bd9041SJohn Johansen
3323622ad25SJohn Johansen if (label->proxy) {
333f1bd9041SJohn Johansen if (rcu_dereference_protected(label->proxy->label, true) == label)
334f1bd9041SJohn Johansen rcu_assign_pointer(label->proxy->label, NULL);
3353622ad25SJohn Johansen aa_put_proxy(label->proxy);
3363622ad25SJohn Johansen }
337f1bd9041SJohn Johansen aa_free_secid(label->secid);
338f1bd9041SJohn Johansen
339f1bd9041SJohn Johansen label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
340f1bd9041SJohn Johansen }
341f1bd9041SJohn Johansen
aa_label_free(struct aa_label * label)342f1bd9041SJohn Johansen void aa_label_free(struct aa_label *label)
343f1bd9041SJohn Johansen {
344f1bd9041SJohn Johansen if (!label)
345f1bd9041SJohn Johansen return;
346f1bd9041SJohn Johansen
3473622ad25SJohn Johansen aa_label_destroy(label);
348f1bd9041SJohn Johansen kfree(label);
349f1bd9041SJohn Johansen }
350f1bd9041SJohn Johansen
label_free_switch(struct aa_label * label)351f1bd9041SJohn Johansen static void label_free_switch(struct aa_label *label)
352f1bd9041SJohn Johansen {
353f1bd9041SJohn Johansen if (label->flags & FLAG_NS_COUNT)
354f1bd9041SJohn Johansen aa_free_ns(labels_ns(label));
355f1bd9041SJohn Johansen else if (label_isprofile(label))
356f1bd9041SJohn Johansen aa_free_profile(labels_profile(label));
357f1bd9041SJohn Johansen else
358f1bd9041SJohn Johansen aa_label_free(label);
359f1bd9041SJohn Johansen }
360f1bd9041SJohn Johansen
label_free_rcu(struct rcu_head * head)361f1bd9041SJohn Johansen static void label_free_rcu(struct rcu_head *head)
362f1bd9041SJohn Johansen {
363f1bd9041SJohn Johansen struct aa_label *label = container_of(head, struct aa_label, rcu);
364f1bd9041SJohn Johansen
365f1bd9041SJohn Johansen if (label->flags & FLAG_IN_TREE)
366f1bd9041SJohn Johansen (void) aa_label_remove(label);
367f1bd9041SJohn Johansen label_free_switch(label);
368f1bd9041SJohn Johansen }
369f1bd9041SJohn Johansen
aa_label_kref(struct kref * kref)370f1bd9041SJohn Johansen void aa_label_kref(struct kref *kref)
371f1bd9041SJohn Johansen {
372f1bd9041SJohn Johansen struct aa_label *label = container_of(kref, struct aa_label, count);
373f1bd9041SJohn Johansen struct aa_ns *ns = labels_ns(label);
374f1bd9041SJohn Johansen
375f1bd9041SJohn Johansen if (!ns) {
376f1bd9041SJohn Johansen /* never live, no rcu callback needed, just using the fn */
377f1bd9041SJohn Johansen label_free_switch(label);
378f1bd9041SJohn Johansen return;
379f1bd9041SJohn Johansen }
380f1bd9041SJohn Johansen /* TODO: update labels_profile macro so it works here */
381f1bd9041SJohn Johansen AA_BUG(label_isprofile(label) &&
382f1bd9041SJohn Johansen on_list_rcu(&label->vec[0]->base.profiles));
383f1bd9041SJohn Johansen AA_BUG(label_isprofile(label) &&
384f1bd9041SJohn Johansen on_list_rcu(&label->vec[0]->base.list));
385f1bd9041SJohn Johansen
386f1bd9041SJohn Johansen /* TODO: if compound label and not stale add to reclaim cache */
387f1bd9041SJohn Johansen call_rcu(&label->rcu, label_free_rcu);
388f1bd9041SJohn Johansen }
389f1bd9041SJohn Johansen
label_free_or_put_new(struct aa_label * label,struct aa_label * new)390f1bd9041SJohn Johansen static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
391f1bd9041SJohn Johansen {
392f1bd9041SJohn Johansen if (label != new)
393f1bd9041SJohn Johansen /* need to free directly to break circular ref with proxy */
394f1bd9041SJohn Johansen aa_label_free(new);
395f1bd9041SJohn Johansen else
396f1bd9041SJohn Johansen aa_put_label(new);
397f1bd9041SJohn Johansen }
398f1bd9041SJohn Johansen
aa_label_init(struct aa_label * label,int size,gfp_t gfp)399c0929212SJohn Johansen bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
400f1bd9041SJohn Johansen {
401f1bd9041SJohn Johansen AA_BUG(!label);
402f1bd9041SJohn Johansen AA_BUG(size < 1);
403f1bd9041SJohn Johansen
404a4c3f89cSJohn Johansen if (aa_alloc_secid(label, gfp) < 0)
405f1bd9041SJohn Johansen return false;
406f1bd9041SJohn Johansen
407f1bd9041SJohn Johansen label->size = size; /* doesn't include null */
408f1bd9041SJohn Johansen label->vec[size] = NULL; /* null terminate */
409f1bd9041SJohn Johansen kref_init(&label->count);
410f1bd9041SJohn Johansen RB_CLEAR_NODE(&label->node);
411f1bd9041SJohn Johansen
412f1bd9041SJohn Johansen return true;
413f1bd9041SJohn Johansen }
414f1bd9041SJohn Johansen
415f1bd9041SJohn Johansen /**
416f1bd9041SJohn Johansen * aa_label_alloc - allocate a label with a profile vector of @size length
417f1bd9041SJohn Johansen * @size: size of profile vector in the label
418f1bd9041SJohn Johansen * @proxy: proxy to use OR null if to allocate a new one
419f1bd9041SJohn Johansen * @gfp: memory allocation type
420f1bd9041SJohn Johansen *
421f1bd9041SJohn Johansen * Returns: new label
422f1bd9041SJohn Johansen * else NULL if failed
423f1bd9041SJohn Johansen */
aa_label_alloc(int size,struct aa_proxy * proxy,gfp_t gfp)424f1bd9041SJohn Johansen struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
425f1bd9041SJohn Johansen {
426f1bd9041SJohn Johansen struct aa_label *new;
427f1bd9041SJohn Johansen
428f1bd9041SJohn Johansen AA_BUG(size < 1);
429f1bd9041SJohn Johansen
430f1bd9041SJohn Johansen /* + 1 for null terminator entry on vec */
431f4a2d282SGustavo A. R. Silva new = kzalloc(struct_size(new, vec, size + 1), gfp);
432f1bd9041SJohn Johansen AA_DEBUG("%s (%p)\n", __func__, new);
433f1bd9041SJohn Johansen if (!new)
434f1bd9041SJohn Johansen goto fail;
435f1bd9041SJohn Johansen
436c0929212SJohn Johansen if (!aa_label_init(new, size, gfp))
437f1bd9041SJohn Johansen goto fail;
438f1bd9041SJohn Johansen
439f1bd9041SJohn Johansen if (!proxy) {
440f1bd9041SJohn Johansen proxy = aa_alloc_proxy(new, gfp);
441f1bd9041SJohn Johansen if (!proxy)
442f1bd9041SJohn Johansen goto fail;
443f1bd9041SJohn Johansen } else
444f1bd9041SJohn Johansen aa_get_proxy(proxy);
445f1bd9041SJohn Johansen /* just set new's proxy, don't redirect proxy here if it was passed in*/
446f1bd9041SJohn Johansen new->proxy = proxy;
447f1bd9041SJohn Johansen
448f1bd9041SJohn Johansen return new;
449f1bd9041SJohn Johansen
450f1bd9041SJohn Johansen fail:
451f1bd9041SJohn Johansen kfree(new);
452f1bd9041SJohn Johansen
453f1bd9041SJohn Johansen return NULL;
454f1bd9041SJohn Johansen }
455f1bd9041SJohn Johansen
456f1bd9041SJohn Johansen
457f1bd9041SJohn Johansen /**
458a18f9028SZygmunt Krynicki * label_cmp - label comparison for set ordering
459f1bd9041SJohn Johansen * @a: label to compare (NOT NULL)
460f1bd9041SJohn Johansen * @b: label to compare (NOT NULL)
461f1bd9041SJohn Johansen *
462f1bd9041SJohn Johansen * Returns: <0 if a < b
463f1bd9041SJohn Johansen * ==0 if a == b
464f1bd9041SJohn Johansen * >0 if a > b
465f1bd9041SJohn Johansen */
label_cmp(struct aa_label * a,struct aa_label * b)466f1bd9041SJohn Johansen static int label_cmp(struct aa_label *a, struct aa_label *b)
467f1bd9041SJohn Johansen {
468f1bd9041SJohn Johansen AA_BUG(!b);
469f1bd9041SJohn Johansen
470f1bd9041SJohn Johansen if (a == b)
471f1bd9041SJohn Johansen return 0;
472f1bd9041SJohn Johansen
473f1bd9041SJohn Johansen return vec_cmp(a->vec, a->size, b->vec, b->size);
474f1bd9041SJohn Johansen }
475f1bd9041SJohn Johansen
476f1bd9041SJohn Johansen /* helper fn for label_for_each_confined */
aa_label_next_confined(struct aa_label * label,int i)477f1bd9041SJohn Johansen int aa_label_next_confined(struct aa_label *label, int i)
478f1bd9041SJohn Johansen {
479f1bd9041SJohn Johansen AA_BUG(!label);
480f1bd9041SJohn Johansen AA_BUG(i < 0);
481f1bd9041SJohn Johansen
482f1bd9041SJohn Johansen for (; i < label->size; i++) {
483f1bd9041SJohn Johansen if (!profile_unconfined(label->vec[i]))
484f1bd9041SJohn Johansen return i;
485f1bd9041SJohn Johansen }
486f1bd9041SJohn Johansen
487f1bd9041SJohn Johansen return i;
488f1bd9041SJohn Johansen }
489f1bd9041SJohn Johansen
490f1bd9041SJohn Johansen /**
491240516dfSYang Li * __aa_label_next_not_in_set - return the next profile of @sub not in @set
492f1bd9041SJohn Johansen * @I: label iterator
493f1bd9041SJohn Johansen * @set: label to test against
494f1bd9041SJohn Johansen * @sub: label to if is subset of @set
495f1bd9041SJohn Johansen *
496f1bd9041SJohn Johansen * Returns: profile in @sub that is not in @set, with iterator set pos after
497f1bd9041SJohn Johansen * else NULL if @sub is a subset of @set
498f1bd9041SJohn Johansen */
__aa_label_next_not_in_set(struct label_it * I,struct aa_label * set,struct aa_label * sub)499f1bd9041SJohn Johansen struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
500f1bd9041SJohn Johansen struct aa_label *set,
501f1bd9041SJohn Johansen struct aa_label *sub)
502f1bd9041SJohn Johansen {
503f1bd9041SJohn Johansen AA_BUG(!set);
504f1bd9041SJohn Johansen AA_BUG(!I);
505f1bd9041SJohn Johansen AA_BUG(I->i < 0);
506f1bd9041SJohn Johansen AA_BUG(I->i > set->size);
507f1bd9041SJohn Johansen AA_BUG(!sub);
508f1bd9041SJohn Johansen AA_BUG(I->j < 0);
509f1bd9041SJohn Johansen AA_BUG(I->j > sub->size);
510f1bd9041SJohn Johansen
511f1bd9041SJohn Johansen while (I->j < sub->size && I->i < set->size) {
512f1bd9041SJohn Johansen int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
513f1bd9041SJohn Johansen
514f1bd9041SJohn Johansen if (res == 0) {
515f1bd9041SJohn Johansen (I->j)++;
516f1bd9041SJohn Johansen (I->i)++;
517f1bd9041SJohn Johansen } else if (res > 0)
518f1bd9041SJohn Johansen (I->i)++;
519f1bd9041SJohn Johansen else
520f1bd9041SJohn Johansen return sub->vec[(I->j)++];
521f1bd9041SJohn Johansen }
522f1bd9041SJohn Johansen
523f1bd9041SJohn Johansen if (I->j < sub->size)
524f1bd9041SJohn Johansen return sub->vec[(I->j)++];
525f1bd9041SJohn Johansen
526f1bd9041SJohn Johansen return NULL;
527f1bd9041SJohn Johansen }
528f1bd9041SJohn Johansen
529f1bd9041SJohn Johansen /**
530f1bd9041SJohn Johansen * aa_label_is_subset - test if @sub is a subset of @set
531f1bd9041SJohn Johansen * @set: label to test against
532f1bd9041SJohn Johansen * @sub: label to test if is subset of @set
533f1bd9041SJohn Johansen *
534f1bd9041SJohn Johansen * Returns: true if @sub is subset of @set
535f1bd9041SJohn Johansen * else false
536f1bd9041SJohn Johansen */
aa_label_is_subset(struct aa_label * set,struct aa_label * sub)537f1bd9041SJohn Johansen bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
538f1bd9041SJohn Johansen {
539f1bd9041SJohn Johansen struct label_it i = { };
540f1bd9041SJohn Johansen
541f1bd9041SJohn Johansen AA_BUG(!set);
542f1bd9041SJohn Johansen AA_BUG(!sub);
543f1bd9041SJohn Johansen
544f1bd9041SJohn Johansen if (sub == set)
545f1bd9041SJohn Johansen return true;
546f1bd9041SJohn Johansen
547f1bd9041SJohn Johansen return __aa_label_next_not_in_set(&i, set, sub) == NULL;
548f1bd9041SJohn Johansen }
549f1bd9041SJohn Johansen
5503ed4aaa9SJohn Johansen /**
5513ed4aaa9SJohn Johansen * aa_label_is_unconfined_subset - test if @sub is a subset of @set
5523ed4aaa9SJohn Johansen * @set: label to test against
5533ed4aaa9SJohn Johansen * @sub: label to test if is subset of @set
5543ed4aaa9SJohn Johansen *
5553ed4aaa9SJohn Johansen * This checks for subset but taking into account unconfined. IF
5563ed4aaa9SJohn Johansen * @sub contains an unconfined profile that does not have a matching
5573ed4aaa9SJohn Johansen * unconfined in @set then this will not cause the test to fail.
