// SPDX-License-Identifier: GPL-2.0-only/* * AppArmor security module * * This file contains AppArmor label definitions * * Copyright 2017 Canonical Ltd. */ #include <linux/audit.h>#include <linux/seq_file.h>#include <linux/sort.h> #include "include/apparmor.h"#include "include/cred.h"#include "include/label.h"#include "include/policy.h"#include "include/secid.h"  /* * the aa_label represents the set of profiles confining an object * * Labels maintain a reference count to the set of pointers they reference * Labels are ref counted by *   tasks and object via the security field/security context off the field *   code - will take a ref count on a label if it needs the label *          beyond what is possible with an rcu_read_lock. *   profiles - each profile is a label *   secids - a pinned secid will keep a refcount of the label it is *          referencing *   objects - inode, files, sockets, ... * * Labels are not ref counted by the label set, so they maybe removed and * freed when no longer in use. * */ #define PROXY_POISON 97#define LABEL_POISON 100 static void free_proxy(struct aa_proxy *proxy){	if (proxy) {		/* p->label will not updated any more as p is dead */		aa_put_label(rcu_dereference_protected(proxy->label, true));		memset(proxy, 0, sizeof(*proxy));		RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);		kfree(proxy);	}} void aa_proxy_kref(struct kref *kref){	struct aa_proxy *proxy = container_of(kref, struct aa_proxy,					      count.count); 	free_proxy(proxy);} struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp){	struct aa_proxy *new; 	new = kzalloc_obj(struct aa_proxy, gfp);	if (new) {		kref_init(&new->count.count);		new->count.reftype = REF_PROXY;		rcu_assign_pointer(new->label, aa_get_label(label));	}	return new;} /* requires profile list write lock held */void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new){	struct aa_label *tmp; 	AA_BUG(!orig);	AA_BUG(!new);	lockdep_assert_held_write(&labels_set(orig)->lock); 	tmp = rcu_dereference_protected(orig->proxy->label,					&labels_ns(orig)->lock);	rcu_assign_pointer(orig->proxy->label, aa_get_label(new));	__label_make_stale(orig);	aa_put_label(tmp);} static void __proxy_share(struct aa_label *old, struct aa_label *new){	struct aa_proxy *proxy = new->proxy; 	new->proxy = aa_get_proxy(old->proxy);	__aa_proxy_redirect(old, new);	aa_put_proxy(proxy);}  /** * ns_cmp - compare ns for label set ordering * @a: ns to compare (NOT NULL) * @b: ns to compare (NOT NULL) * * Returns: <0 if a < b *          ==0 if a == b *          >0  if a > b */static int ns_cmp(struct aa_ns *a, struct aa_ns *b){	int res; 	AA_BUG(!a);	AA_BUG(!b);	AA_BUG(!a->base.hname);	AA_BUG(!b->base.hname); 	if (a == b)		return 0; 	res = a->level - b->level;	if (res)		return res; 	return strcmp(a->base.hname, b->base.hname);} /** * profile_cmp - profile comparison for set ordering * @a: profile to compare (NOT NULL) * @b: profile to compare (NOT NULL) * * Returns: <0  if a < b *          ==0 if a == b *          >0  if a > b */static int profile_cmp(struct aa_profile *a, struct aa_profile *b){	int res; 	AA_BUG(!a);	AA_BUG(!b);	AA_BUG(!a->ns);	AA_BUG(!b->ns);	AA_BUG(!a->base.hname);	AA_BUG(!b->base.hname); 	if (a == b || a->base.hname == b->base.hname)		return 0;	res = ns_cmp(a->ns, b->ns);	if (res)		return res; 	return strcmp(a->base.hname, b->base.hname);} /** * vec_cmp - label comparison for set ordering * @a: aa_profile to compare (NOT NULL) * @an: length of @a * @b: aa_profile to compare (NOT NULL) * @bn: length of @b * * Returns: <0  if @a < @b *          ==0 if @a == @b *          >0  if @a > @b */static int vec_cmp(struct aa_profile * const *a, int an,		   struct aa_profile * const *b, int bn){	int i; 	AA_BUG(!a);	AA_BUG(!