1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * AppArmor security module
4 *
5 * This file contains AppArmor label definitions
6 *
7 * Copyright 2017 Canonical Ltd.
8 */
9
10 #include <linux/audit.h>
11 #include <linux/seq_file.h>
12 #include <linux/sort.h>
13
14 #include "include/apparmor.h"
15 #include "include/cred.h"
16 #include "include/label.h"
17 #include "include/policy.h"
18 #include "include/secid.h"
19
20
21 /*
22 * the aa_label represents the set of profiles confining an object
23 *
24 * Labels maintain a reference count to the set of pointers they reference
25 * Labels are ref counted by
26 * tasks and object via the security field/security context off the field
27 * code - will take a ref count on a label if it needs the label
28 * beyond what is possible with an rcu_read_lock.
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
31 * referencing
32 * objects - inode, files, sockets, ...
33 *
34 * Labels are not ref counted by the label set, so they maybe removed and
35 * freed when no longer in use.
36 *
37 */
38
39 #define PROXY_POISON 97
40 #define LABEL_POISON 100
41
42 static void free_proxy(struct aa_proxy *proxy)
43 {
44 if (proxy) {
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
47 memset(proxy, 0, sizeof(*proxy));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49 kfree(proxy);
50 }
51 }
52
53 void aa_proxy_kref(struct kref *kref)
54 {
55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56
57 free_proxy(proxy);
58 }
59
60 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61 {
62 struct aa_proxy *new;
63
64 new = kzalloc(sizeof(struct aa_proxy), gfp);
65 if (new) {
66 kref_init(&new->count);
67 rcu_assign_pointer(new->label, aa_get_label(label));
68 }
69 return new;
70 }
71
72 /* requires profile list write lock held */
73 void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74 {
75 struct aa_label *tmp;
76
77 AA_BUG(!orig);
78 AA_BUG(!new);
79 lockdep_assert_held_write(&labels_set(orig)->lock);
80
81 tmp = rcu_dereference_protected(orig->proxy->label,
82 &labels_ns(orig)->lock);
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84 orig->flags |= FLAG_STALE;
85 aa_put_label(tmp);
86 }
87
88 static void __proxy_share(struct aa_label *old, struct aa_label *new)
89 {
90 struct aa_proxy *proxy = new->proxy;
91
92 new->proxy = aa_get_proxy(old->proxy);
93 __aa_proxy_redirect(old, new);
94 aa_put_proxy(proxy);
95 }
96
97
98 /**
99 * ns_cmp - compare ns for label set ordering
100 * @a: ns to compare (NOT NULL)
101 * @b: ns to compare (NOT NULL)
102 *
103 * Returns: <0 if a < b
104 * ==0 if a == b
105 * >0 if a > b
106 */
107 static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108 {
109 int res;
110
111 AA_BUG(!a);
112 AA_BUG(!b);
113 AA_BUG(!a->base.hname);
114 AA_BUG(!b->base.hname);
115
116 if (a == b)
117 return 0;
118
119 res = a->level - b->level;
120 if (res)
121 return res;
122
123 return strcmp(a->base.hname, b->base.hname);
124 }
125
126 /**
127 * profile_cmp - profile comparison for set ordering
128 * @a: profile to compare (NOT NULL)
129 * @b: profile to compare (NOT NULL)
130 *
131 * Returns: <0 if a < b
132 * ==0 if a == b
133 * >0 if a > b
134 */
135 static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136 {
137 int res;
138
139 AA_BUG(!a);
140 AA_BUG(!b);
141 AA_BUG(!a->ns);
142 AA_BUG(!b->ns);
143 AA_BUG(!a->base.hname);
144 AA_BUG(!b->base.hname);
145
146 if (a == b || a->base.hname == b->base.hname)
147 return 0;
148 res = ns_cmp(a->ns, b->ns);
149 if (res)
150 return res;
151
152 return strcmp(a->base.hname, b->base.hname);
153 }
154
155 /**
156 * vec_cmp - label comparison for set ordering
157 * @a: aa_profile to compare (NOT NULL)
158 * @an: length of @a
159 * @b: aa_profile to compare (NOT NULL)
160 * @bn: length of @b
161 *
162 * Returns: <0 if @a < @b
163 * ==0 if @a == @b
164 * >0 if @a > @b
165 */
166 static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
167 {
168 int i;
169
170 AA_BUG(!a);
171 AA_BUG(!*a);
172 AA_BUG(!b);
173 AA_BUG(!*b);
174 AA_BUG(an <= 0);
175 AA_BUG(bn <= 0);
176
177 for (i = 0; i < an && i < bn; i++) {
178 int res = profile_cmp(a[i], b[i]);
179
180 if (res != 0)
181 return res;
182 }
183
184 return an - bn;
185 }
186
187 static bool vec_is_stale(struct aa_profile **vec, int n)
188 {
189 int i;
190
191 AA_BUG(!vec);
192
193 for (i = 0; i < n; i++) {
194 if (profile_is_stale(vec[i]))
195 return true;
196 }
197
198 return false;
199 }
200
201 static long accum_vec_flags(struct aa_profile **vec, int n)
202 {
203 long u = FLAG_UNCONFINED;
204 int i;
205
206 AA_BUG(!vec);
207
208 for (i = 0; i < n; i++) {
209 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
210 FLAG_STALE);
211 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
212 u &= ~FLAG_UNCONFINED;
213 }
214
215 return u;
216 }
217
218 static int sort_cmp(const void *a, const void *b)
219 {
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
221 }
222
223 /*
224 * assumes vec is sorted
225 * Assumes @vec has null terminator at vec[n], and will null terminate
226 * vec[n - dups]
227 */
228 static inline int unique(struct aa_profile **vec, int n)
229 {
230 int i, pos, dups = 0;
231
232 AA_BUG(n < 1);
233 AA_BUG(!vec);
234
235 pos = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
238
239 AA_BUG(res > 0, "vec not sorted");
240 if (res == 0) {
241 /* drop duplicate */
242 aa_put_profile(vec[i]);
243 dups++;
244 continue;
245 }
246 pos++;
247 if (dups)
248 vec[pos] = vec[i];
249 }
250
251 AA_BUG(dups < 0);
252
253 return dups;
254 }
255
256 /**
257 * aa_vec_unique - canonical sort and unique a list of profiles
258 * @n: number of refcounted profiles in the list (@n > 0)
259 * @vec: list of profiles to sort and merge
260 * @flags: null terminator flags of @vec
261 *
262 * Returns: the number of duplicates eliminated == references put
263 *
264 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
265 * null terminate vec[n - dups]
266 */
267 int aa_vec_unique(struct aa_profile **vec, int n, int flags)
268 {
269 int i, dups = 0;
270
271 AA_BUG(n < 1);
272 AA_BUG(!vec);
273
274 /* vecs are usually small and inorder, have a fallback for larger */
275 if (n > 8) {
276 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
277 dups = unique(vec, n);
278 goto out;
279 }
280
281 /* insertion sort + unique in one */
282 for (i = 1; i < n; i++) {
283 struct aa_profile *tmp = vec[i];
284 int pos, j;
285
286 for (pos = i - 1 - dups; pos >= 0; pos--) {
287 int res = profile_cmp(vec[pos], tmp);
288
289 if (res == 0) {
290 /* drop duplicate entry */
291 aa_put_profile(tmp);
292 dups++;
293 goto continue_outer;
294 } else if (res < 0)
295 break;
296 }
297 /* pos is at entry < tmp, or index -1. Set to insert pos */
298 pos++;
299
300 for (j = i - dups; j > pos; j--)
301 vec[j] = vec[j - 1];
302 vec[pos] = tmp;
303 continue_outer:
304 ;
305 }
306
307 AA_BUG(dups < 0);
308
309 out:
310 if (flags & VEC_FLAG_TERMINATE)
311 vec[n - dups] = NULL;
312
313 return dups;
314 }
315
316
317 void aa_label_destroy(struct aa_label *label)
318 {
319 AA_BUG(!label);
320
321 if (!label_isprofile(label)) {
322 struct aa_profile *profile;
323 struct label_it i;
324
325 aa_put_str(label->hname);
326
327 label_for_each(i, label, profile) {
328 aa_put_profile(profile);
329 label->vec[i.i] = (struct aa_profile *)
330 (LABEL_POISON + (long) i.i);