5583ed4aaa9SJohn Johansen * Conversely we don't care about an unconfined in @set that is not in
5593ed4aaa9SJohn Johansen * @sub
5603ed4aaa9SJohn Johansen *
5613ed4aaa9SJohn Johansen * Returns: true if @sub is special_subset of @set
5623ed4aaa9SJohn Johansen * else false
5633ed4aaa9SJohn Johansen */
aa_label_is_unconfined_subset(struct aa_label * set,struct aa_label * sub)5643ed4aaa9SJohn Johansen bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
5653ed4aaa9SJohn Johansen {
5663ed4aaa9SJohn Johansen struct label_it i = { };
5673ed4aaa9SJohn Johansen struct aa_profile *p;
5683ed4aaa9SJohn Johansen
5693ed4aaa9SJohn Johansen AA_BUG(!set);
5703ed4aaa9SJohn Johansen AA_BUG(!sub);
5713ed4aaa9SJohn Johansen
5723ed4aaa9SJohn Johansen if (sub == set)
5733ed4aaa9SJohn Johansen return true;
5743ed4aaa9SJohn Johansen
5753ed4aaa9SJohn Johansen do {
5763ed4aaa9SJohn Johansen p = __aa_label_next_not_in_set(&i, set, sub);
5773ed4aaa9SJohn Johansen if (p && !profile_unconfined(p))
5783ed4aaa9SJohn Johansen break;
5793ed4aaa9SJohn Johansen } while (p);
5803ed4aaa9SJohn Johansen
5813ed4aaa9SJohn Johansen return p == NULL;
5823ed4aaa9SJohn Johansen }
583f1bd9041SJohn Johansen
584f1bd9041SJohn Johansen
585f1bd9041SJohn Johansen /**
586f1bd9041SJohn Johansen * __label_remove - remove @label from the label set
587f1bd9041SJohn Johansen * @l: label to remove
588f1bd9041SJohn Johansen * @new: label to redirect to
589f1bd9041SJohn Johansen *
590f1bd9041SJohn Johansen * Requires: labels_set(@label)->lock write_lock
591f1bd9041SJohn Johansen * Returns: true if the label was in the tree and removed
592f1bd9041SJohn Johansen */
__label_remove(struct aa_label * label,struct aa_label * new)593f1bd9041SJohn Johansen static bool __label_remove(struct aa_label *label, struct aa_label *new)
594f1bd9041SJohn Johansen {
595f1bd9041SJohn Johansen struct aa_labelset *ls = labels_set(label);
596f1bd9041SJohn Johansen
597f1bd9041SJohn Johansen AA_BUG(!ls);
598f1bd9041SJohn Johansen AA_BUG(!label);
5999ffbe8acSNikolay Borisov lockdep_assert_held_write(&ls->lock);
600f1bd9041SJohn Johansen
601f1bd9041SJohn Johansen if (new)
602f1bd9041SJohn Johansen __aa_proxy_redirect(label, new);
603f1bd9041SJohn Johansen
604f1bd9041SJohn Johansen if (!label_is_stale(label))
605f1bd9041SJohn Johansen __label_make_stale(label);
606f1bd9041SJohn Johansen
607f1bd9041SJohn Johansen if (label->flags & FLAG_IN_TREE) {
608f1bd9041SJohn Johansen rb_erase(&label->node, &ls->root);
609f1bd9041SJohn Johansen label->flags &= ~FLAG_IN_TREE;
610f1bd9041SJohn Johansen return true;
611f1bd9041SJohn Johansen }
612f1bd9041SJohn Johansen
613f1bd9041SJohn Johansen return false;
614f1bd9041SJohn Johansen }
615f1bd9041SJohn Johansen
616f1bd9041SJohn Johansen /**
617f1bd9041SJohn Johansen * __label_replace - replace @old with @new in label set
618f1bd9041SJohn Johansen * @old: label to remove from label set
619f1bd9041SJohn Johansen * @new: label to replace @old with
620f1bd9041SJohn Johansen *
621f1bd9041SJohn Johansen * Requires: labels_set(@old)->lock write_lock
622f1bd9041SJohn Johansen * valid ref count be held on @new
623f1bd9041SJohn Johansen * Returns: true if @old was in set and replaced by @new
624f1bd9041SJohn Johansen *
625f1bd9041SJohn Johansen * Note: current implementation requires label set be order in such a way
626f1bd9041SJohn Johansen * that @new directly replaces @old position in the set (ie.
627f1bd9041SJohn Johansen * using pointer comparison of the label address would not work)
628f1bd9041SJohn Johansen */
__label_replace(struct aa_label * old,struct aa_label * new)629f1bd9041SJohn Johansen static bool __label_replace(struct aa_label *old, struct aa_label *new)
630f1bd9041SJohn Johansen {
631f1bd9041SJohn Johansen struct aa_labelset *ls = labels_set(old);
632f1bd9041SJohn Johansen
633f1bd9041SJohn Johansen AA_BUG(!ls);
634f1bd9041SJohn Johansen AA_BUG(!old);
635f1bd9041SJohn Johansen AA_BUG(!new);
6369ffbe8acSNikolay Borisov lockdep_assert_held_write(&ls->lock);
637f1bd9041SJohn Johansen AA_BUG(new->flags & FLAG_IN_TREE);
638f1bd9041SJohn Johansen
639f1bd9041SJohn Johansen if (!label_is_stale(old))
640f1bd9041SJohn Johansen __label_make_stale(old);
641f1bd9041SJohn Johansen
642f1bd9041SJohn Johansen if (old->flags & FLAG_IN_TREE) {
643f1bd9041SJohn Johansen rb_replace_node(&old->node, &new->node, &ls->root);
644f1bd9041SJohn Johansen old->flags &= ~FLAG_IN_TREE;
645f1bd9041SJohn Johansen new->flags |= FLAG_IN_TREE;
646f1bd9041SJohn Johansen return true;
647f1bd9041SJohn Johansen }
648f1bd9041SJohn Johansen
649f1bd9041SJohn Johansen return false;
650f1bd9041SJohn Johansen }
651f1bd9041SJohn Johansen
652f1bd9041SJohn Johansen /**
653f1bd9041SJohn Johansen * __label_insert - attempt to insert @l into a label set
654f1bd9041SJohn Johansen * @ls: set of labels to insert @l into (NOT NULL)
655f1bd9041SJohn Johansen * @label: new label to insert (NOT NULL)
656f1bd9041SJohn Johansen * @replace: whether insertion should replace existing entry that is not stale
657f1bd9041SJohn Johansen *
658f1bd9041SJohn Johansen * Requires: @ls->lock
659f1bd9041SJohn Johansen * caller to hold a valid ref on l
660f1bd9041SJohn Johansen * if @replace is true l has a preallocated proxy associated
661f1bd9041SJohn Johansen * Returns: @l if successful in inserting @l - with additional refcount
662f1bd9041SJohn Johansen * else ref counted equivalent label that is already in the set,
663f1bd9041SJohn Johansen * the else condition only happens if @replace is false
664f1bd9041SJohn Johansen */
__label_insert(struct aa_labelset * ls,struct aa_label * label,bool replace)665f1bd9041SJohn Johansen static struct aa_label *__label_insert(struct aa_labelset *ls,
666f1bd9041SJohn Johansen struct aa_label *label, bool replace)
667f1bd9041SJohn Johansen {
668f1bd9041SJohn Johansen struct rb_node **new, *parent = NULL;
669f1bd9041SJohn Johansen
670f1bd9041SJohn Johansen AA_BUG(!ls);
671f1bd9041SJohn Johansen AA_BUG(!label);
672f1bd9041SJohn Johansen AA_BUG(labels_set(label) != ls);
6739ffbe8acSNikolay Borisov lockdep_assert_held_write(&ls->lock);
674f1bd9041SJohn Johansen AA_BUG(label->flags & FLAG_IN_TREE);
675f1bd9041SJohn Johansen
676f1bd9041SJohn Johansen /* Figure out where to put new node */
677f1bd9041SJohn Johansen new = &ls->root.rb_node;
678f1bd9041SJohn Johansen while (*new) {
679f1bd9041SJohn Johansen struct aa_label *this = rb_entry(*new, struct aa_label, node);
680f1bd9041SJohn Johansen int result = label_cmp(label, this);
681f1bd9041SJohn Johansen
682f1bd9041SJohn Johansen parent = *new;
683f1bd9041SJohn Johansen if (result == 0) {
684f1bd9041SJohn Johansen /* !__aa_get_label means queued for destruction,
685f1bd9041SJohn Johansen * so replace in place, however the label has
686f1bd9041SJohn Johansen * died before the replacement so do not share
687f1bd9041SJohn Johansen * the proxy
688f1bd9041SJohn Johansen */
689f1bd9041SJohn Johansen if (!replace && !label_is_stale(this)) {
690f1bd9041SJohn Johansen if (__aa_get_label(this))
691f1bd9041SJohn Johansen return this;
692f1bd9041SJohn Johansen } else
693f1bd9041SJohn Johansen __proxy_share(this, label);
694f1bd9041SJohn Johansen AA_BUG(!__label_replace(this, label));
695f1bd9041SJohn Johansen return aa_get_label(label);
696f1bd9041SJohn Johansen } else if (result < 0)
697f1bd9041SJohn Johansen new = &((*new)->rb_left);
698f1bd9041SJohn Johansen else /* (result > 0) */
699f1bd9041SJohn Johansen new = &((*new)->rb_right);
700f1bd9041SJohn Johansen }
701f1bd9041SJohn Johansen
702f1bd9041SJohn Johansen /* Add new node and rebalance tree. */
703f1bd9041SJohn Johansen rb_link_node(&label->node, parent, new);
704f1bd9041SJohn Johansen rb_insert_color(&label->node, &ls->root);
705f1bd9041SJohn Johansen label->flags |= FLAG_IN_TREE;
706f1bd9041SJohn Johansen
707f1bd9041SJohn Johansen return aa_get_label(label);
708f1bd9041SJohn Johansen }
709f1bd9041SJohn Johansen
710f1bd9041SJohn Johansen /**
711f1bd9041SJohn Johansen * __vec_find - find label that matches @vec in label set
712f1bd9041SJohn Johansen * @vec: vec of profiles to find matching label for (NOT NULL)
713f1bd9041SJohn Johansen * @n: length of @vec
714f1bd9041SJohn Johansen *
715f1bd9041SJohn Johansen * Requires: @vec_labelset(vec) lock held
716f1bd9041SJohn Johansen * caller to hold a valid ref on l
717f1bd9041SJohn Johansen *
718f1bd9041SJohn Johansen * Returns: ref counted @label if matching label is in tree
719f1bd9041SJohn Johansen * ref counted label that is equiv to @l in tree
720f1bd9041SJohn Johansen * else NULL if @vec equiv is not in tree
721f1bd9041SJohn Johansen */
__vec_find(struct aa_profile ** vec,int n)722f1bd9041SJohn Johansen static struct aa_label *__vec_find(struct aa_profile **vec, int n)
723f1bd9041SJohn Johansen {
724f1bd9041SJohn Johansen struct rb_node *node;
725f1bd9041SJohn Johansen
726f1bd9041SJohn Johansen AA_BUG(!vec);
727f1bd9041SJohn Johansen AA_BUG(!*vec);
728f1bd9041SJohn Johansen AA_BUG(n <= 0);
729f1bd9041SJohn Johansen
730f1bd9041SJohn Johansen node = vec_labelset(vec, n)->root.rb_node;
731f1bd9041SJohn Johansen while (node) {
732f1bd9041SJohn Johansen struct aa_label *this = rb_entry(node, struct aa_label, node);
733f1bd9041SJohn Johansen int result = vec_cmp(this->vec, this->size, vec, n);
734f1bd9041SJohn Johansen
735f1bd9041SJohn Johansen if (result > 0)
736f1bd9041SJohn Johansen node = node->rb_left;
737f1bd9041SJohn Johansen else if (result < 0)
738f1bd9041SJohn Johansen node = node->rb_right;
739f1bd9041SJohn Johansen else
740f1bd9041SJohn Johansen return __aa_get_label(this);
741f1bd9041SJohn Johansen }
742f1bd9041SJohn Johansen
743f1bd9041SJohn Johansen return NULL;
744f1bd9041SJohn Johansen }
745f1bd9041SJohn Johansen
746f1bd9041SJohn Johansen /**
747f1bd9041SJohn Johansen * __label_find - find label @label in label set
748f1bd9041SJohn Johansen * @label: label to find (NOT NULL)
749f1bd9041SJohn Johansen *
750f1bd9041SJohn Johansen * Requires: labels_set(@label)->lock held
751f1bd9041SJohn Johansen * caller to hold a valid ref on l
752f1bd9041SJohn Johansen *
753f1bd9041SJohn Johansen * Returns: ref counted @label if @label is in tree OR
754f1bd9041SJohn Johansen * ref counted label that is equiv to @label in tree
755f1bd9041SJohn Johansen * else NULL if @label or equiv is not in tree
756f1bd9041SJohn Johansen */
__label_find(struct aa_label * label)757f1bd9041SJohn Johansen static struct aa_label *__label_find(struct aa_label *label)
758f1bd9041SJohn Johansen {
759f1bd9041SJohn Johansen AA_BUG(!label);
760f1bd9041SJohn Johansen
761f1bd9041SJohn Johansen return __vec_find(label->vec, label->size);
762f1bd9041SJohn Johansen }
763f1bd9041SJohn Johansen
764f1bd9041SJohn Johansen
765f1bd9041SJohn Johansen /**
766f1bd9041SJohn Johansen * aa_label_remove - remove a label from the labelset
767f1bd9041SJohn Johansen * @label: label to remove
768f1bd9041SJohn Johansen *
769f1bd9041SJohn Johansen * Returns: true if @label was removed from the tree
770f1bd9041SJohn Johansen * else @label was not in tree so it could not be removed
771f1bd9041SJohn Johansen */
aa_label_remove(struct aa_label * label)772f1bd9041SJohn Johansen bool aa_label_remove(struct aa_label *label)
773f1bd9041SJohn Johansen {
774f1bd9041SJohn Johansen struct aa_labelset *ls = labels_set(label);
775f1bd9041SJohn Johansen unsigned long flags;
776f1bd9041SJohn Johansen bool res;
777f1bd9041SJohn Johansen
778f1bd9041SJohn Johansen AA_BUG(!ls);
779f1bd9041SJohn Johansen
780f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
781f1bd9041SJohn Johansen res = __label_remove(label, ns_unconfined(labels_ns(label)));
782f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
783f1bd9041SJohn Johansen
784f1bd9041SJohn Johansen return res;
785f1bd9041SJohn Johansen }
786f1bd9041SJohn Johansen
787f1bd9041SJohn Johansen /**
788f1bd9041SJohn Johansen * aa_label_replace - replace a label @old with a new version @new
789f1bd9041SJohn Johansen * @old: label to replace
790f1bd9041SJohn Johansen * @new: label replacing @old
791f1bd9041SJohn Johansen *
792f1bd9041SJohn Johansen * Returns: true if @old was in tree and replaced
793f1bd9041SJohn Johansen * else @old was not in tree, and @new was not inserted
794f1bd9041SJohn Johansen */
aa_label_replace(struct aa_label * old,struct aa_label * new)795f1bd9041SJohn Johansen bool aa_label_replace(struct aa_label *old, struct aa_label *new)
