security/apparmor/policy_unpack.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * AppArmor security module
   4  *
   5  * This file contains AppArmor functions for unpacking policy loaded from
   6  * userspace.
   7  *
   8  * Copyright (C) 1998-2008 Novell/SUSE
   9  * Copyright 2009-2010 Canonical Ltd.
  10  *
  11  * AppArmor uses a serialized binary format for loading policy. To find
  12  * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
  13  * All policy is validated before it is used.
  14  */
  15
  16 #include <asm/unaligned.h>
  17 #include <kunit/visibility.h>
  18 #include <linux/ctype.h>
  19 #include <linux/errno.h>
  20 #include <linux/zstd.h>
  21
  22 #include "include/apparmor.h"
  23 #include "include/audit.h"
  24 #include "include/cred.h"
  25 #include "include/crypto.h"
  26 #include "include/file.h"
  27 #include "include/match.h"
  28 #include "include/path.h"
  29 #include "include/policy.h"
  30 #include "include/policy_unpack.h"
  31 #include "include/policy_compat.h"
  32
  33 /* audit callback for unpack fields */
  34 static void audit_cb(struct audit_buffer *ab, void *va)
  35 {
  36         struct common_audit_data *sa = va;
  37
  38         if (aad(sa)->iface.ns) {
  39                 audit_log_format(ab, " ns=");
  40                 audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  41         }
  42         if (aad(sa)->name) {
  43                 audit_log_format(ab, " name=");
  44                 audit_log_untrustedstring(ab, aad(sa)->name);
  45         }
  46         if (aad(sa)->iface.pos)
  47                 audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
  48 }
  49
  50 /**
  51  * audit_iface - do audit message for policy unpacking/load/replace/remove
  52  * @new: profile if it has been allocated (MAYBE NULL)
  53  * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
  54  * @name: name of the profile being manipulated (MAYBE NULL)
  55  * @info: any extra info about the failure (MAYBE NULL)
  56  * @e: buffer position info
  57  * @error: error code
  58  *
  59  * Returns: %0 or error
  60  */
  61 static int audit_iface(struct aa_profile *new, const char *ns_name,
  62                        const char *name, const char *info, struct aa_ext *e,
  63                        int error)
  64 {
  65         struct aa_profile *profile = labels_profile(aa_current_raw_label());
  66         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
  67         if (e)
  68                 aad(&sa)->iface.pos = e->pos - e->start;
  69         aad(&sa)->iface.ns = ns_name;
  70         if (new)
  71                 aad(&sa)->name = new->base.hname;
  72         else
  73                 aad(&sa)->name = name;
  74         aad(&sa)->info = info;
  75         aad(&sa)->error = error;
  76
  77         return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
  78 }
  79
  80 void __aa_loaddata_update(struct aa_loaddata *data, long revision)
  81 {
  82         AA_BUG(!data);
  83         AA_BUG(!data->ns);
  84         AA_BUG(!mutex_is_locked(&data->ns->lock));
  85         AA_BUG(data->revision > revision);
  86
  87         data->revision = revision;
  88         if ((data->dents[AAFS_LOADDATA_REVISION])) {
  89                 d_inode(data->dents[AAFS_LOADDATA_DIR])->i_mtime =
  90                         current_time(d_inode(data->dents[AAFS_LOADDATA_DIR]));
  91                 d_inode(data->dents[AAFS_LOADDATA_REVISION])->i_mtime =
  92                         current_time(d_inode(data->dents[AAFS_LOADDATA_REVISION]));
  93         }
  94 }
  95
  96 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
  97 {
  98         if (l->size != r->size)
  99                 return false;
 100         if (l->compressed_size != r->compressed_size)
 101                 return false;
 102         if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
 103                 return false;
 104         return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
 105 }
 106
 107 /*
 108  * need to take the ns mutex lock which is NOT safe most places that
 109  * put_loaddata is called, so we have to delay freeing it
 110  */
 111 static void do_loaddata_free(struct work_struct *work)
 112 {
 113         struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
 114         struct aa_ns *ns = aa_get_ns(d->ns);
 115
 116         if (ns) {
 117                 mutex_lock_nested(&ns->lock, ns->level);
 118                 __aa_fs_remove_rawdata(d);
 119                 mutex_unlock(&ns->lock);
 120                 aa_put_ns(ns);
 121         }
 122
 123         kfree_sensitive(d->hash);
 124         kfree_sensitive(d->name);
 125         kvfree(d->data);
 126         kfree_sensitive(d);
 127 }
 128
 129 void aa_loaddata_kref(struct kref *kref)
 130 {
 131         struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
 132
 133         if (d) {
 134                 INIT_WORK(&d->work, do_loaddata_free);
 135                 schedule_work(&d->work);
 136         }
 137 }
 138
 139 struct aa_loaddata *aa_loaddata_alloc(size_t size)
 140 {
 141         struct aa_loaddata *d;
 142
 143         d = kzalloc(sizeof(*d), GFP_KERNEL);
 144         if (d == NULL)
 145                 return ERR_PTR(-ENOMEM);
 146         d->data = kvzalloc(size, GFP_KERNEL);
 147         if (!d->data) {
 148                 kfree(d);
 149                 return ERR_PTR(-ENOMEM);
 150         }
 151         kref_init(&d->count);
 152         INIT_LIST_HEAD(&d->list);
 153
 154         return d;
 155 }
 156
 157 /* test if read will be in packed data bounds */
 158 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
 159 {
 160         return (size <= e->end - e->pos);
 161 }
 162 EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
 163
 164 static void *kvmemdup(const void *src, size_t len)
 165 {
 166         void *p = kvmalloc(len, GFP_KERNEL);
 167
 168         if (p)
 169                 memcpy(p, src, len);
 170         return p;
 171 }
 172
 173 /**
 174  * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
 175  * @e: serialized data read head (NOT NULL)
 176  * @chunk: start address for chunk of data (NOT NULL)
 177  *
 178  * Returns: the size of chunk found with the read head at the end of the chunk.
