1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* AppArmor security module
4	*
5	* This file contains AppArmor label definitions
6	*
7	* Copyright 2017 Canonical Ltd.
8	*/
9
10	#include <linux/audit.h>
11	#include <linux/seq_file.h>
12	#include <linux/sort.h>
13
14	#include "include/apparmor.h"
15	#include "include/cred.h"
16	#include "include/label.h"
17	#include "include/policy.h"
18	#include "include/secid.h"
19
20
21	/*
22	* the aa_label represents the set of profiles confining an object
23	*
24	* Labels maintain a reference count to the set of pointers they reference
25	* Labels are ref counted by
26	* tasks and object via the security field/security context off the field
27	* code - will take a ref count on a label if it needs the label
28	* beyond what is possible with an rcu_read_lock.
29	* profiles - each profile is a label
30	* secids - a pinned secid will keep a refcount of the label it is
31	* referencing
32	* objects - inode, files, sockets, ...
33	*
34	* Labels are not ref counted by the label set, so they maybe removed and
35	* freed when no longer in use.
36	*
37	*/
38
39	#define PROXY_POISON 97
40	#define LABEL_POISON 100
41
42	static void free_proxy(struct aa_proxy *proxy)
43	{
44	if (proxy) {
45	/* p->label will not updated any more as p is dead */
46	aa_put_label(rcu_dereference_protected(proxy->label, true));
47	memset(proxy, 0, sizeof(*proxy));
48	RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
49	kfree(objp: proxy);
50	}
51	}
52
53	void aa_proxy_kref(struct kref *kref)
54	{
55	struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
56
57	free_proxy(proxy);
58	}
59
60	struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
61	{
62	struct aa_proxy *new;
63
64	new = kzalloc(size: sizeof(struct aa_proxy), flags: gfp);
65	if (new) {
66	kref_init(kref: &new->count);
67	rcu_assign_pointer(new->label, aa_get_label(label));
68	}
69	return new;
70	}
71
72	/* requires profile list write lock held */
73	void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
74	{
75	struct aa_label *tmp;
76
77	AA_BUG(!orig);
78	AA_BUG(!new);
79	lockdep_assert_held_write(&labels_set(orig)->lock);
80
81	tmp = rcu_dereference_protected(orig->proxy->label,
82	&labels_ns(orig)->lock);
83	rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
84	orig->flags |= FLAG_STALE;
85	aa_put_label(l: tmp);
86	}
87
88	static void __proxy_share(struct aa_label *old, struct aa_label *new)
89	{
90	struct aa_proxy *proxy = new->proxy;
91
92	new->proxy = aa_get_proxy(proxy: old->proxy);
93	__aa_proxy_redirect(orig: old, new);
94	aa_put_proxy(proxy);
95	}
96
97
98	/**
99	* ns_cmp - compare ns for label set ordering
100	* @a: ns to compare (NOT NULL)
101	* @b: ns to compare (NOT NULL)
102	*
103	* Returns: <0 if a < b
104	* ==0 if a == b
105	* >0 if a > b
106	*/
107	static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
108	{
109	int res;
110
111	AA_BUG(!a);
112	AA_BUG(!b);
113	AA_BUG(!a->base.hname);
114	AA_BUG(!b->base.hname);
115
116	if (a == b)
117	return 0;
118
119	res = a->level - b->level;
120	if (res)
121	return res;
122
123	return strcmp(a->base.hname, b->base.hname);
124	}
125
126	/**
127	* profile_cmp - profile comparison for set ordering
128	* @a: profile to compare (NOT NULL)
129	* @b: profile to compare (NOT NULL)
130	*
131	* Returns: <0 if a < b
132	* ==0 if a == b
133	* >0 if a > b
134	*/
135	static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
136	{
137	int res;
138
139	AA_BUG(!a);
140	AA_BUG(!b);
141	AA_BUG(!a->ns);
142	AA_BUG(!b->ns);
143	AA_BUG(!a->base.hname);
144	AA_BUG(!b->base.hname);
145
146	if (a == b || a->base.hname == b->base.hname)
147	return 0;
148	res = ns_cmp(a: a->ns, b: b->ns);
149	if (res)
150	return res;
151
152	return strcmp(a->base.hname, b->base.hname);
153	}
154
155	/**
156	* vec_cmp - label comparison for set ordering
157	* @a: aa_profile to compare (NOT NULL)
158	* @an: length of @a
159	* @b: aa_profile to compare (NOT NULL)
160	* @bn: length of @b
161	*
162	* Returns: <0 if @a < @b
163	* ==0 if @a == @b
164	* >0 if @a > @b
165	*/
166	static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
167	{
168	int i;
169
170	AA_BUG(!a);
171	AA_BUG(!*a);
172	AA_BUG(!b);
173	AA_BUG(!*b);
174	AA_BUG(an <= 0);
175	AA_BUG(bn <= 0);
176
177	for (i = 0; i < an && i < bn; i++) {
178	int res = profile_cmp(a: a[i], b: b[i]);
179
180	if (res != 0)
181	return res;
182	}
183
184	return an - bn;
185	}
186
187	static bool vec_is_stale(struct aa_profile **vec, int n)
188	{
189	int i;
190
191	AA_BUG(!vec);
192
193	for (i = 0; i < n; i++) {
194	if (profile_is_stale(vec[i]))
195	return true;
196	}
197
198	return false;
199	}
200
201	static long accum_vec_flags(struct aa_profile **vec, int n)
202	{
203	long u = FLAG_UNCONFINED;
204	int i;
205
206	AA_BUG(!vec);
207
208	for (i = 0; i < n; i++) {
209	u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
210	FLAG_STALE);
211	if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
212	u &= ~FLAG_UNCONFINED;
213	}
214
215	return u;
216	}
217
218	static int sort_cmp(const void *a, const void *b)
219	{
220	return profile_cmp(a: *(struct aa_profile **)a, b: *(struct aa_profile **)b);
221	}
222
223	/*
224	* assumes vec is sorted
225	* Assumes @vec has null terminator at vec[n], and will null terminate
226	* vec[n - dups]
227	*/
228	static inline int unique(struct aa_profile **vec, int n)
229	{
230	int i, pos, dups = 0;
231
232	AA_BUG(n < 1);
233	AA_BUG(!vec);
234
235	pos = 0;
236	for (i = 1; i < n; i++) {
237	int res = profile_cmp(a: vec[pos], b: vec[i]);
238
239	AA_BUG(res > 0, "vec not sorted");
240	if (res == 0) {
241	/* drop duplicate */
242	aa_put_profile(p: vec[i]);
243	dups++;
244	continue;
245	}
246	pos++;
247	if (dups)
248	vec[pos] = vec[i];
249	}
250
251	AA_BUG(dups < 0);
252
253	return dups;
254	}
255
256	/**
257	* aa_vec_unique - canonical sort and unique a list of profiles
258	* @n: number of refcounted profiles in the list (@n > 0)
259	* @vec: list of profiles to sort and merge
260	* @flags: null terminator flags of @vec
261	*
262	* Returns: the number of duplicates eliminated == references put
263	*
264	* If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
265	* null terminate vec[n - dups]
266	*/
267	int aa_vec_unique(struct aa_profile **vec, int n, int flags)
268	{
269	int i, dups = 0;
270
271	AA_BUG(n < 1);
272	AA_BUG(!vec);
273
274	/* vecs are usually small and inorder, have a fallback for larger */
275	if (n > 8) {
276	sort(base: vec, num: n, size: sizeof(struct aa_profile *), cmp_func: sort_cmp, NULL);
277	dups = unique(vec, n);
278	goto out;
279	}
280
281	/* insertion sort + unique in one */
282	for (i = 1; i < n; i++) {
283	struct aa_profile *tmp = vec[i];
284	int pos, j;
285
286	for (pos = i - 1 - dups; pos >= 0; pos--) {
287	int res = profile_cmp(a: vec[pos], b: tmp);
288
289	if (res == 0) {
290	/* drop duplicate entry */
291	aa_put_profile(p: tmp);
292	dups++;
293	goto continue_outer;
294	} else if (res < 0)
295	break;
296	}
297	/* pos is at entry < tmp, or index -1. Set to insert pos */
298	pos++;
299
300	for (j = i - dups; j > pos; j--)
301	vec[j] = vec[j - 1];
302	vec[pos] = tmp;
303	continue_outer:
304	;
305	}
306
307	AA_BUG(dups < 0);
308
309	out:
310	if (flags & VEC_FLAG_TERMINATE)
311	vec[n - dups] = NULL;
312
313	return dups;
314	}
315
316
317	void aa_label_destroy(struct aa_label *label)
318	{
319	AA_BUG(!label);
320
321	if (!label_isprofile(label)) {
322	struct aa_profile *profile;
323	struct label_it i;
324
325	aa_put_str(str: label->hname);
326
327	label_for_each(i, label, profile) {
328	aa_put_profile(p: profile);
329	label->vec[i.i] = (struct aa_profile *)
