1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * AppArmor security module 4 * 5 * This file contains AppArmor label definitions 6 * 7 * Copyright 2017 Canonical Ltd. 8 */ 9 10#include <linux/audit.h> 11#include <linux/seq_file.h> 12#include <linux/sort.h> 13 14#include "include/apparmor.h" 15#include "include/cred.h" 16#include "include/label.h" 17#include "include/policy.h" 18#include "include/secid.h" 19 20 21/* 22 * the aa_label represents the set of profiles confining an object 23 * 24 * Labels maintain a reference count to the set of pointers they reference 25 * Labels are ref counted by 26 * tasks and object via the security field/security context off the field 27 * code - will take a ref count on a label if it needs the label 28 * beyond what is possible with an rcu_read_lock. 29 * profiles - each profile is a label 30 * secids - a pinned secid will keep a refcount of the label it is 31 * referencing 32 * objects - inode, files, sockets, ... 33 * 34 * Labels are not ref counted by the label set, so they maybe removed and 35 * freed when no longer in use. 36 * 37 */ 38 39#define PROXY_POISON 97 40#define LABEL_POISON 100 41 42static void free_proxy(struct aa_proxy *proxy) 43{ 44 if (proxy) { 45 /* p->label will not updated any more as p is dead */ 46 aa_put_label(rcu_dereference_protected(proxy->label, true)); 47 memset(proxy, 0, sizeof(*proxy)); 48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); 49 kfree(proxy); 50 } 51} 52 53void aa_proxy_kref(struct kref *kref) 54{ 55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count); 56 57 free_proxy(proxy); 58} 59 60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp) 61{ 62 struct aa_proxy *new; 63 64 new = kzalloc(sizeof(struct aa_proxy), gfp); 65 if (new) { 66 kref_init(&new->count); 67 rcu_assign_pointer(new->label, aa_get_label(label)); 68 } 69 return new; 70} 71 72/* requires profile list write lock held */ 73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new) 74{ 75 struct aa_label *tmp; 76 77 AA_BUG(!orig); 78 AA_BUG(!new); 79 lockdep_assert_held_write(&labels_set(orig)->lock); 80 81 tmp = rcu_dereference_protected(orig->proxy->label, 82 &labels_ns(orig)->lock); 83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); 84 orig->flags |= FLAG_STALE; 85 aa_put_label(tmp); 86} 87 88static void __proxy_share(struct aa_label *old, struct aa_label *new) 89{ 90 struct aa_proxy *proxy = new->proxy; 91 92 new->proxy = aa_get_proxy(old->proxy); 93 __aa_proxy_redirect(old, new); 94 aa_put_proxy(proxy); 95} 96 97 98/** 99 * ns_cmp - compare ns for label set ordering 100 * @a: ns to compare (NOT NULL) 101 * @b: ns to compare (NOT NULL) 102 * 103 * Returns: <0 if a < b 104 * ==0 if a == b 105 * >0 if a > b 106 */ 107static int ns_cmp(struct aa_ns *a, struct aa_ns *b) 108{ 109 int res; 110 111 AA_BUG(!a); 112 AA_BUG(!b); 113 AA_BUG(!a->base.hname); 114 AA_BUG(!b->base.hname); 115 116 if (a == b) 117 return 0; 118 119 res = a->level - b->level; 120 if (res) 121 return res; 122 123 return strcmp(a->base.hname, b->base.hname); 124} 125 126/** 127 * profile_cmp - profile comparison for set ordering 128 * @a: profile to compare (NOT NULL) 129 * @b: profile to compare (NOT NULL) 130 * 131 * Returns: <0 if a < b 132 * ==0 if a == b 133 * >0 if a > b 134 */ 135static int profile_cmp(struct aa_profile *a, struct aa_profile *b) 136{ 137 int res; 138 139 AA_BUG(!a); 140 AA_BUG(!b); 141 AA_BUG(!a->ns); 142 AA_BUG(!b->ns); 143 AA_BUG(!a->base.hname); 144 AA_BUG(!b->base.hname); 145 146 if (a == b || a->base.hname == b->base.hname) 147 return 0; 148 res = ns_cmp(a->ns, b->ns); 149 if (res) 150 return res; 151 152 return strcmp(a->base.hname, b->base.hname); 153} 154 155/** 156 * vec_cmp - label comparison for set ordering 157 * @a: aa_profile to compare (NOT NULL) 158 * @an: length of @a 159 * @b: aa_profile to compare (NOT NULL) 160 * @bn: length of @b 161 * 162 * Returns: <0 if @a < @b 163 * ==0 if @a == @b 164 * >0 if @a > @b 165 */ 166static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn) 167{ 168 int i; 169 170 AA_BUG(!a); 171 AA_BUG(!*a); 172 AA_BUG(!b); 173 AA_BUG(!*b); 174 AA_BUG(an <= 0); 175 AA_BUG(bn <= 0); 176 177 for (i = 0; i < an && i < bn; i++) { 178 int res = profile_cmp(a[i], b[i]); 179 180 if (res != 0) 181 return res; 182 } 183 184 return an - bn; 185} 186 187static bool vec_is_stale(struct aa_profile **vec, int n) 188{ 189 int i; 190 191 AA_BUG(!vec); 192 193 for (i = 0; i < n; i++) { 194 if (profile_is_stale(vec[i])) 195 return true; 196 } 197 198 return false; 199} 200 201static long accum_vec_flags(struct aa_profile **vec, int n) 202{ 203 long u = FLAG_UNCONFINED; 204 int i; 205 206 AA_BUG(!vec); 207 208 for (i = 0; i < n; i++) { 209 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 | 210 FLAG_STALE); 211 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED)) 212 u &= ~FLAG_UNCONFINED; 213 } 214 215 return u; 216} 217 218static int sort_cmp(const void *a, const void *b) 219{ 220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b); 221} 222 223/* 224 * assumes vec is sorted 225 * Assumes @vec has null terminator at vec[n], and will null terminate 226 * vec[n - dups] 227 */ 228static inline int unique(struct aa_profile **vec, int n) 229{ 230 int i, pos, dups = 0; 231 232 AA_BUG(n < 1); 233 AA_BUG(!vec); 234 235 pos = 0; 236 for (i = 1; i < n; i++) { 237 int res = profile_cmp(vec[pos], vec[i]); 238 239 AA_BUG(res > 0, "vec not sorted"); 240 if (res == 0) { 241 /* drop duplicate */ 242 aa_put_profile(vec[i]); 243 dups++; 244 continue; 245 } 246 pos++; 247 if (dups) 248 vec[pos] = vec[i]; 249 } 250 251 AA_BUG(dups < 0); 252 253 return dups; 254} 255 256/** 257 * aa_vec_unique - canonical sort and unique a list of profiles 258 * @n: number of refcounted profiles in the list (@n > 0) 259 * @vec: list of profiles to sort and merge 260 * @flags: null terminator flags of @vec 261 * 262 * Returns: the number of duplicates eliminated == references put 263 * 264 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will 265 * null terminate vec[n - dups] 266 */ 267int aa_vec_unique(struct aa_profile **vec, int n, int flags) 268{ 269 int i, dups = 0; 270 271 AA_BUG(n < 1); 272 AA_BUG(!vec); 273 274 /* vecs are usually small and inorder, have a fallback for larger */ 275 if (n > 8) { 276 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL); 277 dups = unique(vec, n); 278 goto out; 279 } 280 281 /* insertion sort + unique in one */ 282 for (i = 1; i < n; i++) { 283 struct aa_profile *tmp = vec[i]; 284 int pos, j; 285 286 for (pos = i - 1 - dups; pos >= 0; pos--) { 287 int res = profile_cmp(vec[pos], tmp); 288 289 if (res == 0) { 290 /* drop duplicate entry */ 291 aa_put_profile(tmp); 292 dups++; 293 goto continue_outer; 294 } else if (res < 0) 295 break; 296 } 297 /* pos is at entry < tmp, or index -1. Set to insert pos */ 298 pos++; 299 300 for (j = i - dups; j > pos; j--) 301 vec[j] = vec[j - 1]; 302 vec[pos] = tmp; 303continue_outer: 304 ; 305 } 306 307 AA_BUG(dups < 0); 308 309out: 310 if (flags & VEC_FLAG_TERMINATE) 311 vec[n - dups] = NULL; 312 313 return dups; 314} 315 316 317void aa_label_destroy(struct aa_label *label) 318{ 319 AA_BUG(!label); 320 321 if (!label_isprofile(label)) { 322 struct aa_profile *profile; 323 struct