2 * AppArmor security module
4 * This file contains AppArmor label definitions
6 * Copyright 2017 Canonical Ltd.
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation, version 2 of the
14 #include <linux/audit.h>
15 #include <linux/seq_file.h>
16 #include <linux/sort.h>
18 #include "include/apparmor.h"
19 #include "include/cred.h"
20 #include "include/label.h"
21 #include "include/policy.h"
22 #include "include/secid.h"
26 * the aa_label represents the set of profiles confining an object
28 * Labels maintain a reference count to the set of pointers they reference
29 * Labels are ref counted by
30 * tasks and object via the security field/security context off the field
31 * code - will take a ref count on a label if it needs the label
32 * beyond what is possible with an rcu_read_lock.
33 * profiles - each profile is a label
34 * secids - a pinned secid will keep a refcount of the label it is
36 * objects - inode, files, sockets, ...
38 * Labels are not ref counted by the label set, so they maybe removed and
39 * freed when no longer in use.
43 #define PROXY_POISON 97
44 #define LABEL_POISON 100
46 static void free_proxy(struct aa_proxy *proxy)
49 /* p->label will not updated any more as p is dead */
50 aa_put_label(rcu_dereference_protected(proxy->label, true));
51 memset(proxy, 0, sizeof(*proxy));
52 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON);
57 void aa_proxy_kref(struct kref *kref)
59 struct aa_proxy *proxy = container_of(kref, struct aa_proxy, count);
64 struct aa_proxy *aa_alloc_proxy(struct aa_label *label, gfp_t gfp)
68 new = kzalloc(sizeof(struct aa_proxy), gfp);
70 kref_init(&new->count);
71 rcu_assign_pointer(new->label, aa_get_label(label));
76 /* requires profile list write lock held */
77 void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
83 lockdep_assert_held_exclusive(&labels_set(orig)->lock);
85 tmp = rcu_dereference_protected(orig->proxy->label,
86 &labels_ns(orig)->lock);
87 rcu_assign_pointer(orig->proxy->label, aa_get_label(new));
88 orig->flags |= FLAG_STALE;
92 static void __proxy_share(struct aa_label *old, struct aa_label *new)
94 struct aa_proxy *proxy = new->proxy;
96 new->proxy = aa_get_proxy(old->proxy);
97 __aa_proxy_redirect(old, new);
103 * ns_cmp - compare ns for label set ordering
104 * @a: ns to compare (NOT NULL)
105 * @b: ns to compare (NOT NULL)
107 * Returns: <0 if a < b
111 static int ns_cmp(struct aa_ns *a, struct aa_ns *b)
117 AA_BUG(!a->base.hname);
118 AA_BUG(!b->base.hname);
123 res = a->level - b->level;
127 return strcmp(a->base.hname, b->base.hname);
131 * profile_cmp - profile comparison for set ordering
132 * @a: profile to compare (NOT NULL)
133 * @b: profile to compare (NOT NULL)
135 * Returns: <0 if a < b
139 static int profile_cmp(struct aa_profile *a, struct aa_profile *b)
147 AA_BUG(!a->base.hname);
148 AA_BUG(!b->base.hname);
150 if (a == b || a->base.hname == b->base.hname)
152 res = ns_cmp(a->ns, b->ns);
156 return strcmp(a->base.hname, b->base.hname);
160 * vec_cmp - label comparison for set ordering
161 * @a: label to compare (NOT NULL)
162 * @vec: vector of profiles to compare (NOT NULL)
165 * Returns: <0 if a < vec
169 static int vec_cmp(struct aa_profile **a, int an, struct aa_profile **b, int bn)
180 for (i = 0; i < an && i < bn; i++) {
181 int res = profile_cmp(a[i], b[i]);
190 static bool vec_is_stale(struct aa_profile **vec, int n)
196 for (i = 0; i < n; i++) {
197 if (profile_is_stale(vec[i]))
204 static bool vec_unconfined(struct aa_profile **vec, int n)
210 for (i = 0; i < n; i++) {
211 if (!profile_unconfined(vec[i]))
218 static int sort_cmp(const void *a, const void *b)
220 return profile_cmp(*(struct aa_profile **)a, *(struct aa_profile **)b);
224 * assumes vec is sorted
225 * Assumes @vec has null terminator at vec[n], and will null terminate
228 static inline int unique(struct aa_profile **vec, int n)
230 int i, pos, dups = 0;
236 for (i = 1; i < n; i++) {
237 int res = profile_cmp(vec[pos], vec[i]);
239 AA_BUG(res > 0, "vec not sorted");
242 aa_put_profile(vec[i]);
257 * aa_vec_unique - canonical sort and unique a list of profiles
258 * @n: number of refcounted profiles in the list (@n > 0)
259 * @vec: list of profiles to sort and merge
261 * Returns: the number of duplicates eliminated == references put
263 * If @flags & VEC_FLAG_TERMINATE @vec has null terminator at vec[n], and will
264 * null terminate vec[n - dups]
266 int aa_vec_unique(struct aa_profile **vec, int n, int flags)
273 /* vecs are usually small and inorder, have a fallback for larger */
275 sort(vec, n, sizeof(struct aa_profile *), sort_cmp, NULL);
276 dups = unique(vec, n);
280 /* insertion sort + unique in one */
281 for (i = 1; i < n; i++) {
282 struct aa_profile *tmp = vec[i];
285 for (pos = i - 1 - dups; pos >= 0; pos--) {
286 int res = profile_cmp(vec[pos], tmp);
289 /* drop duplicate entry */
296 /* pos is at entry < tmp, or index -1. Set to insert pos */
299 for (j = i - dups; j > pos; j--)
309 if (flags & VEC_FLAG_TERMINATE)
310 vec[n - dups] = NULL;
316 static void label_destroy(struct aa_label *label)
318 struct aa_label *tmp;
322 if (!label_isprofile(label)) {
323 struct aa_profile *profile;
326 aa_put_str(label->hname);