330	(LABEL_POISON + (long) i.i);
331	}
332	}
333
334	if (label->proxy) {
335	if (rcu_dereference_protected(label->proxy->label, true) == label)
336	rcu_assign_pointer(label->proxy->label, NULL);
337	aa_put_proxy(proxy: label->proxy);
338	}
339	aa_free_secid(secid: label->secid);
340
341	label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
342	}
343
344	void aa_label_free(struct aa_label *label)
345	{
346	if (!label)
347	return;
348
349	aa_label_destroy(label);
350	kfree(objp: label);
351	}
352
353	static void label_free_switch(struct aa_label *label)
354	{
355	if (label->flags & FLAG_NS_COUNT)
356	aa_free_ns(labels_ns(label));
357	else if (label_isprofile(label))
358	aa_free_profile(labels_profile(label));
359	else
360	aa_label_free(label);
361	}
362
363	static void label_free_rcu(struct rcu_head *head)
364	{
365	struct aa_label *label = container_of(head, struct aa_label, rcu);
366
367	if (label->flags & FLAG_IN_TREE)
368	(void) aa_label_remove(label);
369	label_free_switch(label);
370	}
371
372	void aa_label_kref(struct kref *kref)
373	{
374	struct aa_label *label = container_of(kref, struct aa_label, count);
375	struct aa_ns *ns = labels_ns(label);
376
377	if (!ns) {
378	/* never live, no rcu callback needed, just using the fn */
379	label_free_switch(label);
380	return;
381	}
382	/* TODO: update labels_profile macro so it works here */
383	AA_BUG(label_isprofile(label) &&
384	on_list_rcu(&label->vec[0]->base.profiles));
385	AA_BUG(label_isprofile(label) &&
386	on_list_rcu(&label->vec[0]->base.list));
387
388	/* TODO: if compound label and not stale add to reclaim cache */
389	call_rcu(head: &label->rcu, func: label_free_rcu);
390	}
391
392	static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
393	{
394	if (label != new)
395	/* need to free directly to break circular ref with proxy */
396	aa_label_free(label: new);
397	else
398	aa_put_label(l: new);
399	}
400
401	bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
402	{
403	AA_BUG(!label);
404	AA_BUG(size < 1);
405
406	if (aa_alloc_secid(label, gfp) < 0)
407	return false;
408
409	label->size = size; /* doesn't include null */
410	label->vec[size] = NULL; /* null terminate */
411	kref_init(kref: &label->count);
412	RB_CLEAR_NODE(&label->node);
413
414	return true;
415	}
416
417	/**
418	* aa_label_alloc - allocate a label with a profile vector of @size length
419	* @size: size of profile vector in the label
420	* @proxy: proxy to use OR null if to allocate a new one
421	* @gfp: memory allocation type
422	*
423	* Returns: new label
424	* else NULL if failed
425	*/
426	struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
427	{
428	struct aa_label *new;
429
430	AA_BUG(size < 1);
431
432	/* + 1 for null terminator entry on vec */
433	new = kzalloc(struct_size(new, vec, size + 1), flags: gfp);
434	AA_DEBUG("%s (%p)\n", __func__, new);
435	if (!new)
436	goto fail;
437
438	if (!aa_label_init(label: new, size, gfp))
439	goto fail;
440
441	if (!proxy) {
442	proxy = aa_alloc_proxy(label: new, gfp);
443	if (!proxy)
444	goto fail;
445	} else
446	aa_get_proxy(proxy);
447	/* just set new's proxy, don't redirect proxy here if it was passed in*/
448	new->proxy = proxy;
449
450	return new;
451
452	fail:
453	kfree(objp: new);
454
455	return NULL;
456	}
457
458
459	/**
460	* label_cmp - label comparison for set ordering
461	* @a: label to compare (NOT NULL)
462	* @b: label to compare (NOT NULL)
463	*
464	* Returns: <0 if a < b
465	* ==0 if a == b
466	* >0 if a > b
467	*/
468	static int label_cmp(struct aa_label *a, struct aa_label *b)
469	{
470	AA_BUG(!b);
471
472	if (a == b)
473	return 0;
474
475	return vec_cmp(a: a->vec, an: a->size, b: b->vec, bn: b->size);
476	}
477
478	/* helper fn for label_for_each_confined */
479	int aa_label_next_confined(struct aa_label *label, int i)
480	{
481	AA_BUG(!label);
482	AA_BUG(i < 0);
483
484	for (; i < label->size; i++) {
485	if (!profile_unconfined(label->vec[i]))
486	return i;
487	}
488
489	return i;
490	}
491
492	/**
493	* __aa_label_next_not_in_set - return the next profile of @sub not in @set
494	* @I: label iterator
495	* @set: label to test against
496	* @sub: label to if is subset of @set
497	*
498	* Returns: profile in @sub that is not in @set, with iterator set pos after
499	* else NULL if @sub is a subset of @set
500	*/
501	struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
502	struct aa_label *set,
503	struct aa_label *sub)
504	{
505	AA_BUG(!set);
506	AA_BUG(!I);
507	AA_BUG(I->i < 0);
508	AA_BUG(I->i > set->size);
509	AA_BUG(!sub);
510	AA_BUG(I->j < 0);
511	AA_BUG(I->j > sub->size);
512
513	while (I->j < sub->size && I->i < set->size) {
514	int res = profile_cmp(a: sub->vec[I->j], b: set->vec[I->i]);
515
516	if (res == 0) {
517	(I->j)++;
518	(I->i)++;
519	} else if (res > 0)
520	(I->i)++;
521	else
522	return sub->vec[(I->j)++];
523	}
524
525	if (I->j < sub->size)
526	return sub->vec[(I->j)++];
527
528	return NULL;
529	}
530
531	/**
532	* aa_label_is_subset - test if @sub is a subset of @set
533	* @set: label to test against
534	* @sub: label to test if is subset of @set
535	*
536	* Returns: true if @sub is subset of @set
537	* else false
538	*/
539	bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
540	{
541	struct label_it i = { };
542
543	AA_BUG(!set);
544	AA_BUG(!sub);
545
546	if (sub == set)
547	return true;
548
549	return __aa_label_next_not_in_set(I: &i, set, sub) == NULL;
550	}
551
552	/**
553	* aa_label_is_unconfined_subset - test if @sub is a subset of @set
554	* @set: label to test against
555	* @sub: label to test if is subset of @set
556	*
557	* This checks for subset but taking into account unconfined. IF
558	* @sub contains an unconfined profile that does not have a matching
559	* unconfined in @set then this will not cause the test to fail.
560	* Conversely we don't care about an unconfined in @set that is not in
561	* @sub
562	*
563	* Returns: true if @sub is special_subset of @set
564	* else false
565	*/
566	bool aa_label_is_unconfined_subset(struct aa_label *set, struct aa_label *sub)
567	{
568	struct label_it i = { };
569	struct aa_profile *p;
570
571	AA_BUG(!set);
572	AA_BUG(!sub);
573
574	if (sub == set)
575	return true;
576
577	do {
578	p = __aa_label_next_not_in_set(I: &i, set, sub);
579	if (p && !profile_unconfined(p))
580	break;
581	} while (p);
582
583	return p == NULL;
584	}
585
586
587	/**
588	* __label_remove - remove @label from the label set
589	* @label: label to remove
590	* @new: label to redirect to
591	*
592	* Requires: labels_set(@label)->lock write_lock
593	* Returns: true if the label was in the tree and removed
594	*/
595	static bool __label_remove(struct aa_label *label, struct aa_label *new)
596	{
597	struct aa_labelset *ls = labels_set(label);
598
599	AA_BUG(!ls);
600	AA_BUG(!label);
601	lockdep_assert_held_write(&ls->lock);
602
603	if (new)
604	__aa_proxy_redirect(orig: label, new);
605
606	if (!label_is_stale(label))
607	__label_make_stale(label);
608
609	if (label->flags & FLAG_IN_TREE) {
610	rb_erase(&label->node, &ls->root);
611	label->flags &= ~FLAG_IN_TREE;
612	return true;
613	}
614
615	return false;
616	}
617
618	/**
619	* __label_replace - replace @old with @new in label set
620	* @old: label to remove from label set
621	* @new: label to replace @old with
622	*
623	* Requires: labels_set(@old)->lock write_lock
624	* valid ref count be held on @new
625	* Returns: true if @old was in set and replaced by @new
626	*
627	* Note: current implementation requires label set be order in such a way
628	* that @new directly replaces @old position in the set (ie.