label_it i; 324 325 aa_put_str(label->hname); 326 327 label_for_each(i, label, profile) { 328 aa_put_profile(profile); 329 label->vec[i.i] = (struct aa_profile *) 330 (LABEL_POISON + (long) i.i); 331 } 332 } 333 334 if (label->proxy) { 335 if (rcu_dereference_protected(label->proxy->label, true) == label) 336 rcu_assign_pointer(label->proxy->label, NULL); 337 aa_put_proxy(label->proxy); 338 } 339 aa_free_secid(label->secid); 340 341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1; 342} 343 344void aa_label_free(struct aa_label *label) 345{ 346 if (!label) 347 return; 348 349 aa_label_destroy(label); 350 kfree(label); 351} 352 353static void label_free_switch(struct aa_label *label) 354{ 355 if (label->flags & FLAG_NS_COUNT) 356 aa_free_ns(labels_ns(label)); 357 else if (label_isprofile(label)) 358 aa_free_profile(labels_profile(label)); 359 else 360 aa_label_free(label); 361} 362 363static void label_free_rcu(struct rcu_head *head) 364{ 365 struct aa_label *label = container_of(head, struct aa_label, rcu); 366 367 if (label->flags & FLAG_IN_TREE) 368 (void) aa_label_remove(label); 369 label_free_switch(label); 370} 371 372void aa_label_kref(struct kref *kref) 373{ 374 struct aa_label *label = container_of(kref, struct aa_label, count); 375 struct aa_ns *ns = labels_ns(label); 376 377 if (!ns) { 378 /* never live, no rcu callback needed, just using the fn */ 379 label_free_switch(label); 380 return; 381 } 382 /* TODO: update labels_profile macro so it works here */ 383 AA_BUG(label_isprofile(label) && 384 on_list_rcu(&label->vec[0]->base.profiles)); 385 AA_BUG(label_isprofile(label) && 386 on_list_rcu(&label->vec[0]->base.list)); 387 388 /* TODO: if compound label and not stale add to reclaim cache */ 389 call_rcu(&label->rcu, label_free_rcu); 390} 391 392static void label_free_or_put_new(struct aa_label *label, struct aa_label *new) 393{ 394 if (label != new) 395 /* need to free directly to break circular ref with proxy */ 396 aa_label_free(new); 397 else 398 aa_put_label(new); 399} 400 401bool aa_label_init(struct aa_label *label, int size, gfp_t gfp) 402{ 403 AA_BUG(!label); 404 AA_BUG(size < 1); 405 406 if (aa_alloc_secid(label, gfp) < 0) 407 return false; 408 409 label->size = size; /* doesn't include null */ 410 label->vec[size] = NULL; /* null terminate */ 411 kref_init(&label->count); 412 RB_CLEAR_NODE(&label->node); 413 414 return true; 415} 416 417/** 418 * aa_label_alloc - allocate a label with a profile vector of @size length 419 * @size: size of profile vector in the label 420 * @proxy: proxy to use OR null if to allocate a new one 421 * @gfp: memory allocation type 422 * 423 * Returns: new label 424 * else NULL if failed 425 */ 426struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp) 427{ 428 struct aa_label *new; 429 430 AA_BUG(size < 1); 431 432 /* + 1 for null terminator entry on vec */ 433 new = kzalloc(struct_size(new, vec, size + 1), gfp); 434 AA_DEBUG("%s (%p)\n", __func__, new); 435 if (!new) 436 goto fail; 437 438 if (!aa_label_init(new, size, gfp)) 439 goto fail; 440 441 if (!proxy) { 442 proxy = aa_alloc_proxy(new, gfp); 443 if (!proxy) 444 goto fail; 445 } else 446 aa_get_proxy(proxy); 447 /* just set new's proxy, don't redirect proxy here if it was passed in*/ 448 new->proxy = proxy; 449 450 return new; 451 452fail: 453 kfree(new); 454 455 return NULL; 456} 457 458 459/** 460 * label_cmp - label comparison for set ordering 461 * @a: label to compare (NOT NULL) 462 * @b: label to compare (NOT NULL) 463 * 464 * Returns: <0 if a < b 465 * ==0 if a == b 466 * >0 if a > b 467 */ 468static int label_cmp(struct aa_label *a, struct aa_label *b) 469{ 470 AA_BUG(!b); 471 472 if (a == b) 473 return 0; 474 475 return vec_cmp(a->vec, a->size, b->vec, b->size); 476} 477 478/* helper fn for label_for_each_confined */ 479int aa_label_next_confined(struct aa_label *label, int i) 480{ 481 AA_BUG(!label); 482 AA_BUG(i < 0); 483 484 for (; i < label->size; i++) { 485 if (!profile_unconfined(label->vec[i])) 486 return i; 487 } 488 489 return i; 490} 491 492/** 493 * __aa_label_next_not_in_set - return the next profile of @sub not in @set 494 * @I: label iterator 495 * @set: label to test against 496 * @sub: label to if is subset of @set 497 * 498 * Returns: profile in @sub that is not in @set, with iterator set pos after 499 * else NULL if @sub is a subset of @set 500 */ 501struct aa_profile *__aa_label_next_not_in_set(struct label_it *I, 502 struct aa_label *set, 503 struct aa_label *sub) 504{ 505 AA_BUG(!set); 506 AA_BUG(!I); 507 AA_BUG(I->i < 0); 508 AA_BUG(I->i > set->size); 509 AA_BUG(!sub); 510 AA_BUG(I->j < 0); 511 AA_BUG(I->j > sub->size); 512 513 while (I->j < sub->size && I->i < set->size) { 514 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]); 515 516 if (res == 0) { 517 (I->j)++; 518 (I->i)++; 519 } else if (res > 0) 520 (I->i)++; 521 else 522 return sub->vec[(I->j)++]; 523 } 524 525 if (I->j < sub->size) 526 return sub->vec[(I->j)++]; 527 528 return NULL; 529} 530 531/** 532 * aa_label_is_subset - test if @sub is a subset of @set 533 * @set: label to test against 534 * @sub: label to test if is subset of @set 535 * 536 * Returns: true if @sub is subset of @set 537 * else false 538 */ 539bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub) 540{ 541 struct label_it i = { }; 542 543 AA_BUG(!set); 544 AA_BUG(!sub); 545 546 if (sub == set) 547 return true; 548 549 return __aa_label_next_not_in_set(&i, set, sub) == NULL; 550} 551 552/** 553 * aa_label_is_unconfined_subset - test if @sub is a subset of @set 554 * @set: label to test against 555 * @sub: label to test if is subset of @set 556 * 557 * This checks for subset but taking into account unconfined. IF 558 * @sub contains an unconfined profile that does not have a matching 559 * unconfined in @set then this will not cause the test to fail. 560 * Conversely we don't care about an unconfined in @set that is not in 561 * @sub 562 * 563 * Returns: true if @sub is special_subset of @set 564 * else false 565 */ 566bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub) 567{ 568 struct label_it i = { }; 569 struct aa_profile *p; 570 571 AA_BUG(!set); 572 AA_BUG(!sub); 573 574 if (sub == set) 575 return true; 576 577 do { 578 p = __aa_label_next_not_in_set(&i, set, sub); 579 if (p && !profile_unconfined(p)) 580 break; 581 } while (p); 582 583 return p == NULL; 584} 585 586 587/** 588 * __label_remove - remove @label from the label set 589 * @label: label to remove 590 * @new: label to redirect to 591 * 592 * Requires: labels_set(@label)->lock write_lock 593 * Returns: true if the label was in the tree and removed 594 */ 595static bool __label_remove(struct aa_label *label, struct aa_label *new) 596{ 597 struct aa_labelset *ls = labels_set(label); 598 599 AA_BUG(!ls); 600 AA_BUG(!label); 601 lockdep_assert_held_write(&ls->lock); 602 603 if (new) 604 __aa_proxy_redirect(label, new); 605 606 if (!label_is_stale(label)) 607 __label_make_stale(label); 608 609 if (label->flags & FLAG_IN_TREE) { 610 rb_erase(&label->node, &ls->root); 611 label->flags &= ~FLAG_IN_TREE; 612 return true; 613 } 614 615 return false; 616} 617 618/** 619 * __label_replace - replace @old with @new in label set 620 * @old: label to remove from label set 621 * @new: label