1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor functions for unpacking policy loaded from
6  * userspace.
7  *
8  * Copyright (C) 1998-2008 Novell/SUSE
9  * Copyright 2009-2010 Canonical Ltd.
10  *
11  * AppArmor uses a serialized binary format for loading policy. To find
12  * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
13  * All policy is validated before it is used.
14  */
15 
16 #include <asm/unaligned.h>
17 #include <kunit/visibility.h>
18 #include <linux/ctype.h>
19 #include <linux/errno.h>
20 #include <linux/zstd.h>
21 
22 #include "include/apparmor.h"
23 #include "include/audit.h"
24 #include "include/cred.h"
25 #include "include/crypto.h"
26 #include "include/file.h"
27 #include "include/match.h"
28 #include "include/path.h"
29 #include "include/policy.h"
30 #include "include/policy_unpack.h"
31 #include "include/policy_compat.h"
32 
33 /* audit callback for unpack fields */
audit_cb(struct audit_buffer * ab,void * va)34 static void audit_cb(struct audit_buffer *ab, void *va)
35 {
36 	struct common_audit_data *sa = va;
37 	struct apparmor_audit_data *ad = aad(sa);
38 
39 	if (ad->iface.ns) {
40 		audit_log_format(ab, " ns=");
41 		audit_log_untrustedstring(ab, ad->iface.ns);
42 	}
43 	if (ad->name) {
44 		audit_log_format(ab, " name=");
45 		audit_log_untrustedstring(ab, ad->name);
46 	}
47 	if (ad->iface.pos)
48 		audit_log_format(ab, " offset=%ld", ad->iface.pos);
49 }
50 
51 /**
52  * audit_iface - do audit message for policy unpacking/load/replace/remove
53  * @new: profile if it has been allocated (MAYBE NULL)
54  * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
55  * @name: name of the profile being manipulated (MAYBE NULL)
56  * @info: any extra info about the failure (MAYBE NULL)
57  * @e: buffer position info
58  * @error: error code
59  *
60  * Returns: %0 or error
61  */
audit_iface(struct aa_profile * new,const char * ns_name,const char * name,const char * info,struct aa_ext * e,int error)62 static int audit_iface(struct aa_profile *new, const char *ns_name,
63 		       const char *name, const char *info, struct aa_ext *e,
64 		       int error)
65 {
66 	struct aa_profile *profile = labels_profile(aa_current_raw_label());
67 	DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
68 	if (e)
69 		ad.iface.pos = e->pos - e->start;
70 	ad.iface.ns = ns_name;
71 	if (new)
72 		ad.name = new->base.hname;
73 	else
74 		ad.name = name;
75 	ad.info = info;
76 	ad.error = error;
77 
78 	return aa_audit(AUDIT_APPARMOR_STATUS, profile, &ad, audit_cb);
79 }
80 
__aa_loaddata_update(struct aa_loaddata * data,long revision)81 void __aa_loaddata_update(struct aa_loaddata *data, long revision)
82 {
83 	AA_BUG(!data);
84 	AA_BUG(!data->ns);
85 	AA_BUG(!mutex_is_locked(&data->ns->lock));
86 	AA_BUG(data->revision > revision);
87 
88 	data->revision = revision;
89 	if ((data->dents[AAFS_LOADDATA_REVISION])) {
90 		struct inode *inode;
91 
92 		inode = d_inode(data->dents[AAFS_LOADDATA_DIR]);
93 		inode->i_mtime = inode_set_ctime_current(inode);
94 
95 		inode = d_inode(data->dents[AAFS_LOADDATA_REVISION]);
96 		inode->i_mtime = inode_set_ctime_current(inode);
97 	}
98 }
99 
aa_rawdata_eq(struct aa_loaddata * l,struct aa_loaddata * r)100 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
101 {
102 	if (l->size != r->size)
103 		return false;
104 	if (l->compressed_size != r->compressed_size)
105 		return false;
106 	if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
107 		return false;
108 	return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
109 }
110 
111 /*
112  * need to take the ns mutex lock which is NOT safe most places that
113  * put_loaddata is called, so we have to delay freeing it
114  */
