137 				struct aa_label *label, bool stack,  in label_compound_match()  argument
146 	label_for_each(i, label, tp) {  in label_compound_match()
160 	label_for_each_cont(i, label, tp) {  in label_compound_match()
197 				  struct aa_label *label, bool stack,  in label_components_match()  argument
208 	label_for_each(i, label, tp) {  in label_components_match()
224 	label_for_each_cont(i, label, tp) {  in label_components_match()
257 static int label_match(struct aa_profile *profile, struct aa_label *label,  in label_match()  argument
264 	error = label_compound_match(profile, label, stack, state, subns,  in label_match()
270 	return label_components_match(profile, label, stack, state, subns,  in label_match()
396 		if (profile->label.flags & FLAG_NULL &&  in __attach_match()
397 		    &profile->label == ns_unconfined(profile->ns))  in __attach_match()
488 	return profile ? &profile->label : NULL;  in find_attach()
507 	struct aa_label *label = NULL;  in x_table_lookup()  local
517 	for (*name = profile->file.trans.table[index]; !label && *name;  in x_table_lookup()
524 				label = &new_profile->label;  in x_table_lookup()
527 		label = aa_label_parse(&profile->label, *name, GFP_ATOMIC,  in x_table_lookup()
529 		if (IS_ERR(label))  in x_table_lookup()
530 			label = NULL;  in x_table_lookup()
535 	return label;  in x_table_lookup()
596 			new = aa_get_newest_label(&profile->label);  in x_to_label()
639 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_transition()
642 			new = aa_get_newest_label(&profile->label);  in profile_transition()
656 		return aa_get_newest_label(&profile->label);  in profile_transition()
665 		if (new && new->proxy == profile->label.proxy && info) {  in profile_transition()
711 			new = &new_profile->label;  in profile_transition()
772 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_onexec()
815 static struct aa_label *handle_onexec(struct aa_label *label,  in handle_onexec()  argument
825 	AA_BUG(!label);  in handle_onexec()
831 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
836 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,  in handle_onexec()
843 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
848 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,  in handle_onexec()
849 				aa_label_merge(&profile->label, onexec,  in handle_onexec()
859 	error = fn_for_each_in_ns(label, profile,  in handle_onexec()
878 	struct aa_label *label, *new = NULL;  in apparmor_bprm_set_creds()  local
896 	label = aa_get_newest_label(cred_label(bprm->cred));  in apparmor_bprm_set_creds()
905 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) && !unconfined(label) &&  in apparmor_bprm_set_creds()
907 		ctx->nnp = aa_get_label(label);  in apparmor_bprm_set_creds()
913 		new = handle_onexec(label, ctx->onexec, ctx->token,  in apparmor_bprm_set_creds()
916 		new = fn_label_build(label, profile, GFP_ATOMIC,  in apparmor_bprm_set_creds()
938 	    !unconfined(label) && !aa_label_is_subset(new, ctx->nnp)) {  in apparmor_bprm_set_creds()
966 	if (label->proxy != new->proxy) {  in apparmor_bprm_set_creds()
981 	aa_put_label(label);  in apparmor_bprm_set_creds()
987 	error = fn_for_each(label, profile,  in apparmor_bprm_set_creds()
1039 		      hat ? &hat->label : NULL, GLOBAL_ROOT_UID, info,  in build_change_hat()
1046 	return &hat->label;  in build_change_hat()
1053 static struct aa_label *change_hat(struct aa_label *label, const char *hats[],  in change_hat()  argument
1063 	AA_BUG(!label);  in change_hat()
1067 	if (PROFILE_IS_HAT(labels_profile(label)))  in change_hat()
1073 		label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1109 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1120 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1137 	new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in change_hat()
1139 				   aa_get_label(&profile->label));  in change_hat()
1170 	struct aa_label *label, *previous, *new = NULL, *target = NULL;  in aa_change_hat()  local
1178 	label = aa_get_newest_cred_label(cred);  in aa_change_hat()
1188 	if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp)  in aa_change_hat()
1189 		ctx->nnp = aa_get_label(label);  in aa_change_hat()
1191 	if (unconfined(label)) {  in aa_change_hat()
1198 		new = change_hat(label, hats, count, flags);  in aa_change_hat()
1215 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_hat()
1236 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_hat()
1259 	aa_put_label(label);  in aa_change_hat()
1269 	fn_for_each_in_ns(label, profile,  in aa_change_hat()
1313 	struct aa_label *label, *new = NULL, *target = NULL;  in aa_change_profile()  local
1324 	label = aa_get_current_label();  in aa_change_profile()
1333 	if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp)  in aa_change_profile()
1334 		ctx->nnp = aa_get_label(label);  in aa_change_profile()
1355 	label = aa_get_current_label();  in aa_change_profile()
1362 	target = aa_label_parse(label, fqname, GFP_KERNEL, true, false);  in aa_change_profile()
1374 		    !COMPLAIN_MODE(labels_profile(label)))  in aa_change_profile()
1377 		tprofile = aa_new_null_profile(labels_profile(label), false,  in aa_change_profile()
1384 		target = &tprofile->label;  in aa_change_profile()
1396 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1409 	if (error && !fn_for_each_in_ns(label, profile,  in aa_change_profile()
1425 		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in aa_change_profile()
1427 					   aa_get_label(&profile->label));  in aa_change_profile()
1432 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_profile()
1444 			new = aa_label_merge(label, target, GFP_KERNEL);  in aa_change_profile()
1464 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1472 	aa_put_label(label);  in aa_change_profile()