Linux Audio

Check our new training course

Loading...
v4.17
 
   1/*
   2 * AppArmor security module
   3 *
   4 * This file contains AppArmor functions for unpacking policy loaded from
   5 * userspace.
   6 *
   7 * Copyright (C) 1998-2008 Novell/SUSE
   8 * Copyright 2009-2010 Canonical Ltd.
   9 *
  10 * This program is free software; you can redistribute it and/or
  11 * modify it under the terms of the GNU General Public License as
  12 * published by the Free Software Foundation, version 2 of the
  13 * License.
  14 *
  15 * AppArmor uses a serialized binary format for loading policy. To find
  16 * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
  17 * All policy is validated before it is used.
  18 */
  19
  20#include <asm/unaligned.h>
  21#include <linux/ctype.h>
  22#include <linux/errno.h>
 
  23
  24#include "include/apparmor.h"
  25#include "include/audit.h"
  26#include "include/cred.h"
  27#include "include/crypto.h"
  28#include "include/match.h"
  29#include "include/path.h"
  30#include "include/policy.h"
  31#include "include/policy_unpack.h"
  32
  33#define K_ABI_MASK 0x3ff
  34#define FORCE_COMPLAIN_FLAG 0x800
  35#define VERSION_LT(X, Y) (((X) & K_ABI_MASK) < ((Y) & K_ABI_MASK))
  36#define VERSION_GT(X, Y) (((X) & K_ABI_MASK) > ((Y) & K_ABI_MASK))
  37
  38#define v5	5	/* base version */
  39#define v6	6	/* per entry policydb mediation check */
  40#define v7	7
  41#define v8	8	/* full network masking */
  42
  43/*
  44 * The AppArmor interface treats data as a type byte followed by the
  45 * actual data.  The interface has the notion of a a named entry
  46 * which has a name (AA_NAME typecode followed by name string) followed by
  47 * the entries typecode and data.  Named types allow for optional
  48 * elements and extensions to be added and tested for without breaking
  49 * backwards compatibility.
  50 */
  51
  52enum aa_code {
  53	AA_U8,
  54	AA_U16,
  55	AA_U32,
  56	AA_U64,
  57	AA_NAME,		/* same as string except it is items name */
  58	AA_STRING,
  59	AA_BLOB,
  60	AA_STRUCT,
  61	AA_STRUCTEND,
  62	AA_LIST,
  63	AA_LISTEND,
  64	AA_ARRAY,
  65	AA_ARRAYEND,
  66};
  67
  68/*
  69 * aa_ext is the read of the buffer containing the serialized profile.  The
  70 * data is copied into a kernel buffer in apparmorfs and then handed off to
  71 * the unpack routines.
  72 */
  73struct aa_ext {
  74	void *start;
  75	void *end;
  76	void *pos;		/* pointer to current position in the buffer */
  77	u32 version;
  78};
  79
  80/* audit callback for unpack fields */
  81static void audit_cb(struct audit_buffer *ab, void *va)
  82{
  83	struct common_audit_data *sa = va;
  84
  85	if (aad(sa)->iface.ns) {
  86		audit_log_format(ab, " ns=");
  87		audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  88	}
  89	if (aad(sa)->name) {
  90		audit_log_format(ab, " name=");
  91		audit_log_untrustedstring(ab, aad(sa)->name);
  92	}
  93	if (aad(sa)->iface.pos)
  94		audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
  95}
  96
  97/**
  98 * audit_iface - do audit message for policy unpacking/load/replace/remove
  99 * @new: profile if it has been allocated (MAYBE NULL)
 100 * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
 101 * @name: name of the profile being manipulated (MAYBE NULL)
 102 * @info: any extra info about the failure (MAYBE NULL)
 103 * @e: buffer position info
 104 * @error: error code
 105 *
 106 * Returns: %0 or error
 107 */
 108static int audit_iface(struct aa_profile *new, const char *ns_name,
 109		       const char *name, const char *info, struct aa_ext *e,
 110		       int error)
 111{
 112	struct aa_profile *profile = labels_profile(aa_current_raw_label());
 113	DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
 114	if (e)
 115		aad(&sa)->iface.pos = e->pos - e->start;
 116	aad(&sa)->iface.ns = ns_name;
 117	if (new)
 118		aad(&sa)->name = new->base.hname;
 119	else
 120		aad(&sa)->name = name;
 121	aad(&sa)->info = info;
 122	aad(&sa)->error = error;
 123
 124	return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
 125}
 126
 127void __aa_loaddata_update(struct aa_loaddata *data, long revision)
 128{
 129	AA_BUG(!data);
 130	AA_BUG(!data->ns);
 131	AA_BUG(!data->dents[AAFS_LOADDATA_REVISION]);
 132	AA_BUG(!mutex_is_locked(&data->ns->lock));
 133	AA_BUG(data->revision > revision);
 134
 135	data->revision = revision;
 136	d_inode(data->dents[AAFS_LOADDATA_DIR])->i_mtime =
 137		current_time(d_inode(data->dents[AAFS_LOADDATA_DIR]));
 138	d_inode(data->dents[AAFS_LOADDATA_REVISION])->i_mtime =
 139		current_time(d_inode(data->dents[AAFS_LOADDATA_REVISION]));
 140}
 141
 142bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
 143{
 144	if (l->size != r->size)
 145		return false;
 
 
 146	if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
 147		return false;
 148	return memcmp(l->data, r->data, r->size) == 0;
 149}
 150
 151/*
 152 * need to take the ns mutex lock which is NOT safe most places that
 153 * put_loaddata is called, so we have to delay freeing it
 154 */
 155static void do_loaddata_free(struct work_struct *work)
 156{
 157	struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
 158	struct aa_ns *ns = aa_get_ns(d->ns);
 159
 160	if (ns) {
 161		mutex_lock_nested(&ns->lock, ns->level);
 162		__aa_fs_remove_rawdata(d);
 163		mutex_unlock(&ns->lock);
 164		aa_put_ns(ns);
 165	}
 166
 167	kzfree(d->hash);
 168	kzfree(d->name);
 169	kvfree(d->data);
 170	kzfree(d);
 171}
 172
 173void aa_loaddata_kref(struct kref *kref)
 174{
 175	struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
 176
 177	if (d) {
 178		INIT_WORK(&d->work, do_loaddata_free);
 179		schedule_work(&d->work);
 180	}
 181}
 182
 183struct aa_loaddata *aa_loaddata_alloc(size_t size)
 184{
 185	struct aa_loaddata *d;
 186
 187	d = kzalloc(sizeof(*d), GFP_KERNEL);
 188	if (d == NULL)
 189		return ERR_PTR(-ENOMEM);
 190	d->data = kvzalloc(size, GFP_KERNEL);
 191	if (!d->data) {
 192		kfree(d);
 193		return ERR_PTR(-ENOMEM);
 194	}
 195	kref_init(&d->count);
 196	INIT_LIST_HEAD(&d->list);
 197
 198	return d;
 199}
 200
 201/* test if read will be in packed data bounds */
 202static bool inbounds(struct aa_ext *e, size_t size)
 203{
 204	return (size <= e->end - e->pos);
 205}
 206
 207static void *kvmemdup(const void *src, size_t len)
 208{
 209	void *p = kvmalloc(len, GFP_KERNEL);
 210
 211	if (p)
 212		memcpy(p, src, len);
 213	return p;
 214}
 215
 216/**
 217 * aa_u16_chunck - test and do bounds checking for a u16 size based chunk
 218 * @e: serialized data read head (NOT NULL)
 219 * @chunk: start address for chunk of data (NOT NULL)
 220 *
 221 * Returns: the size of chunk found with the read head at the end of the chunk.
 222 */
 223static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
 224{
 225	size_t size = 0;
 
 226
 227	if (!inbounds(e, sizeof(u16)))
 228		return 0;
 229	size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 230	e->pos += sizeof(__le16);
 231	if (!inbounds(e, size))
 232		return 0;
 233	*chunk = e->pos;
 234	e->pos += size;
 235	return size;
 
 
 
 
 236}
 237
 238/* unpack control byte */
 239static bool unpack_X(struct aa_ext *e, enum aa_code code)
 240{
 241	if (!inbounds(e, 1))
 242		return 0;
 243	if (*(u8 *) e->pos != code)
 244		return 0;
 245	e->pos++;
 246	return 1;
 247}
 248
 249/**
 250 * unpack_nameX - check is the next element is of type X with a name of @name
 251 * @e: serialized data extent information  (NOT NULL)
 252 * @code: type code
 253 * @name: name to match to the serialized element.  (MAYBE NULL)
 254 *
 255 * check that the next serialized data element is of type X and has a tag
 256 * name @name.  If @name is specified then there must be a matching
 257 * name element in the stream.  If @name is NULL any name element will be
 258 * skipped and only the typecode will be tested.
 259 *
 260 * Returns 1 on success (both type code and name tests match) and the read
 261 * head is advanced past the headers
 262 *
 263 * Returns: 0 if either match fails, the read head does not move
 264 */
 265static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
 266{
 267	/*
 268	 * May need to reset pos if name or type doesn't match
 269	 */
 270	void *pos = e->pos;
 271	/*
 272	 * Check for presence of a tagname, and if present name size
 273	 * AA_NAME tag value is a u16.
 274	 */
 275	if (unpack_X(e, AA_NAME)) {
 276		char *tag = NULL;
 277		size_t size = unpack_u16_chunk(e, &tag);
 278		/* if a name is specified it must match. otherwise skip tag */
 279		if (name && (!size || strcmp(name, tag)))
 280			goto fail;
 281	} else if (name) {
 282		/* if a name is specified and there is no name tag fail */
 283		goto fail;
 284	}
 285
 286	/* now check if type code matches */
 287	if (unpack_X(e, code))
 288		return 1;
 289
 290fail:
 291	e->pos = pos;
 292	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 293}
 294
 295static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 296{
 