629	* using pointer comparison of the label address would not work)
630	*/
631	static bool __label_replace(struct aa_label *old, struct aa_label *new)
632	{
633	struct aa_labelset *ls = labels_set(old);
634
635	AA_BUG(!ls);
636	AA_BUG(!old);
637	AA_BUG(!new);
638	lockdep_assert_held_write(&ls->lock);
639	AA_BUG(new->flags & FLAG_IN_TREE);
640
641	if (!label_is_stale(old))
642	__label_make_stale(old);
643
644	if (old->flags & FLAG_IN_TREE) {
645	rb_replace_node(victim: &old->node, new: &new->node, root: &ls->root);
646	old->flags &= ~FLAG_IN_TREE;
647	new->flags |= FLAG_IN_TREE;
648	return true;
649	}
650
651	return false;
652	}
653
654	/**
655	* __label_insert - attempt to insert @l into a label set
656	* @ls: set of labels to insert @l into (NOT NULL)
657	* @label: new label to insert (NOT NULL)
658	* @replace: whether insertion should replace existing entry that is not stale
659	*
660	* Requires: @ls->lock
661	* caller to hold a valid ref on l
662	* if @replace is true l has a preallocated proxy associated
663	* Returns: @l if successful in inserting @l - with additional refcount
664	* else ref counted equivalent label that is already in the set,
665	* the else condition only happens if @replace is false
666	*/
667	static struct aa_label *__label_insert(struct aa_labelset *ls,
668	struct aa_label *label, bool replace)
669	{
670	struct rb_node **new, *parent = NULL;
671
672	AA_BUG(!ls);
673	AA_BUG(!label);
674	AA_BUG(labels_set(label) != ls);
675	lockdep_assert_held_write(&ls->lock);
676	AA_BUG(label->flags & FLAG_IN_TREE);
677
678	/* Figure out where to put new node */
679	new = &ls->root.rb_node;
680	while (*new) {
681	struct aa_label *this = rb_entry(*new, struct aa_label, node);
682	int result = label_cmp(a: label, b: this);
683
684	parent = *new;
685	if (result == 0) {
686	/* !__aa_get_label means queued for destruction,
687	* so replace in place, however the label has
688	* died before the replacement so do not share
689	* the proxy
690	*/
691	if (!replace && !label_is_stale(this)) {
692	if (__aa_get_label(l: this))
693	return this;
694	} else
695	__proxy_share(old: this, new: label);
696	AA_BUG(!__label_replace(this, label));
697	return aa_get_label(l: label);
698	} else if (result < 0)
699	new = &((*new)->rb_left);
700	else /* (result > 0) */
701	new = &((*new)->rb_right);
702	}
703
704	/* Add new node and rebalance tree. */
705	rb_link_node(node: &label->node, parent, rb_link: new);
706	rb_insert_color(&label->node, &ls->root);
707	label->flags |= FLAG_IN_TREE;
708
709	return aa_get_label(l: label);
710	}
711
712	/**
713	* __vec_find - find label that matches @vec in label set
714	* @vec: vec of profiles to find matching label for (NOT NULL)
715	* @n: length of @vec
716	*
717	* Requires: @vec_labelset(vec) lock held
718	* caller to hold a valid ref on l
719	*
720	* Returns: ref counted @label if matching label is in tree
721	* ref counted label that is equiv to @l in tree
722	* else NULL if @vec equiv is not in tree
723	*/
724	static struct aa_label *__vec_find(struct aa_profile **vec, int n)
725	{
726	struct rb_node *node;
727
728	AA_BUG(!vec);
729	AA_BUG(!*vec);
730	AA_BUG(n <= 0);
731
732	node = vec_labelset(vec, n)->root.rb_node;
733	while (node) {
734	struct aa_label *this = rb_entry(node, struct aa_label, node);
735	int result = vec_cmp(a: this->vec, an: this->size, b: vec, bn: n);
736
737	if (result > 0)
738	node = node->rb_left;
739	else if (result < 0)
740	node = node->rb_right;
741	else
742	return __aa_get_label(l: this);
743	}
744
745	return NULL;
746	}
747
748	/**
749	* __label_find - find label @label in label set
750	* @label: label to find (NOT NULL)
751	*
752	* Requires: labels_set(@label)->lock held
753	* caller to hold a valid ref on l
754	*
755	* Returns: ref counted @label if @label is in tree OR
756	* ref counted label that is equiv to @label in tree
757	* else NULL if @label or equiv is not in tree
758	*/
759	static struct aa_label *__label_find(struct aa_label *label)
760	{
761	AA_BUG(!label);
762
763	return __vec_find(vec: label->vec, n: label->size);
764	}
765
766
767	/**
768	* aa_label_remove - remove a label from the labelset
769	* @label: label to remove
770	*
771	* Returns: true if @label was removed from the tree
772	* else @label was not in tree so it could not be removed
773	*/
774	bool aa_label_remove(struct aa_label *label)
775	{
776	struct aa_labelset *ls = labels_set(label);
777	unsigned long flags;
778	bool res;
779
780	AA_BUG(!ls);
781
782	write_lock_irqsave(&ls->lock, flags);
783	res = __label_remove(label, ns_unconfined(labels_ns(label)));
784	write_unlock_irqrestore(&ls->lock, flags);
785
786	return res;
787	}
788
789	/**
790	* aa_label_replace - replace a label @old with a new version @new
791	* @old: label to replace
792	* @new: label replacing @old
793	*
794	* Returns: true if @old was in tree and replaced
795	* else @old was not in tree, and @new was not inserted
796	*/
797	bool aa_label_replace(struct aa_label *old, struct aa_label *new)
798	{
799	unsigned long flags;
800	bool res;
801
802	if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
803	write_lock_irqsave(&labels_set(old)->lock, flags);
804	if (old->proxy != new->proxy)
805	__proxy_share(old, new);
806	else
807	__aa_proxy_redirect(orig: old, new);
808	res = __label_replace(old, new);
809	write_unlock_irqrestore(&labels_set(old)->lock, flags);
810	} else {
811	struct aa_label *l;
812	struct aa_labelset *ls = labels_set(old);
813
814	write_lock_irqsave(&ls->lock, flags);
815	res = __label_remove(label: old, new);
816	if (labels_ns(old) != labels_ns(new)) {
817	write_unlock_irqrestore(&ls->lock, flags);
818	ls = labels_set(new);
819	write_lock_irqsave(&ls->lock, flags);
820	}
821	l = __label_insert(ls, label: new, replace: true);
822	res = (l == new);
823	write_unlock_irqrestore(&ls->lock, flags);
824	aa_put_label(l);
825	}
826
827	return res;
828	}
829
830	/**
831	* vec_find - find label @l in label set
832	* @vec: array of profiles to find equiv label for (NOT NULL)
833	* @n: length of @vec
834	*
835	* Returns: refcounted label if @vec equiv is in tree
836	* else NULL if @vec equiv is not in tree
837	*/
838	static struct aa_label *vec_find(struct aa_profile **vec, int n)
839	{
840	struct aa_labelset *ls;
841	struct aa_label *label;
842	unsigned long flags;
843
844	AA_BUG(!vec);
845	AA_BUG(!*vec);
846	AA_BUG(n <= 0);
847
848	ls = vec_labelset(vec, n);
849	read_lock_irqsave(&ls->lock, flags);
850	label = __vec_find(vec, n);
851	read_unlock_irqrestore(&ls->lock, flags);
852
853	return label;
854	}
855
856	/* requires sort and merge done first */
857	static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
858	int len, gfp_t gfp)
859	{
860	struct aa_label *label = NULL;
861	struct aa_labelset *ls;
862	unsigned long flags;
863	struct aa_label *new;
864	int i;
865
866	AA_BUG(!vec);
867
868	if (len == 1)
869	return aa_get_label(l: &vec[0]->label);
870
871	ls = labels_set(&vec[len - 1]->label);
872
873	/* TODO: enable when read side is lockless
874	* check if label exists before taking locks
875	*/
876	new = aa_label_alloc(size: len, NULL, gfp);
877	if (!new)
878	return NULL;
879
880	for (i = 0; i < len; i++)
881	new->vec[i] = aa_get_profile(p: vec[i]);
882
883	write_lock_irqsave(&ls->lock, flags);
884	label = __label_insert(ls, label: new, replace: false);
885	write_unlock_irqrestore(&ls->lock, flags);
886	label_free_or_put_new(label, new);
887
888	return label;
889	}
890
891	struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
892	gfp_t gfp)
893	{
894	struct aa_label *label = vec_find(vec, n: len);
895
896	if (label)
897	return label;
898
899	return vec_create_and_insert_label(vec, len, gfp);
900	}
901
902	/**
903	* aa_label_find - find label @label in label set
904	* @label: label to find (NOT NULL)
905	*
906	* Requires: caller to hold a valid ref on l
907	*
908	* Returns: refcounted @label if @label is in tree
909	* refcounted label that is equiv to @label in tree
910	* else NULL if @label or equiv is not in tree
911	*/
912	struct aa_label *aa_label_find(struct aa_label *label)
913	{
914	AA_BUG(!label);
915
916	return vec_find(vec: label->vec, n: label->size);
917	}
918
919
920	/**
