Lines Matching refs:profile
11 * task is confined by. Every task in the system has a profile attached
15 * Each profile exists in a profile namespace which is a container of
16 * visible profiles. Each namespace contains a special "unconfined" profile,
19 * Namespace and profile names can be written together in either
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
26 * Reserved profile names
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
35 * a // in a profile or namespace name indicates a hierarchical name with the
43 * The profile hierarchy severs two distinct purposes,
45 * subprograms under its own profile with different restriction than it
46 * self, and not have it use the system profile.
52 * but is allowed. NOTE: this is currently suboptimal because profile
53 * aliasing is not currently implemented so that a profile for each
58 * A profile or namespace name that can contain one or more // separators
62 * An fqname is a name that may contain both namespace and profile hnames.
66 * - locking of profile lists is currently fairly coarse. All profile
68 * FIXME: move profile lists to using rcu_lists
141 * @profile: the profile to add (NOT NULL)
143 * refcount @profile, should be put by __list_remove_profile
147 static void __add_profile(struct list_head *list, struct aa_profile *profile)
152 AA_BUG(!profile);
153 AA_BUG(!profile->ns);
154 AA_BUG(!mutex_is_locked(&profile->ns->lock));
156 list_add_rcu(&profile->base.list, list);
158 aa_get_profile(profile);
159 l = aa_label_insert(&profile->ns->labels, &profile->label);
160 AA_BUG(l != &profile->label);
165 * __list_remove_profile - remove a profile from the list it is on
166 * @profile: the profile to remove (NOT NULL)
168 * remove a profile from the list, warning generally removal should
169 * be done with __replace_profile as most profile removals are
170 * replacements to the unconfined profile.
172 * put @profile list refcount
176 static void __list_remove_profile(struct aa_profile *profile)
178 AA_BUG(!profile);
179 AA_BUG(!profile->ns);
180 AA_BUG(!mutex_is_locked(&profile->ns->lock));
182 list_del_rcu(&profile->base.list);
183 aa_put_profile(profile);
187 * __remove_profile - remove old profile, and children
188 * @profile: profile to be replaced (NOT NULL)
192 static void __remove_profile(struct aa_profile *profile)
194 AA_BUG(!profile);
195 AA_BUG(!profile->ns);
196 AA_BUG(!mutex_is_locked(&profile->ns->lock));
199 __aa_profile_list_release(&profile->base.profiles);
201 aa_label_remove(&profile->label);
202 __aafs_profile_rmdir(profile);
203 __list_remove_profile(profile);
214 struct aa_profile *profile, *tmp;
215 list_for_each_entry_safe(profile, tmp, head, base.list)
216 __remove_profile(profile);
270 * aa_free_profile - free a profile
271 * @profile: the profile to free (MAYBE NULL)
273 * Free a profile, its hats and null_profile. All references to the profile,
276 * If the profile was referenced from a task context, free_profile() will
279 void aa_free_profile(struct aa_profile *profile)
284 AA_DEBUG("%s(%p)\n", __func__, profile);
286 if (!profile)
290 aa_policy_destroy(&profile->base);
291 aa_put_profile(rcu_access_pointer(profile->parent));
293 aa_put_ns(profile->ns);
294 kfree_sensitive(profile->rename);
295 kfree_sensitive(profile->disconnected);
297 free_attachment(&profile->attach);
303 list_for_each_entry_safe(rule, tmp, &profile->rules, list) {
307 kfree_sensitive(profile->dirname);
309 if (profile->data) {
310 rht = profile->data;
311 profile->data = NULL;
316 kfree_sensitive(profile->hash);
317 aa_put_loaddata(profile->rawdata);
318 aa_label_destroy(&profile->label);
320 kfree_sensitive(profile);
324 * aa_alloc_profile - allocate, initialize and return a new profile
325 * @hname: name of the profile (NOT NULL)
329 * Returns: refcount profile or NULL on failure
334 struct aa_profile *profile;
338 profile = kzalloc(struct_size(profile, label.vec, 2), gfp);
339 if (!profile)
342 if (!aa_policy_init(&profile->base, NULL, hname, gfp))
344 if (!aa_label_init(&profile->label, 1, gfp))
347 INIT_LIST_HEAD(&profile->rules);
353 list_add(&rules->list, &profile->rules);
357 proxy = aa_alloc_proxy(&profile->label, gfp);
362 profile->label.proxy = proxy;
364 profile->label.hname = profile->base.hname;
365 profile->label.flags |= FLAG_PROFILE;
366 profile->label.vec[0] = profile;
369 return profile;
372 aa_free_profile(profile);
377 /* TODO: profile accounting - setup in remove */
380 * __strn_find_child - find a profile on @head list using substring of @name
382 * @name: name of profile (NOT NULL)
387 * Returns: unrefcounted profile ptr, or NULL if not found
396 * __find_child - find a profile on @head list with a name matching @name
398 * @name: name of profile (NOT NULL)
402 * Returns: unrefcounted profile ptr, or NULL if not found
410 * aa_find_child - find a profile by @name in @parent
411 * @parent: profile to search (NOT NULL)
412 * @name: profile name to search for (NOT NULL)
414 * Returns: a refcounted profile or NULL if not found
418 struct aa_profile *profile;
422 profile = __find_child(&parent->base.profiles, name);
423 } while (profile && !aa_get_profile_not0(profile));
427 return profile;
431 * __lookup_parent - lookup the parent of a profile of name @hname
432 * @ns: namespace to lookup profile in (NOT NULL)
433 * @hname: hierarchical profile name to find parent of (NOT NULL)
435 * Lookups up the parent of a fully qualified profile name, the profile
437 * is used to load a new profile.
