1
2
3
4
5
6
7
8
9
10#include <linux/audit.h>
11#include <linux/seq_file.h>
12#include <linux/sort.h>
13
14#include "include/apparmor.h"
15#include "include/cred.h"
16#include "include/label.h"
17#include "include/policy.h"
18#include "include/secid.h"
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39#define PROXY_POISON 97
40#define LABEL_POISON 100
41
42static void free_proxy(struct aa_proxy *proxy)
43{
44 if (proxy) {
45
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
47 memset(proxy, 0, sizeof(*proxy));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49 kfree(proxy);
50 }
51}
52
53void aa_proxy_kref(struct kref *kref)
54{
55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56
57 free_proxy(proxy);
58}
59
60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61{
62 struct aa_proxy *new;
63
64 new = kzalloc(sizeof(struct aa_proxy), gfp);
65 if (new) {
66 kref_init(&new->count);
67 rcu_assign_pointer(new->label, aa_get_label(label));
68 }
69 return new;
70}
71
72
73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74{
75 struct aa_label *tmp;
76
77 AA_BUG(!orig);
78 AA_BUG(!new);
79 lockdep_assert_held_exclusive(&labels_set(orig)->lock);
80
81 tmp = rcu_dereference_protected(orig->proxy->label,
82 &labels_ns(orig)->lock);
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84 orig->flags |= FLAG_STALE;
85 aa_put_label(tmp);
86}
87
88static void __proxy_share(struct aa_label *old, struct aa_label *new)
89{
90 struct aa_proxy *proxy = new->proxy;
91
92 new->proxy = aa_get_proxy(old->proxy);
93 __aa_proxy_redirect(old, new);
94 aa_put_proxy(proxy);
95}
96
97
98
99
100
101
102
103
104
105
106
107static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108{
109 int res;
110
111 AA_BUG(!a);
112 AA_BUG(!b);
113 AA_BUG(!a->base.hname);
114 AA_BUG(!b->base.hname);
115
116 if (a == b)
117 return 0;
118
119 res = a->level - b->level;
120 if (res)
121 return res;
122
123 return strcmp(a->base.hname, b->base.hname);
124}
125
126
127
128
129
130
131
132
133
134
135static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136{
137 int res;
138
139 AA_BUG(!a);
140 AA_BUG(!b);
141 AA_BUG(!a->ns);
142 AA_BUG(!b->ns);
143 AA_BUG(!a->base.hname);
144 AA_BUG(!b->base.hname);
145
146 if (a == b || a->base.hname == b->base.hname)
147 return 0;
148 res = ns_cmp(a->ns, b->ns);
149 if (res)
150 return res;
151
152 return strcmp(a->base.hname, b->base.hname);
153}
154
155
156
157
158
159
160
161
162
163
164
165static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
166{
167 int i;
168
169 AA_BUG(!a);
170 AA_BUG(!*a);
171 AA_BUG(!b);
172 AA_BUG(!*b);
173 AA_BUG(an <= 0);
174 AA_BUG(bn <= 0);
175
176 for (i = 0; i < an && i < bn; i++) {
177 int res = profile_cmp(a[i], b[i]);
178
179 if (res != 0)
180 return res;
181 }
182
183 return an - bn;
184}
185
186static bool vec_is_stale(struct aa_profile **vec, int n)
187{
188 int i;
189
190 AA_BUG(!vec);
191
192 for (i = 0; i < n; i++) {
193 if (profile_is_stale(vec[i]))
194 return true;
195 }
196
197 return false;
198}
199
200static bool vec_unconfined(struct aa_profile **vec, int n)
201{
202 int i;
203
204 AA_BUG(!vec);
205
206 for (i = 0; i < n; i++) {
207 if (!profile_unconfined(vec[i]))
208 return false;
209 }
210
211 return true;
212}
213
214static int sort_cmp(const void *a, const void *b)
215{
216 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
217}
218
219
220
221
222
223
224static inline int unique(struct aa_profile **vec, int n)
225{
226 int i, pos, dups = 0;
227
228 AA_BUG(n < 1);
229 AA_BUG(!vec);
230
231 pos = 0;
232 for (i = 1; i < n; i++) {
233 int res = profile_cmp(vec[pos], vec[i]);
234
235 AA_BUG(res > 0, "vec not sorted");
236 if (res == 0) {
237
238 aa_put_profile(vec[i]);
239 dups++;
240 continue;
241 }
242 pos++;
243 if (dups)
244 vec[pos] = vec[i];
245 }
246
247 AA_BUG(dups < 0);
248
249 return dups;
250}
251
252
253
254
255
256
257
258
259
260
261
262int aa_vec_unique(struct aa_profile **vec, int n, int flags)
263{
264 int i, dups = 0;
265
266 AA_BUG(n < 1);
267 AA_BUG(!vec);
268
269
270 if (n > 8) {
271 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
272 dups = unique(vec, n);
273 goto out;
274 }
275
276
277 for (i = 1; i < n; i++) {
278 struct aa_profile *tmp = vec[i];
279 int pos, j;
280
281 for (pos = i - 1 - dups; pos >= 0; pos--) {
282 int res = profile_cmp(vec[pos], tmp);
283
284 if (res == 0) {
285
286 aa_put_profile(tmp);
287 dups++;
288 goto continue_outer;
289 } else if (res < 0)
290 break;
291 }
292
293 pos++;
294
295 for (j = i - dups; j > pos; j--)
296 vec[j] = vec[j - 1];
297 vec[pos] = tmp;
298continue_outer:
299 ;
300 }
301
302 AA_BUG(dups < 0);
303
304out:
305 if (flags & VEC_FLAG_TERMINATE)
306 vec[n - dups] = NULL;
307
308 return dups;
309}
310
311
312static void label_destroy(struct aa_label *label)
313{
314 struct aa_label *tmp;
