97 static inline unsigned int match_component(struct aa_profile *profile,  in match_component()  argument
104 		state = aa_dfa_match(profile->file.dfa, state, "&");  in match_component()
105 	if (profile->ns == tp->ns)  in match_component()
106 		return aa_dfa_match(profile->file.dfa, state, tp->base.hname);  in match_component()
109 	ns_name = aa_ns_name(profile->ns, tp->ns, true);  in match_component()
110 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);  in match_component()
111 	state = aa_dfa_match(profile->file.dfa, state, ns_name);  in match_component()
112 	state = aa_dfa_match_len(profile->file.dfa, state, ":", 1);  in match_component()
113 	return aa_dfa_match(profile->file.dfa, state, tp->base.hname);  in match_component()
132 static int label_compound_match(struct aa_profile *profile,  in label_compound_match()  argument
143 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_compound_match()
145 		state = match_component(profile, tp, stack, state);  in label_compound_match()
157 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_compound_match()
159 		state = aa_dfa_match(profile->file.dfa, state, "//&");  in label_compound_match()
160 		state = match_component(profile, tp, false, state);  in label_compound_match()
164 	*perms = aa_compute_fperms(profile->file.dfa, state, &cond);  in label_compound_match()
165 	aa_apply_modes_to_perms(profile, perms);  in label_compound_match()
192 static int label_components_match(struct aa_profile *profile,  in label_components_match()  argument
205 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_components_match()
207 		state = match_component(profile, tp, stack, start);  in label_components_match()
217 	tmp = aa_compute_fperms(profile->file.dfa, state, &cond);  in label_components_match()
218 	aa_apply_modes_to_perms(profile, &tmp);  in label_components_match()
221 		if (!aa_ns_visible(profile->ns, tp->ns, subns))  in label_components_match()
223 		state = match_component(profile, tp, stack, start);  in label_components_match()
226 		tmp = aa_compute_fperms(profile->file.dfa, state, &cond);  in label_components_match()
227 		aa_apply_modes_to_perms(profile, &tmp);  in label_components_match()
253 static int label_match(struct aa_profile *profile, struct aa_label *label,  in label_match()  argument
260 	error = label_compound_match(profile, label, stack, state, subns,  in label_match()
266 	return label_components_match(profile, label, stack, state, subns,  in label_match()
286 static int change_profile_perms(struct aa_profile *profile,  in change_profile_perms()  argument
291 	if (profile_unconfined(profile)) {  in change_profile_perms()
298 	return label_match(profile, target, stack, start, true, request, perms);  in change_profile_perms()
310 			   struct aa_profile *profile, unsigned int state)  in aa_xattrs_match()  argument
316 	int value_size = 0, ret = profile->xattr_count;  in aa_xattrs_match()
318 	if (!bprm || !profile->xattr_count)  in aa_xattrs_match()
322 	state = aa_dfa_null_transition(profile->xmatch, state);  in aa_xattrs_match()
326 	for (i = 0; i < profile->xattr_count; i++) {  in aa_xattrs_match()
327 		size = vfs_getxattr_alloc(d, profile->xattrs[i], &value,  in aa_xattrs_match()
333 			state = aa_dfa_match_len(profile->xmatch, state, value,  in aa_xattrs_match()
335 			perm = dfa_user_allow(profile->xmatch, state);  in aa_xattrs_match()
342 		state = aa_dfa_null_transition(profile->xmatch, state);  in aa_xattrs_match()
386 	struct aa_profile *profile, *candidate = NULL;  in __attach_match()  local
391 	list_for_each_entry_rcu(profile, head, base.list) {  in __attach_match()
392 		if (profile->label.flags & FLAG_NULL &&  in __attach_match()
393 		    &profile->label == ns_unconfined(profile->ns))  in __attach_match()
407 		if (profile->xmatch) {  in __attach_match()
411 			state = aa_dfa_leftmatch(profile->xmatch, DFA_START,  in __attach_match()
