Lines Matching full:profile
50 * may_change_ptraced_domain - check if can change profile on ptraced task
51 * @to_label: profile to change to (NOT NULL)
92 /* match a profile and its associated ns component if needed
94 * If a subns profile is not to be matched should be prescreened with
97 static inline unsigned int match_component(struct aa_profile *profile, in match_component() argument
104 state = aa_dfa_match(profile->file.dfa, state, "&"); in match_component()
105 if (profile->ns == tp->ns) in match_component()
106 return aa_dfa_match(profile->file.dfa, state, tp->base.hname); in match_component()
108 /* try matching with namespace name and then profile */ in match_component()
109 ns_name = aa_ns_name(profile->ns, tp->ns, true); in match_component()
110 state = aa_dfa_match_len(profile->file.dfa, state, ":", 1); in match_component()
111 state = aa_dfa_match(profile->file.dfa, state, ns_name); in match_component()
112 state = aa_dfa_match_len(profile->file.dfa, state, ":", 1); in match_component()
113 return aa_dfa_match(profile->file.dfa, state, tp->base.hname); in match_component()
118 * @profile: profile to find perms for
132 static int label_compound_match(struct aa_profile *profile, in label_compound_match() argument
143 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
145 state = match_component(profile, tp, stack, state); in label_compound_match()
157 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
159 state = aa_dfa_match(profile->file.dfa, state, "//&"); in label_compound_match()
160 state = match_component(profile, tp, false, state); in label_compound_match()
164 *perms = aa_compute_fperms(profile->file.dfa, state, &cond); in label_compound_match()
165 aa_apply_modes_to_perms(profile, perms); in label_compound_match()
178 * @profile: profile to find perms for
192 static int label_components_match(struct aa_profile *profile, in label_components_match() argument
205 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
207 state = match_component(profile, tp, stack, start); in label_components_match()
217 tmp = aa_compute_fperms(profile->file.dfa, state, &cond); in label_components_match()
218 aa_apply_modes_to_perms(profile, &tmp); in label_components_match()
221 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
223 state = match_component(profile, tp, stack, start); in label_components_match()
226 tmp = aa_compute_fperms(profile->file.dfa, state, &cond); in label_components_match()
227 aa_apply_modes_to_perms(profile, &tmp); in label_components_match()
243 * @profile: profile to match against (NOT NULL)
253 static int label_match(struct aa_profile *profile, struct aa_label *label, in label_match() argument
260 error = label_compound_match(profile, label, stack, state, subns, in label_match()
266 return label_components_match(profile, label, stack, state, subns, in label_match()
274 * @profile: the current profile (NOT NULL)
286 static int change_profile_perms(struct aa_profile *profile, in change_profile_perms() argument
291 if (profile_unconfined(profile)) { in change_profile_perms()
297 /* TODO: add profile in ns screening */ in change_profile_perms()
298 return label_match(profile, target, stack, start, true, request, perms); in change_profile_perms()
302 * aa_xattrs_match - check whether a file matches the xattrs defined in profile
304 * @profile: profile to match against (NOT NULL)
310 struct aa_profile *profile, unsigned int state) in aa_xattrs_match() argument
316 int value_size = 0, ret = profile->xattr_count; in aa_xattrs_match()
318 if (!bprm || !profile->xattr_count) in aa_xattrs_match()
323 state = aa_dfa_outofband_transition(profile->xmatch, state); in aa_xattrs_match()
326 for (i = 0; i < profile->xattr_count; i++) { in aa_xattrs_match()
327 size = vfs_getxattr_alloc(d, profile->xattrs[i], &value, in aa_xattrs_match()
337 state = aa_dfa_null_transition(profile->xmatch, state); in aa_xattrs_match()
339 state = aa_dfa_match_len(profile->xmatch, state, value, in aa_xattrs_match()
341 perm = dfa_user_allow(profile->xmatch, state); in aa_xattrs_match()
348 state = aa_dfa_outofband_transition(profile->xmatch, state); in aa_xattrs_match()
373 * @head - profile list to walk (NOT NULL)
392 struct aa_profile *profile, *candidate = NULL; in find_attach() local
399 list_for_each_entry_rcu(profile, head, base.list) { in find_attach()
400 if (profile->label.flags & FLAG_NULL && in find_attach()
401 &profile->label == ns_unconfined(profile->ns)) in find_attach()
404 /* Find the "best" matching profile. Profiles must in find_attach()