315
316 AA_BUG(!label);
317
318 if (!label_isprofile(label)) {
319 struct aa_profile *profile;
320 struct label_it i;
321
322 aa_put_str(label->hname);
323
324 label_for_each(i, label, profile) {
325 aa_put_profile(profile);
326 label->vec[i.i] = (struct aa_profile *)
327 (LABEL_POISON + (long) i.i);
328 }
329 }
330
331 if (rcu_dereference_protected(label->proxy->label, true) == label)
332 rcu_assign_pointer(label->proxy->label, NULL);
333
334 aa_free_secid(label->secid);
335
336 tmp = rcu_dereference_protected(label->proxy->label, true);
337 if (tmp == label)
338 rcu_assign_pointer(label->proxy->label, NULL);
339
340 aa_put_proxy(label->proxy);
341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
342}
343
344void aa_label_free(struct aa_label *label)
345{
346 if (!label)
347 return;
348
349 label_destroy(label);
350 kfree(label);
351}
352
353static void label_free_switch(struct aa_label *label)
354{
355 if (label->flags & FLAG_NS_COUNT)
356 aa_free_ns(labels_ns(label));
357 else if (label_isprofile(label))
358 aa_free_profile(labels_profile(label));
359 else
360 aa_label_free(label);
361}
362
363static void label_free_rcu(struct rcu_head *head)
364{
365 struct aa_label *label = container_of(head, struct aa_label, rcu);
366
367 if (label->flags & FLAG_IN_TREE)
368 (void) aa_label_remove(label);
369 label_free_switch(label);
370}
371
372void aa_label_kref(struct kref *kref)
373{
374 struct aa_label *label = container_of(kref, struct aa_label, count);
375 struct aa_ns *ns = labels_ns(label);
376
377 if (!ns) {
378
379 label_free_switch(label);
380 return;
381 }
382
383 AA_BUG(label_isprofile(label) &&
384 on_list_rcu(&label->vec[0]->base.profiles));
385 AA_BUG(label_isprofile(label) &&
386 on_list_rcu(&label->vec[0]->base.list));
387
388
389 call_rcu(&label->rcu, label_free_rcu);
390}
391
392static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
393{
394 if (label != new)
395
396 aa_label_free(new);
397 else
398 aa_put_label(new);
399}
400
401bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
402{
403 AA_BUG(!label);
404 AA_BUG(size < 1);
405
406 if (aa_alloc_secid(label, gfp) < 0)
407 return false;
408
409 label->size = size;
410 label->vec[size] = NULL;
411 kref_init(&label->count);
412 RB_CLEAR_NODE(&label->node);
413
414 return true;
415}
416
417
418
419
420
421
422
423
424
425
426struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
427{
428 struct aa_label *new;
429
430 AA_BUG(size < 1);
431
432
433 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
434 gfp);
435 AA_DEBUG("%s (%p)\n", __func__, new);
436 if (!new)
437 goto fail;
438
439 if (!aa_label_init(new, size, gfp))
440 goto fail;
441
442 if (!proxy) {
443 proxy = aa_alloc_proxy(new, gfp);
444 if (!proxy)
445 goto fail;
446 } else
447 aa_get_proxy(proxy);
448
449 new->proxy = proxy;
450
451 return new;
452
453fail:
454 kfree(new);
455
456 return NULL;
457}
458
459
460
461
462
463
464
465
466
467
468
469static int label_cmp(struct aa_label *a, struct aa_label *b)
470{
471 AA_BUG(!b);
472
473 if (a == b)
474 return 0;
475
476 return vec_cmp(a->vec, a->size, b->vec, b->size);
477}
478
479
480int aa_label_next_confined(struct aa_label *label, int i)
481{
482 AA_BUG(!label);
483 AA_BUG(i < 0);
484
485 for (; i < label->size; i++) {
486 if (!profile_unconfined(label->vec[i]))
487 return i;
488 }
489
490 return i;
491}
492
493
494
495
496
497
498
499
500
501
502struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
503 struct aa_label *set,
504 struct aa_label *sub)
505{
506 AA_BUG(!set);
507 AA_BUG(!I);
508 AA_BUG(I->i < 0);
509 AA_BUG(I->i > set->size);
510 AA_BUG(!sub);
511 AA_BUG(I->j < 0);
512 AA_BUG(I->j > sub->size);
513
514 while (I->j < sub->size && I->i < set->size) {
515 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
516
517 if (res == 0) {
518 (I->j)++;
519 (I->i)++;
520 } else if (res > 0)
521 (I->i)++;
522 else
523 return sub->vec[(I->j)++];
524 }
525
526 if (I->j < sub->size)
527 return sub->vec[(I->j)++];
528
529 return NULL;
530}
531
532
533
534
535
536
537
538
539
540bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
541{
542 struct label_it i = { };
543
544 AA_BUG(!set);
545 AA_BUG(!sub);
546
547 if (sub == set)
548 return true;
549
550 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
551}
552
553
554
555
556
557
558
559
560
561
562
563static bool __label_remove(struct aa_label *label, struct aa_label *new)
564{
565 struct aa_labelset *ls = labels_set(label);
566
567 AA_BUG(!ls);
568 AA_BUG(!label);
569 lockdep_assert_held_exclusive(&ls->lock);
570
571 if (new)
572 __aa_proxy_redirect(label, new);
573
574 if (!label_is_stale(label))
575 __label_make_stale(label);
576
577 if (label->flags & FLAG_IN_TREE) {
578 rb_erase(&label->node, &ls->root);
579 label->flags &= ~FLAG_IN_TREE;
580 return true;
581 }
582
583 return false;