 179  */
 180 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
 181 {
 182         size_t size = 0;
 183         void *pos = e->pos;
 184
 185         if (!aa_inbounds(e, sizeof(u16)))
 186                 goto fail;
 187         size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 188         e->pos += sizeof(__le16);
 189         if (!aa_inbounds(e, size))
 190                 goto fail;
 191         *chunk = e->pos;
 192         e->pos += size;
 193         return size;
 194
 195 fail:
 196         e->pos = pos;
 197         return 0;
 198 }
 199 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
 200
 201 /* unpack control byte */
 202 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
 203 {
 204         if (!aa_inbounds(e, 1))
 205                 return false;
 206         if (*(u8 *) e->pos != code)
 207                 return false;
 208         e->pos++;
 209         return true;
 210 }
 211 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
 212
 213 /**
 214  * aa_unpack_nameX - check is the next element is of type X with a name of @name
 215  * @e: serialized data extent information  (NOT NULL)
 216  * @code: type code
 217  * @name: name to match to the serialized element.  (MAYBE NULL)
 218  *
 219  * check that the next serialized data element is of type X and has a tag
 220  * name @name.  If @name is specified then there must be a matching
 221  * name element in the stream.  If @name is NULL any name element will be
 222  * skipped and only the typecode will be tested.
 223  *
 224  * Returns true on success (both type code and name tests match) and the read
 225  * head is advanced past the headers
 226  *
 227  * Returns: false if either match fails, the read head does not move
 228  */
 229 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
 230 {
 231         /*
 232          * May need to reset pos if name or type doesn't match
 233          */
 234         void *pos = e->pos;
 235         /*
 236          * Check for presence of a tagname, and if present name size
 237          * AA_NAME tag value is a u16.
 238          */
 239         if (aa_unpack_X(e, AA_NAME)) {
 240                 char *tag = NULL;
 241                 size_t size = aa_unpack_u16_chunk(e, &tag);
 242                 /* if a name is specified it must match. otherwise skip tag */
 243                 if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
 244                         goto fail;
 245         } else if (name) {
 246                 /* if a name is specified and there is no name tag fail */
 247                 goto fail;
 248         }
 249
 250         /* now check if type code matches */
 251         if (aa_unpack_X(e, code))
 252                 return true;
 253
 254 fail:
 255         e->pos = pos;
 256         return false;
 257 }
 258 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
 259
 260 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
 261 {
 262         void *pos = e->pos;
 263
 264         if (aa_unpack_nameX(e, AA_U8, name)) {
 265                 if (!aa_inbounds(e, sizeof(u8)))
 266                         goto fail;
 267                 if (data)
 268                         *data = *((u8 *)e->pos);
 269                 e->pos += sizeof(u8);
 270                 return true;
 271         }
 272
 273 fail:
 274         e->pos = pos;
 275         return false;
 276 }
 277
 278 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 279 {
 280         void *pos = e->pos;
 281
 282         if (aa_unpack_nameX(e, AA_U32, name)) {
 283                 if (!aa_inbounds(e, sizeof(u32)))
 284                         goto fail;
 285                 if (data)
 286                         *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 287                 e->pos += sizeof(u32);
 288                 return true;
 289         }
 290
 291 fail:
 292         e->pos = pos;
 293         return false;
 294 }
 295 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
 296
 297 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
 298 {
 299         void *pos = e->pos;
 300
 301         if (aa_unpack_nameX(e, AA_U64, name)) {
 302                 if (!aa_inbounds(e, sizeof(u64)))
 303                         goto fail;
 304                 if (data)
 305                         *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
 306                 e->pos += sizeof(u64);
 307                 return true;
 308         }
 309
 310 fail:
 311         e->pos = pos;
 312         return false;
 313 }
 314 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
 315
 316 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
 317 {
 318         void *pos = e->pos;
 319
 320         if (aa_unpack_nameX(e, AA_ARRAY, name)) {
 321                 if (!aa_inbounds(e, sizeof(u16)))
 322                         goto fail;
 323                 *size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
 324                 e->pos += sizeof(u16);
 325                 return true;
 326         }
 327
 328 fail:
 329         e->pos = pos;
 330         return false;
 331 }
 332 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
 333
 334 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
 335 {
 336         void *pos = e->pos;
 337
 338         if (aa_unpack_nameX(e, AA_BLOB, name)) {
 339                 u32 size;
 340                 if (!aa_inbounds(e, sizeof(u32)))
 341                         goto fail;
 342                 size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
 343                 e->pos += sizeof(u32);
 344                 if (aa_inbounds(e, (size_t) size)) {
 345                         *blob = e->pos;
 346                         e->pos += size;
 347                         return size;
 348                 }
 349         }
 350
 351 fail:
 352         e->pos = pos;
 353         return 0;
 354 }
 355 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
 356
 357 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
 358 {
 359         char *src_str;
 360         size_t size = 0;
 361         void *pos = e->pos;
 362         *string = NULL;
 363         if (aa_unpack_nameX(e, AA_STRING, name)) {
 364                 size = aa_unpack_u16_chunk(e, &src_str);
 365                 if (size) {
 366                         /* strings are null terminated, length is size - 1 */
 367                         if (src_str[size - 1] != 0)
 368                                 goto fail;
 369                         *string = src_str;
 370
 371                         return size;
 372                 }
 373         }
 374
 375 fail:
 376         e->pos = pos;
 377         return 0;
 378 }
 379 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
 380
 381 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
 382 {
 383         const char *tmp;
 384         void *pos = e->pos;
 385         int res = aa_unpack_str(e, &tmp, name);
 386         *string = NULL;
 387
 388         if (!res)
 389                 return 0;
 390
 391         *string = kmemdup(tmp, res, GFP_KERNEL);
 392         if (!*string) {
 393                 e->pos = pos;
 394                 return 0;
 395         }
 396
 397         return res;
 398 }
 399 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
 400
 401
 402 /**
 403  * unpack_dfa - unpack a file rule dfa
 404  * @e: serialized data extent information (NOT NULL)
 405  * @flags: dfa flags to check
 406  *
 407  * returns dfa or ERR_PTR or NULL if no dfa
 408  */
 409 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
 410 {
 411         char *blob = NULL;
 412         size_t size;
 413         struct aa_dfa *dfa = NULL;
 414
 415         size = aa_unpack_blob(e, &blob, "aadfa");
 416         if (size) {
 417                 /*
 418                  * The dfa is aligned with in the blob to 8 bytes
 419                  * from the beginning of the stream.