921	* aa_label_insert - insert label @label into @ls or return existing label
922	* @ls: labelset to insert @label into
923	* @label: label to insert
924	*
925	* Requires: caller to hold a valid ref on @label
926	*
927	* Returns: ref counted @label if successful in inserting @label
928	* else ref counted equivalent label that is already in the set
929	*/
930	struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
931	{
932	struct aa_label *l;
933	unsigned long flags;
934
935	AA_BUG(!ls);
936	AA_BUG(!label);
937
938	/* check if label exists before taking lock */
939	if (!label_is_stale(label)) {
940	read_lock_irqsave(&ls->lock, flags);
941	l = __label_find(label);
942	read_unlock_irqrestore(&ls->lock, flags);
943	if (l)
944	return l;
945	}
946
947	write_lock_irqsave(&ls->lock, flags);
948	l = __label_insert(ls, label, replace: false);
949	write_unlock_irqrestore(&ls->lock, flags);
950
951	return l;
952	}
953
954
955	/**
956	* aa_label_next_in_merge - find the next profile when merging @a and @b
957	* @I: label iterator
958	* @a: label to merge
959	* @b: label to merge
960	*
961	* Returns: next profile
962	* else null if no more profiles
963	*/
964	struct aa_profile *aa_label_next_in_merge(struct label_it *I,
965	struct aa_label *a,
966	struct aa_label *b)
967	{
968	AA_BUG(!a);
969	AA_BUG(!b);
970	AA_BUG(!I);
971	AA_BUG(I->i < 0);
972	AA_BUG(I->i > a->size);
973	AA_BUG(I->j < 0);
974	AA_BUG(I->j > b->size);
975
976	if (I->i < a->size) {
977	if (I->j < b->size) {
978	int res = profile_cmp(a: a->vec[I->i], b: b->vec[I->j]);
979
980	if (res > 0)
981	return b->vec[(I->j)++];
982	if (res == 0)
983	(I->j)++;
984	}
985
986	return a->vec[(I->i)++];
987	}
988
989	if (I->j < b->size)
990	return b->vec[(I->j)++];
991
992	return NULL;
993	}
994
995	/**
996	* label_merge_cmp - cmp of @a merging with @b against @z for set ordering
997	* @a: label to merge then compare (NOT NULL)
998	* @b: label to merge then compare (NOT NULL)
999	* @z: label to compare merge against (NOT NULL)
1000	*
1001	* Assumes: using the most recent versions of @a, @b, and @z
1002	*
1003	* Returns: <0 if a < b
1004	* ==0 if a == b
1005	* >0 if a > b
1006	*/
1007	static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
1008	struct aa_label *z)
1009	{
1010	struct aa_profile *p = NULL;
1011	struct label_it i = { };
1012	int k;
1013
1014	AA_BUG(!a);
1015	AA_BUG(!b);
1016	AA_BUG(!z);
1017
1018	for (k = 0;
1019	k < z->size && (p = aa_label_next_in_merge(I: &i, a, b));
1020	k++) {
1021	int res = profile_cmp(a: p, b: z->vec[k]);
1022
1023	if (res != 0)
1024	return res;
1025	}
1026
1027	if (p)
1028	return 1;
1029	else if (k < z->size)
1030	return -1;
1031	return 0;
1032	}
1033
1034	/**
1035	* label_merge_insert - create a new label by merging @a and @b
1036	* @new: preallocated label to merge into (NOT NULL)
1037	* @a: label to merge with @b (NOT NULL)
1038	* @b: label to merge with @a (NOT NULL)
1039	*
1040	* Requires: preallocated proxy
1041	*
1042	* Returns: ref counted label either @new if merge is unique
1043	* @a if @b is a subset of @a
1044	* @b if @a is a subset of @b
1045	*
1046	* NOTE: will not use @new if the merge results in @new == @a or @b
1047	*
1048	* Must be used within labelset write lock to avoid racing with
1049	* setting labels stale.
1050	*/
1051	static struct aa_label *label_merge_insert(struct aa_label *new,
1052	struct aa_label *a,
1053	struct aa_label *b)
1054	{
1055	struct aa_label *label;
1056	struct aa_labelset *ls;
1057	struct aa_profile *next;
1058	struct label_it i;
1059	unsigned long flags;
1060	int k = 0, invcount = 0;
1061	bool stale = false;
1062
1063	AA_BUG(!a);
1064	AA_BUG(a->size < 0);
1065	AA_BUG(!b);
1066	AA_BUG(b->size < 0);
1067	AA_BUG(!new);
1068	AA_BUG(new->size < a->size + b->size);
1069
1070	label_for_each_in_merge(i, a, b, next) {
1071	AA_BUG(!next);
1072	if (profile_is_stale(next)) {
1073	new->vec[k] = aa_get_newest_profile(p: next);
1074	AA_BUG(!new->vec[k]->label.proxy);
1075	AA_BUG(!new->vec[k]->label.proxy->label);
1076	if (next->label.proxy != new->vec[k]->label.proxy)
1077	invcount++;
1078	k++;
1079	stale = true;
1080	} else
1081	new->vec[k++] = aa_get_profile(p: next);
1082	}
1083	/* set to actual size which is <= allocated len */
1084	new->size = k;
1085	new->vec[k] = NULL;
1086
1087	if (invcount) {
1088	new->size -= aa_vec_unique(vec: &new->vec[0], n: new->size,
1089	VEC_FLAG_TERMINATE);
1090	/* TODO: deal with reference labels */
1091	if (new->size == 1) {
1092	label = aa_get_label(l: &new->vec[0]->label);
1093	return label;
1094	}
1095	} else if (!stale) {
1096	/*
1097	* merge could be same as a || b, note: it is not possible
1098	* for new->size == a->size == b->size unless a == b
1099	*/
1100	if (k == a->size)
1101	return aa_get_label(l: a);
1102	else if (k == b->size)
1103	return aa_get_label(l: b);
1104	}
1105	new->flags |= accum_vec_flags(vec: new->vec, n: new->size);
1106	ls = labels_set(new);
1107	write_lock_irqsave(&ls->lock, flags);
1108	label = __label_insert(labels_set(new), label: new, replace: false);
1109	write_unlock_irqrestore(&ls->lock, flags);
1110
1111	return label;
1112	}
1113
1114	/**
1115	* labelset_of_merge - find which labelset a merged label should be inserted
1116	* @a: label to merge and insert
1117	* @b: label to merge and insert
1118	*
1119	* Returns: labelset that the merged label should be inserted into
1120	*/
1121	static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1122	struct aa_label *b)
1123	{
1124	struct aa_ns *nsa = labels_ns(a);
1125	struct aa_ns *nsb = labels_ns(b);
1126
1127	if (ns_cmp(a: nsa, b: nsb) <= 0)
1128	return &nsa->labels;
1129	return &nsb->labels;
1130	}
1131
1132	/**
1133	* __label_find_merge - find label that is equiv to merge of @a and @b
1134	* @ls: set of labels to search (NOT NULL)
1135	* @a: label to merge with @b (NOT NULL)
1136	* @b: label to merge with @a (NOT NULL)
1137	*
1138	* Requires: ls->lock read_lock held
1139	*
1140	* Returns: ref counted label that is equiv to merge of @a and @b
1141	* else NULL if merge of @a and @b is not in set
1142	*/
1143	static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1144	struct aa_label *a,
1145	struct aa_label *b)
1146	{
1147	struct rb_node *node;
1148
1149	AA_BUG(!ls);
1150	AA_BUG(!a);
1151	AA_BUG(!b);
1152
1153	if (a == b)
1154	return __label_find(label: a);
1155
1156	node = ls->root.rb_node;
1157	while (node) {
1158	struct aa_label *this = container_of(node, struct aa_label,
1159	node);
1160	int result = label_merge_cmp(a, b, z: this);
1161
1162	if (result < 0)
1163	node = node->rb_left;
1164	else if (result > 0)
1165	node = node->rb_right;
1166	else
1167	return __aa_get_label(l: this);
1168	}
1169
1170	return NULL;
1171	}
1172
1173
1174	/**
1175	* aa_label_find_merge - find label that is equiv to merge of @a and @b
1176	* @a: label to merge with @b (NOT NULL)
1177	* @b: label to merge with @a (NOT NULL)
1178	*
1179	* Requires: labels be fully constructed with a valid ns
1180	*
1181	* Returns: ref counted label that is equiv to merge of @a and @b
1182	* else NULL if merge of @a and @b is not in set
1183	*/
1184	struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1185	{
1186	struct aa_labelset *ls;
1187	struct aa_label *label, *ar = NULL, *br = NULL;
1188	unsigned long flags;
1189
1190	AA_BUG(!a);
1191	AA_BUG(!b);
1192
1193	if (label_is_stale(a))
1194	a = ar = aa_get_newest_label(l: a);
1195	if (label_is_stale(b))
1196	b = br = aa_get_newest_label(l: b);
1197	ls = labelset_of_merge(a, b);
1198	read_lock_irqsave(&ls->lock, flags);
1199	label = __label_find_merge(ls, a, b);
1200	read_unlock_irqrestore(&ls->lock, flags);
1201	aa_put_label(l: ar);
1202	aa_put_label(l: br);
1203
1204	return label;
1205	}
1206
1207	/**
1208	* aa_label_merge - attempt to insert new merged label of @a and @b
1209	* @a: label to merge with @b (NOT NULL)
1210	* @b: label to merge with @a (NOT NULL)
1211	* @gfp: memory allocation type
1212	*
1213	* Requires: caller to hold valid refs on @a and @b
1214	* labels be fully constructed with a valid ns
1215	*
1216	* Returns: ref counted new label if successful in inserting merge of a & b
1217	* else ref counted equivalent label that is already in the set.
