1 // SPDX-License-Identifier: GPL-2.0-only
27  *   code - will take a ref count on a label if it needs the label
29  *   profiles - each profile is a label
30  *   secids - a pinned secid will keep a refcount of the label it is
32  *   objects - inode, files, sockets, ...
45 		/* p->label will not updated any more as p is dead */  in free_proxy()
46 		aa_put_label(rcu_dereference_protected(proxy->label, true));  in free_proxy()
48 		RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);  in free_proxy()
66 		kref_init(&new->count);  in aa_alloc_proxy()
67 		rcu_assign_pointer(new->label, aa_get_label(label));  in aa_alloc_proxy()
79 	lockdep_assert_held_write(&labels_set(orig)->lock);  in __aa_proxy_redirect()
81 	tmp = rcu_dereference_protected(orig->proxy->label,  in __aa_proxy_redirect()
82 					&labels_ns(orig)->lock);  in __aa_proxy_redirect()
83 	rcu_assign_pointer(orig->proxy->label, aa_get_label(new));  in __aa_proxy_redirect()
84 	orig->flags |= FLAG_STALE;  in __aa_proxy_redirect()
90 	struct aa_proxy *proxy = new->proxy;  in __proxy_share()
92 	new->proxy = aa_get_proxy(old->proxy);  in __proxy_share()
99  * ns_cmp - compare ns for label set ordering
113 	AA_BUG(!a->base.hname);  in ns_cmp()
114 	AA_BUG(!b->base.hname);  in ns_cmp()
119 	res = a->level - b->level;  in ns_cmp()
123 	return strcmp(a->base.hname, b->base.hname);  in ns_cmp()
127  * profile_cmp - profile comparison for set ordering
141 	AA_BUG(!a->ns);  in profile_cmp()
142 	AA_BUG(!b->ns);  in profile_cmp()
143 	AA_BUG(!a->base.hname);  in profile_cmp()
144 	AA_BUG(!b->base.hname);  in profile_cmp()
146 	if (a == b || a->base.hname == b->base.hname)  in profile_cmp()
148 	res = ns_cmp(a->ns, b->ns);  in profile_cmp()
152 	return strcmp(a->base.hname, b->base.hname);  in profile_cmp()
156  * vec_cmp - label comparison for set ordering
184 	return an - bn;  in vec_cmp()
209 		u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |  in accum_vec_flags()
211 		if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))  in accum_vec_flags()
226  * vec[n - dups]
257  * aa_vec_unique - canonical sort and unique a list of profiles
265  * null terminate vec[n - dups]
286 		for (pos = i - 1 - dups; pos >= 0; pos--) {  in aa_vec_unique()
297 		/* pos is at entry < tmp, or index -1. Set to insert pos */  in aa_vec_unique()
300 		for (j = i - dups; j > pos; j--)  in aa_vec_unique()
301 			vec[j] = vec[j - 1];  in aa_vec_unique()
311 		vec[n - dups] = NULL;  in aa_vec_unique()
325 		aa_put_str(label->hname);  in aa_label_destroy()
329 			label->vec[i.i] = (struct aa_profile *)  in aa_label_destroy()
334 	if (label->proxy) {  in aa_label_destroy()
335 		if (rcu_dereference_protected(label->proxy->label, true) == label)  in aa_label_destroy()
336 			rcu_assign_pointer(label->proxy->label, NULL);  in aa_label_destroy()
337 		aa_put_proxy(label->proxy);  in aa_label_destroy()
339 	aa_free_secid(label->secid);  in aa_label_destroy()
341 	label->proxy = (struct aa_proxy *) PROXY_POISON + 1;  in aa_label_destroy()
355 	if (label->flags & FLAG_NS_COUNT)  in label_free_switch()
367 	if (label->flags & FLAG_IN_TREE)  in label_free_rcu()
384 	       on_list_rcu(&label->vec[0]->base.profiles));  in aa_label_kref()
386 	       on_list_rcu(&label->vec[0]->base.list));  in aa_label_kref()
389 	call_rcu(&label->rcu, label_free_rcu);  in aa_label_kref()
409 	label->size = size;			/* doesn't include null */  in aa_label_init()