 420                  * alignment adjust needed by dfa unpack
 421                  */
 422                 size_t sz = blob - (char *) e->start -
 423                         ((e->pos - e->start) & 7);
 424                 size_t pad = ALIGN(sz, 8) - sz;
 425                 if (aa_g_paranoid_load)
 426                         flags |= DFA_FLAG_VERIFY_STATES;
 427                 dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 428
 429                 if (IS_ERR(dfa))
 430                         return dfa;
 431
 432         }
 433
 434         return dfa;
 435 }
 436
 437 /**
 438  * unpack_trans_table - unpack a profile transition table
 439  * @e: serialized data extent information  (NOT NULL)
 440  * @table: str table to unpack to (NOT NULL)
 441  *
 442  * Returns: true if table successfully unpacked or not present
 443  */
 444 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)
 445 {
 446         void *saved_pos = e->pos;
 447         char **table = NULL;
 448
 449         /* exec table is optional */
 450         if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
 451                 u16 size;
 452                 int i;
 453
 454                 if (!aa_unpack_array(e, NULL, &size))
 455                         /*
 456                          * Note: index into trans table array is a max
 457                          * of 2^24, but unpack array can only unpack
 458                          * an array of 2^16 in size atm so no need
 459                          * for size check here
 460                          */
 461                         goto fail;
 462                 table = kcalloc(size, sizeof(char *), GFP_KERNEL);
 463                 if (!table)
 464                         goto fail;
 465
 466                 for (i = 0; i < size; i++) {
 467                         char *str;
 468                         int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
 469                         /* aa_unpack_strdup verifies that the last character is
 470                          * null termination byte.
 471                          */
 472                         if (!size2)
 473                                 goto fail;
 474                         table[i] = str;
 475                         /* verify that name doesn't start with space */
 476                         if (isspace(*str))
 477                                 goto fail;
 478
 479                         /* count internal #  of internal \0 */
 480                         for (c = j = 0; j < size2 - 1; j++) {
 481                                 if (!str[j]) {
 482                                         pos = j;
 483                                         c++;
 484                                 }
 485                         }
 486                         if (*str == ':') {
 487                                 /* first character after : must be valid */
 488                                 if (!str[1])
 489                                         goto fail;
 490                                 /* beginning with : requires an embedded \0,
 491                                  * verify that exactly 1 internal \0 exists
 492                                  * trailing \0 already verified by aa_unpack_strdup
 493                                  *
 494                                  * convert \0 back to : for label_parse
 495                                  */
 496                                 if (c == 1)
 497                                         str[pos] = ':';
 498                                 else if (c > 1)
 499                                         goto fail;
 500                         } else if (c)
 501                                 /* fail - all other cases with embedded \0 */
 502                                 goto fail;
 503                 }
 504                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 505                         goto fail;
 506                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 507                         goto fail;
 508
 509                 strs->table = table;
 510                 strs->size = size;
 511         }
 512         return true;
 513
 514 fail:
 515         kfree_sensitive(table);
 516         e->pos = saved_pos;
 517         return false;
 518 }
 519
 520 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
 521 {
 522         void *pos = e->pos;
 523
 524         if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
 525                 u16 size;
 526                 int i;
 527
 528                 if (!aa_unpack_array(e, NULL, &size))
 529                         goto fail;
 530                 profile->attach.xattr_count = size;
 531                 profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
 532                 if (!profile->attach.xattrs)
 533                         goto fail;
 534                 for (i = 0; i < size; i++) {
 535                         if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
 536                                 goto fail;
 537                 }
 538                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 539                         goto fail;
 540                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 541                         goto fail;
 542         }
 543
 544         return true;
 545
 546 fail:
 547         e->pos = pos;
 548         return false;
 549 }
 550
 551 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
 552 {
 553         void *pos = e->pos;
 554         u16 size;
 555         int i;
 556
 557         if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
 558                 if (!aa_unpack_array(e, NULL, &size))
 559                         goto fail;
 560
 561                 rules->secmark = kcalloc(size, sizeof(struct aa_secmark),
 562                                            GFP_KERNEL);
 563                 if (!rules->secmark)
 564                         goto fail;
 565
 566                 rules->secmark_count = size;
 567
 568                 for (i = 0; i < size; i++) {
 569                         if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
 570                                 goto fail;
 571                         if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
 572                                 goto fail;
 573                         if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
 574                                 goto fail;
 575                 }
 576                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 577                         goto fail;
 578                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 579                         goto fail;
 580         }
 581
 582         return true;
 583
 584 fail:
 585         if (rules->secmark) {
 586                 for (i = 0; i < size; i++)
 587                         kfree(rules->secmark[i].label);
 588                 kfree(rules->secmark);
