Lines Matching full:profile
11 * task is confined by. Every task in the system has a profile attached
15 * Each profile exists in a profile namespace which is a container of
16 * visible profiles. Each namespace contains a special "unconfined" profile,
19 * Namespace and profile names can be written together in either
21 * :namespace:profile - used by kernel interfaces for easy detection
22 * namespace://profile - used by policy
24 * Profile names can not start with : or @ or ^ and may not contain \0
26 * Reserved profile names
27 * unconfined - special automatically generated unconfined profile
28 * inherit - special name to indicate profile inheritance
35 * a // in a profile or namespace name indicates a hierarchical name with the
38 * Profile and namespace hierarchies serve two different but similar purposes.
43 * The profile hierarchy severs two distinct purposes,
45 * subprograms under its own profile with different restriction than it
46 * self, and not have it use the system profile.
52 * but is allowed. NOTE: this is currently suboptimal because profile
53 * aliasing is not currently implemented so that a profile for each
58 * A profile or namespace name that can contain one or more // separators
62 * An fqname is a name that may contain both namespace and profile hnames.
66 * - locking of profile lists is currently fairly coarse. All profile
68 * FIXME: move profile lists to using rcu_lists
141 * @profile: the profile to add (NOT NULL)
143 * refcount @profile, should be put by __list_remove_profile
147 static void __add_profile(struct list_head *list, struct aa_profile *profile) in __add_profile() argument
152 AA_BUG(!profile); in __add_profile()
153 AA_BUG(!profile->ns); in __add_profile()
154 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __add_profile()
156 list_add_rcu(&profile->base.list, list); in __add_profile()
158 aa_get_profile(profile); in __add_profile()
159 l = aa_label_insert(&profile->ns->labels, &profile->label); in __add_profile()
160 AA_BUG(l != &profile->label); in __add_profile()
165 * __list_remove_profile - remove a profile from the list it is on
166 * @profile: the profile to remove (NOT NULL)
168 * remove a profile from the list, warning generally removal should
169 * be done with __replace_profile as most profile removals are
170 * replacements to the unconfined profile.
172 * put @profile list refcount
176 static void __list_remove_profile(struct aa_profile *profile) in __list_remove_profile() argument
178 AA_BUG(!profile); in __list_remove_profile()
179 AA_BUG(!profile->ns); in __list_remove_profile()
180 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __list_remove_profile()
182 list_del_rcu(&profile->base.list); in __list_remove_profile()
183 aa_put_profile(profile); in __list_remove_profile()
187 * __remove_profile - remove old profile, and children
188 * @profile: profile to be replaced (NOT NULL)
192 static void __remove_profile(struct aa_profile *profile) in __remove_profile() argument
194 AA_BUG(!profile); in __remove_profile()
195 AA_BUG(!profile->ns); in __remove_profile()
196 AA_BUG(!mutex_is_locked(&profile->ns->lock)); in __remove_profile()
199 __aa_profile_list_release(&profile->base.profiles); in __remove_profile()
201 aa_label_remove(&profile->label); in __remove_profile()
202 __aafs_profile_rmdir(profile); in __remove_profile()
203 __list_remove_profile(profile); in __remove_profile()
214 struct aa_profile *profile, *tmp; in __aa_profile_list_release() local
215 list_for_each_entry_safe(profile, tmp, head, base.list) in __aa_profile_list_release()
