109  * label_compound_match - find perms for full compound label
111  * @label: label to check access permissions for
120  * For the label A//&B//&C this does the perm match for A//&B//&C
125 				struct aa_label *label, bool stack,  in label_compound_match()  argument
136 	label_for_each(i, label, tp) {  in label_compound_match()
150 	label_for_each_cont(i, label, tp) {  in label_compound_match()
171  * label_components_match - find perms for all subcomponents of a label
173  * @label: label to check access permissions for
182  * For the label A//&B//&C this does the perm match for each of A and B and C
187 				  struct aa_label *label, bool stack,  in label_components_match()  argument
200 	label_for_each(i, label, tp) {  in label_components_match()
216 	label_for_each_cont(i, label, tp) {  in label_components_match()
238  * label_match - do a multi-component label match
240  * @label: label to match (NOT NULL)
249 static int label_match(struct aa_profile *profile, struct aa_label *label,  in label_match()  argument
256 	error = label_compound_match(profile, label, stack, state, subns,  in label_match()
262 	return label_components_match(profile, label, stack, state, subns,  in label_match()
271  * @target: label to transition to (NOT NULL)
280  * currently only matches full label A//&B//&C or individual components A, B, C
383  * Returns: label or NULL if no match found
401 		if (profile->label.flags & FLAG_NULL &&  in find_attach()
402 		    &profile->label == ns_unconfined(profile->ns))  in find_attach()
497 	return &candidate->label;  in find_attach()
509  * @name: returns: name tested to find label (NOT NULL)
511  * Returns: refcounted label, or NULL on failure (MAYBE NULL)
518 	struct aa_label *label = NULL;  in x_table_lookup()  local
526 	 *       index into the resultant label  in x_table_lookup()
528 	for (*name = rules->file->trans.table[index]; !label && *name;  in x_table_lookup()
535 				label = &new_profile->label;  in x_table_lookup()
538 		label = aa_label_parse(&profile->label, *name, GFP_KERNEL,  in x_table_lookup()
540 		if (IS_ERR(label))  in x_table_lookup()
541 			label = NULL;  in x_table_lookup()
546 	return label;  in x_table_lookup()
550  * x_to_label - get target label for a given xindex
558  * find label for a transition index
560  * Returns: refcounted label or NULL if not found available
610 			new = aa_get_newest_label(&profile->label);  in x_to_label()
654 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_transition()
657 			new = aa_get_newest_label(&profile->label);  in profile_transition()
667 			AA_DEBUG("unconfined attached to new label");  in profile_transition()
671 		return aa_get_newest_label(&profile->label);  in profile_transition()
680 		if (new && new->proxy == profile->label.proxy && info) {  in profile_transition()
700 			new = &new_profile->label;  in profile_transition()
765 		    (profile->label.flags & FLAG_IX_ON_NAME_ERROR)) {  in profile_onexec()
794 				   "variables for %s label=", xname);  in profile_onexec()
810 				      struct aa_label *label,  in handle_onexec()  argument
820 	AA_BUG(!label);  in handle_onexec()
826 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
831 		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in handle_onexec()
839 		error = fn_for_each_in_ns(label, profile,  in handle_onexec()
844 		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in handle_onexec()
845 				aa_label_merge(&profile->label, onexec,  in handle_onexec()
856 	error = fn_for_each_in_ns(label, profile,  in handle_onexec()
861 				      "failed to build target label", -ENOMEM));  in handle_onexec()
876 	struct aa_label *label, *new = NULL;  in apparmor_bprm_creds_for_exec()  local
895 	label = aa_get_newest_label(cred_label(bprm->cred));  in apparmor_bprm_creds_for_exec()
898 	 * Detect no new privs being set, and store the label it  in apparmor_bprm_creds_for_exec()
904 	if ((bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) && !unconfined(label) &&  in apparmor_bprm_creds_for_exec()
906 		ctx->nnp = aa_get_label(label);  in apparmor_bprm_creds_for_exec()
917 		new = handle_onexec(subj_cred, label, ctx->onexec, ctx->token,  in apparmor_bprm_creds_for_exec()