410 	label->vec[size] = NULL;		/* null terminate */  in aa_label_init()
411 	kref_init(&label->count);  in aa_label_init()
412 	RB_CLEAR_NODE(&label->node);  in aa_label_init()
418  * aa_label_alloc - allocate a label with a profile vector of @size length
448 	new->proxy = proxy;  in aa_label_alloc()
460  * label_cmp - label comparison for set ordering
475 	return vec_cmp(a->vec, a->size, b->vec, b->size);  in label_cmp()
484 	for (; i < label->size; i++) {  in aa_label_next_confined()
485 		if (!profile_unconfined(label->vec[i]))  in aa_label_next_confined()
493  * __aa_label_next_not_in_set - return the next profile of @sub not in @set
495  * @set: label to test against
507 	AA_BUG(I->i < 0);  in __aa_label_next_not_in_set()
508 	AA_BUG(I->i > set->size);  in __aa_label_next_not_in_set()
510 	AA_BUG(I->j < 0);  in __aa_label_next_not_in_set()
511 	AA_BUG(I->j > sub->size);  in __aa_label_next_not_in_set()
513 	while (I->j < sub->size && I->i < set->size) {  in __aa_label_next_not_in_set()
514 		int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);  in __aa_label_next_not_in_set()
517 			(I->j)++;  in __aa_label_next_not_in_set()
518 			(I->i)++;  in __aa_label_next_not_in_set()
520 			(I->i)++;  in __aa_label_next_not_in_set()
522 			return sub->vec[(I->j)++];  in __aa_label_next_not_in_set()
525 	if (I->j < sub->size)  in __aa_label_next_not_in_set()
526 		return sub->vec[(I->j)++];  in __aa_label_next_not_in_set()
532  * aa_label_is_subset - test if @sub is a subset of @set
533  * @set: label to test against
534  * @sub: label to test if is subset of @set
553  * aa_label_is_unconfined_subset - test if @sub is a subset of @set
554  * @set: label to test against
555  * @sub: label to test if is subset of @set
559  * unconfined in @set then this will not cause the test to fail.
588  * __label_remove - remove @label from the label set
592  * Requires: labels_set(@label)->lock write_lock
601 	lockdep_assert_held_write(&ls->lock);  in __label_remove()
609 	if (label->flags & FLAG_IN_TREE) {  in __label_remove()
610 		rb_erase(&label->node, &ls->root);  in __label_remove()
611 		label->flags &= ~FLAG_IN_TREE;  in __label_remove()
619  * __label_replace - replace @old with @new in label set
623  * Requires: labels_set(@old)->lock write_lock
638 	lockdep_assert_held_write(&ls->lock);  in __label_replace()
639 	AA_BUG(new->flags & FLAG_IN_TREE);  in __label_replace()
644 	if (old->flags & FLAG_IN_TREE) {  in __label_replace()
645 		rb_replace_node(&old->node, &new->node, &ls->root);  in __label_replace()
646 		old->flags &= ~FLAG_IN_TREE;  in __label_replace()
647 		new->flags |= FLAG_IN_TREE;  in __label_replace()
655  * __label_insert - attempt to insert @l into a label set
660  * Requires: @ls->lock
663  * Returns: @l if successful in inserting @l - with additional refcount
675 	lockdep_assert_held_write(&ls->lock);  in __label_insert()
676 	AA_BUG(label->flags & FLAG_IN_TREE);  in __label_insert()
679 	new = &ls->root.rb_node;  in __label_insert()
699 			new = &((*new)->rb_left);  in __label_insert()
701 			new = &((*new)->rb_right);  in __label_insert()
705 	rb_link_node(&label->node, parent, new);  in __label_insert()
706 	rb_insert_color(&label->node, &ls->root);  in __label_insert()
707 	label->flags |= FLAG_IN_TREE;  in __label_insert()
713  * __vec_find - find label that matches @vec in label set
732 	node = vec_labelset(vec, n)->root.rb_node;  in __vec_find()
735 		int result = vec_cmp(this->vec, this->size, vec, n);  in __vec_find()
