Lines Matching full:label
4 * This file contains AppArmor label definitions
20 #include "include/label.h"
31 * code - will take a ref count on a label if it needs the label
33 * profiles - each profile is a label
34 * secids - a pinned secid will keep a refcount of the label it is
38 * Labels are not ref counted by the label set, so they maybe removed and
49 /* p->label will not updated any more as p is dead */ in free_proxy()
50 aa_put_label(rcu_dereference_protected(proxy->label, true)); in free_proxy()
52 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); in free_proxy()
64 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp) in aa_alloc_proxy() argument
71 rcu_assign_pointer(new->label, aa_get_label(label)); in aa_alloc_proxy()
85 tmp = rcu_dereference_protected(orig->proxy->label, in __aa_proxy_redirect()
87 rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); in __aa_proxy_redirect()
103 * ns_cmp - compare ns for label set ordering
160 * vec_cmp - label comparison for set ordering
161 * @a: label to compare (NOT NULL)
316 static void label_destroy(struct aa_label *label) in label_destroy() argument
320 AA_BUG(!label); in label_destroy()
322 if (!label_isprofile(label)) { in label_destroy()
326 aa_put_str(label->hname); in label_destroy()
328 label_for_each(i, label, profile) { in label_destroy()
330 label->vec[i.i] = (struct aa_profile *) in label_destroy()
335 if (rcu_dereference_protected(label->proxy->label, true) == label) in label_destroy()
336 rcu_assign_pointer(label->proxy->label, NULL); in label_destroy()
338 aa_free_secid(label->secid); in label_destroy()
340 tmp = rcu_dereference_protected(label->proxy->label, true); in label_destroy()
341 if (tmp == label) in label_destroy()
342 rcu_assign_pointer(label->proxy->label, NULL); in label_destroy()
344 aa_put_proxy(label->proxy); in label_destroy()
345 label->proxy = (struct aa_proxy *) PROXY_POISON + 1; in label_destroy()
348 void aa_label_free(struct aa_label *label) in aa_label_free() argument
350 if (!label) in aa_label_free()
353 label_destroy(label); in aa_label_free()
354 kfree(label); in aa_label_free()
357 static void label_free_switch(struct aa_label *label) in label_free_switch() argument
359 if (label->flags & FLAG_NS_COUNT) in label_free_switch()
360 aa_free_ns(labels_ns(label)); in label_free_switch()
361 else if (label_isprofile(label)) in label_free_switch()
362 aa_free_profile(labels_profile(label)); in label_free_switch()
364 aa_label_free(label); in label_free_switch()
369 struct aa_label *label = container_of(head, struct aa_label, rcu); in label_free_rcu() local
371 if (label->flags & FLAG_IN_TREE) in label_free_rcu()
372 (void) aa_label_remove(label); in label_free_rcu()
373 label_free_switch(label); in label_free_rcu()
378 struct aa_label *label = container_of(kref, struct aa_label, count); in aa_label_kref() local
379 struct aa_ns *ns = labels_ns(label); in aa_label_kref()
383 label_free_switch(label); in aa_label_kref()
387 AA_BUG(label_isprofile(label) && in aa_label_kref()
388 on_list_rcu(&label->vec[0]->base.profiles)); in aa_label_kref()
389 AA_BUG(label_isprofile(label) && in aa_label_kref()
390 on_list_rcu(&label->vec[0]->base.list)); in aa_label_kref()
392 /* TODO: if compound label and not stale add to reclaim cache */ in aa_label_kref()
393 call_rcu(&label->rcu, label_free_rcu); in aa_label_kref()
396 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new) in label_free_or_put_new() argument
398 if (label != new) in label_free_or_put_new()
405 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp) in aa_label_init() argument
407 AA_BUG(!label); in aa_label_init()
410 if (aa_alloc_secid(label, gfp) < 0) in aa_label_init()
413 label->size = size; /* doesn't include null */ in aa_label_init()
414 label->vec[size] = NULL; /* null terminate */ in aa_label_init()
415 kref_init(&label->count); in aa_label_init()
416 RB_CLEAR_NODE(&label->node); in aa_label_init()
422 * aa_label_alloc - allocate a label with a profile vector of @size length
423 * @size: size of profile vector in the label
427 * Returns: new label
465 * label_cmp - label comparison for set ordering
