Lines Matching refs:label
135 struct aa_label *label, bool stack, in label_compound_match() argument
144 label_for_each(i, label, tp) { in label_compound_match()
158 label_for_each_cont(i, label, tp) { in label_compound_match()
195 struct aa_label *label, bool stack, in label_components_match() argument
206 label_for_each(i, label, tp) { in label_components_match()
222 label_for_each_cont(i, label, tp) { in label_components_match()
255 static int label_match(struct aa_profile *profile, struct aa_label *label, in label_match() argument
262 error = label_compound_match(profile, label, stack, state, subns, in label_match()
268 return label_components_match(profile, label, stack, state, subns, in label_match()
402 if (profile->label.flags & FLAG_NULL && in find_attach()
403 &profile->label == ns_unconfined(profile->ns)) in find_attach()
495 return &candidate->label; in find_attach()
514 struct aa_label *label = NULL; in x_table_lookup() local
524 for (*name = profile->file.trans.table[index]; !label && *name; in x_table_lookup()
531 label = &new_profile->label; in x_table_lookup()
534 label = aa_label_parse(&profile->label, *name, GFP_KERNEL, in x_table_lookup()
536 if (IS_ERR(label)) in x_table_lookup()
537 label = NULL; in x_table_lookup()
542 return label; in x_table_lookup()
603 new = aa_get_newest_label(&profile->label); in x_to_label()
644 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_transition()
647 new = aa_get_newest_label(&profile->label); in profile_transition()
661 return aa_get_newest_label(&profile->label); in profile_transition()
670 if (new && new->proxy == profile->label.proxy && info) { in profile_transition()
690 new = &new_profile->label; in profile_transition()
751 (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) { in profile_onexec()
794 static struct aa_label *handle_onexec(struct aa_label *label, in handle_onexec() argument
804 AA_BUG(!label); in handle_onexec()
810 error = fn_for_each_in_ns(label, profile, in handle_onexec()
815 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
822 error = fn_for_each_in_ns(label, profile, in handle_onexec()
827 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in handle_onexec()
828 aa_label_merge(&profile->label, onexec, in handle_onexec()
838 error = fn_for_each_in_ns(label, profile, in handle_onexec()
857 struct aa_label *label, *new = NULL; in apparmor_bprm_creds_for_exec() local
874 label = aa_get_newest_label(cred_label(bprm->cred)); in apparmor_bprm_creds_for_exec()
883 if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) && !unconfined(label) && in apparmor_bprm_creds_for_exec()
885 ctx->nnp = aa_get_label(label); in apparmor_bprm_creds_for_exec()
896 new = handle_onexec(label, ctx->onexec, ctx->token, in apparmor_bprm_creds_for_exec()
899 new = fn_label_build(label, profile, GFP_KERNEL, in apparmor_bprm_creds_for_exec()
921 !unconfined(label) && in apparmor_bprm_creds_for_exec()
950 if (label->proxy != new->proxy) { in apparmor_bprm_creds_for_exec()
965 aa_put_label(label); in apparmor_bprm_creds_for_exec()
971 error = fn_for_each(label, profile, in apparmor_bprm_creds_for_exec()
1022 hat ? &hat->label : NULL, GLOBAL_ROOT_UID, info, in build_change_hat()
1029 return &hat->label; in build_change_hat()
1036 static struct aa_label *change_hat(struct aa_label *label, const char *hats[], in change_hat() argument
1046 AA_BUG(!label); in change_hat()
1050 if (PROFILE_IS_HAT(labels_profile(label))) in change_hat()
1056 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1092 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1103 label_for_each_in_ns(it, labels_ns(label), label, profile) { in change_hat()
1120 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in change_hat()
1122 aa_get_label(&profile->label)); in change_hat()
1153 struct aa_label *label, *previous, *new = NULL, *target = NULL; in aa_change_hat() local
1161 label = aa_get_newest_cred_label(cred); in aa_change_hat()
1171 if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp) in aa_change_hat()
1172 ctx->nnp = aa_get_label(label); in aa_change_hat()
1174 if (unconfined(label)) { in aa_change_hat()
1181 new = change_hat(label, hats, count, flags); in aa_change_hat()
1198 if (task_no_new_privs(current) && !unconfined(label) && in aa_change_hat()
1219 if (task_no_new_privs(current) && !unconfined(label) && in aa_change_hat()
1242 aa_put_label(label); in aa_change_hat()
1252 fn_for_each_in_ns(label, profile, in aa_change_hat()
1296 struct aa_label *label, *new = NULL, *target = NULL; in aa_change_profile() local
1307 label = aa_get_current_label(); in aa_change_profile()
1316 if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp) in aa_change_profile()
1317 ctx->nnp = aa_get_label(label); in aa_change_profile()
1320 aa_put_label(label); in aa_change_profile()
1344 target = aa_label_parse(label, fqname, GFP_KERNEL, true, false); in aa_change_profile()
1356 !COMPLAIN_MODE(labels_profile(label))) in aa_change_profile()
1359 tprofile = aa_new_null_profile(labels_profile(label), false, in aa_change_profile()
1366 target = &tprofile->label; in aa_change_profile()
1378 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1391 if (error && !fn_for_each_in_ns(label, profile, in aa_change_profile()
1407 new = fn_label_build_in_ns(label, profile, GFP_KERNEL, in aa_change_profile()
1409 aa_get_label(&profile->label)); in aa_change_profile()
1414 if (task_no_new_privs(current) && !unconfined(label) && in aa_change_profile()
1426 new = aa_label_merge(label, target, GFP_KERNEL); in aa_change_profile()
1449 error = fn_for_each_in_ns(label, profile, in aa_change_profile()
1457 aa_put_label(label); in aa_change_profile()