do_loaddata_free(struct work_struct * work)115 static void do_loaddata_free(struct work_struct *work)
116 {
117 	struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
118 	struct aa_ns *ns = aa_get_ns(d->ns);
119 
120 	if (ns) {
121 		mutex_lock_nested(&ns->lock, ns->level);
122 		__aa_fs_remove_rawdata(d);
123 		mutex_unlock(&ns->lock);
124 		aa_put_ns(ns);
125 	}
126 
127 	kfree_sensitive(d->hash);
128 	kfree_sensitive(d->name);
129 	kvfree(d->data);
130 	kfree_sensitive(d);
131 }
132 
aa_loaddata_kref(struct kref * kref)133 void aa_loaddata_kref(struct kref *kref)
134 {
135 	struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
136 
137 	if (d) {
138 		INIT_WORK(&d->work, do_loaddata_free);
139 		schedule_work(&d->work);
140 	}
141 }
142 
aa_loaddata_alloc(size_t size)143 struct aa_loaddata *aa_loaddata_alloc(size_t size)
144 {
145 	struct aa_loaddata *d;
146 
147 	d = kzalloc(sizeof(*d), GFP_KERNEL);
148 	if (d == NULL)
149 		return ERR_PTR(-ENOMEM);
150 	d->data = kvzalloc(size, GFP_KERNEL);
151 	if (!d->data) {
152 		kfree(d);
153 		return ERR_PTR(-ENOMEM);
154 	}
155 	kref_init(&d->count);
156 	INIT_LIST_HEAD(&d->list);
157 
158 	return d;
159 }
160 
161 /* test if read will be in packed data bounds */
aa_inbounds(struct aa_ext * e,size_t size)162 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
163 {
164 	return (size <= e->end - e->pos);
165 }
166 EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
167 
168 /**
169  * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
170  * @e: serialized data read head (NOT NULL)
171  * @chunk: start address for chunk of data (NOT NULL)
172  *
173  * Returns: the size of chunk found with the read head at the end of the chunk.
174  */
aa_unpack_u16_chunk(struct aa_ext * e,char ** chunk)175 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
176 {
177 	size_t size = 0;
178 	void *pos = e->pos;
179 
180 	if (!aa_inbounds(e, sizeof(u16)))
181 		goto fail;
182 	size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
183 	e->pos += sizeof(__le16);
184 	if (!aa_inbounds(e, size))
185 		goto fail;
186 	*chunk = e->pos;
187 	e->pos += size;
188 	return size;
189 
190 fail:
191 	e->pos = pos;
192 	return 0;
193 }
194 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
195 
196 /* unpack control byte */
aa_unpack_X(struct aa_ext * e,enum aa_code code)197 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
198 {
199 	if (!aa_inbounds(e, 1))
200 		return false;
201 	if (*(u8 *) e->pos != code)
202 		return false;
203 	e->pos++;
204 	return true;
205 }
206 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
207 
208 /**
209  * aa_unpack_nameX - check is the next element is of type X with a name of @name
210  * @e: serialized data extent information  (NOT NULL)
211  * @code: type code
212  * @name: name to match to the serialized element.  (MAYBE NULL)
213  *
214  * check that the next serialized data element is of type X and has a tag
215  * name @name.  If @name is specified then there must be a matching
216  * name element in the stream.  If @name is NULL any name element will be
217  * skipped and only the typecode will be tested.
218  *
219  * Returns true on success (both type code and name tests match) and the read
220  * head is advanced past the headers
221  *
222  * Returns: false if either match fails, the read head does not move
223  */
aa_unpack_nameX(struct aa_ext * e,enum aa_code code,const char * name)224 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
225 {
226 	/*
227 	 * May need to reset pos if name or type doesn't match
228 	 */
229 	void *pos = e->pos;
230 	/*
231 	 * Check for presence of a tagname, and if present name size
232 	 * AA_NAME tag value is a u16.
