Lines Matching +full:state +full:- +full:labels
1 // SPDX-License-Identifier: GPL-2.0-only
24 * Labels maintain a reference count to the set of pointers they reference
25 * Labels are ref counted by
27 * code - will take a ref count on a label if it needs the label
29 * profiles - each profile is a label
30 * secids - a pinned secid will keep a refcount of the label it is
32 * objects - inode, files, sockets, ...
34 * Labels are not ref counted by the label set, so they maybe removed and
45 /* p->label will not updated any more as p is dead */ in free_proxy()
46 aa_put_label(rcu_dereference_protected(proxy->label, true)); in free_proxy()
48 RCU_INIT_POINTER(proxy->label, (struct aa_label *)PROXY_POISON); in free_proxy()
66 kref_init(&new->count); in aa_alloc_proxy()
67 rcu_assign_pointer(new->label, aa_get_label(label)); in aa_alloc_proxy()
79 lockdep_assert_held_write(&labels_set(orig)->lock); in __aa_proxy_redirect()
81 tmp = rcu_dereference_protected(orig->proxy->label, in __aa_proxy_redirect()
82 &labels_ns(orig)->lock); in __aa_proxy_redirect()
83 rcu_assign_pointer(orig->proxy->label, aa_get_label(new)); in __aa_proxy_redirect()
84 orig->flags |= FLAG_STALE; in __aa_proxy_redirect()
90 struct aa_proxy *proxy = new->proxy; in __proxy_share()
92 new->proxy = aa_get_proxy(old->proxy); in __proxy_share()
99 * ns_cmp - compare ns for label set ordering
113 AA_BUG(!a->base.hname); in ns_cmp()
114 AA_BUG(!b->base.hname); in ns_cmp()
119 res = a->level - b->level; in ns_cmp()
123 return strcmp(a->base.hname, b->base.hname); in ns_cmp()
127 * profile_cmp - profile comparison for set ordering
141 AA_BUG(!a->ns); in profile_cmp()
142 AA_BUG(!b->ns); in profile_cmp()
143 AA_BUG(!a->base.hname); in profile_cmp()
144 AA_BUG(!b->base.hname); in profile_cmp()
146 if (a == b || a->base.hname == b->base.hname) in profile_cmp()
148 res = ns_cmp(a->ns, b->ns); in profile_cmp()
152 return strcmp(a->base.hname, b->base.hname); in profile_cmp()
156 * vec_cmp - label comparison for set ordering
184 return an - bn; in vec_cmp()
209 u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 | in accum_vec_flags()
211 if (!(u & vec[i]->label.flags & FLAG_UNCONFINED)) in accum_vec_flags()
226 * vec[n - dups]
257 * aa_vec_unique - canonical sort and unique a list of profiles
265 * null terminate vec[n - dups]
286 for (pos = i - 1 - dups; pos >= 0; pos--) { in aa_vec_unique()
297 /* pos is at entry < tmp, or index -1. Set to insert pos */ in aa_vec_unique()
300 for (j = i - dups; j > pos; j--) in aa_vec_unique()
301 vec[j] = vec[j - 1]; in aa_vec_unique()
311 vec[n - dups] = NULL; in aa_vec_unique()
325 aa_put_str(label->hname); in aa_label_destroy()
329 label->vec[i.i] = (struct aa_profile *) in aa_label_destroy()
334 if (label->proxy) { in aa_label_destroy()
335 if (rcu_dereference_protected(label->proxy->label, true) == label) in aa_label_destroy()
336 rcu_assign_pointer(label->proxy->label, NULL); in aa_label_destroy()
337 aa_put_proxy(label->proxy); in aa_label_destroy()
339 aa_free_secid(label->secid); in aa_label_destroy()
341 label->proxy = (struct aa_proxy *) PROXY_POISON + 1; in aa_label_destroy()
355 if (label->flags & FLAG_NS_COUNT) in label_free_switch()
367 if (label->flags & FLAG_IN_TREE) in label_free_rcu()