328 label_for_each(i, label, profile) {
329 aa_put_profile(profile);
330 label->vec[i.i] = (struct aa_profile *)
331 (LABEL_POISON + (long) i.i);
335 if (rcu_dereference_protected(label->proxy->label, true) == label)
336 rcu_assign_pointer(label->proxy->label, NULL);
338 aa_free_secid(label->secid);
340 tmp = rcu_dereference_protected(label->proxy->label, true);
342 rcu_assign_pointer(label->proxy->label, NULL);
344 aa_put_proxy(label->proxy);
345 label->proxy = (struct aa_proxy *) PROXY_POISON + 1;
348 void aa_label_free(struct aa_label *label)
353 label_destroy(label);
357 static void label_free_switch(struct aa_label *label)
359 if (label->flags & FLAG_NS_COUNT)
360 aa_free_ns(labels_ns(label));
361 else if (label_isprofile(label))
362 aa_free_profile(labels_profile(label));
364 aa_label_free(label);
367 static void label_free_rcu(struct rcu_head *head)
369 struct aa_label *label = container_of(head, struct aa_label, rcu);
371 if (label->flags & FLAG_IN_TREE)
372 (void) aa_label_remove(label);
373 label_free_switch(label);
376 void aa_label_kref(struct kref *kref)
378 struct aa_label *label = container_of(kref, struct aa_label, count);
379 struct aa_ns *ns = labels_ns(label);
382 /* never live, no rcu callback needed, just using the fn */
383 label_free_switch(label);
386 /* TODO: update labels_profile macro so it works here */
387 AA_BUG(label_isprofile(label) &&
388 on_list_rcu(&label->vec[0]->base.profiles));
389 AA_BUG(label_isprofile(label) &&
390 on_list_rcu(&label->vec[0]->base.list));
392 /* TODO: if compound label and not stale add to reclaim cache */
393 call_rcu(&label->rcu, label_free_rcu);
396 static void label_free_or_put_new(struct aa_label *label, struct aa_label *new)
399 /* need to free directly to break circular ref with proxy */
405 bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
410 if (aa_alloc_secid(label, gfp) < 0)
413 label->size = size; /* doesn't include null */
414 label->vec[size] = NULL; /* null terminate */
415 kref_init(&label->count);
416 RB_CLEAR_NODE(&label->node);
422 * aa_label_alloc - allocate a label with a profile vector of @size length
423 * @size: size of profile vector in the label
424 * @proxy: proxy to use OR null if to allocate a new one
425 * @gfp: memory allocation type
428 * else NULL if failed
430 struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
432 struct aa_label *new;
436 /* + 1 for null terminator entry on vec */
437 new = kzalloc(sizeof(*new) + sizeof(struct aa_profile *) * (size + 1),
439 AA_DEBUG("%s (%p)\n", __func__, new);
443 if (!aa_label_init(new, size, gfp))
447 proxy = aa_alloc_proxy(new, gfp);
452 /* just set new's proxy, don't redirect proxy here if it was passed in*/
465 * label_cmp - label comparison for set ordering
466 * @a: label to compare (NOT NULL)
467 * @b: label to compare (NOT NULL)
469 * Returns: <0 if a < b
473 static int label_cmp(struct aa_label *a, struct aa_label *b)
480 return vec_cmp(a->vec, a->size, b->vec, b->size);
483 /* helper fn for label_for_each_confined */
484 int aa_label_next_confined(struct aa_label *label, int i)
489 for (; i < label->size; i++) {
490 if (!profile_unconfined(label->vec[i]))
498 * aa_label_next_not_in_set - return the next profile of @sub not in @set
500 * @set: label to test against
501 * @sub: label to if is subset of @set
503 * Returns: profile in @sub that is not in @set, with iterator set pos after
504 * else NULL if @sub is a subset of @set
506 struct aa_profile *__aa_label_next_not_in_set(struct label_it *I,
507 struct aa_label *set,
508 struct aa_label *sub)
513 AA_BUG(I->i > set->size);
516 AA_BUG(I->j > sub->size);
518 while (I->j < sub->size && I->i < set->size) {
519 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]);
527 return sub->vec[(I->j)++];
530 if (I->j < sub->size)
531 return sub->vec[(I->j)++];
537 * aa_label_is_subset - test if @sub is a subset of @set
538 * @set: label to test against
539 * @sub: label to test if is subset of @set
541 * Returns: true if @sub is subset of @set
544 bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub)
546 struct label_it i = { };
554 return __aa_label_next_not_in_set(&i, set, sub) == NULL;
560 * __label_remove - remove @label from the label set
561 * @l: label to remove
562 * @new: label to redirect to
564 * Requires: labels_set(@label)->lock write_lock
565 * Returns: true if the label was in the tree and removed
567 static bool __label_remove(struct aa_label *label, struct aa_label *new)
569 struct aa_labelset *ls = labels_set(label);
573 lockdep_assert_held_exclusive(&ls->lock);
576 __aa_proxy_redirect(label, new);
578 if (!label_is_stale(label))
579 __label_make_stale(label);
581 if (label->flags & FLAG_IN_TREE) {
582 rb_erase(&label->node, &ls->root);
583 label->flags &= ~FLAG_IN_TREE;
591 * __label_replace - replace @old with @new in label set
592 * @old: label to remove from label set
593 * @new: label to replace @old with
595 * Requires: labels_set(@old)->lock write_lock
596 * valid ref count be held on @new
597 * Returns: true if @old was in set and replaced by @new
599 * Note: current implementation requires label set be order in such a way
600 * that @new directly replaces @old position in the set (ie.