216 __remove_profile(profile); in __aa_profile_list_release()
270 * aa_free_profile - free a profile
271 * @profile: the profile to free (MAYBE NULL)
273 * Free a profile, its hats and null_profile. All references to the profile,
276 * If the profile was referenced from a task context, free_profile() will
279 void aa_free_profile(struct aa_profile *profile) in aa_free_profile() argument
284 AA_DEBUG("%s(%p)\n", __func__, profile); in aa_free_profile()
286 if (!profile) in aa_free_profile()
290 aa_policy_destroy(&profile->base); in aa_free_profile()
291 aa_put_profile(rcu_access_pointer(profile->parent)); in aa_free_profile()
293 aa_put_ns(profile->ns); in aa_free_profile()
294 kfree_sensitive(profile->rename); in aa_free_profile()
295 kfree_sensitive(profile->disconnected); in aa_free_profile()
297 free_attachment(&profile->attach); in aa_free_profile()
303 list_for_each_entry_safe(rule, tmp, &profile->rules, list) { in aa_free_profile()
307 kfree_sensitive(profile->dirname); in aa_free_profile()
309 if (profile->data) { in aa_free_profile()
310 rht = profile->data; in aa_free_profile()
311 profile->data = NULL; in aa_free_profile()
316 kfree_sensitive(profile->hash); in aa_free_profile()
317 aa_put_loaddata(profile->rawdata); in aa_free_profile()
318 aa_label_destroy(&profile->label); in aa_free_profile()
320 kfree_sensitive(profile); in aa_free_profile()
324 * aa_alloc_profile - allocate, initialize and return a new profile
325 * @hname: name of the profile (NOT NULL)
329 * Returns: refcount profile or NULL on failure
334 struct aa_profile *profile; in aa_alloc_profile() local
338 profile = kzalloc(struct_size(profile, label.vec, 2), gfp); in aa_alloc_profile()
339 if (!profile) in aa_alloc_profile()
342 if (!aa_policy_init(&profile->base, NULL, hname, gfp)) in aa_alloc_profile()
344 if (!aa_label_init(&profile->label, 1, gfp)) in aa_alloc_profile()
347 INIT_LIST_HEAD(&profile->rules); in aa_alloc_profile()
353 list_add(&rules->list, &profile->rules); in aa_alloc_profile()
357 proxy = aa_alloc_proxy(&profile->label, gfp); in aa_alloc_profile()
362 profile->label.proxy = proxy; in aa_alloc_profile()
364 profile->label.hname = profile->base.hname; in aa_alloc_profile()
365 profile->label.flags |= FLAG_PROFILE; in aa_alloc_profile()
366 profile->label.vec[0] = profile; in aa_alloc_profile()
369 return profile; in aa_alloc_profile()
372 aa_free_profile(profile); in aa_alloc_profile()
377 /* TODO: profile accounting - setup in remove */
380 * __strn_find_child - find a profile on @head list using substring of @name
382 * @name: name of profile (NOT NULL)
387 * Returns: unrefcounted profile ptr, or NULL if not found
396 * __find_child - find a profile on @head list with a name matching @name
398 * @name: name of profile (NOT NULL)
402 * Returns: unrefcounted profile ptr, or NULL if not found
410 * aa_find_child - find a profile by @name in @parent
411 * @parent: profile to search (NOT NULL)
412 * @name: profile name to search for (NOT NULL)
414 * Returns: a refcounted profile or NULL if not found
418 struct aa_profile *profile; in aa_find_child() local
422 profile = __find_child(&parent->base.profiles, name); in aa_find_child()
423 } while (profile && !aa_get_profile_not0(profile)); in aa_find_child()
427 return profile; in aa_find_child()
431 * __lookup_parent - lookup the parent of a profile of name @hname
432 * @ns: namespace to lookup profile in (NOT NULL)
433 * @hname: hierarchical profile name to find parent of (NOT NULL)
435 * Lookups up the parent of a fully qualified profile name, the profile
437 * is used to load a new profile.
