1// SPDX-License-Identifier: GPL-2.0-only 2/* 3 * AppArmor security module 4 * 5 * This file contains AppArmor label definitions 6 * 7 * Copyright 2017 Canonical Ltd. 8 */ 9 10#include <linux/audit.h> 11#include <linux/seq_file.h> 12#include <linux/sort.h> 13 14#include "include/apparmor.h" 15#include "include/cred.h" 16#include "include/label.h" 17#include "include/policy.h" 18#include "include/secid.h" 19 20 21/* 22 * the aa_label represents the set of profiles confining an object 23 * 24 * Labels maintain a reference count to the set of pointers they reference 25 * Labels are ref counted by 26 * tasks and object via the security field/security context off the field 27 * code - will take a ref count on a label if it needs the label 28 * beyond what is possible with an rcu_read_lock. 29 * profiles - each profile is a label 30 * secids - a pinned secid will keep a refcount of the label it is 31 * referencing 32 * objects - inode, files, sockets, ... 33 * 34 * Labels are not ref counted by the label set, so they maybe removed and 35 * freed when no longer in use. 36 * 37 */ 38 39#define PROXY_POISON 97 40#define LABEL_POISON 100 41 42static void free_proxy(struct aa_proxy *proxy) 43{ 44 if (proxy) { 45 /* p->label will not updated any more as p is dead */ 46 aa_put_label(rcu_dereference_protected(proxy->label, true)); 47 memset(proxy, 0, sizeof(*proxy)); 48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); 49 kfree(proxy); 50 } 51} 52 53void aa_proxy_kref(struct kref *kref) 54{ 55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count); 56 57 free_proxy(proxy); 58} 59 60struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp) 61{ 62 struct aa_proxy *new; 63 64 new = kzalloc(sizeof(struct aa_proxy), gfp); 65 if (new) { 66 kref_init(&new->count); 67 rcu_assign_pointer(new->label, aa_get_label(label)); 68 } 69 return new; 70} 71 72/* requires profile list write lock held */ 73void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new) 74{ 75 struct aa_label *tmp; 76 77 AA_BUG(!orig); 78 AA_BUG(!new); 79 lockdep_assert_held_write(&labels_set(orig)->lock); 80 81 tmp = rcu_dereference_protected(orig->proxy->label, 82 &labels_ns(orig)->lock); 83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); 84 orig->flags |= FLAG_STALE; 85 aa_put_label(tmp); 86} 87 88static void __proxy_share(struct aa_label *old, struct aa_label *new) 89{ 90 struct aa_proxy *proxy = new->proxy; 91 92 new->proxy = aa_get_proxy(old->proxy); 93 __aa_proxy_redirect(old, new); 94 aa_put_proxy(proxy); 95} 96 97 98/** 99 * ns_cmp - compare ns for label set ordering 100 * @a: ns to compare (NOT NULL) 101 * @b: ns to compare (NOT NULL) 102 * 103 * Returns: <0 if a < b 104 * ==0 if a == b 105 * >0 if a > b 106 */ 107static int ns_cmp(struct aa_ns *a, struct aa_ns *b) 108{ 109 int res; 110 111 AA_BUG(!a); 112 AA_BUG(!b); 113 AA_BUG(!a->base.hname); 114 AA_BUG(!b->base.hname); 115 116 if (a == b) 117 return 0; 118 119 res = a->level - b->level; 120 if (res) 121 return res; 122 123 return strcmp(a->base.hname, b->base.hname); 124} 125 126/** 127 * profile_cmp - profile comparison for set ordering 128 * @a: profile to compare (NOT NULL) 129 * @b: profile to compare (NOT NULL) 130 * 131 * Returns: <0 if a < b 132 * ==0 if a == b 133 * >0 if a > b 134 */ 135static int profile_cmp(struct aa_profile *a, struct aa_profile *b) 136{ 137 int res; 138 139 AA_BUG(!a); 140 AA_BUG(!b); 141 AA_BUG(!a->ns); 142 AA_BUG(!b->ns); 143 AA_BUG(!a->base.hname); 144 AA_BUG(!b->base.hname); 145 146 if (a == b || a->base.hname == b->base.hname) 147 return 0; 148 res = ns_cmp(a->ns, b->ns); 149 if (res) 150 return res; 151 152 return strcmp(a->base.hname, b->base.hname); 153} 154 155/** 156 * vec_cmp - label comparison for set ordering 157 * @a: label to compare (NOT NULL) 158 * @vec: vector of profiles to compare (NOT NULL) 159 * @n: length of @vec 160 * 161 * Returns: <0 if a < vec 162 * ==0 if a == vec 163 * >0 if a > vec 164 */ 165static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn) 166{ 167 int i; 168 169 AA_BUG(!a); 170 AA_BUG(!*a); 171 AA_BUG(!b); 172 AA_BUG(!*b); 173 AA_BUG(an <= 0); 174 AA_BUG(bn <= 0); 175 176 for (i = 0; i < an && i < bn; i++) { 177 int res = profile_cmp(a[i], b[i]); 178 179 if (res != 0) 180 return res; 181 } 182 183 return an - bn; 184} 185 186static bool vec_is_stale(struct aa_profile **vec, int n) 187{ 188 int i; 189 190 AA_BUG(!vec); 191 192 for (i = 0; i < n; i++) { 193 if (profile_is_stale(vec[i])) 194 return true; 195 } 196 197 return false; 198} 199 200static bool vec_unconfined(struct aa_profile **vec, int n) 201{ 202 int i; 203 204 AA_BUG(!vec); 205 206 for (i = 0; i < n; i++) { 207 if (!profile_unconfined(vec[i])) 208 return false; 209 } 210 211 return true; 212} 213 214static int sort_cmp(const void *a, const void *b) 215{ 216 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b); 217} 218 219/* 220 * assumes vec is sorted 221 * Assumes @vec has null terminator at vec[n], and will null terminate 222 * vec[n - dups] 223 */ 224static inline int unique(struct aa_profile **vec, int n) 225{ 226 int i, pos, dups = 0; 227 228 AA_BUG(n < 1); 229 AA_BUG(!vec); 230 231 pos = 0; 232 for (i = 1; i < n; i++) { 233 int res = profile_cmp(vec[pos], vec[i]); 234 235 AA_BUG(res > 0, "vec not sorted"); 236 if (res == 0) { 237 /* drop duplicate */ 238 aa_put_profile(vec[i]); 239 dups++; 240 continue; 241 } 242 pos++; 243 if (dups) 244 vec[pos] = vec[i]; 245 } 246 247 AA_BUG(dups < 0); 248 249 return dups; 250} 251 252/** 253 * aa_vec_unique - canonical sort and unique a list of profiles 254 * @n: number of refcounted profiles in the list (@n > 0) 255 * @vec: list of profiles to sort and merge 256 * 257 * Returns: the number of duplicates eliminated == references put 258 * 259 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will 260 * null terminate vec[n - dups] 261 */ 262int aa_vec_unique(struct aa_profile **vec, int n, int flags) 263{ 264 int i, dups = 0; 265 266 AA_BUG(n < 1); 267 AA_BUG(!vec); 268 269 /* vecs are usually small and inorder, have a fallback for larger */ 270 if (n > 8) { 271 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL); 272 dups = unique(vec, n); 273 goto out; 274 } 275 276 /* insertion sort + unique in one */ 277 for (i = 1; i < n; i++) { 278 struct aa_profile *tmp = vec[i]; 279 int pos, j; 280 281 for (pos = i - 1 - dups; pos >= 0; pos--) { 282 int res = profile_cmp(vec[pos], tmp); 283 284 if (res == 0) { 285 /* drop duplicate entry */ 286 aa_put_profile(tmp); 287 dups++; 288 goto continue_outer; 289 } else if (res < 0) 290 break; 291 } 292 /* pos is at entry < tmp, or index -1. Set to insert pos */ 293 pos++; 294 295 for (j = i - dups; j > pos; j--) 296 vec[j] = vec[j - 1]; 297 vec[pos] = tmp; 298continue_outer: 299 ; 300 } 301 302 AA_BUG(dups < 0); 303 304out: 305 if (flags & VEC_FLAG_TERMINATE) 306 vec[n - dups] = NULL; 307 308 return dups; 309} 310 311 312void aa_label_destroy(struct aa_label *label) 313{ 314 AA_BUG(!label); 315 316 if (!label_isprofile(label)) { 317 struct aa_profile *profile; 318 struct label_it i; 319 320 aa_put_str(label->hname); 321 322 label_for_each(i, label, profile) { 323 aa_put_profile(profile); 324 label->vec[i.i] = (struct aa_profile *) 325 (LABEL_POISON + (long) i.i); 326 } 327 } 328 329 if (label->proxy) { 330 if (rcu_dereference_protected(label->proxy->label, true) == label) 331 rcu_assign_pointer(label->proxy->label, NULL); 332 aa_put_proxy(label->proxy); 333 } 334 aa_free_secid(label->secid); 335 336 label->proxy = (struct aa_proxy *) PROXY_POISON + 1; 337} 338 339void aa_label_free(struct aa_label *label) 340{ 341 if (!label) 342 return; 343 344 aa_label_destroy(label); 345 kfree(label); 346} 347 348static void label_free_switch(struct aa_label *label) 349{ 350 if (label->flags & FLAG_NS_COUNT) 351 aa_free_ns(labels_ns(label)); 352 else if (label_isprofile(label)) 353 aa_free_profile(labels_profile(label)); 354 else 355 aa_label_free(label); 356} 357 358static void label_free_rcu(struct rcu_head *head) 359{ 360 struct aa_label *label = container_of(head, struct aa_label, rcu); 361 362 if (label->flags & FLAG_IN_TREE) 363 (void) aa_label_remove(label); 364 label_free_switch(label); 365} 366 367void aa_label_kref(struct kref *kref) 368{ 369 struct aa_label *label = container_of(kref, struct aa_label, count); 370 struct aa_ns *ns = labels_ns(label); 371 372 if (!ns) { 373 /* never live, no rcu callback needed, just using the fn */ 374 label_free_switch(label); 375 return; 376 } 377 /* TODO: update labels_profile macro so it works here */ 378 AA_BUG(label_isprofile(label) && 379 on_list_rcu(&label->vec[0]->base.profiles)); 380 AA_BUG(label_isprofile(label) && 381 on_list_rcu(&label->vec[0]->base.list)); 382 383 /* TODO: if compound label and not stale add to reclaim cache */ 384 call_rcu(&label->rcu, label_free_rcu); 385} 386 387static void label_free_or_put_new(struct aa_label *label, struct aa_label *new) 388{ 389 if (label != new) 390 /* need to free directly to break circular ref with proxy */ 391 aa_label_free(new); 392 else 393 aa_put_label(new); 394} 395 396bool aa_label_init(struct aa_label *label, int size, gfp_t gfp) 397{ 398 AA_BUG(!label); 399 AA_BUG(size < 1); 400 401 if (aa_alloc_secid(label, gfp) < 0) 402 return false; 403 404 label->size = size; /* doesn't include null */ 405 label->vec[size] = NULL; /* null terminate */ 406 kref_init(&label->count); 407 RB_CLEAR_NODE(&label->node); 408 409 return true; 410} 411 412/** 413 * aa_label_alloc - allocate a label with a profile vector of @size length 414 * @size: size of profile vector in the label 415 * @proxy: proxy to use OR null if to allocate a new one 416 * @gfp: memory allocation type 417 * 418 * Returns: new label 419 * else NULL if failed 420 */ 421struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp) 422{ 423 struct aa_label *new; 424 425 AA_BUG(size < 1); 426 427 /* + 1 for null terminator entry on vec */ 428 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1), 429 gfp); 430 AA_DEBUG("%s (%p)\n", __func__, new); 431 if (!new) 432 goto fail; 433 434 if (!aa_label_init(new, size, gfp)) 435 goto fail; 436 437 if (!proxy) { 438 proxy = aa_alloc_proxy(new, gfp); 439 if (!proxy) 440 goto fail; 441 } else 442 aa_get_proxy(proxy); 443 /* just set new's proxy, don't redirect proxy here if it was passed in*/ 444 new->proxy = proxy; 445 446 return new; 447 448fail: 449 kfree(new); 450 451 return NULL; 452} 453 454 455/** 456 * label_cmp - label comparison for set ordering 457 * @a: label to compare (NOT NULL) 458 * @b: label to compare (NOT NULL) 459 * 460 * Returns: <0 if a < b 461 * ==0 if a == b 462 * >0 if a > b 463 */ 464static int label_cmp(struct aa_label *a, struct aa_label *b) 465{ 466 AA_BUG(!b); 467 468 if (a == b) 469 return 0; 470 471 return vec_cmp(a->vec, a->size, b->vec, b->size); 472} 473 474/* helper fn for label_for_each_confined */ 475int aa_label_next_confined(struct aa_label *label, int i) 476{ 477 AA_BUG(!label); 478 AA_BUG(i < 0); 479 480 for (; i < label->size; i++) { 481 if (!profile_unconfined(label->vec[i])) 482 return i; 483 } 484 485 return i; 486} 487 488/** 489 * aa_label_next_not_in_set - return the next profile of @sub not in @set 490 * @I: label iterator 491 * @set: label to test against 492 * @sub: label to if is subset of @set 493 * 494 * Returns: profile in @sub that is not in @set, with iterator set pos after 495 * else NULL if @sub is a subset of @set 496 */ 497struct aa_profile *__aa_label_next_not_in_set(struct label_it *I, 498 struct aa_label *set, 499 struct aa_label *sub) 500{ 501 AA_BUG(!set); 502 AA_BUG(!I); 503 AA_BUG(I->i < 0); 504 AA_BUG(I->i > set->size); 505 AA_BUG(!sub); 506 AA_BUG(I->j < 0); 507 AA_BUG(I->j > sub->size); 508 509 while (I->j < sub->size && I->i < set->size) { 510 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]); 511 512 if (res == 0) { 513 (I->j)++; 514 (I->i)++; 515 } else if (res > 0) 516 (I->i)++; 517 else 518 return sub->vec[(I->j)++]; 519 } 520 521 if (I->j < sub->size) 522 return sub->vec[(I->j)++]; 523 524 return NULL; 525} 526 527/** 528 * aa_label_is_subset - test if @sub is a subset of @set 529 * @set: label to test against 530 * @sub: label to test if is subset of @set 531 * 532 * Returns: true if @sub is subset of @set 533 * else false 534 */ 535bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub) 536{ 537 struct label_it i = { }; 538 539 AA_BUG(!set); 540 AA_BUG(!sub); 541 542 if (sub == set) 543 return true; 544 545 return __aa_label_next_not_in_set(&i, set, sub) == NULL; 546} 547 548/** 549 * aa_label_is_unconfined_subset - test if @sub is a subset of @set 550 * @set: label to test against 551 * @sub: label to test if is subset of @set 552 * 553 * This checks for subset but taking into account unconfined. IF 554 * @sub contains an unconfined profile that does not have a matching 555 * unconfined in @set then this will not cause the test to fail. 556 * Conversely we don't care about an unconfined in @set that is not in 557 * @sub 558 * 559 * Returns: true if @sub is special_subset of @set 560 * else false 561 */ 562bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub) 563{ 564 struct label_it i = { }; 565 struct aa_profile *p; 566 567 AA_BUG(!set); 568 AA_BUG(!sub); 569 570 if (sub == set) 571 return true; 572 573 do { 574 p = __aa_label_next_not_in_set(&i, set, sub); 575 if (p && !profile_unconfined(p)) 576 break; 577 } while (p); 578 579 return p == NULL; 580} 581 582 583/** 584 * __label_remove - remove @label from the label set 585 * @l: label to remove 586 * @new: label to redirect to 587 * 588 * Requires: labels_set(@label)->lock write_lock 589 * Returns: true if the label was in the tree and removed 590 */ 591static bool __label_remove(struct aa_label *label, struct aa_label *new) 592{ 593 struct aa_labelset *ls = labels_set(label); 594 595 AA_BUG(!ls); 596 AA_BUG(!label); 597 lockdep_assert_held_write(&ls->lock); 598 599 if (new) 600 __aa_proxy_redirect(label, new); 601 602 if (!label_is_stale(label)) 603 __label_make_stale(label); 604 605 if (label->flags & FLAG_IN_TREE) { 606 rb_erase(&label->node, &ls->root); 607 label->flags &= ~FLAG_IN_TREE; 608 return true; 609 } 610 611 return false; 612} 613 614/** 615 * __label_replace - replace @old with @new in label set 616 * @old: label to remove from label set 617 * @new: label to replace @old with 618 * 619 * Requires: labels_set(@old)->lock write_lock 620 * valid ref count be held on @new 621 * Returns: true if @old was in set