1
2
3
4
5
6
7
8
9
10
11
12
13
14#include <linux/audit.h>
15#include <linux/seq_file.h>
16#include <linux/sort.h>
17
18#include "include/apparmor.h"
19#include "include/cred.h"
20#include "include/label.h"
21#include "include/policy.h"
22#include "include/secid.h"
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43#define PROXY_POISON 97
44#define LABEL_POISON 100
45
46static void free_proxy(struct aa_proxy *proxy)
47{
48 if (proxy) {
49
50 aa_put_label(rcu_dereference_protected(proxy->label, true));
51 memset(proxy, 0, sizeof(*proxy));
52 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
53 kfree(proxy);
54 }
55}
56
57void aa_proxy_kref(struct kref *kref)
58{
59 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
60
61 free_proxy(proxy);
62}
63
64struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
65{
66 struct aa_proxy *new;
67
68 new = kzalloc(sizeof(struct aa_proxy), gfp);
69 if (new) {
70 kref_init(&new->count);
71 rcu_assign_pointer(new->label, aa_get_label(label));
72 }
73 return new;
74}
75
76
77void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
78{
79 struct aa_label *tmp;
80
81 AA_BUG(!orig);
82 AA_BUG(!new);
83 lockdep_assert_held_exclusive(&labels_set(orig)->lock);
84
85 tmp = rcu_dereference_protected(orig->proxy->label,
86 &labels_ns(orig)->lock);
87 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
88 orig->flags |= FLAG_STALE;
89 aa_put_label(tmp);
90}
91
92static void __proxy_share(struct aa_label *old, struct aa_label *new)
93{
94 struct aa_proxy *proxy = new->proxy;
95
96 new->proxy = aa_get_proxy(old->proxy);
97 __aa_proxy_redirect(old, new);
98 aa_put_proxy(proxy);
99}
100
101
102
103
104
105
106
107
108
109
110
111static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
112{
113 int res;
114
115 AA_BUG(!a);
116 AA_BUG(!b);
117 AA_BUG(!a->base.hname);
118 AA_BUG(!b->base.hname);
119
120 if (a == b)
121 return 0;
122
123 res = a->level - b->level;
124 if (res)
125 return res;
126
127 return strcmp(a->base.hname, b->base.hname);
128}
129
130
131
132
133
134
135
136
137
138
139static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
140{
141 int res;
142
143 AA_BUG(!a);
144 AA_BUG(!b);
145 AA_BUG(!a->ns);
146 AA_BUG(!b->ns);
147 AA_BUG(!a->base.hname);
148 AA_BUG(!b->base.hname);
149
150 if (a == b || a->base.hname == b->base.hname)
151 return 0;
152 res = ns_cmp(a->ns, b->ns);
153 if (res)
154 return res;
155
156 return strcmp(a->base.hname, b->base.hname);
157}
158
159
160
161
162
163
164
165
166
167
168
169static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
170{
171 int i;
172
173 AA_BUG(!a);
174 AA_BUG(!*a);
175 AA_BUG(!b);
176 AA_BUG(!*b);
177 AA_BUG(an <= 0);
178 AA_BUG(bn <= 0);
179
180 for (i = 0; i < an && i < bn; i++) {
181 int res = profile_cmp(a[i], b[i]);
182
183 if (res != 0)
184 return res;
185 }
186
187 return an - bn;
188}
189
190static bool vec_is_stale(struct aa_profile **vec, int n)
191{
192 int i;
193
194 AA_BUG(!vec);
195
196 for (i = 0; i < n; i++) {
197 if (profile_is_stale(vec[i]))
198 return true;
199 }
200
201 return false;
202}
203
204static bool vec_unconfined(struct aa_profile **vec, int n)
205{
206 int i;
207
208 AA_BUG(!vec);
209
210 for (i = 0; i < n; i++) {
211 if (!profile_unconfined(vec[i]))
212 return false;
213 }
214
215 return true;
216}
217
218static int sort_cmp(const void *a, const void *b)
219{
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
221}
222
223
224
225
226
227
228static inline int unique(struct aa_profile **vec, int n)
229{
230 int i, pos, dups = 0;
231
232 AA_BUG(n < 1);
233 AA_BUG(!vec);
234
235 pos = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
238
239 AA_BUG(res > 0, "vec not sorted");
240 if (res == 0) {
241
242 aa_put_profile(vec[i]);
243 dups++;
244 continue;
245 }
246 pos++;
247 if (dups)
248 vec[pos] = vec[i];
249 }
250
251 AA_BUG(dups < 0);
252
253 return dups;
254}
255
256
257
258
259
260
261
262
263
264
265
266int aa_vec_unique(struct aa_profile **vec, int n, int flags)
267{
268 int i, dups = 0;
269
270 AA_BUG(n < 1);
271 AA_BUG(!vec);
272
273
274 if (n > 8) {
275 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
276 dups = unique(vec, n);
277 goto out;
278 }
279
280
281 for (i = 1; i < n; i++) {
282 struct aa_profile *tmp = vec[i];
283 int pos, j;
284
285 for (pos = i - 1 - dups; pos >= 0; pos--) {
286 int res = profile_cmp(vec[pos], tmp);
287
288 if (res == 0) {
289
290 aa_put_profile(tmp);
291 dups++;
292 goto continue_outer;
293 } else if (res < 0)
294 break;
295 }
296
297 pos++;
298
299 for (j = i - dups; j > pos; j--)
300 vec[j] = vec[j - 1];
301 vec[pos] = tmp;
302continue_outer:
303 ;
304 }
305
306 AA_BUG(dups < 0);
307
308out:
309 if (flags & VEC_FLAG_TERMINATE)
310 vec[n - dups] = NULL;
311
312 return dups;
313}
314
315
316static void label_destroy(struct aa_label *label)
317{
