Lines Matching defs:profile
11 * task is confined by. Every task in the system has a profile attached
15 * Each profile exists in a profile namespace which is a container of
16 * visible profiles. Each namespace contains a special "unconfined" profile,
19 * Namespace and profile names can be written together in either
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
26 * Reserved profile names
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
35 * a // in a profile or namespace name indicates a hierarchical name with the
43 * The profile hierarchy severs two distinct purposes,
45 * subprograms under its own profile with different restriction than it
46 * self, and not have it use the system profile.
52 * but is allowed. NOTE: this is currently suboptimal because profile
53 * aliasing is not currently implemented so that a profile for each
58 * A profile or namespace name that can contain one or more // separators
62 * An fqname is a name that may contain both namespace and profile hnames.
66 * - locking of profile lists is currently fairly coarse. All profile
68 * FIXME: move profile lists to using rcu_lists
104 * @profile: the profile to add (NOT NULL)
106 * refcount @profile, should be put by __list_remove_profile
110 static void __add_profile(struct list_head *list, struct aa_profile *profile)
115 AA_BUG(!profile);
116 AA_BUG(!profile->ns);
117 AA_BUG(!mutex_is_locked(&profile->ns->lock));
119 list_add_rcu(&profile->base.list, list);
121 aa_get_profile(profile);
122 l = aa_label_insert(&profile->ns->labels, &profile->label);
123 AA_BUG(l != &profile->label);
128 * __list_remove_profile - remove a profile from the list it is on
129 * @profile: the profile to remove (NOT NULL)
131 * remove a profile from the list, warning generally removal should
132 * be done with __replace_profile as most profile removals are
133 * replacements to the unconfined profile.
135 * put @profile list refcount
139 static void __list_remove_profile(struct aa_profile *profile)
141 AA_BUG(!profile);
142 AA_BUG(!profile->ns);
143 AA_BUG(!mutex_is_locked(&profile->ns->lock));
145 list_del_rcu(&profile->base.list);
146 aa_put_profile(profile);
150 * __remove_profile - remove old profile, and children
151 * @profile: profile to be replaced (NOT NULL)
155 static void __remove_profile(struct aa_profile *profile)
157 AA_BUG(!profile);
158 AA_BUG(!profile->ns);
159 AA_BUG(!mutex_is_locked(&profile->ns->lock));
162 __aa_profile_list_release(&profile->base.profiles);
164 aa_label_remove(&profile->label);
165 __aafs_profile_rmdir(profile);
166 __list_remove_profile(profile);
177 struct aa_profile *profile, *tmp;
178 list_for_each_entry_safe(profile, tmp, head, base.list)
179 __remove_profile(profile);
233 * aa_free_profile - free a profile
234 * @profile: the profile to free (MAYBE NULL)
236 * Free a profile, its hats and null_profile. All references to the profile,
239 * If the profile was referenced from a task context, free_profile() will
242 void aa_free_profile(struct aa_profile *profile)
247 AA_DEBUG("%s(%p)\n", __func__, profile);
249 if (!profile)
253 aa_policy_destroy(&profile->base);
254 aa_put_profile(rcu_access_pointer(profile->parent));
256 aa_put_ns(profile->ns);
257 kfree_sensitive(profile->rename);
258 kfree_sensitive(profile->disconnected);
260 free_attachment(&profile->attach);
266 list_for_each_entry_safe(rule, tmp, &profile->rules, list) {
270 kfree_sensitive(profile->dirname);
272 if (profile->data) {
273 rht = profile->data;
274 profile->data = NULL;
279 kfree_sensitive(profile->hash);
280 aa_put_loaddata(profile->rawdata);
281 aa_label_destroy(&profile->label);
283 kfree_sensitive(profile);
287 * aa_alloc_profile - allocate, initialize and return a new profile
288 * @hname: name of the profile (NOT NULL)
292 * Returns: refcount profile or NULL on failure
297 struct aa_profile *profile;
301 profile = kzalloc(struct_size(profile, label.vec, 2), gfp);
302 if (!profile)
305 if (!aa_policy_init(&profile->base, NULL, hname, gfp))
307 if (!aa_label_init(&profile->label, 1, gfp))
310 INIT_LIST_HEAD(&profile->rules);
316 list_add(&rules->list, &profile->rules);
320 proxy = aa_alloc_proxy(&profile->label, gfp);
325 profile->label.proxy = proxy;
327 profile->label.hname = profile->base.hname;
328 profile->label.flags |= FLAG_PROFILE;
329 profile->label.vec[0] = profile;
332 return profile;
335 aa_free_profile(profile);
340 /* TODO: profile accounting - setup in remove */
343 * __strn_find_child - find a profile on @head list using substring of @name
345 * @name: name of profile (NOT NULL)
350 * Returns: unrefcounted profile ptr, or NULL if not found
359 * __find_child - find a profile on @head list with a name matching @name
361 * @name: name of profile (NOT NULL)
365 * Returns: unrefcounted profile ptr, or NULL if not found
373 * aa_find_child - find a profile by @name in @parent
374 * @parent: profile to search (NOT NULL)
375 * @name: profile name to search for (NOT NULL)
377 * Returns: a refcounted profile or NULL if not found
381 struct aa_profile *profile;
385 profile = __find_child(&parent->base.profiles, name);
386 } while (profile && !aa_get_profile_not0(profile));
390 return profile;
394 * __lookup_parent - lookup the parent of a profile of name @hname
395 * @ns: namespace to lookup profile in (NOT NULL)
396 * @hname: hierarchical profile name to find parent of (NOT NULL)
398 * Lookups up the parent of a fully qualified profile name, the profile
400 * is used to load a new profile.