413 			perm = dfa_user_allow(profile->xmatch, state);  in __attach_match()
421 				ret = aa_xattrs_match(bprm, profile, state);  in __attach_match()
443 				candidate = profile;  in __attach_match()
444 				candidate_len = profile->xmatch_len;  in __attach_match()
448 		} else if (!strcmp(profile->base.name, name))  in __attach_match()
453 			return profile;  in __attach_match()
478 	struct aa_profile *profile;  in find_attach()  local
481 	profile = aa_get_profile(__attach_match(bprm, name, list, info));  in find_attach()
484 	return profile ? &profile->label : NULL;  in find_attach()
500 struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,  in x_table_lookup()  argument
513 	for (*name = profile->file.trans.table[index]; !label && *name;  in x_table_lookup()
518 			new_profile = aa_find_child(profile, *name);  in x_table_lookup()
523 		label = aa_label_parse(&profile->label, *name, GFP_ATOMIC,  in x_table_lookup()
546 static struct aa_label *x_to_label(struct aa_profile *profile,  in x_to_label()  argument
553 	struct aa_ns *ns = profile->ns;  in x_to_label()
564 		stack = profile->file.trans.table[xindex & AA_X_INDEX_MASK];  in x_to_label()
567 			new = x_table_lookup(profile, xindex, lookupname);  in x_to_label()
575 			new = find_attach(bprm, ns, &profile->base.profiles,  in x_to_label()
592 			new = aa_get_newest_label(&profile->label);  in x_to_label()
594 			new = aa_get_newest_label(ns_unconfined(profile->ns));  in x_to_label()
613 static struct aa_label *profile_transition(struct aa_profile *profile,  in profile_transition()  argument
622 	unsigned int state = profile->file.start;  in profile_transition()
627 	AA_BUG(!profile);  in profile_transition()
631 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,  in profile_transition()
632 			     &name, &info, profile->disconnected);  in profile_transition()
634 		if (profile_unconfined(profile) ||  in profile_transition()
635 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_transition()
638 			new = aa_get_newest_label(&profile->label);  in profile_transition()
644 	if (profile_unconfined(profile)) {  in profile_transition()
645 		new = find_attach(bprm, profile->ns,  in profile_transition()
646 				  &profile->ns->base.profiles, name, &info);  in profile_transition()
652 		return aa_get_newest_label(&profile->label);  in profile_transition()
656 	state = aa_str_perms(profile->file.dfa, state, name, cond, &perms);  in profile_transition()
659 		new = x_to_label(profile, bprm, name, perms.xindex, &target,  in profile_transition()
661 		if (new && new->proxy == profile->label.proxy && info) {  in profile_transition()
685 	} else if (COMPLAIN_MODE(profile)) {  in profile_transition()
695 			new_profile = aa_new_null_profile(profile, false, n,  in profile_transition()
729 	aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name, target, new,  in profile_transition()
739 static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,  in profile_onexec()  argument
744 	unsigned int state = profile->file.start;  in profile_onexec()
749 	AA_BUG(!profile);  in profile_onexec()
754 	if (profile_unconfined(profile)) {  in profile_onexec()
764 	error = aa_path_name(&bprm->file->f_path, profile->path_flags, buffer,  in profile_onexec()
765 			     &xname, &info, profile->disconnected);  in profile_onexec()
767 		if (profile_unconfined(profile) ||  in profile_onexec()
768 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_onexec()
777 	state = aa_str_perms(profile->file.dfa, state, xname, cond, &perms);  in profile_onexec()
786 	state = aa_dfa_null_transition(profile->file.dfa, state);  in profile_onexec()
787 	error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC,  in profile_onexec()
805 	return aa_audit_file(profile, &perms, OP_EXEC, AA_MAY_ONEXEC, xname,  in profile_onexec()
817 	struct aa_profile *profile;  in handle_onexec()  local
827 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