601 * using pointer comparison of the label address would not work)
603 static bool __label_replace(struct aa_label *old, struct aa_label *new)
605 struct aa_labelset *ls = labels_set(old);
610 lockdep_assert_held_exclusive(&ls->lock);
611 AA_BUG(new->flags & FLAG_IN_TREE);
613 if (!label_is_stale(old))
614 __label_make_stale(old);
616 if (old->flags & FLAG_IN_TREE) {
617 rb_replace_node(&old->node, &new->node, &ls->root);
618 old->flags &= ~FLAG_IN_TREE;
619 new->flags |= FLAG_IN_TREE;
627 * __label_insert - attempt to insert @l into a label set
628 * @ls: set of labels to insert @l into (NOT NULL)
629 * @label: new label to insert (NOT NULL)
630 * @replace: whether insertion should replace existing entry that is not stale
632 * Requires: @ls->lock
633 * caller to hold a valid ref on l
634 * if @replace is true l has a preallocated proxy associated
635 * Returns: @l if successful in inserting @l - with additional refcount
636 * else ref counted equivalent label that is already in the set,
637 * the else condition only happens if @replace is false
639 static struct aa_label *__label_insert(struct aa_labelset *ls,
640 struct aa_label *label, bool replace)
642 struct rb_node **new, *parent = NULL;
646 AA_BUG(labels_set(label) != ls);
647 lockdep_assert_held_exclusive(&ls->lock);
648 AA_BUG(label->flags & FLAG_IN_TREE);
650 /* Figure out where to put new node */
651 new = &ls->root.rb_node;
653 struct aa_label *this = rb_entry(*new, struct aa_label, node);
654 int result = label_cmp(label, this);
658 /* !__aa_get_label means queued for destruction,
659 * so replace in place, however the label has
660 * died before the replacement so do not share
663 if (!replace && !label_is_stale(this)) {
664 if (__aa_get_label(this))
667 __proxy_share(this, label);
668 AA_BUG(!__label_replace(this, label));
669 return aa_get_label(label);
670 } else if (result < 0)
671 new = &((*new)->rb_left);
672 else /* (result > 0) */
673 new = &((*new)->rb_right);
676 /* Add new node and rebalance tree. */
677 rb_link_node(&label->node, parent, new);
678 rb_insert_color(&label->node, &ls->root);
679 label->flags |= FLAG_IN_TREE;
681 return aa_get_label(label);
685 * __vec_find - find label that matches @vec in label set
686 * @vec: vec of profiles to find matching label for (NOT NULL)
689 * Requires: @vec_labelset(vec) lock held
690 * caller to hold a valid ref on l
692 * Returns: ref counted @label if matching label is in tree
693 * ref counted label that is equiv to @l in tree
694 * else NULL if @vec equiv is not in tree
696 static struct aa_label *__vec_find(struct aa_profile **vec, int n)
698 struct rb_node *node;
704 node = vec_labelset(vec, n)->root.rb_node;
706 struct aa_label *this = rb_entry(node, struct aa_label, node);
707 int result = vec_cmp(this->vec, this->size, vec, n);
710 node = node->rb_left;
712 node = node->rb_right;
714 return __aa_get_label(this);
721 * __label_find - find label @label in label set
722 * @label: label to find (NOT NULL)
724 * Requires: labels_set(@label)->lock held
725 * caller to hold a valid ref on l
727 * Returns: ref counted @label if @label is in tree OR
728 * ref counted label that is equiv to @label in tree
729 * else NULL if @label or equiv is not in tree
731 static struct aa_label *__label_find(struct aa_label *label)
735 return __vec_find(label->vec, label->size);
740 * aa_label_remove - remove a label from the labelset
741 * @label: label to remove
743 * Returns: true if @label was removed from the tree
744 * else @label was not in tree so it could not be removed
746 bool aa_label_remove(struct aa_label *label)
748 struct aa_labelset *ls = labels_set(label);
754 write_lock_irqsave(&ls->lock, flags);
755 res = __label_remove(label, ns_unconfined(labels_ns(label)));
756 write_unlock_irqrestore(&ls->lock, flags);
762 * aa_label_replace - replace a label @old with a new version @new
763 * @old: label to replace
764 * @new: label replacing @old
766 * Returns: true if @old was in tree and replaced
767 * else @old was not in tree, and @new was not inserted
769 bool aa_label_replace(struct aa_label *old, struct aa_label *new)
774 if (name_is_shared(old, new) && labels_ns(old) == labels_ns(new)) {
775 write_lock_irqsave(&labels_set(old)->lock, flags);
776 if (old->proxy != new->proxy)
777 __proxy_share(old, new);
779 __aa_proxy_redirect(old, new);
780 res = __label_replace(old, new);
781 write_unlock_irqrestore(&labels_set(old)->lock, flags);
784 struct aa_labelset *ls = labels_set(old);
786 write_lock_irqsave(&ls->lock, flags);
787 res = __label_remove(old, new);
788 if (labels_ns(old) != labels_ns(new)) {
789 write_unlock_irqrestore(&ls->lock, flags);
790 ls = labels_set(new);
791 write_lock_irqsave(&ls->lock, flags);
793 l = __label_insert(ls, new, true);
795 write_unlock_irqrestore(&ls->lock, flags);
803 * vec_find - find label @l in label set
804 * @vec: array of profiles to find equiv label for (NOT NULL)
807 * Returns: refcounted label if @vec equiv is in tree
808 * else NULL if @vec equiv is not in tree
810 static struct aa_label *vec_find(struct aa_profile **vec, int n)
812 struct aa_labelset *ls;
813 struct aa_label *label;
820 ls = vec_labelset(vec, n);
821 read_lock_irqsave(&ls->lock, flags);
822 label = __vec_find(vec, n);
823 read_unlock_irqrestore(&ls->lock, flags);
828 /* requires sort and merge done first */
829 static struct aa_label *vec_create_and_insert_label(struct aa_profile **vec,
832 struct aa_label *label = NULL;
833 struct aa_labelset *ls;
835 struct aa_label *new;
841 return aa_get_label(&vec[0]->label);
843 ls = labels_set(&vec[len - 1]->label);
845 /* TODO: enable when read side is lockless
846 * check if label exists before taking locks
848 new = aa_label_alloc(len, NULL, gfp);
852 for (i = 0; i < len; i++)
853 new->vec[i] = aa_get_profile(vec[i]);
855 write_lock_irqsave(&ls->lock, flags);
856 label = __label_insert(ls, new, false);
857 write_unlock_irqrestore(&ls->lock, flags);
858 label_free_or_put_new(label, new);
863 struct aa_label *aa_vec_find_or_create_label(struct aa_profile **vec, int len,
866 struct aa_label *label = vec_find(vec, len);
871 return vec_create_and_insert_label(vec, len, gfp);
875 * aa_label_find - find label @label in label set
876 * @label: label to find (NOT NULL)
878 * Requires: caller to hold a valid ref on l
880 * Returns: refcounted @label if @label is in tree
881 * refcounted label that is equiv to @label in tree