738 			node = node->rb_left;  in __vec_find()
740 			node = node->rb_right;  in __vec_find()
749  * __label_find - find label @label in label set
752  * Requires: labels_set(@label)->lock held
763 	return __vec_find(label->vec, label->size);  in __label_find()
768  * aa_label_remove - remove a label from the labelset
782 	write_lock_irqsave(&ls->lock, flags);  in aa_label_remove()
784 	write_unlock_irqrestore(&ls->lock, flags);  in aa_label_remove()
790  * aa_label_replace - replace a label @old with a new version @new
803 		write_lock_irqsave(&labels_set(old)->lock, flags);  in aa_label_replace()
804 		if (old->proxy != new->proxy)  in aa_label_replace()
809 		write_unlock_irqrestore(&labels_set(old)->lock, flags);  in aa_label_replace()
814 		write_lock_irqsave(&ls->lock, flags);  in aa_label_replace()
817 			write_unlock_irqrestore(&ls->lock, flags);  in aa_label_replace()
819 			write_lock_irqsave(&ls->lock, flags);  in aa_label_replace()
823 		write_unlock_irqrestore(&ls->lock, flags);  in aa_label_replace()
831  * vec_find - find label @l in label set
849 	read_lock_irqsave(&ls->lock, flags);  in vec_find()
851 	read_unlock_irqrestore(&ls->lock, flags);  in vec_find()
869 		return aa_get_label(&vec[0]->label);  in vec_create_and_insert_label()
871 	ls = labels_set(&vec[len - 1]->label);  in vec_create_and_insert_label()
881 		new->vec[i] = aa_get_profile(vec[i]);  in vec_create_and_insert_label()
883 	write_lock_irqsave(&ls->lock, flags);  in vec_create_and_insert_label()
885 	write_unlock_irqrestore(&ls->lock, flags);  in vec_create_and_insert_label()
904  * aa_label_insert - insert label @label into @ls or return existing label
923 		read_lock_irqsave(&ls->lock, flags);  in aa_label_insert()
925 		read_unlock_irqrestore(&ls->lock, flags);  in aa_label_insert()
930 	write_lock_irqsave(&ls->lock, flags);  in aa_label_insert()
932 	write_unlock_irqrestore(&ls->lock, flags);  in aa_label_insert()
939  * aa_label_next_in_merge - find the next profile when merging @a and @b
954 	AA_BUG(I->i < 0);  in aa_label_next_in_merge()
955 	AA_BUG(I->i > a->size);  in aa_label_next_in_merge()
956 	AA_BUG(I->j < 0);  in aa_label_next_in_merge()
957 	AA_BUG(I->j > b->size);  in aa_label_next_in_merge()
959 	if (I->i < a->size) {  in aa_label_next_in_merge()
960 		if (I->j < b->size) {  in aa_label_next_in_merge()
961 			int res = profile_cmp(a->vec[I->i], b->vec[I->j]);  in aa_label_next_in_merge()
964 				return b->vec[(I->j)++];  in aa_label_next_in_merge()
966 				(I->j)++;  in aa_label_next_in_merge()
969 		return a->vec[(I->i)++];  in aa_label_next_in_merge()
972 	if (I->j < b->size)  in aa_label_next_in_merge()
973 		return b->vec[(I->j)++];  in aa_label_next_in_merge()
979  * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
1002 	     k < z->size && (p = aa_label_next_in_merge(&i, a, b));  in label_merge_cmp()
1004 		int res = profile_cmp(p, z->vec[k]);  in label_merge_cmp()
1012 	else if (k < z->size)  in label_merge_cmp()
1013 		return -1;  in label_merge_cmp()
1018  * label_merge_insert - create a new label by merging @a and @b
1047 	AA_BUG(a->size < 0);  in label_merge_insert()
1049 	AA_BUG(b->size < 0);  in label_merge_insert()
1051 	AA_BUG(new->size < a->size + b->size);  in label_merge_insert()
1056 			new->vec[k] = aa_get_newest_profile(next);  in label_merge_insert()
1057 			AA_BUG(!new->vec[k]->label.proxy);  in label_merge_insert()
1058 			AA_BUG(!new->vec[k]->label.proxy->label);  in label_merge_insert()