and replaced by @new 622 * 623 * Note: current implementation requires label set be order in such a way 624 * that @new directly replaces @old position in the set (ie. 625 * using pointer comparison of the label address would not work) 626 */ 627static bool __label_replace(struct aa_label *old, struct aa_label *new) 628{ 629 struct aa_labelset *ls = labels_set(old); 630 631 AA_BUG(!ls); 632 AA_BUG(!old); 633 AA_BUG(!new); 634 lockdep_assert_held_write(&ls->lock); 635 AA_BUG(new->flags & FLAG_IN_TREE); 636 637 if (!label_is_stale(old)) 638 __label_make_stale(old); 639 640 if (old->flags & FLAG_IN_TREE) { 641 rb_replace_node(&old->node, &new->node, &ls->root); 642 old->flags &= ~FLAG_IN_TREE; 643 new->flags |= FLAG_IN_TREE; 644 return true; 645 } 646 647 return false; 648} 649 650/** 651 * __label_insert - attempt to insert @l into a label set 652 * @ls: set of labels to insert @l into (NOT NULL) 653 * @label: new label to insert (NOT NULL) 654 * @replace: whether insertion should replace existing entry that is not stale 655 * 656 * Requires: @ls->lock 657 * caller to hold a valid ref on l 658 * if @replace is true l has a preallocated proxy associated 659 * Returns: @l if successful in inserting @l - with additional refcount 660 * else ref counted equivalent label that is already in the set, 661 * the else condition only happens if @replace is false 662 */ 663static struct aa_label *__label_insert(struct aa_labelset *ls, 664 struct aa_label *label, bool replace) 665{ 666 struct rb_node **new, *parent = NULL; 667 668 AA_BUG(!ls); 669 AA_BUG(!label); 670 AA_BUG(labels_set(label) != ls); 671 lockdep_assert_held_write(&ls->lock); 672 AA_BUG(label->flags & FLAG_IN_TREE); 673 674 /* Figure out where to put new node */ 675 new = &ls->root.rb_node; 676 while (*new) { 677 struct aa_label *this = rb_entry(*new, struct aa_label, node); 678 int result = label_cmp(label, this); 679 680 parent = *new; 681 if (result == 0) { 682 /* !__aa_get_label means queued for destruction, 683 * so replace in place, however the label has 684 * died before the replacement so do not share 685 * the proxy 686 */ 687 if (!replace && !label_is_stale(this)) { 688 if (__aa_get_label(this)) 689 return this; 690 } else 691 __proxy_share(this, label); 692 AA_BUG(!__label_replace(this, label)); 693 return aa_get_label(label); 694 } else if (result < 0) 695 new = &((*new)->rb_left); 696 else /* (result > 0) */ 697 new = &((*new)->rb_right); 698 } 699 700 /* Add new node and rebalance tree. */ 701 rb_link_node(&label->node, parent, new); 702 rb_insert_color(&label->node, &ls->root); 703 label->flags |= FLAG_IN_TREE; 704 705 return aa_get_label(label); 706} 707 708/** 709 * __vec_find - find label that matches @vec in label set 710 * @vec: vec of profiles to find matching label for (NOT NULL) 711 * @n: length of @vec 712 * 713 * Requires: @vec_labelset(vec) lock held 714 * caller to hold a valid ref on l 715 * 716 * Returns: ref counted @label if matching label is in tree 717 * ref counted label that is equiv to @l in tree 718 * else NULL if @vec equiv is not in tree 719 */ 720static struct aa_label *__vec_find(struct aa_profile **vec, int n) 721{ 722 struct rb_node *node; 723 724 AA_BUG(!vec); 725 AA_BUG(!*vec); 726 AA_BUG(n <= 0); 727 728 node = vec_labelset(vec, n)->root.rb_node; 729 while (node) { 730 struct aa_label *this = rb_entry(node, struct aa_label, node); 731 int result = vec_cmp(this->vec, this->size, vec, n); 732 733 if (result > 0) 734 node = node->rb_left; 735 else if (result < 0) 736 node = node->rb_right; 737 else 738 return __aa_get_label(this); 739 } 740 741 return NULL; 742} 743 744/** 745 * __label_find - find label @label in label set 746 * @label: label to find (NOT NULL) 747 * 748 * Requires: labels_set(@label)->lock held 749 * caller to hold a valid ref on l 750 * 751 * Returns: ref counted @label if @label is in tree OR 752 * ref counted label that is equiv to @label in tree 753 * else NULL if @label or equiv is not in tree 754 */ 755static struct aa_label *__label_find(struct aa_label *label) 756{ 757 AA_BUG(!label); 758 759 return __vec_find(label->vec, label->size); 760} 761 762 763/** 764 * aa_label_remove - remove a label from the labelset 765 * @label: label to remove 766 * 767 * Returns: true if @label was removed from the tree 768 * else @label was not in tree so it could not be removed 769 */ 770bool aa_label_remove(struct aa_label *label) 771{ 772 struct aa_labelset *ls = labels_set(label); 773 unsigned long flags; 774 bool res; 775 776 AA_BUG(!ls); 777 778 write_lock_irqsave(&ls->lock, flags); 779 res = __label_remove(label, ns_unconfined(labels_ns(label))); 780 write_unlock_irqrestore(&ls->lock, flags); 781 782 return res; 783} 784 785/** 786 * aa_label_replace - replace a label @old with a new version @new 787 * @old: label to replace 788 * @new: label replacing @old 789 * 790 * Returns: true if @old was in tree and replaced 791 * else @old was not in tree, and @new was not inserted 792 */ 793bool aa_label_replace(struct aa_label *old, struct aa_label *new) 794{ 795 unsigned long flags; 796 bool res; 797 798 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) { 799 write_lock_irqsave(&labels_set(old)->lock, flags); 800 if (old->proxy != new->proxy) 801 __proxy_share(old, new); 802 else 803 __aa_proxy_redirect(old, new); 804 res = __label_replace(old, new); 805 write_unlock_irqrestore(&labels_set(old)->lock, flags); 806 } else { 807 struct aa_label *l; 808 struct aa_labelset *ls = labels_set(old); 809 810 write_lock_irqsave(&ls->lock, flags); 811 res = __label_remove(old, new); 812 if (labels_ns(old) != labels_ns(new)) { 813 write_unlock_irqrestore(&ls->lock, flags); 814 ls = labels_set(new); 815 write_lock_irqsave(&ls->lock, flags); 816 } 817 l = __label_insert(ls, new, true); 818 res = (l == new); 819 write_unlock_irqrestore(&ls->lock, flags); 820 aa_put_label(l); 821 } 822 823 return res; 824} 825 826/** 827 * vec_find - find label @l in label set 828 * @vec: array of profiles to find equiv label for (NOT NULL) 829 * @n: length of @vec 830 * 831 * Returns: refcounted label if @vec equiv is in tree 832 * else NULL if @vec equiv is not in tree 833 */ 834static struct aa_label *vec_find(struct aa_profile **vec, int n) 835{ 836 struct aa_labelset *ls; 837 struct aa_label *label; 838 unsigned long flags; 839 840 AA_BUG(!vec); 841 AA_BUG(!