331 }
332 }
333
334 if (label->proxy) {
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
337 aa_put_proxy(label->proxy);
338 }
339 aa_free_secid(label->secid);
340
341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
342 }
343
344 void aa_label_free(struct aa_label *label)
345 {
346 if (!label)
347 return;
348
349 aa_label_destroy(label);
350 kfree(label);
351 }
352
353 static void label_free_switch(struct aa_label *label)
354 {
355 if (label->flags & FLAG_NS_COUNT)
356 aa_free_ns(labels_ns(label));
357 else if (label_isprofile(label))
358 aa_free_profile(labels_profile(label));
359 else
360 aa_label_free(label);
361 }
362
363 static void label_free_rcu(struct rcu_head *head)
364 {
365 struct aa_label *label = container_of(head, struct aa_label, rcu);
366
367 if (label->flags & FLAG_IN_TREE)
368 (void) aa_label_remove(label);
369 label_free_switch(label);
370 }
371
372 void aa_label_kref(struct kref *kref)
373 {
374 struct aa_label *label = container_of(kref, struct aa_label, count);
375 struct aa_ns *ns = labels_ns(label);
376
377 if (!ns) {
378 /* never live, no rcu callback needed, just using the fn */
379 label_free_switch(label);
380 return;
381 }
382 /* TODO: update labels_profile macro so it works here */
383 AA_BUG(label_isprofile(label) &&
384 on_list_rcu(&label->vec[0]->base.profiles));
385 AA_BUG(label_isprofile(label) &&
386 on_list_rcu(&label->vec[0]->base.list));
387
388 /* TODO: if compound label and not stale add to reclaim cache */
389 call_rcu(&label->rcu, label_free_rcu);
390 }
391
392 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
393 {
394 if (label != new)
395 /* need to free directly to break circular ref with proxy */
396 aa_label_free(new);
397 else
398 aa_put_label(new);
399 }
400
401 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
402 {
403 AA_BUG(!label);
404 AA_BUG(size < 1);
405
406 if (aa_alloc_secid(label, gfp) < 0)
407 return false;
408
409 label->size = size; /* doesn't include null */
410 label->vec[size] = NULL; /* null terminate */
411 kref_init(&label->count);
412 RB_CLEAR_NODE(&label->node);
413
414 return true;
415 }
416
417 /**
418 * aa_label_alloc - allocate a label with a profile vector of @size length
419 * @size: size of profile vector in the label
420 * @proxy: proxy to use OR null if to allocate a new one
421 * @gfp: memory allocation type
422 *
423 * Returns: new label
424 * else NULL if failed
425 */
426 struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
427 {
428 struct aa_label *new;
429
430 AA_BUG(size < 1);
431
432 /* + 1 for null terminator entry on vec */
433 new = kzalloc(struct_size(new, vec, size + 1), gfp);
434 AA_DEBUG("%s (%p)\n", __func__, new);
435 if (!new)
436 goto fail;
437
438 if (!aa_label_init(new, size, gfp))
439 goto fail;
440
441 if (!proxy) {
442 proxy = aa_alloc_proxy(new, gfp);
443 if (!proxy)
444 goto fail;
445 } else
446 aa_get_proxy(proxy);
447 /* just set new's proxy, don't redirect proxy here if it was passed in*/
448 new->proxy = proxy;
449
450 return new;
451
452 fail:
453 kfree(new);
454
455 return NULL;
456 }
457
458
459 /**
460 * label_cmp - label comparison for set ordering
461 * @a: label to compare (NOT NULL)
462 * @b: label to compare (NOT NULL)
463 *
464 * Returns: <0 if a < b
465 * ==0 if a == b
466 * >0 if a > b
467 */
468 static int label_cmp(struct aa_label *a, struct aa_label *b)
469 {
470 AA_BUG(!b);
471
472 if (a == b)
473 return 0;
474
475 return vec_cmp(a->vec, a->size, b->vec, b->size);
476 }
477
478 /* helper fn for label_for_each_confined */
479 int aa_label_next_confined(struct aa_label *label, int i)
480 {
481 AA_BUG(!label);
482 AA_BUG(i < 0);
483
484 for (; i < label->size; i++) {
485 if (!profile_unconfined(label->vec[i]))
486 return i;
487 }
488
489 return i;
490 }
491
492 /**
493 * __aa_label_next_not_in_set - return the next profile of @sub not in @set
494 * @I: label iterator
495 * @set: label to test against
496 * @sub: label to if is subset of @set
497 *
498 * Returns: profile in @sub that is not in @set, with iterator set pos after
499 * else NULL if @sub is a subset of @set
500 */
501 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
502 struct aa_label *set,
503 struct aa_label *sub)
504 {
505 AA_BUG(!set);
506 AA_BUG(!I);
507 AA_BUG(I->i < 0);
508 AA_BUG(I->i > set->size);
509 AA_BUG(!sub);
510 AA_BUG(I->j < 0);
511 AA_BUG(I->j > sub->size);
512
513 while (I->j < sub->size && I->i < set->size) {
514 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
515
516 if (res == 0) {
517 (I->j)++;
518 (I->i)++;
519 } else if (res > 0)
520 (I->i)++;
521 else
522 return sub->vec[(I->j)++];
523 }
524
525 if (I->j < sub->size)
526 return sub->vec[(I->j)++];
527
528 return NULL;
529 }
530
531 /**
532 * aa_label_is_subset - test if @sub is a subset of @set
533 * @set: label to test against
534 * @sub: label to test if is subset of @set
535 *
536 * Returns: true if @sub is subset of @set
537 * else false
538 */
539 bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
540 {
541 struct label_it i = { };
542
543 AA_BUG(!set);
544 AA_BUG(!sub);
545
546 if (sub == set)
547 return true;
548
549 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
550 }
551
552 /**
553 * aa_label_is_unconfined_subset - test if @sub is a subset of @set
554 * @set: label to test against
555 * @sub: label to test if is subset of @set
556 *
557 * This checks for subset but taking into account unconfined. IF
558 * @sub contains an unconfined profile that does not have a matching
559 * unconfined in @set then this will not cause the test to fail.
560 * Conversely we don't care about an unconfined in @set that is not in
561 * @sub
562 *
563 * Returns: true if @sub is special_subset of @set
564 * else false
565 */
566 bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
567 {
568 struct label_it i = { };
569 struct aa_profile *p;
570
571 AA_BUG(!set);
572 AA_BUG(!sub);
573
574 if (sub == set)
575 return true;
576
577 do {
578 p = __aa_label_next_not_in_set(&i, set, sub);
579 if (p && !profile_unconfined(p))
580 break;
581 } while (p);
582
583 return p == NULL;
584 }
585
586
587 /**
588 * __label_remove - remove @label from the label set
589 * @label: label to remove
590 * @new: label to redirect to
591 *
592 * Requires: labels_set(@label)->lock write_lock
593 * Returns: true if the label was in the tree and removed
594 */
595 static bool __label_remove(struct aa_label *label, struct aa_label *new)
596 {
597 struct aa_labelset *ls = labels_set(label);
598
599 AA_BUG(!ls);
600 AA_BUG(!label);
601 lockdep_assert_held_write(&ls->lock);
602
603 if (new)
604 __aa_proxy_redirect(label, new);
605
606 if (!label_is_stale(label))
607 __label_make_stale(label);
608
609 if (label->flags & FLAG_IN_TREE) {
610 rb_erase(&label->node, &ls->root);
611 label->flags &= ~FLAG_IN_TREE;
612 return true;
613 }
614
615 return false;
616 }
617
618 /**
619 * __label_replace - replace @old with @new in label set
620 * @old: label to remove from label set
621 * @new: label to replace @old with
622 *
623 * Requires: labels_set(@old)->lock write_lock
624 * valid ref count be held on @new
625 * Returns: true if @old was in set and replaced by @new
626 *
627 * Note: current implementation requires label set be order in such a way
628 * that @new directly replaces @old position in the set (ie.