*a);	AA_BUG(!b);	AA_BUG(!*b);	AA_BUG(an <= 0);	AA_BUG(bn <= 0); 	for (i = 0; i < an && i < bn; i++) {		int res = profile_cmp(a[i], b[i]); 		if (res != 0)			return res;	} 	return an - bn;} static bool vec_is_stale(struct aa_profile **vec, int n){	int i; 	AA_BUG(!vec); 	for (i = 0; i < n; i++) {		if (profile_is_stale(vec[i]))			return true;	} 	return false;} static void accum_label_info(struct aa_label *new){	long u = FLAG_UNCONFINED;	int i; 	AA_BUG(!new); 	/* size == 1 is a profile and flags must be set as part of creation */	if (new->size == 1)		return; 	for (i = 0; i < new->size; i++) {		u |= new->vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |						 FLAG_STALE);		if (!(u & new->vec[i]->label.flags & FLAG_UNCONFINED))			u &= ~FLAG_UNCONFINED;		new->mediates |= new->vec[i]->label.mediates;	}	new->flags |= u;} static int sort_cmp(const void *a, const void *b){	return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);} /* * assumes vec is sorted * Assumes @vec has null terminator at vec[n], and will null terminate * vec[n - dups] */static inline int unique(struct aa_profile **vec, int n){	int i, pos, dups = 0; 	AA_BUG(n < 1);	AA_BUG(!vec); 	pos = 0;	for (i = 1; i < n; i++) {		int res = profile_cmp(vec[pos], vec[i]); 		AA_BUG(res > 0, "vec not sorted");		if (res == 0) {			/* drop duplicate */			aa_put_profile(vec[i]);			dups++;			continue;		}		pos++;		if (dups)			vec[pos] = vec[i];	} 	AA_BUG(dups < 0); 	return dups;} /** * aa_vec_unique - canonical sort and unique a list of profiles * @n: number of refcounted profiles in the list (@n > 0) * @vec: list of profiles to sort and merge * @flags: null terminator flags of @vec * * Returns: the number of duplicates eliminated == references put * * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will * null terminate vec[n - dups] */int aa_vec_unique(struct aa_profile **vec, int n, int flags){	int i, dups = 0; 	AA_BUG(n < 1);	AA_BUG(!vec); 	/* vecs are usually small and inorder, have a fallback for larger */	if (n > 8) {		sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);		dups = unique(vec, n);		goto out;	} 	/* insertion sort + unique in one */	for (i = 1; i < n; i++) {		struct aa_profile *tmp = vec[i];		int pos, j; 		for (pos = i - 1 - dups; pos >= 0; pos--) {			int res = profile_cmp(vec[pos], tmp); 			if (res == 0) {				/* drop duplicate entry */				aa_put_profile(tmp);				dups++;				goto continue_outer;			} else if (res < 0)				break;		}		/* pos is at entry < tmp, or index -1. Set to insert pos */		pos++; 		for (j = i - dups; j > pos; j--)			vec[j] = vec[j - 1];		vec[pos] = tmp;continue_outer:		;	} 	AA_BUG(dups < 0); out:	if (flags & VEC_FLAG_TERMINATE)		vec[n - dups] = NULL; 	return dups;}  void aa_label_destroy(struct aa_label *label){	AA_BUG(!label); 	if (!label_isprofile(label)) {		struct aa_profile *profile;		struct label_it i; 		aa_put_str(label->hname); 		label_for_each(i, label, profile) {			aa_put_profile(profile);			label->vec[i.i] = (struct aa_profile *)					   (LABEL_POISON + (long) i.i);		}	} 	if (label->proxy) {		if (rcu_dereference_protected(label->proxy->label, true) == label)			rcu_assign_pointer(label->proxy->label, NULL);		aa_put_proxy(label->proxy);	}	aa_free_secid(label->secid); 	label->proxy = (struct aa_proxy *) PROXY_POISON + 1;} void aa_label_free(struct aa_label *label){	if (!label)		return; 	aa_label_destroy(label);	kfree(label);} static void label_free_switch(struct aa_label *label){	if (label->flags & FLAG_NS_COUNT)		aa_free_ns(labels_ns(label));	else if (label_isprofile(label))		aa_free_profile(labels_profile(label));	else		aa_label_free(label);} static void label_free_rcu(struct rcu_head *head){	struct aa_label *label = container_of(head, struct aa_label, rcu); 	if (label->flags & FLAG_IN_TREE)		(void) aa_label_remove(label);	label_free_switch(label);} void aa_label_kref(struct kref *kref){	struct aa_label *label = container_of(kref, struct aa_label,					      count.count);	struct aa_ns *ns = labels_ns(label); 	if (!ns) {		/* never live, no rcu callback needed, just using the fn */		label_free_switch(label);		return;	}	/* TODO: update labels_profile macro so it works here */	AA_BUG(label_isprofile(label) &&	       on_list_rcu(&label->vec[0]->base.profiles));	AA_BUG(label_isprofile(label) &&	       on_list_rcu(&label->vec[0]->base.list)); 	/* TODO: if compound label and not stale add to reclaim cache */	call_rcu(&label->rcu, label_free_rcu);} static void label_free_or_put_new(struct aa_label *label, struct aa_label *new){	if (label != new)		/* need to free directly to break circular ref with proxy */		aa_label_free(new);	else		aa_put_label(new);} bool aa_label_init(struct aa_label *label, int size, gfp_t gfp){	AA_BUG(!label);	AA_BUG(size < 1); 	if (aa_alloc_secid(label, gfp) < 0)		return false; 	label->size = size;			/* doesn't include null */	label->vec[size] = NULL;		/* null terminate */	kref_init(&label->count.count);	label->count.reftype = REF_NS;		/* for aafs purposes */	RB_CLEAR_NODE(&label->node); 	return true;} /** * aa_label_alloc - allocate a label with a profile vector of @size length * @size: size of profile vector in the label * @proxy: proxy to use OR null if to allocate a new one * @gfp: memory allocation type * * Returns: new label *     else NULL if failed */struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp){	struct aa_label *new; 	AA_BUG(size < 1); 	/*  + 1 for null terminator entry on vec */	new = kzalloc_flex(*new, vec, size + 1, gfp);	AA_DEBUG(DEBUG_LABEL, "%s (%p)\n", __func__, new);	if (!new)		goto fail; 	if (!aa_label_init(new, size, gfp))		goto fail; 	if (!proxy) {		proxy = aa_alloc_proxy(new, gfp);		if (!proxy)			goto fail;	} else		aa_get_proxy(proxy);	/* just set new's proxy, don't redirect proxy here if it was passed in*/	new->proxy = proxy; 	return new; fail:	aa_label_free(new); 	return NULL;}  /** * label_cmp - label comparison for set ordering * @a: label to compare (NOT NULL) * @b: label to compare (NOT NULL) * * Returns: <0  if a < b *          ==0 if a == b *          >0  if a > b */static int label_cmp(const struct aa_label *a, const struct aa_label *b){	AA_BUG(!b); 	if (a == b)		return 0; 	return vec_cmp(a->vec, a->size, b->vec, b->size);} /* helper fn for label_for_each_confined */int aa_label_next_confined(const struct aa_label *label, int i){	AA_BUG(!label);	AA_BUG(i < 0); 	for (; i < label->size; i++) {		if (!profile_unconfined(label->vec[i]))			return i;	} 	return i;} 

Lines 1–500 of 2170. Load more