384 on_list_rcu(&label->vec[0]->base.profiles)); in aa_label_kref()
386 on_list_rcu(&label->vec[0]->base.list)); in aa_label_kref()
389 call_rcu(&label->rcu, label_free_rcu); in aa_label_kref()
409 label->size = size; /* doesn't include null */ in aa_label_init()
410 label->vec[size] = NULL; /* null terminate */ in aa_label_init()
411 kref_init(&label->count); in aa_label_init()
412 RB_CLEAR_NODE(&label->node); in aa_label_init()
418 * aa_label_alloc - allocate a label with a profile vector of @size length
448 new->proxy = proxy; in aa_label_alloc()
460 * label_cmp - label comparison for set ordering
475 return vec_cmp(a->vec, a->size, b->vec, b->size); in label_cmp()
484 for (; i < label->size; i++) { in aa_label_next_confined()
485 if (!profile_unconfined(label->vec[i])) in aa_label_next_confined()
493 * __aa_label_next_not_in_set - return the next profile of @sub not in @set
507 AA_BUG(I->i < 0); in __aa_label_next_not_in_set()
508 AA_BUG(I->i > set->size); in __aa_label_next_not_in_set()
510 AA_BUG(I->j < 0); in __aa_label_next_not_in_set()
511 AA_BUG(I->j > sub->size); in __aa_label_next_not_in_set()
513 while (I->j < sub->size && I->i < set->size) { in __aa_label_next_not_in_set()
514 int res = profile_cmp(sub->vec[I->j], set->vec[I->i]); in __aa_label_next_not_in_set()
517 (I->j)++; in __aa_label_next_not_in_set()
518 (I->i)++; in __aa_label_next_not_in_set()
520 (I->i)++; in __aa_label_next_not_in_set()
522 return sub->vec[(I->j)++]; in __aa_label_next_not_in_set()
525 if (I->j < sub->size) in __aa_label_next_not_in_set()
526 return sub->vec[(I->j)++]; in __aa_label_next_not_in_set()
532 * aa_label_is_subset - test if @sub is a subset of @set
553 * aa_label_is_unconfined_subset - test if @sub is a subset of @set
588 * __label_remove - remove @label from the label set
592 * Requires: labels_set(@label)->lock write_lock
601 lockdep_assert_held_write(&ls->lock); in __label_remove()
609 if (label->flags & FLAG_IN_TREE) { in __label_remove()
610 rb_erase(&label->node, &ls->root); in __label_remove()
611 label->flags &= ~FLAG_IN_TREE; in __label_remove()
619 * __label_replace - replace @old with @new in label set
623 * Requires: labels_set(@old)->lock write_lock
638 lockdep_assert_held_write(&ls->lock); in __label_replace()
639 AA_BUG(new->flags & FLAG_IN_TREE); in __label_replace()
644 if (old->flags & FLAG_IN_TREE) { in __label_replace()
645 rb_replace_node(&old->node, &new->node, &ls->root); in __label_replace()
646 old->flags &= ~FLAG_IN_TREE; in __label_replace()
647 new->flags |= FLAG_IN_TREE; in __label_replace()
655 * __label_insert - attempt to insert @l into a label set
656 * @ls: set of labels to insert @l into (NOT NULL)
660 * Requires: @ls->lock
663 * Returns: @l if successful in inserting @l - with additional refcount
675 lockdep_assert_held_write(&ls->lock); in __label_insert()
676 AA_BUG(label->flags & FLAG_IN_TREE); in __label_insert()
679 new = &ls->root.rb_node; in __label_insert()
699 new = &((*new)->rb_left); in __label_insert()
701 new = &((*new)->rb_right); in __label_insert()
705 rb_link_node(&label->node, parent, new); in __label_insert()
706 rb_insert_color(&label->node, &ls->root); in __label_insert()
707 label->flags |= FLAG_IN_TREE; in __label_insert()
713 * __vec_find - find label that matches @vec in label set