 
 297	if (unpack_nameX(e, AA_U32, name)) {
 298		if (!inbounds(e, sizeof(u32)))
 299			return 0;
 300		if (data)
 301			*data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 302		e->pos += sizeof(u32);
 303		return 1;
 304	}
 305	return 0;
 
 
 
 306}
 307
 308static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
 309{
 
 
 310	if (unpack_nameX(e, AA_U64, name)) {
 311		if (!inbounds(e, sizeof(u64)))
 312			return 0;
 313		if (data)
 314			*data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
 315		e->pos += sizeof(u64);
 316		return 1;
 317	}
 318	return 0;
 
 
 
 319}
 320
 321static size_t unpack_array(struct aa_ext *e, const char *name)
 322{
 
 
 323	if (unpack_nameX(e, AA_ARRAY, name)) {
 324		int size;
 325		if (!inbounds(e, sizeof(u16)))
 326			return 0;
 327		size = (int)le16_to_cpu(get_unaligned((__le16 *) e->pos));
 328		e->pos += sizeof(u16);
 329		return size;
 330	}
 
 
 
 331	return 0;
 332}
 333
 334static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
 335{
 
 
 336	if (unpack_nameX(e, AA_BLOB, name)) {
 337		u32 size;
 338		if (!inbounds(e, sizeof(u32)))
 339			return 0;
 340		size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 341		e->pos += sizeof(u32);
 342		if (inbounds(e, (size_t) size)) {
 343			*blob = e->pos;
 344			e->pos += size;
 345			return size;
 346		}
 347	}
 
 
 
 348	return 0;
 349}
 350
 351static int unpack_str(struct aa_ext *e, const char **string, const char *name)
 352{
 353	char *src_str;
 354	size_t size = 0;
 355	void *pos = e->pos;
 356	*string = NULL;
 357	if (unpack_nameX(e, AA_STRING, name)) {
 358		size = unpack_u16_chunk(e, &src_str);
 359		if (size) {
 360			/* strings are null terminated, length is size - 1 */
 361			if (src_str[size - 1] != 0)
 362				goto fail;
 363			*string = src_str;
 
 
 364		}
 365	}
 366	return size;
 367
 368fail:
 369	e->pos = pos;
 370	return 0;
 371}
 372
 373static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
 374{
 375	const char *tmp;
 376	void *pos = e->pos;
 377	int res = unpack_str(e, &tmp, name);
 378	*string = NULL;
 379
 380	if (!res)
 381		return 0;
 382
 383	*string = kmemdup(tmp, res, GFP_KERNEL);
 384	if (!*string) {
 385		e->pos = pos;
 386		return 0;
 387	}
 388
 389	return res;
 390}
 391
 392#define DFA_VALID_PERM_MASK		0xffffffff
 393#define DFA_VALID_PERM2_MASK		0xffffffff
 394
 395/**
 396 * verify_accept - verify the accept tables of a dfa
 397 * @dfa: dfa to verify accept tables of (NOT NULL)
 398 * @flags: flags governing dfa
 399 *
 400 * Returns: 1 if valid accept tables else 0 if error
 401 */
 402static bool verify_accept(struct aa_dfa *dfa, int flags)
 403{
 404	int i;
 405
 406	/* verify accept permissions */
 407	for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
 408		int mode = ACCEPT_TABLE(dfa)[i];
 409
 410		if (mode & ~DFA_VALID_PERM_MASK)
 411			return 0;
 412
 413		if (ACCEPT_TABLE2(dfa)[i] & ~DFA_VALID_PERM2_MASK)
 414			return 0;
 415	}
 416	return 1;
 417}
 418
 419/**
 420 * unpack_dfa - unpack a file rule dfa
 421 * @e: serialized data extent information (NOT NULL)
 422 *
 423 * returns dfa or ERR_PTR or NULL if no dfa
 424 */
 425static struct aa_dfa *unpack_dfa(struct aa_ext *e)
 426{
 427	char *blob = NULL;
 428	size_t size;
 429	struct aa_dfa *dfa = NULL;
 430
 431	size = unpack_blob(e, &blob, "aadfa");
 432	if (size) {
 433		/*
 434		 * The dfa is aligned with in the blob to 8 bytes
 435		 * from the beginning of the stream.
 436		 * alignment adjust needed by dfa unpack
 437		 */
 438		size_t sz = blob - (char *) e->start -
 439			((e->pos - e->start) & 7);
 440		size_t pad = ALIGN(sz, 8) - sz;
 441		int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
 442			TO_ACCEPT2_FLAG(YYTD_DATA32) | DFA_FLAG_VERIFY_STATES;
 443		dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 444
 445		if (IS_ERR(dfa))
 446			return dfa;
 447
 448		if (!verify_accept(dfa, flags))
 449			goto fail;
 450	}
 451
 452	return dfa;
 453
 454fail:
 455	aa_put_dfa(dfa);
 456	return ERR_PTR(-EPROTO);
 457}
 458
 459/**
 460 * unpack_trans_table - unpack a profile transition table
 461 * @e: serialized data extent information  (NOT NULL)
 462 * @profile: profile to add the accept table to (NOT NULL)
 463 *
 464 * Returns: 1 if table successfully unpacked
 465 */
 466static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
 467{
 468	void *saved_pos = e->pos;
 469
 470	/* exec table is optional */
 471	if (unpack_nameX(e, AA_STRUCT, "xtable")) {
 472		int i, size;
 473
 474		size = unpack_array(e, NULL);
 475		/* currently 4 exec bits and entries 0-3 are reserved iupcx */
 476		if (size > 16 - 4)
 477			goto fail;
 478		profile->file.trans.table = kzalloc(sizeof(char *) * size,
 479						    GFP_KERNEL);
 480		if (!profile->file.trans.table)
 481			goto fail;
 482
 483		profile->file.trans.size = size;
 484		for (i = 0; i < size; i++) {
 485			char *str;
 486			int c, j, pos, size2 = unpack_strdup(e, &str, NULL);
 487			/* unpack_strdup verifies that the last character is
 488			 * null termination byte.
 489			 */
 490			if (!size2)
 491				goto fail;
 492			profile->file.trans.table[i] = str;
 493			/* verify that name doesn't start with space */
 494			if (isspace(*str))
 495				goto fail;
 496
 497			/* count internal #  of internal \0 */
 498			for (c = j = 0; j < size2 - 1; j++) {
 499				if (!str[j]) {
 500					pos = j;
 501					c++;
 502				}
 503			}
 504			if (*str == ':') {
 505				/* first character after : must be valid */
 506				if (!str[1])
 507					goto fail;
 508				/* beginning with : requires an embedded \0,
 509				 * verify that exactly 1 internal \0 exists
 510				 * trailing \0 already verified by unpack_strdup
 511				 *
 512				 * convert \0 back to : for label_parse
 513				 */
 514				if (c == 1)
 515					str[pos] = ':';
 516				else if (c > 1)
 517					goto fail;
 518			} else if (c)
 519				/* fail - all other cases with embedded \0 */
 520				goto fail;
 521		}
 522		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 523			goto fail;
 524		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 525			goto fail;
 526	}
 527	return 1;
 528
 529fail:
 530	aa_free_domain_entries(&profile->file.trans);
 531	e->pos = saved_pos;
 532	return 0;
 533}
 534
 535static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
 536{
 537	void *pos = e->pos;
 538
 539	if (unpack_nameX(e, AA_STRUCT, "xattrs")) {
 540		int i, size;
 541
 542		size = unpack_array(e, NULL);
 543		profile->xattr_count = size;
 544		profile->xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
 545		if (!profile->xattrs)
 546			goto fail;
 547		for (i = 0; i < size; i++) {
 548			if (!unpack_strdup(e, &profile->xattrs[i], NULL))
 549				goto fail;
 550		}
 551		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 552			goto fail;
 553		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 554			goto fail;
 555	}
 556
 557	return 1;
 558
 559fail:
 560	e->pos = pos;
 561	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 562}
 563
 564static bool unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
 565{
 566	void *pos = e->pos;
 567
 568	/* rlimits are optional */
 569	if (unpack_nameX(e, AA_STRUCT, "rlimits")) {
 570		int i, size;
 571		u32 tmp = 0;
 572		if (!unpack_u32(e, &tmp, NULL))
 573			goto fail;
 574		profile->rlimits.mask = tmp;
 575
 576		size = unpack_array(e, NULL);
 577		if (size > RLIM_NLIMITS)
 578			goto fail;
 579		for (i = 0; i < size; i++) {
 580			u64 tmp2 = 0;
 581			int a = aa_map_resource(i);
 582			if (!unpack_u64(e, &tmp2, NULL))
 583				goto fail;
 584			profile->rlimits.limits[a].rlim_max = tmp2;
 585		}
 586		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 587			goto fail;
 588		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 589			goto fail;
 590	}
 591	return 1;
 592
 593fail:
 594	e->pos = pos;
 595	return 0;
 596}
 597
 598static u32 strhash(const void *data, u32 len, u32 seed)
 599{
 600	const char * const *key = data;
 601
 602	return jhash(*key, strlen(*key), seed);
 603}
 604
 605static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
 606{
 607	const struct aa_data *data = obj;
 608	const char * const *key = arg->key;
 609
 610	return strcmp(data->key, *key);
 611}
 612
 613/**
 614 * unpack_profile - unpack a serialized profile
 615 * @e: serialized data extent information (NOT NULL)
 616 *
 617 * NOTE: unpack profile sets audit struct if there is a failure
 618 */
 619static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 620{
 621	struct aa_profile *profile = NULL;
 622	const char *tmpname, *tmpns = NULL, *name = NULL;
 623	const char *info = "failed to unpack profile";
 624	size_t ns_len;
 625	struct rhashtable_params params = { 0 };
 626	char *key = NULL;
 627	struct aa_data *data;
 628	int i, error = -EPROTO;
 629	kernel_cap_t tmpcap;
 630	u32 tmp;
 631
 632	*ns_name = NULL;
 633
 634	/* check that we have the right struct being passed */
 635	if (!unpack_nameX(e, AA_STRUCT, "profile"))
 636		goto fail;
 637	if (!unpack_str(e, &name, NULL))
 638		goto fail;
 639	if (*name == '\0')
 640		goto fail;
 641
 642	tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 643	if (tmpns) {
 644		*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 645		if (!*ns_name) {
 646			info = "out of memory";
 647			goto fail;
 648		}
 649		name = tmpname;
 650	}
 651
 652	profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
 653	if (!profile)
 654		return ERR_PTR(-ENOMEM);
 655
 656	/* profile renaming is optional */
 657	(void) unpack_str(e, &profile->rename, "rename");
 658
 659	/* attachment string is optional */
 660	(void) unpack_str(e, &profile->attach, "attach");
 661
 662	/* xmatch is optional and may be NULL */
 663	profile->xmatch = unpack_dfa(e);
 664	if (IS_ERR(profile->xmatch)) {
 665		error = PTR_ERR(profile->xmatch);
 666		profile->xmatch = NULL;
 667		info = "bad xmatch";
 668		goto fail;
 669	}
 670	/* xmatch_len is not optional if xmatch is set */
 671	if (profile->xmatch) {
 672		if (!unpack_u32(e, &tmp, NULL)) {
 673			info = "missing xmatch len";
 674			goto fail;
 675		}
 676		profile->xmatch_len = tmp;
 677	}
 678
 679	/* disconnected attachment string is optional */
 680	(void) unpack_str(e, &profile->disconnected, "disconnected");
 681
 682	/* per profile debug flags (complain, audit) */
 683	if (!unpack_nameX(e, AA_STRUCT, "flags")) {
 684		info = "profile missing flags";
 685		goto fail;
 686	}
 687	info = "failed to unpack profile flags";
 688	if (!unpack_u32(e, &tmp, NULL))
 689		goto fail;
 690	if (tmp & PACKED_FLAG_HAT)
 691		profile->label.flags |= FLAG_HAT;
 692	if (!unpack_u32(e, &tmp, NULL))
 693		goto fail;
 694	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))
 695		profile->mode = APPARMOR_COMPLAIN;
 