*vec); 842 AA_BUG(n <= 0); 843 844 ls = vec_labelset(vec, n); 845 read_lock_irqsave(&ls->lock, flags); 846 label = __vec_find(vec, n); 847 read_unlock_irqrestore(&ls->lock, flags); 848 849 return label; 850} 851 852/* requires sort and merge done first */ 853static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec, 854 int len, gfp_t gfp) 855{ 856 struct aa_label *label = NULL; 857 struct aa_labelset *ls; 858 unsigned long flags; 859 struct aa_label *new; 860 int i; 861 862 AA_BUG(!vec); 863 864 if (len == 1) 865 return aa_get_label(&vec[0]->label); 866 867 ls = labels_set(&vec[len - 1]->label); 868 869 /* TODO: enable when read side is lockless 870 * check if label exists before taking locks 871 */ 872 new = aa_label_alloc(len, NULL, gfp); 873 if (!new) 874 return NULL; 875 876 for (i = 0; i < len; i++) 877 new->vec[i] = aa_get_profile(vec[i]); 878 879 write_lock_irqsave(&ls->lock, flags); 880 label = __label_insert(ls, new, false); 881 write_unlock_irqrestore(&ls->lock, flags); 882 label_free_or_put_new(label, new); 883 884 return label; 885} 886 887struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len, 888 gfp_t gfp) 889{ 890 struct aa_label *label = vec_find(vec, len); 891 892 if (label) 893 return label; 894 895 return vec_create_and_insert_label(vec, len, gfp); 896} 897 898/** 899 * aa_label_find - find label @label in label set 900 * @label: label to find (NOT NULL) 901 * 902 * Requires: caller to hold a valid ref on l 903 * 904 * Returns: refcounted @label if @label is in tree 905 * refcounted label that is equiv to @label in tree 906 * else NULL if @label or equiv is not in tree 907 */ 908struct aa_label *aa_label_find(struct aa_label *label) 909{ 910 AA_BUG(!label); 911 912 return vec_find(label->vec, label->size); 913} 914 915 916/** 917 * aa_label_insert - insert label @label into @ls or return existing label 918 * @ls - labelset to insert @label into 919 * @label - label to insert 920 * 921 * Requires: caller to hold a valid ref on @label 922 * 923 * Returns: ref counted @label if successful in inserting @label 924 * else ref counted equivalent label that is already in the set 925 */ 926struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label) 927{ 928 struct aa_label *l; 929 unsigned long flags; 930 931 AA_BUG(!ls); 932 AA_BUG(!label); 933 934 /* check if label exists before taking lock */ 935 if (!label_is_stale(label)) { 936 read_lock_irqsave(&ls->lock, flags); 937 l = __label_find(label); 938 read_unlock_irqrestore(&ls->lock, flags); 939 if (l) 940 return l; 941 } 942 943 write_lock_irqsave(&ls->lock, flags); 944 l = __label_insert(ls, label, false); 945 write_unlock_irqrestore(&ls->lock, flags); 946 947 return l; 948} 949 950 951/** 952 * aa_label_next_in_merge - find the next profile when merging @a and @b 953 * @I: label iterator 954 * @a: label to merge 955 * @b: label to merge 956 * 957 * Returns: next profile 958 * else null if no more profiles 959 */ 960struct aa_profile *aa_label_next_in_merge(struct label_it *I, 961 struct aa_label *a, 962 struct aa_label *b) 963{ 964 AA_BUG(!a); 965 AA_BUG(!b); 966 AA_BUG(!I); 967 AA_BUG(I->i < 0); 968 AA_BUG(I->i > a->size); 969 AA_BUG(I->j < 0); 970 AA_BUG(I->j > b->size); 971 972 if (I->i < a->size) { 973 if (I->j < b->size) { 974 int res = profile_cmp(a->vec[I->i], b->vec[I->j]); 975 976 if (res > 0) 977 return b->vec[(I->j)++]; 978 if (res == 0) 979 (I->j)++; 980 } 981 982 return a->vec[(I->i)++]; 983 } 984 985 if (I->j < b->size) 986 return b->vec[(I->j)++]; 987 988 return NULL; 989} 990 991/** 992 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering 993 * @a: label to merge then compare (NOT NULL) 994 * @b: label to merge then compare (NOT NULL) 995 * @z: label to compare merge against (NOT NULL) 996 * 997 * Assumes: using the most recent versions of @a, @b, and @z 998 * 999 * Returns: <0 if a < b 1000 * ==0 if a == b 1001 * >0 if a > b 1002 */ 1003static int label_merge_cmp(struct aa_label *a, struct aa_label *b, 1004 struct aa_label *z) 1005{ 1006 struct aa_profile *p = NULL; 1007 struct label_it i = { }; 1008 int k; 1009 1010 AA_BUG(!a); 1011 AA_BUG(!b); 1012 AA_BUG(!z); 1013 1014 for (k = 0; 1015 k < z->size && (p = aa_label_next_in_merge(&i, a, b)); 1016 k++) { 1017 int res = profile_cmp(p, z->vec[k]); 1018 1019 if (res != 0) 1020 return res; 1021 } 1022 1023 if (p) 1024 return 1; 1025 else if (k < z->size) 1026 return -1; 1027 return 0; 1028} 1029 1030/** 1031 * label_merge_insert - create a new label by merging @a and @b 1032 * @new: preallocated label to merge into (NOT NULL) 1033 * @a: label to merge with @b (NOT NULL) 1034 * @b: label to merge with @a (NOT NULL) 1035 * 1036 * Requires: preallocated proxy 1037 * 1038 * Returns: ref counted label either @new if merge is unique 1039 * @a if @b is a subset of @a 1040 * @b if @a is a subset of @b 1041 * 1042 * NOTE: will not use @new if the merge results in @new == @a or @b 1043 * 1044 * Must be used within labelset write lock to avoid racing with 1045 * setting labels stale. 1046 */ 1047static struct aa_label *label_merge_insert(struct aa_label *new, 1048 struct aa_label *a, 1049 struct aa_label *b) 1050{ 1051 struct aa_label *label; 1052 struct aa_labelset *ls; 1053 struct aa_profile *next; 1054 struct label_it i; 1055 unsigned long flags; 1056 int k = 0, invcount = 0; 1057 bool stale = false; 1058 1059 AA_BUG(!a); 1060 AA_BUG(a->size < 0); 1061 AA_BUG(!b); 1062 AA_BUG(b->size < 0); 1063 AA_BUG(!new); 1064 AA_BUG(new->size < a->size + b->size); 1065 1066 label_for_each_in_merge(i, a, b, next) { 1067 AA_BUG(!next); 1068 if (profile_is_stale(next)) { 1069 new->vec[k] = aa_get_newest_profile(next); 1070 AA_BUG(!new->vec[k]->label.proxy); 1071 AA_BUG(!new->vec[k]->label.proxy->label); 1072 if (next->label.proxy != new->vec[k]->label.proxy) 1073 invcount++; 1074 k++; 1075 stale = true; 1076 } else 1077 new->vec[k++] = aa_get_profile(next); 1078 } 1079 /* set to actual size which is <= allocated len */ 1080 new->size = k; 1081 new->vec[k] = NULL; 1082 1083 if (invcount) { 1084 new->size -= aa_vec_unique(&new->vec[0], new->size, 1085 VEC_FLAG_TERMINATE); 1086 /* TODO: deal with reference labels */ 1087 if (new->size == 1) { 1088 label = aa_get_label(&new->vec[0]->label); 1089 return label; 1090 } 1091 } else if (!stale) { 1092 /* 1093 * merge could be same as a || b, note: it is not possible 1094 * for new->size == a->size == b->size unless a == b 1095 */ 1096 if (k == a->size) 1097 return aa_get_label(a); 1098 else if (k == b->size) 1099 return aa_get_label(b); 1100 } 1101 if (vec_unconfined(new->vec, new->size)) 1102 new->flags |= FLAG_UNCONFINED; 1103 ls = labels_set(new); 1104 write_lock_irqsave(&ls->lock, flags); 1105 label = __label_insert(labels_set(new), new, false); 1106 write_unlock_irqrestore(&ls->lock, flags); 1107 1108 return label; 1109} 1110 1111/** 1112 * labelset_of_merge - find which labelset a merged label should be inserted 1113 * @a: label to merge and insert 1114 * @b: label to merge and insert 1115 * 1116 * Returns: labelset that the merged label should be inserted into 1117 */ 1118static struct aa_labelset *labelset_of_merge(struct aa_label *a, 1119 struct aa_label *b) 1120{ 1121 struct aa_ns *nsa = labels_ns(a); 1122 struct aa_ns *nsb = labels_ns(b); 1123 1124 if (ns_cmp(nsa, nsb) <= 0) 1125 return &nsa->labels; 1126 return &nsb->labels; 1127} 1128 1129/** 1130 * __label_find_merge - find label that is equiv to merge of @a and @b 1131 * @ls: set of labels to search (NOT NULL) 1132 * @a: label to merge with @b (NOT NULL) 1133 * @b: label to merge with @a (NOT NULL) 1134 * 1135 * Requires: ls->lock read_lock held 1136 * 1137 * Returns: ref counted label that is equiv to merge of @a and @b 1138 * else NULL if merge of @a and @b is not in set 1139 */ 1140static struct aa_label *__label_find_merge(struct aa_labelset *ls, 1141 struct aa_label *a, 1142 struct aa_label *b) 1143{ 1144 struct rb_node *node; 1145 1146 AA_BUG(!ls); 1147 AA_BUG(!a); 1148 AA_BUG(!b); 1149 1150 if (a == b) 1151 return __label_find(a); 1152 1153 node = ls->root.rb_node; 1154 while (node) { 1155 struct aa_label *this = container_of(node, struct