318 struct aa_label *tmp;
319
320 AA_BUG(!label);
321
322 if (!label_isprofile(label)) {
323 struct aa_profile *profile;
324 struct label_it i;
325
326 aa_put_str(label->hname);
327
328 label_for_each(i, label, profile) {
329 aa_put_profile(profile);
330 label->vec[i.i] = (struct aa_profile *)
331 (LABEL_POISON + (long) i.i);
332 }
333 }
334
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
337
338 aa_free_secid(label->secid);
339
340 tmp = rcu_dereference_protected(label->proxy->label, true);
341 if (tmp == label)
342 rcu_assign_pointer(label->proxy->label, NULL);
343
344 aa_put_proxy(label->proxy);
345 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
346}
347
348void aa_label_free(struct aa_label *label)
349{
350 if (!label)
351 return;
352
353 label_destroy(label);
354 kfree(label);
355}
356
357static void label_free_switch(struct aa_label *label)
358{
359 if (label->flags & FLAG_NS_COUNT)
360 aa_free_ns(labels_ns(label));
361 else if (label_isprofile(label))
362 aa_free_profile(labels_profile(label));
363 else
364 aa_label_free(label);
365}
366
367static void label_free_rcu(struct rcu_head *head)
368{
369 struct aa_label *label = container_of(head, struct aa_label, rcu);
370
371 if (label->flags & FLAG_IN_TREE)
372 (void) aa_label_remove(label);
373 label_free_switch(label);
374}
375
376void aa_label_kref(struct kref *kref)
377{
378 struct aa_label *label = container_of(kref, struct aa_label, count);
379 struct aa_ns *ns = labels_ns(label);
380
381 if (!ns) {
382
383 label_free_switch(label);
384 return;
385 }
386
387 AA_BUG(label_isprofile(label) &&
388 on_list_rcu(&label->vec[0]->base.profiles));
389 AA_BUG(label_isprofile(label) &&
390 on_list_rcu(&label->vec[0]->base.list));
391
392
393 call_rcu(&label->rcu, label_free_rcu);
394}
395
396static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
397{
398 if (label != new)
399
400 aa_label_free(new);
401 else
402 aa_put_label(new);
403}
404
405bool aa_label_init(struct aa_label *label, int size)
406{
407 AA_BUG(!label);
408 AA_BUG(size < 1);
409
410 label->secid = aa_alloc_secid();
411 if (label->secid == AA_SECID_INVALID)
412 return false;
413
414 label->size = size;
415 label->vec[size] = NULL;
416 kref_init(&label->count);
417 RB_CLEAR_NODE(&label->node);
418
419 return true;
420}
421
422
423
424
425
426
427
428
429
430
431struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
432{
433 struct aa_label *new;
434
435 AA_BUG(size < 1);
436
437
438 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
439 gfp);
440 AA_DEBUG("%s (%p)\n", __func__, new);
441 if (!new)
442 goto fail;
443
444 if (!aa_label_init(new, size))
445 goto fail;
446
447 if (!proxy) {
448 proxy = aa_alloc_proxy(new, gfp);
449 if (!proxy)
450 goto fail;
451 } else
452 aa_get_proxy(proxy);
453
454 new->proxy = proxy;
455
456 return new;
457
458fail:
459 kfree(new);
460
461 return NULL;
462}
463
464
465
466
467
468
469
470
471
472
473
474static int label_cmp(struct aa_label *a, struct aa_label *b)
475{
476 AA_BUG(!b);
477
478 if (a == b)
479 return 0;
480
481 return vec_cmp(a->vec, a->size, b->vec, b->size);
482}
483
484
485int aa_label_next_confined(struct aa_label *label, int i)
486{
487 AA_BUG(!label);
488 AA_BUG(i < 0);
489
490 for (; i < label->size; i++) {
491 if (!profile_unconfined(label->vec[i]))
492 return i;
493 }
494
495 return i;
496}
497
498
499
500
501
502
503
504
505
506
507struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
508 struct aa_label *set,
509 struct aa_label *sub)
510{
511 AA_BUG(!set);
512 AA_BUG(!I);
513 AA_BUG(I->i < 0);
514 AA_BUG(I->i > set->size);
515 AA_BUG(!sub);
516 AA_BUG(I->j < 0);
517 AA_BUG(I->j > sub->size);
518
519 while (I->j < sub->size && I->i < set->size) {
520 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
521
522 if (res == 0) {
523 (I->j)++;
524 (I->i)++;
525 } else if (res > 0)
526 (I->i)++;
527 else
528 return sub->vec[(I->j)++];
529 }
530
531 if (I->j < sub->size)
532 return sub->vec[(I->j)++];
533
534 return NULL;
535}
536
537
538
539
540
541
542
543
544
545bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
546{
547 struct label_it i = { };
548
549 AA_BUG(!set);
550 AA_BUG(!sub);
551
552 if (sub == set)
553 return true;
554
555 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
556}
557
558
559
560
561
562
563
564
565
566
567
568static bool __label_remove(struct aa_label *label, struct aa_label *new)
569{
570 struct aa_labelset *ls = labels_set(label);
571
572 AA_BUG(!ls);
573 AA_BUG(!label);
574 lockdep_assert_held_exclusive(&ls->lock);
575
576 if (new)
577 __aa_proxy_redirect(label, new);
578
579 if (!label_is_stale(label))
580 __label_make_stale(label);
581
582 if (label->flags & FLAG_IN_TREE) {
583 rb_erase(&label->node, &ls->root);
584 label->flags &= ~FLAG_IN_TREE;
585 return true;
586 }
587
588 return false;
589}