447 struct aa_profile *profile = NULL;
453 profile = __strn_find_child(&policy->profiles, hname,
455 if (!profile)
457 policy = &profile->base;
461 if (!profile)
463 return &profile->base;
468 * @ns: namespace to lookup profile in (NOT NULL)
469 * @hname: hierarchical profile name to find parent of (NOT NULL)
482 struct aa_profile *parent, *profile = NULL;
491 parent = profile;
492 profile = __strn_find_child(&policy->profiles, hname,
494 if (!profile) {
499 profile = aa_alloc_null(parent, name, gfp);
501 if (!profile)
504 profile->ns = aa_get_ns(ns);
506 policy = &profile->base;
510 if (!profile)
512 return &profile->base;
516 * __lookupn_profile - lookup the profile matching @hname
517 * @base: base list to start looking up profile name from (NOT NULL)
518 * @hname: hierarchical profile name (NOT NULL)
523 * Returns: unrefcounted profile pointer or NULL if not found
525 * Do a relative name lookup, recursing through profile tree.
530 struct aa_profile *profile = NULL;
535 profile = __strn_find_child(&base->profiles, hname,
537 if (!profile)
540 base = &profile->base;
557 * aa_lookupn_profile - find a profile by its full or partial name
562 * Returns: refcounted profile or NULL if not found
567 struct aa_profile *profile;
571 profile = __lookupn_profile(&ns->base, hname, n);
572 } while (profile && !aa_get_profile_not0(profile));
575 /* the unconfined profile is not in the regular profile list */
576 if (!profile && strncmp(hname, "unconfined", n) == 0)
577 profile = aa_get_newest_profile(ns->unconfined);
580 return profile;
591 struct aa_profile *profile;
605 profile = aa_lookupn_profile(ns, name, n - (name - fqname));
607 /* default profile for ns, currently unconfined */
608 profile = aa_get_newest_profile(ns->unconfined);
610 profile = NULL;
613 return profile;
620 struct aa_profile *profile;
623 profile = aa_alloc_profile(name, NULL, gfp);
624 if (!profile)
628 profile->label.flags |= FLAG_NULL;
629 rules = list_first_entry(&profile->rules, typeof(*rules), list);
634 profile->path_flags = parent->path_flags;
637 rcu_assign_pointer(profile->parent, aa_get_profile(parent));
638 profile->ns = aa_get_ns(parent->ns);
641 return profile;
645 * aa_new_learning_profile - create or find a null-X learning profile
646 * @parent: profile that caused this profile to be created (NOT NULL)
647 * @hat: true if the null- learning profile is a hat
648 * @base: name to base the null profile off of
651 * Find/Create a null- complain mode profile used in learning mode. The
652 * name of the profile is unique and follows the format of parent//null-XXX.
656 * null profiles are added to the profile list but the list does not
660 * Returns: new refcounted profile else NULL on failure
665 struct aa_profile *p, *profile;
690 profile = aa_find_child(parent, bname);
691 if (profile)
694 profile = aa_alloc_null(parent, name, gfp);
695 if (!profile)
697 profile->mode = APPARMOR_COMPLAIN;
699 profile->label.flags |= FLAG_HAT;
701 mutex_lock_nested(&profile->ns->lock, profile->ns->level);
704 aa_free_profile(profile);
705 profile = aa_get_profile(p);
707 __add_profile(&parent->base.profiles, profile);
709 mutex_unlock(&profile->ns->lock);
715 return profile;
719 aa_free_profile(profile);
725 * @profile: profile to test if it can be replaced (MAYBE NULL)
731 static int replacement_allowed(struct aa_profile *profile, int noreplace,
734 if (profile) {
735 if (profile->label.flags & FLAG_IMMUTIBLE) {
736 *info = "cannot replace immutable profile";
739 *info = "profile already exists";
763 * @name: name of profile being manipulated (NOT NULL)
907 struct aa_profile *profile)
909 const char *base = basename(profile->base.hname);
910 long len = base - profile->base.hname;
919 if (ent->new == profile)
921 if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
931 * @old: profile to be replaced (NOT NULL)
932 * @new: profile to replace @old with (NOT NULL)
988 * __lookup_replace - lookup replacement information for a profile
990 * @hname: name of profile to lookup
991 * @noreplace: true if not replacing an existing profile
992 * @p: Returns - profile to be replaced
995 * Returns: profile to replace (no ref) on success else ptr error
1005 *info = "profile can not be replaced";
1044 * aa_replace_profiles - replace profile(s) on the profile list
1050 * unpack and replace a profile on the profile list and uses of that profile
1051 * by any task creds via invalidating the old version of the profile, which
1052 * tasks will notice to update their own cred. If the profile does not exist
1053 * on the profile list it is added.
1166 * profile that doesn't have
1168 * individual profile loading where
1173 * null profile will be replaced once
1187 /* released on profile replacement or free_profile */
1229 /* dedup actual profile replacement */
1231 "same as current profile, skipping",
1240 * TODO: finer dedup based on profile range in data. Load set
1241 * can differ but profile may remain unchanged
1285 info = "valid profile in failed atomic policy load";
1288 info = "unchecked profile in failed atomic policy load";
1305 * aa_remove_profiles - remove profile(s) from the system
1308 * @fqname: name of the profile or namespace to remove (NOT NULL)
1311 * Remove a profile or sub namespace from the current namespace, so that
1322 struct aa_profile *profile = NULL;
1328 info = "no profile specified";
1356 /* remove profile */
1358 profile = aa_get_profile(__lookup_profile(&ns->base, name));
1359 if (!profile) {
1361 info = "profile does not exist";
1364 name = profile->base.hname;
1366 __remove_profile(profile);
1375 aa_put_profile(profile);