447 struct aa_profile *profile = NULL; in __lookup_parent() local
453 profile = __strn_find_child(&policy->profiles, hname, in __lookup_parent()
455 if (!profile) in __lookup_parent()
457 policy = &profile->base; in __lookup_parent()
461 if (!profile) in __lookup_parent()
463 return &profile->base; in __lookup_parent()
468 * @ns: namespace to lookup profile in (NOT NULL)
469 * @hname: hierarchical profile name to find parent of (NOT NULL)
482 struct aa_profile *parent, *profile = NULL; in __create_missing_ancestors() local
491 parent = profile; in __create_missing_ancestors()
492 profile = __strn_find_child(&policy->profiles, hname, in __create_missing_ancestors()
494 if (!profile) { in __create_missing_ancestors()
499 profile = aa_alloc_null(parent, name, gfp); in __create_missing_ancestors()
501 if (!profile) in __create_missing_ancestors()
504 profile->ns = aa_get_ns(ns); in __create_missing_ancestors()
506 policy = &profile->base; in __create_missing_ancestors()
510 if (!profile) in __create_missing_ancestors()
512 return &profile->base; in __create_missing_ancestors()
516 * __lookupn_profile - lookup the profile matching @hname
517 * @base: base list to start looking up profile name from (NOT NULL)
518 * @hname: hierarchical profile name (NOT NULL)
523 * Returns: unrefcounted profile pointer or NULL if not found
525 * Do a relative name lookup, recursing through profile tree.
530 struct aa_profile *profile = NULL; in __lookupn_profile() local
535 profile = __strn_find_child(&base->profiles, hname, in __lookupn_profile()
537 if (!profile) in __lookupn_profile()
540 base = &profile->base; in __lookupn_profile()
557 * aa_lookupn_profile - find a profile by its full or partial name
562 * Returns: refcounted profile or NULL if not found
567 struct aa_profile *profile; in aa_lookupn_profile() local
571 profile = __lookupn_profile(&ns->base, hname, n); in aa_lookupn_profile()
572 } while (profile && !aa_get_profile_not0(profile)); in aa_lookupn_profile()
575 /* the unconfined profile is not in the regular profile list */ in aa_lookupn_profile()
576 if (!profile && strncmp(hname, "unconfined", n) == 0) in aa_lookupn_profile()
577 profile = aa_get_newest_profile(ns->unconfined); in aa_lookupn_profile()
580 return profile; in aa_lookupn_profile()
591 struct aa_profile *profile; in aa_fqlookupn_profile() local
605 profile = aa_lookupn_profile(ns, name, n - (name - fqname)); in aa_fqlookupn_profile()
607 /* default profile for ns, currently unconfined */ in aa_fqlookupn_profile()
608 profile = aa_get_newest_profile(ns->unconfined); in aa_fqlookupn_profile()
610 profile = NULL; in aa_fqlookupn_profile()
613 return profile; in aa_fqlookupn_profile()
620 struct aa_profile *profile; in aa_alloc_null() local
623 profile = aa_alloc_profile(name, NULL, gfp); in aa_alloc_null()
624 if (!profile) in aa_alloc_null()
628 profile->label.flags |= FLAG_NULL; in aa_alloc_null()
629 rules = list_first_entry(&profile->rules, typeof(*rules), list); in aa_alloc_null()
634 profile->path_flags = parent->path_flags; in aa_alloc_null()
637 rcu_assign_pointer(profile->parent, aa_get_profile(parent)); in aa_alloc_null()
638 profile->ns = aa_get_ns(parent->ns); in aa_alloc_null()
641 return profile; in aa_alloc_null()
645 * aa_new_learning_profile - create or find a null-X learning profile
646 * @parent: profile that caused this profile to be created (NOT NULL)
647 * @hat: true if the null- learning profile is a hat
648 * @base: name to base the null profile off of
651 * Find/Create a null- complain mode profile used in learning mode. The
652 * name of the profile is unique and follows the format of parent//null-XXX.