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604static bool __label_replace(struct aa_label *old, struct aa_label *new)
605{
606 struct aa_labelset *ls = labels_set(old);
607
608 AA_BUG(!ls);
609 AA_BUG(!old);
610 AA_BUG(!new);
611 lockdep_assert_held_exclusive(&ls->lock);
612 AA_BUG(new->flags & FLAG_IN_TREE);
613
614 if (!label_is_stale(old))
615 __label_make_stale(old);
616
617 if (old->flags & FLAG_IN_TREE) {
618 rb_replace_node(&old->node, &new->node, &ls->root);
619 old->flags &= ~FLAG_IN_TREE;
620 new->flags |= FLAG_IN_TREE;
621 return true;
622 }
623
624 return false;
625}
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640static struct aa_label *__label_insert(struct aa_labelset *ls,
641 struct aa_label *label, bool replace)
642{
643 struct rb_node **new, *parent = NULL;
644
645 AA_BUG(!ls);
646 AA_BUG(!label);
647 AA_BUG(labels_set(label) != ls);
648 lockdep_assert_held_exclusive(&ls->lock);
649 AA_BUG(label->flags & FLAG_IN_TREE);
650
651
652 new = &ls->root.rb_node;
653 while (*new) {
654 struct aa_label *this = rb_entry(*new, struct aa_label, node);
655 int result = label_cmp(label, this);
656
657 parent = *new;
658 if (result == 0) {
659
660
661
662
663
664 if (!replace && !label_is_stale(this)) {
665 if (__aa_get_label(this))
666 return this;
667 } else
668 __proxy_share(this, label);
669 AA_BUG(!__label_replace(this, label));
670 return aa_get_label(label);
671 } else if (result < 0)
672 new = &((*new)->rb_left);
673 else
674 new = &((*new)->rb_right);
675 }
676
677
678 rb_link_node(&label->node, parent, new);
679 rb_insert_color(&label->node, &ls->root);
680 label->flags |= FLAG_IN_TREE;
681
682 return aa_get_label(label);
683}
684
685
686
687
688
689
690
691
692
693
694
695
696
697static struct aa_label *__vec_find(struct aa_profile **vec, int n)
698{
699 struct rb_node *node;
700
701 AA_BUG(!vec);
702 AA_BUG(!*vec);
703 AA_BUG(n <= 0);
704
705 node = vec_labelset(vec, n)->root.rb_node;
706 while (node) {
707 struct aa_label *this = rb_entry(node, struct aa_label, node);
708 int result = vec_cmp(this->vec, this->size, vec, n);
709
710 if (result > 0)
711 node = node->rb_left;
712 else if (result < 0)
713 node = node->rb_right;
714 else
715 return __aa_get_label(this);
716 }
717
718 return NULL;
719}
720
721
722
723
724
725
726
727
728
729
730
731
732static struct aa_label *__label_find(struct aa_label *label)
733{
734 AA_BUG(!label);
735
736 return __vec_find(label->vec, label->size);
737}
738
739
740
741
742
743
744
745
746
747bool aa_label_remove(struct aa_label *label)
748{
749 struct aa_labelset *ls = labels_set(label);
750 unsigned long flags;
751 bool res;
752
753 AA_BUG(!ls);
754
755 write_lock_irqsave(&ls->lock, flags);
756 res = __label_remove(label, ns_unconfined(labels_ns(label)));
757 write_unlock_irqrestore(&ls->lock, flags);
758
759 return res;
760}
761
762
763
764
765
766
767
768
769
770bool aa_label_replace(struct aa_label *old, struct aa_label *new)
771{
772 unsigned long flags;
773 bool res;
774
775 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
776 write_lock_irqsave(&labels_set(old)->lock, flags);
777 if (old->proxy != new->proxy)
778 __proxy_share(old, new);
779 else
780 __aa_proxy_redirect(old, new);
781 res = __label_replace(old, new);
782 write_unlock_irqrestore(&labels_set(old)->lock, flags);
783 } else {
784 struct aa_label *l;
785 struct aa_labelset *ls = labels_set(old);
786
787 write_lock_irqsave(&ls->lock, flags);
788 res = __label_remove(old, new);
789 if (labels_ns(old) != labels_ns(new)) {
790 write_unlock_irqrestore(&ls->lock, flags);
791 ls = labels_set(new);
792 write_lock_irqsave(&ls->lock, flags);
793 }
794 l = __label_insert(ls, new, true);
795 res = (l == new);
796 write_unlock_irqrestore(&ls->lock, flags);
797 aa_put_label(l);
798 }
799
800 return res;
801}
802
803
804
805
806
807
808
809
810
811static struct aa_label *vec_find(struct aa_profile **vec, int n)
812{
813 struct aa_labelset *ls;
814 struct aa_label *label;
815 unsigned long flags;
816
817 AA_BUG(!vec);
818 AA_BUG(!*vec);
819 AA_BUG(n <= 0);
820
821 ls = vec_labelset(vec, n);
822 read_lock_irqsave(&ls->lock, flags);
823 label = __vec_find(vec, n);
824 read_unlock_irqrestore(&ls->lock, flags);
825
826 return label;
827}
828
829
830static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
831 int len, gfp_t gfp)
832{
833 struct aa_label *label = NULL;
834 struct aa_labelset *ls;
835 unsigned long flags;
836 struct aa_label *new;
837 int i;
838
839 AA_BUG(!vec);
840
841 if (len == 1)
842 return aa_get_label(&vec[0]->label);
843
844 ls = labels_set(&vec[len - 1]->label);
845
846
847
848
849 new = aa_label_alloc(len, NULL, gfp);
850 if (!new)
851 return NULL;
852
853 for (i = 0; i < len; i++)
854 new->vec[i] = aa_get_profile(vec[i]);
855
856 write_lock_irqsave(&ls->lock, flags);