 
 696	else if (tmp == PACKED_MODE_KILL)
 697		profile->mode = APPARMOR_KILL;
 698	else if (tmp == PACKED_MODE_UNCONFINED)
 699		profile->mode = APPARMOR_UNCONFINED;
 
 
 700	if (!unpack_u32(e, &tmp, NULL))
 701		goto fail;
 702	if (tmp)
 703		profile->audit = AUDIT_ALL;
 704
 705	if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 706		goto fail;
 707
 708	/* path_flags is optional */
 709	if (unpack_u32(e, &profile->path_flags, "path_flags"))
 710		profile->path_flags |= profile->label.flags &
 711			PATH_MEDIATE_DELETED;
 712	else
 713		/* set a default value if path_flags field is not present */
 714		profile->path_flags = PATH_MEDIATE_DELETED;
 715
 716	info = "failed to unpack profile capabilities";
 717	if (!unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
 718		goto fail;
 719	if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
 720		goto fail;
 721	if (!unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
 722		goto fail;
 723	if (!unpack_u32(e, &tmpcap.cap[0], NULL))
 724		goto fail;
 725
 726	info = "failed to unpack upper profile capabilities";
 727	if (unpack_nameX(e, AA_STRUCT, "caps64")) {
 728		/* optional upper half of 64 bit caps */
 729		if (!unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
 730			goto fail;
 731		if (!unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
 732			goto fail;
 733		if (!unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
 734			goto fail;
 735		if (!unpack_u32(e, &(tmpcap.cap[1]), NULL))
 736			goto fail;
 737		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 738			goto fail;
 739	}
 740
 741	info = "failed to unpack extended profile capabilities";
 742	if (unpack_nameX(e, AA_STRUCT, "capsx")) {
 743		/* optional extended caps mediation mask */
 744		if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
 745			goto fail;
 746		if (!unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
 747			goto fail;
 748		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 749			goto fail;
 750	}
 751
 752	if (!unpack_xattrs(e, profile)) {
 753		info = "failed to unpack profile xattrs";
 754		goto fail;
 755	}
 756
 757	if (!unpack_rlimits(e, profile)) {
 758		info = "failed to unpack profile rlimits";
 759		goto fail;
 760	}
 761
 
 
 
 
 
 762	if (unpack_nameX(e, AA_STRUCT, "policydb")) {
 763		/* generic policy dfa - optional and may be NULL */
 764		info = "failed to unpack policydb";
 765		profile->policy.dfa = unpack_dfa(e);
 766		if (IS_ERR(profile->policy.dfa)) {
 767			error = PTR_ERR(profile->policy.dfa);
 768			profile->policy.dfa = NULL;
 769			goto fail;
 770		} else if (!profile->policy.dfa) {
 771			error = -EPROTO;
 772			goto fail;
 773		}
 774		if (!unpack_u32(e, &profile->policy.start[0], "start"))
 775			/* default start state */
 776			profile->policy.start[0] = DFA_START;
 777		/* setup class index */
 778		for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
 779			profile->policy.start[i] =
 780				aa_dfa_next(profile->policy.dfa,
 781					    profile->policy.start[0],
 782					    i);
 783		}
 784		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 785			goto fail;
 786	} else
 787		profile->policy.dfa = aa_get_dfa(nulldfa);
 788
 789	/* get file rules */
 790	profile->file.dfa = unpack_dfa(e);
 791	if (IS_ERR(profile->file.dfa)) {
 792		error = PTR_ERR(profile->file.dfa);
 793		profile->file.dfa = NULL;
 794		info = "failed to unpack profile file rules";
 795		goto fail;
 796	} else if (profile->file.dfa) {
 797		if (!unpack_u32(e, &profile->file.start, "dfa_start"))
 798			/* default start state */
 799			profile->file.start = DFA_START;
 800	} else if (profile->policy.dfa &&
 801		   profile->policy.start[AA_CLASS_FILE]) {
 802		profile->file.dfa = aa_get_dfa(profile->policy.dfa);
 803		profile->file.start = profile->policy.start[AA_CLASS_FILE];
 804	} else
 805		profile->file.dfa = aa_get_dfa(nulldfa);
 806
 807	if (!unpack_trans_table(e, profile)) {
 808		info = "failed to unpack profile transition table";
 809		goto fail;
 810	}
 811
 812	if (unpack_nameX(e, AA_STRUCT, "data")) {
 813		info = "out of memory";
 814		profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
 815		if (!profile->data)
 816			goto fail;
 817
 818		params.nelem_hint = 3;
 819		params.key_len = sizeof(void *);
 820		params.key_offset = offsetof(struct aa_data, key);
 821		params.head_offset = offsetof(struct aa_data, head);
 822		params.hashfn = strhash;
 823		params.obj_cmpfn = datacmp;
 824
 825		if (rhashtable_init(profile->data, &params)) {
 826			info = "failed to init key, value hash table";
 827			goto fail;
 828		}
 829
 830		while (unpack_strdup(e, &key, NULL)) {
 831			data = kzalloc(sizeof(*data), GFP_KERNEL);
 832			if (!data) {
 833				kzfree(key);
 834				goto fail;
 835			}
 836
 837			data->key = key;
 838			data->size = unpack_blob(e, &data->data, NULL);
 839			data->data = kvmemdup(data->data, data->size);
 840			if (data->size && !data->data) {
 841				kzfree(data->key);
 842				kzfree(data);
 843				goto fail;
 844			}
 845
 846			rhashtable_insert_fast(profile->data, &data->head,
 847					       profile->data->p);
 848		}
 849
 850		if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
 851			info = "failed to unpack end of key, value data table";
 852			goto fail;
 853		}
 854	}
 855
 856	if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
 857		info = "failed to unpack end of profile";
 858		goto fail;
 859	}
 860
 861	return profile;
 862
 863fail:
 864	if (profile)
 865		name = NULL;
 866	else if (!name)
 867		name = "unknown";
 868	audit_iface(profile, NULL, name, info, e, error);
 869	aa_free_profile(profile);
 870
 871	return ERR_PTR(error);
 872}
 873
 874/**
 875 * verify_head - unpack serialized stream header
 876 * @e: serialized data read head (NOT NULL)
 877 * @required: whether the header is required or optional
 878 * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
 879 *
 880 * Returns: error or 0 if header is good
 881 */
 882static int verify_header(struct aa_ext *e, int required, const char **ns)
 883{
 884	int error = -EPROTONOSUPPORT;
 885	const char *name = NULL;
 886	*ns = NULL;
 887
 888	/* get the interface version */
 889	if (!unpack_u32(e, &e->version, "version")) {
 890		if (required) {
 891			audit_iface(NULL, NULL, NULL, "invalid profile format",
 892				    e, error);
 893			return error;
 894		}
 895	}
 896
 897	/* Check that the interface version is currently supported.
 898	 * if not specified use previous version
 899	 * Mask off everything that is not kernel abi version
 900	 */
 901	if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) {
 902		audit_iface(NULL, NULL, NULL, "unsupported interface version",
 903			    e, error);
 904		return error;
 905	}
 906
 907	/* read the namespace if present */
 908	if (unpack_str(e, &name, "namespace")) {
 909		if (*name == '\0') {
 910			audit_iface(NULL, NULL, NULL, "invalid namespace name",
 911				    e, error);
 912			return error;
 913		}
 914		if (*ns && strcmp(*ns, name))
 915			audit_iface(NULL, NULL, NULL, "invalid ns change", e,
 916				    error);
 917		else if (!*ns)
 918			*ns = name;
 