410 struct aa_profile *profile = NULL;
416 profile = __strn_find_child(&policy->profiles, hname,
418 if (!profile)
420 policy = &profile->base;
424 if (!profile)
426 return &profile->base;
431 * @ns: namespace to lookup profile in (NOT NULL)
432 * @hname: hierarchical profile name to find parent of (NOT NULL)
445 struct aa_profile *parent, *profile = NULL;
454 parent = profile;
455 profile = __strn_find_child(&policy->profiles, hname,
457 if (!profile) {
462 profile = aa_alloc_null(parent, name, gfp);
464 if (!profile)
467 profile->ns = aa_get_ns(ns);
469 policy = &profile->base;
473 if (!profile)
475 return &profile->base;
479 * __lookupn_profile - lookup the profile matching @hname
480 * @base: base list to start looking up profile name from (NOT NULL)
481 * @hname: hierarchical profile name (NOT NULL)
486 * Returns: unrefcounted profile pointer or NULL if not found
488 * Do a relative name lookup, recursing through profile tree.
493 struct aa_profile *profile = NULL;
498 profile = __strn_find_child(&base->profiles, hname,
500 if (!profile)
503 base = &profile->base;
520 * aa_lookupn_profile - find a profile by its full or partial name
525 * Returns: refcounted profile or NULL if not found
530 struct aa_profile *profile;
534 profile = __lookupn_profile(&ns->base, hname, n);
535 } while (profile && !aa_get_profile_not0(profile));
538 /* the unconfined profile is not in the regular profile list */
539 if (!profile && strncmp(hname, "unconfined", n) == 0)
540 profile = aa_get_newest_profile(ns->unconfined);
543 return profile;
554 struct aa_profile *profile;
568 profile = aa_lookupn_profile(ns, name, n - (name - fqname));
570 /* default profile for ns, currently unconfined */
571 profile = aa_get_newest_profile(ns->unconfined);
573 profile = NULL;
576 return profile;
583 struct aa_profile *profile;
586 profile = aa_alloc_profile(name, NULL, gfp);
587 if (!profile)
591 profile->label.flags |= FLAG_NULL;
592 rules = list_first_entry(&profile->rules, typeof(*rules), list);
605 profile->path_flags = parent->path_flags;
608 rcu_assign_pointer(profile->parent, aa_get_profile(parent));
609 profile->ns = aa_get_ns(parent->ns);
612 return profile;
615 aa_free_profile(profile);
621 * aa_new_learning_profile - create or find a null-X learning profile
622 * @parent: profile that caused this profile to be created (NOT NULL)
623 * @hat: true if the null- learning profile is a hat
624 * @base: name to base the null profile off of
627 * Find/Create a null- complain mode profile used in learning mode. The
628 * name of the profile is unique and follows the format of parent//null-XXX.
632 * null profiles are added to the profile list but the list does not
636 * Returns: new refcounted profile else NULL on failure
641 struct aa_profile *p, *profile;
666 profile = aa_find_child(parent, bname);
667 if (profile)
670 profile = aa_alloc_null(parent, name, gfp);
671 if (!profile)
673 profile->mode = APPARMOR_COMPLAIN;
675 profile->label.flags |= FLAG_HAT;
677 mutex_lock_nested(&profile->ns->lock, profile->ns->level);
680 aa_free_profile(profile);
681 profile = aa_get_profile(p);
683 __add_profile(&parent->base.profiles, profile);
685 mutex_unlock(&profile->ns->lock);
691 return profile;
695 aa_free_profile(profile);
701 * @profile: profile to test if it can be replaced (MAYBE NULL)
707 static int replacement_allowed(struct aa_profile *profile, int noreplace,
710 if (profile) {
711 if (profile->label.flags & FLAG_IMMUTIBLE) {
712 *info = "cannot replace immutable profile";
715 *info = "profile already exists";
739 * @name: name of profile being manipulated (NOT NULL)
883 struct aa_profile *profile)
885 const char *base = basename(profile->base.hname);
886 long len = base - profile->base.hname;
895 if (ent->new == profile)
897 if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
907 * @old: profile to be replaced (NOT NULL)
908 * @new: profile to replace @old with (NOT NULL)
964 * __lookup_replace - lookup replacement information for a profile
966 * @hname: name of profile to lookup
967 * @noreplace: true if not replacing an existing profile
968 * @p: Returns - profile to be replaced
971 * Returns: profile to replace (no ref) on success else ptr error
981 *info = "profile can not be replaced";
1020 * aa_replace_profiles - replace profile(s) on the profile list
1026 * unpack and replace a profile on the profile list and uses of that profile
1027 * by any task creds via invalidating the old version of the profile, which
1028 * tasks will notice to update their own cred. If the profile does not exist
1029 * on the profile list it is added.
1142 * profile that doesn't have
1144 * individual profile loading where
1149 * null profile will be replaced once
1163 /* released on profile replacement or free_profile */
1205 /* dedup actual profile replacement */
1207 "same as current profile, skipping",
1216 * TODO: finer dedup based on profile range in data. Load set
1217 * can differ but profile may remain unchanged
1261 info = "valid profile in failed atomic policy load";
1264 info = "unchecked profile in failed atomic policy load";
1281 * aa_remove_profiles - remove profile(s) from the system
1284 * @fqname: name of the profile or namespace to remove (NOT NULL)
1287 * Remove a profile or sub namespace from the current namespace, so that
1298 struct aa_profile *profile = NULL;
1304 info = "no profile specified";
1332 /* remove profile */
1334 profile = aa_get_profile(__lookup_profile(&ns->base, name));
1335 if (!profile) {
1337 info = "profile does not exist";
1340 name = profile->base.hname;
1342 __remove_profile(profile);
1351 aa_put_profile(profile);