857 label = __label_insert(ls, new, false);
858 write_unlock_irqrestore(&ls->lock, flags);
859 label_free_or_put_new(label, new);
860
861 return label;
862}
863
864struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
865 gfp_t gfp)
866{
867 struct aa_label *label = vec_find(vec, len);
868
869 if (label)
870 return label;
871
872 return vec_create_and_insert_label(vec, len, gfp);
873}
874
875
876
877
878
879
880
881
882
883
884
885struct aa_label *aa_label_find(struct aa_label *label)
886{
887 AA_BUG(!label);
888
889 return vec_find(label->vec, label->size);
890}
891
892
893
894
895
896
897
898
899
900
901
902
903struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
904{
905 struct aa_label *l;
906 unsigned long flags;
907
908 AA_BUG(!ls);
909 AA_BUG(!label);
910
911
912 if (!label_is_stale(label)) {
913 read_lock_irqsave(&ls->lock, flags);
914 l = __label_find(label);
915 read_unlock_irqrestore(&ls->lock, flags);
916 if (l)
917 return l;
918 }
919
920 write_lock_irqsave(&ls->lock, flags);
921 l = __label_insert(ls, label, false);
922 write_unlock_irqrestore(&ls->lock, flags);
923
924 return l;
925}
926
927
928
929
930
931
932
933
934
935
936
937struct aa_profile *aa_label_next_in_merge(struct label_it *I,
938 struct aa_label *a,
939 struct aa_label *b)
940{
941 AA_BUG(!a);
942 AA_BUG(!b);
943 AA_BUG(!I);
944 AA_BUG(I->i < 0);
945 AA_BUG(I->i > a->size);
946 AA_BUG(I->j < 0);
947 AA_BUG(I->j > b->size);
948
949 if (I->i < a->size) {
950 if (I->j < b->size) {
951 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
952
953 if (res > 0)
954 return b->vec[(I->j)++];
955 if (res == 0)
956 (I->j)++;
957 }
958
959 return a->vec[(I->i)++];
960 }
961
962 if (I->j < b->size)
963 return b->vec[(I->j)++];
964
965 return NULL;
966}
967
968
969
970
971
972
973
974
975
976
977
978
979
980static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
981 struct aa_label *z)
982{
983 struct aa_profile *p = NULL;
984 struct label_it i = { };
985 int k;
986
987 AA_BUG(!a);
988 AA_BUG(!b);
989 AA_BUG(!z);
990
991 for (k = 0;
992 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
993 k++) {
994 int res = profile_cmp(p, z->vec[k]);
995
996 if (res != 0)
997 return res;
998 }
999
1000 if (p)
1001 return 1;
1002 else if (k < z->size)
1003 return -1;
1004 return 0;
1005}
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024static struct aa_label *label_merge_insert(struct aa_label *new,
1025 struct aa_label *a,
1026 struct aa_label *b)
1027{
1028 struct aa_label *label;
1029 struct aa_labelset *ls;
1030 struct aa_profile *next;
1031 struct label_it i;
1032 unsigned long flags;
1033 int k = 0, invcount = 0;
1034 bool stale = false;
1035
1036 AA_BUG(!a);
1037 AA_BUG(a->size < 0);
1038 AA_BUG(!b);
1039 AA_BUG(b->size < 0);
1040 AA_BUG(!new);
1041 AA_BUG(new->size < a->size + b->size);
1042
1043 label_for_each_in_merge(i, a, b, next) {
1044 AA_BUG(!next);
1045 if (profile_is_stale(next)) {
1046 new->vec[k] = aa_get_newest_profile(next);
1047 AA_BUG(!new->vec[k]->label.proxy);
1048 AA_BUG(!new->vec[k]->label.proxy->label);
1049 if (next->label.proxy != new->vec[k]->label.proxy)
1050 invcount++;
1051 k++;
1052 stale = true;
1053 } else
1054 new->vec[k++] = aa_get_profile(next);
1055 }
1056
1057 new->size = k;
1058 new->vec[k] = NULL;
1059
1060 if (invcount) {
1061 new->size -= aa_vec_unique(&new->vec[0], new->size,
1062 VEC_FLAG_TERMINATE);
1063
1064 if (new->size == 1) {
1065 label = aa_get_label(&new->vec[0]->label);
1066 return label;
1067 }
1068 } else if (!stale) {
1069
1070
1071
1072
1073 if (k == a->size)
1074 return aa_get_label(a);
1075 else if (k == b->size)
1076 return aa_get_label(b);
1077 }
1078 if (vec_unconfined(new->vec, new->size))
1079 new->flags |= FLAG_UNCONFINED;
1080 ls = labels_set(new);
1081 write_lock_irqsave(&ls->lock, flags);
1082 label = __label_insert(labels_set(new), new, false);
1083 write_unlock_irqrestore(&ls->lock, flags);
1084
1085 return label;
1086}
1087
1088
1089
1090
1091
1092
1093
1094
1095static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1096 struct aa_label *b)
1097{
1098 struct aa_ns *nsa = labels_ns(a);
1099 struct aa_ns *nsb = labels_ns(b);
1100
1101 if (ns_cmp(nsa, nsb) <= 0)
1102 return &nsa->labels;
1103 return &nsb->labels;
1104}
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1118 struct aa_label *a,
1119 struct aa_label *b)
1120{
1121 struct rb_node *node;
1122
1123 AA_BUG(!ls);
1124 AA_BUG(!a);
1125 AA_BUG(!b);
1126
1127 if (a == b)
1128 return __label_find(a);
1129
1130 node = ls->root.rb_node;
1131 while (node) {
1132 struct aa_label *this = container_of(node, struct aa_label,
1133 node);
1134 int result = label_merge_cmp(a, b, this);
1135
1136 if (result < 0)
1137 node = node->rb_left;
1138 else if (result > 0)
1139 node = node->rb_right;
1140 else
1141 return __aa_get_label(this);
1142 }
1143