882 * else NULL if @label or equiv is not in tree
884 struct aa_label *aa_label_find(struct aa_label *label)
888 return vec_find(label->vec, label->size);
893 * aa_label_insert - insert label @label into @ls or return existing label
894 * @ls - labelset to insert @label into
895 * @label - label to insert
897 * Requires: caller to hold a valid ref on @label
899 * Returns: ref counted @label if successful in inserting @label
900 * else ref counted equivalent label that is already in the set
902 struct aa_label *aa_label_insert(struct aa_labelset *ls, struct aa_label *label)
910 /* check if label exists before taking lock */
911 if (!label_is_stale(label)) {
912 read_lock_irqsave(&ls->lock, flags);
913 l = __label_find(label);
914 read_unlock_irqrestore(&ls->lock, flags);
919 write_lock_irqsave(&ls->lock, flags);
920 l = __label_insert(ls, label, false);
921 write_unlock_irqrestore(&ls->lock, flags);
928 * aa_label_next_in_merge - find the next profile when merging @a and @b
933 * Returns: next profile
934 * else null if no more profiles
936 struct aa_profile *aa_label_next_in_merge(struct label_it *I,
944 AA_BUG(I->i > a->size);
946 AA_BUG(I->j > b->size);
948 if (I->i < a->size) {
949 if (I->j < b->size) {
950 int res = profile_cmp(a->vec[I->i], b->vec[I->j]);
953 return b->vec[(I->j)++];
958 return a->vec[(I->i)++];
962 return b->vec[(I->j)++];
968 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
969 * @a: label to merge then compare (NOT NULL)
970 * @b: label to merge then compare (NOT NULL)
971 * @z: label to compare merge against (NOT NULL)
973 * Assumes: using the most recent versions of @a, @b, and @z
975 * Returns: <0 if a < b
979 static int label_merge_cmp(struct aa_label *a, struct aa_label *b,
982 struct aa_profile *p = NULL;
983 struct label_it i = { };
991 k < z->size && (p = aa_label_next_in_merge(&i, a, b));
993 int res = profile_cmp(p, z->vec[k]);
1001 else if (k < z->size)
1007 * label_merge_insert - create a new label by merging @a and @b
1008 * @new: preallocated label to merge into (NOT NULL)
1009 * @a: label to merge with @b (NOT NULL)
1010 * @b: label to merge with @a (NOT NULL)
1012 * Requires: preallocated proxy
1014 * Returns: ref counted label either @new if merge is unique
1015 * @a if @b is a subset of @a
1016 * @b if @a is a subset of @b
1018 * NOTE: will not use @new if the merge results in @new == @a or @b
1020 * Must be used within labelset write lock to avoid racing with
1021 * setting labels stale.
1023 static struct aa_label *label_merge_insert(struct aa_label *new,
1027 struct aa_label *label;
1028 struct aa_labelset *ls;
1029 struct aa_profile *next;
1031 unsigned long flags;
1032 int k = 0, invcount = 0;
1036 AA_BUG(a->size < 0);
1038 AA_BUG(b->size < 0);
1040 AA_BUG(new->size < a->size + b->size);
1042 label_for_each_in_merge(i, a, b, next) {
1044 if (profile_is_stale(next)) {
1045 new->vec[k] = aa_get_newest_profile(next);
1046 AA_BUG(!new->vec[k]->label.proxy);
1047 AA_BUG(!new->vec[k]->label.proxy->label);
1048 if (next->label.proxy != new->vec[k]->label.proxy)
1053 new->vec[k++] = aa_get_profile(next);
1055 /* set to actual size which is <= allocated len */
1060 new->size -= aa_vec_unique(&new->vec[0], new->size,
1061 VEC_FLAG_TERMINATE);
1062 /* TODO: deal with reference labels */
1063 if (new->size == 1) {
1064 label = aa_get_label(&new->vec[0]->label);
1067 } else if (!stale) {
1069 * merge could be same as a || b, note: it is not possible
1070 * for new->size == a->size == b->size unless a == b
1073 return aa_get_label(a);
1074 else if (k == b->size)
1075 return aa_get_label(b);
1077 if (vec_unconfined(new->vec, new->size))
1078 new->flags |= FLAG_UNCONFINED;
1079 ls = labels_set(new);
1080 write_lock_irqsave(&ls->lock, flags);
1081 label = __label_insert(labels_set(new), new, false);
1082 write_unlock_irqrestore(&ls->lock, flags);
1088 * labelset_of_merge - find which labelset a merged label should be inserted
1089 * @a: label to merge and insert
1090 * @b: label to merge and insert
1092 * Returns: labelset that the merged label should be inserted into
1094 static struct aa_labelset *labelset_of_merge(struct aa_label *a,
1097 struct aa_ns *nsa = labels_ns(a);
1098 struct aa_ns *nsb = labels_ns(b);
1100 if (ns_cmp(nsa, nsb) <= 0)
1101 return &nsa->labels;
1102 return &nsb->labels;
1106 * __label_find_merge - find label that is equiv to merge of @a and @b
1107 * @ls: set of labels to search (NOT NULL)
1108 * @a: label to merge with @b (NOT NULL)
1109 * @b: label to merge with @a (NOT NULL)
1111 * Requires: ls->lock read_lock held
1113 * Returns: ref counted label that is equiv to merge of @a and @b
1114 * else NULL if merge of @a and @b is not in set
1116 static struct aa_label *__label_find_merge(struct aa_labelset *ls,
1120 struct rb_node *node;
1127 return __label_find(a);
1129 node = ls->root.rb_node;
1131 struct aa_label *this = container_of(node, struct aa_label,
1133 int result = label_merge_cmp(a, b, this);
1136 node = node->rb_left;
1137 else if (result > 0)
1138 node = node->rb_right;
1140 return __aa_get_label(this);
1148 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1149 * @a: label to merge with @b (NOT NULL)
1150 * @b: label to merge with @a (NOT NULL)
1152 * Requires: labels be fully constructed with a valid ns
1154 * Returns: ref counted label that is equiv to merge of @a and @b
1155 * else NULL if merge of @a and @b is not in set
1157 struct aa_label *aa_label_find_merge(struct aa_label *a, struct aa_label *b)
1159 struct aa_labelset *ls;
1160 struct aa_label *label, *ar = NULL, *br = NULL;
1161 unsigned long flags;
1166 if (label_is_stale(a))
1167 a = ar = aa_get_newest_label(a);
1168 if (label_is_stale(b))
1169 b = br = aa_get_newest_label(b);
1170 ls = labelset_of_merge(a, b);
1171 read_lock_irqsave(&ls->lock, flags);
1172 label = __label_find_merge(ls, a, b);
1173 read_unlock_irqrestore(&ls->lock, flags);
1181 * aa_label_merge - attempt to insert new merged label of @a and @b
1182 * @ls: set of labels to insert label into (NOT NULL)
1183 * @a: label to merge with @b (NOT NULL)
1184 * @b: label to merge with @a (NOT NULL)
1185 * @gfp: memory allocation type
1187 * Requires: caller to hold valid refs on @a and @b
1188 * labels be fully constructed with a valid ns
1190 * Returns: ref counted new label if successful in inserting merge of a & b
1191 * else ref counted equivalent label that is already in the set.