629 * using pointer comparison of the label address would not work)
630 */
631 static bool __label_replace(struct aa_label *old, struct aa_label *new)
632 {
633 struct aa_labelset *ls = labels_set(old);
634
635 AA_BUG(!ls);
636 AA_BUG(!old);
637 AA_BUG(!new);
638 lockdep_assert_held_write(&ls->lock);
639 AA_BUG(new->flags & FLAG_IN_TREE);
640
641 if (!label_is_stale(old))
642 __label_make_stale(old);
643
644 if (old->flags & FLAG_IN_TREE) {
645 rb_replace_node(&old->node, &new->node, &ls->root);
646 old->flags &= ~FLAG_IN_TREE;
647 new->flags |= FLAG_IN_TREE;
648 return true;
649 }
650
651 return false;
652 }
653
654 /**
655 * __label_insert - attempt to insert @l into a label set
656 * @ls: set of labels to insert @l into (NOT NULL)
657 * @label: new label to insert (NOT NULL)
658 * @replace: whether insertion should replace existing entry that is not stale
659 *
660 * Requires: @ls->lock
661 * caller to hold a valid ref on l
662 * if @replace is true l has a preallocated proxy associated
663 * Returns: @l if successful in inserting @l - with additional refcount
664 * else ref counted equivalent label that is already in the set,
665 * the else condition only happens if @replace is false
666 */
667 static struct aa_label *__label_insert(struct aa_labelset *ls,
668 struct aa_label *label, bool replace)
669 {
670 struct rb_node **new, *parent = NULL;
671
672 AA_BUG(!ls);
673 AA_BUG(!label);
674 AA_BUG(labels_set(label) != ls);
675 lockdep_assert_held_write(&ls->lock);
676 AA_BUG(label->flags & FLAG_IN_TREE);
677
678 /* Figure out where to put new node */
679 new = &ls->root.rb_node;
680 while (*new) {
681 struct aa_label *this = rb_entry(*new, struct aa_label, node);
682 int result = label_cmp(label, this);
683
684 parent = *new;
685 if (result == 0) {
686 /* !__aa_get_label means queued for destruction,
687 * so replace in place, however the label has
688 * died before the replacement so do not share
689 * the proxy
690 */
691 if (!replace && !label_is_stale(this)) {
692 if (__aa_get_label(this))
693 return this;
694 } else
695 __proxy_share(this, label);
696 AA_BUG(!__label_replace(this, label));
697 return aa_get_label(label);
698 } else if (result < 0)
699 new = &((*new)->rb_left);
700 else /* (result > 0) */
701 new = &((*new)->rb_right);
702 }
703
704 /* Add new node and rebalance tree. */
705 rb_link_node(&label->node, parent, new);
706 rb_insert_color(&label->node, &ls->root);
707 label->flags |= FLAG_IN_TREE;
708
709 return aa_get_label(label);
710 }
711
712 /**
713 * __vec_find - find label that matches @vec in label set
714 * @vec: vec of profiles to find matching label for (NOT NULL)
715 * @n: length of @vec
716 *
717 * Requires: @vec_labelset(vec) lock held
718 * caller to hold a valid ref on l
719 *
720 * Returns: ref counted @label if matching label is in tree
721 * ref counted label that is equiv to @l in tree
722 * else NULL if @vec equiv is not in tree
723 */
724 static struct aa_label *__vec_find(struct aa_profile **vec, int n)
725 {
726 struct rb_node *node;
727
728 AA_BUG(!vec);
729 AA_BUG(!*vec);
730 AA_BUG(n <= 0);
731
732 node = vec_labelset(vec, n)->root.rb_node;
733 while (node) {
734 struct aa_label *this = rb_entry(node, struct aa_label, node);
735 int result = vec_cmp(this->vec, this->size, vec, n);
736
737 if (result > 0)
738 node = node->rb_left;
739 else if (result < 0)
740 node = node->rb_right;
741 else
742 return __aa_get_label(this);
743 }
744
745 return NULL;
746 }
747
748 /**
749 * __label_find - find label @label in label set
750 * @label: label to find (NOT NULL)
751 *
752 * Requires: labels_set(@label)->lock held
753 * caller to hold a valid ref on l
754 *
755 * Returns: ref counted @label if @label is in tree OR
756 * ref counted label that is equiv to @label in tree
757 * else NULL if @label or equiv is not in tree
758 */
759 static struct aa_label *__label_find(struct aa_label *label)
760 {
761 AA_BUG(!label);
762
763 return __vec_find(label->vec, label->size);
764 }
765
766
767 /**
768 * aa_label_remove - remove a label from the labelset
769 * @label: label to remove
770 *
771 * Returns: true if @label was removed from the tree
772 * else @label was not in tree so it could not be removed
773 */
774 bool aa_label_remove(struct aa_label *label)
775 {
776 struct aa_labelset *ls = labels_set(label);
777 unsigned long flags;
778 bool res;
779
780 AA_BUG(!ls);
781
782 write_lock_irqsave(&ls->lock, flags);
783 res = __label_remove(label, ns_unconfined(labels_ns(label)));
784 write_unlock_irqrestore(&ls->lock, flags);
785
786 return res;
787 }
788
789 /**
790 * aa_label_replace - replace a label @old with a new version @new
791 * @old: label to replace
792 * @new: label replacing @old
793 *
794 * Returns: true if @old was in tree and replaced
795 * else @old was not in tree, and @new was not inserted
796 */
797 bool aa_label_replace(struct aa_label *old, struct aa_label *new)
798 {
799 unsigned long flags;
800 bool res;
801
802 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
803 write_lock_irqsave(&labels_set(old)->lock, flags);
804 if (old->proxy != new->proxy)
805 __proxy_share(old, new);
806 else
807 __aa_proxy_redirect(old, new);
808 res = __label_replace(old, new);
809 write_unlock_irqrestore(&labels_set(old)->lock, flags);
810 } else {
811 struct aa_label *l;
812 struct aa_labelset *ls = labels_set(old);
813
814 write_lock_irqsave(&ls->lock, flags);
815 res = __label_remove(old, new);
816 if (labels_ns(old) != labels_ns(new)) {
817 write_unlock_irqrestore(&ls->lock, flags);
818 ls = labels_set(new);
819 write_lock_irqsave(&ls->lock, flags);
820 }
821 l = __label_insert(ls, new, true);
822 res = (l == new);
823 write_unlock_irqrestore(&ls->lock, flags);
824 aa_put_label(l);
825 }
826
827 return res;
828 }
829
830 /**
831 * vec_find - find label @l in label set
832 * @vec: array of profiles to find equiv label for (NOT NULL)
833 * @n: length of @vec
834 *
835 * Returns: refcounted label if @vec equiv is in tree
836 * else NULL if @vec equiv is not in tree
837 */
838 static struct aa_label *vec_find(struct aa_profile **vec, int n)
839 {
840 struct aa_labelset *ls;
841 struct aa_label *label;
842 unsigned long flags;
843
844 AA_BUG(!vec);
845 AA_BUG(!*vec);
846 AA_BUG(n <= 0);
847
848 ls = vec_labelset(vec, n);
849 read_lock_irqsave(&ls->lock, flags);
850 label = __vec_find(vec, n);
851 read_unlock_irqrestore(&ls->lock, flags);
852
853 return label;
854 }
855
856 /* requires sort and merge done first */
857 static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
858 int len, gfp_t gfp)
859 {
860 struct aa_label *label = NULL;
861 struct aa_labelset *ls;
862 unsigned long flags;
863 struct aa_label *new;
864 int i;
865
866 AA_BUG(!vec);
867
868 if (len == 1)
869 return aa_get_label(&vec[0]->label);
870