1144 return NULL;
1145}
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1159{
1160 struct aa_labelset *ls;
1161 struct aa_label *label, *ar = NULL, *br = NULL;
1162 unsigned long flags;
1163
1164 AA_BUG(!a);
1165 AA_BUG(!b);
1166
1167 if (label_is_stale(a))
1168 a = ar = aa_get_newest_label(a);
1169 if (label_is_stale(b))
1170 b = br = aa_get_newest_label(b);
1171 ls = labelset_of_merge(a, b);
1172 read_lock_irqsave(&ls->lock, flags);
1173 label = __label_find_merge(ls, a, b);
1174 read_unlock_irqrestore(&ls->lock, flags);
1175 aa_put_label(ar);
1176 aa_put_label(br);
1177
1178 return label;
1179}
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1196 gfp_t gfp)
1197{
1198 struct aa_label *label = NULL;
1199
1200 AA_BUG(!a);
1201 AA_BUG(!b);
1202
1203 if (a == b)
1204 return aa_get_newest_label(a);
1205
1206
1207
1208
1209
1210
1211
1212 if (!label) {
1213 struct aa_label *new;
1214
1215 a = aa_get_newest_label(a);
1216 b = aa_get_newest_label(b);
1217
1218
1219
1220
1221 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1222 if (!new)
1223 goto out;
1224
1225 label = label_merge_insert(new, a, b);
1226 label_free_or_put_new(label, new);
1227out:
1228 aa_put_label(a);
1229 aa_put_label(b);
1230 }
1231
1232 return label;
1233}
1234
1235static inline bool label_is_visible(struct aa_profile *profile,
1236 struct aa_label *label)
1237{
1238 return aa_ns_visible(profile->ns, labels_ns(label), true);
1239}
1240
1241
1242
1243
1244
1245
1246static inline unsigned int match_component(struct aa_profile *profile,
1247 struct aa_profile *tp,
1248 unsigned int state)
1249{
1250 const char *ns_name;
1251
1252 if (profile->ns == tp->ns)
1253 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1254
1255
1256 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1257 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1258 state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1259 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1260 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1261}
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278static int label_compound_match(struct aa_profile *profile,
1279 struct aa_label *label,
1280 unsigned int state, bool subns, u32 request,
1281 struct aa_perms *perms)
1282{
1283 struct aa_profile *tp;
1284 struct label_it i;
1285
1286
1287 label_for_each(i, label, tp) {
1288 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1289 continue;
1290 state = match_component(profile, tp, state);
1291 if (!state)
1292 goto fail;
1293 goto next;
1294 }
1295
1296
1297 *perms = allperms;
1298 return 0;
1299
1300next:
1301 label_for_each_cont(i, label, tp) {
1302 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1303 continue;
1304 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1305 state = match_component(profile, tp, state);
1306 if (!state)
1307 goto fail;
1308 }
1309 aa_compute_perms(profile->policy.dfa, state, perms);
1310 aa_apply_modes_to_perms(profile, perms);
1311 if ((perms->allow & request) != request)
1312 return -EACCES;
1313
1314 return 0;
1315
1316fail:
1317 *perms = nullperms;
1318 return state;
1319}
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336static int label_components_match(struct aa_profile *profile,
1337 struct aa_label *label, unsigned int start,
1338 bool subns, u32 request,
1339 struct aa_perms *perms)
1340{
1341 struct aa_profile *tp;
1342 struct label_it i;
1343 struct aa_perms tmp;
1344 unsigned int state = 0;
1345
1346
1347 label_for_each(i, label, tp) {
1348 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1349 continue;
1350 state = match_component(profile, tp, start);
1351 if (!state)
1352 goto fail;
1353 goto next;
1354 }
1355
1356
1357 return 0;
1358
1359next:
1360 aa_compute_perms(profile->policy.dfa, state, &tmp);
1361 aa_apply_modes_to_perms(profile, &tmp);
1362 aa_perms_accum(perms, &tmp);
1363 label_for_each_cont(i, label, tp) {
1364 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1365 continue;
1366 state = match_component(profile, tp, start);
1367 if (!state)
1368 goto fail;
1369 aa_compute_perms(profile->policy.dfa, state, &tmp);
1370 aa_apply_modes_to_perms(profile, &tmp);
1371 aa_perms_accum(perms, &tmp);
1372 }
1373
1374 if ((perms->allow & request) != request)
1375 return -EACCES;
1376
1377 return 0;
1378
1379fail:
1380 *perms = nullperms;
1381 return -EACCES;
1382}
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1396 unsigned int state, bool subns, u32 request,
1397 struct aa_perms *perms)
1398{
1399 int error = label_compound_match(profile, label, state, subns, request,
1400 perms);
1401 if (!error)
1402 return error;
1403
1404 *perms = allperms;
1405 return label_components_match(profile, label, state, subns, request,
1406 perms);
1407}
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1422{
