1 // SPDX-License-Identifier: GPL-2.0-only
3 * AppArmor security module
5 * This file contains AppArmor label definitions
7 * Copyright 2017 Canonical Ltd.
10 #include <linux/audit.h>
11 #include <linux/seq_file.h>
12 #include <linux/sort.h>
14 #include "include/apparmor.h"
15 #include "include/cred.h"
16 #include "include/label.h"
17 #include "include/policy.h"
18 #include "include/secid.h"
22 * the aa_label represents the set of profiles confining an object
24 * Labels maintain a reference count to the set of pointers they reference
25 * Labels are ref counted by
26 * tasks and object via the security field/security context off the field
27 * code - will take a ref count on a label if it needs the label
28 * beyond what is possible with an rcu_read_lock.
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
32 * objects - inode, files, sockets, ...
34 * Labels are not ref counted by the label set, so they maybe removed and
35 * freed when no longer in use.
39 #define PROXY_POISON 97
40 #define LABEL_POISON 100
42 static void free_proxy(struct aa_proxy *proxy)
45 /* p->label will not updated any more as p is dead */
46 aa_put_label(rcu_dereference_protected(proxy->label, true));
47 memset(proxy, 0, sizeof(*proxy));
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
53 void aa_proxy_kref(struct kref *kref)
55 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
60 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
64 new = kzalloc(sizeof(struct aa_proxy), gfp);
66 kref_init(&new->count);
67 rcu_assign_pointer(new->label, aa_get_label(label));
72 /* requires profile list write lock held */
73 void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
79 lockdep_assert_held_write(&labels_set(orig)->lock);
81 tmp = rcu_dereference_protected(orig->proxy->label,
82 &labels_ns(orig)->lock);
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84 orig->flags |= FLAG_STALE;
88 static void __proxy_share(struct aa_label *old, struct aa_label *new)
90 struct aa_proxy *proxy = new->proxy;
92 new->proxy = aa_get_proxy(old->proxy);
93 __aa_proxy_redirect(old, new);
99 * ns_cmp - compare ns for label set ordering
100 * @a: ns to compare (NOT NULL)
101 * @b: ns to compare (NOT NULL)
103 * Returns: <0 if a < b
107 static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
113 AA_BUG(!a->base.hname);
114 AA_BUG(!b->base.hname);
119 res = a->level - b->level;
123 return strcmp(a->base.hname, b->base.hname);
127 * profile_cmp - profile comparison for set ordering
128 * @a: profile to compare (NOT NULL)
129 * @b: profile to compare (NOT NULL)
131 * Returns: <0 if a < b
135 static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
143 AA_BUG(!a->base.hname);
144 AA_BUG(!b->base.hname);
146 if (a == b || a->base.hname == b->base.hname)
148 res = ns_cmp(a->ns, b->ns);
152 return strcmp(a->base.hname, b->base.hname);
156 * vec_cmp - label comparison for set ordering
157 * @a: aa_profile to compare (NOT NULL)
159 * @b: aa_profile to compare (NOT NULL)
162 * Returns: <0 if @a < @b
166 static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
177 for (i = 0; i < an && i < bn; i++) {
178 int res = profile_cmp(a[i], b[i]);
187 static bool vec_is_stale(struct aa_profile **vec, int n)
193 for (i = 0; i < n; i++) {
194 if (profile_is_stale(vec[i]))
201 static long accum_vec_flags(struct aa_profile **vec, int n)
203 long u = FLAG_UNCONFINED;
208 for (i = 0; i < n; i++) {
209 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
211 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
212 u &= ~FLAG_UNCONFINED;
218 static int sort_cmp(const void *a, const void *b)
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
224 * assumes vec is sorted
225 * Assumes @vec has null terminator at vec[n], and will null terminate
228 static inline int unique(struct aa_profile **vec, int n)
230 int i, pos, dups = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
239 AA_BUG(res > 0, "vec not sorted");
242 aa_put_profile(vec[i]);
257 * aa_vec_unique - canonical sort and unique a list of profiles
258 * @n: number of refcounted profiles in the list (@n > 0)
259 * @vec: list of profiles to sort and merge
260 * @flags: null terminator flags of @vec
262 * Returns: the number of duplicates eliminated == references put
264 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
265 * null terminate vec[n - dups]
267 int aa_vec_unique(struct aa_profile **vec, int n, int flags)
274 /* vecs are usually small and inorder, have a fallback for larger */
276 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
277 dups = unique(vec, n);
281 /* insertion sort + unique in one */
282 for (i = 1; i < n; i++) {
283 struct aa_profile *tmp = vec[i];
286 for (pos = i - 1 - dups; pos >= 0; pos--) {
287 int res = profile_cmp(vec[pos], tmp);
290 /* drop duplicate entry */
297 /* pos is at entry < tmp, or index -1. Set to insert pos */
300 for (j = i - dups; j > pos; j--)
310 if (flags & VEC_FLAG_TERMINATE)
311 vec[n - dups] = NULL;
317 void aa_label_destroy(struct aa_label *label)
321 if (!label_isprofile(label)) {
322 struct aa_profile *profile;
325 aa_put_str(label->hname);
327 label_for_each(i, label, profile) {
328 aa_put_profile(profile);
329 label->vec[i.i] = (struct aa_profile *)
330 (LABEL_POISON + (long) i.i);
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
337 aa_put_proxy(label->proxy);
339 aa_free_secid(label->secid);
