Lines Matching refs:label
5 * This file contains AppArmor label definitions
16 #include "include/label.h"
27 * code - will take a ref count on a label if it needs the label
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
34 * Labels are not ref counted by the label set, so they maybe removed and
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
61 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
69 rcu_assign_pointer(new->label, aa_get_label(label));
83 tmp = rcu_dereference_protected(orig->proxy->label,
85 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
101 * ns_cmp - compare ns for label set ordering
158 * vec_cmp - label comparison for set ordering
215 u |= new->vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
217 if (!(u & new->vec[i]->label.flags & FLAG_UNCONFINED))
219 new->mediates |= new->vec[i]->label.mediates;
323 void aa_label_destroy(struct aa_label *label)
325 AA_BUG(!label);
327 if (!label_isprofile(label)) {
331 aa_put_str(label->hname);
333 label_for_each(i, label, profile) {
335 label->vec[i.i] = (struct aa_profile *)
340 if (label->proxy) {
341 if (rcu_dereference_protected(label->proxy->label, true) == label)
342 rcu_assign_pointer(label->proxy->label, NULL);
343 aa_put_proxy(label->proxy);
345 aa_free_secid(label->secid);
347 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
350 void aa_label_free(struct aa_label *label)
352 if (!label)
355 aa_label_destroy(label);
356 kfree(label);
359 static void label_free_switch(struct aa_label *label)
361 if (label->flags & FLAG_NS_COUNT)
362 aa_free_ns(labels_ns(label));
363 else if (label_isprofile(label))
364 aa_free_profile(labels_profile(label));
366 aa_label_free(label);
371 struct aa_label *label = container_of(head, struct aa_label, rcu);
373 if (label->flags & FLAG_IN_TREE)
374 (void) aa_label_remove(label);
375 label_free_switch(label);
380 struct aa_label *label = container_of(kref, struct aa_label,
382 struct aa_ns *ns = labels_ns(label);
386 label_free_switch(label);
390 AA_BUG(label_isprofile(label) &&
391 on_list_rcu(&label->vec[0]->base.profiles));
392 AA_BUG(label_isprofile(label) &&
393 on_list_rcu(&label->vec[0]->base.list));
395 /* TODO: if compound label and not stale add to reclaim cache */
396 call_rcu(&label->rcu, label_free_rcu);
399 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
401 if (label != new)
408 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
410 AA_BUG(!label);
413 if (aa_alloc_secid(label, gfp) < 0)
416 label->size = size; /* doesn't include null */
417 label->vec[size] = NULL; /* null terminate */
418 kref_init(&label->count.count);
419 label->count.reftype = REF_NS; /* for aafs purposes */
420 RB_CLEAR_NODE(&label->node);
426 * aa_label_alloc - allocate a label with a profile vector of @size length
427 * @size: size of profile vector in the label
431 * Returns: new label
468 * label_cmp - label comparison for set ordering
469 * @a: label to compare (NOT NULL)
470 * @b: label to compare (NOT NULL)
487 int aa_label_next_confined(struct aa_label *label, int i)
489 AA_BUG(!label);
492 for (; i < label->size; i++) {
493 if (!profile_unconfined(label->vec[i]))
502 * @I: label iterator
503 * @set: label to test against
504 * @sub: label to if is subset of @set
541 * @set: label to test against
542 * @sub: label to test if is subset of @set
562 * @set: label to test against
563 * @sub: label to test if is subset of @set
596 * __label_remove - remove @label from the label set
597 * @label: label to remove
598 * @new: label to redirect to
600 * Requires: labels_set(@label)->lock write_lock
601 * Returns: true if the label was in the tree and removed
603 static bool __label_remove(struct aa_label *label, struct aa_label *new)
605 struct aa_labelset *ls = labels_set(label);
608 AA_BUG(!label);
612 __aa_proxy_redirect(label, new);
614 if (!label_is_stale(label))
615 __label_make_stale(label);
617 if (label->flags & FLAG_IN_TREE) {