 
 
 919	}
 920
 921	return 0;
 922}
 923
 924static bool verify_xindex(int xindex, int table_size)
 925{
 926	int index, xtype;
 927	xtype = xindex & AA_X_TYPE_MASK;
 928	index = xindex & AA_X_INDEX_MASK;
 929	if (xtype == AA_X_TABLE && index >= table_size)
 930		return 0;
 931	return 1;
 932}
 933
 934/* verify dfa xindexes are in range of transition tables */
 935static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
 936{
 937	int i;
 938	for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
 939		if (!verify_xindex(dfa_user_xindex(dfa, i), table_size))
 940			return 0;
 941		if (!verify_xindex(dfa_other_xindex(dfa, i), table_size))
 942			return 0;
 943	}
 944	return 1;
 945}
 946
 947/**
 948 * verify_profile - Do post unpack analysis to verify profile consistency
 949 * @profile: profile to verify (NOT NULL)
 950 *
 951 * Returns: 0 if passes verification else error
 952 */
 953static int verify_profile(struct aa_profile *profile)
 954{
 955	if (profile->file.dfa &&
 956	    !verify_dfa_xindex(profile->file.dfa,
 957			       profile->file.trans.size)) {
 958		audit_iface(profile, NULL, NULL, "Invalid named transition",
 959			    NULL, -EPROTO);
 960		return -EPROTO;
 961	}
 962
 963	return 0;
 964}
 965
 966void aa_load_ent_free(struct aa_load_ent *ent)
 967{
 968	if (ent) {
 969		aa_put_profile(ent->rename);
 970		aa_put_profile(ent->old);
 971		aa_put_profile(ent->new);
 972		kfree(ent->ns_name);
 973		kzfree(ent);
 974	}
 975}
 976
 977struct aa_load_ent *aa_load_ent_alloc(void)
 978{
 979	struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
 980	if (ent)
 981		INIT_LIST_HEAD(&ent->list);
 982	return ent;
 983}
 984
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 985/**
 986 * aa_unpack - unpack packed binary profile(s) data loaded from user space
 987 * @udata: user data copied to kmem  (NOT NULL)
 988 * @lh: list to place unpacked profiles in a aa_repl_ws
 989 * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
 990 *
 991 * Unpack user data and return refcounted allocated profile(s) stored in
 992 * @lh in order of discovery, with the list chain stored in base.list
 993 * or error
 994 *
 995 * Returns: profile(s) on @lh else error pointer if fails to unpack
 996 */
 997int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
 998	      const char **ns)
 999{
1000	struct aa_load_ent *tmp, *ent;
1001	struct aa_profile *profile = NULL;
1002	int error;
1003	struct aa_ext e = {
1004		.start = udata->data,
1005		.end = udata->data + udata->size,
1006		.pos = udata->data,
1007	};
1008
1009	*ns = NULL;
1010	while (e.pos < e.end) {
1011		char *ns_name = NULL;
1012		void *start;
1013		error = verify_header(&e, e.pos == e.start, ns);
1014		if (error)
1015			goto fail;
1016
1017		start = e.pos;
1018		profile = unpack_profile(&e, &ns_name);
1019		if (IS_ERR(profile)) {
1020			error = PTR_ERR(profile);
1021			goto fail;
1022		}
1023
1024		error = verify_profile(profile);
1025		if (error)
1026			goto fail_profile;
1027
1028		if (aa_g_hash_policy)
1029			error = aa_calc_profile_hash(profile, e.version, start,
1030						     e.pos - start);
1031		if (error)
1032			goto fail_profile;
1033
1034		ent = aa_load_ent_alloc();
1035		if (!ent) {
1036			error = -ENOMEM;
1037			goto fail_profile;
1038		}
1039
1040		ent->new = profile;
1041		ent->ns_name = ns_name;
1042		list_add_tail(&ent->list, lh);
1043	}
1044	udata->abi = e.version & K_ABI_MASK;
1045	if (aa_g_hash_policy) {
1046		udata->hash = aa_calc_hash(udata->data, udata->size);
1047		if (IS_ERR(udata->hash)) {
1048			error = PTR_ERR(udata->hash);
1049			udata->hash = NULL;
1050			goto fail;
1051		}
1052	}
 
 
 
1053	return 0;
1054
1055fail_profile:
1056	aa_put_profile(profile);
1057
1058fail:
1059	list_for_each_entry_safe(ent, tmp, lh, list) {
1060		list_del_init(&ent->list);
1061		aa_load_ent_free(ent);
1062	}
1063
1064	return error;
1065}
v5.14.15
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * AppArmor security module
   4 *
   5 * This file contains AppArmor functions for unpacking policy loaded from
   6 * userspace.
   7 *
   8 * Copyright (C) 1998-2008 Novell/SUSE
   9 * Copyright 2009-2010 Canonical Ltd.
  10 *
 
 
 
 
 