828 				profile_onexec(profile, onexec, stack,  in handle_onexec()
832 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,  in handle_onexec()
834 				profile_transition(profile, bprm, buffer,  in handle_onexec()
839 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
840 				profile_onexec(profile, onexec, stack, bprm,  in handle_onexec()
844 		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,  in handle_onexec()
845 				aa_label_merge(&profile->label, onexec,  in handle_onexec()
847 				profile_transition(profile, bprm, buffer,  in handle_onexec()
855 	error = fn_for_each_in_ns(label, profile,  in handle_onexec()
856 			aa_audit_file(profile, &nullperms, OP_CHANGE_ONEXEC,  in handle_onexec()
875 	struct aa_profile *profile;  in apparmor_bprm_set_creds()  local
912 		new = fn_label_build(label, profile, GFP_ATOMIC,  in apparmor_bprm_set_creds()
913 				profile_transition(profile, bprm, buffer,  in apparmor_bprm_set_creds()
983 	error = fn_for_each(label, profile,  in apparmor_bprm_set_creds()
984 			aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,  in apparmor_bprm_set_creds()
1001 static struct aa_label *build_change_hat(struct aa_profile *profile,  in build_change_hat()  argument
1008 	if (sibling && PROFILE_IS_HAT(profile)) {  in build_change_hat()
1009 		root = aa_get_profile_rcu(&profile->parent);  in build_change_hat()
1010 	} else if (!sibling && !PROFILE_IS_HAT(profile)) {  in build_change_hat()
1011 		root = aa_get_profile(profile);  in build_change_hat()
1021 		if (COMPLAIN_MODE(profile)) {  in build_change_hat()
1022 			hat = aa_new_null_profile(profile, true, name,  in build_change_hat()
1033 	aa_audit_file(profile, &nullperms, OP_CHANGE_HAT, AA_MAY_CHANGEHAT,  in build_change_hat()
1052 	struct aa_profile *profile, *root, *hat = NULL;  in change_hat()  local
1069 		label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1070 			if (sibling && PROFILE_IS_HAT(profile)) {  in change_hat()
1071 				root = aa_get_profile_rcu(&profile->parent);  in change_hat()
1072 			} else if (!sibling && !PROFILE_IS_HAT(profile)) {  in change_hat()
1073 				root = aa_get_profile(profile);  in change_hat()
1082 				if (!COMPLAIN_MODE(profile))  in change_hat()
1105 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1106 		if (!list_empty(&profile->base.profiles)) {  in change_hat()
1116 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1124 		if (count > 1 || COMPLAIN_MODE(profile)) {  in change_hat()
1125 			aa_audit_file(profile, &nullperms, OP_CHANGE_HAT,  in change_hat()
1133 	new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in change_hat()
1134 				   build_change_hat(profile, name, sibling),  in change_hat()
1135 				   aa_get_label(&profile->label));  in change_hat()
1167 	struct aa_profile *profile;  in aa_change_hat()  local
1265 	fn_for_each_in_ns(label, profile,  in aa_change_hat()
1266 		aa_audit_file(profile, &perms, OP_CHANGE_HAT,  in aa_change_hat()
1275 					struct aa_profile *profile,  in change_profile_perms_wrapper()  argument
1283 		error = change_profile_perms(profile, target, stack, request,  in change_profile_perms_wrapper()
1284 					     profile->file.start, perms);  in change_profile_perms_wrapper()
1286 		error = aa_audit_file(profile, perms, op, request, name,  in change_profile_perms_wrapper()
1310 	struct aa_profile *profile;  in aa_change_profile()  local
1392 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1394 						     profile, target, stack,  in aa_change_profile()
1405 	if (error && !fn_for_each_in_ns(label, profile,  in aa_change_profile()
1406 					COMPLAIN_MODE(profile)))  in aa_change_profile()
1421 		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in aa_change_profile()
1423 					   aa_get_label(&profile->label));  in aa_change_profile()
1463 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1464 			aa_audit_file(profile, &perms, op, request, auditname,  in aa_change_profile()