341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
344 void aa_label_free(struct aa_label *label)
349 aa_label_destroy(label);
353 static void label_free_switch(struct aa_label *label)
355 if (label->flags & FLAG_NS_COUNT)
356 aa_free_ns(labels_ns(label));
357 else if (label_isprofile(label))
358 aa_free_profile(labels_profile(label));
360 aa_label_free(label);
363 static void label_free_rcu(struct rcu_head *head)
365 struct aa_label *label = container_of(head, struct aa_label, rcu);
367 if (label->flags & FLAG_IN_TREE)
368 (void) aa_label_remove(label);
369 label_free_switch(label);
372 void aa_label_kref(struct kref *kref)
374 struct aa_label *label = container_of(kref, struct aa_label, count);
375 struct aa_ns *ns = labels_ns(label);
378 /* never live, no rcu callback needed, just using the fn */
379 label_free_switch(label);
382 /* TODO: update labels_profile macro so it works here */
383 AA_BUG(label_isprofile(label) &&
384 on_list_rcu(&label->vec[0]->base.profiles));
385 AA_BUG(label_isprofile(label) &&
386 on_list_rcu(&label->vec[0]->base.list));
388 /* TODO: if compound label and not stale add to reclaim cache */
389 call_rcu(&label->rcu, label_free_rcu);
392 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
395 /* need to free directly to break circular ref with proxy */
401 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
406 if (aa_alloc_secid(label, gfp) < 0)
409 label->size = size; /* doesn't include null */
410 label->vec[size] = NULL; /* null terminate */
411 kref_init(&label->count);
412 RB_CLEAR_NODE(&label->node);
418 * aa_label_alloc - allocate a label with a profile vector of @size length
419 * @size: size of profile vector in the label
420 * @proxy: proxy to use OR null if to allocate a new one
421 * @gfp: memory allocation type
424 * else NULL if failed
426 struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
428 struct aa_label *new;
432 /* + 1 for null terminator entry on vec */
433 new = kzalloc(struct_size(new, vec, size + 1), gfp);
434 AA_DEBUG("%s (%p)\n", __func__, new);
438 if (!aa_label_init(new, size, gfp))
442 proxy = aa_alloc_proxy(new, gfp);
447 /* just set new's proxy, don't redirect proxy here if it was passed in*/
460 * label_cmp - label comparison for set ordering
461 * @a: label to compare (NOT NULL)
462 * @b: label to compare (NOT NULL)
464 * Returns: <0 if a < b
468 static int label_cmp(struct aa_label *a, struct aa_label *b)
475 return vec_cmp(a->vec, a->size, b->vec, b->size);
478 /* helper fn for label_for_each_confined */
479 int aa_label_next_confined(struct aa_label *label, int i)
484 for (; i < label->size; i++) {
485 if (!profile_unconfined(label->vec[i]))
493 * __aa_label_next_not_in_set - return the next profile of @sub not in @set
495 * @set: label to test against
496 * @sub: label to if is subset of @set
498 * Returns: profile in @sub that is not in @set, with iterator set pos after
499 * else NULL if @sub is a subset of @set
501 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
502 struct aa_label *set,
503 struct aa_label *sub)
508 AA_BUG(I->i > set->size);
511 AA_BUG(I->j > sub->size);
513 while (I->j < sub->size && I->i < set->size) {
514 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
522 return sub->vec[(I->j)++];
525 if (I->j < sub->size)
526 return sub->vec[(I->j)++];
532 * aa_label_is_subset - test if @sub is a subset of @set
533 * @set: label to test against
534 * @sub: label to test if is subset of @set
536 * Returns: true if @sub is subset of @set
539 bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
541 struct label_it i = { };
549 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
553 * aa_label_is_unconfined_subset - test if @sub is a subset of @set
554 * @set: label to test against
555 * @sub: label to test if is subset of @set
557 * This checks for subset but taking into account unconfined. IF
558 * @sub contains an unconfined profile that does not have a matching
559 * unconfined in @set then this will not cause the test to fail.
560 * Conversely we don't care about an unconfined in @set that is not in
563 * Returns: true if @sub is special_subset of @set
566 bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
568 struct label_it i = { };
569 struct aa_profile *p;
578 p = __aa_label_next_not_in_set(&i, set, sub);
579 if (p && !profile_unconfined(p))
588 * __label_remove - remove @label from the label set
589 * @label: label to remove
590 * @new: label to redirect to
592 * Requires: labels_set(@label)->lock write_lock
593 * Returns: true if the label was in the tree and removed
595 static bool __label_remove(struct aa_label *label, struct aa_label *new)
597 struct aa_labelset *ls = labels_set(label);
601 lockdep_assert_held_write(&ls->lock);
604 __aa_proxy_redirect(label, new);
606 if (!label_is_stale(label))
607 __label_make_stale(label);
609 if (label->flags & FLAG_IN_TREE) {
610 rb_erase(&label->node, &ls->root);
611 label->flags &= ~FLAG_IN_TREE;
619 * __label_replace - replace @old with @new in label set
620 * @old: label to remove from label set
621 * @new: label to replace @old with
623 * Requires: labels_set(@old)->lock write_lock
624 * valid ref count be held on @new
625 * Returns: true if @old was in set and replaced by @new
627 * Note: current implementation requires label set be order in such a way
628 * that @new directly replaces @old position in the set (ie.