796f1bd9041SJohn Johansen {
797f1bd9041SJohn Johansen unsigned long flags;
798f1bd9041SJohn Johansen bool res;
799f1bd9041SJohn Johansen
800f1bd9041SJohn Johansen if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
801f1bd9041SJohn Johansen write_lock_irqsave(&labels_set(old)->lock, flags);
802f1bd9041SJohn Johansen if (old->proxy != new->proxy)
803f1bd9041SJohn Johansen __proxy_share(old, new);
804f1bd9041SJohn Johansen else
805f1bd9041SJohn Johansen __aa_proxy_redirect(old, new);
806f1bd9041SJohn Johansen res = __label_replace(old, new);
807f1bd9041SJohn Johansen write_unlock_irqrestore(&labels_set(old)->lock, flags);
808f1bd9041SJohn Johansen } else {
809f1bd9041SJohn Johansen struct aa_label *l;
810f1bd9041SJohn Johansen struct aa_labelset *ls = labels_set(old);
811f1bd9041SJohn Johansen
812f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
813f1bd9041SJohn Johansen res = __label_remove(old, new);
814f1bd9041SJohn Johansen if (labels_ns(old) != labels_ns(new)) {
815f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
816f1bd9041SJohn Johansen ls = labels_set(new);
817f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
818f1bd9041SJohn Johansen }
819f1bd9041SJohn Johansen l = __label_insert(ls, new, true);
820f1bd9041SJohn Johansen res = (l == new);
821f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
822f1bd9041SJohn Johansen aa_put_label(l);
823f1bd9041SJohn Johansen }
824f1bd9041SJohn Johansen
825f1bd9041SJohn Johansen return res;
826f1bd9041SJohn Johansen }
827f1bd9041SJohn Johansen
828f1bd9041SJohn Johansen /**
829f1bd9041SJohn Johansen * vec_find - find label @l in label set
830f1bd9041SJohn Johansen * @vec: array of profiles to find equiv label for (NOT NULL)
831f1bd9041SJohn Johansen * @n: length of @vec
832f1bd9041SJohn Johansen *
833f1bd9041SJohn Johansen * Returns: refcounted label if @vec equiv is in tree
834f1bd9041SJohn Johansen * else NULL if @vec equiv is not in tree
835f1bd9041SJohn Johansen */
vec_find(struct aa_profile ** vec,int n)836f1bd9041SJohn Johansen static struct aa_label *vec_find(struct aa_profile **vec, int n)
837f1bd9041SJohn Johansen {
838f1bd9041SJohn Johansen struct aa_labelset *ls;
839f1bd9041SJohn Johansen struct aa_label *label;
840f1bd9041SJohn Johansen unsigned long flags;
841f1bd9041SJohn Johansen
842f1bd9041SJohn Johansen AA_BUG(!vec);
843f1bd9041SJohn Johansen AA_BUG(!*vec);
844f1bd9041SJohn Johansen AA_BUG(n <= 0);
845f1bd9041SJohn Johansen
846f1bd9041SJohn Johansen ls = vec_labelset(vec, n);
847f1bd9041SJohn Johansen read_lock_irqsave(&ls->lock, flags);
848f1bd9041SJohn Johansen label = __vec_find(vec, n);
849f1bd9041SJohn Johansen read_unlock_irqrestore(&ls->lock, flags);
850f1bd9041SJohn Johansen
851f1bd9041SJohn Johansen return label;
852f1bd9041SJohn Johansen }
853f1bd9041SJohn Johansen
854f1bd9041SJohn Johansen /* requires sort and merge done first */
vec_create_and_insert_label(struct aa_profile ** vec,int len,gfp_t gfp)855f1bd9041SJohn Johansen static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
856f1bd9041SJohn Johansen int len, gfp_t gfp)
857f1bd9041SJohn Johansen {
858f1bd9041SJohn Johansen struct aa_label *label = NULL;
859f1bd9041SJohn Johansen struct aa_labelset *ls;
860f1bd9041SJohn Johansen unsigned long flags;
861f1bd9041SJohn Johansen struct aa_label *new;
862f1bd9041SJohn Johansen int i;
863f1bd9041SJohn Johansen
864f1bd9041SJohn Johansen AA_BUG(!vec);
865f1bd9041SJohn Johansen
866f1bd9041SJohn Johansen if (len == 1)
867f1bd9041SJohn Johansen return aa_get_label(&vec[0]->label);
868f1bd9041SJohn Johansen
869f1bd9041SJohn Johansen ls = labels_set(&vec[len - 1]->label);
870f1bd9041SJohn Johansen
871f1bd9041SJohn Johansen /* TODO: enable when read side is lockless
872f1bd9041SJohn Johansen * check if label exists before taking locks
873f1bd9041SJohn Johansen */
874f1bd9041SJohn Johansen new = aa_label_alloc(len, NULL, gfp);
875f1bd9041SJohn Johansen if (!new)
876f1bd9041SJohn Johansen return NULL;
877f1bd9041SJohn Johansen
878f1bd9041SJohn Johansen for (i = 0; i < len; i++)
879f1bd9041SJohn Johansen new->vec[i] = aa_get_profile(vec[i]);
880f1bd9041SJohn Johansen
881f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
882f1bd9041SJohn Johansen label = __label_insert(ls, new, false);
883f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
884f1bd9041SJohn Johansen label_free_or_put_new(label, new);
885f1bd9041SJohn Johansen
886f1bd9041SJohn Johansen return label;
887f1bd9041SJohn Johansen }
888f1bd9041SJohn Johansen
aa_vec_find_or_create_label(struct aa_profile ** vec,int len,gfp_t gfp)889f1bd9041SJohn Johansen struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
890f1bd9041SJohn Johansen gfp_t gfp)
891f1bd9041SJohn Johansen {
892f1bd9041SJohn Johansen struct aa_label *label = vec_find(vec, len);
893f1bd9041SJohn Johansen
894f1bd9041SJohn Johansen if (label)
895f1bd9041SJohn Johansen return label;
896f1bd9041SJohn Johansen
897f1bd9041SJohn Johansen return vec_create_and_insert_label(vec, len, gfp);
898f1bd9041SJohn Johansen }
899f1bd9041SJohn Johansen
900f1bd9041SJohn Johansen /**
901f1bd9041SJohn Johansen * aa_label_find - find label @label in label set
902f1bd9041SJohn Johansen * @label: label to find (NOT NULL)
903f1bd9041SJohn Johansen *
904f1bd9041SJohn Johansen * Requires: caller to hold a valid ref on l
905f1bd9041SJohn Johansen *
906f1bd9041SJohn Johansen * Returns: refcounted @label if @label is in tree
907f1bd9041SJohn Johansen * refcounted label that is equiv to @label in tree
908f1bd9041SJohn Johansen * else NULL if @label or equiv is not in tree
909f1bd9041SJohn Johansen */
aa_label_find(struct aa_label * label)910f1bd9041SJohn Johansen struct aa_label *aa_label_find(struct aa_label *label)
911f1bd9041SJohn Johansen {
912f1bd9041SJohn Johansen AA_BUG(!label);
913f1bd9041SJohn Johansen
914f1bd9041SJohn Johansen return vec_find(label->vec, label->size);
915f1bd9041SJohn Johansen }
916f1bd9041SJohn Johansen
917f1bd9041SJohn Johansen
918f1bd9041SJohn Johansen /**
919f1bd9041SJohn Johansen * aa_label_insert - insert label @label into @ls or return existing label
920f1bd9041SJohn Johansen * @ls - labelset to insert @label into
921f1bd9041SJohn Johansen * @label - label to insert
922f1bd9041SJohn Johansen *
923f1bd9041SJohn Johansen * Requires: caller to hold a valid ref on @label
924f1bd9041SJohn Johansen *
925f1bd9041SJohn Johansen * Returns: ref counted @label if successful in inserting @label
926f1bd9041SJohn Johansen * else ref counted equivalent label that is already in the set
927f1bd9041SJohn Johansen */
aa_label_insert(struct aa_labelset * ls,struct aa_label * label)928f1bd9041SJohn Johansen struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
929f1bd9041SJohn Johansen {
930f1bd9041SJohn Johansen struct aa_label *l;
931f1bd9041SJohn Johansen unsigned long flags;
932f1bd9041SJohn Johansen
933f1bd9041SJohn Johansen AA_BUG(!ls);
934f1bd9041SJohn Johansen AA_BUG(!label);
935f1bd9041SJohn Johansen
936f1bd9041SJohn Johansen /* check if label exists before taking lock */
937f1bd9041SJohn Johansen if (!label_is_stale(label)) {
938f1bd9041SJohn Johansen read_lock_irqsave(&ls->lock, flags);
939f1bd9041SJohn Johansen l = __label_find(label);
940f1bd9041SJohn Johansen read_unlock_irqrestore(&ls->lock, flags);
941f1bd9041SJohn Johansen if (l)
942f1bd9041SJohn Johansen return l;
943f1bd9041SJohn Johansen }
944f1bd9041SJohn Johansen
945f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
946f1bd9041SJohn Johansen l = __label_insert(ls, label, false);
947f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
948f1bd9041SJohn Johansen
949f1bd9041SJohn Johansen return l;
950f1bd9041SJohn Johansen }
951f1bd9041SJohn Johansen
952f1bd9041SJohn Johansen
953f1bd9041SJohn Johansen /**
954f1bd9041SJohn Johansen * aa_label_next_in_merge - find the next profile when merging @a and @b
955f1bd9041SJohn Johansen * @I: label iterator
956f1bd9041SJohn Johansen * @a: label to merge
957f1bd9041SJohn Johansen * @b: label to merge
958f1bd9041SJohn Johansen *
959f1bd9041SJohn Johansen * Returns: next profile
960f1bd9041SJohn Johansen * else null if no more profiles
961f1bd9041SJohn Johansen */
aa_label_next_in_merge(struct label_it * I,struct aa_label * a,struct aa_label * b)962f1bd9041SJohn Johansen struct aa_profile *aa_label_next_in_merge(struct label_it *I,
963f1bd9041SJohn Johansen struct aa_label *a,
964f1bd9041SJohn Johansen struct aa_label *b)
965f1bd9041SJohn Johansen {
966f1bd9041SJohn Johansen AA_BUG(!a);
967f1bd9041SJohn Johansen AA_BUG(!b);
968f1bd9041SJohn Johansen AA_BUG(!I);
969f1bd9041SJohn Johansen AA_BUG(I->i < 0);
970f1bd9041SJohn Johansen AA_BUG(I->i > a->size);
971f1bd9041SJohn Johansen AA_BUG(I->j < 0);
972f1bd9041SJohn Johansen AA_BUG(I->j > b->size);
973f1bd9041SJohn Johansen
974f1bd9041SJohn Johansen if (I->i < a->size) {
975f1bd9041SJohn Johansen if (I->j < b->size) {
976f1bd9041SJohn Johansen int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
977f1bd9041SJohn Johansen
978f1bd9041SJohn Johansen if (res > 0)
979f1bd9041SJohn Johansen return b->vec[(I->j)++];
980f1bd9041SJohn Johansen if (res == 0)
981f1bd9041SJohn Johansen (I->j)++;
982f1bd9041SJohn Johansen }
983f1bd9041SJohn Johansen
984f1bd9041SJohn Johansen return a->vec[(I->i)++];
985f1bd9041SJohn Johansen }
986f1bd9041SJohn Johansen
987f1bd9041SJohn Johansen if (I->j < b->size)
988f1bd9041SJohn Johansen return b->vec[(I->j)++];
989f1bd9041SJohn Johansen
990f1bd9041SJohn Johansen return NULL;
991f1bd9041SJohn Johansen }
992f1bd9041SJohn Johansen
993f1bd9041SJohn Johansen /**
994f1bd9041SJohn Johansen * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
995f1bd9041SJohn Johansen * @a: label to merge then compare (NOT NULL)
996f1bd9041SJohn Johansen * @b: label to merge then compare (NOT NULL)
997f1bd9041SJohn Johansen * @z: label to compare merge against (NOT NULL)
998f1bd9041SJohn Johansen *
999f1bd9041SJohn Johansen * Assumes: using the most recent versions of @a, @b, and @z
1000f1bd9041SJohn Johansen *
1001f1bd9041SJohn Johansen * Returns: <0 if a < b
1002f1bd9041SJohn Johansen * ==0 if a == b
1003f1bd9041SJohn Johansen * >0 if a > b
1004f1bd9041SJohn Johansen */
label_merge_cmp(struct aa_label * a,struct aa_label * b,struct aa_label * z)1005f1bd9041SJohn Johansen static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1006f1bd9041SJohn Johansen struct aa_label *z)
1007f1bd9041SJohn Johansen {
1008f1bd9041SJohn Johansen struct aa_profile *p = NULL;
1009f1bd9041SJohn Johansen struct label_it i = { };
1010f1bd9041SJohn Johansen int k;
1011f1bd9041SJohn Johansen
1012f1bd9041SJohn Johansen AA_BUG(!a);
1013f1bd9041SJohn Johansen AA_BUG(!b);
1014f1bd9041SJohn Johansen AA_BUG(!z);
1015f1bd9041SJohn Johansen
1016f1bd9041SJohn Johansen for (k = 0;
1017f1bd9041SJohn Johansen k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1018f1bd9041SJohn Johansen k++) {
1019f1bd9041SJohn Johansen int res = profile_cmp(p, z->vec[k]);
1020f1bd9041SJohn Johansen
1021f1bd9041SJohn Johansen if (res != 0)
1022f1bd9041SJohn Johansen return res;
1023f1bd9041SJohn Johansen }
1024f1bd9041SJohn Johansen
1025f1bd9041SJohn Johansen if (p)
1026f1bd9041SJohn Johansen return 1;
1027f1bd9041SJohn Johansen else if (k < z->size)
1028f1bd9041SJohn Johansen return -1;
1029f1bd9041SJohn Johansen return 0;
1030f1bd9041SJohn Johansen }
1031f1bd9041SJohn Johansen
1032f1bd9041SJohn Johansen /**
1033f1bd9041SJohn Johansen * label_merge_insert - create a new label by merging @a and @b
1034f1bd9041SJohn Johansen * @new: preallocated label to merge into (NOT NULL)
1035f1bd9041SJohn Johansen * @a: label to merge with @b (NOT NULL)
1036f1bd9041SJohn Johansen * @b: label to merge with @a (NOT NULL)
1037f1bd9041SJohn Johansen *
1038f1bd9041SJohn Johansen * Requires: preallocated proxy
1039f1bd9041SJohn Johansen *
1040f1bd9041SJohn Johansen * Returns: ref counted label either @new if merge is unique
1041f1bd9041SJohn Johansen * @a if @b is a subset of @a
1042f1bd9041SJohn Johansen * @b if @a is a subset of @b
1043f1bd9041SJohn Johansen *
1044f1bd9041SJohn Johansen * NOTE: will not use @new if the merge results in @new == @a or @b
1045f1bd9041SJohn Johansen *
1046f1bd9041SJohn Johansen * Must be used within labelset write lock to avoid racing with
1047f1bd9041SJohn Johansen * setting labels stale.