656 * null profiles are added to the profile list but the list does not
660 * Returns: new refcounted profile else NULL on failure
665 struct aa_profile *p, *profile; in aa_new_learning_profile() local
690 profile = aa_find_child(parent, bname); in aa_new_learning_profile()
691 if (profile) in aa_new_learning_profile()
694 profile = aa_alloc_null(parent, name, gfp); in aa_new_learning_profile()
695 if (!profile) in aa_new_learning_profile()
697 profile->mode = APPARMOR_COMPLAIN; in aa_new_learning_profile()
699 profile->label.flags |= FLAG_HAT; in aa_new_learning_profile()
701 mutex_lock_nested(&profile->ns->lock, profile->ns->level); in aa_new_learning_profile()
704 aa_free_profile(profile); in aa_new_learning_profile()
705 profile = aa_get_profile(p); in aa_new_learning_profile()
707 __add_profile(&parent->base.profiles, profile); in aa_new_learning_profile()
709 mutex_unlock(&profile->ns->lock); in aa_new_learning_profile()
715 return profile; in aa_new_learning_profile()
719 aa_free_profile(profile); in aa_new_learning_profile()
725 * @profile: profile to test if it can be replaced (MAYBE NULL)
731 static int replacement_allowed(struct aa_profile *profile, int noreplace, in replacement_allowed() argument
734 if (profile) { in replacement_allowed()
735 if (profile->label.flags & FLAG_IMMUTIBLE) { in replacement_allowed()
736 *info = "cannot replace immutable profile"; in replacement_allowed()
739 *info = "profile already exists"; in replacement_allowed()
763 * @name: name of profile being manipulated (NOT NULL)
907 struct aa_profile *profile) in __list_lookup_parent() argument
909 const char *base = basename(profile->base.hname); in __list_lookup_parent()
910 long len = base - profile->base.hname; in __list_lookup_parent()
919 if (ent->new == profile) in __list_lookup_parent()
921 if (strncmp(ent->new->base.hname, profile->base.hname, len) == in __list_lookup_parent()
931 * @old: profile to be replaced (NOT NULL)
932 * @new: profile to replace @old with (NOT NULL)
988 * __lookup_replace - lookup replacement information for a profile
990 * @hname: name of profile to lookup
991 * @noreplace: true if not replacing an existing profile
992 * @p: Returns - profile to be replaced
995 * Returns: profile to replace (no ref) on success else ptr error
1005 *info = "profile can not be replaced"; in __lookup_replace()
1044 * aa_replace_profiles - replace profile(s) on the profile list
1050 * unpack and replace a profile on the profile list and uses of that profile
1051 * by any task creds via invalidating the old version of the profile, which
1052 * tasks will notice to update their own cred. If the profile does not exist
1053 * on the profile list it is added.
1166 * profile that doesn't have in aa_replace_profiles()
1168 * individual profile loading where in aa_replace_profiles()
1173 * null profile will be replaced once in aa_replace_profiles()
1187 /* released on profile replacement or free_profile */ in aa_replace_profiles()
1229 /* dedup actual profile replacement */ in aa_replace_profiles()
1231 "same as current profile, skipping", in aa_replace_profiles()
1240 * TODO: finer dedup based on profile range in data. Load set in aa_replace_profiles()
1241 * can differ but profile may remain unchanged in aa_replace_profiles()
1285 info = "valid profile in failed atomic policy load"; in aa_replace_profiles()
1288 info = "unchecked profile in failed atomic policy load"; in aa_replace_profiles()
1305 * aa_remove_profiles - remove profile(s) from the system
1308 * @fqname: name of the profile or namespace to remove (NOT NULL)
1311 * Remove a profile or sub namespace from the current namespace, so that
1322 struct aa_profile *profile = NULL; in aa_remove_profiles() local
1328 info = "no profile specified"; in aa_remove_profiles()
1356 /* remove profile */ in aa_remove_profiles()
1358 profile = aa_get_profile(__lookup_profile(&ns->base, name)); in aa_remove_profiles()
1359 if (!profile) { in aa_remove_profiles()
1361 info = "profile does not exist"; in aa_remove_profiles()
1364 name = profile->base.hname; in aa_remove_profiles()
1366 __remove_profile(profile); in aa_remove_profiles()
1375 aa_put_profile(profile); in aa_remove_profiles()