1218	* else NULL if could not create label (-ENOMEM)
1219	*/
1220	struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1221	gfp_t gfp)
1222	{
1223	struct aa_label *label = NULL;
1224
1225	AA_BUG(!a);
1226	AA_BUG(!b);
1227
1228	if (a == b)
1229	return aa_get_newest_label(l: a);
1230
1231	/* TODO: enable when read side is lockless
1232	* check if label exists before taking locks
1233	if (!label_is_stale(a) && !label_is_stale(b))
1234	label = aa_label_find_merge(a, b);
1235	*/
1236
1237	if (!label) {
1238	struct aa_label *new;
1239
1240	a = aa_get_newest_label(l: a);
1241	b = aa_get_newest_label(l: b);
1242
1243	/* could use label_merge_len(a, b), but requires double
1244	* comparison for small savings
1245	*/
1246	new = aa_label_alloc(size: a->size + b->size, NULL, gfp);
1247	if (!new)
1248	goto out;
1249
1250	label = label_merge_insert(new, a, b);
1251	label_free_or_put_new(label, new);
1252	out:
1253	aa_put_label(l: a);
1254	aa_put_label(l: b);
1255	}
1256
1257	return label;
1258	}
1259
1260	/* match a profile and its associated ns component if needed
1261	* Assumes visibility test has already been done.
1262	* If a subns profile is not to be matched should be prescreened with
1263	* visibility test.
1264	*/
1265	static inline aa_state_t match_component(struct aa_profile *profile,
1266	struct aa_ruleset *rules,
1267	struct aa_profile *tp,
1268	aa_state_t state)
1269	{
1270	const char *ns_name;
1271
1272	if (profile->ns == tp->ns)
1273	return aa_dfa_match(dfa: rules->policy->dfa, start: state, str: tp->base.hname);
1274
1275	/* try matching with namespace name and then profile */
1276	ns_name = aa_ns_name(parent: profile->ns, child: tp->ns, subns: true);
1277	state = aa_dfa_match_len(dfa: rules->policy->dfa, start: state, str: ":", len: 1);
1278	state = aa_dfa_match(dfa: rules->policy->dfa, start: state, str: ns_name);
1279	state = aa_dfa_match_len(dfa: rules->policy->dfa, start: state, str: ":", len: 1);
1280	return aa_dfa_match(dfa: rules->policy->dfa, start: state, str: tp->base.hname);
1281	}
1282
1283	/**
1284	* label_compound_match - find perms for full compound label
1285	* @profile: profile to find perms for
1286	* @rules: ruleset to search
1287	* @label: label to check access permissions for
1288	* @state: state to start match in
1289	* @subns: whether to do permission checks on components in a subns
1290	* @request: permissions to request
1291	* @perms: perms struct to set
1292	*
1293	* Returns: 0 on success else ERROR
1294	*
1295	* For the label A//&B//&C this does the perm match for A//&B//&C
1296	* @perms should be preinitialized with allperms OR a previous permission
1297	* check to be stacked.
1298	*/
1299	static int label_compound_match(struct aa_profile *profile,
1300	struct aa_ruleset *rules,
1301	struct aa_label *label,
1302	aa_state_t state, bool subns, u32 request,
1303	struct aa_perms *perms)
1304	{
1305	struct aa_profile *tp;
1306	struct label_it i;
1307
1308	/* find first subcomponent that is visible */
1309	label_for_each(i, label, tp) {
1310	if (!aa_ns_visible(curr: profile->ns, view: tp->ns, subns))
1311	continue;
1312	state = match_component(profile, rules, tp, state);
1313	if (!state)
1314	goto fail;
1315	goto next;
1316	}
1317
1318	/* no component visible */
1319	*perms = allperms;
1320	return 0;
1321
1322	next:
1323	label_for_each_cont(i, label, tp) {
1324	if (!aa_ns_visible(curr: profile->ns, view: tp->ns, subns))
1325	continue;
1326	state = aa_dfa_match(dfa: rules->policy->dfa, start: state, str: "//&");
1327	state = match_component(profile, rules, tp, state);
1328	if (!state)
1329	goto fail;
1330	}
1331	*perms = *aa_lookup_perms(policy: rules->policy, state);
1332	aa_apply_modes_to_perms(profile, perms);
1333	if ((perms->allow & request) != request)
1334	return -EACCES;
1335
1336	return 0;
1337
1338	fail:
1339	*perms = nullperms;
1340	return state;
1341	}
1342
1343	/**
1344	* label_components_match - find perms for all subcomponents of a label
1345	* @profile: profile to find perms for
1346	* @rules: ruleset to search
1347	* @label: label to check access permissions for
1348	* @start: state to start match in
1349	* @subns: whether to do permission checks on components in a subns
1350	* @request: permissions to request
1351	* @perms: an initialized perms struct to add accumulation to
1352	*
1353	* Returns: 0 on success else ERROR
1354	*
1355	* For the label A//&B//&C this does the perm match for each of A and B and C
1356	* @perms should be preinitialized with allperms OR a previous permission
1357	* check to be stacked.
