11  * task is confined by.  Every task in the system has a profile attached
15  * Each profile exists in a profile namespace which is a container of
16  * visible profiles.  Each namespace contains a special "unconfined" profile,
19  * Namespace and profile names can be written together in either
21  *	:namespace:profile - used by kernel interfaces for easy detection
22  *	namespace://profile - used by policy
24  * Profile names can not start with : or @ or ^ and may not contain \0
26  * Reserved profile names
27  *	unconfined - special automatically generated unconfined profile
28  *	inherit - special name to indicate profile inheritance
35  * a // in a profile or namespace name indicates a hierarchical name with the
38  * Profile and namespace hierarchies serve two different but similar purposes.
43  * The profile hierarchy severs two distinct purposes,
45  *    subprograms under its own profile with different restriction than it
46  *    self, and not have it use the system profile.
52  *   but is allowed.  NOTE: this is currently suboptimal because profile
53  *   aliasing is not currently implemented so that a profile for each
58  *   A profile or namespace name that can contain one or more // separators
62  *   An fqname is a name that may contain both namespace and profile hnames.
66  *   - locking of profile lists is currently fairly coarse.  All profile
68  * FIXME: move profile lists to using rcu_lists
140  * @profile: the profile to add  (NOT NULL)
142  * refcount @profile, should be put by __list_remove_profile
146 static void __add_profile(struct list_head *list, struct aa_profile *profile)  in __add_profile()  argument
151 	AA_BUG(!profile);  in __add_profile()
152 	AA_BUG(!profile->ns);  in __add_profile()
153 	AA_BUG(!mutex_is_locked(&profile->ns->lock));  in __add_profile()
155 	list_add_rcu(&profile->base.list, list);  in __add_profile()
157 	aa_get_profile(profile);  in __add_profile()
158 	l = aa_label_insert(&profile->ns->labels, &profile->label);  in __add_profile()
159 	AA_BUG(l != &profile->label);  in __add_profile()
164  * __list_remove_profile - remove a profile from the list it is on
165  * @profile: the profile to remove  (NOT NULL)
167  * remove a profile from the list, warning generally removal should
168  * be done with __replace_profile as most profile removals are
169  * replacements to the unconfined profile.
171  * put @profile list refcount
175 static void __list_remove_profile(struct aa_profile *profile)  in __list_remove_profile()  argument
177 	AA_BUG(!profile);  in __list_remove_profile()
178 	AA_BUG(!profile->ns);  in __list_remove_profile()
179 	AA_BUG(!mutex_is_locked(&profile->ns->lock));  in __list_remove_profile()
181 	list_del_rcu(&profile->base.list);  in __list_remove_profile()
182 	aa_put_profile(profile);  in __list_remove_profile()
186  * __remove_profile - remove old profile, and children
187  * @profile: profile to be replaced  (NOT NULL)
191 static void __remove_profile(struct aa_profile *profile)  in __remove_profile()  argument
193 	AA_BUG(!profile);  in __remove_profile()
194 	AA_BUG(!profile->ns);  in __remove_profile()
195 	AA_BUG(!mutex_is_locked(&profile->ns->lock));  in __remove_profile()
198 	__aa_profile_list_release(&profile->base.profiles);  in __remove_profile()
200 	aa_label_remove(&profile->label);  in __remove_profile()
201 	__aafs_profile_rmdir(profile);  in __remove_profile()
202 	__list_remove_profile(profile);  in __remove_profile()
213 	struct aa_profile *profile, *tmp;  in __aa_profile_list_release()  local
214 	list_for_each_entry_safe(profile, tmp, head, base.list)  in __aa_profile_list_release()
215 		__remove_profile(profile);  in __aa_profile_list_release()