to replace @old with 622 * 623 * Requires: labels_set(@old)->lock write_lock 624 * valid ref count be held on @new 625 * Returns: true if @old was in set and replaced by @new 626 * 627 * Note: current implementation requires label set be order in such a way 628 * that @new directly replaces @old position in the set (ie. 629 * using pointer comparison of the label address would not work) 630 */ 631static bool __label_replace(struct aa_label *old, struct aa_label *new) 632{ 633 struct aa_labelset *ls = labels_set(old); 634 635 AA_BUG(!ls); 636 AA_BUG(!old); 637 AA_BUG(!new); 638 lockdep_assert_held_write(&ls->lock); 639 AA_BUG(new->flags & FLAG_IN_TREE); 640 641 if (!label_is_stale(old)) 642 __label_make_stale(old); 643 644 if (old->flags & FLAG_IN_TREE) { 645 rb_replace_node(&old->node, &new->node, &ls->root); 646 old->flags &= ~FLAG_IN_TREE; 647 new->flags |= FLAG_IN_TREE; 648 return true; 649 } 650 651 return false; 652} 653 654/** 655 * __label_insert - attempt to insert @l into a label set 656 * @ls: set of labels to insert @l into (NOT NULL) 657 * @label: new label to insert (NOT NULL) 658 * @replace: whether insertion should replace existing entry that is not stale 659 * 660 * Requires: @ls->lock 661 * caller to hold a valid ref on l 662 * if @replace is true l has a preallocated proxy associated 663 * Returns: @l if successful in inserting @l - with additional refcount 664 * else ref counted equivalent label that is already in the set, 665 * the else condition only happens if @replace is false 666 */ 667static struct aa_label *__label_insert(struct aa_labelset *ls, 668 struct aa_label *label, bool replace) 669{ 670 struct rb_node **new, *parent = NULL; 671 672 AA_BUG(!ls); 673 AA_BUG(!label); 674 AA_BUG(labels_set(label) != ls); 675 lockdep_assert_held_write(&ls->lock); 676 AA_BUG(label->flags & FLAG_IN_TREE); 677 678 /* Figure out where to put new node */ 679 new = &ls->root.rb_node; 680 while (*new) { 681 struct aa_label *this = rb_entry(*new, struct aa_label, node); 682 int result = label_cmp(label, this); 683 684 parent = *new; 685 if (result == 0) { 686 /* !__aa_get_label means queued for destruction, 687 * so replace in place, however the label has 688 * died before the replacement so do not share 689 * the proxy 690 */ 691 if (!replace && !label_is_stale(this)) { 692 if (__aa_get_label(this)) 693 return this; 694 } else 695 __proxy_share(this, label); 696 AA_BUG(!__label_replace(this, label)); 697 return aa_get_label(label); 698 } else if (result < 0) 699 new = &((*new)->rb_left); 700 else /* (result > 0) */ 701 new = &((*new)->rb_right); 702 } 703 704 /* Add new node and rebalance tree. */ 705 rb_link_node(&label->node, parent, new); 706 rb_insert_color(&label->node, &ls->root); 707 label->flags |= FLAG_IN_TREE; 708 709 return aa_get_label(label); 710} 711 712/** 713 * __vec_find - find label that matches @vec in label set 714 * @vec: vec of profiles to find matching label for (NOT NULL) 715 * @n: length of @vec 716 * 717 * Requires: @vec_labelset(vec) lock held 718 * caller to hold a valid ref on l 719 * 720 * Returns: ref counted @label if matching label is in tree 721 * ref counted label that is equiv to @l in tree 722 * else NULL if @vec equiv is not in tree 723 */ 724static struct aa_label *__vec_find(struct aa_profile **vec, int n) 725{ 726 struct rb_node *node; 727 728 AA_BUG(!vec); 729 AA_BUG(!*vec); 730 AA_BUG(n <= 0); 731 732 node = vec_labelset(vec, n)->root.rb_node; 733 while (node) { 734 struct aa_label *this = rb_entry(node, struct aa_label, node); 735 int result = vec_cmp(this->vec, this->size, vec, n); 736 737 if (result > 0) 738 node = node->rb_left; 739 else if (result < 0) 740 node = node->rb_right; 741 else 742 return __aa_get_label(this); 743 } 744 745 return NULL; 746} 747 748/** 749 * __label_find - find label @label in label set 750 * @label: label to find (NOT NULL) 751 * 752 * Requires: labels_set(@label)->lock held 753 * caller to hold a valid ref on l 754 * 755 * Returns: ref counted @label if @label is in tree OR 756 * ref counted label that is equiv to @label in tree 757 * else NULL if @label or equiv is not in tree 758 */ 759static struct aa_label *__label_find(struct aa_label *label) 760{ 761 AA_BUG(!label); 762 763 return __vec_find(label->vec, label->size); 764} 765 766 767/** 768 * aa_label_remove - remove a label from the labelset 769 * @label: label to remove 770 * 771 * Returns: true if @label was removed from the tree 772 * else @label was not in tree so it could not be removed 773 */ 774bool aa_label_remove(struct aa_label *label) 775{ 776 struct aa_labelset *ls = labels_set(label); 777 unsigned long flags; 778 bool res; 779 780 AA_BUG(!ls); 781 782 write_lock_irqsave(&ls->lock, flags); 783 res = __label_remove(label, ns_unconfined(labels_ns(label))); 784 write_unlock_irqrestore(&ls->lock, flags); 785 786 return res; 787} 788 789/** 790 * aa_label_replace - replace a label @old with a new version @new 791 * @old: label to replace 792 * @new: label replacing @old 793 * 794 * Returns: true if @old was in tree and replaced 795 * else @old was not in tree, and @new was not inserted 796 */ 797bool aa_label_replace(struct aa_label *old, struct aa_label *new) 798{ 799 unsigned long flags; 800 bool res; 801 802 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) { 803 write_lock_irqsave(&labels_set(old)->lock, flags); 804 if (old->proxy != new->proxy) 805 __proxy_share(old, new); 806 else 807 __aa_proxy_redirect(old, new); 808 res = __label_replace(old, new); 809 write_unlock_irqrestore(&labels_set(old)->lock, flags); 810 } else { 811 struct aa_label *l; 812 struct aa_labelset *ls = labels_set(old); 813 814 write_lock_irqsave(&ls->lock, flags); 815 res = __label_remove(old, new); 816 if (labels_ns(old) != labels_ns(new)) { 817 write_unlock_irqrestore(&ls->lock, flags); 818 ls = labels_set(new); 819 write_lock_irqsave(&ls->lock, flags); 820 } 821 l = __label_insert(ls, new, true); 822 res = (l == new); 823 write_unlock_irqrestore(&ls->lock, flags); 824 aa_put_label(l); 825 } 826 827 return res; 828} 829 830/** 831 * vec_find - find label @l in label set 832 * @vec: array of profiles to find equiv label for (NOT NULL) 833 * @n: length of @vec 834 * 835 * Returns: refcounted label if @vec equiv is in tree 836 * else NULL if @vec equiv is not in tree 837 */ 838static struct aa_label *vec_find(struct aa_profile **vec, int n) 839{ 840 struct aa_labelset *ls; 841 struct aa_label *label; 842 unsigned long flags; 843 844 AA_BUG(!vec); 845 AA_BUG(!