44  * to trace the new domain
460 				 * The new match isn't more specific  in find_attach()
538 			struct aa_profile *new = aa_find_child(profile, lookup);  in x_table_lookup()  local
540 			if (new)  in x_table_lookup()
542 				return &new->label;  in x_table_lookup()
574 	struct aa_label *new = NULL;  in x_to_label()  local
591 		new = x_table_lookup(profile, xindex, lookupname);  in x_to_label()
592 		if (!new || **lookupname != '&')  in x_to_label()
594 		stack = new;  in x_to_label()
595 		new = NULL;  in x_to_label()
600 			new = find_attach(bprm, ns, &profile->base.profiles,  in x_to_label()
604 			new = find_attach(bprm, ns, &ns->base.profiles,  in x_to_label()
611 	if (!new) {  in x_to_label()
623 			new = aa_get_newest_label(&profile->label);  in x_to_label()
625 			new = aa_get_newest_label(ns_unconfined(profile->ns));  in x_to_label()
645 	if (new && stack) {  in x_to_label()
647 		struct aa_label *base = new;  in x_to_label()
649 		new = aa_label_merge(base, stack, GFP_KERNEL);  in x_to_label()
656 	return new;  in x_to_label()
666 	struct aa_label *new = NULL;  in profile_transition()  local
685 			new = aa_get_newest_label(&profile->label);  in profile_transition()
692 		new = find_attach(bprm, profile->ns,  in profile_transition()
707 				OP_EXEC, MAY_EXEC, name, target, new, cond->uid,  in profile_transition()
710 		if (new) {  in profile_transition()
711 			AA_DEBUG(DEBUG_DOMAIN, "unconfined attached to new label");  in profile_transition()
712 			return new;  in profile_transition()
722 		new = x_to_label(profile, bprm, name, perms.xindex, &target,  in profile_transition()
724 		if (new && new->proxy == profile->label.proxy && info) {  in profile_transition()
734 		} else if (!new) {  in profile_transition()
759 			new = &new_profile->label;  in profile_transition()
766 	if (!new)  in profile_transition()
774 			aa_label_printk(new, GFP_KERNEL);  in profile_transition()
782 		      target, new,  in profile_transition()
784 	if (!new || nonewprivs) {  in profile_transition()
785 		aa_put_label(new);  in profile_transition()
789 	return new;  in profile_transition()
875 	struct aa_label *new;  in handle_onexec()  local
892 	new = fn_label_build_in_scope(label, profile, GFP_KERNEL,  in handle_onexec()
898 	if (new)  in handle_onexec()
899 		return new;  in handle_onexec()
912  * apparmor_bprm_creds_for_exec - Update the new creds on the bprm struct
922 	struct aa_label *label, *new = NULL;  in apparmor_bprm_creds_for_exec()  local
944 	 * Detect no new privs being set, and store the label it  in apparmor_bprm_creds_for_exec()
963 		new = handle_onexec(subj_cred, label, ctx->onexec, ctx->token,  in apparmor_bprm_creds_for_exec()
966 		new = fn_label_build(label, profile, GFP_KERNEL,  in apparmor_bprm_creds_for_exec()
971 	AA_BUG(!new);  in apparmor_bprm_creds_for_exec()
972 	if (IS_ERR(new)) {  in apparmor_bprm_creds_for_exec()
973 		error = PTR_ERR(new);  in apparmor_bprm_creds_for_exec()
975 	} else if (!new) {  in apparmor_bprm_creds_for_exec()
982 	 * of the confinement when the task entered no new privs.  in apparmor_bprm_creds_for_exec()
990 	    !aa_label_is_unconfined_subset(new, ctx->nnp)) {  in apparmor_bprm_creds_for_exec()
992 		info = "no new privs";  in apparmor_bprm_creds_for_exec()
1002 		/* TODO: test needs to be profile of label to new */  in apparmor_bprm_creds_for_exec()
1003 		error = may_change_ptraced_domain(bprm->cred, new, &info);  in apparmor_bprm_creds_for_exec()
1012 			aa_label_printk(new, GFP_KERNEL);  in apparmor_bprm_creds_for_exec()
1018 	if (label->proxy != new->proxy) {  in apparmor_bprm_creds_for_exec()
1023 			aa_label_printk(new, GFP_KERNEL);  in apparmor_bprm_creds_for_exec()
1030 	set_cred_label(bprm->cred, new);  in apparmor_bprm_creds_for_exec()
1042 				      bprm->filename, NULL, new,  in apparmor_bprm_creds_for_exec()
1044 	aa_put_label(new);  in apparmor_bprm_creds_for_exec()
1112 	struct aa_label *new;  in change_hat()  local
1193 	new = fn_label_build_in_scope(label, profile, GFP_KERNEL,  in change_hat()
1197 	if (!new) {  in change_hat()
1201 	} /* else if (IS_ERR) build_change_hat has logged error so return new */  in change_hat()
1203 	return new;  in change_hat()
1227 	struct aa_label *label, *previous, *new = NULL, *target = NULL;  in aa_change_hat()  local
1239 	 * Detect no new privs being set, and store the label it  in aa_change_hat()
1269 		new = change_hat(subj_cred, label, hats, count, flags);  in aa_change_hat()
1270 		AA_BUG(!new);  in aa_change_hat()
1271 		if (IS_ERR(new)) {  in aa_change_hat()
1272 			error = PTR_ERR(new);  in aa_change_hat()
1273 			new = NULL;  in aa_change_hat()
1278 		/* target cred is the same as current except new label */  in aa_change_hat()
1279 		error = may_change_ptraced_domain(subj_cred, new, &info);  in aa_change_hat()
1284 		 * no new privs prevents domain transitions that would  in aa_change_hat()
1288 		    !aa_label_is_unconfined_subset(new, ctx->nnp)) {  in aa_change_hat()
1299 		target = new;  in aa_change_hat()
1300 		error = aa_set_current_hat(new, token);  in aa_change_hat()
1306 		 * no new privs prevents domain transitions that would  in aa_change_hat()
1331 	aa_put_label(new);  in aa_change_hat()
1382  * Change to new profile @name.  Unlike with hats, there is no way
1392 	struct aa_label *label, *new = NULL, *target = NULL;  in aa_change_profile()  local
1407 	 * Detect no new privs being set, and store the label it  in aa_change_profile()
1527 		new = fn_label_build_in_scope(label, profile, GFP_KERNEL,  in aa_change_profile()
1531 		 * no new privs prevents domain transitions that would  in aa_change_profile()
1535 		    !aa_label_is_unconfined_subset(new, ctx->nnp)) {  in aa_change_profile()
1547 			new = aa_label_merge(label, target, GFP_KERNEL);  in aa_change_profile()
1548 		if (IS_ERR_OR_NULL(new)) {  in aa_change_profile()
1550 			if (!new)  in aa_change_profile()
1553 				error = PTR_ERR(new);  in aa_change_profile()
1554 			new = NULL;  in aa_change_profile()
1558 		error = aa_replace_current_label(new);  in aa_change_profile()
1560 		if (new) {  in aa_change_profile()
1561 			aa_put_label(new);  in aa_change_profile()
1562 			new = NULL;  in aa_change_profile()
1573 				      NULL, new ? new : target,  in aa_change_profile()
1577 	aa_put_label(new);  in aa_change_profile()