1358	*/
1359	static int label_components_match(struct aa_profile *profile,
1360	struct aa_ruleset *rules,
1361	struct aa_label *label, aa_state_t start,
1362	bool subns, u32 request,
1363	struct aa_perms *perms)
1364	{
1365	struct aa_profile *tp;
1366	struct label_it i;
1367	struct aa_perms tmp;
1368	aa_state_t state = 0;
1369
1370	/* find first subcomponent to test */
1371	label_for_each(i, label, tp) {
1372	if (!aa_ns_visible(curr: profile->ns, view: tp->ns, subns))
1373	continue;
1374	state = match_component(profile, rules, tp, state: start);
1375	if (!state)
1376	goto fail;
1377	goto next;
1378	}
1379
1380	/* no subcomponents visible - no change in perms */
1381	return 0;
1382
1383	next:
1384	tmp = *aa_lookup_perms(policy: rules->policy, state);
1385	aa_apply_modes_to_perms(profile, perms: &tmp);
1386	aa_perms_accum(accum: perms, addend: &tmp);
1387	label_for_each_cont(i, label, tp) {
1388	if (!aa_ns_visible(curr: profile->ns, view: tp->ns, subns))
1389	continue;
1390	state = match_component(profile, rules, tp, state: start);
1391	if (!state)
1392	goto fail;
1393	tmp = *aa_lookup_perms(policy: rules->policy, state);
1394	aa_apply_modes_to_perms(profile, perms: &tmp);
1395	aa_perms_accum(accum: perms, addend: &tmp);
1396	}
1397
1398	if ((perms->allow & request) != request)
1399	return -EACCES;
1400
1401	return 0;
1402
1403	fail:
1404	*perms = nullperms;
1405	return -EACCES;
1406	}
1407
1408	/**
1409	* aa_label_match - do a multi-component label match
1410	* @profile: profile to match against (NOT NULL)
1411	* @rules: ruleset to search
1412	* @label: label to match (NOT NULL)
1413	* @state: state to start in
1414	* @subns: whether to match subns components
1415	* @request: permission request
1416	* @perms: Returns computed perms (NOT NULL)
1417	*
1418	* Returns: the state the match finished in, may be the none matching state
1419	*/
1420	int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
1421	struct aa_label *label, aa_state_t state, bool subns,
1422	u32 request, struct aa_perms *perms)
1423	{
1424	int error = label_compound_match(profile, rules, label, state, subns,
1425	request, perms);
1426	if (!error)
1427	return error;
1428
1429	*perms = allperms;
1430	return label_components_match(profile, rules, label, start: state, subns,
1431	request, perms);
1432	}
1433
1434
1435	/**
1436	* aa_update_label_name - update a label to have a stored name
1437	* @ns: ns being viewed from (NOT NULL)
1438	* @label: label to update (NOT NULL)
1439	* @gfp: type of memory allocation
1440	*
1441	* Requires: labels_set(label) not locked in caller
1442	*
1443	* note: only updates the label name if it does not have a name already
1444	* and if it is in the labelset
1445	*/
1446	bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1447	{
1448	struct aa_labelset *ls;
1449	unsigned long flags;
1450	char __counted *name;
1451	bool res = false;
1452
1453	AA_BUG(!ns);
1454	AA_BUG(!label);
1455
1456	if (label->hname || labels_ns(label) != ns)
1457	return res;
1458
1459	if (aa_label_acntsxprint(strp: &name, ns, label, FLAGS_NONE, gfp) < 0)
1460	return res;
1461
1462	ls = labels_set(label);
1463	write_lock_irqsave(&ls->lock, flags);
1464	if (!label->hname && label->flags & FLAG_IN_TREE) {
1465	label->hname = name;
1466	res = true;
1467	} else
1468	aa_put_str(str: name);
1469	write_unlock_irqrestore(&ls->lock, flags);
1470
1471	return res;
1472	}
1473
1474	/*
1475	* cached label name is present and visible
1476	* @label->hname only exists if label is namespace hierachical
1477	*/
1478	static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1479	int flags)
1480	{
1481	if (label->hname && (!ns || labels_ns(label) == ns) &&
1482	!(flags & ~FLAG_SHOW_MODE))
1483	return true;
1484
1485	return false;
1486	}
1487
1488	/* helper macro for snprint routines */
1489	#define update_for_len(total, len, size, str) \
1490	do { \
1491	size_t ulen = len; \
1492	\
1493	AA_BUG(len < 0); \
1494	total += ulen; \
1495	ulen = min(ulen, size); \
1496	size -= ulen; \
1497	str += ulen; \
1498	} while (0)
1499
1500	/**
1501	* aa_profile_snxprint - print a profile name to a buffer
1502	* @str: buffer to write to. (MAY BE NULL if @size == 0)
1503	* @size: size of buffer
1504	* @view: namespace profile is being viewed from
1505	* @profile: profile to view (NOT NULL)
1506	* @flags: whether to include the mode string
1507	* @prev_ns: last ns printed when used in compound print
1508	*
1509	* Returns: size of name written or would be written if larger than
1510	* available buffer
1511	*
1512	* Note: will not print anything if the profile is not visible
1513	*/
1514	static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1515	struct aa_profile *profile, int flags,
1516	struct aa_ns **prev_ns)
1517	{
1518	const char *ns_name = NULL;
1519
1520	AA_BUG(!str && size != 0);
1521	AA_BUG(!profile);
1522
1523	if (!view)
1524	view = profiles_ns(profile);
1525
1526	if (view != profile->ns &&
1527	(!prev_ns || (*prev_ns != profile->ns))) {
1528	if (prev_ns)
1529	*prev_ns = profile->ns;
1530	ns_name = aa_ns_name(parent: view, child: profile->ns,
1531	subns: flags & FLAG_VIEW_SUBNS);
1532	if (ns_name == aa_hidden_ns_name) {
1533	if (flags & FLAG_HIDDEN_UNCONFINED)
1534	return snprintf(buf: str, size, fmt: "%s", "unconfined");
1535	return snprintf(buf: str, size, fmt: "%s", ns_name);
1536	}
1537	}
1538
1539	if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1540	const char *modestr = aa_profile_mode_names[profile->mode];
1541
1542	if (ns_name)
1543	return snprintf(buf: str, size, fmt: ":%s:%s (%s)", ns_name,
1544	profile->base.hname, modestr);
1545	return snprintf(buf: str, size, fmt: "%s (%s)", profile->base.hname,
1546	modestr);
1547	}
1548
1549	if (ns_name)
1550	return snprintf(buf: str, size, fmt: ":%s:%s", ns_name,
1551	profile->base.hname);
1552	return snprintf(buf: str, size, fmt: "%s", profile->base.hname);
1553	}
1554
1555	static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1556	int flags)
1557	{
1558	struct aa_profile *profile;
1559	struct label_it i;
1560	int mode = -1, count = 0;
1561
1562	label_for_each(i, label, profile) {
1563	if (aa_ns_visible(curr: ns, view: profile->ns, subns: flags & FLAG_VIEW_SUBNS)) {
1564	count++;
1565	if (profile == profile->ns->unconfined)
1566	/* special case unconfined so stacks with
1567	* unconfined don't report as mixed. ie.
1568	* profile_foo//&:ns1:unconfined (mixed)
1569	*/
1570	continue;
1571	if (mode == -1)
1572	mode = profile->mode;
1573	else if (mode != profile->mode)
1574	return "mixed";
1575	}
1576	}
1577
1578	if (count == 0)
1579	return "-";
1580	if (mode == -1)
1581	/* everything was unconfined */
1582	mode = APPARMOR_UNCONFINED;
1583
1584	return aa_profile_mode_names[mode];
1585	}
1586
1587	/* if any visible label is not unconfined the display_mode returns true */
1588	static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1589	int flags)
1590	{
1591	if ((flags & FLAG_SHOW_MODE)) {
1592	struct aa_profile *profile;
1593	struct label_it i;
1594
1595	label_for_each(i, label, profile) {
1596	if (aa_ns_visible(curr: ns, view: profile->ns,
1597	subns: flags & FLAG_VIEW_SUBNS) &&
1598	profile != profile->ns->unconfined)
1599	return true;
1600	}
1601	/* only ns->unconfined in set of profiles in ns */
1602	return false;
1603	}
1604
1605	return false;
1606	}
1607
1608	/**
1609	* aa_label_snxprint - print a label name to a string buffer
1610	* @str: buffer to write to. (MAY BE NULL if @size == 0)
1611	* @size: size of buffer
1612	* @ns: namespace profile is being viewed from
1613	* @label: label to view (NOT NULL)
1614	* @flags: whether to include the mode string
1615	*
1616	* Returns: size of name written or would be written if larger than
1617	* available buffer
1618	*
1619	* Note: labels do not have to be strictly hierarchical to the ns as
1620	* objects may be shared across different namespaces and thus
1621	* pickup labeling from each ns. If a particular part of the
1622	* label is not visible it will just be excluded. And if none
1623	* of the label is visible "---" will be used.