*vec); 846 AA_BUG(n <= 0); 847 848 ls = vec_labelset(vec, n); 849 read_lock_irqsave(&ls->lock, flags); 850 label = __vec_find(vec, n); 851 read_unlock_irqrestore(&ls->lock, flags); 852 853 return label; 854} 855 856/* requires sort and merge done first */ 857static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec, 858 int len, gfp_t gfp) 859{ 860 struct aa_label *label = NULL; 861 struct aa_labelset *ls; 862 unsigned long flags; 863 struct aa_label *new; 864 int i; 865 866 AA_BUG(!vec); 867 868 if (len == 1) 869 return aa_get_label(&vec[0]->label); 870 871 ls = labels_set(&vec[len - 1]->label); 872 873 /* TODO: enable when read side is lockless 874 * check if label exists before taking locks 875 */ 876 new = aa_label_alloc(len, NULL, gfp); 877 if (!new) 878 return NULL; 879 880 for (i = 0; i < len; i++) 881 new->vec[i] = aa_get_profile(vec[i]); 882 883 write_lock_irqsave(&ls->lock, flags); 884 label = __label_insert(ls, new, false); 885 write_unlock_irqrestore(&ls->lock, flags); 886 label_free_or_put_new(label, new); 887 888 return label; 889} 890 891struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len, 892 gfp_t gfp) 893{ 894 struct aa_label *label = vec_find(vec, len); 895 896 if (label) 897 return label; 898 899 return vec_create_and_insert_label(vec, len, gfp); 900} 901 902/** 903 * aa_label_find - find label @label in label set 904 * @label: label to find (NOT NULL) 905 * 906 * Requires: caller to hold a valid ref on l 907 * 908 * Returns: refcounted @label if @label is in tree 909 * refcounted label that is equiv to @label in tree 910 * else NULL if @label or equiv is not in tree 911 */ 912struct aa_label *aa_label_find(struct aa_label *label) 913{ 914 AA_BUG(!label); 915 916 return vec_find(label->vec, label->size); 917} 918 919 920/** 921 * aa_label_insert - insert label @label into @ls or return existing label 922 * @ls: labelset to insert @label into 923 * @label: label to insert 924 * 925 * Requires: caller to hold a valid ref on @label 926 * 927 * Returns: ref counted @label if successful in inserting @label 928 * else ref counted equivalent label that is already in the set 929 */ 930struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label) 931{ 932 struct aa_label *l; 933 unsigned long flags; 934 935 AA_BUG(!ls); 936 AA_BUG(!label); 937 938 /* check if label exists before taking lock */ 939 if (!label_is_stale(label)) { 940 read_lock_irqsave(&ls->lock, flags); 941 l = __label_find(label); 942 read_unlock_irqrestore(&ls->lock, flags); 943 if (l) 944 return l; 945 } 946 947 write_lock_irqsave(&ls->lock, flags); 948 l = __label_insert(ls, label, false); 949 write_unlock_irqrestore(&ls->lock, flags); 950 951 return l; 952} 953 954 955/** 956 * aa_label_next_in_merge - find the next profile when merging @a and @b 957 * @I: label iterator 958 * @a: label to merge 959 * @b: label to merge 960 * 961 * Returns: next profile 962 * else null if no more profiles 963 */ 964struct aa_profile *aa_label_next_in_merge(struct label_it *I, 965 struct aa_label *a, 966 struct aa_label *b) 967{ 968 AA_BUG(!a); 969 AA_BUG(!b); 970 AA_BUG(!I); 971 AA_BUG(I->i < 0); 972 AA_BUG(I->i > a->size); 973 AA_BUG(I->j < 0); 974 AA_BUG(I->j > b->size); 975 976 if (I->i < a->size) { 977 if (I->j < b->size) { 978 int res = profile_cmp(a->vec[I->i], b->vec[I->j]); 979 980 if (res > 0) 981 return b->vec[(I->j)++]; 982 if (res == 0) 983 (I->j)++; 984 } 985 986 return a->vec[(I->i)++]; 987 } 988 989 if (I->j < b->size) 990 return b->vec[(I->j)++]; 991 992 return NULL; 993} 994 995/** 996 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering 997 * @a: label to merge then compare (NOT NULL) 998 * @b: label to merge then compare (NOT NULL) 999 * @z: label to compare merge against (NOT NULL) 1000 * 1001 * Assumes: using the most recent versions of @a, @b, and @z 1002 * 1003 * Returns: <0 if a < b 1004 * ==0 if a == b 1005 * >0 if a > b 1006 */ 1007static int label_merge_cmp(struct aa_label *a, struct aa_label *b, 1008 struct aa_label *z) 1009{ 1010 struct aa_profile *p = NULL; 1011 struct label_it i = { }; 1012 int k; 1013 1014 AA_BUG(!a); 1015 AA_BUG(!b); 1016 AA_BUG(!z); 1017 1018 for (k = 0; 1019 k < z->size && (p = aa_label_next_in_merge(&i, a, b)); 1020 k++) { 1021 int res = profile_cmp(p, z->vec[k]); 1022 1023 if (res != 0) 1024 return res; 1025 } 1026 1027 if (p) 1028 return 1; 1029 else if (k < z->size) 1030 return -1; 1031 return 0; 1032} 1033 1034/** 1035 * label_merge_insert - create a new label by merging @a and @b 1036 * @new: preallocated label to merge into (NOT NULL) 1037 * @a: label to merge with @b (NOT NULL) 1038 * @b: label to merge with @a (NOT NULL) 1039 * 1040 * Requires: preallocated proxy 1041 * 1042 * Returns: ref counted label either @new if merge is unique 1043 * @a if @b is a subset of @a 1044 * @b if @a is a subset of @b 1045 * 1046 * NOTE: will not use @new if the merge results in @new == @a or @b 1047 * 1048 * Must be used within labelset write lock to avoid racing with 1049 * setting labels stale. 1050 */ 1051static struct aa_label *label_merge_insert(struct aa_label *new, 1052 struct aa_label *a, 1053 struct aa_label *b) 1054{ 1055 struct aa_label *label; 1056 struct aa_labelset *ls; 1057 struct aa_profile *next; 1058 struct label_it i; 1059 unsigned long flags; 1060 int k = 0, invcount = 0; 1061 bool stale = false; 1062 1063 AA_BUG(!a); 1064 AA_BUG(a->size < 0); 1065 AA_BUG(!b); 1066 AA_BUG(b->size < 0); 1067 AA_BUG(!new); 1068 AA_BUG(new->size < a->size + b->size); 1069 1070 label_for_each_in_merge(i, a, b, next) { 1071 AA_BUG(!next); 1072 if (profile_is_stale(next)) { 1073 new->vec[k] = aa_get_newest_profile(next); 1074 AA_BUG(!new->vec[k]->label.proxy); 1075 AA_BUG(!new->vec[k]->label.proxy->label); 1076 if (next->label.proxy != new->vec[k]->label.proxy) 1077 invcount++; 1078 k++; 1079 stale = true; 1080 } else 1081 new->vec[k++] = aa_get_profile(next); 1082 } 1083 /* set to actual size which is <= allocated len */ 1084 new->size = k; 1085 new->vec[k] = NULL; 1086 1087 if (invcount) { 1088 new->size -= aa_vec_unique(&new->vec[0], new->size, 1089 VEC_FLAG_TERMINATE); 1090 /* TODO: deal with reference labels */ 1091 if (new->size == 1) { 1092 label = aa_get_label(&new->vec[0]->label); 1093 return label; 1094 } 1095 } else if (!stale) { 1096 /* 1097 * merge could be same as a || b, note: it is not possible 1098 * for new->size == a->size == b->size unless a == b 1099 */ 1100 if (k == a->size) 1101 return aa_get_label(a); 1102 else if (k == b->size) 1103 return aa_get_label(b); 1104 } 1105 new->flags |= accum_vec_flags(new->vec, new->size); 1106 ls = labels_set(new); 1107 write_lock_irqsave(&ls->lock, flags); 1108 label = __label_insert(labels_set(new), new, false); 1109 write_unlock_irqrestore(&ls->lock, flags); 1110 1111 return label; 1112} 1113 1114/** 1115 * labelset_of_merge - find which labelset a merged label should be inserted 1116 * @a: label to merge and insert 1117 * @b: label to merge and insert 1118 * 1119 * Returns: labelset that the merged label should be inserted into 1120 */ 1121static struct aa_labelset *labelset_of_merge(struct aa_label *a, 1122 struct aa_label *b) 1123{ 1124 struct aa_ns *nsa = labels_ns(a); 1125 struct aa_ns *nsb = labels_ns(b); 1126 1127 if (ns_cmp(nsa, nsb) <= 0) 1128 return &nsa->labels; 1129 return &nsb->labels; 1130} 1131 1132/** 1133 * __label_find_merge - find label that is equiv to merge of @a and @b 1134 * @ls: set of labels to search (NOT NULL) 1135 * @a: label to merge with @b (NOT NULL) 1136 * @b: label to merge with @a (NOT NULL) 1137 * 1138 * Requires: ls->lock read_lock held 1139 * 1140 * Returns: ref counted label that is equiv to merge of @a and @b 1141 * else NULL if merge of @a and @b is not in set 1142 */ 1143static struct aa_label *__label_find_merge(struct aa_labelset *ls, 1144 struct aa_label *a, 1145 struct aa_label *b) 1146{ 1147 struct rb_node *node; 1148 1149 AA_BUG(!ls); 1150 AA_BUG(!a); 1151 AA_BUG(!b); 1152 1153 if (a == b) 1154 return __label_find(a); 