584}
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599static bool __label_replace(struct aa_label *old, struct aa_label *new)
600{
601 struct aa_labelset *ls = labels_set(old);
602
603 AA_BUG(!ls);
604 AA_BUG(!old);
605 AA_BUG(!new);
606 lockdep_assert_held_exclusive(&ls->lock);
607 AA_BUG(new->flags & FLAG_IN_TREE);
608
609 if (!label_is_stale(old))
610 __label_make_stale(old);
611
612 if (old->flags & FLAG_IN_TREE) {
613 rb_replace_node(&old->node, &new->node, &ls->root);
614 old->flags &= ~FLAG_IN_TREE;
615 new->flags |= FLAG_IN_TREE;
616 return true;
617 }
618
619 return false;
620}
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635static struct aa_label *__label_insert(struct aa_labelset *ls,
636 struct aa_label *label, bool replace)
637{
638 struct rb_node **new, *parent = NULL;
639
640 AA_BUG(!ls);
641 AA_BUG(!label);
642 AA_BUG(labels_set(label) != ls);
643 lockdep_assert_held_exclusive(&ls->lock);
644 AA_BUG(label->flags & FLAG_IN_TREE);
645
646
647 new = &ls->root.rb_node;
648 while (*new) {
649 struct aa_label *this = rb_entry(*new, struct aa_label, node);
650 int result = label_cmp(label, this);
651
652 parent = *new;
653 if (result == 0) {
654
655
656
657
658
659 if (!replace && !label_is_stale(this)) {
660 if (__aa_get_label(this))
661 return this;
662 } else
663 __proxy_share(this, label);
664 AA_BUG(!__label_replace(this, label));
665 return aa_get_label(label);
666 } else if (result < 0)
667 new = &((*new)->rb_left);
668 else
669 new = &((*new)->rb_right);
670 }
671
672
673 rb_link_node(&label->node, parent, new);
674 rb_insert_color(&label->node, &ls->root);
675 label->flags |= FLAG_IN_TREE;
676
677 return aa_get_label(label);
678}
679
680
681
682
683
684
685
686
687
688
689
690
691
692static struct aa_label *__vec_find(struct aa_profile **vec, int n)
693{
694 struct rb_node *node;
695
696 AA_BUG(!vec);
697 AA_BUG(!*vec);
698 AA_BUG(n <= 0);
699
700 node = vec_labelset(vec, n)->root.rb_node;
701 while (node) {
702 struct aa_label *this = rb_entry(node, struct aa_label, node);
703 int result = vec_cmp(this->vec, this->size, vec, n);
704
705 if (result > 0)
706 node = node->rb_left;
707 else if (result < 0)
708 node = node->rb_right;
709 else
710 return __aa_get_label(this);
711 }
712
713 return NULL;
714}
715
716
717
718
719
720
721
722
723
724
725
726
727static struct aa_label *__label_find(struct aa_label *label)
728{
729 AA_BUG(!label);
730
731 return __vec_find(label->vec, label->size);
732}
733
734
735
736
737
738
739
740
741
742bool aa_label_remove(struct aa_label *label)
743{
744 struct aa_labelset *ls = labels_set(label);
745 unsigned long flags;
746 bool res;
747
748 AA_BUG(!ls);
749
750 write_lock_irqsave(&ls->lock, flags);
751 res = __label_remove(label, ns_unconfined(labels_ns(label)));
752 write_unlock_irqrestore(&ls->lock, flags);
753
754 return res;
755}
756
757
758
759
760
761
762
763
764
765bool aa_label_replace(struct aa_label *old, struct aa_label *new)
766{
767 unsigned long flags;
768 bool res;
769
770 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
771 write_lock_irqsave(&labels_set(old)->lock, flags);
772 if (old->proxy != new->proxy)
773 __proxy_share(old, new);
774 else
775 __aa_proxy_redirect(old, new);
776 res = __label_replace(old, new);
777 write_unlock_irqrestore(&labels_set(old)->lock, flags);
778 } else {
779 struct aa_label *l;
780 struct aa_labelset *ls = labels_set(old);
781
782 write_lock_irqsave(&ls->lock, flags);
783 res = __label_remove(old, new);
784 if (labels_ns(old) != labels_ns(new)) {
785 write_unlock_irqrestore(&ls->lock, flags);
786 ls = labels_set(new);
787 write_lock_irqsave(&ls->lock, flags);
788 }
789 l = __label_insert(ls, new, true);
790 res = (l == new);
791 write_unlock_irqrestore(&ls->lock, flags);
792 aa_put_label(l);
793 }
794
795 return res;
796}
797
798
799
800
801
802
803
804
805
806static struct aa_label *vec_find(struct aa_profile **vec, int n)
807{
808 struct aa_labelset *ls;
809 struct aa_label *label;
810 unsigned long flags;
811
812 AA_BUG(!vec);
813 AA_BUG(!*vec);
814 AA_BUG(n <= 0);
815
816 ls = vec_labelset(vec, n);
817 read_lock_irqsave(&ls->lock, flags);
818 label = __vec_find(vec, n);
819 read_unlock_irqrestore(&ls->lock, flags);
820
821 return label;
822}
823
824
825static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
826 int len, gfp_t gfp)
827{
828 struct aa_label *label = NULL;
829 struct aa_labelset *ls;
830 unsigned long flags;
831 struct aa_label *new;
832 int i;
833
834 AA_BUG(!vec);
835
836 if (len == 1)
837 return aa_get_label(&vec[0]->label);
838
839 ls = labels_set(&vec[len - 1]->label);
840
841
842
843
844 new = aa_label_alloc(len, NULL, gfp);
845 if (!new)
846 return NULL;
847
848 for (i = 0; i < len; i++)
849 new->vec[i] = aa_get_profile(vec[i]);
850
851 write_lock_irqsave(&ls->lock, flags);