 589                 rules->secmark_count = 0;
 590                 rules->secmark = NULL;
 591         }
 592
 593         e->pos = pos;
 594         return false;
 595 }
 596
 597 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
 598 {
 599         void *pos = e->pos;
 600
 601         /* rlimits are optional */
 602         if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
 603                 u16 size;
 604                 int i;
 605                 u32 tmp = 0;
 606                 if (!aa_unpack_u32(e, &tmp, NULL))
 607                         goto fail;
 608                 rules->rlimits.mask = tmp;
 609
 610                 if (!aa_unpack_array(e, NULL, &size) ||
 611                     size > RLIM_NLIMITS)
 612                         goto fail;
 613                 for (i = 0; i < size; i++) {
 614                         u64 tmp2 = 0;
 615                         int a = aa_map_resource(i);
 616                         if (!aa_unpack_u64(e, &tmp2, NULL))
 617                                 goto fail;
 618                         rules->rlimits.limits[a].rlim_max = tmp2;
 619                 }
 620                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 621                         goto fail;
 622                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 623                         goto fail;
 624         }
 625         return true;
 626
 627 fail:
 628         e->pos = pos;
 629         return false;
 630 }
 631
 632 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
 633 {
 634         if (version != 1)
 635                 return false;
 636
 637         return  aa_unpack_u32(e, &perm->allow, NULL) &&
 638                 aa_unpack_u32(e, &perm->allow, NULL) &&
 639                 aa_unpack_u32(e, &perm->deny, NULL) &&
 640                 aa_unpack_u32(e, &perm->subtree, NULL) &&
 641                 aa_unpack_u32(e, &perm->cond, NULL) &&
 642                 aa_unpack_u32(e, &perm->kill, NULL) &&
 643                 aa_unpack_u32(e, &perm->complain, NULL) &&
 644                 aa_unpack_u32(e, &perm->prompt, NULL) &&
 645                 aa_unpack_u32(e, &perm->audit, NULL) &&
 646                 aa_unpack_u32(e, &perm->quiet, NULL) &&
 647                 aa_unpack_u32(e, &perm->hide, NULL) &&
 648                 aa_unpack_u32(e, &perm->xindex, NULL) &&
 649                 aa_unpack_u32(e, &perm->tag, NULL) &&
 650                 aa_unpack_u32(e, &perm->label, NULL);
 651 }
 652
 653 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
 654 {
 655         void *pos = e->pos;
 656         u16 size = 0;
 657
 658         AA_BUG(!perms);
 659         /*
 660          * policy perms are optional, in which case perms are embedded
 661          * in the dfa accept table
 662          */
 663         if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
 664                 int i;
 665                 u32 version;
 666
 667                 if (!aa_unpack_u32(e, &version, "version"))
 668                         goto fail_reset;
 669                 if (!aa_unpack_array(e, NULL, &size))
 670                         goto fail_reset;
 671                 *perms = kcalloc(size, sizeof(struct aa_perms), GFP_KERNEL);
 672                 if (!*perms)
 673                         goto fail_reset;
 674                 for (i = 0; i < size; i++) {
 675                         if (!unpack_perm(e, version, &(*perms)[i]))
 676                                 goto fail;
 677                 }
 678                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
 679                         goto fail;
 680                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 681                         goto fail;
 682         } else
 683                 *perms = NULL;
 684
 685         return size;
 686
 687 fail:
 688         kfree(*perms);
 689 fail_reset:
 690         e->pos = pos;
 691         return -EPROTO;
 692 }
 693
 694 static int unpack_pdb(struct aa_ext *e, struct aa_policydb *policy,
 695                       bool required_dfa, bool required_trans,
 696                       const char **info)
 697 {
 698         void *pos = e->pos;
 699         int i, flags, error = -EPROTO;
 700         ssize_t size;
 701
 702         size = unpack_perms_table(e, &policy->perms);
 703         if (size < 0) {
 704                 error = size;
 705                 policy->perms = NULL;
 706                 *info = "failed to unpack - perms";
 707                 goto fail;
 708         }
 709         policy->size = size;
 710
 711         if (policy->perms) {
 712                 /* perms table present accept is index */
 713                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
 714         } else {
 715                 /* packed perms in accept1 and accept2 */
 716                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
 717                         TO_ACCEPT2_FLAG(YYTD_DATA32);
 718         }
 719
 720         policy->dfa = unpack_dfa(e, flags);
 721         if (IS_ERR(policy->dfa)) {
 722                 error = PTR_ERR(policy->dfa);
 723                 policy->dfa = NULL;
 724                 *info = "failed to unpack - dfa";
 725                 goto fail;
 726         } else if (!policy->dfa) {
 727                 if (required_dfa) {
 728                         *info = "missing required dfa";
 729                         goto fail;
 730                 }
 731                 goto out;
 732         }
 733
 734         /*
 735          * only unpack the following if a dfa is present
 736          *
 737          * sadly start was given different names for file and policydb
 738          * but since it is optional we can try both
 739          */
 740         if (!aa_unpack_u32(e, &policy->start[0], "start"))
 741                 /* default start state */
 742                 policy->start[0] = DFA_START;
 743         if (!aa_unpack_u32(e, &policy->start[AA_CLASS_FILE], "dfa_start")) {
 744                 /* default start state for xmatch and file dfa */
 745                 policy->start[AA_CLASS_FILE] = DFA_START;
 746         }       /* setup class index */
 747         for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
 748                 policy->start[i] = aa_dfa_next(policy->dfa, policy->start[0],
 749                                                i);
 750         }
 751         if (!unpack_trans_table(e, &policy->trans) && required_trans) {
 752                 *info = "failed to unpack profile transition table";
 753                 goto fail;
 754         }
 755
 756         /* TODO: move compat mapping here, requires dfa merging first */
 757         /* TODO: move verify here, it has to be done after compat mappings */
 758 out:
 759         return 0;
 760
 761 fail:
 762         e->pos = pos;
 763         return error;
 764 }
 765
 766 static u32 strhash(const void *data, u32 len, u32 seed)
 767 {
 768         const char * const *key = data;
 769