618 rb_erase(&label->node, &ls->root);
619 label->flags &= ~FLAG_IN_TREE;
627 * __label_replace - replace @old with @new in label set
628 * @old: label to remove from label set
629 * @new: label to replace @old with
635 * Note: current implementation requires label set be order in such a way
637 * using pointer comparison of the label address would not work)
664 * __label_insert - attempt to insert @l into a label set
666 * @label: new label to insert (NOT NULL)
673 * else ref counted equivalent label that is already in the set,
677 struct aa_label *label, bool replace)
682 AA_BUG(!label);
683 AA_BUG(labels_set(label) != ls);
685 AA_BUG(label->flags & FLAG_IN_TREE);
691 int result = label_cmp(label, this);
696 * so replace in place, however the label has
704 __proxy_share(this, label);
705 AA_BUG(!__label_replace(this, label));
706 return aa_get_label(label);
714 rb_link_node(&label->node, parent, new);
715 rb_insert_color(&label->node, &ls->root);
716 label->flags |= FLAG_IN_TREE;
717 accum_label_info(label);
719 return aa_get_label(label);
723 * __vec_find - find label that matches @vec in label set
724 * @vec: vec of profiles to find matching label for (NOT NULL)
730 * Returns: ref counted @label if matching label is in tree
731 * ref counted label that is equiv to @l in tree
759 * __label_find - find label @label in label set
760 * @label: label to find (NOT NULL)
762 * Requires: labels_set(@label)->lock held
765 * Returns: ref counted @label if @label is in tree OR
766 * ref counted label that is equiv to @label in tree
767 * else NULL if @label or equiv is not in tree
769 static struct aa_label *__label_find(struct aa_label *label)
771 AA_BUG(!label);
773 return __vec_find(label->vec, label->size);
778 * aa_label_remove - remove a label from the labelset
779 * @label: label to remove
781 * Returns: true if @label was removed from the tree
782 * else @label was not in tree so it could not be removed
784 bool aa_label_remove(struct aa_label *label)
786 struct aa_labelset *ls = labels_set(label);
793 res = __label_remove(label, ns_unconfined(labels_ns(label)));
800 * aa_label_replace - replace a label @old with a new version @new
801 * @old: label to replace
802 * @new: label replacing @old
841 * vec_find - find label @l in label set
842 * @vec: array of profiles to find equiv label for (NOT NULL)
845 * Returns: refcounted label if @vec equiv is in tree
851 struct aa_label *label;
860 label = __vec_find(vec, n);
863 return label;
870 struct aa_label *label = NULL;
879 return aa_get_label(&vec[0]->label);
881 ls = labels_set(&vec[len - 1]->label);
884 * check if label exists before taking locks
894 label = __label_insert(ls, new, false);
896 label_free_or_put_new(label, new);
898 return label;
904 struct aa_label *label = vec_find(vec, len);
906 if (label)
907 return label;
914 * aa_label_insert - insert label @label into @ls or return existing label
915 * @ls: labelset to insert @label into
916 * @label: label to insert
918 * Requires: caller to hold a valid ref on @label
920 * Returns: ref counted @label if successful in inserting @label
921 * else ref counted equivalent label that is already in the set
923 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
929 AA_BUG(!label);
931 /* check if label exists before taking lock */
932 if (!label_is_stale(label)) {
934 l = __label_find(label);
941 l = __label_insert(ls, label, false);
950 * @I: label iterator
951 * @a: label to merge
952 * @b: label to merge
990 * @a: label to merge then compare (NOT NULL)
991 * @b: label to merge then compare (NOT NULL)
992 * @z: label to compare merge against (NOT NULL)
1028 * label_merge_insert - create a new label by merging @a and @b
1029 * @new: preallocated label to merge into (NOT NULL)
1030 * @a: label to merge with @b (NOT NULL)
1031 * @b: label to merge with @a (NOT NULL)
1035 * Returns: ref counted label either @new if merge is unique