1059 			if (next->label.proxy != new->vec[k]->label.proxy)  in label_merge_insert()
1064 			new->vec[k++] = aa_get_profile(next);  in label_merge_insert()
1067 	new->size = k;  in label_merge_insert()
1068 	new->vec[k] = NULL;  in label_merge_insert()
1071 		new->size -= aa_vec_unique(&new->vec[0], new->size,  in label_merge_insert()
1074 		if (new->size == 1) {  in label_merge_insert()
1075 			label = aa_get_label(&new->vec[0]->label);  in label_merge_insert()
1081 		 * for new->size == a->size == b->size unless a == b  in label_merge_insert()
1083 		if (k == a->size)  in label_merge_insert()
1085 		else if (k == b->size)  in label_merge_insert()
1088 	new->flags |= accum_vec_flags(new->vec, new->size);  in label_merge_insert()
1090 	write_lock_irqsave(&ls->lock, flags);  in label_merge_insert()
1092 	write_unlock_irqrestore(&ls->lock, flags);  in label_merge_insert()
1098  * labelset_of_merge - find which labelset a merged label should be inserted
1111 		return &nsa->labels;  in labelset_of_merge()
1112 	return &nsb->labels;  in labelset_of_merge()
1116  * __label_find_merge - find label that is equiv to merge of @a and @b
1121  * Requires: ls->lock read_lock held
1139 	node  = ls->root.rb_node;  in __label_find_merge()
1146 			node = node->rb_left;  in __label_find_merge()
1148 			node = node->rb_right;  in __label_find_merge()
1158  * aa_label_find_merge - find label that is equiv to merge of @a and @b
1181 	read_lock_irqsave(&ls->lock, flags);  in aa_label_find_merge()
1183 	read_unlock_irqrestore(&ls->lock, flags);  in aa_label_find_merge()
1191  * aa_label_merge - attempt to insert new merged label of @a and @b
1201  *     else NULL if could not create label (-ENOMEM)
1229 		new = aa_label_alloc(a->size + b->size, NULL, gfp);  in aa_label_merge()
1244  * Assumes visibility test has already been done.
1246  * visibility test.
1249 					 struct aa_ruleset *rules,  in match_component()  argument
1255 	if (profile->ns == tp->ns)  in match_component()
1256 		return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);  in match_component()
1259 	ns_name = aa_ns_name(profile->ns, tp->ns, true);  in match_component()
1260 	state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);  in match_component()
1261 	state = aa_dfa_match(rules->policy->dfa, state, ns_name);  in match_component()
1262 	state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1);  in match_component()
1263 	return aa_dfa_match(rules->policy->dfa, state, tp->base.hname);  in match_component()
1267  * label_compound_match - find perms for full compound label
1269  * @rules: ruleset to search
1283 				struct aa_ruleset *rules,  in label_compound_match()  argument
1293 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_compound_match()
1295 		state = match_component(profile, rules, tp, state);  in label_compound_match()
1307 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_compound_match()
1309 		state = aa_dfa_match(rules->policy->dfa, state, "//&");  in label_compound_match()
1310 		state = match_component(profile, rules, tp, state);  in label_compound_match()
1314 	*perms = *aa_lookup_perms(rules->policy, state);  in label_compound_match()
1316 	if ((perms->allow & request) != request)  in label_compound_match()
1317 		return -EACCES;  in label_compound_match()
1327  * label_components_match - find perms for all subcomponents of a label
1329  * @rules: ruleset to search