  11 * AppArmor uses a serialized binary format for loading policy. To find
  12 * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
  13 * All policy is validated before it is used.
  14 */
  15
  16#include <asm/unaligned.h>
  17#include <linux/ctype.h>
  18#include <linux/errno.h>
  19#include <linux/zlib.h>
  20
  21#include "include/apparmor.h"
  22#include "include/audit.h"
  23#include "include/cred.h"
  24#include "include/crypto.h"
  25#include "include/match.h"
  26#include "include/path.h"
  27#include "include/policy.h"
  28#include "include/policy_unpack.h"
  29
  30#define K_ABI_MASK 0x3ff
  31#define FORCE_COMPLAIN_FLAG 0x800
  32#define VERSION_LT(X, Y) (((X) & K_ABI_MASK) < ((Y) & K_ABI_MASK))
  33#define VERSION_GT(X, Y) (((X) & K_ABI_MASK) > ((Y) & K_ABI_MASK))
  34
  35#define v5	5	/* base version */
  36#define v6	6	/* per entry policydb mediation check */
  37#define v7	7
  38#define v8	8	/* full network masking */
  39
  40/*
  41 * The AppArmor interface treats data as a type byte followed by the
  42 * actual data.  The interface has the notion of a a named entry
  43 * which has a name (AA_NAME typecode followed by name string) followed by
  44 * the entries typecode and data.  Named types allow for optional
  45 * elements and extensions to be added and tested for without breaking
  46 * backwards compatibility.
  47 */
  48
  49enum aa_code {
  50	AA_U8,
  51	AA_U16,
  52	AA_U32,
  53	AA_U64,
  54	AA_NAME,		/* same as string except it is items name */
  55	AA_STRING,
  56	AA_BLOB,
  57	AA_STRUCT,
  58	AA_STRUCTEND,
  59	AA_LIST,
  60	AA_LISTEND,
  61	AA_ARRAY,
  62	AA_ARRAYEND,
  63};
  64
  65/*
  66 * aa_ext is the read of the buffer containing the serialized profile.  The
  67 * data is copied into a kernel buffer in apparmorfs and then handed off to
  68 * the unpack routines.
  69 */
  70struct aa_ext {
  71	void *start;
  72	void *end;
  73	void *pos;		/* pointer to current position in the buffer */
  74	u32 version;
  75};
  76
  77/* audit callback for unpack fields */
  78static void audit_cb(struct audit_buffer *ab, void *va)
  79{
  80	struct common_audit_data *sa = va;
  81
  82	if (aad(sa)->iface.ns) {
  83		audit_log_format(ab, " ns=");
  84		audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  85	}
  86	if (aad(sa)->name) {
  87		audit_log_format(ab, " name=");
  88		audit_log_untrustedstring(ab, aad(sa)->name);
  89	}
  90	if (aad(sa)->iface.pos)
  91		audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
  92}
  93
  94/**
  95 * audit_iface - do audit message for policy unpacking/load/replace/remove
  96 * @new: profile if it has been allocated (MAYBE NULL)
  97 * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
  98 * @name: name of the profile being manipulated (MAYBE NULL)
  99 * @info: any extra info about the failure (MAYBE NULL)
 100 * @e: buffer position info
 101 * @error: error code
 102 *
 103 * Returns: %0 or error
 104 */
 105static int audit_iface(struct aa_profile *new, const char *ns_name,
 106		       const char *name, const char *info, struct aa_ext *e,
 107		       int error)
 108{
 109	struct aa_profile *profile = labels_profile(aa_current_raw_label());
 110	DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
 111	if (e)
 112		aad(&sa)->iface.pos = e->pos - e->start;
 113	aad(&sa)->iface.ns = ns_name;
 114	if (new)
 115		aad(&sa)->name = new->base.hname;
 116	else
 117		aad(&sa)->name = name;
 118	aad(&sa)->info = info;
 119	aad(&sa)->error = error;
 120
 121	return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
 122}
 123
 124void __aa_loaddata_update(struct aa_loaddata *data, long revision)
 125{
 126	AA_BUG(!data);
 127	AA_BUG(!data->ns);
 128	AA_BUG(!data->dents[AAFS_LOADDATA_REVISION]);
 129	AA_BUG(!mutex_is_locked(&data->ns->lock));
 130	AA_BUG(data->revision > revision);
 131
 132	data->revision = revision;
 133	d_inode(data->dents[AAFS_LOADDATA_DIR])->i_mtime =
 134		current_time(d_inode(data->dents[AAFS_LOADDATA_DIR]));
 135	d_inode(data->dents[AAFS_LOADDATA_REVISION])->i_mtime =
 136		current_time(d_inode(data->dents[AAFS_LOADDATA_REVISION]));
 137}
 138
 139bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
 140{
 141	if (l->size != r->size)
 142		return false;
 143	if (l->compressed_size != r->compressed_size)
 144		return false;
 145	if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
 146		return false;
 147	return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
 148}
 149
 150/*
 151 * need to take the ns mutex lock which is NOT safe most places that
 152 * put_loaddata is called, so we have to delay freeing it
 153 */
 154static void do_loaddata_free(struct work_struct *work)
 155{
 156	struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
 157	struct aa_ns *ns = aa_get_ns(d->ns);
 158
 159	if (ns) {
 160		mutex_lock_nested(&ns->lock, ns->level);
 161		__aa_fs_remove_rawdata(d);
 162		mutex_unlock(&ns->lock);
 163		aa_put_ns(ns);
 164	}
 165
 166	kfree_sensitive(d->hash);
 167	kfree_sensitive(d->name);
 168	kvfree(d->data);
 169	kfree_sensitive(d);
 170}
 171
 172void aa_loaddata_kref(struct kref *kref)
 173{
 174	struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
 175
 176	if (d) {
 177		INIT_WORK(&d->work, do_loaddata_free);
 178		schedule_work(&d->work);
 179	}
 180}
 181
 182struct aa_loaddata *aa_loaddata_alloc(size_t size)
 183{
 184	struct aa_loaddata *d;
 185
 186	d = kzalloc(sizeof(*d), GFP_KERNEL);
 187	if (d == NULL)
 188		return ERR_PTR(-ENOMEM);
 189	d->data = kvzalloc(size, GFP_KERNEL);
 190	if (!d->data) {
 191		kfree(d);
 192		return ERR_PTR(-ENOMEM);
 193	}
 194	kref_init(&d->count);
 195	INIT_LIST_HEAD(&d->list);
 196
 197	return d;
 198}
 199
 200/* test if read will be in packed data bounds */
 201static bool inbounds(struct aa_ext *e, size_t size)
 202{
 203	return (size <= e->end - e->pos);
 204}
 205
 206static void *kvmemdup(const void *src, size_t len)
 207{
 208	void *p = kvmalloc(len, GFP_KERNEL);
 209
 210	if (p)
 211		memcpy(p, src, len);
 212	return p;
 213}
 214
 215/**
 216 * aa_u16_chunck - test and do bounds checking for a u16 size based chunk
 217 * @e: serialized data read head (NOT NULL)
 218 * @chunk: start address for chunk of data (NOT NULL)
 219 *
 220 * Returns: the size of chunk found with the read head at the end of the chunk.
 221 */
 222static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
 223{
 224	size_t size = 0;
 225	void *pos = e->pos;
 226
 227	if (!inbounds(e, sizeof(u16)))
 228		goto fail;
 229	size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 230	e->pos += sizeof(__le16);
 231	if (!inbounds(e, size))
 232		goto fail;
 233	*chunk = e->pos;
 234	e->pos += size;
 235	return size;
 236
 237fail:
 238	e->pos = pos;
 239	return 0;
 240}
 241
 242/* unpack control byte */
 243static bool unpack_X(struct aa_ext *e, enum aa_code code)
 244{
 245	if (!inbounds(e, 1))
 246		return false;
 247	if (*(u8 *) e->pos != code)
 248		return false;
 249	e->pos++;
 250	return true;
 251}
 252
 253/**
 254 * unpack_nameX - check is the next element is of type X with a name of @name
 255 * @e: serialized data extent information  (NOT NULL)
 256 * @code: type code
 257 * @name: name to match to the serialized element.  (MAYBE NULL)
 258 *
 259 * check that the next serialized data element is of type X and has a tag
 260 * name @name.  If @name is specified then there must be a matching
 261 * name element in the stream.  If @name is NULL any name element will be
 262 * skipped and only the typecode will be tested.
 263 *
 264 * Returns true on success (both type code and name tests match) and the read
 265 * head is advanced past the headers
 266 *
 267 * Returns: false if either match fails, the read head does not move
 268 */
 269static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
 270{
 271	/*
 272	 * May need to reset pos if name or type doesn't match
 273	 */
 274	void *pos = e->pos;
 275	/*
 276	 * Check for presence of a tagname, and if present name size
 277	 * AA_NAME tag value is a u16.
 278	 */
 279	if (unpack_X(e, AA_NAME)) {
 280		char *tag = NULL;
 281		size_t size = unpack_u16_chunk(e, &tag);
 282		/* if a name is specified it must match. otherwise skip tag */
 283		if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
 284			goto fail;
 285	} else if (name) {
 286		/* if a name is specified and there is no name tag fail */
 287		goto fail;
 288	}
 289
 290	/* now check if type code matches */
 291	if (unpack_X(e, code))
 292		return true;
 293
 294fail:
 295	e->pos = pos;
 296	return false;
 297}
 298
 299static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
 300{
 301	void *pos = e->pos;
 302
 303	if (unpack_nameX(e, AA_U8, name)) {
 304		if (!inbounds(e, sizeof(u8)))
 305			goto fail;
 306		if (data)
 307			*data = *((u8 *)e->pos);
 308		e->pos += sizeof(u8);
 309		return true;
 310	}
 311
 312fail:
 313	e->pos = pos;
 314	return false;
 315}
 316
 317static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 318{
 319	void *pos = e->pos;
 320
 321	if (unpack_nameX(e, AA_U32, name)) {
 322		if (!inbounds(e, sizeof(u32)))
 323			goto fail;
 324		if (data)
 325			*data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 326		e->pos += sizeof(u32);
 327		return true;
 328	}
 329
 330fail:
 331	e->pos = pos;
 332	return false;
 333}
 334
 335static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
 336{
 337	void *pos = e->pos;
 338
 339	if (unpack_nameX(e, AA_U64, name)) {
 340		if (!inbounds(e, sizeof(u64)))
 341			goto fail;
 342		if (data)
 343			*data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
 344		e->pos += sizeof(u64);
 345		return true;
 346	}
 347
 348fail:
 349	e->pos = pos;
 350	return false;
 351}
 352
 353static size_t unpack_array(struct aa_ext *e, const char *name)
 354{
 355	void *pos = e->pos;
 356
 357	if (unpack_nameX(e, AA_ARRAY, name)) {
 358		int size;
 359		if (!inbounds(e, sizeof(u16)))
 360			goto fail;
 361		size = (int)le16_to_cpu(get_unaligned((__le16 *) e->pos));
 362		e->pos += sizeof(u16);
 363		return size;
 364	}
 365
 366fail:
 367	e->pos = pos;
 368	return 0;
 369}
 370
 371static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
 372{
 373	void *pos = e->pos;
 374
 375	if (unpack_nameX(e, AA_BLOB, name)) {
 376		u32 size;
 377		if (!inbounds(e, sizeof(u32)))
 378			goto fail;
 379		size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 380		e->pos += sizeof(u32);
 381		if (inbounds(e, (size_t) size)) {
 382			*blob = e->pos;
 383			e->pos += size;
 384			return size;
 385		}
 386	}
 387
 388fail:
 389	e->pos = pos;
 390	return 0;
 391}
 392
 393static int unpack_str(struct aa_ext *e, const char **string, const char *name)
 394{
 395	char *src_str;
 396	size_t size = 0;
 397	void *pos = e->pos;
 398	*string = NULL;
 399	if (unpack_nameX(e, AA_STRING, name)) {
 400		size = unpack_u16_chunk(e, &src_str);
 401		if (size) {
 402			/* strings are null terminated, length is size - 1 */
 403			if (src_str[size - 1] != 0)
 404				goto fail;
 405			*string = src_str;
 406
 407			return size;
 408		}
 409	}
 