1423 struct aa_labelset *ls;
1424 unsigned long flags;
1425 char __counted *name;
1426 bool res = false;
1427
1428 AA_BUG(!ns);
1429 AA_BUG(!label);
1430
1431 if (label->hname || labels_ns(label) != ns)
1432 return res;
1433
1434 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1435 return res;
1436
1437 ls = labels_set(label);
1438 write_lock_irqsave(&ls->lock, flags);
1439 if (!label->hname && label->flags & FLAG_IN_TREE) {
1440 label->hname = name;
1441 res = true;
1442 } else
1443 aa_put_str(name);
1444 write_unlock_irqrestore(&ls->lock, flags);
1445
1446 return res;
1447}
1448
1449
1450
1451
1452
1453static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1454 int flags)
1455{
1456 if (label->hname && (!ns || labels_ns(label) == ns) &&
1457 !(flags & ~FLAG_SHOW_MODE))
1458 return true;
1459
1460 return false;
1461}
1462
1463
1464#define update_for_len(total, len, size, str) \
1465do { \
1466 AA_BUG(len < 0); \
1467 total += len; \
1468 len = min(len, size); \
1469 size -= len; \
1470 str += len; \
1471} while (0)
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1488 struct aa_profile *profile, int flags,
1489 struct aa_ns **prev_ns)
1490{
1491 const char *ns_name = NULL;
1492
1493 AA_BUG(!str && size != 0);
1494 AA_BUG(!profile);
1495
1496 if (!view)
1497 view = profiles_ns(profile);
1498
1499 if (view != profile->ns &&
1500 (!prev_ns || (*prev_ns != profile->ns))) {
1501 if (prev_ns)
1502 *prev_ns = profile->ns;
1503 ns_name = aa_ns_name(view, profile->ns,
1504 flags & FLAG_VIEW_SUBNS);
1505 if (ns_name == aa_hidden_ns_name) {
1506 if (flags & FLAG_HIDDEN_UNCONFINED)
1507 return snprintf(str, size, "%s", "unconfined");
1508 return snprintf(str, size, "%s", ns_name);
1509 }
1510 }
1511
1512 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1513 const char *modestr = aa_profile_mode_names[profile->mode];
1514
1515 if (ns_name)
1516 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1517 profile->base.hname, modestr);
1518 return snprintf(str, size, "%s (%s)", profile->base.hname,
1519 modestr);
1520 }
1521
1522 if (ns_name)
1523 return snprintf(str, size, ":%s:%s", ns_name,
1524 profile->base.hname);
1525 return snprintf(str, size, "%s", profile->base.hname);
1526}
1527
1528static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1529 int flags)
1530{
1531 struct aa_profile *profile;
1532 struct label_it i;
1533 int mode = -1, count = 0;
1534
1535 label_for_each(i, label, profile) {
1536 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1537 if (profile->mode == APPARMOR_UNCONFINED)
1538
1539
1540
1541
1542 continue;
1543 count++;
1544 if (mode == -1)
1545 mode = profile->mode;
1546 else if (mode != profile->mode)
1547 return "mixed";
1548 }
1549 }
1550
1551 if (count == 0)
1552 return "-";
1553 if (mode == -1)
1554
1555 mode = APPARMOR_UNCONFINED;
1556
1557 return aa_profile_mode_names[mode];
1558}
1559
1560
1561static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1562 int flags)
1563{
1564 if ((flags & FLAG_SHOW_MODE)) {
1565 struct aa_profile *profile;
1566 struct label_it i;
1567
1568 label_for_each(i, label, profile) {
1569 if (aa_ns_visible(ns, profile->ns,
1570 flags & FLAG_VIEW_SUBNS) &&
1571 profile != profile->ns->unconfined)
1572 return true;
1573 }
1574
1575 return false;
1576 }
1577
1578 return false;
1579}
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1599 struct aa_label *label, int flags)
1600{
1601 struct aa_profile *profile;
1602 struct aa_ns *prev_ns = NULL;
1603 struct label_it i;
1604 int count = 0, total = 0;
1605 size_t len;
1606
1607 AA_BUG(!str && size != 0);
1608 AA_BUG(!label);
1609
1610 if (flags & FLAG_ABS_ROOT) {
1611 ns = root_ns;
1612 len = snprintf(str, size, "=");
1613 update_for_len(total, len, size, str);
1614 } else if (!ns) {
1615 ns = labels_ns(label);
1616 }
1617
1618 label_for_each(i, label, profile) {
1619 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1620 if (count > 0) {
1621 len = snprintf(str, size, "//&");
1622 update_for_len(total, len, size, str);
1623 }
1624 len = aa_profile_snxprint(str, size, ns, profile,
1625 flags & FLAG_VIEW_SUBNS,
1626 &prev_ns);
1627 update_for_len(total, len, size, str);
1628 count++;
1629 }
1630 }
1631
1632 if (count == 0) {
1633 if (flags & FLAG_HIDDEN_UNCONFINED)
1634 return snprintf(str, size, "%s", "unconfined");
1635 return snprintf(str, size, "%s", aa_hidden_ns_name);
1636 }
1637
1638
1639
1640
1641 if (display_mode(ns, label, flags)) {
1642 len = snprintf(str, size, " (%s)",
1643 label_modename(ns, label, flags));
1644 update_for_len(total, len, size, str);
1645 }
1646
1647 return total;
1648}
1649#undef update_for_len
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1663 int flags, gfp_t gfp)
1664{
1665 int size;
1666
1667 AA_BUG(!strp);
1668 AA_BUG(!label);
1669
1670 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1671 if (size < 0)