1343 				  struct aa_ruleset *rules,  in label_components_match()  argument
1353 	/* find first subcomponent to test */  in label_components_match()
1355 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_components_match()
1357 		state = match_component(profile, rules, tp, start);  in label_components_match()
1363 	/* no subcomponents visible - no change in perms */  in label_components_match()
1367 	tmp = *aa_lookup_perms(rules->policy, state);  in label_components_match()
1371 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_components_match()
1373 		state = match_component(profile, rules, tp, start);  in label_components_match()
1376 		tmp = *aa_lookup_perms(rules->policy, state);  in label_components_match()
1381 	if ((perms->allow & request) != request)  in label_components_match()
1382 		return -EACCES;  in label_components_match()
1388 	return -EACCES;  in label_components_match()
1392  * aa_label_match - do a multi-component label match
1394  * @rules: ruleset to search
1403 int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,  in aa_label_match()  argument
1407 	int error = label_compound_match(profile, rules, label, state, subns,  in aa_label_match()
1413 	return label_components_match(profile, rules, label, state, subns,  in aa_label_match()
1419  * aa_update_label_name - update a label to have a stored name
1439 	if (label->hname || labels_ns(label) != ns)  in aa_update_label_name()
1446 	write_lock_irqsave(&ls->lock, flags);  in aa_update_label_name()
1447 	if (!label->hname && label->flags & FLAG_IN_TREE) {  in aa_update_label_name()
1448 		label->hname = name;  in aa_update_label_name()
1452 	write_unlock_irqrestore(&ls->lock, flags);  in aa_update_label_name()
1459  * @label->hname only exists if label is namespace hierachical
1464 	if (label->hname && (!ns || labels_ns(label) == ns) &&  in use_label_hname()
1479 	size -= ulen;			\
1484  * aa_profile_snxprint - print a profile name to a buffer
1509 	if (view != profile->ns &&  in aa_profile_snxprint()
1510 	    (!prev_ns || (*prev_ns != profile->ns))) {  in aa_profile_snxprint()
1512 			*prev_ns = profile->ns;  in aa_profile_snxprint()
1513 		ns_name = aa_ns_name(view, profile->ns,  in aa_profile_snxprint()
1522 	if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {  in aa_profile_snxprint()
1523 		const char *modestr = aa_profile_mode_names[profile->mode];  in aa_profile_snxprint()
1527 					profile->base.hname, modestr);  in aa_profile_snxprint()
1528 		return snprintf(str, size, "%s (%s)", profile->base.hname,  in aa_profile_snxprint()
1534 				profile->base.hname);  in aa_profile_snxprint()
1535 	return snprintf(str, size, "%s", profile->base.hname);  in aa_profile_snxprint()
1543 	int mode = -1, count = 0;  in label_modename()
1546 		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {  in label_modename()
1548 			if (profile == profile->ns->unconfined)  in label_modename()
1554 			if (mode == -1)  in label_modename()
1555 				mode = profile->mode;  in label_modename()
1556 			else if (mode != profile->mode)  in label_modename()
1562 		return "-";  in label_modename()
1563 	if (mode == -1)  in label_modename()
1579 			if (aa_ns_visible(ns, profile->ns,  in display_mode()
1581 			    profile != profile->ns->unconfined)  in display_mode()
1584 		/* only ns->unconfined in set of profiles in ns */  in display_mode()
1592  * aa_label_snxprint - print a label name to a string buffer
1606  *       of the label is visible "---" will be used.
