Lines Matching refs:profile
33 * may_change_ptraced_domain - check if can change profile on ptraced task
35 * @to_label: profile to change to (NOT NULL)
82 /* match a profile and its associated ns component if needed
84 * If a subns profile is not to be matched should be prescreened with
87 static inline aa_state_t match_component(struct aa_profile *profile,
91 struct aa_ruleset *rules = list_first_entry(&profile->rules,
97 if (profile->ns == tp->ns)
100 /* try matching with namespace name and then profile */
101 ns_name = aa_ns_name(profile->ns, tp->ns, true);
110 * @profile: profile to find perms for
124 static int label_compound_match(struct aa_profile *profile,
129 struct aa_ruleset *rules = list_first_entry(&profile->rules,
137 if (!aa_ns_visible(profile->ns, tp->ns, subns))
139 state = match_component(profile, tp, stack, state);
151 if (!aa_ns_visible(profile->ns, tp->ns, subns))
154 state = match_component(profile, tp, false, state);
159 aa_apply_modes_to_perms(profile, perms);
172 * @profile: profile to find perms for
186 static int label_components_match(struct aa_profile *profile,
191 struct aa_ruleset *rules = list_first_entry(&profile->rules,
201 if (!aa_ns_visible(profile->ns, tp->ns, subns))
203 state = match_component(profile, tp, stack, start);
214 aa_apply_modes_to_perms(profile, &tmp);
217 if (!aa_ns_visible(profile->ns, tp->ns, subns))
219 state = match_component(profile, tp, stack, start);
223 aa_apply_modes_to_perms(profile, &tmp);
239 * @profile: profile to match against (NOT NULL)
249 static int label_match(struct aa_profile *profile, struct aa_label *label,
256 error = label_compound_match(profile, label, stack, state, subns,
262 return label_components_match(profile, label, stack, state, subns,
270 * @profile: the current profile (NOT NULL)
282 static int change_profile_perms(struct aa_profile *profile,
287 if (profile_unconfined(profile)) {
293 /* TODO: add profile in ns screening */
294 return label_match(profile, target, stack, start, true, request, perms);
298 * aa_xattrs_match - check whether a file matches the xattrs defined in profile
300 * @profile: profile to match against (NOT NULL)
306 struct aa_profile *profile, aa_state_t state)
311 struct aa_attachment *attach = &profile->attach;
371 * @head - profile list to walk (NOT NULL)
390 struct aa_profile *profile, *candidate = NULL;
397 list_for_each_entry_rcu(profile, head, base.list) {
398 struct aa_attachment *attach = &profile->attach;
400 if (profile->label.flags & FLAG_NULL &&
401 &profile->label == ns_unconfined(profile->ns))
404 /* Find the "best" matching profile. Profiles must
412 * as another profile, signal a conflict and refuse to
435 if (!aa_get_profile_not0(profile))
438 ret = aa_xattrs_match(bprm, profile,
441 aa_put_profile(profile);
470 candidate = profile;
475 } else if (!strcmp(profile->base.name, name)) {
480 candidate = profile;
487 *info = "conflicting profile attachments";
506 * @profile: current profile (NOT NULL)
512 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,
515 struct aa_ruleset *rules = list_first_entry(&profile->rules,
532 new_profile = aa_find_child(profile, *name);
537 label = aa_label_parse(&profile->label, *name, GFP_KERNEL,
550 * @profile: current profile (NOT NULL)
560 static struct aa_label *x_to_label(struct aa_profile *profile,
566 struct aa_ruleset *rules = list_first_entry(&profile->rules,
569 struct aa_ns *ns = profile->ns;
583 new = x_table_lookup(profile, xindex, lookupname);
591 new = find_attach(bprm, ns, &profile->base.profiles,
603 /* (p|c|n)ix - don't change profile but do
607 /* no profile && no error */
608 new = aa_get_newest_label(&profile->label);
610 new = aa_get_newest_label(ns_unconfined(profile->ns));
630 struct aa_profile *profile,
635 struct aa_ruleset *rules = list_first_entry(&profile->rules,
644 AA_BUG(!profile);
648 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
649 &name, &info, profile->disconnected);
651 if (profile_unconfined(profile) ||
652 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
655 new = aa_get_newest_label(&profile->label);
661 if (profile_unconfined(profile)) {
662 new = find_attach(bprm, profile->ns,
663 &profile->ns->base.profiles, name, &info);
669 return aa_get_newest_label(&profile->label);
676 new = x_to_label(profile, bprm, name, perms.xindex, &target,
678 if (new && new->proxy == profile->label.proxy && info) {