 770         return jhash(*key, strlen(*key), seed);
 771 }
 772
 773 static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
 774 {
 775         const struct aa_data *data = obj;
 776         const char * const *key = arg->key;
 777
 778         return strcmp(data->key, *key);
 779 }
 780
 781 /**
 782  * unpack_profile - unpack a serialized profile
 783  * @e: serialized data extent information (NOT NULL)
 784  * @ns_name: pointer of newly allocated copy of %NULL in case of error
 785  *
 786  * NOTE: unpack profile sets audit struct if there is a failure
 787  */
 788 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
 789 {
 790         struct aa_ruleset *rules;
 791         struct aa_profile *profile = NULL;
 792         const char *tmpname, *tmpns = NULL, *name = NULL;
 793         const char *info = "failed to unpack profile";
 794         size_t ns_len;
 795         struct rhashtable_params params = { 0 };
 796         char *key = NULL;
 797         struct aa_data *data;
 798         int error = -EPROTO;
 799         kernel_cap_t tmpcap;
 800         u32 tmp;
 801
 802         *ns_name = NULL;
 803
 804         /* check that we have the right struct being passed */
 805         if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
 806                 goto fail;
 807         if (!aa_unpack_str(e, &name, NULL))
 808                 goto fail;
 809         if (*name == '\0')
 810                 goto fail;
 811
 812         tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
 813         if (tmpns) {
 814                 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
 815                 if (!*ns_name) {
 816                         info = "out of memory";
 817                         error = -ENOMEM;
 818                         goto fail;
 819                 }
 820                 name = tmpname;
 821         }
 822
 823         profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
 824         if (!profile) {
 825                 info = "out of memory";
 826                 error = -ENOMEM;
 827                 goto fail;
 828         }
 829         rules = list_first_entry(&profile->rules, typeof(*rules), list);
 830
 831         /* profile renaming is optional */
 832         (void) aa_unpack_str(e, &profile->rename, "rename");
 833
 834         /* attachment string is optional */
 835         (void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
 836
 837         /* xmatch is optional and may be NULL */
 838         error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
 839         if (error) {
 840                 info = "bad xmatch";
 841                 goto fail;
 842         }
 843
 844         /* neither xmatch_len not xmatch_perms are optional if xmatch is set */
 845         if (profile->attach.xmatch.dfa) {
 846                 if (!aa_unpack_u32(e, &tmp, NULL)) {
 847                         info = "missing xmatch len";
 848                         goto fail;
 849                 }
 850                 profile->attach.xmatch_len = tmp;
 851                 profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
 852                 error = aa_compat_map_xmatch(&profile->attach.xmatch);
 853                 if (error) {
 854                         info = "failed to convert xmatch permission table";
 855                         goto fail;
 856                 }
 857         }
 858
 859         /* disconnected attachment string is optional */
 860         (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
 861
 862         /* per profile debug flags (complain, audit) */
 863         if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
 864                 info = "profile missing flags";
 865                 goto fail;
 866         }
 867         info = "failed to unpack profile flags";
 868         if (!aa_unpack_u32(e, &tmp, NULL))
 869                 goto fail;
 870         if (tmp & PACKED_FLAG_HAT)
 871                 profile->label.flags |= FLAG_HAT;
 872         if (tmp & PACKED_FLAG_DEBUG1)
 873                 profile->label.flags |= FLAG_DEBUG1;
 874         if (tmp & PACKED_FLAG_DEBUG2)
 875                 profile->label.flags |= FLAG_DEBUG2;
 876         if (!aa_unpack_u32(e, &tmp, NULL))
 877                 goto fail;
 878         if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
 879                 profile->mode = APPARMOR_COMPLAIN;
 880         } else if (tmp == PACKED_MODE_ENFORCE) {
 881                 profile->mode = APPARMOR_ENFORCE;
 882         } else if (tmp == PACKED_MODE_KILL) {
 883                 profile->mode = APPARMOR_KILL;
 884         } else if (tmp == PACKED_MODE_UNCONFINED) {
 885                 profile->mode = APPARMOR_UNCONFINED;
 886                 profile->label.flags |= FLAG_UNCONFINED;
 887         } else if (tmp == PACKED_MODE_USER) {
 888                 profile->mode = APPARMOR_USER;
 889         } else {
 890                 goto fail;
 891         }
 892         if (!aa_unpack_u32(e, &tmp, NULL))
 893                 goto fail;
 894         if (tmp)
 895                 profile->audit = AUDIT_ALL;
 896
 897         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 898                 goto fail;
 899
 900         /* path_flags is optional */
 901         if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
 902                 profile->path_flags |= profile->label.flags &
 903                         PATH_MEDIATE_DELETED;
 904         else
 905                 /* set a default value if path_flags field is not present */
 906                 profile->path_flags = PATH_MEDIATE_DELETED;
 907
 908         info = "failed to unpack profile capabilities";
 909         if (!aa_unpack_u32(e, &(rules->caps.allow.cap[0]), NULL))
 910                 goto fail;
 911         if (!aa_unpack_u32(e, &(rules->caps.audit.cap[0]), NULL))
 912                 goto fail;
 913         if (!aa_unpack_u32(e, &(rules->caps.quiet.cap[0]), NULL))
 914                 goto fail;
 915         if (!aa_unpack_u32(e, &tmpcap.cap[0], NULL))
 916                 goto fail;
 917
 918         info = "failed to unpack upper profile capabilities";
 919         if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
 920                 /* optional upper half of 64 bit caps */
 921                 if (!aa_unpack_u32(e, &(rules->caps.allow.cap[1]), NULL))
 922                         goto fail;
 923                 if (!aa_unpack_u32(e, &(rules->caps.audit.cap[1]), NULL))
 924                         goto fail;
 925                 if (!aa_unpack_u32(e, &(rules->caps.quiet.cap[1]), NULL))
 926                         goto fail;
 927                 if (!aa_unpack_u32(e, &(tmpcap.cap[1]), NULL))
 928                         goto fail;
 929                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 930                         goto fail;
 931         }
 932
 933         info = "failed to unpack extended profile capabilities";
 934         if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