1048 struct aa_label *label;
1067 AA_BUG(!new->vec[k]->label.proxy);
1068 AA_BUG(!new->vec[k]->label.proxy->label);
1069 if (next->label.proxy != new->vec[k]->label.proxy)
1085 label = aa_get_label(&new->vec[0]->label);
1086 return label;
1100 label = __label_insert(labels_set(new), new, false);
1103 return label;
1107 * labelset_of_merge - find which labelset a merged label should be inserted
1108 * @a: label to merge and insert
1109 * @b: label to merge and insert
1111 * Returns: labelset that the merged label should be inserted into
1125 * __label_find_merge - find label that is equiv to merge of @a and @b
1127 * @a: label to merge with @b (NOT NULL)
1128 * @b: label to merge with @a (NOT NULL)
1132 * Returns: ref counted label that is equiv to merge of @a and @b
1167 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1168 * @a: label to merge with @b (NOT NULL)
1169 * @b: label to merge with @a (NOT NULL)
1173 * Returns: ref counted label that is equiv to merge of @a and @b
1179 struct aa_label *label;
1190 label = __label_find_merge(ls, a, b);
1195 return label;
1199 * aa_label_merge - attempt to insert new merged label of @a and @b
1200 * @a: label to merge with @b (NOT NULL)
1201 * @b: label to merge with @a (NOT NULL)
1207 * Returns: ref counted new label if successful in inserting merge of a & b
1208 * else ref counted equivalent label that is already in the set.
1209 * else NULL if could not create label (-ENOMEM)
1214 struct aa_label *label = NULL;
1223 * check if label exists before taking locks
1225 label = aa_label_find_merge(a, b);
1228 if (!label) {
1242 label = label_merge_insert(new, a, b);
1243 label_free_or_put_new(label, new);
1249 return label;
1276 * label_compound_match - find perms for full compound label
1279 * @label: label to check access permissions for
1287 * For the label A//&B//&C this does the perm match for A//&B//&C
1293 struct aa_label *label,
1301 label_for_each(i, label, tp) {
1315 label_for_each_cont(i, label, tp) {
1332 * label_components_match - find perms for all subcomponents of a label
1335 * @label: label to check access permissions for
1343 * For the label A//&B//&C this does the perm match for each of A and B and C
1349 struct aa_label *label, aa_state_t start,
1359 label_for_each(i, label, tp) {
1374 label_for_each_cont(i, label, tp) {
1395 * aa_label_match - do a multi-component label match
1398 * @label: label to match (NOT NULL)
1407 struct aa_label *label, aa_state_t state, bool inview,
1410 aa_state_t tmp = label_compound_match(profile, rules, label, state,
1417 return label_components_match(profile, rules, label, state, inview,
1423 * aa_update_label_name - update a label to have a stored name
1425 * @label: label to update (NOT NULL)
1428 * Requires: labels_set(label) not locked in caller
1430 * note: only updates the label name if it does not have a name already
1433 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1441 AA_BUG(!label);
1443 if (label->hname || labels_ns(label) != ns)
1446 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1449 ls = labels_set(label);
1451 if (!label->hname && label->flags & FLAG_IN_TREE) {
1452 label->hname = name;
1462 * cached label name is present and visible
1463 * @label->hname only exists if label is namespace hierarchical
1465 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1468 if (label->hname && (!ns || labels_ns(label) == ns) &&
1542 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1549 label_for_each(i, label, profile) {
1574 /* if any visible label is not unconfined the display_mode returns true */
1575 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1582 label_for_each(i, label, profile) {
1596 * aa_label_snxprint - print a label name to a string buffer
1600 * @label: label to view (NOT NULL)
1609 * label is not visible it will just be excluded. And if none
1610 * of the label is visible "---" will be used.