1672 return size;
1673
1674 *strp = kmalloc(size + 1, gfp);
1675 if (!*strp)
1676 return -ENOMEM;
1677 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1678}
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1692 struct aa_label *label, int flags, gfp_t gfp)
1693{
1694 int size;
1695
1696 AA_BUG(!strp);
1697 AA_BUG(!label);
1698
1699 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1700 if (size < 0)
1701 return size;
1702
1703 *strp = aa_str_alloc(size + 1, gfp);
1704 if (!*strp)
1705 return -ENOMEM;
1706 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1707}
1708
1709
1710void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1711 struct aa_label *label, int flags, gfp_t gfp)
1712{
1713 const char *str;
1714 char *name = NULL;
1715 int len;
1716
1717 AA_BUG(!ab);
1718 AA_BUG(!label);
1719
1720 if (!use_label_hname(ns, label, flags) ||
1721 display_mode(ns, label, flags)) {
1722 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1723 if (len == -1) {
1724 AA_DEBUG("label print error");
1725 return;
1726 }
1727 str = name;
1728 } else {
1729 str = (char *) label->hname;
1730 len = strlen(str);
1731 }
1732 if (audit_string_contains_control(str, len))
1733 audit_log_n_hex(ab, str, len);
1734 else
1735 audit_log_n_string(ab, str, len);
1736
1737 kfree(name);
1738}
1739
1740void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1741 struct aa_label *label, int flags, gfp_t gfp)
1742{
1743 AA_BUG(!f);
1744 AA_BUG(!label);
1745
1746 if (!use_label_hname(ns, label, flags)) {
1747 char *str;
1748 int len;
1749
1750 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1751 if (len == -1) {
1752 AA_DEBUG("label print error");
1753 return;
1754 }
1755 seq_printf(f, "%s", str);
1756 kfree(str);
1757 } else if (display_mode(ns, label, flags))
1758 seq_printf(f, "%s (%s)", label->hname,
1759 label_modename(ns, label, flags));
1760 else
1761 seq_printf(f, "%s", label->hname);
1762}
1763
1764void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1765 gfp_t gfp)
1766{
1767 AA_BUG(!label);
1768
1769 if (!use_label_hname(ns, label, flags)) {
1770 char *str;
1771 int len;
1772
1773 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1774 if (len == -1) {
1775 AA_DEBUG("label print error");
1776 return;
1777 }
1778 pr_info("%s", str);
1779 kfree(str);
1780 } else if (display_mode(ns, label, flags))
1781 pr_info("%s (%s)", label->hname,
1782 label_modename(ns, label, flags));
1783 else
1784 pr_info("%s", label->hname);
1785}
1786
1787void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1788{
1789 struct aa_ns *ns = aa_get_current_ns();
1790
1791 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1792 aa_put_ns(ns);
1793}
1794
1795void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1796{
1797 struct aa_ns *ns = aa_get_current_ns();
1798
1799 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1800 aa_put_ns(ns);
1801}
1802
1803void aa_label_printk(struct aa_label *label, gfp_t gfp)
1804{
1805 struct aa_ns *ns = aa_get_current_ns();
1806
1807 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1808 aa_put_ns(ns);
1809}
1810
1811static int label_count_strn_entries(const char *str, size_t n)
1812{
1813 const char *end = str + n;
1814 const char *split;
1815 int count = 1;
1816
1817 AA_BUG(!str);
1818
1819 for (split = aa_label_strn_split(str, end - str);
1820 split;
1821 split = aa_label_strn_split(str, end - str)) {
1822 count++;
1823 str = split + 3;
1824 }
1825
1826 return count;
1827}
1828
1829
1830
1831
1832
1833
1834
1835
1836static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1837 struct aa_label *currentbase,
1838 const char *str, size_t n)
1839{
1840 const char *first = skipn_spaces(str, n);
1841
1842 if (first && *first == ':')
1843 return aa_fqlookupn_profile(base, str, n);
1844
1845 return aa_fqlookupn_profile(currentbase, str, n);
1846}
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1861 size_t n, gfp_t gfp, bool create,
1862 bool force_stack)
1863{
1864 DEFINE_VEC(profile, vec);
1865 struct aa_label *label, *currbase = base;
1866 int i, len, stack = 0, error;
1867 const char *end = str + n;
1868 const char *split;
1869
1870 AA_BUG(!base);
1871 AA_BUG(!str);
1872
1873 str = skipn_spaces(str, n);
1874 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1875 return ERR_PTR(-EINVAL);
1876
1877 len = label_count_strn_entries(str, end - str);
1878 if (*str == '&' || force_stack) {
1879
1880 stack = base->size;
1881 len += stack;
1882 if (*str == '&')
1883 str++;
1884 }
1885
1886 error = vec_setup(profile, vec, len, gfp);
1887 if (error)
1888 return ERR_PTR(error);
1889
1890 for (i = 0; i < stack; i++)
1891 vec[i] = aa_get_profile(base->vec[i]);
1892
1893 for (split = aa_label_strn_split(str, end - str), i = stack;
1894 split && i < len; i++) {