 935                 /* optional extended caps mediation mask */
 936                 if (!aa_unpack_u32(e, &(rules->caps.extended.cap[0]), NULL))
 937                         goto fail;
 938                 if (!aa_unpack_u32(e, &(rules->caps.extended.cap[1]), NULL))
 939                         goto fail;
 940                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 941                         goto fail;
 942         }
 943
 944         if (!unpack_xattrs(e, profile)) {
 945                 info = "failed to unpack profile xattrs";
 946                 goto fail;
 947         }
 948
 949         if (!unpack_rlimits(e, rules)) {
 950                 info = "failed to unpack profile rlimits";
 951                 goto fail;
 952         }
 953
 954         if (!unpack_secmark(e, rules)) {
 955                 info = "failed to unpack profile secmark rules";
 956                 goto fail;
 957         }
 958
 959         if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
 960                 /* generic policy dfa - optional and may be NULL */
 961                 info = "failed to unpack policydb";
 962                 error = unpack_pdb(e, &rules->policy, true, false,
 963                                    &info);
 964                 if (error)
 965                         goto fail;
 966                 /* Fixup: drop when we get rid of start array */
 967                 if (aa_dfa_next(rules->policy.dfa, rules->policy.start[0],
 968                                 AA_CLASS_FILE))
 969                         rules->policy.start[AA_CLASS_FILE] =
 970                           aa_dfa_next(rules->policy.dfa,
 971                                       rules->policy.start[0],
 972                                       AA_CLASS_FILE);
 973                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
 974                         goto fail;
 975                 error = aa_compat_map_policy(&rules->policy, e->version);
 976                 if (error) {
 977                         info = "failed to remap policydb permission table";
 978                         goto fail;
 979                 }
 980         } else
 981                 rules->policy.dfa = aa_get_dfa(nulldfa);
 982
 983         /* get file rules */
 984         error = unpack_pdb(e, &rules->file, false, true, &info);
 985         if (error) {
 986                 goto fail;
 987         } else if (rules->file.dfa) {
 988                 error = aa_compat_map_file(&rules->file);
 989                 if (error) {
 990                         info = "failed to remap file permission table";
 991                         goto fail;
 992                 }
 993         } else if (rules->policy.dfa &&
 994                    rules->policy.start[AA_CLASS_FILE]) {
 995                 rules->file.dfa = aa_get_dfa(rules->policy.dfa);
 996                 rules->file.start[AA_CLASS_FILE] = rules->policy.start[AA_CLASS_FILE];
 997         } else
 998                 rules->file.dfa = aa_get_dfa(nulldfa);
 999
1000         error = -EPROTO;
1001         if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1002                 info = "out of memory";
1003                 profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
1004                 if (!profile->data) {
1005                         error = -ENOMEM;
1006                         goto fail;
1007                 }
1008                 params.nelem_hint = 3;
1009                 params.key_len = sizeof(void *);
1010                 params.key_offset = offsetof(struct aa_data, key);
1011                 params.head_offset = offsetof(struct aa_data, head);
1012                 params.hashfn = strhash;
1013                 params.obj_cmpfn = datacmp;
1014
1015                 if (rhashtable_init(profile->data, &params)) {
1016                         info = "failed to init key, value hash table";
1017                         goto fail;
1018                 }
1019
1020                 while (aa_unpack_strdup(e, &key, NULL)) {
1021                         data = kzalloc(sizeof(*data), GFP_KERNEL);
1022                         if (!data) {
1023                                 kfree_sensitive(key);
1024                                 error = -ENOMEM;
1025                                 goto fail;
1026                         }
1027
1028                         data->key = key;
1029                         data->size = aa_unpack_blob(e, &data->data, NULL);
1030                         data->data = kvmemdup(data->data, data->size);
1031                         if (data->size && !data->data) {
1032                                 kfree_sensitive(data->key);
1033                                 kfree_sensitive(data);
1034                                 error = -ENOMEM;
1035                                 goto fail;
1036                         }
1037
1038                         rhashtable_insert_fast(profile->data, &data->head,
1039                                                profile->data->p);
1040                 }
1041
1042                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1043                         info = "failed to unpack end of key, value data table";
1044                         goto fail;
1045                 }
1046         }
1047
1048         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1049                 info = "failed to unpack end of profile";
1050                 goto fail;
1051         }
1052
1053         return profile;
1054
1055 fail:
1056         if (error == 0)
1057                 /* default error covers most cases */
1058                 error = -EPROTO;
1059         if (*ns_name) {
1060                 kfree(*ns_name);
1061                 *ns_name = NULL;
1062         }
1063         if (profile)
1064                 name = NULL;
1065         else if (!name)
1066                 name = "unknown";
1067         audit_iface(profile, NULL, name, info, e, error);
1068         aa_free_profile(profile);
1069
1070         return ERR_PTR(error);
1071 }
1072
1073 /**
1074  * verify_header - unpack serialized stream header
1075  * @e: serialized data read head (NOT NULL)
1076  * @required: whether the header is required or optional
1077  * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1078  *
1079  * Returns: error or 0 if header is good
1080  */
1081 static int verify_header(struct aa_ext *e, int required, const char **ns)
1082 {
1083         int error = -EPROTONOSUPPORT;
1084         const char *name = NULL;
1085         *ns = NULL;
1086
1087         /* get the interface version */
1088         if (!aa_unpack_u32(e, &e->version, "version")) {
1089                 if (required) {
1090                         audit_iface(NULL, NULL, NULL, "invalid profile format",
1091                                     e, error);
1092                         return error;
1093                 }
1094         }
1095
1096         /* Check that the interface version is currently supported.