852 label = __label_insert(ls, new, false);
853 write_unlock_irqrestore(&ls->lock, flags);
854 label_free_or_put_new(label, new);
855
856 return label;
857}
858
859struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
860 gfp_t gfp)
861{
862 struct aa_label *label = vec_find(vec, len);
863
864 if (label)
865 return label;
866
867 return vec_create_and_insert_label(vec, len, gfp);
868}
869
870
871
872
873
874
875
876
877
878
879
880struct aa_label *aa_label_find(struct aa_label *label)
881{
882 AA_BUG(!label);
883
884 return vec_find(label->vec, label->size);
885}
886
887
888
889
890
891
892
893
894
895
896
897
898struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
899{
900 struct aa_label *l;
901 unsigned long flags;
902
903 AA_BUG(!ls);
904 AA_BUG(!label);
905
906
907 if (!label_is_stale(label)) {
908 read_lock_irqsave(&ls->lock, flags);
909 l = __label_find(label);
910 read_unlock_irqrestore(&ls->lock, flags);
911 if (l)
912 return l;
913 }
914
915 write_lock_irqsave(&ls->lock, flags);
916 l = __label_insert(ls, label, false);
917 write_unlock_irqrestore(&ls->lock, flags);
918
919 return l;
920}
921
922
923
924
925
926
927
928
929
930
931
932struct aa_profile *aa_label_next_in_merge(struct label_it *I,
933 struct aa_label *a,
934 struct aa_label *b)
935{
936 AA_BUG(!a);
937 AA_BUG(!b);
938 AA_BUG(!I);
939 AA_BUG(I->i < 0);
940 AA_BUG(I->i > a->size);
941 AA_BUG(I->j < 0);
942 AA_BUG(I->j > b->size);
943
944 if (I->i < a->size) {
945 if (I->j < b->size) {
946 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
947
948 if (res > 0)
949 return b->vec[(I->j)++];
950 if (res == 0)
951 (I->j)++;
952 }
953
954 return a->vec[(I->i)++];
955 }
956
957 if (I->j < b->size)
958 return b->vec[(I->j)++];
959
960 return NULL;
961}
962
963
964
965
966
967
968
969
970
971
972
973
974
975static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
976 struct aa_label *z)
977{
978 struct aa_profile *p = NULL;
979 struct label_it i = { };
980 int k;
981
982 AA_BUG(!a);
983 AA_BUG(!b);
984 AA_BUG(!z);
985
986 for (k = 0;
987 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
988 k++) {
989 int res = profile_cmp(p, z->vec[k]);
990
991 if (res != 0)
992 return res;
993 }
994
995 if (p)
996 return 1;
997 else if (k < z->size)
998 return -1;
999 return 0;
1000}
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019static struct aa_label *label_merge_insert(struct aa_label *new,
1020 struct aa_label *a,
1021 struct aa_label *b)
1022{
1023 struct aa_label *label;
1024 struct aa_labelset *ls;
1025 struct aa_profile *next;
1026 struct label_it i;
1027 unsigned long flags;
1028 int k = 0, invcount = 0;
1029 bool stale = false;
1030
1031 AA_BUG(!a);
1032 AA_BUG(a->size < 0);
1033 AA_BUG(!b);
1034 AA_BUG(b->size < 0);
1035 AA_BUG(!new);
1036 AA_BUG(new->size < a->size + b->size);
1037
1038 label_for_each_in_merge(i, a, b, next) {
1039 AA_BUG(!next);
1040 if (profile_is_stale(next)) {
1041 new->vec[k] = aa_get_newest_profile(next);
1042 AA_BUG(!new->vec[k]->label.proxy);
1043 AA_BUG(!new->vec[k]->label.proxy->label);
1044 if (next->label.proxy != new->vec[k]->label.proxy)
1045 invcount++;
1046 k++;
1047 stale = true;
1048 } else
1049 new->vec[k++] = aa_get_profile(next);
1050 }
1051
1052 new->size = k;
1053 new->vec[k] = NULL;
1054
1055 if (invcount) {
1056 new->size -= aa_vec_unique(&new->vec[0], new->size,
1057 VEC_FLAG_TERMINATE);
1058
1059 if (new->size == 1) {
1060 label = aa_get_label(&new->vec[0]->label);
1061 return label;
1062 }
1063 } else if (!stale) {
1064
1065
1066
1067
1068 if (k == a->size)
1069 return aa_get_label(a);
1070 else if (k == b->size)
1071 return aa_get_label(b);
1072 }
1073 if (vec_unconfined(new->vec, new->size))
1074 new->flags |= FLAG_UNCONFINED;
1075 ls = labels_set(new);
1076 write_lock_irqsave(&ls->lock, flags);
1077 label = __label_insert(labels_set(new), new, false);
1078 write_unlock_irqrestore(&ls->lock, flags);
1079
1080 return label;
1081}
1082
1083
1084
1085
1086
1087
1088
1089
1090static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1091 struct aa_label *b)
1092{
1093 struct aa_ns *nsa = labels_ns(a);
1094 struct aa_ns *nsb = labels_ns(b);
1095
1096 if (ns_cmp(nsa, nsb) <= 0)
1097 return &nsa->labels;
1098 return &nsb->labels;
1099}
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1113 struct aa_label *a,
1114 struct aa_label *b)
1115{
1116 struct rb_node *node;
1117
1118 AA_BUG(!ls);
1119 AA_BUG(!a);
1120 AA_BUG(!b);
1121
1122 if (a == b)
1123 return __label_find(a);
1124
1125 node = ls->root.rb_node;
1126 while (node) {
1127 struct aa_label *this = container_of(node, struct aa_label,
1128 node);
1129 int result = label_merge_cmp(a, b, this);
1130
1131 if (result < 0)
1132 node = node->rb_left;
1133 else if (result > 0)
1134 node = node->rb_right;
1135 else
1136 return __aa_get_label(this);
1137 }