871 ls = labels_set(&vec[len - 1]->label);
872
873 /* TODO: enable when read side is lockless
874 * check if label exists before taking locks
875 */
876 new = aa_label_alloc(len, NULL, gfp);
877 if (!new)
878 return NULL;
879
880 for (i = 0; i < len; i++)
881 new->vec[i] = aa_get_profile(vec[i]);
882
883 write_lock_irqsave(&ls->lock, flags);
884 label = __label_insert(ls, new, false);
885 write_unlock_irqrestore(&ls->lock, flags);
886 label_free_or_put_new(label, new);
887
888 return label;
889 }
890
891 struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
892 gfp_t gfp)
893 {
894 struct aa_label *label = vec_find(vec, len);
895
896 if (label)
897 return label;
898
899 return vec_create_and_insert_label(vec, len, gfp);
900 }
901
902 /**
903 * aa_label_find - find label @label in label set
904 * @label: label to find (NOT NULL)
905 *
906 * Requires: caller to hold a valid ref on l
907 *
908 * Returns: refcounted @label if @label is in tree
909 * refcounted label that is equiv to @label in tree
910 * else NULL if @label or equiv is not in tree
911 */
912 struct aa_label *aa_label_find(struct aa_label *label)
913 {
914 AA_BUG(!label);
915
916 return vec_find(label->vec, label->size);
917 }
918
919
920 /**
921 * aa_label_insert - insert label @label into @ls or return existing label
922 * @ls: labelset to insert @label into
923 * @label: label to insert
924 *
925 * Requires: caller to hold a valid ref on @label
926 *
927 * Returns: ref counted @label if successful in inserting @label
928 * else ref counted equivalent label that is already in the set
929 */
930 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
931 {
932 struct aa_label *l;
933 unsigned long flags;
934
935 AA_BUG(!ls);
936 AA_BUG(!label);
937
938 /* check if label exists before taking lock */
939 if (!label_is_stale(label)) {
940 read_lock_irqsave(&ls->lock, flags);
941 l = __label_find(label);
942 read_unlock_irqrestore(&ls->lock, flags);
943 if (l)
944 return l;
945 }
946
947 write_lock_irqsave(&ls->lock, flags);
948 l = __label_insert(ls, label, false);
949 write_unlock_irqrestore(&ls->lock, flags);
950
951 return l;
952 }
953
954
955 /**
956 * aa_label_next_in_merge - find the next profile when merging @a and @b
957 * @I: label iterator
958 * @a: label to merge
959 * @b: label to merge
960 *
961 * Returns: next profile
962 * else null if no more profiles
963 */
964 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
965 struct aa_label *a,
966 struct aa_label *b)
967 {
968 AA_BUG(!a);
969 AA_BUG(!b);
970 AA_BUG(!I);
971 AA_BUG(I->i < 0);
972 AA_BUG(I->i > a->size);
973 AA_BUG(I->j < 0);
974 AA_BUG(I->j > b->size);
975
976 if (I->i < a->size) {
977 if (I->j < b->size) {
978 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
979
980 if (res > 0)
981 return b->vec[(I->j)++];
982 if (res == 0)
983 (I->j)++;
984 }
985
986 return a->vec[(I->i)++];
987 }
988
989 if (I->j < b->size)
990 return b->vec[(I->j)++];
991
992 return NULL;
993 }
994
995 /**
996 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
997 * @a: label to merge then compare (NOT NULL)
998 * @b: label to merge then compare (NOT NULL)
999 * @z: label to compare merge against (NOT NULL)
1000 *
1001 * Assumes: using the most recent versions of @a, @b, and @z
1002 *
1003 * Returns: <0 if a < b
1004 * ==0 if a == b
1005 * >0 if a > b
1006 */
1007 static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1008 struct aa_label *z)
1009 {
1010 struct aa_profile *p = NULL;
1011 struct label_it i = { };
1012 int k;
1013
1014 AA_BUG(!a);
1015 AA_BUG(!b);
1016 AA_BUG(!z);
1017
1018 for (k = 0;
1019 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1020 k++) {
1021 int res = profile_cmp(p, z->vec[k]);
1022
1023 if (res != 0)
1024 return res;
1025 }
1026
1027 if (p)
1028 return 1;
1029 else if (k < z->size)
1030 return -1;
1031 return 0;
1032 }
1033
1034 /**
1035 * label_merge_insert - create a new label by merging @a and @b
1036 * @new: preallocated label to merge into (NOT NULL)
1037 * @a: label to merge with @b (NOT NULL)
1038 * @b: label to merge with @a (NOT NULL)
1039 *
1040 * Requires: preallocated proxy
1041 *
1042 * Returns: ref counted label either @new if merge is unique
1043 * @a if @b is a subset of @a
1044 * @b if @a is a subset of @b
1045 *
1046 * NOTE: will not use @new if the merge results in @new == @a or @b
1047 *
1048 * Must be used within labelset write lock to avoid racing with
1049 * setting labels stale.
1050 */
1051 static struct aa_label *label_merge_insert(struct aa_label *new,
1052 struct aa_label *a,
1053 struct aa_label *b)
1054 {
1055 struct aa_label *label;
1056 struct aa_labelset *ls;
1057 struct aa_profile *next;
1058 struct label_it i;
1059 unsigned long flags;
1060 int k = 0, invcount = 0;
1061 bool stale = false;
1062
1063 AA_BUG(!a);
1064 AA_BUG(a->size < 0);
1065 AA_BUG(!b);
1066 AA_BUG(b->size < 0);
1067 AA_BUG(!new);
1068 AA_BUG(new->size < a->size + b->size);
1069
1070 label_for_each_in_merge(i, a, b, next) {
1071 AA_BUG(!next);
1072 if (profile_is_stale(next)) {
1073 new->vec[k] = aa_get_newest_profile(next);
1074 AA_BUG(!new->vec[k]->label.proxy);
1075 AA_BUG(!new->vec[k]->label.proxy->label);
1076 if (next->label.proxy != new->vec[k]->label.proxy)
1077 invcount++;
1078 k++;
1079 stale = true;
1080 } else
1081 new->vec[k++] = aa_get_profile(next);
1082 }
1083 /* set to actual size which is <= allocated len */
1084 new->size = k;
1085 new->vec[k] = NULL;
1086
1087 if (invcount) {
1088 new->size -= aa_vec_unique(&new->vec[0], new->size,
1089 VEC_FLAG_TERMINATE);
1090 /* TODO: deal with reference labels */
1091 if (new->size == 1) {
1092 label = aa_get_label(&new->vec[0]->label);
1093 return label;
1094 }
1095 } else if (!stale) {
1096 /*
1097 * merge could be same as a || b, note: it is not possible
1098 * for new->size == a->size == b->size unless a == b
1099 */
1100 if (k == a->size)
1101 return aa_get_label(a);
1102 else if (k == b->size)
1103 return aa_get_label(b);
1104 }
1105 new->flags |= accum_vec_flags(new->vec, new->size);
1106 ls = labels_set(new);
1107 write_lock_irqsave(&ls->lock, flags);
1108 label = __label_insert(labels_set(new), new, false);
1109 write_unlock_irqrestore(&ls->lock, flags);
1110
1111 return label;
1112 }
1113
1114 /**
1115 * labelset_of_merge - find which labelset a merged label should be inserted
1116 * @a: label to merge and insert
1117 * @b: label to merge and insert
1118 *
1119 * Returns: labelset that the merged label should be inserted into
1120 */
1121 static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1122 struct aa_label *b)
1123 {
1124 struct aa_ns *nsa = labels_ns(a);
1125 struct aa_ns *nsb = labels_ns(b);
1126
1127 if (ns_cmp(nsa, nsb) <= 0)
1128 return &nsa->labels;
1129 return &nsb->labels;
1130 }
1131
1132 /**