269  * aa_free_profile - free a profile
270  * @profile: the profile to free  (MAYBE NULL)
272  * Free a profile, its hats and null_profile. All references to the profile,
275  * If the profile was referenced from a task context, free_profile() will
278 void aa_free_profile(struct aa_profile *profile)  in aa_free_profile()  argument
283 	AA_DEBUG("%s(%p)\n", __func__, profile);  in aa_free_profile()
285 	if (!profile)  in aa_free_profile()
289 	aa_policy_destroy(&profile->base);  in aa_free_profile()
290 	aa_put_profile(rcu_access_pointer(profile->parent));  in aa_free_profile()
292 	aa_put_ns(profile->ns);  in aa_free_profile()
293 	kfree_sensitive(profile->rename);  in aa_free_profile()
294 	kfree_sensitive(profile->disconnected);  in aa_free_profile()
296 	free_attachment(&profile->attach);  in aa_free_profile()
302 	list_for_each_entry_safe(rule, tmp, &profile->rules, list) {  in aa_free_profile()
306 	kfree_sensitive(profile->dirname);  in aa_free_profile()
308 	if (profile->data) {  in aa_free_profile()
309 		rht = profile->data;  in aa_free_profile()
310 		profile->data = NULL;  in aa_free_profile()
315 	kfree_sensitive(profile->hash);  in aa_free_profile()
316 	aa_put_loaddata(profile->rawdata);  in aa_free_profile()
317 	aa_label_destroy(&profile->label);  in aa_free_profile()
319 	kfree_sensitive(profile);  in aa_free_profile()
323  * aa_alloc_profile - allocate, initialize and return a new profile
324  * @hname: name of the profile  (NOT NULL)
328  * Returns: refcount profile or NULL on failure
333 	struct aa_profile *profile;  in aa_alloc_profile()  local
337 	profile = kzalloc(struct_size(profile, label.vec, 2), gfp);  in aa_alloc_profile()
338 	if (!profile)  in aa_alloc_profile()
341 	if (!aa_policy_init(&profile->base, NULL, hname, gfp))  in aa_alloc_profile()
343 	if (!aa_label_init(&profile->label, 1, gfp))  in aa_alloc_profile()
346 	INIT_LIST_HEAD(&profile->rules);  in aa_alloc_profile()
352 	list_add(&rules->list, &profile->rules);  in aa_alloc_profile()
356 		proxy = aa_alloc_proxy(&profile->label, gfp);  in aa_alloc_profile()
361 	profile->label.proxy = proxy;  in aa_alloc_profile()
363 	profile->label.hname = profile->base.hname;  in aa_alloc_profile()
364 	profile->label.flags |= FLAG_PROFILE;  in aa_alloc_profile()
365 	profile->label.vec[0] = profile;  in aa_alloc_profile()
368 	return profile;  in aa_alloc_profile()
371 	aa_free_profile(profile);  in aa_alloc_profile()
376 /* TODO: profile accounting - setup in remove */
379  * __strn_find_child - find a profile on @head list using substring of @name
381  * @name: name of profile (NOT NULL)
386  * Returns: unrefcounted profile ptr, or NULL if not found
395  * __find_child - find a profile on @head list with a name matching @name
397  * @name: name of profile (NOT NULL)
401  * Returns: unrefcounted profile ptr, or NULL if not found
409  * aa_find_child - find a profile by @name in @parent
410  * @parent: profile to search  (NOT NULL)
411  * @name: profile name to search for  (NOT NULL)
413  * Returns: a refcounted profile or NULL if not found
417 	struct aa_profile *profile;  in aa_find_child()  local
421 		profile = __find_child(&parent->base.profiles, name);  in aa_find_child()
422 	} while (profile && !aa_get_profile_not0(profile));  in aa_find_child()
426 	return profile;  in aa_find_child()
430  * __lookup_parent - lookup the parent of a profile of name @hname
431  * @ns: namespace to lookup profile in  (NOT NULL)
432  * @hname: hierarchical profile name to find parent of  (NOT NULL)
434  * Lookups up the parent of a fully qualified profile name, the profile
436  * is used to load a new profile.