aa_label, 1156 node); 1157 int result = label_merge_cmp(a, b, this); 1158 1159 if (result < 0) 1160 node = node->rb_left; 1161 else if (result > 0) 1162 node = node->rb_right; 1163 else 1164 return __aa_get_label(this); 1165 } 1166 1167 return NULL; 1168} 1169 1170 1171/** 1172 * aa_label_find_merge - find label that is equiv to merge of @a and @b 1173 * @a: label to merge with @b (NOT NULL) 1174 * @b: label to merge with @a (NOT NULL) 1175 * 1176 * Requires: labels be fully constructed with a valid ns 1177 * 1178 * Returns: ref counted label that is equiv to merge of @a and @b 1179 * else NULL if merge of @a and @b is not in set 1180 */ 1181struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b) 1182{ 1183 struct aa_labelset *ls; 1184 struct aa_label *label, *ar = NULL, *br = NULL; 1185 unsigned long flags; 1186 1187 AA_BUG(!a); 1188 AA_BUG(!b); 1189 1190 if (label_is_stale(a)) 1191 a = ar = aa_get_newest_label(a); 1192 if (label_is_stale(b)) 1193 b = br = aa_get_newest_label(b); 1194 ls = labelset_of_merge(a, b); 1195 read_lock_irqsave(&ls->lock, flags); 1196 label = __label_find_merge(ls, a, b); 1197 read_unlock_irqrestore(&ls->lock, flags); 1198 aa_put_label(ar); 1199 aa_put_label(br); 1200 1201 return label; 1202} 1203 1204/** 1205 * aa_label_merge - attempt to insert new merged label of @a and @b 1206 * @ls: set of labels to insert label into (NOT NULL) 1207 * @a: label to merge with @b (NOT NULL) 1208 * @b: label to merge with @a (NOT NULL) 1209 * @gfp: memory allocation type 1210 * 1211 * Requires: caller to hold valid refs on @a and @b 1212 * labels be fully constructed with a valid ns 1213 * 1214 * Returns: ref counted new label if successful in inserting merge of a & b 1215 * else ref counted equivalent label that is already in the set. 1216 * else NULL if could not create label (-ENOMEM) 1217 */ 1218struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b, 1219 gfp_t gfp) 1220{ 1221 struct aa_label *label = NULL; 1222 1223 AA_BUG(!a); 1224 AA_BUG(!b); 1225 1226 if (a == b) 1227 return aa_get_newest_label(a); 1228 1229 /* TODO: enable when read side is lockless 1230 * check if label exists before taking locks 1231 if (!label_is_stale(a) && !label_is_stale(b)) 1232 label = aa_label_find_merge(a, b); 1233 */ 1234 1235 if (!label) { 1236 struct aa_label *new; 1237 1238 a = aa_get_newest_label(a); 1239 b = aa_get_newest_label(b); 1240 1241 /* could use label_merge_len(a, b), but requires double 1242 * comparison for small savings 1243 */ 1244 new = aa_label_alloc(a->size + b->size, NULL, gfp); 1245 if (!new) 1246 goto out; 1247 1248 label = label_merge_insert(new, a, b); 1249 label_free_or_put_new(label, new); 1250out: 1251 aa_put_label(a); 1252 aa_put_label(b); 1253 } 1254 1255 return label; 1256} 1257 1258static inline bool label_is_visible(struct aa_profile *profile, 1259 struct aa_label *label) 1260{ 1261 return aa_ns_visible(profile->ns, labels_ns(label), true); 1262} 1263 1264/* match a profile and its associated ns component if needed 1265 * Assumes visibility test has already been done. 1266 * If a subns profile is not to be matched should be prescreened with 1267 * visibility test. 1268 */ 1269static inline unsigned int match_component(struct aa_profile *profile, 1270 struct aa_profile *tp, 1271 unsigned int state) 1272{ 1273 const char *ns_name; 1274 1275 if (profile->ns == tp->ns) 1276 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname); 1277 1278 /* try matching with namespace name and then profile */ 1279 ns_name = aa_ns_name(profile->ns, tp->ns, true); 1280 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1); 1281 state = aa_dfa_match(profile->policy.dfa, state, ns_name); 1282 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1); 1283 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname); 1284} 1285 1286/** 1287 * label_compound_match - find perms for full compound label 1288 * @profile: profile to find perms for 1289 * @label: label to check access permissions for 1290 * @start: state to start match in 1291 * @subns: whether to do permission checks on components in a subns 1292 * @request: permissions to request 1293 * @perms: perms struct to set 1294 * 1295 * Returns: 0 on success else ERROR 1296 * 1297 * For the label A//&B//&C this does the perm match for A//&B//&C 1298 * @perms should be preinitialized with allperms OR a previous permission 1299 * check to be stacked. 1300 */ 1301static int label_compound_match(struct aa_profile *profile, 1302 struct aa_label *label, 1303 unsigned int state, bool subns, u32 request, 1304 struct aa_perms *perms) 1305{ 1306 struct aa_profile *tp; 1307 struct label_it i; 1308 1309 /* find first subcomponent that is visible */ 1310 label_for_each(i, label, tp) { 1311 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1312 continue; 1313 state = match_component(profile, tp, state); 1314 if (!state) 1315 goto fail; 1316 goto next; 1317 } 1318 1319 /* no component visible */ 1320 *perms = allperms; 1321 return 0; 1322 1323next: 1324 label_for_each_cont(i, label, tp) { 1325 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1326 continue; 1327 state = aa_dfa_match(profile->policy.dfa, state, "//&"); 1328 state = match_component(profile, tp, state); 1329 if (!state) 1330 goto fail; 1331 } 1332 aa_compute_perms(profile->policy.dfa, state, perms); 1333 aa_apply_modes_to_perms(profile, perms); 1334 if ((perms->allow & request) != request) 1335 return -EACCES; 1336 1337 return 0; 1338 1339fail: 1340 *perms = nullperms; 1341 return state; 1342} 1343 1344/** 1345 * label_components_match - find perms for all subcomponents of a label 1346 * @profile: profile to find perms for 1347 * @label: label to check access permissions for 1348 * @start: state to start match in 1349 * @subns: whether to do permission checks on components in a subns 1350 * @request: permissions to request 1351 * @perms: an initialized perms struct to add accumulation to 1352 * 1353 * Returns: 0 on success else ERROR 1354 * 1355 * For the label A//&B//&C this does the perm match for each of A and B and C 1356 * @perms should be preinitialized with allperms OR a previous permission 1357 * check to be stacked. 