732 node = vec_labelset(vec, n)->root.rb_node; in __vec_find()
735 int result = vec_cmp(this->vec, this->size, vec, n); in __vec_find()
738 node = node->rb_left; in __vec_find()
740 node = node->rb_right; in __vec_find()
749 * __label_find - find label @label in label set
752 * Requires: labels_set(@label)->lock held
763 return __vec_find(label->vec, label->size); in __label_find()
768 * aa_label_remove - remove a label from the labelset
782 write_lock_irqsave(&ls->lock, flags); in aa_label_remove()
784 write_unlock_irqrestore(&ls->lock, flags); in aa_label_remove()
790 * aa_label_replace - replace a label @old with a new version @new
803 write_lock_irqsave(&labels_set(old)->lock, flags); in aa_label_replace()
804 if (old->proxy != new->proxy) in aa_label_replace()
809 write_unlock_irqrestore(&labels_set(old)->lock, flags); in aa_label_replace()
814 write_lock_irqsave(&ls->lock, flags); in aa_label_replace()
817 write_unlock_irqrestore(&ls->lock, flags); in aa_label_replace()
819 write_lock_irqsave(&ls->lock, flags); in aa_label_replace()
823 write_unlock_irqrestore(&ls->lock, flags); in aa_label_replace()
831 * vec_find - find label @l in label set
849 read_lock_irqsave(&ls->lock, flags); in vec_find()
851 read_unlock_irqrestore(&ls->lock, flags); in vec_find()
869 return aa_get_label(&vec[0]->label); in vec_create_and_insert_label()
871 ls = labels_set(&vec[len - 1]->label); in vec_create_and_insert_label()
881 new->vec[i] = aa_get_profile(vec[i]); in vec_create_and_insert_label()
883 write_lock_irqsave(&ls->lock, flags); in vec_create_and_insert_label()
885 write_unlock_irqrestore(&ls->lock, flags); in vec_create_and_insert_label()
903 * aa_label_find - find label @label in label set
916 return vec_find(label->vec, label->size); in aa_label_find()
921 * aa_label_insert - insert label @label into @ls or return existing label
940 read_lock_irqsave(&ls->lock, flags); in aa_label_insert()
942 read_unlock_irqrestore(&ls->lock, flags); in aa_label_insert()
947 write_lock_irqsave(&ls->lock, flags); in aa_label_insert()
949 write_unlock_irqrestore(&ls->lock, flags); in aa_label_insert()
956 * aa_label_next_in_merge - find the next profile when merging @a and @b
971 AA_BUG(I->i < 0); in aa_label_next_in_merge()
972 AA_BUG(I->i > a->size); in aa_label_next_in_merge()
973 AA_BUG(I->j < 0); in aa_label_next_in_merge()
974 AA_BUG(I->j > b->size); in aa_label_next_in_merge()
976 if (I->i < a->size) { in aa_label_next_in_merge()
977 if (I->j < b->size) { in aa_label_next_in_merge()
978 int res = profile_cmp(a->vec[I->i], b->vec[I->j]); in aa_label_next_in_merge()
981 return b->vec[(I->j)++]; in aa_label_next_in_merge()
983 (I->j)++; in aa_label_next_in_merge()
986 return a->vec[(I->i)++]; in aa_label_next_in_merge()
989 if (I->j < b->size) in aa_label_next_in_merge()
990 return b->vec[(I->j)++]; in aa_label_next_in_merge()
996 * label_merge_cmp - cmp of @a merging with @b against @z for set ordering
1019 k < z->size && (p = aa_label_next_in_merge(&i, a, b)); in label_merge_cmp()
1021 int res = profile_cmp(p, z->vec[k]); in label_merge_cmp()
1029 else if (k < z->size) in label_merge_cmp()
1030 return -1; in label_merge_cmp()
1035 * label_merge_insert - create a new label by merging @a and @b
1049 * setting labels stale.