1048f1bd9041SJohn Johansen */
label_merge_insert(struct aa_label * new,struct aa_label * a,struct aa_label * b)1049f1bd9041SJohn Johansen static struct aa_label *label_merge_insert(struct aa_label *new,
1050f1bd9041SJohn Johansen struct aa_label *a,
1051f1bd9041SJohn Johansen struct aa_label *b)
1052f1bd9041SJohn Johansen {
1053f1bd9041SJohn Johansen struct aa_label *label;
1054f1bd9041SJohn Johansen struct aa_labelset *ls;
1055f1bd9041SJohn Johansen struct aa_profile *next;
1056f1bd9041SJohn Johansen struct label_it i;
1057f1bd9041SJohn Johansen unsigned long flags;
1058f1bd9041SJohn Johansen int k = 0, invcount = 0;
1059f1bd9041SJohn Johansen bool stale = false;
1060f1bd9041SJohn Johansen
1061f1bd9041SJohn Johansen AA_BUG(!a);
1062f1bd9041SJohn Johansen AA_BUG(a->size < 0);
1063f1bd9041SJohn Johansen AA_BUG(!b);
1064f1bd9041SJohn Johansen AA_BUG(b->size < 0);
1065f1bd9041SJohn Johansen AA_BUG(!new);
1066f1bd9041SJohn Johansen AA_BUG(new->size < a->size + b->size);
1067f1bd9041SJohn Johansen
1068f1bd9041SJohn Johansen label_for_each_in_merge(i, a, b, next) {
1069f1bd9041SJohn Johansen AA_BUG(!next);
1070f1bd9041SJohn Johansen if (profile_is_stale(next)) {
1071f1bd9041SJohn Johansen new->vec[k] = aa_get_newest_profile(next);
1072f1bd9041SJohn Johansen AA_BUG(!new->vec[k]->label.proxy);
1073f1bd9041SJohn Johansen AA_BUG(!new->vec[k]->label.proxy->label);
1074f1bd9041SJohn Johansen if (next->label.proxy != new->vec[k]->label.proxy)
1075f1bd9041SJohn Johansen invcount++;
1076f1bd9041SJohn Johansen k++;
1077f1bd9041SJohn Johansen stale = true;
1078f1bd9041SJohn Johansen } else
1079f1bd9041SJohn Johansen new->vec[k++] = aa_get_profile(next);
1080f1bd9041SJohn Johansen }
1081f1bd9041SJohn Johansen /* set to actual size which is <= allocated len */
1082f1bd9041SJohn Johansen new->size = k;
1083f1bd9041SJohn Johansen new->vec[k] = NULL;
1084f1bd9041SJohn Johansen
1085f1bd9041SJohn Johansen if (invcount) {
1086f1bd9041SJohn Johansen new->size -= aa_vec_unique(&new->vec[0], new->size,
1087f1bd9041SJohn Johansen VEC_FLAG_TERMINATE);
1088f1bd9041SJohn Johansen /* TODO: deal with reference labels */
1089f1bd9041SJohn Johansen if (new->size == 1) {
1090f1bd9041SJohn Johansen label = aa_get_label(&new->vec[0]->label);
1091f1bd9041SJohn Johansen return label;
1092f1bd9041SJohn Johansen }
1093f1bd9041SJohn Johansen } else if (!stale) {
1094f1bd9041SJohn Johansen /*
1095f1bd9041SJohn Johansen * merge could be same as a || b, note: it is not possible
1096f1bd9041SJohn Johansen * for new->size == a->size == b->size unless a == b
1097f1bd9041SJohn Johansen */
1098f1bd9041SJohn Johansen if (k == a->size)
1099f1bd9041SJohn Johansen return aa_get_label(a);
1100f1bd9041SJohn Johansen else if (k == b->size)
1101f1bd9041SJohn Johansen return aa_get_label(b);
1102f1bd9041SJohn Johansen }
1103*1f939c6bSJohn Johansen new->flags |= accum_vec_flags(new->vec, new->size);
1104f1bd9041SJohn Johansen ls = labels_set(new);
1105f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
1106f1bd9041SJohn Johansen label = __label_insert(labels_set(new), new, false);
1107f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
1108f1bd9041SJohn Johansen
1109f1bd9041SJohn Johansen return label;
1110f1bd9041SJohn Johansen }
1111f1bd9041SJohn Johansen
1112f1bd9041SJohn Johansen /**
1113f1bd9041SJohn Johansen * labelset_of_merge - find which labelset a merged label should be inserted
1114f1bd9041SJohn Johansen * @a: label to merge and insert
1115f1bd9041SJohn Johansen * @b: label to merge and insert
1116f1bd9041SJohn Johansen *
1117f1bd9041SJohn Johansen * Returns: labelset that the merged label should be inserted into
1118f1bd9041SJohn Johansen */
labelset_of_merge(struct aa_label * a,struct aa_label * b)1119f1bd9041SJohn Johansen static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1120f1bd9041SJohn Johansen struct aa_label *b)
1121f1bd9041SJohn Johansen {
1122f1bd9041SJohn Johansen struct aa_ns *nsa = labels_ns(a);
1123f1bd9041SJohn Johansen struct aa_ns *nsb = labels_ns(b);
1124f1bd9041SJohn Johansen
1125f1bd9041SJohn Johansen if (ns_cmp(nsa, nsb) <= 0)
1126f1bd9041SJohn Johansen return &nsa->labels;
1127f1bd9041SJohn Johansen return &nsb->labels;
1128f1bd9041SJohn Johansen }
1129f1bd9041SJohn Johansen
1130f1bd9041SJohn Johansen /**
1131f1bd9041SJohn Johansen * __label_find_merge - find label that is equiv to merge of @a and @b
1132f1bd9041SJohn Johansen * @ls: set of labels to search (NOT NULL)
1133f1bd9041SJohn Johansen * @a: label to merge with @b (NOT NULL)
1134f1bd9041SJohn Johansen * @b: label to merge with @a (NOT NULL)
1135f1bd9041SJohn Johansen *
1136f1bd9041SJohn Johansen * Requires: ls->lock read_lock held
1137f1bd9041SJohn Johansen *
1138f1bd9041SJohn Johansen * Returns: ref counted label that is equiv to merge of @a and @b
1139f1bd9041SJohn Johansen * else NULL if merge of @a and @b is not in set
1140f1bd9041SJohn Johansen */
__label_find_merge(struct aa_labelset * ls,struct aa_label * a,struct aa_label * b)1141f1bd9041SJohn Johansen static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1142f1bd9041SJohn Johansen struct aa_label *a,
1143f1bd9041SJohn Johansen struct aa_label *b)
1144f1bd9041SJohn Johansen {
1145f1bd9041SJohn Johansen struct rb_node *node;
1146f1bd9041SJohn Johansen
1147f1bd9041SJohn Johansen AA_BUG(!ls);
1148f1bd9041SJohn Johansen AA_BUG(!a);
1149f1bd9041SJohn Johansen AA_BUG(!b);
1150f1bd9041SJohn Johansen
1151f1bd9041SJohn Johansen if (a == b)
1152f1bd9041SJohn Johansen return __label_find(a);
1153f1bd9041SJohn Johansen
1154f1bd9041SJohn Johansen node = ls->root.rb_node;
1155f1bd9041SJohn Johansen while (node) {
1156f1bd9041SJohn Johansen struct aa_label *this = container_of(node, struct aa_label,
1157f1bd9041SJohn Johansen node);
1158f1bd9041SJohn Johansen int result = label_merge_cmp(a, b, this);
1159f1bd9041SJohn Johansen
1160f1bd9041SJohn Johansen if (result < 0)
1161f1bd9041SJohn Johansen node = node->rb_left;
1162f1bd9041SJohn Johansen else if (result > 0)
1163f1bd9041SJohn Johansen node = node->rb_right;
1164f1bd9041SJohn Johansen else
1165f1bd9041SJohn Johansen return __aa_get_label(this);
1166f1bd9041SJohn Johansen }
1167f1bd9041SJohn Johansen
1168f1bd9041SJohn Johansen return NULL;
1169f1bd9041SJohn Johansen }
1170f1bd9041SJohn Johansen
1171f1bd9041SJohn Johansen
1172f1bd9041SJohn Johansen /**
1173f1bd9041SJohn Johansen * aa_label_find_merge - find label that is equiv to merge of @a and @b
1174f1bd9041SJohn Johansen * @a: label to merge with @b (NOT NULL)
1175f1bd9041SJohn Johansen * @b: label to merge with @a (NOT NULL)
1176f1bd9041SJohn Johansen *
1177f1bd9041SJohn Johansen * Requires: labels be fully constructed with a valid ns
1178f1bd9041SJohn Johansen *
1179f1bd9041SJohn Johansen * Returns: ref counted label that is equiv to merge of @a and @b
1180f1bd9041SJohn Johansen * else NULL if merge of @a and @b is not in set
1181f1bd9041SJohn Johansen */
aa_label_find_merge(struct aa_label * a,struct aa_label * b)1182f1bd9041SJohn Johansen struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1183f1bd9041SJohn Johansen {
1184f1bd9041SJohn Johansen struct aa_labelset *ls;
1185f1bd9041SJohn Johansen struct aa_label *label, *ar = NULL, *br = NULL;
1186f1bd9041SJohn Johansen unsigned long flags;
1187f1bd9041SJohn Johansen
1188f1bd9041SJohn Johansen AA_BUG(!a);
1189f1bd9041SJohn Johansen AA_BUG(!b);
1190f1bd9041SJohn Johansen
1191f1bd9041SJohn Johansen if (label_is_stale(a))
1192f1bd9041SJohn Johansen a = ar = aa_get_newest_label(a);
1193f1bd9041SJohn Johansen if (label_is_stale(b))
1194f1bd9041SJohn Johansen b = br = aa_get_newest_label(b);
1195f1bd9041SJohn Johansen ls = labelset_of_merge(a, b);
1196f1bd9041SJohn Johansen read_lock_irqsave(&ls->lock, flags);
1197f1bd9041SJohn Johansen label = __label_find_merge(ls, a, b);
1198f1bd9041SJohn Johansen read_unlock_irqrestore(&ls->lock, flags);
1199f1bd9041SJohn Johansen aa_put_label(ar);
1200f1bd9041SJohn Johansen aa_put_label(br);
1201f1bd9041SJohn Johansen
1202f1bd9041SJohn Johansen return label;
1203f1bd9041SJohn Johansen }
1204f1bd9041SJohn Johansen
1205f1bd9041SJohn Johansen /**
1206f1bd9041SJohn Johansen * aa_label_merge - attempt to insert new merged label of @a and @b
1207f1bd9041SJohn Johansen * @ls: set of labels to insert label into (NOT NULL)
1208f1bd9041SJohn Johansen * @a: label to merge with @b (NOT NULL)
1209f1bd9041SJohn Johansen * @b: label to merge with @a (NOT NULL)
1210f1bd9041SJohn Johansen * @gfp: memory allocation type
1211f1bd9041SJohn Johansen *
1212f1bd9041SJohn Johansen * Requires: caller to hold valid refs on @a and @b
1213f1bd9041SJohn Johansen * labels be fully constructed with a valid ns
1214f1bd9041SJohn Johansen *
1215f1bd9041SJohn Johansen * Returns: ref counted new label if successful in inserting merge of a & b
1216f1bd9041SJohn Johansen * else ref counted equivalent label that is already in the set.
1217f1bd9041SJohn Johansen * else NULL if could not create label (-ENOMEM)
1218f1bd9041SJohn Johansen */
aa_label_merge(struct aa_label * a,struct aa_label * b,gfp_t gfp)1219f1bd9041SJohn Johansen struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1220f1bd9041SJohn Johansen gfp_t gfp)
1221f1bd9041SJohn Johansen {
1222f1bd9041SJohn Johansen struct aa_label *label = NULL;
1223f1bd9041SJohn Johansen
1224f1bd9041SJohn Johansen AA_BUG(!a);
1225f1bd9041SJohn Johansen AA_BUG(!b);
1226f1bd9041SJohn Johansen
1227f1bd9041SJohn Johansen if (a == b)
1228f1bd9041SJohn Johansen return aa_get_newest_label(a);
1229f1bd9041SJohn Johansen
1230f1bd9041SJohn Johansen /* TODO: enable when read side is lockless
1231f1bd9041SJohn Johansen * check if label exists before taking locks
1232f1bd9041SJohn Johansen if (!label_is_stale(a) && !label_is_stale(b))
1233f1bd9041SJohn Johansen label = aa_label_find_merge(a, b);
1234f1bd9041SJohn Johansen */
1235f1bd9041SJohn Johansen
1236f1bd9041SJohn Johansen if (!label) {
1237f1bd9041SJohn Johansen struct aa_label *new;
1238f1bd9041SJohn Johansen
1239f1bd9041SJohn Johansen a = aa_get_newest_label(a);
1240f1bd9041SJohn Johansen b = aa_get_newest_label(b);
1241f1bd9041SJohn Johansen
1242f1bd9041SJohn Johansen /* could use label_merge_len(a, b), but requires double
1243f1bd9041SJohn Johansen * comparison for small savings
1244f1bd9041SJohn Johansen */
1245f1bd9041SJohn Johansen new = aa_label_alloc(a->size + b->size, NULL, gfp);
1246f1bd9041SJohn Johansen if (!new)
1247f1bd9041SJohn Johansen goto out;
1248f1bd9041SJohn Johansen
1249f1bd9041SJohn Johansen label = label_merge_insert(new, a, b);
1250f1bd9041SJohn Johansen label_free_or_put_new(label, new);
1251f1bd9041SJohn Johansen out:
1252f1bd9041SJohn Johansen aa_put_label(a);
1253f1bd9041SJohn Johansen aa_put_label(b);
1254f1bd9041SJohn Johansen }
1255f1bd9041SJohn Johansen
1256f1bd9041SJohn Johansen return label;
1257f1bd9041SJohn Johansen }
1258f1bd9041SJohn Johansen
1259f1bd9041SJohn Johansen /* match a profile and its associated ns component if needed
1260f1bd9041SJohn Johansen * Assumes visibility test has already been done.
1261f1bd9041SJohn Johansen * If a subns profile is not to be matched should be prescreened with
1262f1bd9041SJohn Johansen * visibility test.
