| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * AppArmor security module |
|---|
| 3 | 4 | * |
|---|
| 4 | 5 | * This file contains AppArmor label definitions |
|---|
| 5 | 6 | * |
|---|
| 6 | 7 | * Copyright 2017 Canonical Ltd. |
|---|
| 7 | | - * |
|---|
| 8 | | - * This program is free software; you can redistribute it and/or |
|---|
| 9 | | - * modify it under the terms of the GNU General Public License as |
|---|
| 10 | | - * published by the Free Software Foundation, version 2 of the |
|---|
| 11 | | - * License. |
|---|
| 12 | 8 | */ |
|---|
| 13 | 9 | |
|---|
| 14 | 10 | #include <linux/audit.h> |
|---|
| .. | .. |
|---|
| 80 | 76 | |
|---|
| 81 | 77 | AA_BUG(!orig); |
|---|
| 82 | 78 | AA_BUG(!new); |
|---|
| 83 | | - lockdep_assert_held_exclusive(&labels_set(orig)->lock); |
|---|
| 79 | + lockdep_assert_held_write(&labels_set(orig)->lock); |
|---|
| 84 | 80 | |
|---|
| 85 | 81 | tmp = rcu_dereference_protected(orig->proxy->label, |
|---|
| 86 | 82 | &labels_ns(orig)->lock); |
|---|
| .. | .. |
|---|
| 313 | 309 | } |
|---|
| 314 | 310 | |
|---|
| 315 | 311 | |
|---|
| 316 | | -static void label_destroy(struct aa_label *label) |
|---|
| 312 | +void aa_label_destroy(struct aa_label *label) |
|---|
| 317 | 313 | { |
|---|
| 318 | | - struct aa_label *tmp; |
|---|
| 319 | | - |
|---|
| 320 | 314 | AA_BUG(!label); |
|---|
| 321 | 315 | |
|---|
| 322 | 316 | if (!label_isprofile(label)) { |
|---|
| .. | .. |
|---|
| 332 | 326 | } |
|---|
| 333 | 327 | } |
|---|
| 334 | 328 | |
|---|
| 335 | | - if (rcu_dereference_protected(label->proxy->label, true) == label) |
|---|
| 336 | | - rcu_assign_pointer(label->proxy->label, NULL); |
|---|
| 337 | | - |
|---|
| 329 | + if (label->proxy) { |
|---|
| 330 | + if (rcu_dereference_protected(label->proxy->label, true) == label) |
|---|
| 331 | + rcu_assign_pointer(label->proxy->label, NULL); |
|---|
| 332 | + aa_put_proxy(label->proxy); |
|---|
| 333 | + } |
|---|
| 338 | 334 | aa_free_secid(label->secid); |
|---|
| 339 | 335 | |
|---|
| 340 | | - tmp = rcu_dereference_protected(label->proxy->label, true); |
|---|
| 341 | | - if (tmp == label) |
|---|
| 342 | | - rcu_assign_pointer(label->proxy->label, NULL); |
|---|
| 343 | | - |
|---|
| 344 | | - aa_put_proxy(label->proxy); |
|---|
| 345 | 336 | label->proxy = (struct aa_proxy *) PROXY_POISON + 1; |
|---|
| 346 | 337 | } |
|---|
| 347 | 338 | |
|---|
| .. | .. |
|---|
| 350 | 341 | if (!label) |
|---|
| 351 | 342 | return; |
|---|
| 352 | 343 | |
|---|
| 353 | | - label_destroy(label); |
|---|
| 344 | + aa_label_destroy(label); |
|---|
| 354 | 345 | kfree(label); |
|---|
| 355 | 346 | } |
|---|
| 356 | 347 | |
|---|
| .. | .. |
|---|
| 603 | 594 | |
|---|
| 604 | 595 | AA_BUG(!ls); |
|---|
| 605 | 596 | AA_BUG(!label); |
|---|
| 606 | | - lockdep_assert_held_exclusive(&ls->lock); |
|---|
| 597 | + lockdep_assert_held_write(&ls->lock); |
|---|
| 607 | 598 | |
|---|
| 608 | 599 | if (new) |
|---|
| 609 | 600 | __aa_proxy_redirect(label, new); |
|---|
| .. | .. |
|---|
| 640 | 631 | AA_BUG(!ls); |
|---|
| 641 | 632 | AA_BUG(!old); |
|---|
| 642 | 633 | AA_BUG(!new); |
|---|
| 643 | | - lockdep_assert_held_exclusive(&ls->lock); |
|---|
| 634 | + lockdep_assert_held_write(&ls->lock); |
|---|