683 info = "profile transition not found";
687 } else if (COMPLAIN_MODE(profile)) {
691 new_profile = aa_new_learning_profile(profile, false, name,
695 info = "could not create null profile";
712 " for %s profile=", name);
720 aa_audit_file(subj_cred, profile, &perms, OP_EXEC, MAY_EXEC, name,
732 struct aa_profile *profile, struct aa_label *onexec,
737 struct aa_ruleset *rules = list_first_entry(&profile->rules,
744 AA_BUG(!profile);
749 if (profile_unconfined(profile)) {
759 error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,
760 &xname, &info, profile->disconnected);
762 if (profile_unconfined(profile) ||
763 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {
782 error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC,
800 return aa_audit_file(subj_cred, profile, &perms, OP_EXEC,
814 struct aa_profile *profile;
824 error = fn_for_each_in_ns(label, profile,
825 profile_onexec(subj_cred, profile, onexec, stack,
829 new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
831 profile_transition(subj_cred, profile, bprm,
837 error = fn_for_each_in_ns(label, profile,
838 profile_onexec(subj_cred, profile, onexec, stack, bprm,
842 new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
843 aa_label_merge(&profile->label, onexec,
845 profile_transition(subj_cred, profile, bprm,
854 error = fn_for_each_in_ns(label, profile,
855 aa_audit_file(subj_cred, profile, &nullperms,
876 struct aa_profile *profile;
918 new = fn_label_build(label, profile, GFP_KERNEL,
919 profile_transition(subj_cred, profile, bprm,
954 /* TODO: test needs to be profile of label to new */
991 error = fn_for_each(label, profile,
992 aa_audit_file(current_cred(), profile, &nullperms,
1001 * Functions for self directed profile change
1010 struct aa_profile *profile,
1017 if (sibling && PROFILE_IS_HAT(profile)) {
1018 root = aa_get_profile_rcu(&profile->parent);
1019 } else if (!sibling && !PROFILE_IS_HAT(profile)) {
1020 root = aa_get_profile(profile);
1030 if (COMPLAIN_MODE(profile)) {
1031 hat = aa_new_learning_profile(profile, true, name,
1034 info = "failed null profile create";
1042 aa_audit_file(subj_cred, profile, &nullperms, OP_CHANGE_HAT,
1063 struct aa_profile *profile, *root, *hat = NULL;
1080 label_for_each_in_ns(it, labels_ns(label), label, profile) {
1081 if (sibling && PROFILE_IS_HAT(profile)) {
1082 root = aa_get_profile_rcu(&profile->parent);
1083 } else if (!sibling && !PROFILE_IS_HAT(profile)) {
1084 root = aa_get_profile(profile);
1093 if (!COMPLAIN_MODE(profile))
1116 label_for_each_in_ns(it, labels_ns(label), label, profile) {
1117 if (!list_empty(&profile->base.profiles)) {
1127 label_for_each_in_ns(it, labels_ns(label), label, profile) {
1135 if (count > 1 || COMPLAIN_MODE(profile)) {
1136 aa_audit_file(subj_cred, profile, &nullperms,
1145 new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
1146 build_change_hat(subj_cred, profile, name,
1148 aa_get_label(&profile->label));
1167 * Change to the first profile specified in @hats that exists, and store
1170 * top level profile.
1172 * change_hat only applies to profiles in the current ns, and each profile
1180 struct aa_profile *profile;
1264 } /* else ignore @flags && restores when there is no saved profile */
1279 fn_for_each_in_ns(label, profile,
1280 aa_audit_file(subj_cred, profile, &perms, OP_CHANGE_HAT,
1290 struct aa_profile *profile,
1294 struct aa_ruleset *rules = list_first_entry(&profile->rules,
1300 error = change_profile_perms(profile, target, stack, request,
1304 error = aa_audit_file(subj_cred, profile, perms, op, request,
1313 * aa_change_profile - perform a one-way profile transition
1314 * @fqname: name of profile may include namespace (NOT NULL)
1317 * Change to new profile @name. Unlike with hats, there is no way
1318 * to change back. If @name isn't specified the current profile name is
1328 struct aa_profile *profile;
1353 AA_DEBUG("no profile name");
1384 * TODO: fixme using labels_profile is not right - do profile
1385 * per complain profile
1394 info = "failed null profile create";
1410 error = fn_for_each_in_ns(label, profile,
1413 profile, target, stack,
1424 if (error && !fn_for_each_in_ns(label, profile,
1425 COMPLAIN_MODE(profile)))
1440 new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
1442 aa_get_label(&profile->label));
1482 error = fn_for_each_in_ns(label, profile,
1484 profile, &perms, op, request, auditname,