412 * as another profile, signal a conflict and refuse to in find_attach()
415 if (profile->xmatch) { in find_attach()
419 state = aa_dfa_leftmatch(profile->xmatch, DFA_START, in find_attach()
421 perm = dfa_user_allow(profile->xmatch, state); in find_attach()
429 if (bprm && profile->xattr_count) { in find_attach()
432 if (!aa_get_profile_not0(profile)) in find_attach()
435 ret = aa_xattrs_match(bprm, profile, in find_attach()
438 aa_put_profile(profile); in find_attach()
467 candidate = profile; in find_attach()
468 candidate_len = max(count, profile->xmatch_len); in find_attach()
472 } else if (!strcmp(profile->base.name, name)) { in find_attach()
477 candidate = profile; in find_attach()
484 *info = "conflicting profile attachments"; in find_attach()
503 * @profile: current profile (NOT NULL)
509 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex, in x_table_lookup() argument
522 for (*name = profile->file.trans.table[index]; !label && *name; in x_table_lookup()
527 new_profile = aa_find_child(profile, *name); in x_table_lookup()
532 label = aa_label_parse(&profile->label, *name, GFP_KERNEL, in x_table_lookup()
545 * @profile: current profile (NOT NULL)
555 static struct aa_label *x_to_label(struct aa_profile *profile, in x_to_label() argument
562 struct aa_ns *ns = profile->ns; in x_to_label()
573 stack = profile->file.trans.table[xindex & AA_X_INDEX_MASK]; in x_to_label()
576 new = x_table_lookup(profile, xindex, lookupname); in x_to_label()
584 new = find_attach(bprm, ns, &profile->base.profiles, in x_to_label()
596 /* (p|c|n)ix - don't change profile but do in x_to_label()
600 /* no profile && no error */ in x_to_label()
601 new = aa_get_newest_label(&profile->label); in x_to_label()
603 new = aa_get_newest_label(ns_unconfined(profile->ns)); in x_to_label()
622 static struct aa_label *profile_transition(struct aa_profile *profile, in profile_transition() argument
629 unsigned int state = profile->file.start; in profile_transition()
634 AA_BUG(!profile); in profile_transition()
638 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, in profile_transition()
639 &name, &info, profile->disconnected); in profile_transition()
641 if (profile_unconfined(profile) || in profile_transition()
642 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_transition()
645 new = aa_get_newest_label(&profile->label); in profile_transition()
651 if (profile_unconfined(profile)) { in profile_transition()
652 new = find_attach(bprm, profile->ns, in profile_transition()
653 &profile->ns->base.profiles, name, &info); in profile_transition()
659 return aa_get_newest_label(&profile->label); in profile_transition()
663 state = aa_str_perms(profile->file.dfa, state, name, cond, &perms); in profile_transition()
666 new = x_to_label(profile, bprm, name, perms.xindex, &target, in profile_transition()
668 if (new && new->proxy == profile->label.proxy && info) { in profile_transition()
673 info = "profile transition not found"; in profile_transition()
677 } else if (COMPLAIN_MODE(profile)) { in profile_transition()
681 new_profile = aa_new_null_profile(profile, false, name, in profile_transition()
685 info = "could not create null profile"; in profile_transition()
702 " for %s profile=", name); in profile_transition()
710 aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name, target, new, in profile_transition()
720 static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec, in profile_onexec() argument
725 unsigned int state = profile->file.start; in profile_onexec()
730 AA_BUG(!profile); in profile_onexec()
735 if (profile_unconfined(profile)) { in profile_onexec()
745 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer, in profile_onexec()
746 &xname, &info, profile->disconnected); in profile_onexec()
748 if (profile_unconfined(profile) || in profile_onexec()
749 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_onexec()
758 state = aa_str_perms(profile->file.dfa, state, xname, cond, &perms); in profile_onexec()
767 state = aa_dfa_null_transition(profile->file.dfa, state); in profile_onexec()
768 error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC, in profile_onexec()
786 return aa_audit_file(profile, &perms, OP_EXEC, AA_MAY_ONEXEC, xname, in profile_onexec()
798 struct aa_profile *profile; in handle_onexec() local
808 error = fn_for_each_in_ns(label, profile, in handle_onexec()
809 profile_onexec(profile, onexec, stack, in handle_onexec()
813 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
815 profile_transition(profile, bprm, buffer, in handle_onexec()