1133 * __label_find_merge - find label that is equiv to merge of @a and @b
1134 * @ls: set of labels to search (NOT NULL)
1135 * @a: label to merge with @b (NOT NULL)
1136 * @b: label to merge with @a (NOT NULL)
1137 *
1138 * Requires: ls->lock read_lock held
1139 *
1140 * Returns: ref counted label that is equiv to merge of @a and @b
1141 * else NULL if merge of @a and @b is not in set
1142 */
1143 static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1144 struct aa_label *a,
1145 struct aa_label *b)
1146 {
1147 struct rb_node *node;
1148
1149 AA_BUG(!ls);
1150 AA_BUG(!a);
1151 AA_BUG(!b);
1152
1153 if (a == b)
1154 return __label_find(a);
1155
1156 node = ls->root.rb_node;
1157 while (node) {
1158 struct aa_label *this = container_of(node, struct aa_label,
1159 node);
1160 int result = label_merge_cmp(a, b, this);
1161
1162 if (result < 0)
1163 node = node->rb_left;
1164 else if (result > 0)
1165 node = node->rb_right;
1166 else
1167 return __aa_get_label(this);
1168 }
1169
1170 return NULL;
1171 }
1172
1173
1174 /**
1175 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1176 * @a: label to merge with @b (NOT NULL)
1177 * @b: label to merge with @a (NOT NULL)
1178 *
1179 * Requires: labels be fully constructed with a valid ns
1180 *
1181 * Returns: ref counted label that is equiv to merge of @a and @b
1182 * else NULL if merge of @a and @b is not in set
1183 */
1184 struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1185 {
1186 struct aa_labelset *ls;
1187 struct aa_label *label, *ar = NULL, *br = NULL;
1188 unsigned long flags;
1189
1190 AA_BUG(!a);
1191 AA_BUG(!b);
1192
1193 if (label_is_stale(a))
1194 a = ar = aa_get_newest_label(a);
1195 if (label_is_stale(b))
1196 b = br = aa_get_newest_label(b);
1197 ls = labelset_of_merge(a, b);
1198 read_lock_irqsave(&ls->lock, flags);
1199 label = __label_find_merge(ls, a, b);
1200 read_unlock_irqrestore(&ls->lock, flags);
1201 aa_put_label(ar);
1202 aa_put_label(br);
1203
1204 return label;
1205 }
1206
1207 /**
1208 * aa_label_merge - attempt to insert new merged label of @a and @b
1209 * @a: label to merge with @b (NOT NULL)
1210 * @b: label to merge with @a (NOT NULL)
1211 * @gfp: memory allocation type
1212 *
1213 * Requires: caller to hold valid refs on @a and @b
1214 * labels be fully constructed with a valid ns
1215 *
1216 * Returns: ref counted new label if successful in inserting merge of a & b
1217 * else ref counted equivalent label that is already in the set.
1218 * else NULL if could not create label (-ENOMEM)
1219 */
1220 struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1221 gfp_t gfp)
1222 {
1223 struct aa_label *label = NULL;
1224
1225 AA_BUG(!a);
1226 AA_BUG(!b);
1227
1228 if (a == b)
1229 return aa_get_newest_label(a);
1230
1231 /* TODO: enable when read side is lockless
1232 * check if label exists before taking locks
1233 if (!label_is_stale(a) && !label_is_stale(b))
1234 label = aa_label_find_merge(a, b);
1235 */
1236
1237 if (!label) {
1238 struct aa_label *new;
1239
1240 a = aa_get_newest_label(a);
1241 b = aa_get_newest_label(b);
1242
1243 /* could use label_merge_len(a, b), but requires double
1244 * comparison for small savings
1245 */
1246 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1247 if (!new)
1248 goto out;
1249
1250 label = label_merge_insert(new, a, b);
1251 label_free_or_put_new(label, new);
1252 out:
1253 aa_put_label(a);
1254 aa_put_label(b);
1255 }
1256
1257 return label;
1258 }
1259
1260 /* match a profile and its associated ns component if needed
1261 * Assumes visibility test has already been done.
1262 * If a subns profile is not to be matched should be prescreened with
1263 * visibility test.
1264 */
1265 static inline aa_state_t match_component(struct aa_profile *profile,
1266 struct aa_ruleset *rules,
1267 struct aa_profile *tp,
1268 aa_state_t state)
1269 {
1270 const char *ns_name;
1271
1272 if (profile->ns == tp->ns)
1273 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1274
1275 /* try matching with namespace name and then profile */
1276 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1277 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1278 state = aa_dfa_match(rules->policy->dfa, state, ns_name);
1279 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1280 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1281 }
1282
1283 /**
1284 * label_compound_match - find perms for full compound label
1285 * @profile: profile to find perms for
1286 * @rules: ruleset to search
1287 * @label: label to check access permissions for
1288 * @state: state to start match in
1289 * @subns: whether to do permission checks on components in a subns
1290 * @request: permissions to request
1291 * @perms: perms struct to set
1292 *
1293 * Returns: 0 on success else ERROR
1294 *
1295 * For the label A//&B//&C this does the perm match for A//&B//&C
1296 * @perms should be preinitialized with allperms OR a previous permission
1297 * check to be stacked.
1298 */
1299 static int label_compound_match(struct aa_profile *profile,
1300 struct aa_ruleset *rules,
1301 struct aa_label *label,
1302 aa_state_t state, bool subns, u32 request,
1303 struct aa_perms *perms)
1304 {
1305 struct aa_profile *tp;
1306 struct label_it i;
1307
1308 /* find first subcomponent that is visible */
1309 label_for_each(i, label, tp) {
1310 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1311 continue;
1312 state = match_component(profile, rules, tp, state);
1313 if (!state)
1314 goto fail;
1315 goto next;
1316 }
1317
1318 /* no component visible */
1319 *perms = allperms;
1320 return 0;
1321
1322 next:
1323 label_for_each_cont(i, label, tp) {
1324 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1325 continue;
1326 state = aa_dfa_match(rules->policy->dfa, state, "//&");
1327 state = match_component(profile, rules, tp, state);
1328 if (!state)
1329 goto fail;
1330 }
1331 *perms = *aa_lookup_perms(rules->policy, state);
1332 aa_apply_modes_to_perms(profile, perms);
1333 if ((perms->allow & request) != request)
1334 return -EACCES;
1335
1336 return 0;
1337
1338 fail:
1339 *perms = nullperms;
1340 return state;
1341 }
1342
1343 /**
1344 * label_components_match - find perms for all subcomponents of a label
1345 * @profile: profile to find perms for
1346 * @rules: ruleset to search
1347 * @label: label to check access permissions for
1348 * @start: state to start match in
1349 * @subns: whether to do permission checks on components in a subns
1350 * @request: permissions to request
1351 * @perms: an initialized perms struct to add accumulation to
1352 *
1353 * Returns: 0 on success else ERROR
1354 *
1355 * For the label A//&B//&C this does the perm match for each of A and B and C
1356 * @perms should be preinitialized with allperms OR a previous permission
1357 * check to be stacked.