446 	struct aa_profile *profile = NULL;  in __lookup_parent()  local
452 		profile = __strn_find_child(&policy->profiles, hname,  in __lookup_parent()
454 		if (!profile)  in __lookup_parent()
456 		policy = &profile->base;  in __lookup_parent()
460 	if (!profile)  in __lookup_parent()
462 	return &profile->base;  in __lookup_parent()
467  * @ns: namespace to lookup profile in (NOT NULL)
468  * @hname: hierarchical profile name to find parent of (NOT NULL)
481 	struct aa_profile *parent, *profile = NULL;  in __create_missing_ancestors()  local
490 		parent = profile;  in __create_missing_ancestors()
491 		profile = __strn_find_child(&policy->profiles, hname,  in __create_missing_ancestors()
493 		if (!profile) {  in __create_missing_ancestors()
498 			profile = aa_alloc_null(parent, name, gfp);  in __create_missing_ancestors()
500 			if (!profile)  in __create_missing_ancestors()
503 				profile->ns = aa_get_ns(ns);  in __create_missing_ancestors()
505 		policy = &profile->base;  in __create_missing_ancestors()
509 	if (!profile)  in __create_missing_ancestors()
511 	return &profile->base;  in __create_missing_ancestors()
515  * __lookupn_profile - lookup the profile matching @hname
516  * @base: base list to start looking up profile name from  (NOT NULL)
517  * @hname: hierarchical profile name  (NOT NULL)
522  * Returns: unrefcounted profile pointer or NULL if not found
524  * Do a relative name lookup, recursing through profile tree.
529 	struct aa_profile *profile = NULL;  in __lookupn_profile()  local
534 		profile = __strn_find_child(&base->profiles, hname,  in __lookupn_profile()
536 		if (!profile)  in __lookupn_profile()
539 		base = &profile->base;  in __lookupn_profile()
556  * aa_lookupn_profile - find a profile by its full or partial name
561  * Returns: refcounted profile or NULL if not found
566 	struct aa_profile *profile;  in aa_lookupn_profile()  local
570 		profile = __lookupn_profile(&ns->base, hname, n);  in aa_lookupn_profile()
571 	} while (profile && !aa_get_profile_not0(profile));  in aa_lookupn_profile()
574 	/* the unconfined profile is not in the regular profile list */  in aa_lookupn_profile()
575 	if (!profile && strncmp(hname, "unconfined", n) == 0)  in aa_lookupn_profile()
576 		profile = aa_get_newest_profile(ns->unconfined);  in aa_lookupn_profile()
579 	return profile;  in aa_lookupn_profile()
585 	struct aa_profile *profile;  in aa_fqlookupn_profile()  local
599 		profile = aa_lookupn_profile(ns, name, n - (name - fqname));  in aa_fqlookupn_profile()
601 		/* default profile for ns, currently unconfined */  in aa_fqlookupn_profile()
602 		profile = aa_get_newest_profile(ns->unconfined);  in aa_fqlookupn_profile()
604 		profile = NULL;  in aa_fqlookupn_profile()
607 	return profile;  in aa_fqlookupn_profile()
614 	struct aa_profile *profile;  in aa_alloc_null()  local
617 	profile = aa_alloc_profile(name, NULL, gfp);  in aa_alloc_null()
618 	if (!profile)  in aa_alloc_null()
622 	profile->label.flags |= FLAG_NULL;  in aa_alloc_null()
623 	profile->attach.xmatch = aa_get_pdb(nullpdb);  in aa_alloc_null()
624 	rules = list_first_entry(&profile->rules, typeof(*rules), list);  in aa_alloc_null()
629 		profile->path_flags = parent->path_flags;  in aa_alloc_null()
632 		rcu_assign_pointer(profile->parent, aa_get_profile(parent));  in aa_alloc_null()
633 		profile->ns = aa_get_ns(parent->ns);  in aa_alloc_null()
636 	return profile;  in aa_alloc_null()
640  * aa_new_learning_profile - create or find a null-X learning profile
641  * @parent: profile that caused this profile to be created (NOT NULL)
642  * @hat: true if the null- learning profile is a hat
643  * @base: name to base the null profile off of
646  * Find/Create a null- complain mode profile used in learning mode.  The
647  * name of the profile is unique and follows the format of parent//null-XXX.