820 error = fn_for_each_in_ns(label, profile, in handle_onexec()
821 profile_onexec(profile, onexec, stack, bprm, in handle_onexec()
825 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
826 aa_label_merge(&profile->label, onexec, in handle_onexec()
828 profile_transition(profile, bprm, buffer, in handle_onexec()
836 error = fn_for_each_in_ns(label, profile, in handle_onexec()
837 aa_audit_file(profile, &nullperms, OP_CHANGE_ONEXEC, in handle_onexec()
856 struct aa_profile *profile; in apparmor_bprm_creds_for_exec() local
895 new = fn_label_build(label, profile, GFP_KERNEL, in apparmor_bprm_creds_for_exec()
896 profile_transition(profile, bprm, buffer, in apparmor_bprm_creds_for_exec()
930 /* TODO: test needs to be profile of label to new */ in apparmor_bprm_creds_for_exec()
967 error = fn_for_each(label, profile, in apparmor_bprm_creds_for_exec()
968 aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC, in apparmor_bprm_creds_for_exec()
977 * Functions for self directed profile change
985 static struct aa_label *build_change_hat(struct aa_profile *profile, in build_change_hat() argument
992 if (sibling && PROFILE_IS_HAT(profile)) { in build_change_hat()
993 root = aa_get_profile_rcu(&profile->parent); in build_change_hat()
994 } else if (!sibling && !PROFILE_IS_HAT(profile)) { in build_change_hat()
995 root = aa_get_profile(profile); in build_change_hat()
1005 if (COMPLAIN_MODE(profile)) { in build_change_hat()
1006 hat = aa_new_null_profile(profile, true, name, in build_change_hat()
1009 info = "failed null profile create"; in build_change_hat()
1017 aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, AA_MAY_CHANGEHAT, in build_change_hat()
1036 struct aa_profile *profile, *root, *hat = NULL; in change_hat() local
1053 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1054 if (sibling && PROFILE_IS_HAT(profile)) { in change_hat()
1055 root = aa_get_profile_rcu(&profile->parent); in change_hat()
1056 } else if (!sibling && !PROFILE_IS_HAT(profile)) { in change_hat()
1057 root = aa_get_profile(profile); in change_hat()
1066 if (!COMPLAIN_MODE(profile)) in change_hat()
1089 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1090 if (!list_empty(&profile->base.profiles)) { in change_hat()
1100 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1108 if (count > 1 || COMPLAIN_MODE(profile)) { in change_hat()
1109 aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, in change_hat()
1117 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in change_hat()
1118 build_change_hat(profile, name, sibling), in change_hat()
1119 aa_get_label(&profile->label)); in change_hat()
1138 * Change to the first profile specified in @hats that exists, and store
1141 * top level profile.
1143 * change_hat only applies to profiles in the current ns, and each profile
1151 struct aa_profile *profile; in aa_change_hat() local
1234 } /* else ignore @flags && restores when there is no saved profile */ in aa_change_hat()
1249 fn_for_each_in_ns(label, profile, in aa_change_hat()
1250 aa_audit_file(profile, &perms, OP_CHANGE_HAT, in aa_change_hat()
1259 struct aa_profile *profile, in change_profile_perms_wrapper() argument
1267 error = change_profile_perms(profile, target, stack, request, in change_profile_perms_wrapper()
1268 profile->file.start, perms); in change_profile_perms_wrapper()
1270 error = aa_audit_file(profile, perms, op, request, name, in change_profile_perms_wrapper()
1278 * aa_change_profile - perform a one-way profile transition
1279 * @fqname: name of profile may include namespace (NOT NULL)
1283 * Change to new profile @name. Unlike with hats, there is no way
1284 * to change back. If @name isn't specified the current profile name is
1294 struct aa_profile *profile; in aa_change_profile() local
1318 AA_DEBUG("no profile name"); in aa_change_profile()
1349 * TODO: fixme using labels_profile is not right - do profile in aa_change_profile()
1350 * per complain profile in aa_change_profile()
1359 info = "failed null profile create"; in aa_change_profile()
1375 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1377 profile, target, stack, in aa_change_profile()
1388 if (error && !fn_for_each_in_ns(label, profile, in aa_change_profile()
1389 COMPLAIN_MODE(profile))) in aa_change_profile()
1404 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in aa_change_profile()
1406 aa_get_label(&profile->label)); in aa_change_profile()
1446 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1447 aa_audit_file(profile, &perms, op, request, auditname, in aa_change_profile()