466 * @a: label to compare (NOT NULL)
467 * @b: label to compare (NOT NULL)
484 int aa_label_next_confined(struct aa_label *label, int i) in aa_label_next_confined() argument
486 AA_BUG(!label); in aa_label_next_confined()
489 for (; i < label->size; i++) { in aa_label_next_confined()
490 if (!profile_unconfined(label->vec[i])) in aa_label_next_confined()
499 * @I: label iterator
500 * @set: label to test against
501 * @sub: label to if is subset of @set
538 * @set: label to test against
539 * @sub: label to test if is subset of @set
559 * @set: label to test against
560 * @sub: label to test if is subset of @set
593 * __label_remove - remove @label from the label set
594 * @l: label to remove
595 * @new: label to redirect to
597 * Requires: labels_set(@label)->lock write_lock
598 * Returns: true if the label was in the tree and removed
600 static bool __label_remove(struct aa_label *label, struct aa_label *new) in __label_remove() argument
602 struct aa_labelset *ls = labels_set(label); in __label_remove()
605 AA_BUG(!label); in __label_remove()
609 __aa_proxy_redirect(label, new); in __label_remove()
611 if (!label_is_stale(label)) in __label_remove()
612 __label_make_stale(label); in __label_remove()
614 if (label->flags & FLAG_IN_TREE) { in __label_remove()
615 rb_erase(&label->node, &ls->root); in __label_remove()
616 label->flags &= ~FLAG_IN_TREE; in __label_remove()
624 * __label_replace - replace @old with @new in label set
625 * @old: label to remove from label set
626 * @new: label to replace @old with
632 * Note: current implementation requires label set be order in such a way
634 * using pointer comparison of the label address would not work)
660 * __label_insert - attempt to insert @l into a label set
662 * @label: new label to insert (NOT NULL)
669 * else ref counted equivalent label that is already in the set,
673 struct aa_label *label, bool replace) in __label_insert() argument
678 AA_BUG(!label); in __label_insert()
679 AA_BUG(labels_set(label) != ls); in __label_insert()
681 AA_BUG(label->flags & FLAG_IN_TREE); in __label_insert()
687 int result = label_cmp(label, this); in __label_insert()
692 * so replace in place, however the label has in __label_insert()
700 __proxy_share(this, label); in __label_insert()
701 AA_BUG(!__label_replace(this, label)); in __label_insert()
702 return aa_get_label(label); in __label_insert()
710 rb_link_node(&label->node, parent, new); in __label_insert()
711 rb_insert_color(&label->node, &ls->root); in __label_insert()
712 label->flags |= FLAG_IN_TREE; in __label_insert()
714 return aa_get_label(label); in __label_insert()
718 * __vec_find - find label that matches @vec in label set
719 * @vec: vec of profiles to find matching label for (NOT NULL)
725 * Returns: ref counted @label if matching label is in tree
726 * ref counted label that is equiv to @l in tree
754 * __label_find - find label @label in label set
755 * @label: label to find (NOT NULL)
757 * Requires: labels_set(@label)->lock held
760 * Returns: ref counted @label if @label is in tree OR
761 * ref counted label that is equiv to @label in tree
762 * else NULL if @label or equiv is not in tree
764 static struct aa_label *__label_find(struct aa_label *label) in __label_find() argument
766 AA_BUG(!label); in __label_find()
768 return __vec_find(label->vec, label->size); in __label_find()
773 * aa_label_remove - remove a label from the labelset
774 * @label: label to remove
776 * Returns: true if @label was removed from the tree
777 * else @label was not in tree so it could not be removed
779 bool aa_label_remove(struct aa_label *label) in aa_label_remove() argument
781 struct aa_labelset *ls = labels_set(label); in aa_label_remove()
788 res = __label_remove(label, ns_unconfined(labels_ns(label))); in aa_label_remove()
795 * aa_label_replace - replace a label @old with a new version @new
796 * @old: label to replace
797 * @new: label replacing @old
836 * vec_find - find label @l in label set
837 * @vec: array of profiles to find equiv label for (NOT NULL)
840 * Returns: refcounted label if @vec equiv is in tree
846 struct aa_label *label; in vec_find() local
855 label = __vec_find(vec, n); in vec_find()