1358 */
1359 static int label_components_match(struct aa_profile *profile,
1360 struct aa_ruleset *rules,
1361 struct aa_label *label, aa_state_t start,
1362 bool subns, u32 request,
1363 struct aa_perms *perms)
1364 {
1365 struct aa_profile *tp;
1366 struct label_it i;
1367 struct aa_perms tmp;
1368 aa_state_t state = 0;
1369
1370 /* find first subcomponent to test */
1371 label_for_each(i, label, tp) {
1372 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1373 continue;
1374 state = match_component(profile, rules, tp, start);
1375 if (!state)
1376 goto fail;
1377 goto next;
1378 }
1379
1380 /* no subcomponents visible - no change in perms */
1381 return 0;
1382
1383 next:
1384 tmp = *aa_lookup_perms(rules->policy, state);
1385 aa_apply_modes_to_perms(profile, &tmp);
1386 aa_perms_accum(perms, &tmp);
1387 label_for_each_cont(i, label, tp) {
1388 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1389 continue;
1390 state = match_component(profile, rules, tp, start);
1391 if (!state)
1392 goto fail;
1393 tmp = *aa_lookup_perms(rules->policy, state);
1394 aa_apply_modes_to_perms(profile, &tmp);
1395 aa_perms_accum(perms, &tmp);
1396 }
1397
1398 if ((perms->allow & request) != request)
1399 return -EACCES;
1400
1401 return 0;
1402
1403 fail:
1404 *perms = nullperms;
1405 return -EACCES;
1406 }
1407
1408 /**
1409 * aa_label_match - do a multi-component label match
1410 * @profile: profile to match against (NOT NULL)
1411 * @rules: ruleset to search
1412 * @label: label to match (NOT NULL)
1413 * @state: state to start in
1414 * @subns: whether to match subns components
1415 * @request: permission request
1416 * @perms: Returns computed perms (NOT NULL)
1417 *
1418 * Returns: the state the match finished in, may be the none matching state
1419 */
1420 int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
1421 struct aa_label *label, aa_state_t state, bool subns,
1422 u32 request, struct aa_perms *perms)
1423 {
1424 int error = label_compound_match(profile, rules, label, state, subns,
1425 request, perms);
1426 if (!error)
1427 return error;
1428
1429 *perms = allperms;
1430 return label_components_match(profile, rules, label, state, subns,
1431 request, perms);
1432 }
1433
1434
1435 /**
1436 * aa_update_label_name - update a label to have a stored name
1437 * @ns: ns being viewed from (NOT NULL)
1438 * @label: label to update (NOT NULL)
1439 * @gfp: type of memory allocation
1440 *
1441 * Requires: labels_set(label) not locked in caller
1442 *
1443 * note: only updates the label name if it does not have a name already
1444 * and if it is in the labelset
1445 */
1446 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1447 {
1448 struct aa_labelset *ls;
1449 unsigned long flags;
1450 char __counted *name;
1451 bool res = false;
1452
1453 AA_BUG(!ns);
1454 AA_BUG(!label);
1455
1456 if (label->hname || labels_ns(label) != ns)
1457 return res;
1458
1459 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1460 return res;
1461
1462 ls = labels_set(label);
1463 write_lock_irqsave(&ls->lock, flags);
1464 if (!label->hname && label->flags & FLAG_IN_TREE) {
1465 label->hname = name;
1466 res = true;
1467 } else
1468 aa_put_str(name);
1469 write_unlock_irqrestore(&ls->lock, flags);
1470
1471 return res;
1472 }
1473
1474 /*
1475 * cached label name is present and visible
1476 * @label->hname only exists if label is namespace hierachical
1477 */
1478 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1479 int flags)
1480 {
1481 if (label->hname && (!ns || labels_ns(label) == ns) &&
1482 !(flags & ~FLAG_SHOW_MODE))
1483 return true;
1484
1485 return false;
1486 }
1487
1488 /* helper macro for snprint routines */
1489 #define update_for_len(total, len, size, str) \
1490 do { \
1491 size_t ulen = len; \
1492 \
1493 AA_BUG(len < 0); \
1494 total += ulen; \
1495 ulen = min(ulen, size); \
1496 size -= ulen; \
1497 str += ulen; \
1498 } while (0)
1499
1500 /**
1501 * aa_profile_snxprint - print a profile name to a buffer
1502 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1503 * @size: size of buffer
1504 * @view: namespace profile is being viewed from
1505 * @profile: profile to view (NOT NULL)
1506 * @flags: whether to include the mode string
1507 * @prev_ns: last ns printed when used in compound print
1508 *
1509 * Returns: size of name written or would be written if larger than
1510 * available buffer
1511 *
1512 * Note: will not print anything if the profile is not visible
1513 */
1514 static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1515 struct aa_profile *profile, int flags,
1516 struct aa_ns **prev_ns)
1517 {
1518 const char *ns_name = NULL;
1519
1520 AA_BUG(!str && size != 0);
1521 AA_BUG(!profile);
1522
1523 if (!view)
1524 view = profiles_ns(profile);
1525
1526 if (view != profile->ns &&
1527 (!prev_ns || (*prev_ns != profile->ns))) {
1528 if (prev_ns)
1529 *prev_ns = profile->ns;
1530 ns_name = aa_ns_name(view, profile->ns,
1531 flags & FLAG_VIEW_SUBNS);
1532 if (ns_name == aa_hidden_ns_name) {
1533 if (flags & FLAG_HIDDEN_UNCONFINED)
1534 return snprintf(str, size, "%s", "unconfined");
1535 return snprintf(str, size, "%s", ns_name);
1536 }
1537 }
1538
1539 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1540 const char *modestr = aa_profile_mode_names[profile->mode];
1541
1542 if (ns_name)
1543 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1544 profile->base.hname, modestr);
1545 return snprintf(str, size, "%s (%s)", profile->base.hname,
1546 modestr);
1547 }
1548
1549 if (ns_name)
1550 return snprintf(str, size, ":%s:%s", ns_name,
1551 profile->base.hname);
1552 return snprintf(str, size, "%s", profile->base.hname);
1553 }
1554
1555 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1556 int flags)
1557 {
1558 struct aa_profile *profile;
1559 struct label_it i;
1560 int mode = -1, count = 0;
1561
1562 label_for_each(i, label, profile) {
1563 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1564 count++;
1565 if (profile == profile->ns->unconfined)
1566 /* special case unconfined so stacks with
1567 * unconfined don't report as mixed. ie.
1568 * profile_foo//&:ns1:unconfined (mixed)
1569 */
1570 continue;
1571 if (mode == -1)
1572 mode = profile->mode;
1573 else if (mode != profile->mode)
1574 return "mixed";
1575 }
1576 }
1577
1578 if (count == 0)
1579 return "-";
1580 if (mode == -1)
1581 /* everything was unconfined */
1582 mode = APPARMOR_UNCONFINED;
1583
1584 return aa_profile_mode_names[mode];
1585 }
1586
1587 /* if any visible label is not unconfined the display_mode returns true */
1588 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1589 int flags)
1590 {
1591 if ((flags & FLAG_SHOW_MODE)) {
1592 struct aa_profile *profile;
1593 struct label_it i;
1594
1595 label_for_each(i, label, profile) {
1596 if (aa_ns_visible(ns, profile->ns,
1597 flags & FLAG_VIEW_SUBNS) &&
1598 profile != profile->ns->unconfined)
1599 return true;
1600 }
1601 /* only ns->unconfined in set of profiles in ns */
1602 return false;
1603 }
1604
1605 return false;
1606 }
1607
1608 /**
1609 * aa_label_snxprint - print a label name to a string buffer
1610 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1611 * @size: size of buffer
1612 * @ns: namespace profile is being viewed from
1613 * @label: label to view (NOT NULL)
1614 * @flags: whether to include the mode string
1615 *
1616 * Returns: size of name written or would be written if larger than
1617 * available buffer
1618 *
1619 * Note: labels do not have to be strictly hierarchical to the ns as
1620 * objects may be shared across different namespaces and thus
1621 * pickup labeling from each ns. If a particular part of the
1622 * label is not visible it will just be excluded. And if none
1623 * of the label is visible "---" will be used.