1155 1156 node = ls->root.rb_node; 1157 while (node) { 1158 struct aa_label *this = container_of(node, struct aa_label, 1159 node); 1160 int result = label_merge_cmp(a, b, this); 1161 1162 if (result < 0) 1163 node = node->rb_left; 1164 else if (result > 0) 1165 node = node->rb_right; 1166 else 1167 return __aa_get_label(this); 1168 } 1169 1170 return NULL; 1171} 1172 1173 1174/** 1175 * aa_label_find_merge - find label that is equiv to merge of @a and @b 1176 * @a: label to merge with @b (NOT NULL) 1177 * @b: label to merge with @a (NOT NULL) 1178 * 1179 * Requires: labels be fully constructed with a valid ns 1180 * 1181 * Returns: ref counted label that is equiv to merge of @a and @b 1182 * else NULL if merge of @a and @b is not in set 1183 */ 1184struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b) 1185{ 1186 struct aa_labelset *ls; 1187 struct aa_label *label, *ar = NULL, *br = NULL; 1188 unsigned long flags; 1189 1190 AA_BUG(!a); 1191 AA_BUG(!b); 1192 1193 if (label_is_stale(a)) 1194 a = ar = aa_get_newest_label(a); 1195 if (label_is_stale(b)) 1196 b = br = aa_get_newest_label(b); 1197 ls = labelset_of_merge(a, b); 1198 read_lock_irqsave(&ls->lock, flags); 1199 label = __label_find_merge(ls, a, b); 1200 read_unlock_irqrestore(&ls->lock, flags); 1201 aa_put_label(ar); 1202 aa_put_label(br); 1203 1204 return label; 1205} 1206 1207/** 1208 * aa_label_merge - attempt to insert new merged label of @a and @b 1209 * @a: label to merge with @b (NOT NULL) 1210 * @b: label to merge with @a (NOT NULL) 1211 * @gfp: memory allocation type 1212 * 1213 * Requires: caller to hold valid refs on @a and @b 1214 * labels be fully constructed with a valid ns 1215 * 1216 * Returns: ref counted new label if successful in inserting merge of a & b 1217 * else ref counted equivalent label that is already in the set. 1218 * else NULL if could not create label (-ENOMEM) 1219 */ 1220struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b, 1221 gfp_t gfp) 1222{ 1223 struct aa_label *label = NULL; 1224 1225 AA_BUG(!a); 1226 AA_BUG(!b); 1227 1228 if (a == b) 1229 return aa_get_newest_label(a); 1230 1231 /* TODO: enable when read side is lockless 1232 * check if label exists before taking locks 1233 if (!label_is_stale(a) && !label_is_stale(b)) 1234 label = aa_label_find_merge(a, b); 1235 */ 1236 1237 if (!label) { 1238 struct aa_label *new; 1239 1240 a = aa_get_newest_label(a); 1241 b = aa_get_newest_label(b); 1242 1243 /* could use label_merge_len(a, b), but requires double 1244 * comparison for small savings 1245 */ 1246 new = aa_label_alloc(a->size + b->size, NULL, gfp); 1247 if (!new) 1248 goto out; 1249 1250 label = label_merge_insert(new, a, b); 1251 label_free_or_put_new(label, new); 1252out: 1253 aa_put_label(a); 1254 aa_put_label(b); 1255 } 1256 1257 return label; 1258} 1259 1260/* match a profile and its associated ns component if needed 1261 * Assumes visibility test has already been done. 1262 * If a subns profile is not to be matched should be prescreened with 1263 * visibility test. 1264 */ 1265static inline aa_state_t match_component(struct aa_profile *profile, 1266 struct aa_ruleset *rules, 1267 struct aa_profile *tp, 1268 aa_state_t state) 1269{ 1270 const char *ns_name; 1271 1272 if (profile->ns == tp->ns) 1273 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname); 1274 1275 /* try matching with namespace name and then profile */ 1276 ns_name = aa_ns_name(profile->ns, tp->ns, true); 1277 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); 1278 state = aa_dfa_match(rules->policy->dfa, state, ns_name); 1279 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); 1280 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname); 1281} 1282 1283/** 1284 * label_compound_match - find perms for full compound label 1285 * @profile: profile to find perms for 1286 * @rules: ruleset to search 1287 * @label: label to check access permissions for 1288 * @state: state to start match in 1289 * @subns: whether to do permission checks on components in a subns 1290 * @request: permissions to request 1291 * @perms: perms struct to set 1292 * 1293 * Returns: 0 on success else ERROR 1294 * 1295 * For the label A//&B//&C this does the perm match for A//&B//&C 1296 * @perms should be preinitialized with allperms OR a previous permission 1297 * check to be stacked. 1298 */ 1299static int label_compound_match(struct aa_profile *profile, 1300 struct aa_ruleset *rules, 1301 struct aa_label *label, 1302 aa_state_t state, bool subns, u32 request, 1303 struct aa_perms *perms) 1304{ 1305 struct aa_profile *tp; 1306 struct label_it i; 1307 1308 /* find first subcomponent that is visible */ 1309 label_for_each(i, label, tp) { 1310 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1311 continue; 1312 state = match_component(profile, rules, tp, state); 1313 if (!state) 1314 goto fail; 1315 goto next; 1316 } 1317 1318 /* no component visible */ 1319 *perms = allperms; 1320 return 0; 1321 1322next: 1323 label_for_each_cont(i, label, tp) { 1324 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1325 continue; 1326 state = aa_dfa_match(rules->policy->dfa, state, "//&"); 1327 state = match_component(profile, rules, tp, state); 1328 if (!state) 1329 goto fail; 1330 } 1331 *perms = *aa_lookup_perms(rules->policy, state); 1332 aa_apply_modes_to_perms(profile, perms); 1333 if ((perms->allow & request) != request) 1334 return -EACCES; 1335 1336 return 0; 1337 1338fail: 1339 *perms = nullperms; 1340 return state; 1341} 1342 1343/** 1344 * label_components_match - find perms for all subcomponents of a label 1345 * @profile: profile to find perms for 1346 * @rules: ruleset to search 1347 * @label: label to check access permissions for 1348 * @start: state to start match in 1349 * @subns: whether to do permission checks on components in a subns 1350 * @request: permissions to request 1351 * @perms: an initialized perms struct to add accumulation to 1352 * 1353 * Returns: 0 on success else ERROR 1354 * 1355 * For the label A//&B//&C this does the perm match for each of A and B and C 1356 * @perms should be preinitialized with allperms OR a previous permission 1357 * check to be stacked. 1358 */ 1359static int label_components_match(struct aa_profile *profile, 1360 struct aa_ruleset *rules, 1361 struct aa_label *label, aa_state_t start, 1362 bool subns, u32 request, 1363 struct aa_perms *perms) 1364{ 1365 struct aa_profile *tp; 1366 struct label_it i; 1367 struct aa_perms tmp; 1368 aa_state_t state = 0; 1369 1370 /* find first subcomponent to test */ 1371 label_for_each(i, label, tp) { 1372 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1373 continue; 1374 state = match_component(profile, rules, tp, start); 1375 if (!state) 1376 goto fail; 1377 goto next; 1378 } 1379 1380 /* no subcomponents visible - no change in perms */ 1381 return 0; 1382 1383next: 1384 tmp = *aa_lookup_perms(rules->policy, state); 1385 aa_apply_modes_to_perms(profile, &tmp); 1386 aa_perms_accum(perms, &tmp); 1387 label_for_each_cont(i, label, tp) { 1388 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1389 continue; 1390 state = match_component(profile, rules, tp, start); 1391 if (!state) 1392 goto fail; 1393 tmp = *aa_lookup_perms(rules->policy, state); 1394 