858 return label; in vec_find()
865 struct aa_label *label = NULL; in vec_create_and_insert_label() local
874 return aa_get_label(&vec[0]->label); in vec_create_and_insert_label()
876 ls = labels_set(&vec[len - 1]->label); in vec_create_and_insert_label()
879 * check if label exists before taking locks in vec_create_and_insert_label()
889 label = __label_insert(ls, new, false); in vec_create_and_insert_label()
891 label_free_or_put_new(label, new); in vec_create_and_insert_label()
893 return label; in vec_create_and_insert_label()
899 struct aa_label *label = vec_find(vec, len); in aa_vec_find_or_create_label() local
901 if (label) in aa_vec_find_or_create_label()
902 return label; in aa_vec_find_or_create_label()
908 * aa_label_find - find label @label in label set
909 * @label: label to find (NOT NULL)
913 * Returns: refcounted @label if @label is in tree
914 * refcounted label that is equiv to @label in tree
915 * else NULL if @label or equiv is not in tree
917 struct aa_label *aa_label_find(struct aa_label *label) in aa_label_find() argument
919 AA_BUG(!label); in aa_label_find()
921 return vec_find(label->vec, label->size); in aa_label_find()
926 * aa_label_insert - insert label @label into @ls or return existing label
927 * @ls - labelset to insert @label into
928 * @label - label to insert
930 * Requires: caller to hold a valid ref on @label
932 * Returns: ref counted @label if successful in inserting @label
933 * else ref counted equivalent label that is already in the set
935 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label) in aa_label_insert() argument
941 AA_BUG(!label); in aa_label_insert()
943 /* check if label exists before taking lock */ in aa_label_insert()
944 if (!label_is_stale(label)) { in aa_label_insert()
946 l = __label_find(label); in aa_label_insert()
953 l = __label_insert(ls, label, false); in aa_label_insert()
962 * @I: label iterator
963 * @a: label to merge
964 * @b: label to merge
1002 * @a: label to merge then compare (NOT NULL)
1003 * @b: label to merge then compare (NOT NULL)
1004 * @z: label to compare merge against (NOT NULL)
1040 * label_merge_insert - create a new label by merging @a and @b
1041 * @new: preallocated label to merge into (NOT NULL)
1042 * @a: label to merge with @b (NOT NULL)
1043 * @b: label to merge with @a (NOT NULL)
1047 * Returns: ref counted label either @new if merge is unique
1060 struct aa_label *label; in label_merge_insert() local
1079 AA_BUG(!new->vec[k]->label.proxy); in label_merge_insert()
1080 AA_BUG(!new->vec[k]->label.proxy->label); in label_merge_insert()
1081 if (next->label.proxy != new->vec[k]->label.proxy) in label_merge_insert()
1097 label = aa_get_label(&new->vec[0]->label); in label_merge_insert()
1098 return label; in label_merge_insert()
1114 label = __label_insert(labels_set(new), new, false); in label_merge_insert()
1117 return label; in label_merge_insert()
1121 * labelset_of_merge - find which labelset a merged label should be inserted
1122 * @a: label to merge and insert
1123 * @b: label to merge and insert
1125 * Returns: labelset that the merged label should be inserted into
1139 * __label_find_merge - find label that is equiv to merge of @a and @b
1141 * @a: label to merge with @b (NOT NULL)
1142 * @b: label to merge with @a (NOT NULL)
1146 * Returns: ref counted label that is equiv to merge of @a and @b
1181 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1182 * @a: label to merge with @b (NOT NULL)
1183 * @b: label to merge with @a (NOT NULL)
1187 * Returns: ref counted label that is equiv to merge of @a and @b
1193 struct aa_label *label, *ar = NULL, *br = NULL; in aa_label_find_merge() local
1205 label = __label_find_merge(ls, a, b); in aa_label_find_merge()
1210 return label; in aa_label_find_merge()
1214 * aa_label_merge - attempt to insert new merged label of @a and @b
1215 * @ls: set of labels to insert label into (NOT NULL)
1216 * @a: label to merge with @b (NOT NULL)
1217 * @b: label to merge with @a (NOT NULL)
1223 * Returns: ref counted new label if successful in inserting merge of a & b
1224 * else ref counted equivalent label that is already in the set.