| 644 | 635 | AA_BUG(new->flags & FLAG_IN_TREE); |
|---|
| 645 | 636 | |
|---|
| 646 | 637 | if (!label_is_stale(old)) |
|---|
| .. | .. |
|---|
| 677 | 668 | AA_BUG(!ls); |
|---|
| 678 | 669 | AA_BUG(!label); |
|---|
| 679 | 670 | AA_BUG(labels_set(label) != ls); |
|---|
| 680 | | - lockdep_assert_held_exclusive(&ls->lock); |
|---|
| 671 | + lockdep_assert_held_write(&ls->lock); |
|---|
| 681 | 672 | AA_BUG(label->flags & FLAG_IN_TREE); |
|---|
| 682 | 673 | |
|---|
| 683 | 674 | /* Figure out where to put new node */ |
|---|
| .. | .. |
|---|
| 1641 | 1632 | AA_BUG(!str && size != 0); |
|---|
| 1642 | 1633 | AA_BUG(!label); |
|---|
| 1643 | 1634 | |
|---|
| 1644 | | - if (flags & FLAG_ABS_ROOT) { |
|---|
| 1635 | + if (AA_DEBUG_LABEL && (flags & FLAG_ABS_ROOT)) { |
|---|
| 1645 | 1636 | ns = root_ns; |
|---|
| 1646 | | - len = snprintf(str, size, "="); |
|---|
| 1637 | + len = snprintf(str, size, "_"); |
|---|
| 1647 | 1638 | update_for_len(total, len, size, str); |
|---|
| 1648 | 1639 | } else if (!ns) { |
|---|
| 1649 | 1640 | ns = labels_ns(label); |
|---|
| .. | .. |
|---|
| 1754 | 1745 | if (!use_label_hname(ns, label, flags) || |
|---|
| 1755 | 1746 | display_mode(ns, label, flags)) { |
|---|
| 1756 | 1747 | len = aa_label_asxprint(&name, ns, label, flags, gfp); |
|---|
| 1757 | | - if (len == -1) { |
|---|
| 1748 | + if (len < 0) { |
|---|
| 1758 | 1749 | AA_DEBUG("label print error"); |
|---|
| 1759 | 1750 | return; |
|---|
| 1760 | 1751 | } |
|---|
| .. | .. |
|---|
| 1782 | 1773 | int len; |
|---|
| 1783 | 1774 | |
|---|
| 1784 | 1775 | len = aa_label_asxprint(&str, ns, label, flags, gfp); |
|---|
| 1785 | | - if (len == -1) { |
|---|
| 1776 | + if (len < 0) { |
|---|
| 1786 | 1777 | AA_DEBUG("label print error"); |
|---|
| 1787 | 1778 | return; |
|---|
| 1788 | 1779 | } |
|---|
| 1789 | | - seq_printf(f, "%s", str); |
|---|
| 1780 | + seq_puts(f, str); |
|---|
| 1790 | 1781 | kfree(str); |
|---|
| 1791 | 1782 | } else if (display_mode(ns, label, flags)) |
|---|
| 1792 | 1783 | seq_printf(f, "%s (%s)", label->hname, |
|---|
| 1793 | 1784 | label_modename(ns, label, flags)); |
|---|
| 1794 | 1785 | else |
|---|
| 1795 | | - seq_printf(f, "%s", label->hname); |
|---|
| 1786 | + seq_puts(f, label->hname); |
|---|
| 1796 | 1787 | } |
|---|
| 1797 | 1788 | |
|---|
| 1798 | 1789 | void aa_label_xprintk(struct aa_ns *ns, struct aa_label *label, int flags, |
|---|
| .. | .. |
|---|
| 1805 | 1796 | int len; |
|---|
| 1806 | 1797 | |
|---|
| 1807 | 1798 | len = aa_label_asxprint(&str, ns, label, flags, gfp); |
|---|
| 1808 | | - if (len == -1) { |
|---|
| 1799 | + if (len < 0) { |
|---|
| 1809 | 1800 | AA_DEBUG("label print error"); |
|---|
| 1810 | 1801 | return; |
|---|
| 1811 | 1802 | } |
|---|
| .. | .. |
|---|
| 1905 | 1896 | AA_BUG(!str); |
|---|
| 1906 | 1897 | |
|---|
| 1907 | 1898 | str = skipn_spaces(str, n); |
|---|
| 1908 | | - if (str == NULL || (*str == '=' && base != &root_ns->unconfined->label)) |
|---|
| 1899 | + if (str == NULL || (AA_DEBUG_LABEL && *str == '_' && |
|---|
| 1900 | + base != &root_ns->unconfined->label)) |
|---|
| 1909 | 1901 | return ERR_PTR(-EINVAL); |
|---|
| 1910 | 1902 | |
|---|
| 1911 | 1903 | len = label_count_strn_entries(str, end - str); |
|---|