1138
1139 return NULL;
1140}
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1154{
1155 struct aa_labelset *ls;
1156 struct aa_label *label, *ar = NULL, *br = NULL;
1157 unsigned long flags;
1158
1159 AA_BUG(!a);
1160 AA_BUG(!b);
1161
1162 if (label_is_stale(a))
1163 a = ar = aa_get_newest_label(a);
1164 if (label_is_stale(b))
1165 b = br = aa_get_newest_label(b);
1166 ls = labelset_of_merge(a, b);
1167 read_lock_irqsave(&ls->lock, flags);
1168 label = __label_find_merge(ls, a, b);
1169 read_unlock_irqrestore(&ls->lock, flags);
1170 aa_put_label(ar);
1171 aa_put_label(br);
1172
1173 return label;
1174}
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1191 gfp_t gfp)
1192{
1193 struct aa_label *label = NULL;
1194
1195 AA_BUG(!a);
1196 AA_BUG(!b);
1197
1198 if (a == b)
1199 return aa_get_newest_label(a);
1200
1201
1202
1203
1204
1205
1206
1207 if (!label) {
1208 struct aa_label *new;
1209
1210 a = aa_get_newest_label(a);
1211 b = aa_get_newest_label(b);
1212
1213
1214
1215
1216 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1217 if (!new)
1218 goto out;
1219
1220 label = label_merge_insert(new, a, b);
1221 label_free_or_put_new(label, new);
1222out:
1223 aa_put_label(a);
1224 aa_put_label(b);
1225 }
1226
1227 return label;
1228}
1229
1230static inline bool label_is_visible(struct aa_profile *profile,
1231 struct aa_label *label)
1232{
1233 return aa_ns_visible(profile->ns, labels_ns(label), true);
1234}
1235
1236
1237
1238
1239
1240
1241static inline unsigned int match_component(struct aa_profile *profile,
1242 struct aa_profile *tp,
1243 unsigned int state)
1244{
1245 const char *ns_name;
1246
1247 if (profile->ns == tp->ns)
1248 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1249
1250
1251 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1252 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1253 state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1254 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1255 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1256}
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273static int label_compound_match(struct aa_profile *profile,
1274 struct aa_label *label,
1275 unsigned int state, bool subns, u32 request,
1276 struct aa_perms *perms)
1277{
1278 struct aa_profile *tp;
1279 struct label_it i;
1280
1281
1282 label_for_each(i, label, tp) {
1283 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1284 continue;
1285 state = match_component(profile, tp, state);
1286 if (!state)
1287 goto fail;
1288 goto next;
1289 }
1290
1291
1292 *perms = allperms;
1293 return 0;
1294
1295next:
1296 label_for_each_cont(i, label, tp) {
1297 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1298 continue;
1299 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1300 state = match_component(profile, tp, state);
1301 if (!state)
1302 goto fail;
1303 }
1304 aa_compute_perms(profile->policy.dfa, state, perms);
1305 aa_apply_modes_to_perms(profile, perms);
1306 if ((perms->allow & request) != request)
1307 return -EACCES;
1308
1309 return 0;
1310
1311fail:
1312 *perms = nullperms;
1313 return state;
1314}
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331static int label_components_match(struct aa_profile *profile,
1332 struct aa_label *label, unsigned int start,
1333 bool subns, u32 request,
1334 struct aa_perms *perms)
1335{
1336 struct aa_profile *tp;
1337 struct label_it i;
1338 struct aa_perms tmp;
1339 unsigned int state = 0;
1340
1341
1342 label_for_each(i, label, tp) {
1343 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1344 continue;
1345 state = match_component(profile, tp, start);
1346 if (!state)
1347 goto fail;
1348 goto next;
1349 }
1350
1351
1352 return 0;
1353
1354next:
1355 aa_compute_perms(profile->policy.dfa, state, &tmp);
1356 aa_apply_modes_to_perms(profile, &tmp);
1357 aa_perms_accum(perms, &tmp);
1358 label_for_each_cont(i, label, tp) {
1359 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1360 continue;
1361 state = match_component(profile, tp, start);
1362 if (!state)
1363 goto fail;
1364 aa_compute_perms(profile->policy.dfa, state, &tmp);
1365 aa_apply_modes_to_perms(profile, &tmp);
1366 aa_perms_accum(perms, &tmp);
1367 }
1368
1369 if ((perms->allow & request) != request)
1370 return -EACCES;
1371
1372 return 0;
1373
1374fail:
1375 *perms = nullperms;
1376 return -EACCES;
1377}
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1391 unsigned int state, bool subns, u32 request,
1392 struct aa_perms *perms)
1393{
1394 int error = label_compound_match(profile, label, state, subns, request,
1395 perms);
1396 if (!error)
1397 return error;
1398
1399 *perms = allperms;
1400 return label_components_match(profile, label, state, subns, request,
1401 perms);
1402}
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1417{