1192 * else NULL if could not create label (-ENOMEM)
1194 struct aa_label *aa_label_merge(struct aa_label *a, struct aa_label *b,
1197 struct aa_label *label = NULL;
1203 return aa_get_newest_label(a);
1205 /* TODO: enable when read side is lockless
1206 * check if label exists before taking locks
1207 if (!label_is_stale(a) && !label_is_stale(b))
1208 label = aa_label_find_merge(a, b);
1212 struct aa_label *new;
1214 a = aa_get_newest_label(a);
1215 b = aa_get_newest_label(b);
1217 /* could use label_merge_len(a, b), but requires double
1218 * comparison for small savings
1220 new = aa_label_alloc(a->size + b->size, NULL, gfp);
1224 label = label_merge_insert(new, a, b);
1225 label_free_or_put_new(label, new);
1234 static inline bool label_is_visible(struct aa_profile *profile,
1235 struct aa_label *label)
1237 return aa_ns_visible(profile->ns, labels_ns(label), true);
1240 /* match a profile and its associated ns component if needed
1241 * Assumes visibility test has already been done.
1242 * If a subns profile is not to be matched should be prescreened with
1245 static inline unsigned int match_component(struct aa_profile *profile,
1246 struct aa_profile *tp,
1249 const char *ns_name;
1251 if (profile->ns == tp->ns)
1252 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1254 /* try matching with namespace name and then profile */
1255 ns_name = aa_ns_name(profile->ns, tp->ns, true);
1256 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1257 state = aa_dfa_match(profile->policy.dfa, state, ns_name);
1258 state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
1259 return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
1263 * label_compound_match - find perms for full compound label
1264 * @profile: profile to find perms for
1265 * @label: label to check access permissions for
1266 * @start: state to start match in
1267 * @subns: whether to do permission checks on components in a subns
1268 * @request: permissions to request
1269 * @perms: perms struct to set
1271 * Returns: 0 on success else ERROR
1273 * For the label A//&B//&C this does the perm match for A//&B//&C
1274 * @perms should be preinitialized with allperms OR a previous permission
1275 * check to be stacked.
1277 static int label_compound_match(struct aa_profile *profile,
1278 struct aa_label *label,
1279 unsigned int state, bool subns, u32 request,
1280 struct aa_perms *perms)
1282 struct aa_profile *tp;
1285 /* find first subcomponent that is visible */
1286 label_for_each(i, label, tp) {
1287 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1289 state = match_component(profile, tp, state);
1295 /* no component visible */
1300 label_for_each_cont(i, label, tp) {
1301 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1303 state = aa_dfa_match(profile->policy.dfa, state, "//&");
1304 state = match_component(profile, tp, state);
1308 aa_compute_perms(profile->policy.dfa, state, perms);
1309 aa_apply_modes_to_perms(profile, perms);
1310 if ((perms->allow & request) != request)
1321 * label_components_match - find perms for all subcomponents of a label
1322 * @profile: profile to find perms for
1323 * @label: label to check access permissions for
1324 * @start: state to start match in
1325 * @subns: whether to do permission checks on components in a subns
1326 * @request: permissions to request
1327 * @perms: an initialized perms struct to add accumulation to
1329 * Returns: 0 on success else ERROR
1331 * For the label A//&B//&C this does the perm match for each of A and B and C
1332 * @perms should be preinitialized with allperms OR a previous permission
1333 * check to be stacked.