629 * using pointer comparison of the label address would not work)
631 static bool __label_replace(struct aa_label *old, struct aa_label *new)
633 struct aa_labelset *ls = labels_set(old);
638 lockdep_assert_held_write(&ls->lock);
639 AA_BUG(new->flags & FLAG_IN_TREE);
641 if (!label_is_stale(old))
642 __label_make_stale(old);
644 if (old->flags & FLAG_IN_TREE) {
645 rb_replace_node(&old->node, &new->node, &ls->root);
646 old->flags &= ~FLAG_IN_TREE;
647 new->flags |= FLAG_IN_TREE;
655 * __label_insert - attempt to insert @l into a label set
656 * @ls: set of labels to insert @l into (NOT NULL)
657 * @label: new label to insert (NOT NULL)
658 * @replace: whether insertion should replace existing entry that is not stale
660 * Requires: @ls->lock
661 * caller to hold a valid ref on l
662 * if @replace is true l has a preallocated proxy associated
663 * Returns: @l if successful in inserting @l - with additional refcount
664 * else ref counted equivalent label that is already in the set,
665 * the else condition only happens if @replace is false
667 static struct aa_label *__label_insert(struct aa_labelset *ls,
668 struct aa_label *label, bool replace)
670 struct rb_node **new, *parent = NULL;
674 AA_BUG(labels_set(label) != ls);
675 lockdep_assert_held_write(&ls->lock);
676 AA_BUG(label->flags & FLAG_IN_TREE);
678 /* Figure out where to put new node */
679 new = &ls->root.rb_node;
681 struct aa_label *this = rb_entry(*new, struct aa_label, node);
682 int result = label_cmp(label, this);
686 /* !__aa_get_label means queued for destruction,
687 * so replace in place, however the label has
688 * died before the replacement so do not share
691 if (!replace && !label_is_stale(this)) {
692 if (__aa_get_label(this))
695 __proxy_share(this, label);
696 AA_BUG(!__label_replace(this, label));
697 return aa_get_label(label);
698 } else if (result < 0)
699 new = &((*new)->rb_left);
700 else /* (result > 0) */
701 new = &((*new)->rb_right);
704 /* Add new node and rebalance tree. */
705 rb_link_node(&label->node, parent, new);
706 rb_insert_color(&label->node, &ls->root);
707 label->flags |= FLAG_IN_TREE;
709 return aa_get_label(label);
713 * __vec_find - find label that matches @vec in label set
714 * @vec: vec of profiles to find matching label for (NOT NULL)
717 * Requires: @vec_labelset(vec) lock held
718 * caller to hold a valid ref on l
720 * Returns: ref counted @label if matching label is in tree
721 * ref counted label that is equiv to @l in tree
722 * else NULL if @vec equiv is not in tree
724 static struct aa_label *__vec_find(struct aa_profile **vec, int n)
726 struct rb_node *node;
732 node = vec_labelset(vec, n)->root.rb_node;
734 struct aa_label *this = rb_entry(node, struct aa_label, node);
735 int result = vec_cmp(this->vec, this->size, vec, n);
738 node = node->rb_left;
740 node = node->rb_right;
742 return __aa_get_label(this);
749 * __label_find - find label @label in label set
750 * @label: label to find (NOT NULL)
752 * Requires: labels_set(@label)->lock held
753 * caller to hold a valid ref on l
755 * Returns: ref counted @label if @label is in tree OR
756 * ref counted label that is equiv to @label in tree
757 * else NULL if @label or equiv is not in tree
759 static struct aa_label *__label_find(struct aa_label *label)
763 return __vec_find(label->vec, label->size);
768 * aa_label_remove - remove a label from the labelset
769 * @label: label to remove
771 * Returns: true if @label was removed from the tree
772 * else @label was not in tree so it could not be removed
774 bool aa_label_remove(struct aa_label *label)
776 struct aa_labelset *ls = labels_set(label);
782 write_lock_irqsave(&ls->lock, flags);
783 res = __label_remove(label, ns_unconfined(labels_ns(label)));
784 write_unlock_irqrestore(&ls->lock, flags);
790 * aa_label_replace - replace a label @old with a new version @new
791 * @old: label to replace
792 * @new: label replacing @old
794 * Returns: true if @old was in tree and replaced
795 * else @old was not in tree, and @new was not inserted
797 bool aa_label_replace(struct aa_label *old, struct aa_label *new)
802 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
803 write_lock_irqsave(&labels_set(old)->lock, flags);
804 if (old->proxy != new->proxy)
805 __proxy_share(old, new);
807 __aa_proxy_redirect(old, new);
808 res = __label_replace(old, new);
809 write_unlock_irqrestore(&labels_set(old)->lock, flags);
812 struct aa_labelset *ls = labels_set(old);
814 write_lock_irqsave(&ls->lock, flags);
815 res = __label_remove(old, new);
816 if (labels_ns(old) != labels_ns(new)) {
817 write_unlock_irqrestore(&ls->lock, flags);
818 ls = labels_set(new);
819 write_lock_irqsave(&ls->lock, flags);
821 l = __label_insert(ls, new, true);
823 write_unlock_irqrestore(&ls->lock, flags);
831 * vec_find - find label @l in label set
832 * @vec: array of profiles to find equiv label for (NOT NULL)
835 * Returns: refcounted label if @vec equiv is in tree
836 * else NULL if @vec equiv is not in tree
838 static struct aa_label *vec_find(struct aa_profile **vec, int n)
840 struct aa_labelset *ls;
841 struct aa_label *label;
848 ls = vec_labelset(vec, n);
849 read_lock_irqsave(&ls->lock, flags);
850 label = __vec_find(vec, n);
851 read_unlock_irqrestore(&ls->lock, flags);
856 /* requires sort and merge done first */
857 static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