1624 */
1625 int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1626 struct aa_label *label, int flags)
1627 {
1628 struct aa_profile *profile;
1629 struct aa_ns *prev_ns = NULL;
1630 struct label_it i;
1631 int count = 0, total = 0;
1632 ssize_t len;
1633
1634 AA_BUG(!str && size != 0);
1635 AA_BUG(!label);
1636
1637 if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
1638 ns = root_ns;
1639 len = snprintf(str, size, "_");
1640 update_for_len(total, len, size, str);
1641 } else if (!ns) {
1642 ns = labels_ns(label);
1643 }
1644
1645 label_for_each(i, label, profile) {
1646 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1647 if (count > 0) {
1648 len = snprintf(str, size, "//&");
1649 update_for_len(total, len, size, str);
1650 }
1651 len = aa_profile_snxprint(str, size, ns, profile,
1652 flags & FLAG_VIEW_SUBNS,
1653 &prev_ns);
1654 update_for_len(total, len, size, str);
1655 count++;
1656 }
1657 }
1658
1659 if (count == 0) {
1660 if (flags & FLAG_HIDDEN_UNCONFINED)
1661 return snprintf(str, size, "%s", "unconfined");
1662 return snprintf(str, size, "%s", aa_hidden_ns_name);
1663 }
1664
1665 /* count == 1 && ... is for backwards compat where the mode
1666 * is not displayed for 'unconfined' in the current ns
1667 */
1668 if (display_mode(ns, label, flags)) {
1669 len = snprintf(str, size, " (%s)",
1670 label_modename(ns, label, flags));
1671 update_for_len(total, len, size, str);
1672 }
1673
1674 return total;
1675 }
1676 #undef update_for_len
1677
1678 /**
1679 * aa_label_asxprint - allocate a string buffer and print label into it
1680 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1681 * @ns: namespace profile is being viewed from
1682 * @label: label to view (NOT NULL)
1683 * @flags: flags controlling what label info is printed
1684 * @gfp: kernel memory allocation type
1685 *
1686 * Returns: size of name written or would be written if larger than
1687 * available buffer
1688 */
1689 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1690 int flags, gfp_t gfp)
1691 {
1692 int size;
1693
1694 AA_BUG(!strp);
1695 AA_BUG(!label);
1696
1697 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1698 if (size < 0)
1699 return size;
1700
1701 *strp = kmalloc(size + 1, gfp);
1702 if (!*strp)
1703 return -ENOMEM;
1704 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1705 }
1706
1707 /**
1708 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1709 * @strp: buffer to write to.
1710 * @ns: namespace profile is being viewed from
1711 * @label: label to view (NOT NULL)
1712 * @flags: flags controlling what label info is printed
1713 * @gfp: kernel memory allocation type
1714 *
1715 * Returns: size of name written or would be written if larger than
1716 * available buffer
1717 */
1718 int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1719 struct aa_label *label, int flags, gfp_t gfp)
1720 {
1721 int size;
1722
1723 AA_BUG(!strp);
1724 AA_BUG(!label);
1725
1726 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1727 if (size < 0)
1728 return size;
1729
1730 *strp = aa_str_alloc(size + 1, gfp);
1731 if (!*strp)
1732 return -ENOMEM;
1733 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1734 }
1735
1736
1737 void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1738 struct aa_label *label, int flags, gfp_t gfp)
1739 {
1740 const char *str;
1741 char *name = NULL;
1742 int len;
1743
1744 AA_BUG(!ab);
1745 AA_BUG(!label);
1746
1747 if (!use_label_hname(ns, label, flags) ||
1748 display_mode(ns, label, flags)) {
1749 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1750 if (len < 0) {
1751 AA_DEBUG("label print error");
1752 return;
1753 }
1754 str = name;
1755 } else {
1756 str = (char *) label->hname;
1757 len = strlen(str);
1758 }
1759 if (audit_string_contains_control(str, len))
1760 audit_log_n_hex(ab, str, len);
1761 else
1762 audit_log_n_string(ab, str, len);
1763
1764 kfree(name);
1765 }
1766
1767 void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1768 struct aa_label *label, int flags, gfp_t gfp)
1769 {
1770 AA_BUG(!f);
1771 AA_BUG(!label);
1772
1773 if (!use_label_hname(ns, label, flags)) {
1774 char *str;
1775 int len;
1776
1777 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1778 if (len < 0) {
1779 AA_DEBUG("label print error");
1780 return;
1781 }
1782 seq_puts(f, str);
1783 kfree(str);
1784 } else if (display_mode(ns, label, flags))
1785 seq_printf(f, "%s (%s)", label->hname,
1786 label_modename(ns, label, flags));
1787 else
1788 seq_puts(f, label->hname);
1789 }
1790
1791 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1792 gfp_t gfp)
1793 {
1794 AA_BUG(!label);
1795
1796 if (!use_label_hname(ns, label, flags)) {
1797 char *str;
1798 int len;
1799
1800 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1801 if (len < 0) {
1802 AA_DEBUG("label print error");
1803 return;
1804 }
1805 pr_info("%s", str);
1806 kfree(str);
1807 } else if (display_mode(ns, label, flags))
1808 pr_info("%s (%s)", label->hname,
1809 label_modename(ns, label, flags));
1810 else
1811 pr_info("%s", label->hname);
1812 }
1813
1814 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1815 {
1816 struct aa_ns *ns = aa_get_current_ns();
1817
1818 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1819 aa_put_ns(ns);
1820 }
1821
1822 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1823 {
1824 struct aa_ns *ns = aa_get_current_ns();
1825
1826 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1827 aa_put_ns(ns);
1828 }
1829
1830 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1831 {
1832 struct aa_ns *ns = aa_get_current_ns();
1833
1834 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1835 aa_put_ns(ns);
1836 }
1837
1838 static int label_count_strn_entries(const char *str, size_t n)
1839 {
1840 const char *end = str + n;
1841 const char *split;
1842 int count = 1;
1843
1844 AA_BUG(!str);
1845
1846 for (split = aa_label_strn_split(str, end - str);
1847 split;
1848 split = aa_label_strn_split(str, end - str)) {
1849 count++;
1850 str = split + 3;
1851 }
1852
1853 return count;
1854 }
1855
1856 /*
1857 * ensure stacks with components like
1858 * :ns:A//&B
1859 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1860 * to the base if the lookup specifies an ns, else making the stacked lookup
1861 * relative to the last embedded ns in the string.