1335 static int label_components_match(struct aa_profile *profile,
1336 struct aa_label *label, unsigned int start,
1337 bool subns, u32 request,
1338 struct aa_perms *perms)
1340 struct aa_profile *tp;
1342 struct aa_perms tmp;
1343 unsigned int state = 0;
1345 /* find first subcomponent to test */
1346 label_for_each(i, label, tp) {
1347 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1349 state = match_component(profile, tp, start);
1355 /* no subcomponents visible - no change in perms */
1359 aa_compute_perms(profile->policy.dfa, state, &tmp);
1360 aa_apply_modes_to_perms(profile, &tmp);
1361 aa_perms_accum(perms, &tmp);
1362 label_for_each_cont(i, label, tp) {
1363 if (!aa_ns_visible(profile->ns, tp->ns, subns))
1365 state = match_component(profile, tp, start);
1368 aa_compute_perms(profile->policy.dfa, state, &tmp);
1369 aa_apply_modes_to_perms(profile, &tmp);
1370 aa_perms_accum(perms, &tmp);
1373 if ((perms->allow & request) != request)
1384 * aa_label_match - do a multi-component label match
1385 * @profile: profile to match against (NOT NULL)
1386 * @label: label to match (NOT NULL)
1387 * @state: state to start in
1388 * @subns: whether to match subns components
1389 * @request: permission request
1390 * @perms: Returns computed perms (NOT NULL)
1392 * Returns: the state the match finished in, may be the none matching state
1394 int aa_label_match(struct aa_profile *profile, struct aa_label *label,
1395 unsigned int state, bool subns, u32 request,
1396 struct aa_perms *perms)
1398 int error = label_compound_match(profile, label, state, subns, request,
1404 return label_components_match(profile, label, state, subns, request,
1410 * aa_update_label_name - update a label to have a stored name
1411 * @ns: ns being viewed from (NOT NULL)
1412 * @label: label to update (NOT NULL)
1413 * @gfp: type of memory allocation
1415 * Requires: labels_set(label) not locked in caller
1417 * note: only updates the label name if it does not have a name already
1418 * and if it is in the labelset
1420 bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
1422 struct aa_labelset *ls;
1423 unsigned long flags;
1424 char __counted *name;
1430 if (label->hname || labels_ns(label) != ns)
1433 if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
1436 ls = labels_set(label);
1437 write_lock_irqsave(&ls->lock, flags);
1438 if (!label->hname && label->flags & FLAG_IN_TREE) {
1439 label->hname = name;
1443 write_unlock_irqrestore(&ls->lock, flags);
1449 * cached label name is present and visible
1450 * @label->hname only exists if label is namespace hierachical
1452 static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label,
1455 if (label->hname && (!ns || labels_ns(label) == ns) &&
1456 !(flags & ~FLAG_SHOW_MODE))
1462 /* helper macro for snprint routines */
1463 #define update_for_len(total, len, size, str) \
1467 len = min(len, size); \
1473 * aa_profile_snxprint - print a profile name to a buffer
1474 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1475 * @size: size of buffer
1476 * @view: namespace profile is being viewed from
1477 * @profile: profile to view (NOT NULL)
1478 * @flags: whether to include the mode string
1479 * @prev_ns: last ns printed when used in compound print
1481 * Returns: size of name written or would be written if larger than
1484 * Note: will not print anything if the profile is not visible
1486 static int aa_profile_snxprint(char *str, size_t size, struct aa_ns *view,
1487 struct aa_profile *profile, int flags,
1488 struct aa_ns **prev_ns)
1490 const char *ns_name = NULL;
1492 AA_BUG(!str && size != 0);
1496 view = profiles_ns(profile);
1498 if (view != profile->ns &&
1499 (!prev_ns || (*prev_ns != profile->ns))) {
1501 *prev_ns = profile->ns;
1502 ns_name = aa_ns_name(view, profile->ns,
1503 flags & FLAG_VIEW_SUBNS);
1504 if (ns_name == aa_hidden_ns_name) {
1505 if (flags & FLAG_HIDDEN_UNCONFINED)
1506 return snprintf(str, size, "%s", "unconfined");
1507 return snprintf(str, size, "%s", ns_name);
1511 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) {
1512 const char *modestr = aa_profile_mode_names[profile->mode];
1515 return snprintf(str, size, ":%s:%s (%s)", ns_name,
1516 profile->base.hname, modestr);
1517 return snprintf(str, size, "%s (%s)", profile->base.hname,
1522 return snprintf(str, size, ":%s:%s", ns_name,
1523 profile->base.hname);
1524 return snprintf(str, size, "%s", profile->base.hname);
1527 static const char *label_modename(struct aa_ns *ns, struct aa_label *label,
1530 struct aa_profile *profile;
1532 int mode = -1, count = 0;
1534 label_for_each(i, label, profile) {
1535 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1536 if (profile->mode == APPARMOR_UNCONFINED)
1537 /* special case unconfined so stacks with
1538 * unconfined don't report as mixed. ie.
1539 * profile_foo//&:ns1:unconfined (mixed)
1544 mode = profile->mode;
1545 else if (mode != profile->mode)
1553 /* everything was unconfined */
1554 mode = APPARMOR_UNCONFINED;
1556 return aa_profile_mode_names[mode];
1559 /* if any visible label is not unconfined the display_mode returns true */
1560 static inline bool display_mode(struct aa_ns *ns, struct aa_label *label,
1563 if ((flags & FLAG_SHOW_MODE)) {
1564 struct aa_profile *profile;
1567 label_for_each(i, label, profile) {
1568 if (aa_ns_visible(ns, profile->ns,
1569 flags & FLAG_VIEW_SUBNS) &&
1570 profile != profile->ns->unconfined)
1573 /* only ns->unconfined in set of profiles in ns */
1581 * aa_label_snxprint - print a label name to a string buffer
1582 * @str: buffer to write to. (MAY BE NULL if @size == 0)
1583 * @size: size of buffer
1584 * @ns: namespace profile is being viewed from
1585 * @label: label to view (NOT NULL)
1586 * @flags: whether to include the mode string
1588 * Returns: size of name written or would be written if larger than
1591 * Note: labels do not have to be strictly hierarchical to the ns as
1592 * objects may be shared across different namespaces and thus
1593 * pickup labeling from each ns. If a particular part of the
1594 * label is not visible it will just be excluded. And if none
1595 * of the label is visible "---" will be used.