860 struct aa_label *label = NULL;
861 struct aa_labelset *ls;
863 struct aa_label *new;
869 return aa_get_label(&vec[0]->label);
871 ls = labels_set(&vec[len - 1]->label);
873 /* TODO: enable when read side is lockless
874 * check if label exists before taking locks
876 new = aa_label_alloc(len, NULL, gfp);
880 for (i = 0; i < len; i++)
881 new->vec[i] = aa_get_profile(vec[i]);
883 write_lock_irqsave(&ls->lock, flags);
884 label = __label_insert(ls, new, false);
885 write_unlock_irqrestore(&ls->lock, flags);
886 label_free_or_put_new(label, new);
891 struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
894 struct aa_label *label = vec_find(vec, len);
899 return vec_create_and_insert_label(vec, len, gfp);
903 * aa_label_find - find label @label in label set
904 * @label: label to find (NOT NULL)
906 * Requires: caller to hold a valid ref on l
908 * Returns: refcounted @label if @label is in tree
909 * refcounted label that is equiv to @label in tree
910 * else NULL if @label or equiv is not in tree
912 struct aa_label *aa_label_find(struct aa_label *label)
916 return vec_find(label->vec, label->size);
921 * aa_label_insert - insert label @label into @ls or return existing label
922 * @ls: labelset to insert @label into
923 * @label: label to insert
925 * Requires: caller to hold a valid ref on @label
927 * Returns: ref counted @label if successful in inserting @label
928 * else ref counted equivalent label that is already in the set
930 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
938 /* check if label exists before taking lock */
939 if (!label_is_stale(label)) {
940 read_lock_irqsave(&ls->lock, flags);
941 l = __label_find(label);
942 read_unlock_irqrestore(&ls->lock, flags);
947 write_lock_irqsave(&ls->lock, flags);
948 l = __label_insert(ls, label, false);
949 write_unlock_irqrestore(&ls->lock, flags);
956 * aa_label_next_in_merge - find the next profile when merging @a and @b
961 * Returns: next profile
962 * else null if no more profiles
964 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
972 AA_BUG(I->i > a->size);
974 AA_BUG(I->j > b->size);
976 if (I->i < a->size) {
977 if (I->j < b->size) {
978 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
981 return b->vec[(I->j)++];
986 return a->vec[(I->i)++];
990 return b->vec[(I->j)++];
996 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
997 * @a: label to merge then compare (NOT NULL)
998 * @b: label to merge then compare (NOT NULL)
999 * @z: label to compare merge against (NOT NULL)
1001 * Assumes: using the most recent versions of @a, @b, and @z
1003 * Returns: <0 if a < b
1007 static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1010 struct aa_profile *p = NULL;
1011 struct label_it i = { };
1019 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
1021 int res = profile_cmp(p, z->vec[k]);
1029 else if (k < z->size)
1035 * label_merge_insert - create a new label by merging @a and @b
1036 * @new: preallocated label to merge into (NOT NULL)
1037 * @a: label to merge with @b (NOT NULL)
1038 * @b: label to merge with @a (NOT NULL)
1040 * Requires: preallocated proxy
1042 * Returns: ref counted label either @new if merge is unique
1043 * @a if @b is a subset of @a
1044 * @b if @a is a subset of @b
1046 * NOTE: will not use @new if the merge results in @new == @a or @b
1048 * Must be used within labelset write lock to avoid racing with
1049 * setting labels stale.
1051 static struct aa_label *label_merge_insert(struct aa_label *new,
1055 struct aa_label *label;
1056 struct aa_labelset *ls;
1057 struct aa_profile *next;
1059 unsigned long flags;
1060 int k = 0, invcount = 0;
1064 AA_BUG(a->size < 0);
1066 AA_BUG(b->size < 0);
1068 AA_BUG(new->size < a->size + b->size);
1070 label_for_each_in_merge(i, a, b, next) {
1072 if (profile_is_stale(next)) {
1073 new->vec[k] = aa_get_newest_profile(next);
1074 AA_BUG(!new->vec[k]->label.proxy);
1075 AA_BUG(!new->vec[k]->label.proxy->label);
1076 if (next->label.proxy != new->vec[k]->label.proxy)
1081 new->vec[k++] = aa_get_profile(next);
1083 /* set to actual size which is <= allocated len */
1088 new->size -= aa_vec_unique(&new->vec[0], new->size,
1089 VEC_FLAG_TERMINATE);
1090 /* TODO: deal with reference labels */
1091 if (new->size == 1) {
1092 label = aa_get_label(&new->vec[0]->label);
1095 } else if (!stale) {
1097 * merge could be same as a || b, note: it is not possible
1098 * for new->size == a->size == b->size unless a == b
1101 return aa_get_label(a);
1102 else if (k == b->size)
1103 return aa_get_label(b);
1105 new->flags |= accum_vec_flags(new->vec, new->size);
1106 ls = labels_set(new);
1107 write_lock_irqsave(&ls->lock, flags);
1108 label = __label_insert(labels_set(new), new, false);
1109 write_unlock_irqrestore(&ls->lock, flags);
1115 * labelset_of_merge - find which labelset a merged label should be inserted
1116 * @a: label to merge and insert
1117 * @b: label to merge and insert
1119 * Returns: labelset that the merged label should be inserted into
1121 static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1124 struct aa_ns *nsa = labels_ns(a);
1125 struct aa_ns *nsb = labels_ns(b);
1127 if (ns_cmp(nsa, nsb) <= 0)
1128 return &nsa->labels;
1129 return &nsb->labels;
1133 * __label_find_merge - find label that is equiv to merge of @a and @b
1134 * @ls: set of labels to search (NOT NULL)
1135 * @a: label to merge with @b (NOT NULL)
1136 * @b: label to merge with @a (NOT NULL)