1418 struct aa_labelset *ls;
1419 unsigned long flags;
1420 char __counted *name;
1421 bool res = false;
1422
1423 AA_BUG(!ns);
1424 AA_BUG(!label);
1425
1426 if (label->hname || labels_ns(label) != ns)
1427 return res;
1428
1429 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1430 return res;
1431
1432 ls = labels_set(label);
1433 write_lock_irqsave(&ls->lock, flags);
1434 if (!label->hname && label->flags & FLAG_IN_TREE) {
1435 label->hname = name;
1436 res = true;
1437 } else
1438 aa_put_str(name);
1439 write_unlock_irqrestore(&ls->lock, flags);
1440
1441 return res;
1442}
1443
1444
1445
1446
1447
1448static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1449 int flags)
1450{
1451 if (label->hname && (!ns || labels_ns(label) == ns) &&
1452 !(flags & ~FLAG_SHOW_MODE))
1453 return true;
1454
1455 return false;
1456}
1457
1458
1459#define update_for_len(total, len, size, str) \
1460do { \
1461 AA_BUG(len < 0); \
1462 total += len; \
1463 len = min(len, size); \
1464 size -= len; \
1465 str += len; \
1466} while (0)
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1483 struct aa_profile *profile, int flags,
1484 struct aa_ns **prev_ns)
1485{
1486 const char *ns_name = NULL;
1487
1488 AA_BUG(!str && size != 0);
1489 AA_BUG(!profile);
1490
1491 if (!view)
1492 view = profiles_ns(profile);
1493
1494 if (view != profile->ns &&
1495 (!prev_ns || (*prev_ns != profile->ns))) {
1496 if (prev_ns)
1497 *prev_ns = profile->ns;
1498 ns_name = aa_ns_name(view, profile->ns,
1499 flags & FLAG_VIEW_SUBNS);
1500 if (ns_name == aa_hidden_ns_name) {
1501 if (flags & FLAG_HIDDEN_UNCONFINED)
1502 return snprintf(str, size, "%s", "unconfined");
1503 return snprintf(str, size, "%s", ns_name);
1504 }
1505 }
1506
1507 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1508 const char *modestr = aa_profile_mode_names[profile->mode];
1509
1510 if (ns_name)
1511 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1512 profile->base.hname, modestr);
1513 return snprintf(str, size, "%s (%s)", profile->base.hname,
1514 modestr);
1515 }
1516
1517 if (ns_name)
1518 return snprintf(str, size, ":%s:%s", ns_name,
1519 profile->base.hname);
1520 return snprintf(str, size, "%s", profile->base.hname);
1521}
1522
1523static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1524 int flags)
1525{
1526 struct aa_profile *profile;
1527 struct label_it i;
1528 int mode = -1, count = 0;
1529
1530 label_for_each(i, label, profile) {
1531 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1532 if (profile->mode == APPARMOR_UNCONFINED)
1533
1534
1535
1536
1537 continue;
1538 count++;
1539 if (mode == -1)
1540 mode = profile->mode;
1541 else if (mode != profile->mode)
1542 return "mixed";
1543 }
1544 }
1545
1546 if (count == 0)
1547 return "-";
1548 if (mode == -1)
1549
1550 mode = APPARMOR_UNCONFINED;
1551
1552 return aa_profile_mode_names[mode];
1553}
1554
1555
1556static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1557 int flags)
1558{
1559 if ((flags & FLAG_SHOW_MODE)) {
1560 struct aa_profile *profile;
1561 struct label_it i;
1562
1563 label_for_each(i, label, profile) {
1564 if (aa_ns_visible(ns, profile->ns,
1565 flags & FLAG_VIEW_SUBNS) &&
1566 profile != profile->ns->unconfined)
1567 return true;
1568 }
1569
1570 return false;
1571 }
1572
1573 return false;
1574}
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1594 struct aa_label *label, int flags)
1595{
1596 struct aa_profile *profile;
1597 struct aa_ns *prev_ns = NULL;
1598 struct label_it i;
1599 int count = 0, total = 0;
1600 size_t len;
1601
1602 AA_BUG(!str && size != 0);
1603 AA_BUG(!label);
1604
1605 if (flags & FLAG_ABS_ROOT) {
1606 ns = root_ns;
1607 len = snprintf(str, size, "=");
1608 update_for_len(total, len, size, str);
1609 } else if (!ns) {
1610 ns = labels_ns(label);
1611 }
1612
1613 label_for_each(i, label, profile) {
1614 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1615 if (count > 0) {
1616 len = snprintf(str, size, "//&");
1617 update_for_len(total, len, size, str);
1618 }
1619 len = aa_profile_snxprint(str, size, ns, profile,
1620 flags & FLAG_VIEW_SUBNS,
1621 &prev_ns);
1622 update_for_len(total, len, size, str);
1623 count++;
1624 }
1625 }
1626
1627 if (count == 0) {
1628 if (flags & FLAG_HIDDEN_UNCONFINED)
1629 return snprintf(str, size, "%s", "unconfined");
1630 return snprintf(str, size, "%s", aa_hidden_ns_name);
1631 }
1632
1633
1634
1635
1636 if (display_mode(ns, label, flags)) {
1637 len = snprintf(str, size, " (%s)",
1638 label_modename(ns, label, flags));
1639 update_for_len(total, len, size, str);
1640 }
1641
1642 return total;
1643}
1644#undef update_for_len
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1658 int flags, gfp_t gfp)
1659{
1660 int size;
1661
1662 AA_BUG(!strp);
1663 AA_BUG(!label);
1664
1665 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1666 if (size < 0)
