security/apparmor/policy_ns.c

57  * aa_ns_name - Find the ns name to display for @view from @curr
71 		/* at this point if a ns is visible it is in a view ns
72 		 * thus the curr ns.hname is a prefix of its name.
107 	struct aa_ns *ns;
109 	ns = kzalloc(sizeof(*ns), GFP_KERNEL);
110 	AA_DEBUG("%s(%p)\n", __func__, ns);
111 	if (!ns)
113 	if (!aa_policy_init(&ns->base, prefix, name, GFP_KERNEL))
116 	INIT_LIST_HEAD(&ns->sub_ns);
117 	INIT_LIST_HEAD(&ns->rawdata_list);
118 	mutex_init(&ns->lock);
119 	init_waitqueue_head(&ns->wait);
122 	ns->unconfined = alloc_unconfined("unconfined");
123 	if (!ns->unconfined)
125 	/* ns and ns->unconfined share ns->unconfined refcount */
126 	ns->unconfined->ns = ns;
128 	atomic_set(&ns->uniq_null, 0);
130 	aa_labelset_init(&ns->labels);
132 	return ns;
135 	aa_policy_destroy(&ns->base);
137 	kfree_sensitive(ns);
143  * @ns: the namespace to free  (MAYBE NULL)
148 void aa_free_ns(struct aa_ns *ns)
150 	if (!ns)
153 	aa_policy_destroy(&ns->base);
154 	aa_labelset_destroy(&ns->labels);
155 	aa_put_ns(ns->parent);
157 	ns->unconfined->ns = NULL;
158 	aa_free_profile(ns->unconfined);
159 	kfree_sensitive(ns);
165  * @hname: hierarchical ns name  (NOT NULL)
170  * Returns: unrefcounted ns pointer or NULL if not found
176 	struct aa_ns *ns = view;
181 		ns = __aa_findn_ns(&ns->sub_ns, hname, split - hname);
182 		if (!ns)
190 		return __aa_findn_ns(&ns->sub_ns, hname, n);
207 	struct aa_ns *ns = NULL;
210 	ns = aa_get_ns(__aa_lookupn_ns(view, name, n));
213 	return ns;
219 	struct aa_ns *ns;
226 	ns = alloc_ns(parent->base.hname, name);
227 	if (!ns)
229 	ns->level = parent->level + 1;
230 	mutex_lock_nested(&ns->lock, ns->level);
231 	error = __aafs_ns_mkdir(ns, ns_subns_dir(parent), name, dir);
233 		AA_ERROR("Failed to create interface for ns %s\n",
234 			 ns->base.name);
235 		mutex_unlock(&ns->lock);
236 		aa_free_ns(ns);
239 	ns->parent = aa_get_ns(parent);
240 	list_add_rcu(&ns->base.list, &parent->sub_ns);
242 	aa_get_ns(ns);
243 	mutex_unlock(&ns->lock);
245 	return ns;
249  * __aa_find_or_create_ns - create an ns, fail if it already exists
252  * @dir: if not null the dir to put the ns entries in
254  * Returns: the a refcounted ns that has been add or an ERR_PTR
259 	struct aa_ns *ns;
263 	/* try and find the specified ns */
265 	ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
266 	if (!ns)
267 		ns = __aa_create_ns(parent, name, dir);
269 		ns = ERR_PTR(-EEXIST);
272 	return ns;
277  * @parent: ns to treat as parent
284 	struct aa_ns *ns;
287 	/* try and find the specified ns and if it doesn't exist create it */
289 	ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
290 	if (!ns)
291 		ns = __aa_create_ns(parent, name, NULL);
295 	return ns;
301  * destroy_ns - remove everything contained by @ns
302  * @ns: namespace to have it contents removed  (NOT NULL)
304 static void destroy_ns(struct aa_ns *ns)
306 	if (!ns)
309 	mutex_lock_nested(&ns->lock, ns->level);
311 	__aa_profile_list_release(&ns->base.profiles);
314 	__ns_list_release(&ns->sub_ns);
316 	if (ns->parent) {
319 		write_lock_irqsave(&ns->labels.lock, flags);
320 		__aa_proxy_redirect(ns_unconfined(ns),
321 				    ns_unconfined(ns->parent));
322 		write_unlock_irqrestore(&ns->labels.lock, flags);
324 	__aafs_ns_rmdir(ns);
325 	mutex_unlock(&ns->lock);
330  * @ns: namespace to be removed  (NOT NULL)
332  * Requires: ns->parent->lock be held and ns removed from parent.
334 void __aa_remove_ns(struct aa_ns *ns)
336 	/* remove ns from namespace list */
337 	list_del_rcu(&ns->base.list);
338 	destroy_ns(ns);
339 	aa_put_ns(ns);
350 	struct aa_ns *ns, *tmp;
352 	list_for_each_entry_safe(ns, tmp, head, base.list)
353 		__aa_remove_ns(ns);
379 	root_ns->unconfined->ns = aa_get_ns(root_ns);
389 	 struct aa_ns *ns = root_ns;
394 	 destroy_ns(ns);
395 	 aa_put_ns(ns);