 410
 411fail:
 412	e->pos = pos;
 413	return 0;
 414}
 415
 416static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
 417{
 418	const char *tmp;
 419	void *pos = e->pos;
 420	int res = unpack_str(e, &tmp, name);
 421	*string = NULL;
 422
 423	if (!res)
 424		return 0;
 425
 426	*string = kmemdup(tmp, res, GFP_KERNEL);
 427	if (!*string) {
 428		e->pos = pos;
 429		return 0;
 430	}
 431
 432	return res;
 433}
 434
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 435
 436/**
 437 * unpack_dfa - unpack a file rule dfa
 438 * @e: serialized data extent information (NOT NULL)
 439 *
 440 * returns dfa or ERR_PTR or NULL if no dfa
 441 */
 442static struct aa_dfa *unpack_dfa(struct aa_ext *e)
 443{
 444	char *blob = NULL;
 445	size_t size;
 446	struct aa_dfa *dfa = NULL;
 447
 448	size = unpack_blob(e, &blob, "aadfa");
 449	if (size) {
 450		/*
 451		 * The dfa is aligned with in the blob to 8 bytes
 452		 * from the beginning of the stream.
 453		 * alignment adjust needed by dfa unpack
 454		 */
 455		size_t sz = blob - (char *) e->start -
 456			((e->pos - e->start) & 7);
 457		size_t pad = ALIGN(sz, 8) - sz;
 458		int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
 459			TO_ACCEPT2_FLAG(YYTD_DATA32) | DFA_FLAG_VERIFY_STATES;
 460		dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 461
 462		if (IS_ERR(dfa))
 463			return dfa;
 464
 
 
 465	}
 466
 467	return dfa;
 
 
 