1667 return size;
1668
1669 *strp = kmalloc(size + 1, gfp);
1670 if (!*strp)
1671 return -ENOMEM;
1672 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1673}
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1687 struct aa_label *label, int flags, gfp_t gfp)
1688{
1689 int size;
1690
1691 AA_BUG(!strp);
1692 AA_BUG(!label);
1693
1694 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1695 if (size < 0)
1696 return size;
1697
1698 *strp = aa_str_alloc(size + 1, gfp);
1699 if (!*strp)
1700 return -ENOMEM;
1701 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1702}
1703
1704
1705void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1706 struct aa_label *label, int flags, gfp_t gfp)
1707{
1708 const char *str;
1709 char *name = NULL;
1710 int len;
1711
1712 AA_BUG(!ab);
1713 AA_BUG(!label);
1714
1715 if (!use_label_hname(ns, label, flags) ||
1716 display_mode(ns, label, flags)) {
1717 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1718 if (len == -1) {
1719 AA_DEBUG("label print error");
1720 return;
1721 }
1722 str = name;
1723 } else {
1724 str = (char *) label->hname;
1725 len = strlen(str);
1726 }
1727 if (audit_string_contains_control(str, len))
1728 audit_log_n_hex(ab, str, len);
1729 else
1730 audit_log_n_string(ab, str, len);
1731
1732 kfree(name);
1733}
1734
1735void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1736 struct aa_label *label, int flags, gfp_t gfp)
1737{
1738 AA_BUG(!f);
1739 AA_BUG(!label);
1740
1741 if (!use_label_hname(ns, label, flags)) {
1742 char *str;
1743 int len;
1744
1745 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1746 if (len == -1) {
1747 AA_DEBUG("label print error");
1748 return;
1749 }
1750 seq_printf(f, "%s", str);
1751 kfree(str);
1752 } else if (display_mode(ns, label, flags))
1753 seq_printf(f, "%s (%s)", label->hname,
1754 label_modename(ns, label, flags));
1755 else
1756 seq_printf(f, "%s", label->hname);
1757}
1758
1759void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1760 gfp_t gfp)
1761{
1762 AA_BUG(!label);
1763
1764 if (!use_label_hname(ns, label, flags)) {
1765 char *str;
1766 int len;
1767
1768 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1769 if (len == -1) {
1770 AA_DEBUG("label print error");
1771 return;
1772 }
1773 pr_info("%s", str);
1774 kfree(str);
1775 } else if (display_mode(ns, label, flags))
1776 pr_info("%s (%s)", label->hname,
1777 label_modename(ns, label, flags));
1778 else
1779 pr_info("%s", label->hname);
1780}
1781
1782void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1783{
1784 struct aa_ns *ns = aa_get_current_ns();
1785
1786 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1787 aa_put_ns(ns);
1788}
1789
1790void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1791{
1792 struct aa_ns *ns = aa_get_current_ns();
1793
1794 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1795 aa_put_ns(ns);
1796}
1797
1798void aa_label_printk(struct aa_label *label, gfp_t gfp)
1799{
1800 struct aa_ns *ns = aa_get_current_ns();
1801
1802 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1803 aa_put_ns(ns);
1804}
1805
1806static int label_count_strn_entries(const char *str, size_t n)
1807{
1808 const char *end = str + n;
1809 const char *split;
1810 int count = 1;
1811
1812 AA_BUG(!str);
1813
1814 for (split = aa_label_strn_split(str, end - str);
1815 split;
1816 split = aa_label_strn_split(str, end - str)) {
1817 count++;
1818 str = split + 3;
1819 }
1820
1821 return count;
1822}
1823
1824
1825
1826
1827
1828
1829
1830
1831static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1832 struct aa_label *currentbase,
1833 const char *str, size_t n)
1834{
1835 const char *first = skipn_spaces(str, n);
1836
1837 if (first && *first == ':')
1838 return aa_fqlookupn_profile(base, str, n);
1839
1840 return aa_fqlookupn_profile(currentbase, str, n);
1841}
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1856 size_t n, gfp_t gfp, bool create,
1857 bool force_stack)
1858{
1859 DEFINE_VEC(profile, vec);
1860 struct aa_label *label, *currbase = base;
1861 int i, len, stack = 0, error;
1862 const char *end = str + n;
1863 const char *split;
1864
1865 AA_BUG(!base);
1866 AA_BUG(!str);
1867
1868 str = skipn_spaces(str, n);
1869 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1870 return ERR_PTR(-EINVAL);
1871
1872 len = label_count_strn_entries(str, end - str);
1873 if (*str == '&' || force_stack) {
1874
1875 stack = base->size;
1876 len += stack;
1877 if (*str == '&')
1878 str++;
1879 }
1880
1881 error = vec_setup(profile, vec, len, gfp);
1882 if (error)
1883 return ERR_PTR(error);
1884
1885 for (i = 0; i < stack; i++)
1886 vec[i] = aa_get_profile(base->vec[i]);
1887
1888 for (split = aa_label_strn_split(str, end - str), i = stack;
1889 split && i < len; i++) {