1263f1bd9041SJohn Johansen */
match_component(struct aa_profile * profile,struct aa_ruleset * rules,struct aa_profile * tp,aa_state_t state)126433fc95d8SJohn Johansen static inline aa_state_t match_component(struct aa_profile *profile,
1265217af7e2SJohn Johansen struct aa_ruleset *rules,
1266f1bd9041SJohn Johansen struct aa_profile *tp,
126733fc95d8SJohn Johansen aa_state_t state)
1268f1bd9041SJohn Johansen {
1269f1bd9041SJohn Johansen const char *ns_name;
1270f1bd9041SJohn Johansen
1271f1bd9041SJohn Johansen if (profile->ns == tp->ns)
1272217af7e2SJohn Johansen return aa_dfa_match(rules->policy.dfa, state, tp->base.hname);
1273f1bd9041SJohn Johansen
1274f1bd9041SJohn Johansen /* try matching with namespace name and then profile */
1275f1bd9041SJohn Johansen ns_name = aa_ns_name(profile->ns, tp->ns, true);
1276217af7e2SJohn Johansen state = aa_dfa_match_len(rules->policy.dfa, state, ":", 1);
1277217af7e2SJohn Johansen state = aa_dfa_match(rules->policy.dfa, state, ns_name);
1278217af7e2SJohn Johansen state = aa_dfa_match_len(rules->policy.dfa, state, ":", 1);
1279217af7e2SJohn Johansen return aa_dfa_match(rules->policy.dfa, state, tp->base.hname);
1280f1bd9041SJohn Johansen }
1281f1bd9041SJohn Johansen
1282f1bd9041SJohn Johansen /**
1283f1bd9041SJohn Johansen * label_compound_match - find perms for full compound label
1284f1bd9041SJohn Johansen * @profile: profile to find perms for
1285f1bd9041SJohn Johansen * @label: label to check access permissions for
1286f1bd9041SJohn Johansen * @start: state to start match in
1287f1bd9041SJohn Johansen * @subns: whether to do permission checks on components in a subns
1288f1bd9041SJohn Johansen * @request: permissions to request
1289f1bd9041SJohn Johansen * @perms: perms struct to set
1290f1bd9041SJohn Johansen *
1291f1bd9041SJohn Johansen * Returns: 0 on success else ERROR
1292f1bd9041SJohn Johansen *
1293f1bd9041SJohn Johansen * For the label A//&B//&C this does the perm match for A//&B//&C
1294f1bd9041SJohn Johansen * @perms should be preinitialized with allperms OR a previous permission
1295f1bd9041SJohn Johansen * check to be stacked.
1296f1bd9041SJohn Johansen */
label_compound_match(struct aa_profile * profile,struct aa_ruleset * rules,struct aa_label * label,aa_state_t state,bool subns,u32 request,struct aa_perms * perms)1297f1bd9041SJohn Johansen static int label_compound_match(struct aa_profile *profile,
1298217af7e2SJohn Johansen struct aa_ruleset *rules,
1299f1bd9041SJohn Johansen struct aa_label *label,
130033fc95d8SJohn Johansen aa_state_t state, bool subns, u32 request,
1301f1bd9041SJohn Johansen struct aa_perms *perms)
1302f1bd9041SJohn Johansen {
1303f1bd9041SJohn Johansen struct aa_profile *tp;
1304f1bd9041SJohn Johansen struct label_it i;
1305f1bd9041SJohn Johansen
1306f1bd9041SJohn Johansen /* find first subcomponent that is visible */
1307f1bd9041SJohn Johansen label_for_each(i, label, tp) {
1308f1bd9041SJohn Johansen if (!aa_ns_visible(profile->ns, tp->ns, subns))
1309f1bd9041SJohn Johansen continue;
1310217af7e2SJohn Johansen state = match_component(profile, rules, tp, state);
1311f1bd9041SJohn Johansen if (!state)
1312f1bd9041SJohn Johansen goto fail;
1313f1bd9041SJohn Johansen goto next;
1314f1bd9041SJohn Johansen }
1315f1bd9041SJohn Johansen
1316f1bd9041SJohn Johansen /* no component visible */
1317f1bd9041SJohn Johansen *perms = allperms;
1318f1bd9041SJohn Johansen return 0;
1319f1bd9041SJohn Johansen
1320f1bd9041SJohn Johansen next:
1321f1bd9041SJohn Johansen label_for_each_cont(i, label, tp) {
1322f1bd9041SJohn Johansen if (!aa_ns_visible(profile->ns, tp->ns, subns))
1323f1bd9041SJohn Johansen continue;
1324217af7e2SJohn Johansen state = aa_dfa_match(rules->policy.dfa, state, "//&");
1325217af7e2SJohn Johansen state = match_component(profile, rules, tp, state);
1326f1bd9041SJohn Johansen if (!state)
1327f1bd9041SJohn Johansen goto fail;
1328f1bd9041SJohn Johansen }
1329217af7e2SJohn Johansen *perms = *aa_lookup_perms(&rules->policy, state);
1330f1bd9041SJohn Johansen aa_apply_modes_to_perms(profile, perms);
1331f1bd9041SJohn Johansen if ((perms->allow & request) != request)
1332f1bd9041SJohn Johansen return -EACCES;
1333f1bd9041SJohn Johansen
1334f1bd9041SJohn Johansen return 0;
1335f1bd9041SJohn Johansen
1336f1bd9041SJohn Johansen fail:
1337f1bd9041SJohn Johansen *perms = nullperms;
1338f1bd9041SJohn Johansen return state;
1339f1bd9041SJohn Johansen }
1340f1bd9041SJohn Johansen
1341f1bd9041SJohn Johansen /**
1342f1bd9041SJohn Johansen * label_components_match - find perms for all subcomponents of a label
1343f1bd9041SJohn Johansen * @profile: profile to find perms for
1344217af7e2SJohn Johansen * @rules: ruleset to search
1345f1bd9041SJohn Johansen * @label: label to check access permissions for
1346f1bd9041SJohn Johansen * @start: state to start match in
1347f1bd9041SJohn Johansen * @subns: whether to do permission checks on components in a subns
1348f1bd9041SJohn Johansen * @request: permissions to request
1349f1bd9041SJohn Johansen * @perms: an initialized perms struct to add accumulation to
1350f1bd9041SJohn Johansen *
1351f1bd9041SJohn Johansen * Returns: 0 on success else ERROR
1352f1bd9041SJohn Johansen *
1353f1bd9041SJohn Johansen * For the label A//&B//&C this does the perm match for each of A and B and C
1354f1bd9041SJohn Johansen * @perms should be preinitialized with allperms OR a previous permission
1355f1bd9041SJohn Johansen * check to be stacked.
1356f1bd9041SJohn Johansen */
label_components_match(struct aa_profile * profile,struct aa_ruleset * rules,struct aa_label * label,aa_state_t start,bool subns,u32 request,struct aa_perms * perms)1357f1bd9041SJohn Johansen static int label_components_match(struct aa_profile *profile,
1358217af7e2SJohn Johansen struct aa_ruleset *rules,
135933fc95d8SJohn Johansen struct aa_label *label, aa_state_t start,
1360f1bd9041SJohn Johansen bool subns, u32 request,
1361f1bd9041SJohn Johansen struct aa_perms *perms)
1362f1bd9041SJohn Johansen {
1363f1bd9041SJohn Johansen struct aa_profile *tp;
1364f1bd9041SJohn Johansen struct label_it i;
1365f1bd9041SJohn Johansen struct aa_perms tmp;
136633fc95d8SJohn Johansen aa_state_t state = 0;
1367f1bd9041SJohn Johansen
1368f1bd9041SJohn Johansen /* find first subcomponent to test */
1369f1bd9041SJohn Johansen label_for_each(i, label, tp) {
1370f1bd9041SJohn Johansen if (!aa_ns_visible(profile->ns, tp->ns, subns))
1371f1bd9041SJohn Johansen continue;
1372217af7e2SJohn Johansen state = match_component(profile, rules, tp, start);
1373f1bd9041SJohn Johansen if (!state)
1374f1bd9041SJohn Johansen goto fail;
1375f1bd9041SJohn Johansen goto next;
1376f1bd9041SJohn Johansen }
1377f1bd9041SJohn Johansen
1378f1bd9041SJohn Johansen /* no subcomponents visible - no change in perms */
1379f1bd9041SJohn Johansen return 0;
1380f1bd9041SJohn Johansen
1381f1bd9041SJohn Johansen next:
1382217af7e2SJohn Johansen tmp = *aa_lookup_perms(&rules->policy, state);
1383f1bd9041SJohn Johansen aa_apply_modes_to_perms(profile, &tmp);
1384f1bd9041SJohn Johansen aa_perms_accum(perms, &tmp);
1385f1bd9041SJohn Johansen label_for_each_cont(i, label, tp) {
1386f1bd9041SJohn Johansen if (!aa_ns_visible(profile->ns, tp->ns, subns))
1387f1bd9041SJohn Johansen continue;
1388217af7e2SJohn Johansen state = match_component(profile, rules, tp, start);
1389f1bd9041SJohn Johansen if (!state)
1390f1bd9041SJohn Johansen goto fail;
1391217af7e2SJohn Johansen tmp = *aa_lookup_perms(&rules->policy, state);
1392f1bd9041SJohn Johansen aa_apply_modes_to_perms(profile, &tmp);
1393f1bd9041SJohn Johansen aa_perms_accum(perms, &tmp);
1394f1bd9041SJohn Johansen }
1395f1bd9041SJohn Johansen
1396f1bd9041SJohn Johansen if ((perms->allow & request) != request)
1397f1bd9041SJohn Johansen return -EACCES;
1398f1bd9041SJohn Johansen
1399f1bd9041SJohn Johansen return 0;
1400f1bd9041SJohn Johansen
1401f1bd9041SJohn Johansen fail:
1402f1bd9041SJohn Johansen *perms = nullperms;
1403f1bd9041SJohn Johansen return -EACCES;
1404f1bd9041SJohn Johansen }
1405f1bd9041SJohn Johansen
1406f1bd9041SJohn Johansen /**
1407f1bd9041SJohn Johansen * aa_label_match - do a multi-component label match
1408f1bd9041SJohn Johansen * @profile: profile to match against (NOT NULL)
1409217af7e2SJohn Johansen * @rules: ruleset to search
1410f1bd9041SJohn Johansen * @label: label to match (NOT NULL)
1411f1bd9041SJohn Johansen * @state: state to start in
1412f1bd9041SJohn Johansen * @subns: whether to match subns components
1413f1bd9041SJohn Johansen * @request: permission request
1414f1bd9041SJohn Johansen * @perms: Returns computed perms (NOT NULL)
1415f1bd9041SJohn Johansen *
1416f1bd9041SJohn Johansen * Returns: the state the match finished in, may be the none matching state
1417f1bd9041SJohn Johansen */
aa_label_match(struct aa_profile * profile,struct aa_ruleset * rules,struct aa_label * label,aa_state_t state,bool subns,u32 request,struct aa_perms * perms)1418217af7e2SJohn Johansen int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
1419217af7e2SJohn Johansen struct aa_label *label, aa_state_t state, bool subns,
1420217af7e2SJohn Johansen u32 request, struct aa_perms *perms)
1421f1bd9041SJohn Johansen {
1422217af7e2SJohn Johansen int error = label_compound_match(profile, rules, label, state, subns,
1423217af7e2SJohn Johansen request, perms);
1424f1bd9041SJohn Johansen if (!error)
1425f1bd9041SJohn Johansen return error;
1426f1bd9041SJohn Johansen
1427f1bd9041SJohn Johansen *perms = allperms;
1428217af7e2SJohn Johansen return label_components_match(profile, rules, label, state, subns,
1429217af7e2SJohn Johansen request, perms);
1430f1bd9041SJohn Johansen }
1431f1bd9041SJohn Johansen
1432f1bd9041SJohn Johansen
1433f1bd9041SJohn Johansen /**
1434f1bd9041SJohn Johansen * aa_update_label_name - update a label to have a stored name
1435f1bd9041SJohn Johansen * @ns: ns being viewed from (NOT NULL)
1436f1bd9041SJohn Johansen * @label: label to update (NOT NULL)
1437f1bd9041SJohn Johansen * @gfp: type of memory allocation
1438f1bd9041SJohn Johansen *
1439f1bd9041SJohn Johansen * Requires: labels_set(label) not locked in caller
1440f1bd9041SJohn Johansen *
1441f1bd9041SJohn Johansen * note: only updates the label name if it does not have a name already
1442f1bd9041SJohn Johansen * and if it is in the labelset
1443f1bd9041SJohn Johansen */
aa_update_label_name(struct aa_ns * ns,struct aa_label * label,gfp_t gfp)1444f1bd9041SJohn Johansen bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1445f1bd9041SJohn Johansen {
1446f1bd9041SJohn Johansen struct aa_labelset *ls;
1447f1bd9041SJohn Johansen unsigned long flags;
1448f1bd9041SJohn Johansen char __counted *name;
1449f1bd9041SJohn Johansen bool res = false;
1450f1bd9041SJohn Johansen
1451f1bd9041SJohn Johansen AA_BUG(!ns);
1452f1bd9041SJohn Johansen AA_BUG(!label);
1453f1bd9041SJohn Johansen
1454f1bd9041SJohn Johansen if (label->hname || labels_ns(label) != ns)
1455f1bd9041SJohn Johansen return res;
1456f1bd9041SJohn Johansen
1457d108370cSTom Rix if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1458f1bd9041SJohn Johansen return res;
1459f1bd9041SJohn Johansen
1460f1bd9041SJohn Johansen ls = labels_set(label);
1461f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
1462f1bd9041SJohn Johansen if (!label->hname && label->flags & FLAG_IN_TREE) {
1463f1bd9041SJohn Johansen label->hname = name;
1464f1bd9041SJohn Johansen res = true;
1465f1bd9041SJohn Johansen } else
1466f1bd9041SJohn Johansen aa_put_str(name);
1467f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
1468f1bd9041SJohn Johansen
1469f1bd9041SJohn Johansen return res;
1470f1bd9041SJohn Johansen }
1471f1bd9041SJohn Johansen
1472f1bd9041SJohn Johansen /*
1473f1bd9041SJohn Johansen * cached label name is present and visible
1474f1bd9041SJohn Johansen * @label->hname only exists if label is namespace hierachical
1475f1bd9041SJohn Johansen */
use_label_hname(struct aa_ns * ns,struct aa_label * label,int flags)1476f872af75SJohn Johansen static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1477f872af75SJohn Johansen int flags)
1478f1bd9041SJohn Johansen {
1479f872af75SJohn Johansen if (label->hname && (!ns || labels_ns(label) == ns) &&