1138 * Requires: ls->lock read_lock held
1140 * Returns: ref counted label that is equiv to merge of @a and @b
1141 * else NULL if merge of @a and @b is not in set
1143 static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1147 struct rb_node *node;
1154 return __label_find(a);
1156 node = ls->root.rb_node;
1158 struct aa_label *this = container_of(node, struct aa_label,
1160 int result = label_merge_cmp(a, b, this);
1163 node = node->rb_left;
1164 else if (result > 0)
1165 node = node->rb_right;
1167 return __aa_get_label(this);
1175 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1176 * @a: label to merge with @b (NOT NULL)
1177 * @b: label to merge with @a (NOT NULL)
1179 * Requires: labels be fully constructed with a valid ns
1181 * Returns: ref counted label that is equiv to merge of @a and @b
1182 * else NULL if merge of @a and @b is not in set
1184 struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1186 struct aa_labelset *ls;
1187 struct aa_label *label, *ar = NULL, *br = NULL;
1188 unsigned long flags;
1193 if (label_is_stale(a))
1194 a = ar = aa_get_newest_label(a);
1195 if (label_is_stale(b))
1196 b = br = aa_get_newest_label(b);
1197 ls = labelset_of_merge(a, b);
1198 read_lock_irqsave(&ls->lock, flags);
1199 label = __label_find_merge(ls, a, b);
1200 read_unlock_irqrestore(&ls->lock, flags);
1208 * aa_label_merge - attempt to insert new merged label of @a and @b
1209 * @a: label to merge with @b (NOT NULL)
1210 * @b: label to merge with @a (NOT NULL)
1211 * @gfp: memory allocation type
1213 * Requires: caller to hold valid refs on @a and @b
1214 * labels be fully constructed with a valid ns
1216 * Returns: ref counted new label if successful in inserting merge of a & b
1217 * else ref counted equivalent label that is already in the set.
1218 * else NULL if could not create label (-ENOMEM)
1220 struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1223 struct aa_label *label = NULL;
1229 return aa_get_newest_label(a);
1231 /* TODO: enable when read side is lockless
1232 * check if label exists before taking locks
1233 if (!label_is_stale(a) && !label_is_stale(b))
1234 label = aa_label_find_merge(a, b);
1238 struct aa_label *new;
1240 a = aa_get_newest_label(a);
1241 b = aa_get_newest_label(b);
1243 /* could use label_merge_len(a, b), but requires double
1244 * comparison for small savings
1246 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1250 label = label_merge_insert(new, a, b);
1251 label_free_or_put_new(label, new);
1260 /* match a profile and its associated ns component if needed
1261 * Assumes visibility test has already been done.
1262 * If a subns profile is not to be matched should be prescreened with
1265 static inline aa_state_t match_component(struct aa_profile *profile,
1266 struct aa_ruleset *rules,
1267 struct aa_profile *tp,
1270 const char *ns_name;
1272 if (profile->ns == tp->ns)
1273 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1275 /* try matching with namespace name and then profile */
1276 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1277 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1278 state = aa_dfa_match(rules->policy->dfa, state, ns_name);
1279 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);
1280 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);
1284 * label_compound_match - find perms for full compound label
1285 * @profile: profile to find perms for
1286 * @rules: ruleset to search
1287 * @label: label to check access permissions for
1288 * @state: state to start match in
1289 * @subns: whether to do permission checks on components in a subns
1290 * @request: permissions to request
1291 * @perms: perms struct to set
1293 * Returns: 0 on success else ERROR
1295 * For the label A//&B//&C this does the perm match for A//&B//&C
1296 * @perms should be preinitialized with allperms OR a previous permission
1297 * check to be stacked.
1299 static int label_compound_match(struct aa_profile *profile,
1300 struct aa_ruleset *rules,
1301 struct aa_label *label,
1302 aa_state_t state, bool subns, u32 request,
1303 struct aa_perms *perms)
1305 struct aa_profile *tp;
1308 /* find first subcomponent that is visible */
1309 label_for_each(i, label, tp) {
1310 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1312 state = match_component(profile, rules, tp, state);
1318 /* no component visible */
1323 label_for_each_cont(i, label, tp) {
1324 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1326 state = aa_dfa_match(rules->policy->dfa, state, "//&");
1327 state = match_component(profile, rules, tp, state);
1331 *perms = *aa_lookup_perms(rules->policy, state);
1332 aa_apply_modes_to_perms(profile, perms);
1333 if ((perms->allow & request) != request)
1344 * label_components_match - find perms for all subcomponents of a label
1345 * @profile: profile to find perms for
1346 * @rules: ruleset to search
1347 * @label: label to check access permissions for
1348 * @start: state to start match in
1349 * @subns: whether to do permission checks on components in a subns
1350 * @request: permissions to request
1351 * @perms: an initialized perms struct to add accumulation to
1353 * Returns: 0 on success else ERROR
1355 * For the label A//&B//&C this does the perm match for each of A and B and C
1356 * @perms should be preinitialized with allperms OR a previous permission
1357 * check to be stacked.