1895 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1896 if (!vec[i])
1897 goto fail;
1898
1899
1900
1901
1902 if (vec[i]->ns != labels_ns(currbase))
1903 currbase = &vec[i]->label;
1904 str = split + 3;
1905 split = aa_label_strn_split(str, end - str);
1906 }
1907
1908 if (i < len) {
1909 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1910 if (!vec[i])
1911 goto fail;
1912 }
1913 if (len == 1)
1914
1915 return &vec[0]->label;
1916
1917 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1918
1919 if (len == 1) {
1920 label = aa_get_label(&vec[0]->label);
1921 goto out;
1922 }
1923
1924 if (create)
1925 label = aa_vec_find_or_create_label(vec, len, gfp);
1926 else
1927 label = vec_find(vec, len);
1928 if (!label)
1929 goto fail;
1930
1931out:
1932
1933 vec_cleanup(profile, vec, len);
1934 return label;
1935
1936fail:
1937 label = ERR_PTR(-ENOENT);
1938 goto out;
1939}
1940
1941struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1942 gfp_t gfp, bool create, bool force_stack)
1943{
1944 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1945 force_stack);
1946}
1947
1948
1949
1950
1951
1952
1953
1954
1955void aa_labelset_destroy(struct aa_labelset *ls)
1956{
1957 struct rb_node *node;
1958 unsigned long flags;
1959
1960 AA_BUG(!ls);
1961
1962 write_lock_irqsave(&ls->lock, flags);
1963 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1964 struct aa_label *this = rb_entry(node, struct aa_label, node);
1965
1966 if (labels_ns(this) != root_ns)
1967 __label_remove(this,
1968 ns_unconfined(labels_ns(this)->parent));
1969 else
1970 __label_remove(this, NULL);
1971 }
1972 write_unlock_irqrestore(&ls->lock, flags);
1973}
1974
1975
1976
1977
1978void aa_labelset_init(struct aa_labelset *ls)
1979{
1980 AA_BUG(!ls);
1981
1982 rwlock_init(&ls->lock);
1983 ls->root = RB_ROOT;
1984}
1985
1986static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1987{
1988 struct aa_label *label;
1989 struct rb_node *node;
1990 unsigned long flags;
1991
1992 AA_BUG(!ls);
1993
1994 read_lock_irqsave(&ls->lock, flags);
1995
1996 __labelset_for_each(ls, node) {
1997 label = rb_entry(node, struct aa_label, node);
1998 if ((label_is_stale(label) ||
1999 vec_is_stale(label->vec, label->size)) &&
2000 __aa_get_label(label))
2001 goto out;
2002
2003 }
2004 label = NULL;
2005
2006out:
2007 read_unlock_irqrestore(&ls->lock, flags);
2008
2009 return label;
2010}
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024static struct aa_label *__label_update(struct aa_label *label)
2025{
2026 struct aa_label *new, *tmp;
2027 struct aa_labelset *ls;
2028 unsigned long flags;
2029 int i, invcount = 0;
2030
2031 AA_BUG(!label);
2032 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2033
2034 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2035 if (!new)
2036 return NULL;
2037
2038
2039
2040
2041
2042 ls = labels_set(label);
2043 write_lock_irqsave(&ls->lock, flags);
2044 for (i = 0; i < label->size; i++) {
2045 AA_BUG(!label->vec[i]);
2046 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2047 AA_BUG(!new->vec[i]);
2048 AA_BUG(!new->vec[i]->label.proxy);
2049 AA_BUG(!new->vec[i]->label.proxy->label);
2050 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2051 invcount++;
2052 }
2053
2054
2055 if (invcount) {
2056 new->size -= aa_vec_unique(&new->vec[0], new->size,
2057 VEC_FLAG_TERMINATE);
2058
2059 if (new->size == 1) {
2060 tmp = aa_get_label(&new->vec[0]->label);
2061 AA_BUG(tmp == label);
2062 goto remove;
2063 }
2064 if (labels_set(label) != labels_set(new)) {
2065 write_unlock_irqrestore(&ls->lock, flags);
2066 tmp = aa_label_insert(labels_set(new), new);
2067 write_lock_irqsave(&ls->lock, flags);
2068 goto remove;
2069 }
2070 } else
2071 AA_BUG(labels_ns(label) != labels_ns(new));
2072
2073 tmp = __label_insert(labels_set(label), new, true);
2074remove:
2075
2076 __label_remove(label, tmp);
2077 write_unlock_irqrestore(&ls->lock, flags);
2078 label_free_or_put_new(tmp, new);
2079
2080 return tmp;
2081}
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096static void __labelset_update(struct aa_ns *ns)
2097{
2098 struct aa_label *label;
2099
2100 AA_BUG(!ns);
2101 AA_BUG(!mutex_is_locked(&ns->lock));
2102
2103 do {
2104 label = labelset_next_stale(&ns->labels);
2105 if (label) {
2106 struct aa_label *l = __label_update(label);
2107
2108 aa_put_label(l);
2109 aa_put_label(label);
2110 }
2111 } while (label);
2112}
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122void __aa_labelset_update_subtree(struct aa_ns *ns)
2123{
2124 struct aa_ns *child;
2125
2126 AA_BUG(!ns);
2127 AA_BUG(!mutex_is_locked(&ns->lock));
2128
2129 __labelset_update(ns);
2130
2131 list_for_each_entry(child, &ns->sub_ns, base.list) {
2132 mutex_lock_nested(&child->lock, child->level);
2133 __aa_labelset_update_subtree(child);
2134 mutex_unlock(&child->lock);
2135 }
2136}
2137