1225 * else NULL if could not create label (-ENOMEM)
1230 struct aa_label *label = NULL; in aa_label_merge() local
1239 * check if label exists before taking locks in aa_label_merge()
1241 label = aa_label_find_merge(a, b); in aa_label_merge()
1244 if (!label) { in aa_label_merge()
1257 label = label_merge_insert(new, a, b); in aa_label_merge()
1258 label_free_or_put_new(label, new); in aa_label_merge()
1264 return label; in aa_label_merge()
1268 struct aa_label *label) in label_is_visible() argument
1270 return aa_ns_visible(profile->ns, labels_ns(label), true); in label_is_visible()
1296 * label_compound_match - find perms for full compound label
1298 * @label: label to check access permissions for
1306 * For the label A//&B//&C this does the perm match for A//&B//&C
1311 struct aa_label *label, in label_compound_match() argument
1319 label_for_each(i, label, tp) { in label_compound_match()
1333 label_for_each_cont(i, label, tp) { in label_compound_match()
1354 * label_components_match - find perms for all subcomponents of a label
1356 * @label: label to check access permissions for
1364 * For the label A//&B//&C this does the perm match for each of A and B and C
1369 struct aa_label *label, unsigned int start, in label_components_match() argument
1379 label_for_each(i, label, tp) { in label_components_match()
1395 label_for_each_cont(i, label, tp) { in label_components_match()
1417 * aa_label_match - do a multi-component label match
1419 * @label: label to match (NOT NULL)
1427 int aa_label_match(struct aa_profile *profile, struct aa_label *label, in aa_label_match() argument
1431 int error = label_compound_match(profile, label, state, subns, request, in aa_label_match()
1437 return label_components_match(profile, label, state, subns, request, in aa_label_match()
1443 * aa_update_label_name - update a label to have a stored name
1445 * @label: label to update (NOT NULL)
1448 * Requires: labels_set(label) not locked in caller
1450 * note: only updates the label name if it does not have a name already
1453 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp) in aa_update_label_name() argument
1461 AA_BUG(!label); in aa_update_label_name()
1463 if (label->hname || labels_ns(label) != ns) in aa_update_label_name()
1466 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1) in aa_update_label_name()
1469 ls = labels_set(label); in aa_update_label_name()
1471 if (!label->hname && label->flags & FLAG_IN_TREE) { in aa_update_label_name()
1472 label->hname = name; in aa_update_label_name()
1482 * cached label name is present and visible
1483 * @label->hname only exists if label is namespace hierachical
1485 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, in use_label_hname() argument
1488 if (label->hname && (!ns || labels_ns(label) == ns) && in use_label_hname()
1562 static const char *label_modename(struct aa_ns *ns, struct aa_label *label, in label_modename() argument
1569 label_for_each(i, label, profile) { in label_modename()
1594 /* if any visible label is not unconfined the display_mode returns true */
1595 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label, in display_mode() argument
1602 label_for_each(i, label, profile) { in display_mode()
1616 * aa_label_snxprint - print a label name to a string buffer
1620 * @label: label to view (NOT NULL)
1629 * label is not visible it will just be excluded. And if none
1630 * of the label is visible "---" will be used.
1633 struct aa_label *label, int flags) in aa_label_snxprint() argument
1642 AA_BUG(!label); in aa_label_snxprint()
1649 ns = labels_ns(label); in aa_label_snxprint()
1652 label_for_each(i, label, profile) { in aa_label_snxprint()
1675 if (display_mode(ns, label, flags)) { in aa_label_snxprint()
1677 label_modename(ns, label, flags)); in aa_label_snxprint()
1686 * aa_label_asxprint - allocate a string buffer and print label into it
1687 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1689 * @label: label to view (NOT NULL)
1690 * @flags: flags controlling what label info is printed
1696 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, in aa_label_asxprint() argument
1702 AA_BUG(!label); in aa_label_asxprint()
1704 size = aa_label_snxprint(NULL, 0, ns, label, flags); in aa_label_asxprint()
1711 return aa_label_snxprint(*strp, size + 1, ns, label, flags); in aa_label_asxprint()
1715 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1718 * @label: label to view (NOT NULL)
1719 * @flags: flags controlling what label info is printed
1726 struct aa_label *label, int flags, gfp_t gfp) in aa_label_acntsxprint() argument
1731 AA_BUG(!label); in aa_label_acntsxprint()
1733 size = aa_label_snxprint(NULL, 0, ns, label, flags); in aa_label_acntsxprint()
1740 return aa_label_snxprint(*strp, size + 1, ns, label, flags); in aa_label_acntsxprint()
1745 struct aa_label *label, int flags, gfp_t gfp) in aa_label_xaudit() argument
1752 AA_BUG(!label); in aa_label_xaudit()
1754 if (!use_label_hname(ns, label, flags) || in aa_label_xaudit()
1755 display_mode(ns, label, flags)) { in aa_label_xaudit()
1756 len = aa_label_asxprint(&name, ns, label, flags, gfp); in aa_label_xaudit()
1758 AA_DEBUG("label print error"); in aa_label_xaudit()