1890 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1891 if (!vec[i])
1892 goto fail;
1893
1894
1895
1896
1897 if (vec[i]->ns != labels_ns(currbase))
1898 currbase = &vec[i]->label;
1899 str = split + 3;
1900 split = aa_label_strn_split(str, end - str);
1901 }
1902
1903 if (i < len) {
1904 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1905 if (!vec[i])
1906 goto fail;
1907 }
1908 if (len == 1)
1909
1910 return &vec[0]->label;
1911
1912 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1913
1914 if (len == 1) {
1915 label = aa_get_label(&vec[0]->label);
1916 goto out;
1917 }
1918
1919 if (create)
1920 label = aa_vec_find_or_create_label(vec, len, gfp);
1921 else
1922 label = vec_find(vec, len);
1923 if (!label)
1924 goto fail;
1925
1926out:
1927
1928 vec_cleanup(profile, vec, len);
1929 return label;
1930
1931fail:
1932 label = ERR_PTR(-ENOENT);
1933 goto out;
1934}
1935
1936struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1937 gfp_t gfp, bool create, bool force_stack)
1938{
1939 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1940 force_stack);
1941}
1942
1943
1944
1945
1946
1947
1948
1949
1950void aa_labelset_destroy(struct aa_labelset *ls)
1951{
1952 struct rb_node *node;
1953 unsigned long flags;
1954
1955 AA_BUG(!ls);
1956
1957 write_lock_irqsave(&ls->lock, flags);
1958 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1959 struct aa_label *this = rb_entry(node, struct aa_label, node);
1960
1961 if (labels_ns(this) != root_ns)
1962 __label_remove(this,
1963 ns_unconfined(labels_ns(this)->parent));
1964 else
1965 __label_remove(this, NULL);
1966 }
1967 write_unlock_irqrestore(&ls->lock, flags);
1968}
1969
1970
1971
1972
1973void aa_labelset_init(struct aa_labelset *ls)
1974{
1975 AA_BUG(!ls);
1976
1977 rwlock_init(&ls->lock);
1978 ls->root = RB_ROOT;
1979}
1980
1981static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1982{
1983 struct aa_label *label;
1984 struct rb_node *node;
1985 unsigned long flags;
1986
1987 AA_BUG(!ls);
1988
1989 read_lock_irqsave(&ls->lock, flags);
1990
1991 __labelset_for_each(ls, node) {
1992 label = rb_entry(node, struct aa_label, node);
1993 if ((label_is_stale(label) ||
1994 vec_is_stale(label->vec, label->size)) &&
1995 __aa_get_label(label))
1996 goto out;
1997
1998 }
1999 label = NULL;
2000
2001out:
2002 read_unlock_irqrestore(&ls->lock, flags);
2003
2004 return label;
2005}
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019static struct aa_label *__label_update(struct aa_label *label)
2020{
2021 struct aa_label *new, *tmp;
2022 struct aa_labelset *ls;
2023 unsigned long flags;
2024 int i, invcount = 0;
2025
2026 AA_BUG(!label);
2027 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2028
2029 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2030 if (!new)
2031 return NULL;
2032
2033
2034
2035
2036
2037 ls = labels_set(label);
2038 write_lock_irqsave(&ls->lock, flags);
2039 for (i = 0; i < label->size; i++) {
2040 AA_BUG(!label->vec[i]);
2041 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2042 AA_BUG(!new->vec[i]);
2043 AA_BUG(!new->vec[i]->label.proxy);
2044 AA_BUG(!new->vec[i]->label.proxy->label);
2045 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2046 invcount++;
2047 }
2048
2049
2050 if (invcount) {
2051 new->size -= aa_vec_unique(&new->vec[0], new->size,
2052 VEC_FLAG_TERMINATE);
2053
2054 if (new->size == 1) {
2055 tmp = aa_get_label(&new->vec[0]->label);
2056 AA_BUG(tmp == label);
2057 goto remove;
2058 }
2059 if (labels_set(label) != labels_set(new)) {
2060 write_unlock_irqrestore(&ls->lock, flags);
2061 tmp = aa_label_insert(labels_set(new), new);
2062 write_lock_irqsave(&ls->lock, flags);
2063 goto remove;
2064 }
2065 } else
2066 AA_BUG(labels_ns(label) != labels_ns(new));
2067
2068 tmp = __label_insert(labels_set(label), new, true);
2069remove:
2070
2071 __label_remove(label, tmp);
2072 write_unlock_irqrestore(&ls->lock, flags);
2073 label_free_or_put_new(tmp, new);
2074
2075 return tmp;
2076}
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091static void __labelset_update(struct aa_ns *ns)
2092{
2093 struct aa_label *label;
2094
2095 AA_BUG(!ns);
2096 AA_BUG(!mutex_is_locked(&ns->lock));
2097
2098 do {
2099 label = labelset_next_stale(&ns->labels);
2100 if (label) {
2101 struct aa_label *l = __label_update(label);
2102
2103 aa_put_label(l);
2104 aa_put_label(label);
2105 }
2106 } while (label);
2107}
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117void __aa_labelset_update_subtree(struct aa_ns *ns)
2118{
2119 struct aa_ns *child;
2120
2121 AA_BUG(!ns);
2122 AA_BUG(!mutex_is_locked(&ns->lock));
2123
2124 __labelset_update(ns);
2125
2126 list_for_each_entry(child, &ns->sub_ns, base.list) {
2127 mutex_lock_nested(&child->lock, child->level);
2128 __aa_labelset_update_subtree(child);
2129 mutex_unlock(&child->lock);
2130 }
2131}
2132