1624	*/
1625	int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1626	struct aa_label *label, int flags)
1627	{
1628	struct aa_profile *profile;
1629	struct aa_ns *prev_ns = NULL;
1630	struct label_it i;
1631	int count = 0, total = 0;
1632	ssize_t len;
1633
1634	AA_BUG(!str && size != 0);
1635	AA_BUG(!label);
1636
1637	if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) {
1638	ns = root_ns;
1639	len = snprintf(buf: str, size, fmt: "_");
1640	update_for_len(total, len, size, str);
1641	} else if (!ns) {
1642	ns = labels_ns(label);
1643	}
1644
1645	label_for_each(i, label, profile) {
1646	if (aa_ns_visible(curr: ns, view: profile->ns, subns: flags & FLAG_VIEW_SUBNS)) {
1647	if (count > 0) {
1648	len = snprintf(buf: str, size, fmt: "//&");
1649	update_for_len(total, len, size, str);
1650	}
1651	len = aa_profile_snxprint(str, size, view: ns, profile,
1652	flags: flags & FLAG_VIEW_SUBNS,
1653	prev_ns: &prev_ns);
1654	update_for_len(total, len, size, str);
1655	count++;
1656	}
1657	}
1658
1659	if (count == 0) {
1660	if (flags & FLAG_HIDDEN_UNCONFINED)
1661	return snprintf(buf: str, size, fmt: "%s", "unconfined");
1662	return snprintf(buf: str, size, fmt: "%s", aa_hidden_ns_name);
1663	}
1664
1665	/* count == 1 && ... is for backwards compat where the mode
1666	* is not displayed for 'unconfined' in the current ns
1667	*/
1668	if (display_mode(ns, label, flags)) {
1669	len = snprintf(buf: str, size, fmt: " (%s)",
1670	label_modename(ns, label, flags));
1671	update_for_len(total, len, size, str);
1672	}
1673
1674	return total;
1675	}
1676	#undef update_for_len
1677
1678	/**
1679	* aa_label_asxprint - allocate a string buffer and print label into it
1680	* @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1681	* @ns: namespace profile is being viewed from
1682	* @label: label to view (NOT NULL)
1683	* @flags: flags controlling what label info is printed
1684	* @gfp: kernel memory allocation type
1685	*
1686	* Returns: size of name written or would be written if larger than
1687	* available buffer
1688	*/
1689	int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1690	int flags, gfp_t gfp)
1691	{
1692	int size;
1693
1694	AA_BUG(!strp);
1695	AA_BUG(!label);
1696
1697	size = aa_label_snxprint(NULL, size: 0, ns, label, flags);
1698	if (size < 0)
1699	return size;
1700
1701	*strp = kmalloc(size: size + 1, flags: gfp);
1702	if (!*strp)
1703	return -ENOMEM;
1704	return aa_label_snxprint(str: *strp, size: size + 1, ns, label, flags);
1705	}
1706
1707	/**
1708	* aa_label_acntsxprint - allocate a __counted string buffer and print label
1709	* @strp: buffer to write to.
1710	* @ns: namespace profile is being viewed from
1711	* @label: label to view (NOT NULL)
1712	* @flags: flags controlling what label info is printed
1713	* @gfp: kernel memory allocation type
1714	*
1715	* Returns: size of name written or would be written if larger than
1716	* available buffer
1717	*/
1718	int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1719	struct aa_label *label, int flags, gfp_t gfp)
1720	{
1721	int size;
1722
1723	AA_BUG(!strp);
1724	AA_BUG(!label);
1725
1726	size = aa_label_snxprint(NULL, size: 0, ns, label, flags);
1727	if (size < 0)
1728	return size;
1729
1730	*strp = aa_str_alloc(size: size + 1, gfp);
1731	if (!*strp)
1732	return -ENOMEM;
1733	return aa_label_snxprint(str: *strp, size: size + 1, ns, label, flags);
1734	}
1735
1736
1737	void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1738	struct aa_label *label, int flags, gfp_t gfp)
1739	{
1740	const char *str;
1741	char *name = NULL;
1742	int len;
1743
1744	AA_BUG(!ab);
1745	AA_BUG(!label);
1746
1747	if (!use_label_hname(ns, label, flags) ||
1748	display_mode(ns, label, flags)) {
1749	len = aa_label_asxprint(strp: &name, ns, label, flags, gfp);
1750	if (len < 0) {
1751	AA_DEBUG("label print error");
1752	return;
1753	}
1754	str = name;
1755	} else {
1756	str = (char *) label->hname;
1757	len = strlen(str);
1758	}
1759	if (audit_string_contains_control(string: str, len))
1760	audit_log_n_hex(ab, buf: str, len);
1761	else
1762	audit_log_n_string(ab, buf: str, n: len);
1763
1764	kfree(objp: name);
1765	}
1766
1767	void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1768	struct aa_label *label, int flags, gfp_t gfp)
1769	{
1770	AA_BUG(!f);
1771	AA_BUG(!label);
1772
1773	if (!use_label_hname(ns, label, flags)) {
1774	char *str;
1775	int len;
1776
1777	len = aa_label_asxprint(strp: &str, ns, label, flags, gfp);
1778	if (len < 0) {
1779	AA_DEBUG("label print error");
1780	return;
1781	}
1782	seq_puts(m: f, s: str);
1783	kfree(objp: str);
1784	} else if (display_mode(ns, label, flags))
1785	seq_printf(m: f, fmt: "%s (%s)", label->hname,
1786	label_modename(ns, label, flags));
1787	else
1788	seq_puts(m: f, s: label->hname);
1789	}
1790
1791	void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1792	gfp_t gfp)
1793	{
1794	AA_BUG(!label);
1795
1796	if (!use_label_hname(ns, label, flags)) {
1797	char *str;
1798	int len;
1799
1800	len = aa_label_asxprint(strp: &str, ns, label, flags, gfp);
1801	if (len < 0) {
1802	AA_DEBUG("label print error");
1803	return;
1804	}
1805	pr_info("%s", str);
1806	kfree(objp: str);
1807	} else if (display_mode(ns, label, flags))
1808	pr_info("%s (%s)", label->hname,
1809	label_modename(ns, label, flags));
1810	else
1811	pr_info("%s", label->hname);
1812	}
1813
1814	void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1815	{
1816	struct aa_ns *ns = aa_get_current_ns();
1817
1818	aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1819	aa_put_ns(ns);
1820	}
1821
1822	void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1823	{
1824	struct aa_ns *ns = aa_get_current_ns();
1825
1826	aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1827	aa_put_ns(ns);
1828	}
1829
1830	void aa_label_printk(struct aa_label *label, gfp_t gfp)
1831	{
1832	struct aa_ns *ns = aa_get_current_ns();
1833
1834	aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1835	aa_put_ns(ns);
1836	}
1837
1838	static int label_count_strn_entries(const char *str, size_t n)
1839	{
1840	const char *end = str + n;
1841	const char *split;
1842	int count = 1;
1843
1844	AA_BUG(!str);
1845
1846	for (split = aa_label_strn_split(str, n: end - str);
1847	split;
1848	split = aa_label_strn_split(str, n: end - str)) {
1849	count++;
1850	str = split + 3;
1851	}
1852
1853	return count;
1854	}
1855
1856	/*
1857	* ensure stacks with components like
1858	* :ns:A//&B
1859	* have :ns: applied to both 'A' and 'B' by making the lookup relative
1860	* to the base if the lookup specifies an ns, else making the stacked lookup
1861	* relative to the last embedded ns in the string.