1359 static int label_components_match(struct aa_profile *profile,
1360 struct aa_ruleset *rules,
1361 struct aa_label *label, aa_state_t start,
1362 bool subns, u32 request,
1363 struct aa_perms *perms)
1365 struct aa_profile *tp;
1367 struct aa_perms tmp;
1368 aa_state_t state = 0;
1370 /* find first subcomponent to test */
1371 label_for_each(i, label, tp) {
1372 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1374 state = match_component(profile, rules, tp, start);
1380 /* no subcomponents visible - no change in perms */
1384 tmp = *aa_lookup_perms(rules->policy, state);
1385 aa_apply_modes_to_perms(profile, &tmp);
1386 aa_perms_accum(perms, &tmp);
1387 label_for_each_cont(i, label, tp) {
1388 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1390 state = match_component(profile, rules, tp, start);
1393 tmp = *aa_lookup_perms(rules->policy, state);
1394 aa_apply_modes_to_perms(profile, &tmp);
1395 aa_perms_accum(perms, &tmp);
1398 if ((perms->allow & request) != request)
1409 * aa_label_match - do a multi-component label match
1410 * @profile: profile to match against (NOT NULL)
1411 * @rules: ruleset to search
1412 * @label: label to match (NOT NULL)
1413 * @state: state to start in
1414 * @subns: whether to match subns components
1415 * @request: permission request
1416 * @perms: Returns computed perms (NOT NULL)
1418 * Returns: the state the match finished in, may be the none matching state
1420 int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
1421 struct aa_label *label, aa_state_t state, bool subns,
1422 u32 request, struct aa_perms *perms)
1424 int error = label_compound_match(profile, rules, label, state, subns,
1430 return label_components_match(profile, rules, label, state, subns,
1436 * aa_update_label_name - update a label to have a stored name
1437 * @ns: ns being viewed from (NOT NULL)
1438 * @label: label to update (NOT NULL)
1439 * @gfp: type of memory allocation
1441 * Requires: labels_set(label) not locked in caller
1443 * note: only updates the label name if it does not have a name already
1444 * and if it is in the labelset
1446 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1448 struct aa_labelset *ls;
1449 unsigned long flags;
1450 char __counted *name;
1456 if (label->hname || labels_ns(label) != ns)
1459 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
1462 ls = labels_set(label);
1463 write_lock_irqsave(&ls->lock, flags);
1464 if (!label->hname && label->flags & FLAG_IN_TREE) {
1465 label->hname = name;
1469 write_unlock_irqrestore(&ls->lock, flags);
1475 * cached label name is present and visible
1476 * @label->hname only exists if label is namespace hierachical
1478 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1481 if (label->hname && (!ns || labels_ns(label) == ns) &&
1482 !(flags & ~FLAG_SHOW_MODE))
1488 /* helper macro for snprint routines */
1489 #define update_for_len(total, len, size, str) \
1491 size_t ulen = len; \
1495 ulen = min(ulen, size); \
1501 * aa_profile_snxprint - print a profile name to a buffer
1502 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1503 * @size: size of buffer
1504 * @view: namespace profile is being viewed from
1505 * @profile: profile to view (NOT NULL)
1506 * @flags: whether to include the mode string
1507 * @prev_ns: last ns printed when used in compound print
1509 * Returns: size of name written or would be written if larger than
1512 * Note: will not print anything if the profile is not visible
1514 static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1515 struct aa_profile *profile, int flags,
1516 struct aa_ns **prev_ns)
1518 const char *ns_name = NULL;
1520 AA_BUG(!str && size != 0);
1524 view = profiles_ns(profile);
1526 if (view != profile->ns &&
1527 (!prev_ns || (*prev_ns != profile->ns))) {
1529 *prev_ns = profile->ns;
1530 ns_name = aa_ns_name(view, profile->ns,
1531 flags & FLAG_VIEW_SUBNS);
1532 if (ns_name == aa_hidden_ns_name) {
1533 if (flags & FLAG_HIDDEN_UNCONFINED)
1534 return snprintf(str, size, "%s", "unconfined");
1535 return snprintf(str, size, "%s", ns_name);
1539 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1540 const char *modestr = aa_profile_mode_names[profile->mode];
1543 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1544 profile->base.hname, modestr);
1545 return snprintf(str, size, "%s (%s)", profile->base.hname,
1550 return snprintf(str, size, ":%s:%s", ns_name,
1551 profile->base.hname);
1552 return snprintf(str, size, "%s", profile->base.hname);
1555 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1558 struct aa_profile *profile;
1560 int mode = -1, count = 0;
1562 label_for_each(i, label, profile) {
1563 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1565 if (profile == profile->ns->unconfined)
1566 /* special case unconfined so stacks with
1567 * unconfined don't report as mixed. ie.
1568 * profile_foo//&:ns1:unconfined (mixed)
1572 mode = profile->mode;
1573 else if (mode != profile->mode)
1581 /* everything was unconfined */
1582 mode = APPARMOR_UNCONFINED;
1584 return aa_profile_mode_names[mode];
1587 /* if any visible label is not unconfined the display_mode returns true */
1588 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1591 if ((flags & FLAG_SHOW_MODE)) {
1592 struct aa_profile *profile;
1595 label_for_each(i, label, profile) {
1596 if (aa_ns_visible(ns, profile->ns,
1597 flags & FLAG_VIEW_SUBNS) &&
1598 profile != profile->ns->unconfined)
1601 /* only ns->unconfined in set of profiles in ns */
1609 * aa_label_snxprint - print a label name to a string buffer
1610 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1611 * @size: size of buffer
1612 * @ns: namespace profile is being viewed from
1613 * @label: label to view (NOT NULL)
1614 * @flags: whether to include the mode string
1616 * Returns: size of name written or would be written if larger than
1619 * Note: labels do not have to be strictly hierarchical to the ns as
1620 * objects may be shared across different namespaces and thus
1621 * pickup labeling from each ns. If a particular part of the
1622 * label is not visible it will just be excluded. And if none
1623 * of the label is visible "---" will be used.