1597 int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
1598 struct aa_label *label, int flags)
1600 struct aa_profile *profile;
1601 struct aa_ns *prev_ns = NULL;
1603 int count = 0, total = 0;
1606 AA_BUG(!str && size != 0);
1609 if (flags & FLAG_ABS_ROOT) {
1611 len = snprintf(str, size, "=");
1612 update_for_len(total, len, size, str);
1614 ns = labels_ns(label);
1617 label_for_each(i, label, profile) {
1618 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
1620 len = snprintf(str, size, "//&");
1621 update_for_len(total, len, size, str);
1623 len = aa_profile_snxprint(str, size, ns, profile,
1624 flags & FLAG_VIEW_SUBNS,
1626 update_for_len(total, len, size, str);
1632 if (flags & FLAG_HIDDEN_UNCONFINED)
1633 return snprintf(str, size, "%s", "unconfined");
1634 return snprintf(str, size, "%s", aa_hidden_ns_name);
1637 /* count == 1 && ... is for backwards compat where the mode
1638 * is not displayed for 'unconfined' in the current ns
1640 if (display_mode(ns, label, flags)) {
1641 len = snprintf(str, size, " (%s)",
1642 label_modename(ns, label, flags));
1643 update_for_len(total, len, size, str);
1648 #undef update_for_len
1651 * aa_label_asxprint - allocate a string buffer and print label into it
1652 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1653 * @ns: namespace profile is being viewed from
1654 * @label: label to view (NOT NULL)
1655 * @flags: flags controlling what label info is printed
1656 * @gfp: kernel memory allocation type
1658 * Returns: size of name written or would be written if larger than
1661 int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
1662 int flags, gfp_t gfp)
1669 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1673 *strp = kmalloc(size + 1, gfp);
1676 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1680 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1681 * @strp: buffer to write to. (MAY BE NULL if @size == 0)
1682 * @ns: namespace profile is being viewed from
1683 * @label: label to view (NOT NULL)
1684 * @flags: flags controlling what label info is printed
1685 * @gfp: kernel memory allocation type
1687 * Returns: size of name written or would be written if larger than
1690 int aa_label_acntsxprint(char __counted **strp, struct aa_ns *ns,
1691 struct aa_label *label, int flags, gfp_t gfp)
1698 size = aa_label_snxprint(NULL, 0, ns, label, flags);
1702 *strp = aa_str_alloc(size + 1, gfp);
1705 return aa_label_snxprint(*strp, size + 1, ns, label, flags);
1709 void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
1710 struct aa_label *label, int flags, gfp_t gfp)
1719 if (!use_label_hname(ns, label, flags) ||
1720 display_mode(ns, label, flags)) {
1721 len = aa_label_asxprint(&name, ns, label, flags, gfp);
1723 AA_DEBUG("label print error");
1728 str = (char *) label->hname;
1731 if (audit_string_contains_control(str, len))
1732 audit_log_n_hex(ab, str, len);
1734 audit_log_n_string(ab, str, len);
1739 void aa_label_seq_xprint(struct seq_file *f, struct aa_ns *ns,
1740 struct aa_label *label, int flags, gfp_t gfp)
1745 if (!use_label_hname(ns, label, flags)) {
1749 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1751 AA_DEBUG("label print error");
1754 seq_printf(f, "%s", str);
1756 } else if (display_mode(ns, label, flags))
1757 seq_printf(f, "%s (%s)", label->hname,
1758 label_modename(ns, label, flags));
1760 seq_printf(f, "%s", label->hname);
1763 void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags,
1768 if (!use_label_hname(ns, label, flags)) {
1772 len = aa_label_asxprint(&str, ns, label, flags, gfp);
1774 AA_DEBUG("label print error");
1779 } else if (display_mode(ns, label, flags))
1780 pr_info("%s (%s)", label->hname,
1781 label_modename(ns, label, flags));
1783 pr_info("%s", label->hname);
1786 void aa_label_audit(struct audit_buffer *ab, struct aa_label *label, gfp_t gfp)
1788 struct aa_ns *ns = aa_get_current_ns();
1790 aa_label_xaudit(ab, ns, label, FLAG_VIEW_SUBNS, gfp);
1794 void aa_label_seq_print(struct seq_file *f, struct aa_label *label, gfp_t gfp)
1796 struct aa_ns *ns = aa_get_current_ns();
1798 aa_label_seq_xprint(f, ns, label, FLAG_VIEW_SUBNS, gfp);
1802 void aa_label_printk(struct aa_label *label, gfp_t gfp)
1804 struct aa_ns *ns = aa_get_current_ns();
1806 aa_label_xprintk(ns, label, FLAG_VIEW_SUBNS, gfp);
1810 static int label_count_strn_entries(const char *str, size_t n)
1812 const char *end = str + n;
1818 for (split = aa_label_strn_split(str, end - str);
1820 split = aa_label_strn_split(str, end - str)) {
1829 * ensure stacks with components like
1831 * have :ns: applied to both 'A' and 'B' by making the lookup relative
1832 * to the base if the lookup specifies an ns, else making the stacked lookup
1833 * relative to the last embedded ns in the string.