1064 AA_BUG(a->size < 0); in label_merge_insert()
1066 AA_BUG(b->size < 0); in label_merge_insert()
1068 AA_BUG(new->size < a->size + b->size); in label_merge_insert()
1073 new->vec[k] = aa_get_newest_profile(next); in label_merge_insert()
1074 AA_BUG(!new->vec[k]->label.proxy); in label_merge_insert()
1075 AA_BUG(!new->vec[k]->label.proxy->label); in label_merge_insert()
1076 if (next->label.proxy != new->vec[k]->label.proxy) in label_merge_insert()
1081 new->vec[k++] = aa_get_profile(next); in label_merge_insert()
1084 new->size = k; in label_merge_insert()
1085 new->vec[k] = NULL; in label_merge_insert()
1088 new->size -= aa_vec_unique(&new->vec[0], new->size, in label_merge_insert()
1090 /* TODO: deal with reference labels */ in label_merge_insert()
1091 if (new->size == 1) { in label_merge_insert()
1092 label = aa_get_label(&new->vec[0]->label); in label_merge_insert()
1098 * for new->size == a->size == b->size unless a == b in label_merge_insert()
1100 if (k == a->size) in label_merge_insert()
1102 else if (k == b->size) in label_merge_insert()
1105 new->flags |= accum_vec_flags(new->vec, new->size); in label_merge_insert()
1107 write_lock_irqsave(&ls->lock, flags); in label_merge_insert()
1109 write_unlock_irqrestore(&ls->lock, flags); in label_merge_insert()
1115 * labelset_of_merge - find which labelset a merged label should be inserted
1128 return &nsa->labels; in labelset_of_merge()
1129 return &nsb->labels; in labelset_of_merge()
1133 * __label_find_merge - find label that is equiv to merge of @a and @b
1134 * @ls: set of labels to search (NOT NULL)
1138 * Requires: ls->lock read_lock held
1156 node = ls->root.rb_node; in __label_find_merge()
1163 node = node->rb_left; in __label_find_merge()
1165 node = node->rb_right; in __label_find_merge()
1175 * aa_label_find_merge - find label that is equiv to merge of @a and @b
1179 * Requires: labels be fully constructed with a valid ns
1198 read_lock_irqsave(&ls->lock, flags); in aa_label_find_merge()
1200 read_unlock_irqrestore(&ls->lock, flags); in aa_label_find_merge()
1208 * aa_label_merge - attempt to insert new merged label of @a and @b
1214 * labels be fully constructed with a valid ns
1218 * else NULL if could not create label (-ENOMEM)
1246 new = aa_label_alloc(a->size + b->size, NULL, gfp); in aa_label_merge()
1268 aa_state_t state) in match_component() argument
1272 if (profile->ns == tp->ns) in match_component()
1273 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname); in match_component()
1276 ns_name = aa_ns_name(profile->ns, tp->ns, true); in match_component()
1277 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); in match_component()
1278 state = aa_dfa_match(rules->policy->dfa, state, ns_name); in match_component()
1279 state = aa_dfa_match_len(rules->policy->dfa, state, ":", 1); in match_component()
1280 return aa_dfa_match(rules->policy->dfa, state, tp->base.hname); in match_component()
1284 * label_compound_match - find perms for full compound label
1288 * @state: state to start match in
1302 aa_state_t state, bool subns, u32 request, in label_compound_match() argument
1310 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
1312 state = match_component(profile, rules, tp, state); in label_compound_match()
1313 if (!state) in label_compound_match()
1324 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_compound_match()
1326 state = aa_dfa_match(rules->policy->dfa, state, "//&"); in label_compound_match()
1327 state = match_component(profile, rules, tp, state); in label_compound_match()
1328 if (!state) in label_compound_match()
1331 *perms = *aa_lookup_perms(rules->policy, state); in label_compound_match()
1333 if ((perms->allow & request) != request) in label_compound_match()
1334 return -EACCES; in label_compound_match()
1340 return state; in label_compound_match()
1344 * label_components_match - find perms for all subcomponents of a label
1348 * @start: state to start match in
1368 aa_state_t state = 0; in label_components_match() local
1372 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
1374 state = match_component(profile, rules, tp, start); in label_components_match()