1097          * if not specified use previous version
1098          * Mask off everything that is not kernel abi version
1099          */
1100         if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1101                 audit_iface(NULL, NULL, NULL, "unsupported interface version",
1102                             e, error);
1103                 return error;
1104         }
1105
1106         /* read the namespace if present */
1107         if (aa_unpack_str(e, &name, "namespace")) {
1108                 if (*name == '\0') {
1109                         audit_iface(NULL, NULL, NULL, "invalid namespace name",
1110                                     e, error);
1111                         return error;
1112                 }
1113                 if (*ns && strcmp(*ns, name)) {
1114                         audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1115                                     error);
1116                 } else if (!*ns) {
1117                         *ns = kstrdup(name, GFP_KERNEL);
1118                         if (!*ns)
1119                                 return -ENOMEM;
1120                 }
1121         }
1122
1123         return 0;
1124 }
1125
1126 static bool verify_xindex(int xindex, int table_size)
1127 {
1128         int index, xtype;
1129         xtype = xindex & AA_X_TYPE_MASK;
1130         index = xindex & AA_X_INDEX_MASK;
1131         if (xtype == AA_X_TABLE && index >= table_size)
1132                 return false;
1133         return true;
1134 }
1135
1136 /* verify dfa xindexes are in range of transition tables */
1137 static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
1138 {
1139         int i;
1140         for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1141                 if (!verify_xindex(ACCEPT_TABLE(dfa)[i], table_size))
1142                         return false;
1143         }
1144         return true;
1145 }
1146
1147 static bool verify_perm(struct aa_perms *perm)
1148 {
1149         /* TODO: allow option to just force the perms into a valid state */
1150         if (perm->allow & perm->deny)
1151                 return false;
1152         if (perm->subtree & ~perm->allow)
1153                 return false;
1154         if (perm->cond & (perm->allow | perm->deny))
1155                 return false;
1156         if (perm->kill & perm->allow)
1157                 return false;
1158         if (perm->complain & (perm->allow | perm->deny))
1159                 return false;
1160         if (perm->prompt & (perm->allow | perm->deny))
1161                 return false;
1162         if (perm->complain & perm->prompt)
1163                 return false;
1164         if (perm->hide & perm->allow)
1165                 return false;
1166
1167         return true;
1168 }
1169
1170 static bool verify_perms(struct aa_policydb *pdb)
1171 {
1172         int i;
1173
1174         for (i = 0; i < pdb->size; i++) {
1175                 if (!verify_perm(&pdb->perms[i]))
1176                         return false;
1177                 /* verify indexes into str table */
1178                 if (pdb->perms[i].xindex >= pdb->trans.size)
1179                         return false;
1180                 if (pdb->perms[i].tag >= pdb->trans.size)
1181                         return false;
1182                 if (pdb->perms[i].label >= pdb->trans.size)
1183                         return false;
1184         }
1185
1186         return true;
1187 }
1188
1189 /**
1190  * verify_profile - Do post unpack analysis to verify profile consistency
1191  * @profile: profile to verify (NOT NULL)
1192  *
1193  * Returns: 0 if passes verification else error
1194  *
1195  * This verification is post any unpack mapping or changes
1196  */
1197 static int verify_profile(struct aa_profile *profile)
1198 {
1199         struct aa_ruleset *rules = list_first_entry(&profile->rules,
1200                                                     typeof(*rules), list);
1201         if (!rules)
1202                 return 0;
1203
1204         if ((rules->file.dfa && !verify_dfa_xindex(rules->file.dfa,
1205                                                   rules->file.trans.size)) ||
1206             (rules->policy.dfa &&
1207              !verify_dfa_xindex(rules->policy.dfa, rules->policy.trans.size))) {
1208                 audit_iface(profile, NULL, NULL,
1209                             "Unpack: Invalid named transition", NULL, -EPROTO);
1210                 return -EPROTO;
1211         }
1212
1213         if (!verify_perms(&rules->file)) {
1214                 audit_iface(profile, NULL, NULL,
1215                             "Unpack: Invalid perm index", NULL, -EPROTO);
1216                 return -EPROTO;
1217         }
1218         if (!verify_perms(&rules->policy)) {
1219                 audit_iface(profile, NULL, NULL,
1220                             "Unpack: Invalid perm index", NULL, -EPROTO);
1221                 return -EPROTO;
1222         }
1223         if (!verify_perms(&profile->attach.xmatch)) {
1224                 audit_iface(profile, NULL, NULL,
1225                             "Unpack: Invalid perm index", NULL, -EPROTO);
1226                 return -EPROTO;
1227         }
1228
1229         return 0;
1230 }
1231
1232 void aa_load_ent_free(struct aa_load_ent *ent)
1233 {
1234         if (ent) {
1235                 aa_put_profile(ent->rename);
1236                 aa_put_profile(ent->old);
1237                 aa_put_profile(ent->new);
1238                 kfree(ent->ns_name);
1239                 kfree_sensitive(ent);
1240         }
1241 }
1242
1243 struct aa_load_ent *aa_load_ent_alloc(void)
1244 {
1245         struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1246         if (ent)
1247                 INIT_LIST_HEAD(&ent->list);
1248         return ent;
1249 }
1250
1251 static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1252 {
1253 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1254         const zstd_parameters params =
1255                 zstd_get_params(aa_g_rawdata_compression_level, slen);
1256         const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1257         void *wksp = NULL;