1835 static struct aa_profile *fqlookupn_profile(struct aa_label *base,
1836 struct aa_label *currentbase,
1837 const char *str, size_t n)
1839 const char *first = skipn_spaces(str, n);
1841 if (first && *first == ':')
1842 return aa_fqlookupn_profile(base, str, n);
1844 return aa_fqlookupn_profile(currentbase, str, n);
1848 * aa_label_strn_parse - parse, validate and convert a text string to a label
1849 * @base: base label to use for lookups (NOT NULL)
1850 * @str: null terminated text string (NOT NULL)
1851 * @n: length of str to parse, will stop at \0 if encountered before n
1852 * @gfp: allocation type
1853 * @create: true if should create compound labels if they don't exist
1854 * @force_stack: true if should stack even if no leading &
1856 * Returns: the matching refcounted label if present
1859 struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
1860 size_t n, gfp_t gfp, bool create,
1863 DEFINE_VEC(profile, vec);
1864 struct aa_label *label, *currbase = base;
1865 int i, len, stack = 0, error;
1866 const char *end = str + n;
1872 str = skipn_spaces(str, n);
1873 if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label))
1874 return ERR_PTR(-EINVAL);
1876 len = label_count_strn_entries(str, end - str);
1877 if (*str == '&' || force_stack) {
1878 /* stack on top of base */
1885 error = vec_setup(profile, vec, len, gfp);
1887 return ERR_PTR(error);
1889 for (i = 0; i < stack; i++)
1890 vec[i] = aa_get_profile(base->vec[i]);
1892 for (split = aa_label_strn_split(str, end - str), i = stack;
1893 split && i < len; i++) {
1894 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
1898 * if component specified a new ns it becomes the new base
1899 * so that subsequent lookups are relative to it
1901 if (vec[i]->ns != labels_ns(currbase))
1902 currbase = &vec[i]->label;
1904 split = aa_label_strn_split(str, end - str);
1906 /* last element doesn't have a split */
1908 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
1913 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
1914 return &vec[0]->label;
1916 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
1917 /* TODO: deal with reference labels */
1919 label = aa_get_label(&vec[0]->label);
1924 label = aa_vec_find_or_create_label(vec, len, gfp);
1926 label = vec_find(vec, len);
1931 /* use adjusted len from after vec_unique, not original */
1932 vec_cleanup(profile, vec, len);
1936 label = ERR_PTR(-ENOENT);
1940 struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
1941 gfp_t gfp, bool create, bool force_stack)
1943 return aa_label_strn_parse(base, str, strlen(str), gfp, create,
1948 * aa_labelset_destroy - remove all labels from the label set
1949 * @ls: label set to cleanup (NOT NULL)
1951 * Labels that are removed from the set may still exist beyond the set
1952 * being destroyed depending on their reference counting
1954 void aa_labelset_destroy(struct aa_labelset *ls)
1956 struct rb_node *node;
1957 unsigned long flags;
1961 write_lock_irqsave(&ls->lock, flags);
1962 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) {
1963 struct aa_label *this = rb_entry(node, struct aa_label, node);
1965 if (labels_ns(this) != root_ns)
1966 __label_remove(this,
1967 ns_unconfined(labels_ns(this)->parent));
1969 __label_remove(this, NULL);
1971 write_unlock_irqrestore(&ls->lock, flags);
1975 * @ls: labelset to init (NOT NULL)
1977 void aa_labelset_init(struct aa_labelset *ls)
1981 rwlock_init(&ls->lock);
1985 static struct aa_label *labelset_next_stale(struct aa_labelset *ls)
1987 struct aa_label *label;
1988 struct rb_node *node;
1989 unsigned long flags;
1993 read_lock_irqsave(&ls->lock, flags);
1995 __labelset_for_each(ls, node) {
1996 label = rb_entry(node, struct aa_label, node);
1997 if ((label_is_stale(label) ||
1998 vec_is_stale(label->vec, label->size)) &&
1999 __aa_get_label(label))
2006 read_unlock_irqrestore(&ls->lock, flags);
2012 * __label_update - insert updated version of @label into labelset
2013 * @label - the label to update/replace
2015 * Returns: new label that is up to date
2016 * else NULL on failure
2018 * Requires: @ns lock be held
2020 * Note: worst case is the stale @label does not get updated and has
2021 * to be updated at a later time.
2023 static struct aa_label *__label_update(struct aa_label *label)
2025 struct aa_label *new, *tmp;
2026 struct aa_labelset *ls;
2027 unsigned long flags;
2028 int i, invcount = 0;
2031 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock));
2033 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL);
2038 * while holding the ns_lock will stop profile replacement, removal,
2039 * and label updates, label merging and removal can be occurring
2041 ls = labels_set(label);
2042 write_lock_irqsave(&ls->lock, flags);
2043 for (i = 0; i < label->size; i++) {
2044 AA_BUG(!label->vec[i]);
2045 new->vec[i] = aa_get_newest_profile(label->vec[i]);
2046 AA_BUG(!new->vec[i]);
2047 AA_BUG(!new->vec[i]->label.proxy);
2048 AA_BUG(!new->vec[i]->label.proxy->label);
2049 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy)
2053 /* updated stale label by being removed/renamed from labelset */
2055 new->size -= aa_vec_unique(&new->vec[0], new->size,
2056 VEC_FLAG_TERMINATE);
2057 /* TODO: deal with reference labels */
2058 if (new->size == 1) {
2059 tmp = aa_get_label(&new->vec[0]->label);
2060 AA_BUG(tmp == label);
2063 if (labels_set(label) != labels_set(new)) {
2064 write_unlock_irqrestore(&ls->lock, flags);
2065 tmp = aa_label_insert(labels_set(new), new);
2066 write_lock_irqsave(&ls->lock, flags);
2070 AA_BUG(labels_ns(label) != labels_ns(new));
2072 tmp = __label_insert(labels_set(label), new, true);
2074 /* ensure label is removed, and redirected correctly */
2075 __label_remove(label, tmp);
2076 write_unlock_irqrestore(&ls->lock, flags);
2077 label_free_or_put_new(tmp, new);
2083 * __labelset_update - update labels in @ns
2084 * @ns: namespace to update labels in (NOT NULL)
2086 * Requires: @ns lock be held
2088 * Walk the labelset ensuring that all labels are up to date and valid
2089 * Any label that has a stale component is marked stale and replaced and
2090 * by an updated version.
2092 * If failures happen due to memory pressures then stale labels will
2093 * be left in place until the next pass.
2095 static void __labelset_update(struct aa_ns *ns)
2097 struct aa_label *label;
2100 AA_BUG(!mutex_is_locked(&ns->lock));
2103 label = labelset_next_stale(&ns->labels);
2105 struct aa_label *l = __label_update(label);
2108 aa_put_label(label);
2114 * __aa_labelset_udate_subtree - update all labels with a stale component
2115 * @ns: ns to start update at (NOT NULL)
2117 * Requires: @ns lock be held
2119 * Invalidates labels based on @p in @ns and any children namespaces.
2121 void __aa_labelset_update_subtree(struct aa_ns *ns)
2123 struct aa_ns *child;
2126 AA_BUG(!mutex_is_locked(&ns->lock));
2128 __labelset_update(ns);
2130 list_for_each_entry(child, &ns->sub_ns, base.list) {
2131 mutex_lock_nested(&child->lock, child->level);
2132 __aa_labelset_update_subtree(child);
2133 mutex_unlock(&child->lock);