920 		new = fn_label_build(label, profile, GFP_KERNEL,  in apparmor_bprm_creds_for_exec()
943 	    !unconfined(label) &&  in apparmor_bprm_creds_for_exec()
956 		/* TODO: test needs to be profile of label to new */  in apparmor_bprm_creds_for_exec()
965 				   "label=", bprm->filename);  in apparmor_bprm_creds_for_exec()
972 	if (label->proxy != new->proxy) {  in apparmor_bprm_creds_for_exec()
976 				   "bits. %s label=", bprm->filename);  in apparmor_bprm_creds_for_exec()
987 	aa_put_label(label);  in apparmor_bprm_creds_for_exec()
993 	error = fn_for_each(label, profile,  in apparmor_bprm_creds_for_exec()
1009  * Returns: label for hat transition OR ERR_PTR.  Does NOT return NULL
1047 		      hat ? &hat->label : NULL, GLOBAL_ROOT_UID, info,  in build_change_hat()
1052 	 * complain mode allow by returning hat->label  in build_change_hat()
1054 	return &hat->label;  in build_change_hat()
1059  * Returns: label for hat transition or ERR_PTR. Does not return NULL
1062 				   struct aa_label *label, const char *hats[],  in change_hat()  argument
1072 	AA_BUG(!label);  in change_hat()
1076 	if (PROFILE_IS_HAT(labels_profile(label)))  in change_hat()
1082 		label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1118 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1129 	label_for_each_in_ns(it, labels_ns(label), label, profile) {  in change_hat()
1147 	new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in change_hat()
1150 				   aa_get_label(&profile->label));  in change_hat()
1152 		info = "label build failed";  in change_hat()
1181 	struct aa_label *label, *previous, *new = NULL, *target = NULL;  in aa_change_hat()  local
1189 	label = aa_get_newest_cred_label(subj_cred);  in aa_change_hat()
1193 	 * Detect no new privs being set, and store the label it  in aa_change_hat()
1199 	if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp)  in aa_change_hat()
1200 		ctx->nnp = aa_get_label(label);  in aa_change_hat()
1202 	if (unconfined(label)) {  in aa_change_hat()
1209 		new = change_hat(subj_cred, label, hats, count, flags);  in aa_change_hat()
1218 		/* target cred is the same as current except new label */  in aa_change_hat()
1227 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_hat()
1248 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_hat()
1256 		/* Return to saved label.  Kill task if restore fails  in aa_change_hat()
1271 	aa_put_label(label);  in aa_change_hat()
1281 	fn_for_each_in_ns(label, profile,  in aa_change_hat()
1331 	struct aa_label *label, *new = NULL, *target = NULL;  in aa_change_profile()  local
1343 	label = aa_get_current_label();  in aa_change_profile()
1346 	 * Detect no new privs being set, and store the label it  in aa_change_profile()
1352 	if (task_no_new_privs(current) && !unconfined(label) && !ctx->nnp)  in aa_change_profile()
1353 		ctx->nnp = aa_get_label(label);  in aa_change_profile()
1356 		aa_put_label(label);  in aa_change_profile()
1378 	if (!stack && unconfined(label) &&  in aa_change_profile()
1379 	    label == &labels_ns(label)->unconfined->label &&  in aa_change_profile()
1390 		(void) fn_for_each_in_ns(label, profile,  in aa_change_profile()
1402 	target = aa_label_parse(label, fqname, GFP_KERNEL, true, false);  in aa_change_profile()
1406 		info = "label not found";  in aa_change_profile()
1414 		    !COMPLAIN_MODE(labels_profile(label)))  in aa_change_profile()
1417 		tprofile = aa_new_learning_profile(labels_profile(label), false,  in aa_change_profile()
1424 		target = &tprofile->label;  in aa_change_profile()
1436 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1450 	if (error && !fn_for_each_in_ns(label, profile,  in aa_change_profile()
1466 		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,  in aa_change_profile()
1468 					   aa_get_label(&profile->label));  in aa_change_profile()
1473 		if (task_no_new_privs(current) && !unconfined(label) &&  in aa_change_profile()
1485 			new = aa_label_merge(label, target, GFP_KERNEL);  in aa_change_profile()
1487 			info = "failed to build target label";  in aa_change_profile()
1508 	error = fn_for_each_in_ns(label, profile,  in aa_change_profile()
1517 	aa_put_label(label);  in aa_change_profile()