Lines Matching refs:profile
11 * task is confined by. Every task in the system has a profile attached
15 * Each profile exists in a profile namespace which is a container of
16 * visible profiles. Each namespace contains a special "unconfined" profile,
19 * Namespace and profile names can be written together in either
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
26 * Reserved profile names
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
35 * a // in a profile or namespace name indicates a hierarchical name with the
43 * The profile hierarchy severs two distinct purposes,
45 * subprograms under its own profile with different restriction than it
46 * self, and not have it use the system profile.
52 * but is allowed. NOTE: this is currently suboptimal because profile
53 * aliasing is not currently implemented so that a profile for each
58 * A profile or namespace name that can contain one or more // separators
62 * An fqname is a name that may contain both namespace and profile hnames.
66 * - locking of profile lists is currently fairly coarse. All profile
68 * FIXME: move profile lists to using rcu_lists
140 * @profile: the profile to add (NOT NULL)
142 * refcount @profile, should be put by __list_remove_profile
146 static void __add_profile(struct list_head *list, struct aa_profile *profile)
151 AA_BUG(!profile);
152 AA_BUG(!profile->ns);
153 AA_BUG(!mutex_is_locked(&profile->ns->lock));
155 list_add_rcu(&profile->base.list, list);
157 aa_get_profile(profile);
158 l = aa_label_insert(&profile->ns->labels, &profile->label);
159 AA_BUG(l != &profile->label);
164 * __list_remove_profile - remove a profile from the list it is on
165 * @profile: the profile to remove (NOT NULL)
167 * remove a profile from the list, warning generally removal should
168 * be done with __replace_profile as most profile removals are
169 * replacements to the unconfined profile.
171 * put @profile list refcount
175 static void __list_remove_profile(struct aa_profile *profile)
177 AA_BUG(!profile);
178 AA_BUG(!profile->ns);
179 AA_BUG(!mutex_is_locked(&profile->ns->lock));
181 list_del_rcu(&profile->base.list);
182 aa_put_profile(profile);
186 * __remove_profile - remove old profile, and children
187 * @profile: profile to be replaced (NOT NULL)
191 static void __remove_profile(struct aa_profile *profile)
193 AA_BUG(!profile);
194 AA_BUG(!profile->ns);
195 AA_BUG(!mutex_is_locked(&profile->ns->lock));
198 __aa_profile_list_release(&profile->base.profiles);
200 aa_label_remove(&profile->label);
201 __aafs_profile_rmdir(profile);
202 __list_remove_profile(profile);
213 struct aa_profile *profile, *tmp;
214 list_for_each_entry_safe(profile, tmp, head, base.list)
215 __remove_profile(profile);
269 * aa_free_profile - free a profile
270 * @profile: the profile to free (MAYBE NULL)
272 * Free a profile, its hats and null_profile. All references to the profile,
275 * If the profile was referenced from a task context, free_profile() will
278 void aa_free_profile(struct aa_profile *profile)
283 AA_DEBUG("%s(%p)\n", __func__, profile);
285 if (!profile)
289 aa_policy_destroy(&profile->base);
290 aa_put_profile(rcu_access_pointer(profile->parent));
292 aa_put_ns(profile->ns);
293 kfree_sensitive(profile->rename);
294 kfree_sensitive(profile->disconnected);
296 free_attachment(&profile->attach);
302 list_for_each_entry_safe(rule, tmp, &profile->rules, list) {
306 kfree_sensitive(profile->dirname);
308 if (profile->data) {
309 rht = profile->data;
310 profile->data = NULL;
315 kfree_sensitive(profile->hash);
316 aa_put_loaddata(profile->rawdata);
317 aa_label_destroy(&profile->label);
319 kfree_sensitive(profile);
323 * aa_alloc_profile - allocate, initialize and return a new profile
324 * @hname: name of the profile (NOT NULL)
328 * Returns: refcount profile or NULL on failure
333 struct aa_profile *profile;
337 profile = kzalloc(struct_size(profile, label.vec, 2), gfp);
338 if (!profile)
341 if (!aa_policy_init(&profile->base, NULL, hname, gfp))
343 if (!aa_label_init(&profile->label, 1, gfp))
346 INIT_LIST_HEAD(&profile->rules);
352 list_add(&rules->list, &profile->rules);
356 proxy = aa_alloc_proxy(&profile->label, gfp);
361 profile->label.proxy = proxy;
363 profile->label.hname = profile->base.hname;
364 profile->label.flags |= FLAG_PROFILE;
365 profile->label.vec[0] = profile;
368 return profile;
371 aa_free_profile(profile);
376 /* TODO: profile accounting - setup in remove */
379 * __strn_find_child - find a profile on @head list using substring of @name
381 * @name: name of profile (NOT NULL)
386 * Returns: unrefcounted profile ptr, or NULL if not found
395 * __find_child - find a profile on @head list with a name matching @name
397 * @name: name of profile (NOT NULL)
401 * Returns: unrefcounted profile ptr, or NULL if not found
409 * aa_find_child - find a profile by @name in @parent
410 * @parent: profile to search (NOT NULL)
411 * @name: profile name to search for (NOT NULL)
413 * Returns: a refcounted profile or NULL if not found
417 struct aa_profile *profile;
421 profile = __find_child(&parent->base.profiles, name);
422 } while (profile && !aa_get_profile_not0(profile));
426 return profile;
430 * __lookup_parent - lookup the parent of a profile of name @hname
431 * @ns: namespace to lookup profile in (NOT NULL)
432 * @hname: hierarchical profile name to find parent of (NOT NULL)
434 * Lookups up the parent of a fully qualified profile name, the profile
436 * is used to load a new profile.