651  * null profiles are added to the profile list but the list does not
655  * Returns: new refcounted profile else NULL on failure
660 	struct aa_profile *p, *profile;  in aa_new_learning_profile()  local
685 	profile = aa_find_child(parent, bname);  in aa_new_learning_profile()
686 	if (profile)  in aa_new_learning_profile()
689 	profile = aa_alloc_null(parent, name, gfp);  in aa_new_learning_profile()
690 	if (!profile)  in aa_new_learning_profile()
692 	profile->mode = APPARMOR_COMPLAIN;  in aa_new_learning_profile()
694 		profile->label.flags |= FLAG_HAT;  in aa_new_learning_profile()
696 	mutex_lock_nested(&profile->ns->lock, profile->ns->level);  in aa_new_learning_profile()
699 		aa_free_profile(profile);  in aa_new_learning_profile()
700 		profile = aa_get_profile(p);  in aa_new_learning_profile()
702 		__add_profile(&parent->base.profiles, profile);  in aa_new_learning_profile()
704 	mutex_unlock(&profile->ns->lock);  in aa_new_learning_profile()
710 	return profile;  in aa_new_learning_profile()
714 	aa_free_profile(profile);  in aa_new_learning_profile()
720  * @profile: profile to test if it can be replaced  (MAYBE NULL)
726 static int replacement_allowed(struct aa_profile *profile, int noreplace,  in replacement_allowed()  argument
729 	if (profile) {  in replacement_allowed()
730 		if (profile->label.flags & FLAG_IMMUTIBLE) {  in replacement_allowed()
731 			*info = "cannot replace immutable profile";  in replacement_allowed()
734 			*info = "profile already exists";  in replacement_allowed()
758  * @name: name of profile being manipulated (NOT NULL)
902 					       struct aa_profile *profile)  in __list_lookup_parent()  argument
904 	const char *base = basename(profile->base.hname);  in __list_lookup_parent()
905 	long len = base - profile->base.hname;  in __list_lookup_parent()
914 		if (ent->new == profile)  in __list_lookup_parent()
916 		if (strncmp(ent->new->base.hname, profile->base.hname, len) ==  in __list_lookup_parent()
926  * @old: profile to be replaced  (NOT NULL)
927  * @new: profile to replace @old with  (NOT NULL)
983  * __lookup_replace - lookup replacement information for a profile
985  * @hname: name of profile to lookup
986  * @noreplace: true if not replacing an existing profile
987  * @p: Returns - profile to be replaced
990  * Returns: profile to replace (no ref) on success else ptr error
1000 			*info = "profile can not be replaced";  in __lookup_replace()
1039  * aa_replace_profiles - replace profile(s) on the profile list
1045  * unpack and replace a profile on the profile list and uses of that profile
1046  * by any task creds via invalidating the old version of the profile, which
1047  * tasks will notice to update their own cred.  If the profile does not exist
1048  * on the profile list it is added.
1161 				 * profile that doesn't have  in aa_replace_profiles()
1163 				 * individual profile loading where  in aa_replace_profiles()
1168 				 * null profile will be replaced once  in aa_replace_profiles()
1182 			/* released on profile replacement or free_profile */  in aa_replace_profiles()
1224 			/* dedup actual profile replacement */  in aa_replace_profiles()
1226 				     "same as current profile, skipping",  in aa_replace_profiles()
1235 		 * TODO: finer dedup based on profile range in data. Load set  in aa_replace_profiles()
1236 		 * can differ but profile may remain unchanged  in aa_replace_profiles()
1280 	info = "valid profile in failed atomic policy load";  in aa_replace_profiles()
1283 			info = "unchecked profile in failed atomic policy load";  in aa_replace_profiles()
1300  * aa_remove_profiles - remove profile(s) from the system
1303  * @fqname: name of the profile or namespace to remove  (NOT NULL)
1306  * Remove a profile or sub namespace from the current namespace, so that
1317 	struct aa_profile *profile = NULL;  in aa_remove_profiles()  local
1323 		info = "no profile specified";  in aa_remove_profiles()
1351 		/* remove profile */  in aa_remove_profiles()
1353 		profile = aa_get_profile(__lookup_profile(&ns->base, name));  in aa_remove_profiles()
1354 		if (!profile) {  in aa_remove_profiles()
1356 			info = "profile does not exist";  in aa_remove_profiles()
1359 		name = profile->base.hname;  in aa_remove_profiles()
1361 		__remove_profile(profile);  in aa_remove_profiles()
1370 	aa_put_profile(profile);  in aa_remove_profiles()