1480f872af75SJohn Johansen !(flags & ~FLAG_SHOW_MODE))
1481f1bd9041SJohn Johansen return true;
1482f1bd9041SJohn Johansen
1483f1bd9041SJohn Johansen return false;
1484f1bd9041SJohn Johansen }
1485f1bd9041SJohn Johansen
1486f1bd9041SJohn Johansen /* helper macro for snprint routines */
1487f1bd9041SJohn Johansen #define update_for_len(total, len, size, str) \
1488f1bd9041SJohn Johansen do { \
148900e0590dSColin Ian King size_t ulen = len; \
149000e0590dSColin Ian King \
1491f1bd9041SJohn Johansen AA_BUG(len < 0); \
149200e0590dSColin Ian King total += ulen; \
149300e0590dSColin Ian King ulen = min(ulen, size); \
149400e0590dSColin Ian King size -= ulen; \
149500e0590dSColin Ian King str += ulen; \
1496f1bd9041SJohn Johansen } while (0)
1497f1bd9041SJohn Johansen
1498f1bd9041SJohn Johansen /**
1499f1bd9041SJohn Johansen * aa_profile_snxprint - print a profile name to a buffer
1500f1bd9041SJohn Johansen * @str: buffer to write to. (MAY BE NULL if @size == 0)
1501f1bd9041SJohn Johansen * @size: size of buffer
1502f1bd9041SJohn Johansen * @view: namespace profile is being viewed from
1503f1bd9041SJohn Johansen * @profile: profile to view (NOT NULL)
1504f1bd9041SJohn Johansen * @flags: whether to include the mode string
1505f1bd9041SJohn Johansen * @prev_ns: last ns printed when used in compound print
1506f1bd9041SJohn Johansen *
1507f1bd9041SJohn Johansen * Returns: size of name written or would be written if larger than
1508f1bd9041SJohn Johansen * available buffer
1509f1bd9041SJohn Johansen *
1510f1bd9041SJohn Johansen * Note: will not print anything if the profile is not visible
1511f1bd9041SJohn Johansen */
aa_profile_snxprint(char * str,size_t size,struct aa_ns * view,struct aa_profile * profile,int flags,struct aa_ns ** prev_ns)1512f1bd9041SJohn Johansen static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1513f1bd9041SJohn Johansen struct aa_profile *profile, int flags,
1514f1bd9041SJohn Johansen struct aa_ns **prev_ns)
1515f1bd9041SJohn Johansen {
1516f1bd9041SJohn Johansen const char *ns_name = NULL;
1517f1bd9041SJohn Johansen
1518f1bd9041SJohn Johansen AA_BUG(!str && size != 0);
1519f1bd9041SJohn Johansen AA_BUG(!profile);
1520f1bd9041SJohn Johansen
1521f1bd9041SJohn Johansen if (!view)
1522f1bd9041SJohn Johansen view = profiles_ns(profile);
1523f1bd9041SJohn Johansen
1524f1bd9041SJohn Johansen if (view != profile->ns &&
1525c5561700SJohn Johansen (!prev_ns || (*prev_ns != profile->ns))) {
1526f1bd9041SJohn Johansen if (prev_ns)
1527f1bd9041SJohn Johansen *prev_ns = profile->ns;
1528f1bd9041SJohn Johansen ns_name = aa_ns_name(view, profile->ns,
1529f1bd9041SJohn Johansen flags & FLAG_VIEW_SUBNS);
1530f1bd9041SJohn Johansen if (ns_name == aa_hidden_ns_name) {
1531f1bd9041SJohn Johansen if (flags & FLAG_HIDDEN_UNCONFINED)
1532f1bd9041SJohn Johansen return snprintf(str, size, "%s", "unconfined");
1533f1bd9041SJohn Johansen return snprintf(str, size, "%s", ns_name);
1534f1bd9041SJohn Johansen }
1535f1bd9041SJohn Johansen }
1536f1bd9041SJohn Johansen
1537f1bd9041SJohn Johansen if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1538f1bd9041SJohn Johansen const char *modestr = aa_profile_mode_names[profile->mode];
1539f1bd9041SJohn Johansen
1540f1bd9041SJohn Johansen if (ns_name)
1541f1bd9041SJohn Johansen return snprintf(str, size, ":%s:%s (%s)", ns_name,
1542f1bd9041SJohn Johansen profile->base.hname, modestr);
1543f1bd9041SJohn Johansen return snprintf(str, size, "%s (%s)", profile->base.hname,
1544f1bd9041SJohn Johansen modestr);
1545f1bd9041SJohn Johansen }
1546f1bd9041SJohn Johansen
1547f1bd9041SJohn Johansen if (ns_name)
1548f1bd9041SJohn Johansen return snprintf(str, size, ":%s:%s", ns_name,
1549f1bd9041SJohn Johansen profile->base.hname);
1550f1bd9041SJohn Johansen return snprintf(str, size, "%s", profile->base.hname);
1551f1bd9041SJohn Johansen }
1552f1bd9041SJohn Johansen
label_modename(struct aa_ns * ns,struct aa_label * label,int flags)1553f1bd9041SJohn Johansen static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1554f1bd9041SJohn Johansen int flags)
1555f1bd9041SJohn Johansen {
1556f1bd9041SJohn Johansen struct aa_profile *profile;
1557f1bd9041SJohn Johansen struct label_it i;
1558f1bd9041SJohn Johansen int mode = -1, count = 0;
1559f1bd9041SJohn Johansen
1560f1bd9041SJohn Johansen label_for_each(i, label, profile) {
1561f1bd9041SJohn Johansen if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1562dd2569fbSJohn Johansen count++;
1563dd2569fbSJohn Johansen if (profile == profile->ns->unconfined)
1564f1bd9041SJohn Johansen /* special case unconfined so stacks with
1565f1bd9041SJohn Johansen * unconfined don't report as mixed. ie.
1566f1bd9041SJohn Johansen * profile_foo//&:ns1:unconfined (mixed)
1567f1bd9041SJohn Johansen */
1568f1bd9041SJohn Johansen continue;
1569f1bd9041SJohn Johansen if (mode == -1)
1570f1bd9041SJohn Johansen mode = profile->mode;
1571f1bd9041SJohn Johansen else if (mode != profile->mode)
1572f1bd9041SJohn Johansen return "mixed";
1573f1bd9041SJohn Johansen }
1574f1bd9041SJohn Johansen }
1575f1bd9041SJohn Johansen
1576f1bd9041SJohn Johansen if (count == 0)
1577f1bd9041SJohn Johansen return "-";
1578f1bd9041SJohn Johansen if (mode == -1)
1579f1bd9041SJohn Johansen /* everything was unconfined */
1580f1bd9041SJohn Johansen mode = APPARMOR_UNCONFINED;
1581f1bd9041SJohn Johansen
1582f1bd9041SJohn Johansen return aa_profile_mode_names[mode];
1583f1bd9041SJohn Johansen }
1584f1bd9041SJohn Johansen
1585f1bd9041SJohn Johansen /* if any visible label is not unconfined the display_mode returns true */
display_mode(struct aa_ns * ns,struct aa_label * label,int flags)1586f1bd9041SJohn Johansen static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1587f1bd9041SJohn Johansen int flags)
1588f1bd9041SJohn Johansen {
1589f1bd9041SJohn Johansen if ((flags & FLAG_SHOW_MODE)) {
1590f1bd9041SJohn Johansen struct aa_profile *profile;
1591f1bd9041SJohn Johansen struct label_it i;
1592f1bd9041SJohn Johansen
1593f1bd9041SJohn Johansen label_for_each(i, label, profile) {
1594f1bd9041SJohn Johansen if (aa_ns_visible(ns, profile->ns,
1595f1bd9041SJohn Johansen flags & FLAG_VIEW_SUBNS) &&
1596f1bd9041SJohn Johansen profile != profile->ns->unconfined)
1597f1bd9041SJohn Johansen return true;
1598f1bd9041SJohn Johansen }
1599f1bd9041SJohn Johansen /* only ns->unconfined in set of profiles in ns */
1600f1bd9041SJohn Johansen return false;
1601f1bd9041SJohn Johansen }
1602f1bd9041SJohn Johansen
1603f1bd9041SJohn Johansen return false;
1604f1bd9041SJohn Johansen }
1605f1bd9041SJohn Johansen
1606f1bd9041SJohn Johansen /**
1607f1bd9041SJohn Johansen * aa_label_snxprint - print a label name to a string buffer
1608f1bd9041SJohn Johansen * @str: buffer to write to. (MAY BE NULL if @size == 0)
1609f1bd9041SJohn Johansen * @size: size of buffer
1610f1bd9041SJohn Johansen * @ns: namespace profile is being viewed from
1611f1bd9041SJohn Johansen * @label: label to view (NOT NULL)
1612f1bd9041SJohn Johansen * @flags: whether to include the mode string
1613f1bd9041SJohn Johansen *
1614f1bd9041SJohn Johansen * Returns: size of name written or would be written if larger than
1615f1bd9041SJohn Johansen * available buffer
1616f1bd9041SJohn Johansen *
1617f1bd9041SJohn Johansen * Note: labels do not have to be strictly hierarchical to the ns as
1618f1bd9041SJohn Johansen * objects may be shared across different namespaces and thus
1619f1bd9041SJohn Johansen * pickup labeling from each ns. If a particular part of the
1620f1bd9041SJohn Johansen * label is not visible it will just be excluded. And if none
1621f1bd9041SJohn Johansen * of the label is visible "---" will be used.
1622f1bd9041SJohn Johansen */
aa_label_snxprint(char * str,size_t size,struct aa_ns * ns,struct aa_label * label,int flags)1623f1bd9041SJohn Johansen int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1624f1bd9041SJohn Johansen struct aa_label *label, int flags)
1625f1bd9041SJohn Johansen {
1626f1bd9041SJohn Johansen struct aa_profile *profile;
1627f1bd9041SJohn Johansen struct aa_ns *prev_ns = NULL;
1628f1bd9041SJohn Johansen struct label_it i;
1629f1bd9041SJohn Johansen int count = 0, total = 0;
163000e0590dSColin Ian King ssize_t len;
1631f1bd9041SJohn Johansen
1632f1bd9041SJohn Johansen AA_BUG(!str && size != 0);
1633f1bd9041SJohn Johansen AA_BUG(!label);
1634f1bd9041SJohn Johansen
1635511f7b5bSJohn Johansen if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
163626b78995SJohn Johansen ns = root_ns;
1637511f7b5bSJohn Johansen len = snprintf(str, size, "_");
163826b78995SJohn Johansen update_for_len(total, len, size, str);
163926b78995SJohn Johansen } else if (!ns) {
1640f1bd9041SJohn Johansen ns = labels_ns(label);
164126b78995SJohn Johansen }
1642f1bd9041SJohn Johansen
1643f1bd9041SJohn Johansen label_for_each(i, label, profile) {
1644f1bd9041SJohn Johansen if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1645f1bd9041SJohn Johansen if (count > 0) {
1646f1bd9041SJohn Johansen len = snprintf(str, size, "//&");
1647f1bd9041SJohn Johansen update_for_len(total, len, size, str);
1648f1bd9041SJohn Johansen }
1649f1bd9041SJohn Johansen len = aa_profile_snxprint(str, size, ns, profile,
1650f1bd9041SJohn Johansen flags & FLAG_VIEW_SUBNS,
1651f1bd9041SJohn Johansen &prev_ns);
1652f1bd9041SJohn Johansen update_for_len(total, len, size, str);
1653f1bd9041SJohn Johansen count++;
1654f1bd9041SJohn Johansen }
1655f1bd9041SJohn Johansen }
1656f1bd9041SJohn Johansen
1657f1bd9041SJohn Johansen if (count == 0) {
1658f1bd9041SJohn Johansen if (flags & FLAG_HIDDEN_UNCONFINED)
1659f1bd9041SJohn Johansen return snprintf(str, size, "%s", "unconfined");
1660f1bd9041SJohn Johansen return snprintf(str, size, "%s", aa_hidden_ns_name);
1661f1bd9041SJohn Johansen }
1662f1bd9041SJohn Johansen
1663f1bd9041SJohn Johansen /* count == 1 && ... is for backwards compat where the mode
1664f1bd9041SJohn Johansen * is not displayed for 'unconfined' in the current ns
1665f1bd9041SJohn Johansen */
1666f1bd9041SJohn Johansen if (display_mode(ns, label, flags)) {
1667f1bd9041SJohn Johansen len = snprintf(str, size, " (%s)",
1668f1bd9041SJohn Johansen label_modename(ns, label, flags));
1669f1bd9041SJohn Johansen update_for_len(total, len, size, str);
1670f1bd9041SJohn Johansen }
1671f1bd9041SJohn Johansen
1672f1bd9041SJohn Johansen return total;
1673f1bd9041SJohn Johansen }
1674f1bd9041SJohn Johansen #undef update_for_len
1675f1bd9041SJohn Johansen
1676f1bd9041SJohn Johansen /**
1677f1bd9041SJohn Johansen * aa_label_asxprint - allocate a string buffer and print label into it
1678f1bd9041SJohn Johansen * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1679f1bd9041SJohn Johansen * @ns: namespace profile is being viewed from
1680f1bd9041SJohn Johansen * @label: label to view (NOT NULL)
1681f1bd9041SJohn Johansen * @flags: flags controlling what label info is printed
1682f1bd9041SJohn Johansen * @gfp: kernel memory allocation type
1683f1bd9041SJohn Johansen *
1684f1bd9041SJohn Johansen * Returns: size of name written or would be written if larger than
1685f1bd9041SJohn Johansen * available buffer
1686f1bd9041SJohn Johansen */
aa_label_asxprint(char ** strp,struct aa_ns * ns,struct aa_label * label,int flags,gfp_t gfp)1687f1bd9041SJohn Johansen int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1688f1bd9041SJohn Johansen int flags, gfp_t gfp)
1689f1bd9041SJohn Johansen {
1690f1bd9041SJohn Johansen int size;
1691f1bd9041SJohn Johansen
1692f1bd9041SJohn Johansen AA_BUG(!strp);
1693f1bd9041SJohn Johansen AA_BUG(!label);
1694f1bd9041SJohn Johansen
1695f1bd9041SJohn Johansen size = aa_label_snxprint(NULL, 0, ns, label, flags);
1696f1bd9041SJohn Johansen if (size < 0)
1697f1bd9041SJohn Johansen return size;
1698f1bd9041SJohn Johansen
1699f1bd9041SJohn Johansen *strp = kmalloc(size + 1, gfp);
1700f1bd9041SJohn Johansen if (!*strp)
1701f1bd9041SJohn Johansen return -ENOMEM;
1702f1bd9041SJohn Johansen return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1703f1bd9041SJohn Johansen }
1704f1bd9041SJohn Johansen
1705f1bd9041SJohn Johansen /**
1706f1bd9041SJohn Johansen * aa_label_acntsxprint - allocate a __counted string buffer and print label
1707d108370cSTom Rix * @strp: buffer to write to.