1258         zstd_cctx *ctx = NULL;
1259         size_t out_len = zstd_compress_bound(slen);
1260         void *out = NULL;
1261         int ret = 0;
1262
1263         out = kvzalloc(out_len, GFP_KERNEL);
1264         if (!out) {
1265                 ret = -ENOMEM;
1266                 goto cleanup;
1267         }
1268
1269         wksp = kvzalloc(wksp_len, GFP_KERNEL);
1270         if (!wksp) {
1271                 ret = -ENOMEM;
1272                 goto cleanup;
1273         }
1274
1275         ctx = zstd_init_cctx(wksp, wksp_len);
1276         if (!ctx) {
1277                 ret = -EINVAL;
1278                 goto cleanup;
1279         }
1280
1281         out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1282         if (zstd_is_error(out_len) || out_len >= slen) {
1283                 ret = -EINVAL;
1284                 goto cleanup;
1285         }
1286
1287         if (is_vmalloc_addr(out)) {
1288                 *dst = kvzalloc(out_len, GFP_KERNEL);
1289                 if (*dst) {
1290                         memcpy(*dst, out, out_len);
1291                         kvfree(out);
1292                         out = NULL;
1293                 }
1294         } else {
1295                 /*
1296                  * If the staging buffer was kmalloc'd, then using krealloc is
1297                  * probably going to be faster. The destination buffer will
1298                  * always be smaller, so it's just shrunk, avoiding a memcpy
1299                  */
1300                 *dst = krealloc(out, out_len, GFP_KERNEL);
1301         }
1302
1303         if (!*dst) {
1304                 ret = -ENOMEM;
1305                 goto cleanup;
1306         }
1307
1308         *dlen = out_len;
1309
1310 cleanup:
1311         if (ret) {
1312                 kvfree(out);
1313                 *dst = NULL;
1314         }
1315
1316         kvfree(wksp);
1317         return ret;
1318 #else
1319         *dlen = slen;
1320         return 0;
1321 #endif
1322 }
1323
1324 static int compress_loaddata(struct aa_loaddata *data)
1325 {
1326         AA_BUG(data->compressed_size > 0);
1327
1328         /*
1329          * Shortcut the no compression case, else we increase the amount of
1330          * storage required by a small amount
1331          */
1332         if (aa_g_rawdata_compression_level != 0) {
1333                 void *udata = data->data;
1334                 int error = compress_zstd(udata, data->size, &data->data,
1335                                           &data->compressed_size);
1336                 if (error) {
1337                         data->compressed_size = data->size;
1338                         return error;
1339                 }
1340                 if (udata != data->data)
1341                         kvfree(udata);
1342         } else
1343                 data->compressed_size = data->size;
1344
1345         return 0;
1346 }
1347
1348 /**
1349  * aa_unpack - unpack packed binary profile(s) data loaded from user space
1350  * @udata: user data copied to kmem  (NOT NULL)
1351  * @lh: list to place unpacked profiles in a aa_repl_ws
1352  * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1353  *
1354  * Unpack user data and return refcounted allocated profile(s) stored in
1355  * @lh in order of discovery, with the list chain stored in base.list
1356  * or error
1357  *
1358  * Returns: profile(s) on @lh else error pointer if fails to unpack
1359  */
1360 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1361               const char **ns)
1362 {
1363         struct aa_load_ent *tmp, *ent;
1364         struct aa_profile *profile = NULL;
1365         char *ns_name = NULL;
1366         int error;
1367         struct aa_ext e = {
1368                 .start = udata->data,
1369                 .end = udata->data + udata->size,
1370                 .pos = udata->data,
1371         };
1372
1373         *ns = NULL;
1374         while (e.pos < e.end) {
1375                 void *start;
1376                 error = verify_header(&e, e.pos == e.start, ns);
1377                 if (error)
1378                         goto fail;
1379
1380                 start = e.pos;
1381                 profile = unpack_profile(&e, &ns_name);
1382                 if (IS_ERR(profile)) {
1383                         error = PTR_ERR(profile);
1384                         goto fail;
1385                 }
1386
1387                 error = verify_profile(profile);
1388                 if (error)
1389                         goto fail_profile;
1390
1391                 if (aa_g_hash_policy)
1392                         error = aa_calc_profile_hash(profile, e.version, start,
1393                                                      e.pos - start);
1394                 if (error)
1395                         goto fail_profile;
1396
1397                 ent = aa_load_ent_alloc();
1398                 if (!ent) {
1399                         error = -ENOMEM;
1400                         goto fail_profile;
1401                 }
1402
1403                 ent->new = profile;
1404                 ent->ns_name = ns_name;
1405                 ns_name = NULL;
1406                 list_add_tail(&ent->list, lh);
1407         }
1408         udata->abi = e.version & K_ABI_MASK;
1409         if (aa_g_hash_policy) {
1410                 udata->hash = aa_calc_hash(udata->data, udata->size);
1411                 if (IS_ERR(udata->hash)) {
1412                         error = PTR_ERR(udata->hash);
1413                         udata->hash = NULL;
1414                         goto fail;
1415                 }
1416         }
1417
1418         if (aa_g_export_binary) {
1419                 error = compress_loaddata(udata);
1420                 if (error)
1421                         goto fail;
1422         }
1423         return 0;
1424
1425 fail_profile:
1426         kfree(ns_name);
1427         aa_put_profile(profile);
1428
1429 fail:
1430         list_for_each_entry_safe(ent, tmp, lh, list) {
1431                 list_del_init(&ent->list);
1432                 aa_load_ent_free(ent);
1433         }
1434
1435         return error;
1436 }