 
 468}
 469
 470/**
 471 * unpack_trans_table - unpack a profile transition table
 472 * @e: serialized data extent information  (NOT NULL)
 473 * @profile: profile to add the accept table to (NOT NULL)
 474 *
 475 * Returns: true if table successfully unpacked
 476 */
 477static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
 478{
 479	void *saved_pos = e->pos;
 480
 481	/* exec table is optional */
 482	if (unpack_nameX(e, AA_STRUCT, "xtable")) {
 483		int i, size;
 484
 485		size = unpack_array(e, NULL);
 486		/* currently 4 exec bits and entries 0-3 are reserved iupcx */
 487		if (size > 16 - 4)
 488			goto fail;
 489		profile->file.trans.table = kcalloc(size, sizeof(char *),
 490						    GFP_KERNEL);
 491		if (!profile->file.trans.table)
 492			goto fail;
 493
 494		profile->file.trans.size = size;
 495		for (i = 0; i < size; i++) {
 496			char *str;
 497			int c, j, pos, size2 = unpack_strdup(e, &str, NULL);
 498			/* unpack_strdup verifies that the last character is
 499			 * null termination byte.
 500			 */
 501			if (!size2)
 502				goto fail;
 503			profile->file.trans.table[i] = str;
 504			/* verify that name doesn't start with space */
 505			if (isspace(*str))
 506				goto fail;
 507
 508			/* count internal #  of internal \0 */
 509			for (c = j = 0; j < size2 - 1; j++) {
 510				if (!str[j]) {
 511					pos = j;
 512					c++;
 513				}
 514			}
 515			if (*str == ':') {
 516				/* first character after : must be valid */
 517				if (!str[1])
 518					goto fail;
 519				/* beginning with : requires an embedded \0,
 520				 * verify that exactly 1 internal \0 exists
 521				 * trailing \0 already verified by unpack_strdup
 522				 *
 523				 * convert \0 back to : for label_parse
 524				 */
 525				if (c == 1)
 526					str[pos] = ':';
 527				else if (c > 1)
 528					goto fail;
 529			} else if (c)
 530				/* fail - all other cases with embedded \0 */
 531				goto fail;
 532		}
 533		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 534			goto fail;
 535		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 536			goto fail;
 537	}
 538	return true;
 539
 540fail:
 541	aa_free_domain_entries(&profile->file.trans);
 542	e->pos = saved_pos;
 543	return false;
 544}
 545
 546static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
 547{
 548	void *pos = e->pos;
 549
 550	if (unpack_nameX(e, AA_STRUCT, "xattrs")) {
 551		int i, size;
 552
 553		size = unpack_array(e, NULL);
 554		profile->xattr_count = size;
 555		profile->xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
 556		if (!profile->xattrs)
 557			goto fail;
 558		for (i = 0; i < size; i++) {
 559			if (!unpack_strdup(e, &profile->xattrs[i], NULL))
 560				goto fail;
 561		}
 562		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 563			goto fail;
 564		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 565			goto fail;
 566	}
 567
 568	return true;
 569
 570fail:
 571	e->pos = pos;
 572	return false;
 573}
 574
 575static bool unpack_secmark(struct aa_ext *e, struct aa_profile *profile)
 576{
 577	void *pos = e->pos;
 578	int i, size;
 579
 580	if (unpack_nameX(e, AA_STRUCT, "secmark")) {
 581		size = unpack_array(e, NULL);
 582
 583		profile->secmark = kcalloc(size, sizeof(struct aa_secmark),
 584					   GFP_KERNEL);
 585		if (!profile->secmark)
 586			goto fail;
 587
 588		profile->secmark_count = size;
 589
 590		for (i = 0; i < size; i++) {
 591			if (!unpack_u8(e, &profile->secmark[i].audit, NULL))
 592				goto fail;
 593			if (!unpack_u8(e, &profile->secmark[i].deny, NULL))
 594				goto fail;
 595			if (!unpack_strdup(e, &profile->secmark[i].label, NULL))
 596				goto fail;
 597		}
 598		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 599			goto fail;
 600		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 601			goto fail;
 602	}
 603
 604	return true;
 605
 606fail:
 607	if (profile->secmark) {
 608		for (i = 0; i < size; i++)
 609			kfree(profile->secmark[i].label);
 610		kfree(profile->secmark);
 611		profile->secmark_count = 0;
 612		profile->secmark = NULL;
 613	}
 614
 615	e->pos = pos;
 616	return false;
 617}
 618
 619static bool unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
 620{
 621	void *pos = e->pos;
 622
 623	/* rlimits are optional */
 624	if (unpack_nameX(e, AA_STRUCT, "rlimits")) {
 625		int i, size;
 626		u32 tmp = 0;
 627		if (!unpack_u32(e, &tmp, NULL))
 628			goto fail;
 629		profile->rlimits.mask = tmp;
 630
 631		size = unpack_array(e, NULL);
 632		if (size > RLIM_NLIMITS)
 633			goto fail;
 634		for (i = 0; i < size; i++) {
 635			u64 tmp2 = 0;
 636			int a = aa_map_resource(i);
 637			if (!unpack_u64(e, &tmp2, NULL))
 638				goto fail;
 639			profile->rlimits.limits[a].rlim_max = tmp2;
 640		}
 641		if (!unpack_nameX(e, AA_ARRAYEND, NULL))
 642			goto fail;
 643		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 644			goto fail;
 645	}
 646	return true;
 647
 648fail:
 649	e->pos = pos;
 650	return false;
 651}
 652
 653static u32 strhash(const void *data, u32 len, u32 seed)
 654{
 655	const char * const *key = data;
 656
 657	return jhash(*key, strlen(*key), seed);
 658}
 659
 660static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
 661{
 662	const struct aa_data *data = obj;
 663	const char * const *key = arg->key;
 664
 665	return strcmp(data->key, *key);
 666}
 667
 668/**
 669 * unpack_profile - unpack a serialized profile
 670 * @e: serialized data extent information (NOT NULL)
 671 *
 672 * NOTE: unpack profile sets audit struct if there is a failure
 673 */
 674static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 675{
 676	struct aa_profile *profile = NULL;
 677	const char *tmpname, *tmpns = NULL, *name = NULL;
 678	const char *info = "failed to unpack profile";
 679	size_t ns_len;
 680	struct rhashtable_params params = { 0 };
 681	char *key = NULL;
 682	struct aa_data *data;
 683	int i, error = -EPROTO;
 684	kernel_cap_t tmpcap;
 685	u32 tmp;
 686
 687	*ns_name = NULL;
 688
 689	/* check that we have the right struct being passed */
 690	if (!unpack_nameX(e, AA_STRUCT, "profile"))
 691		goto fail;
 692	if (!unpack_str(e, &name, NULL))
 693		goto fail;
 694	if (*name == '\0')
 695		goto fail;
 696
 697	tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 698	if (tmpns) {
 699		*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 700		if (!*ns_name) {
 701			info = "out of memory";
 702			goto fail;
 703		}
 704		name = tmpname;
 705	}
 706
 707	profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
 708	if (!profile)
 709		return ERR_PTR(-ENOMEM);
 710
 711	/* profile renaming is optional */
 712	(void) unpack_str(e, &profile->rename, "rename");
 713
 714	/* attachment string is optional */
 715	(void) unpack_str(e, &profile->attach, "attach");
 716
 717	/* xmatch is optional and may be NULL */
 718	profile->xmatch = unpack_dfa(e);
 719	if (IS_ERR(profile->xmatch)) {
 720		error = PTR_ERR(profile->xmatch);
 721		profile->xmatch = NULL;
 722		info = "bad xmatch";
 723		goto fail;
 724	}
 725	/* xmatch_len is not optional if xmatch is set */
 726	if (profile->xmatch) {
 727		if (!unpack_u32(e, &tmp, NULL)) {
 728			info = "missing xmatch len";
 729			goto fail;
 730		}
 731		profile->xmatch_len = tmp;
 732	}
 733
 734	/* disconnected attachment string is optional */
 735	(void) unpack_str(e, &profile->disconnected, "disconnected");
 736
 737	/* per profile debug flags (complain, audit) */
 738	if (!unpack_nameX(e, AA_STRUCT, "flags")) {
 739		info = "profile missing flags";
 740		goto fail;
 741	}
 742	info = "failed to unpack profile flags";
 743	if (!unpack_u32(e, &tmp, NULL))
 744		goto fail;
 745	if (tmp & PACKED_FLAG_HAT)
 746		profile->label.flags |= FLAG_HAT;
 747	if (!unpack_u32(e, &tmp, NULL))
 748		goto fail;
 749	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))
 750		profile->mode = APPARMOR_COMPLAIN;
 751	else if (tmp == PACKED_MODE_ENFORCE)
 752		profile->mode = APPARMOR_ENFORCE;
 753	else if (tmp == PACKED_MODE_KILL)
 754		profile->mode = APPARMOR_KILL;
 755	else if (tmp == PACKED_MODE_UNCONFINED)
 756		profile->mode = APPARMOR_UNCONFINED;
 757	else
 758		goto fail;
 759	if (!unpack_u32(e, &tmp, NULL))
 760		goto fail;
 761	if (tmp)
 762		profile->audit = AUDIT_ALL;
 763
 764	if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 765		goto fail;
 766
 767	/* path_flags is optional */
 768	if (unpack_u32(e, &profile->path_flags, "path_flags"))
 769		profile->path_flags |= profile->label.flags &
 770			PATH_MEDIATE_DELETED;
 771	else
 772		/* set a default value if path_flags field is not present */
 773		profile->path_flags = PATH_MEDIATE_DELETED;
 774
 775	info = "failed to unpack profile capabilities";
 776	if (!unpack_u32(e, &(profile->caps.allow.cap[0]), NULL))
 777		goto fail;
 778	if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
 779		goto fail;
 780	if (!unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
 781		goto fail;
 782	if (!unpack_u32(e, &tmpcap.cap[0], NULL))
 783		goto fail;
 784
 785	info = "failed to unpack upper profile capabilities";
 786	if (unpack_nameX(e, AA_STRUCT, "caps64")) {
 787		/* optional upper half of 64 bit caps */
 788		if (!unpack_u32(e, &(profile->caps.allow.cap[1]), NULL))
 789			goto fail;
 790		if (!unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
 791			goto fail;
 792		if (!unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
 793			goto fail;
 794		if (!unpack_u32(e, &(tmpcap.cap[1]), NULL))
 795			goto fail;
 796		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 797			goto fail;
 798	}
 799
 800	info = "failed to unpack extended profile capabilities";
 801	if (unpack_nameX(e, AA_STRUCT, "capsx")) {
 802		/* optional extended caps mediation mask */
 803		if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
 804			goto fail;
 805		if (!unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
 806			goto fail;
 807		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 808			goto fail;
 809	}
 810
 811	if (!unpack_xattrs(e, profile)) {
 812		info = "failed to unpack profile xattrs";
 813		goto fail;
 814	}
 815
 816	if (!unpack_rlimits(e, profile)) {
 817		info = "failed to unpack profile rlimits";
 818		goto fail;
 819	}
 820
 821	if (!unpack_secmark(e, profile)) {
 822		info = "failed to unpack profile secmark rules";
 823		goto fail;
 824	}
 825
 826	if (unpack_nameX(e, AA_STRUCT, "policydb")) {
 827		/* generic policy dfa - optional and may be NULL */
 828		info = "failed to unpack policydb";
 829		profile->policy.dfa = unpack_dfa(e);
 830		if (IS_ERR(profile->policy.dfa)) {
 831			error = PTR_ERR(profile->policy.dfa);
 832			profile->policy.dfa = NULL;
 833			goto fail;
 834		} else if (!profile->policy.dfa) {
 835			error = -EPROTO;
 836			goto fail;
 837		}
 838		if (!unpack_u32(e, &profile->policy.start[0], "start"))
 839			/* default start state */
 840			profile->policy.start[0] = DFA_START;