1862 */
1863 static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1864 struct aa_label *currentbase,
1865 const char *str, size_t n)
1866 {
1867 const char *first = skipn_spaces(str, n);
1868
1869 if (first && *first == ':')
1870 return aa_fqlookupn_profile(base, str, n);
1871
1872 return aa_fqlookupn_profile(currentbase, str, n);
1873 }
1874
1875 /**
1876 * aa_label_strn_parse - parse, validate and convert a text string to a label
1877 * @base: base label to use for lookups (NOT NULL)
1878 * @str: null terminated text string (NOT NULL)
1879 * @n: length of str to parse, will stop at \0 if encountered before n
1880 * @gfp: allocation type
1881 * @create: true if should create compound labels if they don't exist
1882 * @force_stack: true if should stack even if no leading &
1883 *
1884 * Returns: the matching refcounted label if present
1885 * else ERRPTR
1886 */
1887 struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1888 size_t n, gfp_t gfp, bool create,
1889 bool force_stack)
1890 {
1891 DEFINE_VEC(profile, vec);
1892 struct aa_label *label, *currbase = base;
1893 int i, len, stack = 0, error;
1894 const char *end = str + n;
1895 const char *split;
1896
1897 AA_BUG(!base);
1898 AA_BUG(!str);
1899
1900 str = skipn_spaces(str, n);
1901 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
1902 base != &root_ns->unconfined->label))
1903 return ERR_PTR(-EINVAL);
1904
1905 len = label_count_strn_entries(str, end - str);
1906 if (*str == '&' || force_stack) {
1907 /* stack on top of base */
1908 stack = base->size;
1909 len += stack;
1910 if (*str == '&')
1911 str++;
1912 }
1913
1914 error = vec_setup(profile, vec, len, gfp);
1915 if (error)
1916 return ERR_PTR(error);
1917
1918 for (i = 0; i < stack; i++)
1919 vec[i] = aa_get_profile(base->vec[i]);
1920
1921 for (split = aa_label_strn_split(str, end - str), i = stack;
1922 split && i < len; i++) {
1923 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1924 if (!vec[i])
1925 goto fail;
1926 /*
1927 * if component specified a new ns it becomes the new base
1928 * so that subsequent lookups are relative to it
1929 */
1930 if (vec[i]->ns != labels_ns(currbase))
1931 currbase = &vec[i]->label;
1932 str = split + 3;
1933 split = aa_label_strn_split(str, end - str);
1934 }
1935 /* last element doesn't have a split */
1936 if (i < len) {
1937 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1938 if (!vec[i])
1939 goto fail;
1940 }
1941 if (len == 1)
1942 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1943 return &vec[0]->label;
1944
1945 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1946 /* TODO: deal with reference labels */
1947 if (len == 1) {
1948 label = aa_get_label(&vec[0]->label);
1949 goto out;
1950 }
1951
1952 if (create)
1953 label = aa_vec_find_or_create_label(vec, len, gfp);
1954 else
1955 label = vec_find(vec, len);
1956 if (!label)
1957 goto fail;
1958
1959 out:
1960 /* use adjusted len from after vec_unique, not original */
1961 vec_cleanup(profile, vec, len);
1962 return label;
1963
1964 fail:
1965 label = ERR_PTR(-ENOENT);
1966 goto out;
1967 }
1968
1969 struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1970 gfp_t gfp, bool create, bool force_stack)
1971 {
1972 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1973 force_stack);
1974 }
1975
1976 /**
1977 * aa_labelset_destroy - remove all labels from the label set
1978 * @ls: label set to cleanup (NOT NULL)
1979 *
1980 * Labels that are removed from the set may still exist beyond the set
1981 * being destroyed depending on their reference counting
1982 */
1983 void aa_labelset_destroy(struct aa_labelset *ls)
1984 {
1985 struct rb_node *node;
1986 unsigned long flags;
1987
1988 AA_BUG(!ls);
1989
1990 write_lock_irqsave(&ls->lock, flags);
1991 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1992 struct aa_label *this = rb_entry(node, struct aa_label, node);
1993
1994 if (labels_ns(this) != root_ns)
1995 __label_remove(this,
1996 ns_unconfined(labels_ns(this)->parent));
1997 else
1998 __label_remove(this, NULL);
1999 }
2000 write_unlock_irqrestore(&ls->lock, flags);
2001 }
2002
2003 /*
2004 * @ls: labelset to init (NOT NULL)
2005 */
2006 void aa_labelset_init(struct aa_labelset *ls)
2007 {
2008 AA_BUG(!ls);
2009
2010 rwlock_init(&ls->lock);
2011 ls->root = RB_ROOT;
2012 }
2013
2014 static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2015 {
2016 struct aa_label *label;
2017 struct rb_node *node;
2018 unsigned long flags;
2019
2020 AA_BUG(!ls);
2021
2022 read_lock_irqsave(&ls->lock, flags);
2023
2024 __labelset_for_each(ls, node) {
2025 label = rb_entry(node, struct aa_label, node);
2026 if ((label_is_stale(label) ||
2027 vec_is_stale(label->vec, label->size)) &&
2028 __aa_get_label(label))
2029 goto out;
2030
2031 }
2032 label = NULL;
2033
2034 out:
2035 read_unlock_irqrestore(&ls->lock, flags);
2036
2037 return label;
2038 }
2039
2040 /**
2041 * __label_update - insert updated version of @label into labelset
2042 * @label: the label to update/replace
2043 *
2044 * Returns: new label that is up to date
2045 * else NULL on failure
2046 *
2047 * Requires: @ns lock be held
2048 *
2049 * Note: worst case is the stale @label does not get updated and has
2050 * to be updated at a later time.
2051 */
2052 static struct aa_label *__label_update(struct aa_label *label)
2053 {
2054 struct aa_label *new, *tmp;
2055 struct aa_labelset *ls;
2056 unsigned long flags;
2057 int i, invcount = 0;
2058
2059 AA_BUG(!label);
2060 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2061
2062 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2063 if (!new)
2064 return NULL;
2065
2066 /*
2067 * while holding the ns_lock will stop profile replacement, removal,
2068 * and label updates, label merging and removal can be occurring
2069 */
2070 ls = labels_set(label);
2071 write_lock_irqsave(&ls->lock, flags);
2072 for (i = 0; i < label->size; i++) {
2073 AA_BUG(!label->vec[i]);
2074 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2075 AA_BUG(!new->vec[i]);
2076 AA_BUG(!new->vec[i]->label.proxy);
2077 AA_BUG(!new->vec[i]->label.proxy->label);
2078 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2079 invcount++;
2080 }
2081
2082 /* updated stale label by being removed/renamed from labelset */
2083 if (invcount) {
2084 new->size -= aa_vec_unique(&new->vec[0], new->size,
2085 VEC_FLAG_TERMINATE);
2086 /* TODO: deal with reference labels */
2087 if (new->size == 1) {
2088 tmp = aa_get_label(&new->vec[0]->label);
2089 AA_BUG(tmp == label);
2090 goto remove;
2091 }
2092 if (labels_set(label) != labels_set(new)) {
2093 write_unlock_irqrestore(&ls->lock, flags);
2094 tmp = aa_label_insert(labels_set(new), new);
2095 write_lock_irqsave(&ls->lock, flags);
2096 goto remove;
2097 }
2098 } else
2099 AA_BUG(labels_ns(label) != labels_ns(new));
2100
2101 tmp = __label_insert(labels_set(label), new, true);
2102 remove:
2103 /* ensure label is removed, and redirected correctly */
2104 __label_remove(label, tmp);
2105 write_unlock_irqrestore(&ls->lock, flags);
2106 label_free_or_put_new(tmp, new);
2107
2108 return tmp;
2109 }
2110
2111 /**
2112 * __labelset_update - update labels in @ns
2113 * @ns: namespace to update labels in (NOT NULL)
2114 *
2115 * Requires: @ns lock be held
2116 *
2117 * Walk the labelset ensuring that all labels are up to date and valid
2118 * Any label that has a stale component is marked stale and replaced and
2119 * by an updated version.
2120 *
2121 * If failures happen due to memory pressures then stale labels will
2122 * be left in place until the next pass.
2123 */
2124 static void __labelset_update(struct aa_ns *ns)
2125 {
2126 struct aa_label *label;
2127
2128 AA_BUG(!ns);
2129 AA_BUG(!mutex_is_locked(&ns->lock));
2130
2131 do {
2132 label = labelset_next_stale(&ns->labels);
2133 if (label) {
2134 struct aa_label *l = __label_update(label);
2135
2136 aa_put_label(l);
2137 aa_put_label(label);
2138 }
2139 } while (label);
2140 }
2141
2142 /**
2143 * __aa_labelset_update_subtree - update all labels with a stale component
2144 * @ns: ns to start update at (NOT NULL)
2145 *
2146 * Requires: @ns lock be held
2147 *
2148 * Invalidates labels based on @p in @ns and any children namespaces.
2149 */
2150 void __aa_labelset_update_subtree(struct aa_ns *ns)
2151 {
2152 struct aa_ns *child;
2153
2154 AA_BUG(!ns);
2155 AA_BUG(!mutex_is_locked(&ns->lock));
2156
2157 __labelset_update(ns);
2158
2159 list_for_each_entry(child, &ns->sub_ns, base.list) {
2160 mutex_lock_nested(&child->lock, child->level);
2161 __aa_labelset_update_subtree(child);
2162 mutex_unlock(&child->lock);
2163 }
2164 }
2165
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.