1625 int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1626 struct aa_label *label, int flags)
1628 struct aa_profile *profile;
1629 struct aa_ns *prev_ns = NULL;
1631 int count = 0, total = 0;
1634 AA_BUG(!str && size != 0);
1637 if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
1639 len = snprintf(str, size, "_");
1640 update_for_len(total, len, size, str);
1642 ns = labels_ns(label);
1645 label_for_each(i, label, profile) {
1646 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1648 len = snprintf(str, size, "//&");
1649 update_for_len(total, len, size, str);
1651 len = aa_profile_snxprint(str, size, ns, profile,
1652 flags & FLAG_VIEW_SUBNS,
1654 update_for_len(total, len, size, str);
1660 if (flags & FLAG_HIDDEN_UNCONFINED)
1661 return snprintf(str, size, "%s", "unconfined");
1662 return snprintf(str, size, "%s", aa_hidden_ns_name);
1665 /* count == 1 && ... is for backwards compat where the mode
1666 * is not displayed for 'unconfined' in the current ns
1668 if (display_mode(ns, label, flags)) {
1669 len = snprintf(str, size, " (%s)",
1670 label_modename(ns, label, flags));
1671 update_for_len(total, len, size, str);
1676 #undef update_for_len
1679 * aa_label_asxprint - allocate a string buffer and print label into it
1680 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1681 * @ns: namespace profile is being viewed from
1682 * @label: label to view (NOT NULL)
1683 * @flags: flags controlling what label info is printed
1684 * @gfp: kernel memory allocation type
1686 * Returns: size of name written or would be written if larger than
1689 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1690 int flags, gfp_t gfp)
1697 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1701 *strp = kmalloc(size + 1, gfp);
1704 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1708 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1709 * @strp: buffer to write to.
1710 * @ns: namespace profile is being viewed from
1711 * @label: label to view (NOT NULL)
1712 * @flags: flags controlling what label info is printed
1713 * @gfp: kernel memory allocation type
1715 * Returns: size of name written or would be written if larger than
1718 int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1719 struct aa_label *label, int flags, gfp_t gfp)
1726 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1730 *strp = aa_str_alloc(size + 1, gfp);
1733 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1737 void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1738 struct aa_label *label, int flags, gfp_t gfp)
1747 if (!use_label_hname(ns, label, flags) ||
1748 display_mode(ns, label, flags)) {
1749 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1751 AA_DEBUG("label print error");
1756 str = (char *) label->hname;
1759 if (audit_string_contains_control(str, len))
1760 audit_log_n_hex(ab, str, len);
1762 audit_log_n_string(ab, str, len);
1767 void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1768 struct aa_label *label, int flags, gfp_t gfp)
1773 if (!use_label_hname(ns, label, flags)) {
1777 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1779 AA_DEBUG("label print error");
1784 } else if (display_mode(ns, label, flags))
1785 seq_printf(f, "%s (%s)", label->hname,
1786 label_modename(ns, label, flags));
1788 seq_puts(f, label->hname);
1791 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1796 if (!use_label_hname(ns, label, flags)) {
1800 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1802 AA_DEBUG("label print error");
1807 } else if (display_mode(ns, label, flags))
1808 pr_info("%s (%s)", label->hname,
1809 label_modename(ns, label, flags));
1811 pr_info("%s", label->hname);
1814 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1816 struct aa_ns *ns = aa_get_current_ns();
1818 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1822 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1824 struct aa_ns *ns = aa_get_current_ns();
1826 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1830 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1832 struct aa_ns *ns = aa_get_current_ns();
1834 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1838 static int label_count_strn_entries(const char *str, size_t n)
1840 const char *end = str + n;
1846 for (split = aa_label_strn_split(str, end - str);
1848 split = aa_label_strn_split(str, end - str)) {
1857 * ensure stacks with components like
1859 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1860 * to the base if the lookup specifies an ns, else making the stacked lookup
1861 * relative to the last embedded ns in the string.