1358 */ 1359static int label_components_match(struct aa_profile *profile, 1360 struct aa_label *label, unsigned int start, 1361 bool subns, u32 request, 1362 struct aa_perms *perms) 1363{ 1364 struct aa_profile *tp; 1365 struct label_it i; 1366 struct aa_perms tmp; 1367 unsigned int state = 0; 1368 1369 /* find first subcomponent to test */ 1370 label_for_each(i, label, tp) { 1371 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1372 continue; 1373 state = match_component(profile, tp, start); 1374 if (!state) 1375 goto fail; 1376 goto next; 1377 } 1378 1379 /* no subcomponents visible - no change in perms */ 1380 return 0; 1381 1382next: 1383 aa_compute_perms(profile->policy.dfa, state, &tmp); 1384 aa_apply_modes_to_perms(profile, &tmp); 1385 aa_perms_accum(perms, &tmp); 1386 label_for_each_cont(i, label, tp) { 1387 if (!aa_ns_visible(profile->ns, tp->ns, subns)) 1388 continue; 1389 state = match_component(profile, tp, start); 1390 if (!state) 1391 goto fail; 1392 aa_compute_perms(profile->policy.dfa, state, &tmp); 1393 aa_apply_modes_to_perms(profile, &tmp); 1394 aa_perms_accum(perms, &tmp); 1395 } 1396 1397 if ((perms->allow & request) != request) 1398 return -EACCES; 1399 1400 return 0; 1401 1402fail: 1403 *perms = nullperms; 1404 return -EACCES; 1405} 1406 1407/** 1408 * aa_label_match - do a multi-component label match 1409 * @profile: profile to match against (NOT NULL) 1410 * @label: label to match (NOT NULL) 1411 * @state: state to start in 1412 * @subns: whether to match subns components 1413 * @request: permission request 1414 * @perms: Returns computed perms (NOT NULL) 1415 * 1416 * Returns: the state the match finished in, may be the none matching state 1417 */ 1418int aa_label_match(struct aa_profile *profile, struct aa_label *label, 1419 unsigned int state, bool subns, u32 request, 1420 struct aa_perms *perms) 1421{ 1422 int error = label_compound_match(profile, label, state, subns, request, 1423 perms); 1424 if (!error) 1425 return error; 1426 1427 *perms = allperms; 1428 return label_components_match(profile, label, state, subns, request, 1429 perms); 1430} 1431 1432 1433/** 1434 * aa_update_label_name - update a label to have a stored name 1435 * @ns: ns being viewed from (NOT NULL) 1436 * @label: label to update (NOT NULL) 1437 * @gfp: type of memory allocation 1438 * 1439 * Requires: labels_set(label) not locked in caller 1440 * 1441 * note: only updates the label name if it does not have a name already 1442 * and if it is in the labelset 1443 */ 1444bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp) 1445{ 1446 struct aa_labelset *ls; 1447 unsigned long flags; 1448 char __counted *name; 1449 bool res = false; 1450 1451 AA_BUG(!ns); 1452 AA_BUG(!label); 1453 1454 if (label->hname || labels_ns(label) != ns) 1455 return res; 1456 1457 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) 1458 return res; 1459 1460 ls = labels_set(label); 1461 write_lock_irqsave(&ls->lock, flags); 1462 if (!label->hname && label->flags & FLAG_IN_TREE) { 1463 label->hname = name; 1464 res = true; 1465 } else 1466 aa_put_str(name); 1467 write_unlock_irqrestore(&ls->lock, flags); 1468 1469 return res; 1470} 1471 1472/* 1473 * cached label name is present and visible 1474 * @label->hname only exists if label is namespace hierachical 1475 */ 1476static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, 1477 int flags) 1478{ 1479 if (label->hname && (!ns || labels_ns(label) == ns) && 1480 !(flags & ~FLAG_SHOW_MODE)) 1481 return true; 1482 1483 return false; 1484} 1485 1486/* helper macro for snprint routines */ 1487#define update_for_len(total, len, size, str) \ 1488do { \ 1489 size_t ulen = len; \ 1490 \ 1491 AA_BUG(len < 0); \ 1492 total += ulen; \ 1493 ulen = min(ulen, size); \ 1494 size -= ulen; \ 1495 str += ulen; \ 1496} while (0) 1497 1498/** 1499 * aa_profile_snxprint - print a profile name to a buffer 1500 * @str: buffer to write to. (MAY BE NULL if @size == 0) 1501 * @size: size of buffer 1502 * @view: namespace profile is being viewed from 1503 * @profile: profile to view (NOT NULL) 1504 * @flags: whether to include the mode string 1505 * @prev_ns: last ns printed when used in compound print 1506 * 1507 * Returns: size of name written or would be written if larger than 1508 * available buffer 1509 * 1510 * Note: will not print anything if the profile is not visible 1511 */ 1512static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view, 1513 struct aa_profile *profile, int flags, 1514 struct aa_ns **prev_ns) 1515{ 1516 const char *ns_name = NULL; 1517 1518 AA_BUG(!str && size != 0); 1519 AA_BUG(!profile); 1520 1521 if (!view) 1522 view = profiles_ns(profile); 1523 1524 if (view != profile->ns && 1525 (!prev_ns || (*prev_ns != profile->ns))) { 1526 if (prev_ns) 1527 *prev_ns = profile->ns; 1528 ns_name = aa_ns_name(view, profile->ns, 1529 flags & FLAG_VIEW_SUBNS); 1530 if (ns_name == aa_hidden_ns_name) { 1531 if (flags & FLAG_HIDDEN_UNCONFINED) 1532 return snprintf(str, size, "%s", "unconfined"); 1533 return snprintf(str, size, "%s", ns_name); 1534 } 1535 } 1536 1537 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) { 1538 const char *modestr = aa_profile_mode_names[profile->mode]; 1539 1540 if (ns_name) 1541 return snprintf(str, size, ":%s:%s (%s)", ns_name, 1542 profile->base.hname, modestr); 1543 return snprintf(str, size, "%s (%s)", profile->base.hname, 1544 modestr); 1545 } 1546 1547 if (ns_name) 1548 return snprintf(str, size, ":%s:%s", ns_name, 1549 profile->base.hname); 1550 return snprintf(str, size, "%s", profile->base.hname); 1551} 1552 1553static const char *label_modename(struct aa_ns *ns, struct aa_label *label, 1554 int flags) 1555{ 1556 struct aa_profile *profile; 1557 struct label_it i; 1558 int mode = -1, count = 0; 1559 1560 label_for_each(i, label, profile) { 1561 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { 1562 count++; 1563 if (profile == profile->ns->unconfined) 1564 /* special case unconfined so stacks with 1565 * unconfined don't report as mixed. ie. 1566 * profile_foo//&:ns1:unconfined (mixed) 1567 */ 1568 continue; 1569 if (mode == -1) 1570 mode = profile->mode; 1571 else if (mode != profile->mode) 1572 return "mixed"; 1573 } 1574 } 1575 1576 if (count == 0) 1577 return "-"; 1578 if (mode == -1) 1579 /* everything was unconfined */ 1580 mode = APPARMOR_UNCONFINED; 1581 1582 return aa_profile_mode_names[mode]; 1583} 1584 1585/* if any visible label is not unconfined the display_mode returns true */ 1586static inline bool display_mode(struct aa_ns *ns, struct aa_label *label, 1587 int flags) 1588{ 1589 if ((flags & FLAG_SHOW_MODE)) { 1590 struct aa_profile *profile; 1591 struct label_it i; 1592 1593 label_for_each(i, label, profile) { 1594 if (aa_ns_visible(ns, profile->ns, 1595 flags & FLAG_VIEW_SUBNS) && 1596 profile != profile->ns->unconfined) 1597 return true; 1598 } 1599 /* only ns->unconfined in set of profiles in ns */ 1600 return false; 1601 } 1602 1603 return false; 1604} 1605 1606/** 1607 * aa_label_snxprint - print a label name to a string buffer 1608 * @str: buffer to write to. (MAY BE NULL if @size == 0) 1609 * @size: size of buffer 1610 * @ns: namespace profile is being viewed from 1611 * @label: label to view (NOT NULL) 1612 * @flags: whether to include the mode string 1613 * 1614 * Returns: size of name written or would be written if larger than 1615 * available buffer 1616 * 1617 * Note: labels do not have to be strictly hierarchical to the ns as 1618 * objects may be shared across different namespaces and thus 1619 * pickup labeling from each ns. If a particular part of the 1620 * label is not visible it will just be excluded. And if none 1621 * of the label is visible "---" will be used. 1622 */ 1623int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, 1624 struct aa_label *label, int flags) 1625{ 1626 struct aa_profile *profile; 1627 struct aa_ns *prev_ns = NULL; 1628 struct label_it i; 1629 int count = 0, total = 0; 1630 ssize_t len; 1631 1632 AA_BUG(!str && size != 0); 1633 AA_BUG(!label); 1634 1635 if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) { 1636 ns = root_ns; 1637 len = snprintf(str, size, "_"); 1638 update_for_len(total, len, size, str); 1639 } else if (!ns) { 1640 ns = labels_ns(label); 1641 } 1642 1643 label_for_each(i, label, profile) { 