aa_apply_modes_to_perms(profile, &tmp); 1395 aa_perms_accum(perms, &tmp); 1396 } 1397 1398 if ((perms->allow & request) != request) 1399 return -EACCES; 1400 1401 return 0; 1402 1403fail: 1404 *perms = nullperms; 1405 return -EACCES; 1406} 1407 1408/** 1409 * aa_label_match - do a multi-component label match 1410 * @profile: profile to match against (NOT NULL) 1411 * @rules: ruleset to search 1412 * @label: label to match (NOT NULL) 1413 * @state: state to start in 1414 * @subns: whether to match subns components 1415 * @request: permission request 1416 * @perms: Returns computed perms (NOT NULL) 1417 * 1418 * Returns: the state the match finished in, may be the none matching state 1419 */ 1420int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules, 1421 struct aa_label *label, aa_state_t state, bool subns, 1422 u32 request, struct aa_perms *perms) 1423{ 1424 int error = label_compound_match(profile, rules, label, state, subns, 1425 request, perms); 1426 if (!error) 1427 return error; 1428 1429 *perms = allperms; 1430 return label_components_match(profile, rules, label, state, subns, 1431 request, perms); 1432} 1433 1434 1435/** 1436 * aa_update_label_name - update a label to have a stored name 1437 * @ns: ns being viewed from (NOT NULL) 1438 * @label: label to update (NOT NULL) 1439 * @gfp: type of memory allocation 1440 * 1441 * Requires: labels_set(label) not locked in caller 1442 * 1443 * note: only updates the label name if it does not have a name already 1444 * and if it is in the labelset 1445 */ 1446bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp) 1447{ 1448 struct aa_labelset *ls; 1449 unsigned long flags; 1450 char __counted *name; 1451 bool res = false; 1452 1453 AA_BUG(!ns); 1454 AA_BUG(!label); 1455 1456 if (label->hname || labels_ns(label) != ns) 1457 return res; 1458 1459 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) 1460 return res; 1461 1462 ls = labels_set(label); 1463 write_lock_irqsave(&ls->lock, flags); 1464 if (!label->hname && label->flags & FLAG_IN_TREE) { 1465 label->hname = name; 1466 res = true; 1467 } else 1468 aa_put_str(name); 1469 write_unlock_irqrestore(&ls->lock, flags); 1470 1471 return res; 1472} 1473 1474/* 1475 * cached label name is present and visible 1476 * @label->hname only exists if label is namespace hierachical 1477 */ 1478static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, 1479 int flags) 1480{ 1481 if (label->hname && (!ns || labels_ns(label) == ns) && 1482 !(flags & ~FLAG_SHOW_MODE)) 1483 return true; 1484 1485 return false; 1486} 1487 1488/* helper macro for snprint routines */ 1489#define update_for_len(total, len, size, str) \ 1490do { \ 1491 size_t ulen = len; \ 1492 \ 1493 AA_BUG(len < 0); \ 1494 total += ulen; \ 1495 ulen = min(ulen, size); \ 1496 size -= ulen; \ 1497 str += ulen; \ 1498} while (0) 1499 1500/** 1501 * aa_profile_snxprint - print a profile name to a buffer 1502 * @str: buffer to write to. (MAY BE NULL if @size == 0) 1503 * @size: size of buffer 1504 * @view: namespace profile is being viewed from 1505 * @profile: profile to view (NOT NULL) 1506 * @flags: whether to include the mode string 1507 * @prev_ns: last ns printed when used in compound print 1508 * 1509 * Returns: size of name written or would be written if larger than 1510 * available buffer 1511 * 1512 * Note: will not print anything if the profile is not visible 1513 */ 1514static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view, 1515 struct aa_profile *profile, int flags, 1516 struct aa_ns **prev_ns) 1517{ 1518 const char *ns_name = NULL; 1519 1520 AA_BUG(!str && size != 0); 1521 AA_BUG(!profile); 1522 1523 if (!view) 1524 view = profiles_ns(profile); 1525 1526 if (view != profile->ns && 1527 (!prev_ns || (*prev_ns != profile->ns))) { 1528 if (prev_ns) 1529 *prev_ns = profile->ns; 1530 ns_name = aa_ns_name(view, profile->ns, 1531 flags & FLAG_VIEW_SUBNS); 1532 if (ns_name == aa_hidden_ns_name) { 1533 if (flags & FLAG_HIDDEN_UNCONFINED) 1534 return snprintf(str, size, "%s", "unconfined"); 1535 return snprintf(str, size, "%s", ns_name); 1536 } 1537 } 1538 1539 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) { 1540 const char *modestr = aa_profile_mode_names[profile->mode]; 1541 1542 if (ns_name) 1543 return snprintf(str, size, ":%s:%s (%s)", ns_name, 1544 profile->base.hname, modestr); 1545 return snprintf(str, size, "%s (%s)", profile->base.hname, 1546 modestr); 1547 } 1548 1549 if (ns_name) 1550 return snprintf(str, size, ":%s:%s", ns_name, 1551 profile->base.hname); 1552 return snprintf(str, size, "%s", profile->base.hname); 1553} 1554 1555static const char *label_modename(struct aa_ns *ns, struct aa_label *label, 1556 int flags) 1557{ 1558 struct aa_profile *profile; 1559 struct label_it i; 1560 int mode = -1, count = 0; 1561 1562 label_for_each(i, label, profile) { 1563 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { 1564 count++; 1565 if (profile == profile->ns->unconfined) 1566 /* special case unconfined so stacks with 1567 * unconfined don't report as mixed. ie. 1568 * profile_foo//&:ns1:unconfined (mixed) 1569 */ 1570 continue; 1571 if (mode == -1) 1572 mode = profile->mode; 1573 else if (mode != profile->mode) 1574 return "mixed"; 1575 } 1576 } 1577 1578 if (count == 0) 1579 return "-"; 1580 if (mode == -1) 1581 /* everything was unconfined */ 1582 mode = APPARMOR_UNCONFINED; 1583 1584 return aa_profile_mode_names[mode]; 1585} 1586 1587/* if any visible label is not unconfined the display_mode returns true */ 1588static inline bool display_mode(struct aa_ns *ns, struct aa_label *label, 1589 int flags) 1590{ 1591 if ((flags & FLAG_SHOW_MODE)) { 1592 struct aa_profile *profile; 1593 struct label_it i; 1594 1595 label_for_each(i, label, profile) { 1596 if (aa_ns_visible(ns, profile->ns, 1597 flags & FLAG_VIEW_SUBNS) && 1598 profile != profile->ns->unconfined) 1599 return true; 1600 } 1601 /* only ns->unconfined in set of profiles in ns */ 1602 return false; 1603 } 1604 1605 return false; 1606} 1607 1608/** 1609 * aa_label_snxprint - print a label name to a string buffer 1610 * @str: buffer to write to. (MAY BE NULL if @size == 0) 1611 * @size: size of buffer 1612 * @ns: namespace profile is being viewed from 1613 * @label: label to view (NOT NULL) 1614 * @flags: whether to include the mode string 1615 * 1616 * Returns: size of name written or would be written if larger than 1617 * available buffer 1618 * 1619 * Note: labels do not have to be strictly hierarchical to the ns as 1620 * objects may be shared across different namespaces and thus 1621 * pickup labeling from each ns. If a particular part of the 1622 * label is not visible it will just be excluded. And if none 1623 * of the label is visible "---" will be used. 1624 */ 1625int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, 1626 struct aa_label *label, int flags) 1627{ 1628 struct aa_profile *profile; 1629 struct aa_ns *prev_ns = NULL; 1630 struct label_it i; 1631 int count = 0, total = 0; 1632 ssize_t len; 1633 1634 AA_BUG(!str && size != 0); 1635 AA_BUG(!label); 1636 1637 if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) { 1638 ns = root_ns; 1639 len = snprintf(str, size, "_"); 1640 update_for_len(total, len, size, str); 1641 } else if (!ns) { 1642 ns = labels_ns(label); 1643 } 1644 1645 label_for_each(i, label, profile) { 1646 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { 1647 if (count > 0) { 1648 len = snprintf(str, size, "//&"); 1649 update_for_len(total, len, size, str); 1650 } 1651 len = aa_profile_snxprint(str, size, ns, profile, 1652 flags & FLAG_VIEW_SUBNS, 1653 &prev_ns); 1654 update_for_len(total, len, size, str); 1655 count++; 1656 } 1657 } 1658 1659 if (count == 0) { 1660 if (flags & FLAG_HIDDEN_UNCONFINED) 1661 return snprintf(str, size, "%s", "unconfined"); 1662 return snprintf(str, size, "%s", aa_hidden_ns_name); 1663 } 1664 1665 /* count == 1 && ... is for backwards compat where the mode 1666 * is not displayed for 'unconfined' in the current ns 1667 */ 1668 if (display_mode(ns, label, flags)) { 1669 len = snprintf(str, size, " (%s)", 1670 label_modename(ns, label, flags)); 1671 update_for_len(total, len, size, str); 1672 } 1673 1674 return total; 1675} 1676#undef update_for_len 1677 1678/** 1679 * aa_label_asxprint - allocate a string buffer and print label into it 1680 * @strp: Returns - the allocated buffer with the label name. (NOT NULL) 1681 * @ns: namespace profile is being viewed from 1682 * @label: label to view (NOT NULL) 1683 * @flags: flags controlling what label info is printed 1684 * @gfp: kernel memory allocation type 1685 * 1686 * Returns: size of name written or would be written if larger than 1687 * available buffer 1688 */ 1689int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, 1690 int flags, gfp_t gfp) 1691{ 1692 int size; 1693 1694 AA_BUG(!strp); 1695 AA_BUG(!label); 1696 1697 size = aa_label_snxprint(NULL, 0, ns, label, flags); 1698 if (size < 0) 1699 return size; 1700 1701 *strp = kmalloc(size + 1, gfp); 1702 if (!*strp) 1703 return -ENOMEM; 1704 return aa_label_snxprint(*strp, size + 1, ns, label, flags); 1705} 1706 1707/** 1708 * aa_label_acntsxprint - allocate a __counted string buffer and print label 1709 * @strp: buffer to write to. 1710 * @ns: namespace profile is being viewed from 1711 * @label: label to view (NOT NULL) 1712 * @flags: flags controlling what label info is printed 1713 * @gfp: kernel memory allocation type 1714 * 1715 * Returns: size of name written or would be written if larger than 1716 * available buffer 1717 */ 1718int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns, 1719 struct aa_label *label, int flags, gfp_t gfp) 1720{ 1721 int size; 1722 1723 AA_BUG(!strp); 1724 AA_BUG(!label); 1725 1726 size = aa_label_snxprint(NULL, 0, ns, label, flags); 1727 if (size < 0) 1728 return size; 1729 1730 *strp = aa_str_alloc(size + 1, gfp); 1731 if (!*strp) 1732 return -ENOMEM; 1733 return aa_label_snxprint(*strp, size + 1, ns, label, flags); 1734} 1735 1736 1737void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, 1738 struct aa_label *label, int flags, gfp_t gfp) 1739{ 1740 const char *str; 1741 char *name = NULL; 1742 int len; 1743 1744 AA_BUG(!ab); 1745 AA_BUG(!label); 1746 1747 if (!use_label_hname(ns, label, flags) || 1748 display_mode(ns, label, flags)) { 1749 len = aa_label_asxprint(&name, ns, label, flags, gfp); 1750 if (len < 0) { 1751 AA_DEBUG("label print error"); 1752 return; 1753 } 1754 str = name; 1755 } else { 1756 str = (char *) label->hname; 1757 len = strlen(str); 1758 } 1759 if (audit_string_contains_control(str, len)) 1760 audit_log_n_hex(ab, str, len); 1761 else 1762 audit_log_n_string(ab, str, len); 1763 1764 kfree(name); 1765} 1766 1767void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, 1768 struct aa_label *label, int flags, gfp_t gfp) 1769{ 1770 AA_BUG(!f); 1771 AA_BUG(!label); 1772 1773 if (!use_label_hname(ns, label, flags)) { 1774 char *str; 1775 int len; 1776 1777 len = aa_label_asxprint(&str, ns, label, flags, gfp); 1778 if (len < 0) { 1779 AA_DEBUG("label print error"); 1780 return; 1781 } 1782 seq_puts(f, str); 1783 kfree(str); 1784 } else if (display_mode(ns, label, flags)) 1785 seq_printf(f, "%s (%s)", label->hname, 1786 label_modename(ns, label, flags)); 1787 else 1788 seq_puts(f, label->hname); 1789} 1790 1791void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, 1792 gfp_t gfp) 1793{ 1794 AA_BUG(!label); 1795 1796 if (!use_label_hname(ns, label, flags)) { 1797 char *str; 1798 int len; 1799 1800 len = aa_label_asxprint(&str, ns, label, flags, gfp); 1801 if (len < 0) { 1802 AA_DEBUG("label print error"); 1803 return; 1804 } 1805 pr_info("%s", str); 1806 kfree(str); 1807 } else if (display_mode(ns, label, flags)) 1808 pr_info("%s (%s)", label->hname, 1809 label_modename(ns, label, flags)); 1810 else 1811 pr_info("%s", label->hname); 1812} 1813 1814void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp) 1815{ 1816 struct aa_ns *ns = aa_get_current_ns(); 1817 1818 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp); 1819 aa_put_ns(ns); 1820} 1821 1822void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp) 1823{ 1824 struct aa_ns *ns = aa_get_current_ns(); 1825 1826 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp); 1827 aa_put_ns(ns); 1828} 1829 1830void aa_label_printk(struct aa_label *label, gfp_t gfp) 1831{ 1832 struct aa_ns *ns = aa_get_current_ns(); 1833 1834 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp); 1835 aa_put_ns(ns); 1836} 1837 1838static int label_count_strn_entries(const char *str, size_t n) 1839{ 1840 const char *end = str + n; 1841 const char *split; 1842 int count = 1; 1843 1844 AA_BUG(!str); 1845 1846 for (split = aa_label_strn_split(str, end - str); 1847 split; 1848 split = aa_label_strn_split(str, end - str)) { 1849 count++; 1850 str = split + 3; 1851 } 1852 1853 return count; 1854} 1855 1856/* 1857 * ensure stacks with components like 1858 * :ns:A//&B 1859 * have :ns: applied to both 'A' and 'B' by making the lookup relative 1860 * to the base if the lookup specifies an ns, else making the stacked lookup 1861 * relative to the last embedded ns in the string. 1862 */ 1863static struct aa_profile *fqlookupn_profile(struct aa_label *base, 1864 struct aa_label *currentbase, 1865 const char *str, size_t n) 1866{ 1867 const char *first = skipn_spaces(str, n); 1868 1869 if (first && *first == ':') 1870 return aa_fqlookupn_profile(base, str, n); 1871 1872 return aa_fqlookupn_profile(currentbase, str, n); 1873} 1874 1875/** 1876 * aa_label_strn_parse - parse, validate and convert a text string to a label 1877 * @base: base label to use for lookups (NOT NULL) 1878 * @str: null terminated text string (NOT NULL) 1879 * @n: length of str to parse, will stop at \0 if encountered before n 1880 * @gfp: allocation type 1881 * @create: true if should create compound labels if they don't exist 1882 * @force_stack: true if should stack even if no leading & 1883 * 1884 * Returns: the matching refcounted label if present 1885 * else ERRPTR 1886 */ 1887struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, 1888 size_t n, gfp_t gfp, bool create, 1889 bool force_stack) 1890{ 1891 DEFINE_VEC(profile, vec); 1892 struct aa_label *label, *currbase = base; 1893 int i, len, stack = 0, error; 1894 const char *end = str + n; 1895 const char *split; 1896 1897 AA_BUG(!base); 1898 AA_BUG(!str); 1899 1900 str = skipn_spaces(str, n); 1901 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' && 1902 base != &root_ns->unconfined->label)) 1903 return