1613 struct aa_label *label, int flags)
1622 AA_BUG(!label);
1629 ns = labels_ns(label);
1632 label_for_each(i, label, profile) {
1655 if (display_mode(ns, label, flags)) {
1657 label_modename(ns, label, flags));
1666 * aa_label_asxprint - allocate a string buffer and print label into it
1667 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1669 * @label: label to view (NOT NULL)
1670 * @flags: flags controlling what label info is printed
1676 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1682 AA_BUG(!label);
1684 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1691 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1695 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1698 * @label: label to view (NOT NULL)
1699 * @flags: flags controlling what label info is printed
1706 struct aa_label *label, int flags, gfp_t gfp)
1711 AA_BUG(!label);
1713 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1720 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1725 struct aa_label *label, int flags, gfp_t gfp)
1732 AA_BUG(!label);
1734 if (!use_label_hname(ns, label, flags) ||
1735 display_mode(ns, label, flags)) {
1736 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1738 AA_DEBUG(DEBUG_LABEL, "label print error");
1743 str = (char *) label->hname;
1755 struct aa_label *label, int flags, gfp_t gfp)
1758 AA_BUG(!label);
1760 if (!use_label_hname(ns, label, flags)) {
1764 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1766 AA_DEBUG(DEBUG_LABEL, "label print error");
1771 } else if (display_mode(ns, label, flags))
1772 seq_printf(f, "%s (%s)", label->hname,
1773 label_modename(ns, label, flags));
1775 seq_puts(f, label->hname);
1778 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1781 AA_BUG(!label);
1783 if (!use_label_hname(ns, label, flags)) {
1787 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1789 AA_DEBUG(DEBUG_LABEL, "label print error");
1794 } else if (display_mode(ns, label, flags))
1795 pr_info("%s (%s)", label->hname,
1796 label_modename(ns, label, flags));
1798 pr_info("%s", label->hname);
1801 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1805 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1847 * aa_label_strn_parse - parse, validate and convert a text string to a label
1848 * @base: base label to use for lookups (NOT NULL)
1855 * Returns: the matching refcounted label if present
1863 struct aa_label *label, *currbase = base;
1873 base != &root_ns->unconfined->label))
1902 currbase = &vec[i]->label;
1914 return &vec[0]->label;
1919 label = aa_get_label(&vec[0]->label);
1924 label = aa_vec_find_or_create_label(vec, len, gfp);
1926 label = vec_find(vec, len);
1927 if (!label)
1933 return label;
1936 label = ERR_PTR(-ENOENT);
1948 * aa_labelset_destroy - remove all labels from the label set
1949 * @ls: label set to cleanup (NOT NULL)
1987 struct aa_label *label;
1996 label = rb_entry(node, struct aa_label, node);
1997 if ((label_is_stale(label) ||
1998 vec_is_stale(label->vec, label->size)) &&
1999 __aa_get_label(label))
2003 label = NULL;
2008 return label;
2012 * __label_update - insert updated version of @label into labelset
2013 * @label: the label to update/replace
2015 * Returns: new label that is up to date
2020 * Note: worst case is the stale @label does not get updated and has
2023 static struct aa_label *__label_update(struct aa_label *label)
2030 AA_BUG(!label);
2031 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2033 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2039 * and label updates, label merging and removal can be occurring
2041 ls = labels_set(label);
2043 for (i = 0; i < label->size; i++) {
2044 AA_BUG(!label->vec[i]);
2045 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2047 AA_BUG(!new->vec[i]->label.proxy);
2048 AA_BUG(!new->vec[i]->label.proxy->label);
2049 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2053 /* updated stale label by being removed/renamed from labelset */
2059 tmp = aa_get_label(&new->vec[0]->label);
2060 AA_BUG(tmp == label);
2063 if (labels_set(label) != labels_set(new)) {
2070 AA_BUG(labels_ns(label) != labels_ns(new));
2072 tmp = __label_insert(labels_set(label), new, true);
2074 /* ensure label is removed, and redirected correctly */
2075 __label_remove(label, tmp);
2089 * Any label that has a stale component is marked stale and replaced and
2097 struct aa_label *label;
2103 label = labelset_next_stale(&ns->labels);
2104 if (label) {
2105 struct aa_label *l = __label_update(label);
2108 aa_put_label(label);
2110 } while (label);