1708f1bd9041SJohn Johansen * @ns: namespace profile is being viewed from
1709f1bd9041SJohn Johansen * @label: label to view (NOT NULL)
1710f1bd9041SJohn Johansen * @flags: flags controlling what label info is printed
1711f1bd9041SJohn Johansen * @gfp: kernel memory allocation type
1712f1bd9041SJohn Johansen *
1713f1bd9041SJohn Johansen * Returns: size of name written or would be written if larger than
1714f1bd9041SJohn Johansen * available buffer
1715f1bd9041SJohn Johansen */
aa_label_acntsxprint(char __counted ** strp,struct aa_ns * ns,struct aa_label * label,int flags,gfp_t gfp)1716f1bd9041SJohn Johansen int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1717f1bd9041SJohn Johansen struct aa_label *label, int flags, gfp_t gfp)
1718f1bd9041SJohn Johansen {
1719f1bd9041SJohn Johansen int size;
1720f1bd9041SJohn Johansen
1721f1bd9041SJohn Johansen AA_BUG(!strp);
1722f1bd9041SJohn Johansen AA_BUG(!label);
1723f1bd9041SJohn Johansen
1724f1bd9041SJohn Johansen size = aa_label_snxprint(NULL, 0, ns, label, flags);
1725f1bd9041SJohn Johansen if (size < 0)
1726f1bd9041SJohn Johansen return size;
1727f1bd9041SJohn Johansen
1728f1bd9041SJohn Johansen *strp = aa_str_alloc(size + 1, gfp);
1729f1bd9041SJohn Johansen if (!*strp)
1730f1bd9041SJohn Johansen return -ENOMEM;
1731f1bd9041SJohn Johansen return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1732f1bd9041SJohn Johansen }
1733f1bd9041SJohn Johansen
1734f1bd9041SJohn Johansen
aa_label_xaudit(struct audit_buffer * ab,struct aa_ns * ns,struct aa_label * label,int flags,gfp_t gfp)1735f1bd9041SJohn Johansen void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1736f1bd9041SJohn Johansen struct aa_label *label, int flags, gfp_t gfp)
1737f1bd9041SJohn Johansen {
1738f1bd9041SJohn Johansen const char *str;
1739f1bd9041SJohn Johansen char *name = NULL;
1740f1bd9041SJohn Johansen int len;
1741f1bd9041SJohn Johansen
1742f1bd9041SJohn Johansen AA_BUG(!ab);
1743f1bd9041SJohn Johansen AA_BUG(!label);
1744f1bd9041SJohn Johansen
1745f872af75SJohn Johansen if (!use_label_hname(ns, label, flags) ||
1746f872af75SJohn Johansen display_mode(ns, label, flags)) {
1747f1bd9041SJohn Johansen len = aa_label_asxprint(&name, ns, label, flags, gfp);
17483e2a3a08STom Rix if (len < 0) {
1749f1bd9041SJohn Johansen AA_DEBUG("label print error");
1750f1bd9041SJohn Johansen return;
1751f1bd9041SJohn Johansen }
1752f1bd9041SJohn Johansen str = name;
1753f1bd9041SJohn Johansen } else {
1754f1bd9041SJohn Johansen str = (char *) label->hname;
1755f1bd9041SJohn Johansen len = strlen(str);
1756f1bd9041SJohn Johansen }
1757f1bd9041SJohn Johansen if (audit_string_contains_control(str, len))
1758f1bd9041SJohn Johansen audit_log_n_hex(ab, str, len);
1759f1bd9041SJohn Johansen else
1760f1bd9041SJohn Johansen audit_log_n_string(ab, str, len);
1761f1bd9041SJohn Johansen
1762f1bd9041SJohn Johansen kfree(name);
1763f1bd9041SJohn Johansen }
1764f1bd9041SJohn Johansen
aa_label_seq_xprint(struct seq_file * f,struct aa_ns * ns,struct aa_label * label,int flags,gfp_t gfp)1765f1bd9041SJohn Johansen void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1766f1bd9041SJohn Johansen struct aa_label *label, int flags, gfp_t gfp)
1767f1bd9041SJohn Johansen {
1768f1bd9041SJohn Johansen AA_BUG(!f);
1769f1bd9041SJohn Johansen AA_BUG(!label);
1770f1bd9041SJohn Johansen
1771f872af75SJohn Johansen if (!use_label_hname(ns, label, flags)) {
1772f1bd9041SJohn Johansen char *str;
1773f1bd9041SJohn Johansen int len;
1774f1bd9041SJohn Johansen
1775f1bd9041SJohn Johansen len = aa_label_asxprint(&str, ns, label, flags, gfp);
17763e2a3a08STom Rix if (len < 0) {
1777f1bd9041SJohn Johansen AA_DEBUG("label print error");
1778f1bd9041SJohn Johansen return;
1779f1bd9041SJohn Johansen }
1780278de07eSMarkus Elfring seq_puts(f, str);
1781f1bd9041SJohn Johansen kfree(str);
1782f1bd9041SJohn Johansen } else if (display_mode(ns, label, flags))
1783f1bd9041SJohn Johansen seq_printf(f, "%s (%s)", label->hname,
1784f1bd9041SJohn Johansen label_modename(ns, label, flags));
1785f1bd9041SJohn Johansen else
1786278de07eSMarkus Elfring seq_puts(f, label->hname);
1787f1bd9041SJohn Johansen }
1788f1bd9041SJohn Johansen
aa_label_xprintk(struct aa_ns * ns,struct aa_label * label,int flags,gfp_t gfp)1789f1bd9041SJohn Johansen void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1790f1bd9041SJohn Johansen gfp_t gfp)
1791f1bd9041SJohn Johansen {
1792f1bd9041SJohn Johansen AA_BUG(!label);
1793f1bd9041SJohn Johansen
1794f872af75SJohn Johansen if (!use_label_hname(ns, label, flags)) {
1795f1bd9041SJohn Johansen char *str;
1796f1bd9041SJohn Johansen int len;
1797f1bd9041SJohn Johansen
1798f1bd9041SJohn Johansen len = aa_label_asxprint(&str, ns, label, flags, gfp);
17993e2a3a08STom Rix if (len < 0) {
1800f1bd9041SJohn Johansen AA_DEBUG("label print error");
1801f1bd9041SJohn Johansen return;
1802f1bd9041SJohn Johansen }
1803f1bd9041SJohn Johansen pr_info("%s", str);
1804f1bd9041SJohn Johansen kfree(str);
1805f1bd9041SJohn Johansen } else if (display_mode(ns, label, flags))
1806f1bd9041SJohn Johansen pr_info("%s (%s)", label->hname,
1807f1bd9041SJohn Johansen label_modename(ns, label, flags));
1808f1bd9041SJohn Johansen else
1809f1bd9041SJohn Johansen pr_info("%s", label->hname);
1810f1bd9041SJohn Johansen }
1811f1bd9041SJohn Johansen
aa_label_audit(struct audit_buffer * ab,struct aa_label * label,gfp_t gfp)1812f1bd9041SJohn Johansen void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1813f1bd9041SJohn Johansen {
1814f1bd9041SJohn Johansen struct aa_ns *ns = aa_get_current_ns();
1815f1bd9041SJohn Johansen
1816f1bd9041SJohn Johansen aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1817f1bd9041SJohn Johansen aa_put_ns(ns);
1818f1bd9041SJohn Johansen }
1819f1bd9041SJohn Johansen
aa_label_seq_print(struct seq_file * f,struct aa_label * label,gfp_t gfp)1820f1bd9041SJohn Johansen void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1821f1bd9041SJohn Johansen {
1822f1bd9041SJohn Johansen struct aa_ns *ns = aa_get_current_ns();
1823f1bd9041SJohn Johansen
1824f1bd9041SJohn Johansen aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1825f1bd9041SJohn Johansen aa_put_ns(ns);
1826f1bd9041SJohn Johansen }
1827f1bd9041SJohn Johansen
aa_label_printk(struct aa_label * label,gfp_t gfp)1828f1bd9041SJohn Johansen void aa_label_printk(struct aa_label *label, gfp_t gfp)
1829f1bd9041SJohn Johansen {
1830f1bd9041SJohn Johansen struct aa_ns *ns = aa_get_current_ns();
1831f1bd9041SJohn Johansen
1832f1bd9041SJohn Johansen aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1833f1bd9041SJohn Johansen aa_put_ns(ns);
1834f1bd9041SJohn Johansen }
1835f1bd9041SJohn Johansen
label_count_strn_entries(const char * str,size_t n)183695652cacSJohn Johansen static int label_count_strn_entries(const char *str, size_t n)
1837f1bd9041SJohn Johansen {
183895652cacSJohn Johansen const char *end = str + n;
1839f1bd9041SJohn Johansen const char *split;
1840f1bd9041SJohn Johansen int count = 1;
1841f1bd9041SJohn Johansen
1842f1bd9041SJohn Johansen AA_BUG(!str);
1843f1bd9041SJohn Johansen
184495652cacSJohn Johansen for (split = aa_label_strn_split(str, end - str);
18456e0654d2SJohn Johansen split;
184695652cacSJohn Johansen split = aa_label_strn_split(str, end - str)) {
1847f1bd9041SJohn Johansen count++;
1848f1bd9041SJohn Johansen str = split + 3;
1849f1bd9041SJohn Johansen }
1850f1bd9041SJohn Johansen
1851f1bd9041SJohn Johansen return count;
1852f1bd9041SJohn Johansen }
1853f1bd9041SJohn Johansen
1854f1bd9041SJohn Johansen /*
1855f1bd9041SJohn Johansen * ensure stacks with components like
1856f1bd9041SJohn Johansen * :ns:A//&B
1857f1bd9041SJohn Johansen * have :ns: applied to both 'A' and 'B' by making the lookup relative
1858f1bd9041SJohn Johansen * to the base if the lookup specifies an ns, else making the stacked lookup
1859f1bd9041SJohn Johansen * relative to the last embedded ns in the string.
1860f1bd9041SJohn Johansen */
fqlookupn_profile(struct aa_label * base,struct aa_label * currentbase,const char * str,size_t n)1861f1bd9041SJohn Johansen static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1862f1bd9041SJohn Johansen struct aa_label *currentbase,
1863f1bd9041SJohn Johansen const char *str, size_t n)
1864f1bd9041SJohn Johansen {
1865f1bd9041SJohn Johansen const char *first = skipn_spaces(str, n);
1866f1bd9041SJohn Johansen
1867f1bd9041SJohn Johansen if (first && *first == ':')
1868f1bd9041SJohn Johansen return aa_fqlookupn_profile(base, str, n);
1869f1bd9041SJohn Johansen
1870f1bd9041SJohn Johansen return aa_fqlookupn_profile(currentbase, str, n);
1871f1bd9041SJohn Johansen }
1872f1bd9041SJohn Johansen
1873f1bd9041SJohn Johansen /**
187495652cacSJohn Johansen * aa_label_strn_parse - parse, validate and convert a text string to a label
1875f1bd9041SJohn Johansen * @base: base label to use for lookups (NOT NULL)
1876f1bd9041SJohn Johansen * @str: null terminated text string (NOT NULL)
187795652cacSJohn Johansen * @n: length of str to parse, will stop at \0 if encountered before n
1878f1bd9041SJohn Johansen * @gfp: allocation type
1879f1bd9041SJohn Johansen * @create: true if should create compound labels if they don't exist
1880f1bd9041SJohn Johansen * @force_stack: true if should stack even if no leading &
1881f1bd9041SJohn Johansen *
1882f1bd9041SJohn Johansen * Returns: the matching refcounted label if present
1883f1bd9041SJohn Johansen * else ERRPTR
1884f1bd9041SJohn Johansen */
aa_label_strn_parse(struct aa_label * base,const char * str,size_t n,gfp_t gfp,bool create,bool force_stack)188595652cacSJohn Johansen struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
188695652cacSJohn Johansen size_t n, gfp_t gfp, bool create,
188795652cacSJohn Johansen bool force_stack)
1888f1bd9041SJohn Johansen {
1889f1bd9041SJohn Johansen DEFINE_VEC(profile, vec);
1890f1bd9041SJohn Johansen struct aa_label *label, *currbase = base;
1891f1bd9041SJohn Johansen int i, len, stack = 0, error;
189295652cacSJohn Johansen const char *end = str + n;
18936e0654d2SJohn Johansen const char *split;
1894f1bd9041SJohn Johansen
1895f1bd9041SJohn Johansen AA_BUG(!base);
1896f1bd9041SJohn Johansen AA_BUG(!str);
1897f1bd9041SJohn Johansen
189895652cacSJohn Johansen str = skipn_spaces(str, n);
1899511f7b5bSJohn Johansen if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
1900511f7b5bSJohn Johansen base != &root_ns->unconfined->label))
190195652cacSJohn Johansen return ERR_PTR(-EINVAL);
1902475bdda1SJohn Johansen
190395652cacSJohn Johansen len = label_count_strn_entries(str, end - str);
1904f1bd9041SJohn Johansen if (*str == '&' || force_stack) {
1905f1bd9041SJohn Johansen /* stack on top of base */
1906f1bd9041SJohn Johansen stack = base->size;
1907f1bd9041SJohn Johansen len += stack;
1908f1bd9041SJohn Johansen if (*str == '&')
1909f1bd9041SJohn Johansen str++;
1910f1bd9041SJohn Johansen }
191126b78995SJohn Johansen
1912f1bd9041SJohn Johansen error = vec_setup(profile, vec, len, gfp);
1913f1bd9041SJohn Johansen if (error)
1914f1bd9041SJohn Johansen return ERR_PTR(error);
1915f1bd9041SJohn Johansen
1916f1bd9041SJohn Johansen for (i = 0; i < stack; i++)
1917f1bd9041SJohn Johansen vec[i] = aa_get_profile(base->vec[i]);
1918f1bd9041SJohn Johansen
191995652cacSJohn Johansen for (split = aa_label_strn_split(str, end - str), i = stack;
19206e0654d2SJohn Johansen split && i < len; i++) {
1921f1bd9041SJohn Johansen vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1922f1bd9041SJohn Johansen if (!vec[i])
1923f1bd9041SJohn Johansen goto fail;
1924f1bd9041SJohn Johansen /*
1925f1bd9041SJohn Johansen * if component specified a new ns it becomes the new base
1926f1bd9041SJohn Johansen * so that subsequent lookups are relative to it
1927f1bd9041SJohn Johansen */
1928f1bd9041SJohn Johansen if (vec[i]->ns != labels_ns(currbase))
1929f1bd9041SJohn Johansen currbase = &vec[i]->label;
1930f1bd9041SJohn Johansen str = split + 3;