1763 str = (char *) label->hname; in aa_label_xaudit()
1775 struct aa_label *label, int flags, gfp_t gfp) in aa_label_seq_xprint() argument
1778 AA_BUG(!label); in aa_label_seq_xprint()
1780 if (!use_label_hname(ns, label, flags)) { in aa_label_seq_xprint()
1784 len = aa_label_asxprint(&str, ns, label, flags, gfp); in aa_label_seq_xprint()
1786 AA_DEBUG("label print error"); in aa_label_seq_xprint()
1791 } else if (display_mode(ns, label, flags)) in aa_label_seq_xprint()
1792 seq_printf(f, "%s (%s)", label->hname, in aa_label_seq_xprint()
1793 label_modename(ns, label, flags)); in aa_label_seq_xprint()
1795 seq_printf(f, "%s", label->hname); in aa_label_seq_xprint()
1798 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, in aa_label_xprintk() argument
1801 AA_BUG(!label); in aa_label_xprintk()
1803 if (!use_label_hname(ns, label, flags)) { in aa_label_xprintk()
1807 len = aa_label_asxprint(&str, ns, label, flags, gfp); in aa_label_xprintk()
1809 AA_DEBUG("label print error"); in aa_label_xprintk()
1814 } else if (display_mode(ns, label, flags)) in aa_label_xprintk()
1815 pr_info("%s (%s)", label->hname, in aa_label_xprintk()
1816 label_modename(ns, label, flags)); in aa_label_xprintk()
1818 pr_info("%s", label->hname); in aa_label_xprintk()
1821 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp) in aa_label_audit() argument
1825 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp); in aa_label_audit()
1829 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp) in aa_label_seq_print() argument
1833 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp); in aa_label_seq_print()
1837 void aa_label_printk(struct aa_label *label, gfp_t gfp) in aa_label_printk() argument
1841 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp); in aa_label_printk()
1883 * aa_label_strn_parse - parse, validate and convert a text string to a label
1884 * @base: base label to use for lookups (NOT NULL)
1891 * Returns: the matching refcounted label if present
1899 struct aa_label *label, *currbase = base; in aa_label_strn_parse() local
1908 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label)) in aa_label_strn_parse()
1937 currbase = &vec[i]->label; in aa_label_strn_parse()
1949 return &vec[0]->label; in aa_label_strn_parse()
1954 label = aa_get_label(&vec[0]->label); in aa_label_strn_parse()
1959 label = aa_vec_find_or_create_label(vec, len, gfp); in aa_label_strn_parse()
1961 label = vec_find(vec, len); in aa_label_strn_parse()
1962 if (!label) in aa_label_strn_parse()
1968 return label; in aa_label_strn_parse()
1971 label = ERR_PTR(-ENOENT); in aa_label_strn_parse()
1983 * aa_labelset_destroy - remove all labels from the label set
1984 * @ls: label set to cleanup (NOT NULL)
2022 struct aa_label *label; in labelset_next_stale() local
2031 label = rb_entry(node, struct aa_label, node); in labelset_next_stale()
2032 if ((label_is_stale(label) || in labelset_next_stale()
2033 vec_is_stale(label->vec, label->size)) && in labelset_next_stale()
2034 __aa_get_label(label)) in labelset_next_stale()
2038 label = NULL; in labelset_next_stale()
2043 return label; in labelset_next_stale()
2047 * __label_update - insert updated version of @label into labelset
2048 * @label - the label to update/replace
2050 * Returns: new label that is up to date
2055 * Note: worst case is the stale @label does not get updated and has
2058 static struct aa_label *__label_update(struct aa_label *label) in __label_update() argument
2065 AA_BUG(!label); in __label_update()
2066 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock)); in __label_update()
2068 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); in __label_update()
2074 * and label updates, label merging and removal can be occurring in __label_update()
2076 ls = labels_set(label); in __label_update()
2078 for (i = 0; i < label->size; i++) { in __label_update()
2079 AA_BUG(!label->vec[i]); in __label_update()
2080 new->vec[i] = aa_get_newest_profile(label->vec[i]); in __label_update()
2082 AA_BUG(!new->vec[i]->label.proxy); in __label_update()
2083 AA_BUG(!new->vec[i]->label.proxy->label); in __label_update()
2084 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) in __label_update()
2088 /* updated stale label by being removed/renamed from labelset */ in __label_update()
2094 tmp = aa_get_label(&new->vec[0]->label); in __label_update()
2095 AA_BUG(tmp == label); in __label_update()
2098 if (labels_set(label) != labels_set(new)) { in __label_update()
2105 AA_BUG(labels_ns(label) != labels_ns(new)); in __label_update()
2107 tmp = __label_insert(labels_set(label), new, true); in __label_update()
2109 /* ensure label is removed, and redirected correctly */ in __label_update()
2110 __label_remove(label, tmp); in __label_update()
2124 * Any label that has a stale component is marked stale and replaced and
2132 struct aa_label *label; in __labelset_update() local
2138 label = labelset_next_stale(&ns->labels); in __labelset_update()
2139 if (label) { in __labelset_update()
2140 struct aa_label *l = __label_update(label); in __labelset_update()
2143 aa_put_label(label); in __labelset_update()
2145 } while (label); in __labelset_update()