 841		/* setup class index */
 842		for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
 843			profile->policy.start[i] =
 844				aa_dfa_next(profile->policy.dfa,
 845					    profile->policy.start[0],
 846					    i);
 847		}
 848		if (!unpack_nameX(e, AA_STRUCTEND, NULL))
 849			goto fail;
 850	} else
 851		profile->policy.dfa = aa_get_dfa(nulldfa);
 852
 853	/* get file rules */
 854	profile->file.dfa = unpack_dfa(e);
 855	if (IS_ERR(profile->file.dfa)) {
 856		error = PTR_ERR(profile->file.dfa);
 857		profile->file.dfa = NULL;
 858		info = "failed to unpack profile file rules";
 859		goto fail;
 860	} else if (profile->file.dfa) {
 861		if (!unpack_u32(e, &profile->file.start, "dfa_start"))
 862			/* default start state */
 863			profile->file.start = DFA_START;
 864	} else if (profile->policy.dfa &&
 865		   profile->policy.start[AA_CLASS_FILE]) {
 866		profile->file.dfa = aa_get_dfa(profile->policy.dfa);
 867		profile->file.start = profile->policy.start[AA_CLASS_FILE];
 868	} else
 869		profile->file.dfa = aa_get_dfa(nulldfa);
 870
 871	if (!unpack_trans_table(e, profile)) {
 872		info = "failed to unpack profile transition table";
 873		goto fail;
 874	}
 875
 876	if (unpack_nameX(e, AA_STRUCT, "data")) {
 877		info = "out of memory";
 878		profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
 879		if (!profile->data)
 880			goto fail;
 881
 882		params.nelem_hint = 3;
 883		params.key_len = sizeof(void *);
 884		params.key_offset = offsetof(struct aa_data, key);
 885		params.head_offset = offsetof(struct aa_data, head);
 886		params.hashfn = strhash;
 887		params.obj_cmpfn = datacmp;
 888
 889		if (rhashtable_init(profile->data, &params)) {
 890			info = "failed to init key, value hash table";
 891			goto fail;
 892		}
 893
 894		while (unpack_strdup(e, &key, NULL)) {
 895			data = kzalloc(sizeof(*data), GFP_KERNEL);
 896			if (!data) {
 897				kfree_sensitive(key);
 898				goto fail;
 899			}
 900
 901			data->key = key;
 902			data->size = unpack_blob(e, &data->data, NULL);
 903			data->data = kvmemdup(data->data, data->size);
 904			if (data->size && !data->data) {
 905				kfree_sensitive(data->key);
 906				kfree_sensitive(data);
 907				goto fail;
 908			}
 909
 910			rhashtable_insert_fast(profile->data, &data->head,
 911					       profile->data->p);
 912		}
 913
 914		if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
 915			info = "failed to unpack end of key, value data table";
 916			goto fail;
 917		}
 918	}
 919
 920	if (!unpack_nameX(e, AA_STRUCTEND, NULL)) {
 921		info = "failed to unpack end of profile";
 922		goto fail;
 923	}
 924
 925	return profile;
 926
 927fail:
 928	if (profile)
 929		name = NULL;
 930	else if (!name)
 931		name = "unknown";
 932	audit_iface(profile, NULL, name, info, e, error);
 933	aa_free_profile(profile);
 934
 935	return ERR_PTR(error);
 936}
 937
 938/**
 939 * verify_head - unpack serialized stream header
 940 * @e: serialized data read head (NOT NULL)
 941 * @required: whether the header is required or optional
 942 * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
 943 *
 944 * Returns: error or 0 if header is good
 945 */
 946static int verify_header(struct aa_ext *e, int required, const char **ns)
 947{
 948	int error = -EPROTONOSUPPORT;
 949	const char *name = NULL;
 950	*ns = NULL;
 951
 952	/* get the interface version */
 953	if (!unpack_u32(e, &e->version, "version")) {
 954		if (required) {
 955			audit_iface(NULL, NULL, NULL, "invalid profile format",
 956				    e, error);
 957			return error;
 958		}
 959	}
 960
 961	/* Check that the interface version is currently supported.
 962	 * if not specified use previous version
 963	 * Mask off everything that is not kernel abi version
 964	 */
 965	if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) {
 966		audit_iface(NULL, NULL, NULL, "unsupported interface version",
 967			    e, error);
 968		return error;
 969	}
 970
 971	/* read the namespace if present */
 972	if (unpack_str(e, &name, "namespace")) {
 973		if (*name == '\0') {
 974			audit_iface(NULL, NULL, NULL, "invalid namespace name",
 975				    e, error);
 976			return error;
 977		}
 978		if (*ns && strcmp(*ns, name)) {
 979			audit_iface(NULL, NULL, NULL, "invalid ns change", e,
 980				    error);
 981		} else if (!*ns) {
 982			*ns = kstrdup(name, GFP_KERNEL);
 983			if (!*ns)
 984				return -ENOMEM;
 985		}
 986	}
 987
 988	return 0;
 989}
 990
 991static bool verify_xindex(int xindex, int table_size)
 992{
 993	int index, xtype;
 994	xtype = xindex & AA_X_TYPE_MASK;
 995	index = xindex & AA_X_INDEX_MASK;
 996	if (xtype == AA_X_TABLE && index >= table_size)
 997		return false;
 998	return true;
 999}
1000
1001/* verify dfa xindexes are in range of transition tables */
1002static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
1003{
1004	int i;
1005	for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1006		if (!verify_xindex(dfa_user_xindex(dfa, i), table_size))
1007			return false;
1008		if (!verify_xindex(dfa_other_xindex(dfa, i), table_size))
1009			return false;
1010	}
1011	return true;
1012}
1013
1014/**
1015 * verify_profile - Do post unpack analysis to verify profile consistency
1016 * @profile: profile to verify (NOT NULL)
1017 *
1018 * Returns: 0 if passes verification else error
1019 */
1020static int verify_profile(struct aa_profile *profile)
1021{
1022	if (profile->file.dfa &&
1023	    !verify_dfa_xindex(profile->file.dfa,
1024			       profile->file.trans.size)) {
1025		audit_iface(profile, NULL, NULL, "Invalid named transition",
1026			    NULL, -EPROTO);
1027		return -EPROTO;
1028	}
1029
1030	return 0;
1031}
1032
1033void aa_load_ent_free(struct aa_load_ent *ent)
1034{
1035	if (ent) {
1036		aa_put_profile(ent->rename);
1037		aa_put_profile(ent->old);
1038		aa_put_profile(ent->new);
1039		kfree(ent->ns_name);
1040		kfree_sensitive(ent);
1041	}
1042}
1043
1044struct aa_load_ent *aa_load_ent_alloc(void)
1045{
1046	struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1047	if (ent)
1048		INIT_LIST_HEAD(&ent->list);
1049	return ent;
1050}
1051
1052static int deflate_compress(const char *src, size_t slen, char **dst,
1053			    size_t *dlen)
1054{
1055	int error;
1056	struct z_stream_s strm;
1057	void *stgbuf, *dstbuf;
1058	size_t stglen = deflateBound(slen);
1059
1060	memset(&strm, 0, sizeof(strm));
1061
1062	if (stglen < slen)
1063		return -EFBIG;
1064
1065	strm.workspace = kvzalloc(zlib_deflate_workspacesize(MAX_WBITS,
1066							     MAX_MEM_LEVEL),
1067				  GFP_KERNEL);
1068	if (!strm.workspace)
1069		return -ENOMEM;
1070
1071	error = zlib_deflateInit(&strm, aa_g_rawdata_compression_level);
1072	if (error != Z_OK) {
1073		error = -ENOMEM;
1074		goto fail_deflate_init;
1075	}
1076
1077	stgbuf = kvzalloc(stglen, GFP_KERNEL);
1078	if (!stgbuf) {
1079		error = -ENOMEM;
1080		goto fail_stg_alloc;
1081	}
1082
1083	strm.next_in = src;
1084	strm.avail_in = slen;
1085	strm.next_out = stgbuf;
1086	strm.avail_out = stglen;
1087
1088	error = zlib_deflate(&strm, Z_FINISH);
1089	if (error != Z_STREAM_END) {
1090		error = -EINVAL;
1091		goto fail_deflate;
1092	}
1093	error = 0;
1094
1095	if (is_vmalloc_addr(stgbuf)) {
1096		dstbuf = kvzalloc(strm.total_out, GFP_KERNEL);
1097		if (dstbuf) {
1098			memcpy(dstbuf, stgbuf, strm.total_out);
1099			kvfree(stgbuf);
1100		}
1101	} else
1102		/*
1103		 * If the staging buffer was kmalloc'd, then using krealloc is
1104		 * probably going to be faster. The destination buffer will
1105		 * always be smaller, so it's just shrunk, avoiding a memcpy
1106		 */
1107		dstbuf = krealloc(stgbuf, strm.total_out, GFP_KERNEL);
1108
1109	if (!dstbuf) {
1110		error = -ENOMEM;
1111		goto fail_deflate;
1112	}
1113
1114	*dst = dstbuf;
1115	*dlen = strm.total_out;
1116
1117fail_stg_alloc:
1118	zlib_deflateEnd(&strm);
1119fail_deflate_init:
1120	kvfree(strm.workspace);
1121	return error;
1122
1123fail_deflate:
1124	kvfree(stgbuf);
1125	goto fail_stg_alloc;
1126}
1127
1128static int compress_loaddata(struct aa_loaddata *data)
1129{
1130
1131	AA_BUG(data->compressed_size > 0);
1132
1133	/*
1134	 * Shortcut the no compression case, else we increase the amount of
1135	 * storage required by a small amount
1136	 */
1137	if (aa_g_rawdata_compression_level != 0) {
1138		void *udata = data->data;
1139		int error = deflate_compress(udata, data->size, &data->data,
1140					     &data->compressed_size);
1141		if (error)
1142			return error;
1143
1144		kvfree(udata);
1145	} else
1146		data->compressed_size = data->size;
1147
1148	return 0;
1149}
1150
1151/**
1152 * aa_unpack - unpack packed binary profile(s) data loaded from user space
1153 * @udata: user data copied to kmem  (NOT NULL)
1154 * @lh: list to place unpacked profiles in a aa_repl_ws
1155 * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1156 *
1157 * Unpack user data and return refcounted allocated profile(s) stored in
1158 * @lh in order of discovery, with the list chain stored in base.list
1159 * or error
1160 *
1161 * Returns: profile(s) on @lh else error pointer if fails to unpack
1162 */
1163int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1164	      const char **ns)
1165{
1166	struct aa_load_ent *tmp, *ent;
1167	struct aa_profile *profile = NULL;
1168	int error;
1169	struct aa_ext e = {
1170		.start = udata->data,
1171		.end = udata->data + udata->size,
1172		.pos = udata->data,
1173	};
1174
1175	*ns = NULL;
1176	while (e.pos < e.end) {
1177		char *ns_name = NULL;
1178		void *start;
1179		error = verify_header(&e, e.pos == e.start, ns);
1180		if (error)
1181			goto fail;
1182
1183		start = e.pos;
1184		profile = unpack_profile(&e, &ns_name);
1185		if (IS_ERR(profile)) {
1186			error = PTR_ERR(profile);
1187			goto fail;
1188		}
1189
1190		error = verify_profile(profile);
1191		if (error)
1192			goto fail_profile;
1193
1194		if (aa_g_hash_policy)
1195			error = aa_calc_profile_hash(profile, e.version, start,
1196						     e.pos - start);
1197		if (error)
1198			goto fail_profile;
1199
1200		ent = aa_load_ent_alloc();
1201		if (!ent) {
1202			error = -ENOMEM;
1203			goto fail_profile;
1204		}
1205
1206		ent->new = profile;
1207		ent->ns_name = ns_name;
1208		list_add_tail(&ent->list, lh);
1209	}
1210	udata->abi = e.version & K_ABI_MASK;
1211	if (aa_g_hash_policy) {
1212		udata->hash = aa_calc_hash(udata->data, udata->size);
1213		if (IS_ERR(udata->hash)) {
1214			error = PTR_ERR(udata->hash);
1215			udata->hash = NULL;
1216			goto fail;
1217		}
1218	}
1219	error = compress_loaddata(udata);
1220	if (error)
1221		goto fail;
1222	return 0;
1223
1224fail_profile:
1225	aa_put_profile(profile);
1226
1227fail:
1228	list_for_each_entry_safe(ent, tmp, lh, list) {
1229		list_del_init(&ent->list);
1230		aa_load_ent_free(ent);
1231	}
1232
1233	return error;
1234}
1235
1236#ifdef CONFIG_SECURITY_APPARMOR_KUNIT_TEST
1237#include "policy_unpack_test.c"
1238#endif /* CONFIG_SECURITY_APPARMOR_KUNIT_TEST */