446 struct aa_profile *profile = NULL;
452 profile = __strn_find_child(&policy->profiles, hname,
454 if (!profile)
456 policy = &profile->base;
460 if (!profile)
462 return &profile->base;
467 * @ns: namespace to lookup profile in (NOT NULL)
468 * @hname: hierarchical profile name to find parent of (NOT NULL)
481 struct aa_profile *parent, *profile = NULL;
490 parent = profile;
491 profile = __strn_find_child(&policy->profiles, hname,
493 if (!profile) {
498 profile = aa_alloc_null(parent, name, gfp);
500 if (!profile)
503 profile->ns = aa_get_ns(ns);
505 policy = &profile->base;
509 if (!profile)
511 return &profile->base;
515 * __lookupn_profile - lookup the profile matching @hname
516 * @base: base list to start looking up profile name from (NOT NULL)
517 * @hname: hierarchical profile name (NOT NULL)
522 * Returns: unrefcounted profile pointer or NULL if not found
524 * Do a relative name lookup, recursing through profile tree.
529 struct aa_profile *profile = NULL;
534 profile = __strn_find_child(&base->profiles, hname,
536 if (!profile)
539 base = &profile->base;
556 * aa_lookupn_profile - find a profile by its full or partial name
561 * Returns: refcounted profile or NULL if not found
566 struct aa_profile *profile;
570 profile = __lookupn_profile(&ns->base, hname, n);
571 } while (profile && !aa_get_profile_not0(profile));
574 /* the unconfined profile is not in the regular profile list */
575 if (!profile && strncmp(hname, "unconfined", n) == 0)
576 profile = aa_get_newest_profile(ns->unconfined);
579 return profile;
585 struct aa_profile *profile;
599 profile = aa_lookupn_profile(ns, name, n - (name - fqname));
601 /* default profile for ns, currently unconfined */
602 profile = aa_get_newest_profile(ns->unconfined);
604 profile = NULL;
607 return profile;
614 struct aa_profile *profile;
617 profile = aa_alloc_profile(name, NULL, gfp);
618 if (!profile)
622 profile->label.flags |= FLAG_NULL;
623 profile->attach.xmatch = aa_get_pdb(nullpdb);
624 rules = list_first_entry(&profile->rules, typeof(*rules), list);
629 profile->path_flags = parent->path_flags;
632 rcu_assign_pointer(profile->parent, aa_get_profile(parent));
633 profile->ns = aa_get_ns(parent->ns);
636 return profile;
640 * aa_new_learning_profile - create or find a null-X learning profile
641 * @parent: profile that caused this profile to be created (NOT NULL)
642 * @hat: true if the null- learning profile is a hat
643 * @base: name to base the null profile off of
646 * Find/Create a null- complain mode profile used in learning mode. The
647 * name of the profile is unique and follows the format of parent//null-XXX.
651 * null profiles are added to the profile list but the list does not
655 * Returns: new refcounted profile else NULL on failure
660 struct aa_profile *p, *profile;
685 profile = aa_find_child(parent, bname);
686 if (profile)
689 profile = aa_alloc_null(parent, name, gfp);
690 if (!profile)
692 profile->mode = APPARMOR_COMPLAIN;
694 profile->label.flags |= FLAG_HAT;
696 mutex_lock_nested(&profile->ns->lock, profile->ns->level);
699 aa_free_profile(profile);
700 profile = aa_get_profile(p);
702 __add_profile(&parent->base.profiles, profile);
704 mutex_unlock(&profile->ns->lock);
710 return profile;
714 aa_free_profile(profile);
720 * @profile: profile to test if it can be replaced (MAYBE NULL)
726 static int replacement_allowed(struct aa_profile *profile, int noreplace,
729 if (profile) {
730 if (profile->label.flags & FLAG_IMMUTIBLE) {
731 *info = "cannot replace immutable profile";
734 *info = "profile already exists";
758 * @name: name of profile being manipulated (NOT NULL)
902 struct aa_profile *profile)
904 const char *base = basename(profile->base.hname);
905 long len = base - profile->base.hname;
914 if (ent->new == profile)
916 if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
926 * @old: profile to be replaced (NOT NULL)
927 * @new: profile to replace @old with (NOT NULL)
983 * __lookup_replace - lookup replacement information for a profile
985 * @hname: name of profile to lookup
986 * @noreplace: true if not replacing an existing profile
987 * @p: Returns - profile to be replaced
990 * Returns: profile to replace (no ref) on success else ptr error
1000 *info = "profile can not be replaced";
1039 * aa_replace_profiles - replace profile(s) on the profile list
1045 * unpack and replace a profile on the profile list and uses of that profile
1046 * by any task creds via invalidating the old version of the profile, which
1047 * tasks will notice to update their own cred. If the profile does not exist
1048 * on the profile list it is added.
1161 * profile that doesn't have
1163 * individual profile loading where
1168 * null profile will be replaced once
1182 /* released on profile replacement or free_profile */
1224 /* dedup actual profile replacement */
1226 "same as current profile, skipping",
1235 * TODO: finer dedup based on profile range in data. Load set
1236 * can differ but profile may remain unchanged
1280 info = "valid profile in failed atomic policy load";
1283 info = "unchecked profile in failed atomic policy load";
1300 * aa_remove_profiles - remove profile(s) from the system
1303 * @fqname: name of the profile or namespace to remove (NOT NULL)
1306 * Remove a profile or sub namespace from the current namespace, so that
1317 struct aa_profile *profile = NULL;
1323 info = "no profile specified";
1351 /* remove profile */
1353 profile = aa_get_profile(__lookup_profile(&ns->base, name));
1354 if (!profile) {
1356 info = "profile does not exist";
1359 name = profile->base.hname;
1361 __remove_profile(profile);
1370 aa_put_profile(profile);