1863 static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1864 struct aa_label *currentbase,
1865 const char *str, size_t n)
1867 const char *first = skipn_spaces(str, n);
1869 if (first && *first == ':')
1870 return aa_fqlookupn_profile(base, str, n);
1872 return aa_fqlookupn_profile(currentbase, str, n);
1876 * aa_label_strn_parse - parse, validate and convert a text string to a label
1877 * @base: base label to use for lookups (NOT NULL)
1878 * @str: null terminated text string (NOT NULL)
1879 * @n: length of str to parse, will stop at \0 if encountered before n
1880 * @gfp: allocation type
1881 * @create: true if should create compound labels if they don't exist
1882 * @force_stack: true if should stack even if no leading &
1884 * Returns: the matching refcounted label if present
1887 struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1888 size_t n, gfp_t gfp, bool create,
1891 DEFINE_VEC(profile, vec);
1892 struct aa_label *label, *currbase = base;
1893 int i, len, stack = 0, error;
1894 const char *end = str + n;
1900 str = skipn_spaces(str, n);
1901 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
1902 base != &root_ns->unconfined->label))
1903 return ERR_PTR(-EINVAL);
1905 len = label_count_strn_entries(str, end - str);
1906 if (*str == '&' || force_stack) {
1907 /* stack on top of base */
1914 error = vec_setup(profile, vec, len, gfp);
1916 return ERR_PTR(error);
1918 for (i = 0; i < stack; i++)
1919 vec[i] = aa_get_profile(base->vec[i]);
1921 for (split = aa_label_strn_split(str, end - str), i = stack;
1922 split && i < len; i++) {
1923 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1927 * if component specified a new ns it becomes the new base
1928 * so that subsequent lookups are relative to it
1930 if (vec[i]->ns != labels_ns(currbase))
1931 currbase = &vec[i]->label;
1933 split = aa_label_strn_split(str, end - str);
1935 /* last element doesn't have a split */
1937 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1942 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1943 return &vec[0]->label;
1945 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1946 /* TODO: deal with reference labels */
1948 label = aa_get_label(&vec[0]->label);
1953 label = aa_vec_find_or_create_label(vec, len, gfp);
1955 label = vec_find(vec, len);
1960 /* use adjusted len from after vec_unique, not original */
1961 vec_cleanup(profile, vec, len);
1965 label = ERR_PTR(-ENOENT);
1969 struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1970 gfp_t gfp, bool create, bool force_stack)
1972 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1977 * aa_labelset_destroy - remove all labels from the label set
1978 * @ls: label set to cleanup (NOT NULL)
1980 * Labels that are removed from the set may still exist beyond the set
1981 * being destroyed depending on their reference counting
1983 void aa_labelset_destroy(struct aa_labelset *ls)
1985 struct rb_node *node;
1986 unsigned long flags;
1990 write_lock_irqsave(&ls->lock, flags);
1991 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1992 struct aa_label *this = rb_entry(node, struct aa_label, node);
1994 if (labels_ns(this) != root_ns)
1995 __label_remove(this,
1996 ns_unconfined(labels_ns(this)->parent));
1998 __label_remove(this, NULL);
2000 write_unlock_irqrestore(&ls->lock, flags);
2004 * @ls: labelset to init (NOT NULL)
2006 void aa_labelset_init(struct aa_labelset *ls)
2010 rwlock_init(&ls->lock);
2014 static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2016 struct aa_label *label;
2017 struct rb_node *node;
2018 unsigned long flags;
2022 read_lock_irqsave(&ls->lock, flags);
2024 __labelset_for_each(ls, node) {
2025 label = rb_entry(node, struct aa_label, node);
2026 if ((label_is_stale(label) ||
2027 vec_is_stale(label->vec, label->size)) &&
2028 __aa_get_label(label))
2035 read_unlock_irqrestore(&ls->lock, flags);
2041 * __label_update - insert updated version of @label into labelset
2042 * @label: the label to update/replace
2044 * Returns: new label that is up to date
2045 * else NULL on failure
2047 * Requires: @ns lock be held
2049 * Note: worst case is the stale @label does not get updated and has
2050 * to be updated at a later time.
2052 static struct aa_label *__label_update(struct aa_label *label)
2054 struct aa_label *new, *tmp;
2055 struct aa_labelset *ls;
2056 unsigned long flags;
2057 int i, invcount = 0;
2060 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2062 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2067 * while holding the ns_lock will stop profile replacement, removal,
2068 * and label updates, label merging and removal can be occurring
2070 ls = labels_set(label);
2071 write_lock_irqsave(&ls->lock, flags);
2072 for (i = 0; i < label->size; i++) {
2073 AA_BUG(!label->vec[i]);
2074 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2075 AA_BUG(!new->vec[i]);
2076 AA_BUG(!new->vec[i]->label.proxy);
2077 AA_BUG(!new->vec[i]->label.proxy->label);
2078 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2082 /* updated stale label by being removed/renamed from labelset */
2084 new->size -= aa_vec_unique(&new->vec[0], new->size,
2085 VEC_FLAG_TERMINATE);
2086 /* TODO: deal with reference labels */
2087 if (new->size == 1) {
2088 tmp = aa_get_label(&new->vec[0]->label);
2089 AA_BUG(tmp == label);
2092 if (labels_set(label) != labels_set(new)) {
2093 write_unlock_irqrestore(&ls->lock, flags);
2094 tmp = aa_label_insert(labels_set(new), new);
2095 write_lock_irqsave(&ls->lock, flags);
2099 AA_BUG(labels_ns(label) != labels_ns(new));
2101 tmp = __label_insert(labels_set(label), new, true);
2103 /* ensure label is removed, and redirected correctly */
2104 __label_remove(label, tmp);
2105 write_unlock_irqrestore(&ls->lock, flags);
2106 label_free_or_put_new(tmp, new);
2112 * __labelset_update - update labels in @ns
2113 * @ns: namespace to update labels in (NOT NULL)
2115 * Requires: @ns lock be held
2117 * Walk the labelset ensuring that all labels are up to date and valid
2118 * Any label that has a stale component is marked stale and replaced and
2119 * by an updated version.
2121 * If failures happen due to memory pressures then stale labels will
2122 * be left in place until the next pass.
2124 static void __labelset_update(struct aa_ns *ns)
2126 struct aa_label *label;
2129 AA_BUG(!mutex_is_locked(&ns->lock));
2132 label = labelset_next_stale(&ns->labels);
2134 struct aa_label *l = __label_update(label);
2137 aa_put_label(label);
2143 * __aa_labelset_update_subtree - update all labels with a stale component
2144 * @ns: ns to start update at (NOT NULL)
2146 * Requires: @ns lock be held
2148 * Invalidates labels based on @p in @ns and any children namespaces.
2150 void __aa_labelset_update_subtree(struct aa_ns *ns)
2152 struct aa_ns *child;
2155 AA_BUG(!mutex_is_locked(&ns->lock));
2157 __labelset_update(ns);
2159 list_for_each_entry(child, &ns->sub_ns, base.list) {
2160 mutex_lock_nested(&child->lock, child->level);
2161 __aa_labelset_update_subtree(child);
2162 mutex_unlock(&child->lock);