ERR_PTR(-EINVAL); 1904 1905 len = label_count_strn_entries(str, end - str); 1906 if (*str == '&' || force_stack) { 1907 /* stack on top of base */ 1908 stack = base->size; 1909 len += stack; 1910 if (*str == '&') 1911 str++; 1912 } 1913 1914 error = vec_setup(profile, vec, len, gfp); 1915 if (error) 1916 return ERR_PTR(error); 1917 1918 for (i = 0; i < stack; i++) 1919 vec[i] = aa_get_profile(base->vec[i]); 1920 1921 for (split = aa_label_strn_split(str, end - str), i = stack; 1922 split && i < len; i++) { 1923 vec[i] = fqlookupn_profile(base, currbase, str, split - str); 1924 if (!vec[i]) 1925 goto fail; 1926 /* 1927 * if component specified a new ns it becomes the new base 1928 * so that subsequent lookups are relative to it 1929 */ 1930 if (vec[i]->ns != labels_ns(currbase)) 1931 currbase = &vec[i]->label; 1932 str = split + 3; 1933 split = aa_label_strn_split(str, end - str); 1934 } 1935 /* last element doesn't have a split */ 1936 if (i < len) { 1937 vec[i] = fqlookupn_profile(base, currbase, str, end - str); 1938 if (!vec[i]) 1939 goto fail; 1940 } 1941 if (len == 1) 1942 /* no need to free vec as len < LOCAL_VEC_ENTRIES */ 1943 return &vec[0]->label; 1944 1945 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE); 1946 /* TODO: deal with reference labels */ 1947 if (len == 1) { 1948 label = aa_get_label(&vec[0]->label); 1949 goto out; 1950 } 1951 1952 if (create) 1953 label = aa_vec_find_or_create_label(vec, len, gfp); 1954 else 1955 label = vec_find(vec, len); 1956 if (!label) 1957 goto fail; 1958 1959out: 1960 /* use adjusted len from after vec_unique, not original */ 1961 vec_cleanup(profile, vec, len); 1962 return label; 1963 1964fail: 1965 label = ERR_PTR(-ENOENT); 1966 goto out; 1967} 1968 1969struct aa_label *aa_label_parse(struct aa_label *base, const char *str, 1970 gfp_t gfp, bool create, bool force_stack) 1971{ 1972 return aa_label_strn_parse(base, str, strlen(str), gfp, create, 1973 force_stack); 1974} 1975 1976/** 1977 * aa_labelset_destroy - remove all labels from the label set 1978 * @ls: label set to cleanup (NOT NULL) 1979 * 1980 * Labels that are removed from the set may still exist beyond the set 1981 * being destroyed depending on their reference counting 1982 */ 1983void aa_labelset_destroy(struct aa_labelset *ls) 1984{ 1985 struct rb_node *node; 1986 unsigned long flags; 1987 1988 AA_BUG(!ls); 1989 1990 write_lock_irqsave(&ls->lock, flags); 1991 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) { 1992 struct aa_label *this = rb_entry(node, struct aa_label, node); 1993 1994 if (labels_ns(this) != root_ns) 1995 __label_remove(this, 1996 ns_unconfined(labels_ns(this)->parent)); 1997 else 1998 __label_remove(this, NULL); 1999 } 2000 write_unlock_irqrestore(&ls->lock, flags); 2001} 2002 2003/* 2004 * @ls: labelset to init (NOT NULL) 2005 */ 2006void aa_labelset_init(struct aa_labelset *ls) 2007{ 2008 AA_BUG(!ls); 2009 2010 rwlock_init(&ls->lock); 2011 ls->root = RB_ROOT; 2012} 2013 2014static struct aa_label *labelset_next_stale(struct aa_labelset *ls) 2015{ 2016 struct aa_label *label; 2017 struct rb_node *node; 2018 unsigned long flags; 2019 2020 AA_BUG(!ls); 2021 2022 read_lock_irqsave(&ls->lock, flags); 2023 2024 __labelset_for_each(ls, node) { 2025 label = rb_entry(node, struct aa_label, node); 2026 if ((label_is_stale(label) || 2027 vec_is_stale(label->vec, label->size)) && 2028 __aa_get_label(label)) 2029 goto out; 2030 2031 } 2032 label = NULL; 2033 2034out: 2035 read_unlock_irqrestore(&ls->lock, flags); 2036 2037 return label; 2038} 2039 2040/** 2041 * __label_update - insert updated version of @label into labelset 2042 * @label: the label to update/replace 2043 * 2044 * Returns: new label that is up to date 2045 * else NULL on failure 2046 * 2047 * Requires: @ns lock be held 2048 * 2049 * Note: worst case is the stale @label does not get updated and has 2050 * to be updated at a later time. 2051 */ 2052static struct aa_label *__label_update(struct aa_label *label) 2053{ 2054 struct aa_label *new, *tmp; 2055 struct aa_labelset *ls; 2056 unsigned long flags; 2057 int i, invcount = 0; 2058 2059 AA_BUG(!label); 2060 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock)); 2061 2062 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); 2063 if (!new) 2064 return NULL; 2065 2066 /* 2067 * while holding the ns_lock will stop profile replacement, removal, 2068 * and label updates, label merging and removal can be occurring 2069 */ 2070 ls = labels_set(label); 2071 write_lock_irqsave(&ls->lock, flags); 2072 for (i = 0; i < label->size; i++) { 2073 AA_BUG(!label->vec[i]); 2074 new->vec[i] = aa_get_newest_profile(label->vec[i]); 2075 AA_BUG(!new->vec[i]); 2076 AA_BUG(!new->vec[i]->label.proxy); 2077 AA_BUG(!new->vec[i]->label.proxy->label); 2078 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) 2079 invcount++; 2080 } 2081 2082 /* updated stale label by being removed/renamed from labelset */ 2083 if (invcount) { 2084 new->size -= aa_vec_unique(&new->vec[0], new->size, 2085 VEC_FLAG_TERMINATE); 2086 /* TODO: deal with reference labels */ 2087 if (new->size == 1) { 2088 tmp = aa_get_label(&new->vec[0]->label); 2089 AA_BUG(tmp == label); 2090 goto remove; 2091 } 2092 if (labels_set(label) != labels_set(new)) { 2093 write_unlock_irqrestore(&ls->lock, flags); 2094 tmp = aa_label_insert(labels_set(new), new); 2095 write_lock_irqsave(&ls->lock, flags); 2096 goto remove; 2097 } 2098 } else 2099 AA_BUG(labels_ns(label) != labels_ns(new)); 2100 2101 tmp = __label_insert(labels_set(label), new, true); 2102remove: 2103 /* ensure label is removed, and redirected correctly */ 2104 __label_remove(label, tmp); 2105 write_unlock_irqrestore(&ls->lock, flags); 2106 label_free_or_put_new(tmp, new); 2107 2108 return tmp; 2109} 2110 2111/** 2112 * __labelset_update - update labels in @ns 2113 * @ns: namespace to update labels in (NOT NULL) 2114 * 2115 * Requires: @ns lock be held 2116 * 2117 * Walk the labelset ensuring that all labels are up to date and valid 2118 * Any label that has a stale component is marked stale and replaced and 2119 * by an updated version. 2120 * 2121 * If failures happen due to memory pressures then stale labels will 2122 * be left in place until the next pass. 2123 */ 2124static void __labelset_update(struct aa_ns *ns) 2125{ 2126 struct aa_label *label; 2127 2128 AA_BUG(!ns); 2129 AA_BUG(!mutex_is_locked(&ns->lock)); 2130 2131 do { 2132 label = labelset_next_stale(&ns->labels); 2133 if (label) { 2134 struct aa_label *l = __label_update(label); 2135 2136 aa_put_label(l); 2137 aa_put_label(label); 2138 } 2139 } while (label); 2140} 2141 2142/** 2143 * __aa_labelset_update_subtree - update all labels with a stale component 2144 * @ns: ns to start update at (NOT NULL) 2145 * 2146 * Requires: @ns lock be held 2147 * 2148 * Invalidates labels based on @p in @ns and any children namespaces. 2149 */ 2150void __aa_labelset_update_subtree(struct aa_ns *ns) 2151{ 2152 struct aa_ns *child; 2153 2154 AA_BUG(!ns); 2155 AA_BUG(!mutex_is_locked(&ns->lock)); 2156 2157 __labelset_update(ns); 2158 2159 list_for_each_entry(child, &ns->sub_ns, base.list) { 2160 mutex_lock_nested(&child->lock, child->level); 2161 __aa_labelset_update_subtree(child); 2162 mutex_unlock(&child->lock); 2163 } 2164} 2165