1862	*/
1863	static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1864	struct aa_label *currentbase,
1865	const char *str, size_t n)
1866	{
1867	const char *first = skipn_spaces(str, n);
1868
1869	if (first && *first == ':')
1870	return aa_fqlookupn_profile(base, fqname: str, n);
1871
1872	return aa_fqlookupn_profile(base: currentbase, fqname: str, n);
1873	}
1874
1875	/**
1876	* aa_label_strn_parse - parse, validate and convert a text string to a label
1877	* @base: base label to use for lookups (NOT NULL)
1878	* @str: null terminated text string (NOT NULL)
1879	* @n: length of str to parse, will stop at \0 if encountered before n
1880	* @gfp: allocation type
1881	* @create: true if should create compound labels if they don't exist
1882	* @force_stack: true if should stack even if no leading &
1883	*
1884	* Returns: the matching refcounted label if present
1885	* else ERRPTR
1886	*/
1887	struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1888	size_t n, gfp_t gfp, bool create,
1889	bool force_stack)
1890	{
1891	DEFINE_VEC(profile, vec);
1892	struct aa_label *label, *currbase = base;
1893	int i, len, stack = 0, error;
1894	const char *end = str + n;
1895	const char *split;
1896
1897	AA_BUG(!base);
1898	AA_BUG(!str);
1899
1900	str = skipn_spaces(str, n);
1901	if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
1902	base != &root_ns->unconfined->label))
1903	return ERR_PTR(error: -EINVAL);
1904
1905	len = label_count_strn_entries(str, n: end - str);
1906	if (*str == '&' || force_stack) {
1907	/* stack on top of base */
1908	stack = base->size;
1909	len += stack;
1910	if (*str == '&')
1911	str++;
1912	}
1913
1914	error = vec_setup(profile, vec, len, gfp);
1915	if (error)
1916	return ERR_PTR(error);
1917
1918	for (i = 0; i < stack; i++)
1919	vec[i] = aa_get_profile(p: base->vec[i]);
1920
1921	for (split = aa_label_strn_split(str, n: end - str), i = stack;
1922	split && i < len; i++) {
1923	vec[i] = fqlookupn_profile(base, currentbase: currbase, str, n: split - str);
1924	if (!vec[i])
1925	goto fail;
1926	/*
1927	* if component specified a new ns it becomes the new base
1928	* so that subsequent lookups are relative to it
1929	*/
1930	if (vec[i]->ns != labels_ns(currbase))
1931	currbase = &vec[i]->label;
1932	str = split + 3;
1933	split = aa_label_strn_split(str, n: end - str);
1934	}
1935	/* last element doesn't have a split */
1936	if (i < len) {
1937	vec[i] = fqlookupn_profile(base, currentbase: currbase, str, n: end - str);
1938	if (!vec[i])
1939	goto fail;
1940	}
1941	if (len == 1)
1942	/* no need to free vec as len < LOCAL_VEC_ENTRIES */
1943	return &vec[0]->label;
1944
1945	len -= aa_vec_unique(vec, n: len, VEC_FLAG_TERMINATE);
1946	/* TODO: deal with reference labels */
1947	if (len == 1) {
1948	label = aa_get_label(l: &vec[0]->label);
1949	goto out;
1950	}
1951
1952	if (create)
1953	label = aa_vec_find_or_create_label(vec, len, gfp);
1954	else
1955	label = vec_find(vec, n: len);
1956	if (!label)
1957	goto fail;
1958
1959	out:
1960	/* use adjusted len from after vec_unique, not original */
1961	vec_cleanup(profile, vec, len);
1962	return label;
1963
1964	fail:
1965	label = ERR_PTR(error: -ENOENT);
1966	goto out;
1967	}
1968
1969	struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1970	gfp_t gfp, bool create, bool force_stack)
1971	{
1972	return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1973	force_stack);
1974	}
1975
1976	/**
1977	* aa_labelset_destroy - remove all labels from the label set
1978	* @ls: label set to cleanup (NOT NULL)
1979	*
1980	* Labels that are removed from the set may still exist beyond the set
1981	* being destroyed depending on their reference counting
1982	*/
1983	void aa_labelset_destroy(struct aa_labelset *ls)
1984	{
1985	struct rb_node *node;
1986	unsigned long flags;
1987
1988	AA_BUG(!ls);
1989
1990	write_lock_irqsave(&ls->lock, flags);
1991	for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1992	struct aa_label *this = rb_entry(node, struct aa_label, node);
1993
1994	if (labels_ns(this) != root_ns)
1995	__label_remove(label: this,
1996	ns_unconfined(labels_ns(this)->parent));
1997	else
1998	__label_remove(label: this, NULL);
1999	}
2000	write_unlock_irqrestore(&ls->lock, flags);
2001	}
2002
2003	/*
2004	* @ls: labelset to init (NOT NULL)
2005	*/
2006	void aa_labelset_init(struct aa_labelset *ls)
2007	{
2008	AA_BUG(!ls);
2009
2010	rwlock_init(&ls->lock);
2011	ls->root = RB_ROOT;
2012	}
2013
2014	static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
2015	{
2016	struct aa_label *label;
2017	struct rb_node *node;
2018	unsigned long flags;
2019
2020	AA_BUG(!ls);
2021
2022	read_lock_irqsave(&ls->lock, flags);
2023
2024	__labelset_for_each(ls, node) {
2025	label = rb_entry(node, struct aa_label, node);
2026	if ((label_is_stale(label) ||
2027	vec_is_stale(vec: label->vec, n: label->size)) &&
2028	__aa_get_label(l: label))
2029	goto out;
2030
2031	}
2032	label = NULL;
2033
2034	out:
2035	read_unlock_irqrestore(&ls->lock, flags);
2036
2037	return label;
2038	}
2039
2040	/**
2041	* __label_update - insert updated version of @label into labelset
2042	* @label: the label to update/replace
2043	*
2044	* Returns: new label that is up to date
2045	* else NULL on failure
2046	*
2047	* Requires: @ns lock be held
2048	*
2049	* Note: worst case is the stale @label does not get updated and has
2050	* to be updated at a later time.
2051	*/
2052	static struct aa_label *__label_update(struct aa_label *label)
2053	{
2054	struct aa_label *new, *tmp;
2055	struct aa_labelset *ls;
2056	unsigned long flags;
2057	int i, invcount = 0;
2058
2059	AA_BUG(!label);
2060	AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2061
2062	new = aa_label_alloc(size: label->size, proxy: label->proxy, GFP_KERNEL);
2063	if (!new)
2064	return NULL;
2065
2066	/*
2067	* while holding the ns_lock will stop profile replacement, removal,
2068	* and label updates, label merging and removal can be occurring
2069	*/
2070	ls = labels_set(label);
2071	write_lock_irqsave(&ls->lock, flags);
2072	for (i = 0; i < label->size; i++) {
2073	AA_BUG(!label->vec[i]);
2074	new->vec[i] = aa_get_newest_profile(p: label->vec[i]);
2075	AA_BUG(!new->vec[i]);
2076	AA_BUG(!new->vec[i]->label.proxy);
2077	AA_BUG(!new->vec[i]->label.proxy->label);
2078	if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2079	invcount++;
2080	}
2081
2082	/* updated stale label by being removed/renamed from labelset */
2083	if (invcount) {
2084	new->size -= aa_vec_unique(vec: &new->vec[0], n: new->size,
2085	VEC_FLAG_TERMINATE);
2086	/* TODO: deal with reference labels */
2087	if (new->size == 1) {
2088	tmp = aa_get_label(l: &new->vec[0]->label);
2089	AA_BUG(tmp == label);
2090	goto remove;
2091	}
2092	if (labels_set(label) != labels_set(new)) {
2093	write_unlock_irqrestore(&ls->lock, flags);
2094	tmp = aa_label_insert(labels_set(new), label: new);
2095	write_lock_irqsave(&ls->lock, flags);
2096	goto remove;
2097	}
2098	} else
2099	AA_BUG(labels_ns(label) != labels_ns(new));
2100
2101	tmp = __label_insert(labels_set(label), label: new, replace: true);
2102	remove:
2103	/* ensure label is removed, and redirected correctly */
2104	__label_remove(label, new: tmp);
2105	write_unlock_irqrestore(&ls->lock, flags);
2106	label_free_or_put_new(label: tmp, new);
2107
2108	return tmp;
2109	}
2110
2111	/**
2112	* __labelset_update - update labels in @ns
2113	* @ns: namespace to update labels in (NOT NULL)
2114	*
2115	* Requires: @ns lock be held
2116	*
2117	* Walk the labelset ensuring that all labels are up to date and valid
2118	* Any label that has a stale component is marked stale and replaced and
2119	* by an updated version.
2120	*
2121	* If failures happen due to memory pressures then stale labels will
2122	* be left in place until the next pass.
2123	*/
2124	static void __labelset_update(struct aa_ns *ns)
2125	{
2126	struct aa_label *label;
2127
2128	AA_BUG(!ns);
2129	AA_BUG(!mutex_is_locked(&ns->lock));
2130
2131	do {
2132	label = labelset_next_stale(ls: &ns->labels);
2133	if (label) {
2134	struct aa_label *l = __label_update(label);
2135
2136	aa_put_label(l);
2137	aa_put_label(l: label);
2138	}
2139	} while (label);
2140	}
2141
2142	/**
2143	* __aa_labelset_update_subtree - update all labels with a stale component
2144	* @ns: ns to start update at (NOT NULL)
2145	*
2146	* Requires: @ns lock be held
2147	*
2148	* Invalidates labels based on @p in @ns and any children namespaces.
2149	*/
2150	void __aa_labelset_update_subtree(struct aa_ns *ns)
2151	{
2152	struct aa_ns *child;
2153
2154	AA_BUG(!ns);
2155	AA_BUG(!mutex_is_locked(&ns->lock));
2156
2157	__labelset_update(ns);
2158
2159	list_for_each_entry(child, &ns->sub_ns, base.list) {
2160	mutex_lock_nested(lock: &child->lock, subclass: child->level);
2161	__aa_labelset_update_subtree(ns: child);
2162	mutex_unlock(lock: &child->lock);
2163	}
2164	}
2165