1644 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { 1645 if (count > 0) { 1646 len = snprintf(str, size, "//&"); 1647 update_for_len(total, len, size, str); 1648 } 1649 len = aa_profile_snxprint(str, size, ns, profile, 1650 flags & FLAG_VIEW_SUBNS, 1651 &prev_ns); 1652 update_for_len(total, len, size, str); 1653 count++; 1654 } 1655 } 1656 1657 if (count == 0) { 1658 if (flags & FLAG_HIDDEN_UNCONFINED) 1659 return snprintf(str, size, "%s", "unconfined"); 1660 return snprintf(str, size, "%s", aa_hidden_ns_name); 1661 } 1662 1663 /* count == 1 && ... is for backwards compat where the mode 1664 * is not displayed for 'unconfined' in the current ns 1665 */ 1666 if (display_mode(ns, label, flags)) { 1667 len = snprintf(str, size, " (%s)", 1668 label_modename(ns, label, flags)); 1669 update_for_len(total, len, size, str); 1670 } 1671 1672 return total; 1673} 1674#undef update_for_len 1675 1676/** 1677 * aa_label_asxprint - allocate a string buffer and print label into it 1678 * @strp: Returns - the allocated buffer with the label name. (NOT NULL) 1679 * @ns: namespace profile is being viewed from 1680 * @label: label to view (NOT NULL) 1681 * @flags: flags controlling what label info is printed 1682 * @gfp: kernel memory allocation type 1683 * 1684 * Returns: size of name written or would be written if larger than 1685 * available buffer 1686 */ 1687int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, 1688 int flags, gfp_t gfp) 1689{ 1690 int size; 1691 1692 AA_BUG(!strp); 1693 AA_BUG(!label); 1694 1695 size = aa_label_snxprint(NULL, 0, ns, label, flags); 1696 if (size < 0) 1697 return size; 1698 1699 *strp = kmalloc(size + 1, gfp); 1700 if (!*strp) 1701 return -ENOMEM; 1702 return aa_label_snxprint(*strp, size + 1, ns, label, flags); 1703} 1704 1705/** 1706 * aa_label_acntsxprint - allocate a __counted string buffer and print label 1707 * @strp: buffer to write to. 1708 * @ns: namespace profile is being viewed from 1709 * @label: label to view (NOT NULL) 1710 * @flags: flags controlling what label info is printed 1711 * @gfp: kernel memory allocation type 1712 * 1713 * Returns: size of name written or would be written if larger than 1714 * available buffer 1715 */ 1716int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns, 1717 struct aa_label *label, int flags, gfp_t gfp) 1718{ 1719 int size; 1720 1721 AA_BUG(!strp); 1722 AA_BUG(!label); 1723 1724 size = aa_label_snxprint(NULL, 0, ns, label, flags); 1725 if (size < 0) 1726 return size; 1727 1728 *strp = aa_str_alloc(size + 1, gfp); 1729 if (!*strp) 1730 return -ENOMEM; 1731 return aa_label_snxprint(*strp, size + 1, ns, label, flags); 1732} 1733 1734 1735void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns, 1736 struct aa_label *label, int flags, gfp_t gfp) 1737{ 1738 const char *str; 1739 char *name = NULL; 1740 int len; 1741 1742 AA_BUG(!ab); 1743 AA_BUG(!label); 1744 1745 if (!use_label_hname(ns, label, flags) || 1746 display_mode(ns, label, flags)) { 1747 len = aa_label_asxprint(&name, ns, label, flags, gfp); 1748 if (len < 0) { 1749 AA_DEBUG("label print error"); 1750 return; 1751 } 1752 str = name; 1753 } else { 1754 str = (char *) label->hname; 1755 len = strlen(str); 1756 } 1757 if (audit_string_contains_control(str, len)) 1758 audit_log_n_hex(ab, str, len); 1759 else 1760 audit_log_n_string(ab, str, len); 1761 1762 kfree(name); 1763} 1764 1765void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns, 1766 struct aa_label *label, int flags, gfp_t gfp) 1767{ 1768 AA_BUG(!f); 1769 AA_BUG(!label); 1770 1771 if (!use_label_hname(ns, label, flags)) { 1772 char *str; 1773 int len; 1774 1775 len = aa_label_asxprint(&str, ns, label, flags, gfp); 1776 if (len < 0) { 1777 AA_DEBUG("label print error"); 1778 return; 1779 } 1780 seq_puts(f, str); 1781 kfree(str); 1782 } else if (display_mode(ns, label, flags)) 1783 seq_printf(f, "%s (%s)", label->hname, 1784 label_modename(ns, label, flags)); 1785 else 1786 seq_puts(f, label->hname); 1787} 1788 1789void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, 1790 gfp_t gfp) 1791{ 1792 AA_BUG(!label); 1793 1794 if (!use_label_hname(ns, label, flags)) { 1795 char *str; 1796 int len; 1797 1798 len = aa_label_asxprint(&str, ns, label, flags, gfp); 1799 if (len < 0) { 1800 AA_DEBUG("label print error"); 1801 return; 1802 } 1803 pr_info("%s", str); 1804 kfree(str); 1805 } else if (display_mode(ns, label, flags)) 1806 pr_info("%s (%s)", label->hname, 1807 label_modename(ns, label, flags)); 1808 else 1809 pr_info("%s", label->hname); 1810} 1811 1812void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp) 1813{ 1814 struct aa_ns *ns = aa_get_current_ns(); 1815 1816 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp); 1817 aa_put_ns(ns); 1818} 1819 1820void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp) 1821{ 1822 struct aa_ns *ns = aa_get_current_ns(); 1823 1824 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp); 1825 aa_put_ns(ns); 1826} 1827 1828void aa_label_printk(struct aa_label *label, gfp_t gfp) 1829{ 1830 struct aa_ns *ns = aa_get_current_ns(); 1831 1832 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp); 1833 aa_put_ns(ns); 1834} 1835 1836static int label_count_strn_entries(const char *str, size_t n) 1837{ 1838 const char *end = str + n; 1839 const char *split; 1840 int count = 1; 1841 1842 AA_BUG(!str); 1843 1844 for (split = aa_label_strn_split(str, end - str); 1845 split; 1846 split = aa_label_strn_split(str, end - str)) { 1847 count++; 1848 str = split + 3; 1849 } 1850 1851 return count; 1852} 1853 1854/* 1855 * ensure stacks with components like 1856 * :ns:A//&B 1857 * have :ns: applied to both 'A' and 'B' by making the lookup relative 1858 * to the base if the lookup specifies an ns, else making the stacked lookup 1859 * relative to the last embedded ns in the string. 1860 */ 1861static struct aa_profile *fqlookupn_profile(struct aa_label *base, 1862 struct aa_label *currentbase, 1863 const char *str, size_t n) 1864{ 1865 const char *first = skipn_spaces(str, n); 1866 1867 if (first && *first == ':') 1868 return aa_fqlookupn_profile(base, str, n); 1869 1870 return aa_fqlookupn_profile(currentbase, str, n); 1871} 1872 1873/** 1874 * aa_label_strn_parse - parse, validate and convert a text string to a label 1875 * @base: base label to use for lookups (NOT NULL) 1876 * @str: null terminated text string (NOT NULL) 1877 * @n: length of str to parse, will stop at \0 if encountered before n 1878 * @gfp: allocation type 1879 * @create: true if should create compound labels if they don't exist 1880 * @force_stack: true if should stack even if no leading & 1881 * 1882 * Returns: the matching refcounted label if present 1883 * else ERRPTR 1884 */ 1885struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str, 1886 size_t n, gfp_t gfp, bool create, 1887 bool force_stack) 1888{ 1889 DEFINE_VEC(profile, vec); 1890 struct aa_label *label, *currbase = base; 1891 int i, len, stack = 0, error; 1892 const char *end = str + n; 1893 const char *split; 1894 1895 AA_BUG(!base); 1896 AA_BUG(!str); 1897 1898 str = skipn_spaces(str, n); 1899 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' && 1900 base != &root_ns->unconfined->label)) 1901 return ERR_PTR(-EINVAL); 1902 