1375 if (!state) in label_components_match()
1380 /* no subcomponents visible - no change in perms */ in label_components_match()
1384 tmp = *aa_lookup_perms(rules->policy, state); in label_components_match()
1388 if (!aa_ns_visible(profile->ns, tp->ns, subns)) in label_components_match()
1390 state = match_component(profile, rules, tp, start); in label_components_match()
1391 if (!state) in label_components_match()
1393 tmp = *aa_lookup_perms(rules->policy, state); in label_components_match()
1398 if ((perms->allow & request) != request) in label_components_match()
1399 return -EACCES; in label_components_match()
1405 return -EACCES; in label_components_match()
1409 * aa_label_match - do a multi-component label match
1413 * @state: state to start in
1418 * Returns: the state the match finished in, may be the none matching state
1421 struct aa_label *label, aa_state_t state, bool subns, in aa_label_match() argument
1424 int error = label_compound_match(profile, rules, label, state, subns, in aa_label_match()
1430 return label_components_match(profile, rules, label, state, subns, in aa_label_match()
1436 * aa_update_label_name - update a label to have a stored name
1456 if (label->hname || labels_ns(label) != ns) in aa_update_label_name()
1463 write_lock_irqsave(&ls->lock, flags); in aa_update_label_name()
1464 if (!label->hname && label->flags & FLAG_IN_TREE) { in aa_update_label_name()
1465 label->hname = name; in aa_update_label_name()
1469 write_unlock_irqrestore(&ls->lock, flags); in aa_update_label_name()
1476 * @label->hname only exists if label is namespace hierachical
1481 if (label->hname && (!ns || labels_ns(label) == ns) && in use_label_hname()
1496 size -= ulen; \
1501 * aa_profile_snxprint - print a profile name to a buffer
1526 if (view != profile->ns && in aa_profile_snxprint()
1527 (!prev_ns || (*prev_ns != profile->ns))) { in aa_profile_snxprint()
1529 *prev_ns = profile->ns; in aa_profile_snxprint()
1530 ns_name = aa_ns_name(view, profile->ns, in aa_profile_snxprint()
1539 if ((flags & FLAG_SHOW_MODE) && profile != profile->ns->unconfined) { in aa_profile_snxprint()
1540 const char *modestr = aa_profile_mode_names[profile->mode]; in aa_profile_snxprint()
1544 profile->base.hname, modestr); in aa_profile_snxprint()
1545 return snprintf(str, size, "%s (%s)", profile->base.hname, in aa_profile_snxprint()
1551 profile->base.hname); in aa_profile_snxprint()
1552 return snprintf(str, size, "%s", profile->base.hname); in aa_profile_snxprint()
1560 int mode = -1, count = 0; in label_modename()
1563 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { in label_modename()
1565 if (profile == profile->ns->unconfined) in label_modename()
1571 if (mode == -1) in label_modename()
1572 mode = profile->mode; in label_modename()
1573 else if (mode != profile->mode) in label_modename()
1579 return "-"; in label_modename()
1580 if (mode == -1) in label_modename()
1596 if (aa_ns_visible(ns, profile->ns, in display_mode()
1598 profile != profile->ns->unconfined) in display_mode()
1601 /* only ns->unconfined in set of profiles in ns */ in display_mode()
1609 * aa_label_snxprint - print a label name to a string buffer
1619 * Note: labels do not have to be strictly hierarchical to the ns as
1623 * of the label is visible "---" will be used.
1646 if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { in aa_label_snxprint()
1679 * aa_label_asxprint - allocate a string buffer and print label into it
1680 * @strp: Returns - the allocated buffer with the label name. (NOT NULL)
1703 return -ENOMEM; in aa_label_asxprint()
1708 * aa_label_acntsxprint - allocate a __counted string buffer and print label
1732 return -ENOMEM; in aa_label_acntsxprint()
1756 str = (char *) label->hname; in aa_label_xaudit()
1785 seq_printf(f, "%s (%s)", label->hname, in aa_label_seq_xprint()
1788 seq_puts(f, label->hname); in aa_label_seq_xprint()
1808 pr_info("%s (%s)", label->hname, in aa_label_xprintk()
1811 pr_info("%s", label->hname); in aa_label_xprintk()
1846 for (split = aa_label_strn_split(str, end - str); in label_count_strn_entries()