1629 		if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {  in aa_label_snxprint()
1662  * aa_label_asxprint - allocate a string buffer and print label into it
1663  * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1686 		return -ENOMEM;  in aa_label_asxprint()
1691  * aa_label_acntsxprint - allocate a __counted string buffer and print label
1715 		return -ENOMEM;  in aa_label_acntsxprint()
1739 		str = (char *) label->hname;  in aa_label_xaudit()
1768 		seq_printf(f, "%s (%s)", label->hname,  in aa_label_seq_xprint()
1771 		seq_puts(f, label->hname);  in aa_label_seq_xprint()
1791 		pr_info("%s (%s)", label->hname,  in aa_label_xprintk()
1794 		pr_info("%s", label->hname);  in aa_label_xprintk()
1813 	for (split = aa_label_strn_split(str, end - str);  in label_count_strn_entries()
1815 	     split = aa_label_strn_split(str, end - str)) {  in label_count_strn_entries()
1843  * aa_label_strn_parse - parse, validate and convert a text string to a label
1869 			    base != &root_ns->unconfined->label))  in aa_label_strn_parse()
1870 		return ERR_PTR(-EINVAL);  in aa_label_strn_parse()
1872 	len = label_count_strn_entries(str, end - str);  in aa_label_strn_parse()
1875 		stack = base->size;  in aa_label_strn_parse()
1886 		vec[i] = aa_get_profile(base->vec[i]);  in aa_label_strn_parse()
1888 	for (split = aa_label_strn_split(str, end - str), i = stack;  in aa_label_strn_parse()
1890 		vec[i] = fqlookupn_profile(base, currbase, str, split - str);  in aa_label_strn_parse()
1897 		if (vec[i]->ns != labels_ns(currbase))  in aa_label_strn_parse()
1898 			currbase = &vec[i]->label;  in aa_label_strn_parse()
1900 		split = aa_label_strn_split(str, end - str);  in aa_label_strn_parse()
1904 		vec[i] = fqlookupn_profile(base, currbase, str, end - str);  in aa_label_strn_parse()
1910 		return &vec[0]->label;  in aa_label_strn_parse()
1912 	len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);  in aa_label_strn_parse()
1915 		label = aa_get_label(&vec[0]->label);  in aa_label_strn_parse()
1932 	label = ERR_PTR(-ENOENT);  in aa_label_strn_parse()
1944  * aa_labelset_destroy - remove all labels from the label set
1957 	write_lock_irqsave(&ls->lock, flags);  in aa_labelset_destroy()
1958 	for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {  in aa_labelset_destroy()
1963 				       ns_unconfined(labels_ns(this)->parent));  in aa_labelset_destroy()
1967 	write_unlock_irqrestore(&ls->lock, flags);  in aa_labelset_destroy()
1977 	rwlock_init(&ls->lock);  in aa_labelset_init()
1978 	ls->root = RB_ROOT;  in aa_labelset_init()
1989 	read_lock_irqsave(&ls->lock, flags);  in labelset_next_stale()
1994 		     vec_is_stale(label->vec, label->size)) &&  in labelset_next_stale()
2002 	read_unlock_irqrestore(&ls->lock, flags);  in labelset_next_stale()
2008  * __label_update - insert updated version of @label into labelset
2027 	AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));  in __label_update()
2029 	new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);  in __label_update()
2038 	write_lock_irqsave(&ls->lock, flags);  in __label_update()
2039 	for (i = 0; i < label->size; i++) {  in __label_update()
2040 		AA_BUG(!label->vec[i]);  in __label_update()
2041 		new->vec[i] = aa_get_newest_profile(label->vec[i]);  in __label_update()
2042 		AA_BUG(!new->vec[i]);  in __label_update()
2043 		AA_BUG(!new->vec[i]->label.proxy);  in __label_update()
2044 		AA_BUG(!new->vec[i]->label.proxy->label);  in __label_update()
2045 		if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)  in __label_update()
2051 		new->size -= aa_vec_unique(&new->vec[0], new->size,  in __label_update()
2054 		if (new->size == 1) {  in __label_update()
2055 			tmp = aa_get_label(&new->vec[0]->label);  in __label_update()
2060 			write_unlock_irqrestore(&ls->lock, flags);  in __label_update()
2062 			write_lock_irqsave(&ls->lock, flags);  in __label_update()
2072 	write_unlock_irqrestore(&ls->lock, flags);  in __label_update()
2079  * __labelset_update - update labels in @ns
2096 	AA_BUG(!mutex_is_locked(&ns->lock));  in __labelset_update()
2099 		label = labelset_next_stale(&ns->labels);  in __labelset_update()
2110  * __aa_labelset_update_subtree - update all labels with a stale component
2122 	AA_BUG(!mutex_is_locked(&ns->lock));  in __aa_labelset_update_subtree()
2126 	list_for_each_entry(child, &ns->sub_ns, base.list) {  in __aa_labelset_update_subtree()
2127 		mutex_lock_nested(&child->lock, child->level);  in __aa_labelset_update_subtree()
2129 		mutex_unlock(&child->lock);  in __aa_labelset_update_subtree()