1903 len = label_count_strn_entries(str, end - str); 1904 if (*str == '&' || force_stack) { 1905 /* stack on top of base */ 1906 stack = base->size; 1907 len += stack; 1908 if (*str == '&') 1909 str++; 1910 } 1911 1912 error = vec_setup(profile, vec, len, gfp); 1913 if (error) 1914 return ERR_PTR(error); 1915 1916 for (i = 0; i < stack; i++) 1917 vec[i] = aa_get_profile(base->vec[i]); 1918 1919 for (split = aa_label_strn_split(str, end - str), i = stack; 1920 split && i < len; i++) { 1921 vec[i] = fqlookupn_profile(base, currbase, str, split - str); 1922 if (!vec[i]) 1923 goto fail; 1924 /* 1925 * if component specified a new ns it becomes the new base 1926 * so that subsequent lookups are relative to it 1927 */ 1928 if (vec[i]->ns != labels_ns(currbase)) 1929 currbase = &vec[i]->label; 1930 str = split + 3; 1931 split = aa_label_strn_split(str, end - str); 1932 } 1933 /* last element doesn't have a split */ 1934 if (i < len) { 1935 vec[i] = fqlookupn_profile(base, currbase, str, end - str); 1936 if (!vec[i]) 1937 goto fail; 1938 } 1939 if (len == 1) 1940 /* no need to free vec as len < LOCAL_VEC_ENTRIES */ 1941 return &vec[0]->label; 1942 1943 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE); 1944 /* TODO: deal with reference labels */ 1945 if (len == 1) { 1946 label = aa_get_label(&vec[0]->label); 1947 goto out; 1948 } 1949 1950 if (create) 1951 label = aa_vec_find_or_create_label(vec, len, gfp); 1952 else 1953 label = vec_find(vec, len); 1954 if (!label) 1955 goto fail; 1956 1957out: 1958 /* use adjusted len from after vec_unique, not original */ 1959 vec_cleanup(profile, vec, len); 1960 return label; 1961 1962fail: 1963 label = ERR_PTR(-ENOENT); 1964 goto out; 1965} 1966 1967struct aa_label *aa_label_parse(struct aa_label *base, const char *str, 1968 gfp_t gfp, bool create, bool force_stack) 1969{ 1970 return aa_label_strn_parse(base, str, strlen(str), gfp, create, 1971 force_stack); 1972} 1973 1974/** 1975 * aa_labelset_destroy - remove all labels from the label set 1976 * @ls: label set to cleanup (NOT NULL) 1977 * 1978 * Labels that are removed from the set may still exist beyond the set 1979 * being destroyed depending on their reference counting 1980 */ 1981void aa_labelset_destroy(struct aa_labelset *ls) 1982{ 1983 struct rb_node *node; 1984 unsigned long flags; 1985 1986 AA_BUG(!ls); 1987 1988 write_lock_irqsave(&ls->lock, flags); 1989 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) { 1990 struct aa_label *this = rb_entry(node, struct aa_label, node); 1991 1992 if (labels_ns(this) != root_ns) 1993 __label_remove(this, 1994 ns_unconfined(labels_ns(this)->parent)); 1995 else 1996 __label_remove(this, NULL); 1997 } 1998 write_unlock_irqrestore(&ls->lock, flags); 1999} 2000 2001/* 2002 * @ls: labelset to init (NOT NULL) 2003 */ 2004void aa_labelset_init(struct aa_labelset *ls) 2005{ 2006 AA_BUG(!ls); 2007 2008 rwlock_init(&ls->lock); 2009 ls->root = RB_ROOT; 2010} 2011 2012static struct aa_label *labelset_next_stale(struct aa_labelset *ls) 2013{ 2014 struct aa_label *label; 2015 struct rb_node *node; 2016 unsigned long flags; 2017 2018 AA_BUG(!ls); 2019 2020 read_lock_irqsave(&ls->lock, flags); 2021 2022 __labelset_for_each(ls, node) { 2023 label = rb_entry(node, struct aa_label, node); 2024 if ((label_is_stale(label) || 2025 vec_is_stale(label->vec, label->size)) && 2026 __aa_get_label(label)) 2027 goto out; 2028 2029 } 2030 label = NULL; 2031 2032out: 2033 read_unlock_irqrestore(&ls->lock, flags); 2034 2035 return label; 2036} 2037 2038/** 2039 * __label_update - insert updated version of @label into labelset 2040 * @label - the label to update/replace 2041 * 2042 * Returns: new label that is up to date 2043 * else NULL on failure 2044 * 2045 * Requires: @ns lock be held 2046 * 2047 * Note: worst case is the stale @label does not get updated and has 2048 * to be updated at a later time. 2049 */ 2050static struct aa_label *__label_update(struct aa_label *label) 2051{ 2052 struct aa_label *new, *tmp; 2053 struct aa_labelset *ls; 2054 unsigned long flags; 2055 int i, invcount = 0; 2056 2057 AA_BUG(!label); 2058 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock)); 2059 2060 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); 2061 if (!new) 2062 return NULL; 2063 2064 /* 2065 * while holding the ns_lock will stop profile replacement, removal, 2066 * and label updates, label merging and removal can be occurring 2067 */ 2068 ls = labels_set(label); 2069 write_lock_irqsave(&ls->lock, flags); 2070 for (i = 0; i < label->size; i++) { 2071 AA_BUG(!label->vec[i]); 2072 new->vec[i] = aa_get_newest_profile(label->vec[i]); 2073 AA_BUG(!new->vec[i]); 2074 AA_BUG(!new->vec[i]->label.proxy); 2075 AA_BUG(!new->vec[i]->label.proxy->label); 2076 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) 2077 invcount++; 2078 } 2079 2080 /* updated stale label by being removed/renamed from labelset */ 2081 if (invcount) { 2082 new->size -= aa_vec_unique(&new->vec[0], new->size, 2083 VEC_FLAG_TERMINATE); 2084 /* TODO: deal with reference labels */ 2085 if (new->size == 1) { 2086 tmp = aa_get_label(&new->vec[0]->label); 2087 AA_BUG(tmp == label); 2088 goto remove; 2089 } 2090 if (labels_set(label) != labels_set(new)) { 2091 write_unlock_irqrestore(&ls->lock, flags); 2092 tmp = aa_label_insert(labels_set(new), new); 2093 write_lock_irqsave(&ls->lock, flags); 2094 goto remove; 2095 } 2096 } else 2097 AA_BUG(labels_ns(label) != labels_ns(new)); 2098 2099 tmp = __label_insert(labels_set(label), new, true); 2100remove: 2101 /* ensure label is removed, and redirected correctly */ 2102 __label_remove(label, tmp); 2103 write_unlock_irqrestore(&ls->lock, flags); 2104 label_free_or_put_new(tmp, new); 2105 2106 return tmp; 2107} 2108 2109/** 2110 * __labelset_update - update labels in @ns 2111 * @ns: namespace to update labels in (NOT NULL) 2112 * 2113 * Requires: @ns lock be held 2114 * 2115 * Walk the labelset ensuring that all labels are up to date and valid 2116 * Any label that has a stale component is marked stale and replaced and 2117 * by an updated version. 2118 * 2119 * If failures happen due to memory pressures then stale labels will 2120 * be left in place until the next pass. 2121 */ 2122static void __labelset_update(struct aa_ns *ns) 2123{ 2124 struct aa_label *label; 2125 2126 AA_BUG(!ns); 2127 AA_BUG(!mutex_is_locked(&ns->lock)); 2128 2129 do { 2130 label = labelset_next_stale(&ns->labels); 2131 if (label) { 2132 struct aa_label *l = __label_update(label); 2133 2134 aa_put_label(l); 2135 aa_put_label(label); 2136 } 2137 } while (label); 2138} 2139 2140/** 2141 * __aa_labelset_udate_subtree - update all labels with a stale component 2142 * @ns: ns to start update at (NOT NULL) 2143 * 2144 * Requires: @ns lock be held 2145 * 2146 * Invalidates labels based on @p in @ns and any children namespaces. 2147 */ 2148void __aa_labelset_update_subtree(struct aa_ns *ns) 2149{ 2150 struct aa_ns *child; 2151 2152 AA_BUG(!ns); 2153 AA_BUG(!mutex_is_locked(&ns->lock)); 2154 2155 __labelset_update(ns); 2156 2157 list_for_each_entry(child, &ns->sub_ns, base.list) { 2158 mutex_lock_nested(&child->lock, child->level); 2159 __aa_labelset_update_subtree(child); 2160 mutex_unlock(&child->lock); 2161 } 2162} 2163