193195652cacSJohn Johansen split = aa_label_strn_split(str, end - str);
1932f1bd9041SJohn Johansen }
1933f1bd9041SJohn Johansen /* last element doesn't have a split */
1934f1bd9041SJohn Johansen if (i < len) {
193595652cacSJohn Johansen vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1936f1bd9041SJohn Johansen if (!vec[i])
1937f1bd9041SJohn Johansen goto fail;
1938f1bd9041SJohn Johansen }
1939f1bd9041SJohn Johansen if (len == 1)
1940f1bd9041SJohn Johansen /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1941f1bd9041SJohn Johansen return &vec[0]->label;
1942f1bd9041SJohn Johansen
1943f1bd9041SJohn Johansen len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1944f1bd9041SJohn Johansen /* TODO: deal with reference labels */
1945f1bd9041SJohn Johansen if (len == 1) {
1946f1bd9041SJohn Johansen label = aa_get_label(&vec[0]->label);
1947f1bd9041SJohn Johansen goto out;
1948f1bd9041SJohn Johansen }
1949f1bd9041SJohn Johansen
1950f1bd9041SJohn Johansen if (create)
1951f1bd9041SJohn Johansen label = aa_vec_find_or_create_label(vec, len, gfp);
1952f1bd9041SJohn Johansen else
1953f1bd9041SJohn Johansen label = vec_find(vec, len);
1954f1bd9041SJohn Johansen if (!label)
1955f1bd9041SJohn Johansen goto fail;
1956f1bd9041SJohn Johansen
1957f1bd9041SJohn Johansen out:
1958f1bd9041SJohn Johansen /* use adjusted len from after vec_unique, not original */
1959f1bd9041SJohn Johansen vec_cleanup(profile, vec, len);
1960f1bd9041SJohn Johansen return label;
1961f1bd9041SJohn Johansen
1962f1bd9041SJohn Johansen fail:
1963f1bd9041SJohn Johansen label = ERR_PTR(-ENOENT);
1964f1bd9041SJohn Johansen goto out;
1965f1bd9041SJohn Johansen }
1966f1bd9041SJohn Johansen
aa_label_parse(struct aa_label * base,const char * str,gfp_t gfp,bool create,bool force_stack)196795652cacSJohn Johansen struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
196895652cacSJohn Johansen gfp_t gfp, bool create, bool force_stack)
196995652cacSJohn Johansen {
197095652cacSJohn Johansen return aa_label_strn_parse(base, str, strlen(str), gfp, create,
197195652cacSJohn Johansen force_stack);
197295652cacSJohn Johansen }
197395652cacSJohn Johansen
1974f1bd9041SJohn Johansen /**
1975f1bd9041SJohn Johansen * aa_labelset_destroy - remove all labels from the label set
1976f1bd9041SJohn Johansen * @ls: label set to cleanup (NOT NULL)
1977f1bd9041SJohn Johansen *
1978f1bd9041SJohn Johansen * Labels that are removed from the set may still exist beyond the set
1979f1bd9041SJohn Johansen * being destroyed depending on their reference counting
1980f1bd9041SJohn Johansen */
aa_labelset_destroy(struct aa_labelset * ls)1981f1bd9041SJohn Johansen void aa_labelset_destroy(struct aa_labelset *ls)
1982f1bd9041SJohn Johansen {
1983f1bd9041SJohn Johansen struct rb_node *node;
1984f1bd9041SJohn Johansen unsigned long flags;
1985f1bd9041SJohn Johansen
1986f1bd9041SJohn Johansen AA_BUG(!ls);
1987f1bd9041SJohn Johansen
1988f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
1989f1bd9041SJohn Johansen for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1990f1bd9041SJohn Johansen struct aa_label *this = rb_entry(node, struct aa_label, node);
1991f1bd9041SJohn Johansen
1992f1bd9041SJohn Johansen if (labels_ns(this) != root_ns)
1993f1bd9041SJohn Johansen __label_remove(this,
1994f1bd9041SJohn Johansen ns_unconfined(labels_ns(this)->parent));
1995f1bd9041SJohn Johansen else
1996f1bd9041SJohn Johansen __label_remove(this, NULL);
1997f1bd9041SJohn Johansen }
1998f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
1999f1bd9041SJohn Johansen }
2000f1bd9041SJohn Johansen
2001f1bd9041SJohn Johansen /*
2002f1bd9041SJohn Johansen * @ls: labelset to init (NOT NULL)
2003f1bd9041SJohn Johansen */
aa_labelset_init(struct aa_labelset * ls)2004f1bd9041SJohn Johansen void aa_labelset_init(struct aa_labelset *ls)
2005f1bd9041SJohn Johansen {
2006f1bd9041SJohn Johansen AA_BUG(!ls);
2007f1bd9041SJohn Johansen
2008f1bd9041SJohn Johansen rwlock_init(&ls->lock);
2009f1bd9041SJohn Johansen ls->root = RB_ROOT;
2010f1bd9041SJohn Johansen }
2011f1bd9041SJohn Johansen
labelset_next_stale(struct aa_labelset * ls)2012f1bd9041SJohn Johansen static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2013f1bd9041SJohn Johansen {
2014f1bd9041SJohn Johansen struct aa_label *label;
2015f1bd9041SJohn Johansen struct rb_node *node;
2016f1bd9041SJohn Johansen unsigned long flags;
2017f1bd9041SJohn Johansen
2018f1bd9041SJohn Johansen AA_BUG(!ls);
2019f1bd9041SJohn Johansen
2020f1bd9041SJohn Johansen read_lock_irqsave(&ls->lock, flags);
2021f1bd9041SJohn Johansen
2022f1bd9041SJohn Johansen __labelset_for_each(ls, node) {
2023f1bd9041SJohn Johansen label = rb_entry(node, struct aa_label, node);
2024f1bd9041SJohn Johansen if ((label_is_stale(label) ||
2025f1bd9041SJohn Johansen vec_is_stale(label->vec, label->size)) &&
2026f1bd9041SJohn Johansen __aa_get_label(label))
2027f1bd9041SJohn Johansen goto out;
2028f1bd9041SJohn Johansen
2029f1bd9041SJohn Johansen }
2030f1bd9041SJohn Johansen label = NULL;
2031f1bd9041SJohn Johansen
2032f1bd9041SJohn Johansen out:
2033f1bd9041SJohn Johansen read_unlock_irqrestore(&ls->lock, flags);
2034f1bd9041SJohn Johansen
2035f1bd9041SJohn Johansen return label;
2036f1bd9041SJohn Johansen }
2037f1bd9041SJohn Johansen
2038f1bd9041SJohn Johansen /**
2039f1bd9041SJohn Johansen * __label_update - insert updated version of @label into labelset
2040b62fb226SZygmunt Krynicki * @label - the label to update/replace
2041f1bd9041SJohn Johansen *
2042f1bd9041SJohn Johansen * Returns: new label that is up to date
2043f1bd9041SJohn Johansen * else NULL on failure
2044f1bd9041SJohn Johansen *
2045f1bd9041SJohn Johansen * Requires: @ns lock be held
2046f1bd9041SJohn Johansen *
2047f1bd9041SJohn Johansen * Note: worst case is the stale @label does not get updated and has
2048f1bd9041SJohn Johansen * to be updated at a later time.
2049f1bd9041SJohn Johansen */
__label_update(struct aa_label * label)2050f1bd9041SJohn Johansen static struct aa_label *__label_update(struct aa_label *label)
2051f1bd9041SJohn Johansen {
2052f1bd9041SJohn Johansen struct aa_label *new, *tmp;
2053f1bd9041SJohn Johansen struct aa_labelset *ls;
2054f1bd9041SJohn Johansen unsigned long flags;
2055f1bd9041SJohn Johansen int i, invcount = 0;
2056f1bd9041SJohn Johansen
2057f1bd9041SJohn Johansen AA_BUG(!label);
2058f1bd9041SJohn Johansen AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2059f1bd9041SJohn Johansen
2060f1bd9041SJohn Johansen new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2061f1bd9041SJohn Johansen if (!new)
2062f1bd9041SJohn Johansen return NULL;
2063f1bd9041SJohn Johansen
2064f1bd9041SJohn Johansen /*
2065f1bd9041SJohn Johansen * while holding the ns_lock will stop profile replacement, removal,
2066f1bd9041SJohn Johansen * and label updates, label merging and removal can be occurring
2067f1bd9041SJohn Johansen */
2068f1bd9041SJohn Johansen ls = labels_set(label);
2069f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
2070f1bd9041SJohn Johansen for (i = 0; i < label->size; i++) {
2071f1bd9041SJohn Johansen AA_BUG(!label->vec[i]);
2072f1bd9041SJohn Johansen new->vec[i] = aa_get_newest_profile(label->vec[i]);
2073f1bd9041SJohn Johansen AA_BUG(!new->vec[i]);
2074f1bd9041SJohn Johansen AA_BUG(!new->vec[i]->label.proxy);
2075f1bd9041SJohn Johansen AA_BUG(!new->vec[i]->label.proxy->label);
2076f1bd9041SJohn Johansen if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2077f1bd9041SJohn Johansen invcount++;
2078f1bd9041SJohn Johansen }
2079f1bd9041SJohn Johansen
2080f1bd9041SJohn Johansen /* updated stale label by being removed/renamed from labelset */
2081f1bd9041SJohn Johansen if (invcount) {
2082f1bd9041SJohn Johansen new->size -= aa_vec_unique(&new->vec[0], new->size,
2083f1bd9041SJohn Johansen VEC_FLAG_TERMINATE);
2084f1bd9041SJohn Johansen /* TODO: deal with reference labels */
2085f1bd9041SJohn Johansen if (new->size == 1) {
2086f1bd9041SJohn Johansen tmp = aa_get_label(&new->vec[0]->label);
2087f1bd9041SJohn Johansen AA_BUG(tmp == label);
2088f1bd9041SJohn Johansen goto remove;
2089f1bd9041SJohn Johansen }
2090f1bd9041SJohn Johansen if (labels_set(label) != labels_set(new)) {
2091f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
2092f1bd9041SJohn Johansen tmp = aa_label_insert(labels_set(new), new);
2093f1bd9041SJohn Johansen write_lock_irqsave(&ls->lock, flags);
2094f1bd9041SJohn Johansen goto remove;
2095f1bd9041SJohn Johansen }
2096f1bd9041SJohn Johansen } else
2097f1bd9041SJohn Johansen AA_BUG(labels_ns(label) != labels_ns(new));
2098f1bd9041SJohn Johansen
2099f1bd9041SJohn Johansen tmp = __label_insert(labels_set(label), new, true);
2100f1bd9041SJohn Johansen remove:
2101f1bd9041SJohn Johansen /* ensure label is removed, and redirected correctly */
2102f1bd9041SJohn Johansen __label_remove(label, tmp);
2103f1bd9041SJohn Johansen write_unlock_irqrestore(&ls->lock, flags);
2104f1bd9041SJohn Johansen label_free_or_put_new(tmp, new);
2105f1bd9041SJohn Johansen
2106f1bd9041SJohn Johansen return tmp;
2107f1bd9041SJohn Johansen }
2108f1bd9041SJohn Johansen
2109f1bd9041SJohn Johansen /**
2110f1bd9041SJohn Johansen * __labelset_update - update labels in @ns
2111f1bd9041SJohn Johansen * @ns: namespace to update labels in (NOT NULL)
2112f1bd9041SJohn Johansen *
2113f1bd9041SJohn Johansen * Requires: @ns lock be held
2114f1bd9041SJohn Johansen *
2115f1bd9041SJohn Johansen * Walk the labelset ensuring that all labels are up to date and valid
2116f1bd9041SJohn Johansen * Any label that has a stale component is marked stale and replaced and
2117f1bd9041SJohn Johansen * by an updated version.
2118f1bd9041SJohn Johansen *
2119f1bd9041SJohn Johansen * If failures happen due to memory pressures then stale labels will
2120f1bd9041SJohn Johansen * be left in place until the next pass.
2121f1bd9041SJohn Johansen */
__labelset_update(struct aa_ns * ns)2122f1bd9041SJohn Johansen static void __labelset_update(struct aa_ns *ns)
2123f1bd9041SJohn Johansen {
2124f1bd9041SJohn Johansen struct aa_label *label;
2125f1bd9041SJohn Johansen
2126f1bd9041SJohn Johansen AA_BUG(!ns);
2127f1bd9041SJohn Johansen AA_BUG(!mutex_is_locked(&ns->lock));
2128f1bd9041SJohn Johansen
2129f1bd9041SJohn Johansen do {
2130f1bd9041SJohn Johansen label = labelset_next_stale(&ns->labels);
2131f1bd9041SJohn Johansen if (label) {
2132f1bd9041SJohn Johansen struct aa_label *l = __label_update(label);
2133f1bd9041SJohn Johansen
2134f1bd9041SJohn Johansen aa_put_label(l);
2135f1bd9041SJohn Johansen aa_put_label(label);
2136f1bd9041SJohn Johansen }
2137f1bd9041SJohn Johansen } while (label);
2138f1bd9041SJohn Johansen }
2139f1bd9041SJohn Johansen
2140f1bd9041SJohn Johansen /**
2141240516dfSYang Li * __aa_labelset_update_subtree - update all labels with a stale component
2142f1bd9041SJohn Johansen * @ns: ns to start update at (NOT NULL)
2143f1bd9041SJohn Johansen *
2144f1bd9041SJohn Johansen * Requires: @ns lock be held
2145f1bd9041SJohn Johansen *
2146f1bd9041SJohn Johansen * Invalidates labels based on @p in @ns and any children namespaces.
2147f1bd9041SJohn Johansen */
__aa_labelset_update_subtree(struct aa_ns * ns)2148f1bd9041SJohn Johansen void __aa_labelset_update_subtree(struct aa_ns *ns)
2149f1bd9041SJohn Johansen {
2150f1bd9041SJohn Johansen struct aa_ns *child;
2151f1bd9041SJohn Johansen
2152f1bd9041SJohn Johansen AA_BUG(!ns);
2153f1bd9041SJohn Johansen AA_BUG(!mutex_is_locked(&ns->lock));
2154f1bd9041SJohn Johansen
2155f1bd9041SJohn Johansen __labelset_update(ns);
2156f1bd9041SJohn Johansen
2157f1bd9041SJohn Johansen list_for_each_entry(child, &ns->sub_ns, base.list) {
2158feb3c766SJohn Johansen mutex_lock_nested(&child->lock, child->level);
2159f1bd9041SJohn Johansen __aa_labelset_update_subtree(child);
2160f1bd9041SJohn Johansen mutex_unlock(&child->lock);
2161f1bd9041SJohn Johansen }
2162f1bd9041SJohn Johansen }
2163