1848 split = aa_label_strn_split(str, end - str)) { in label_count_strn_entries()
1876 * aa_label_strn_parse - parse, validate and convert a text string to a label
1881 * @create: true if should create compound labels if they don't exist
1902 base != &root_ns->unconfined->label)) in aa_label_strn_parse()
1903 return ERR_PTR(-EINVAL); in aa_label_strn_parse()
1905 len = label_count_strn_entries(str, end - str); in aa_label_strn_parse()
1908 stack = base->size; in aa_label_strn_parse()
1919 vec[i] = aa_get_profile(base->vec[i]); in aa_label_strn_parse()
1921 for (split = aa_label_strn_split(str, end - str), i = stack; in aa_label_strn_parse()
1923 vec[i] = fqlookupn_profile(base, currbase, str, split - str); in aa_label_strn_parse()
1930 if (vec[i]->ns != labels_ns(currbase)) in aa_label_strn_parse()
1931 currbase = &vec[i]->label; in aa_label_strn_parse()
1933 split = aa_label_strn_split(str, end - str); in aa_label_strn_parse()
1937 vec[i] = fqlookupn_profile(base, currbase, str, end - str); in aa_label_strn_parse()
1943 return &vec[0]->label; in aa_label_strn_parse()
1945 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE); in aa_label_strn_parse()
1946 /* TODO: deal with reference labels */ in aa_label_strn_parse()
1948 label = aa_get_label(&vec[0]->label); in aa_label_strn_parse()
1965 label = ERR_PTR(-ENOENT); in aa_label_strn_parse()
1977 * aa_labelset_destroy - remove all labels from the label set
1980 * Labels that are removed from the set may still exist beyond the set
1990 write_lock_irqsave(&ls->lock, flags); in aa_labelset_destroy()
1991 for (node = rb_first(&ls->root); node; node = rb_first(&ls->root)) { in aa_labelset_destroy()
1996 ns_unconfined(labels_ns(this)->parent)); in aa_labelset_destroy()
2000 write_unlock_irqrestore(&ls->lock, flags); in aa_labelset_destroy()
2010 rwlock_init(&ls->lock); in aa_labelset_init()
2011 ls->root = RB_ROOT; in aa_labelset_init()
2022 read_lock_irqsave(&ls->lock, flags); in labelset_next_stale()
2027 vec_is_stale(label->vec, label->size)) && in labelset_next_stale()
2035 read_unlock_irqrestore(&ls->lock, flags); in labelset_next_stale()
2041 * __label_update - insert updated version of @label into labelset
2060 AA_BUG(!mutex_is_locked(&labels_ns(label)->lock)); in __label_update()
2062 new = aa_label_alloc(label->size, label->proxy, GFP_KERNEL); in __label_update()
2071 write_lock_irqsave(&ls->lock, flags); in __label_update()
2072 for (i = 0; i < label->size; i++) { in __label_update()
2073 AA_BUG(!label->vec[i]); in __label_update()
2074 new->vec[i] = aa_get_newest_profile(label->vec[i]); in __label_update()
2075 AA_BUG(!new->vec[i]); in __label_update()
2076 AA_BUG(!new->vec[i]->label.proxy); in __label_update()
2077 AA_BUG(!new->vec[i]->label.proxy->label); in __label_update()
2078 if (new->vec[i]->label.proxy != label->vec[i]->label.proxy) in __label_update()
2084 new->size -= aa_vec_unique(&new->vec[0], new->size, in __label_update()
2086 /* TODO: deal with reference labels */ in __label_update()
2087 if (new->size == 1) { in __label_update()
2088 tmp = aa_get_label(&new->vec[0]->label); in __label_update()
2093 write_unlock_irqrestore(&ls->lock, flags); in __label_update()
2095 write_lock_irqsave(&ls->lock, flags); in __label_update()
2105 write_unlock_irqrestore(&ls->lock, flags); in __label_update()
2112 * __labelset_update - update labels in @ns
2113 * @ns: namespace to update labels in (NOT NULL)
2117 * Walk the labelset ensuring that all labels are up to date and valid
2121 * If failures happen due to memory pressures then stale labels will
2129 AA_BUG(!mutex_is_locked(&ns->lock)); in __labelset_update()
2132 label = labelset_next_stale(&ns->labels); in __labelset_update()
2143 * __aa_labelset_update_subtree - update all labels with a stale component
2148 * Invalidates labels based on @p in @ns and any children namespaces.
2155 AA_BUG(!mutex_is_locked(&ns->lock)); in __aa_labelset_update_subtree()
2159 list_for_each_entry(child, &ns->sub_ns, base.list) { in __aa_labelset_update_subtree()
2160 mutex_lock_nested(&child->lock, child->level); in __aa_labelset_update_subtree()
2162 mutex_unlock(&child->lock); in __aa_labelset_update_subtree()