233 	 */
234 	if (aa_unpack_X(e, AA_NAME)) {
235 		char *tag = NULL;
236 		size_t size = aa_unpack_u16_chunk(e, &tag);
237 		/* if a name is specified it must match. otherwise skip tag */
238 		if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
239 			goto fail;
240 	} else if (name) {
241 		/* if a name is specified and there is no name tag fail */
242 		goto fail;
243 	}
244 
245 	/* now check if type code matches */
246 	if (aa_unpack_X(e, code))
247 		return true;
248 
249 fail:
250 	e->pos = pos;
251 	return false;
252 }
253 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
254 
unpack_u8(struct aa_ext * e,u8 * data,const char * name)255 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
256 {
257 	void *pos = e->pos;
258 
259 	if (aa_unpack_nameX(e, AA_U8, name)) {
260 		if (!aa_inbounds(e, sizeof(u8)))
261 			goto fail;
262 		if (data)
263 			*data = *((u8 *)e->pos);
264 		e->pos += sizeof(u8);
265 		return true;
266 	}
267 
268 fail:
269 	e->pos = pos;
270 	return false;
271 }
272 
aa_unpack_u32(struct aa_ext * e,u32 * data,const char * name)273 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
274 {
275 	void *pos = e->pos;
276 
277 	if (aa_unpack_nameX(e, AA_U32, name)) {
278 		if (!aa_inbounds(e, sizeof(u32)))
279 			goto fail;
280 		if (data)
281 			*data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
282 		e->pos += sizeof(u32);
283 		return true;
284 	}
285 
286 fail:
287 	e->pos = pos;
288 	return false;
289 }
290 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
291 
aa_unpack_u64(struct aa_ext * e,u64 * data,const char * name)292 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
293 {
294 	void *pos = e->pos;
295 
296 	if (aa_unpack_nameX(e, AA_U64, name)) {
297 		if (!aa_inbounds(e, sizeof(u64)))
298 			goto fail;
299 		if (data)
300 			*data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
301 		e->pos += sizeof(u64);
302 		return true;
303 	}
304 
305 fail:
306 	e->pos = pos;
307 	return false;
308 }
309 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
310 
aa_unpack_cap_low(struct aa_ext * e,kernel_cap_t * data,const char * name)311 static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
312 {
313 	u32 val;
314 
315 	if (!aa_unpack_u32(e, &val, name))
316 		return false;
317 	data->val = val;
318 	return true;
319 }
320 
aa_unpack_cap_high(struct aa_ext * e,kernel_cap_t * data,const char * name)321 static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
322 {
323 	u32 val;
324 
325 	if (!aa_unpack_u32(e, &val, name))
326 		return false;
327 	data->val = (u32)data->val | ((u64)val << 32);
328 	return true;
329 }
330 
aa_unpack_array(struct aa_ext * e,const char * name,u16 * size)331 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
332 {
333 	void *pos = e->pos;
334 
335 	if (aa_unpack_nameX(e, AA_ARRAY, name)) {
336 		if (!aa_inbounds(e, sizeof(u16)))
337 			goto fail;
338 		*size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
339 		e->pos += sizeof(u16);
340 		return true;
341 	}
342 
343 fail:
344 	e->pos = pos;
345 	return false;
346 }
347 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
348 
aa_unpack_blob(struct aa_ext * e,char ** blob,const char * name)349 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
350 {
351 	void *pos = e->pos;
352 
353 	if (aa_unpack_nameX(e, AA_BLOB, name)) {
354 		u32 size;
355 		if (!aa_inbounds(e, sizeof(u32)))
356 			goto fail;
357 		size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
358 		e->pos += sizeof(u32);
359 		if (aa_inbounds(e, (size_t) size)) {
360 			*blob = e->pos;
361 			e->pos += size;
362 			return size;
363 		}
364 	}
365 
366 fail:
367 	e->pos = pos;
368 	return 0;
369 }
370 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
371 
aa_unpack_str(struct aa_ext * e,const char ** string,const char * name)372 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
373 {
374 	char *src_str;
375 	size_t size = 0;
376 	void *pos = e->pos;
377 	*string = NULL;
378 	if (aa_unpack_nameX(e, AA_STRING, name)) {
379 		size = aa_unpack_u16_chunk(e, &src_str);
380 		if (size) {
381 			/* strings are null terminated, length is size - 1 */
382 			if (src_str[size - 1] != 0)
383 				goto fail;
384 			*string = src_str;
385 
386 			return size;
387 		}
388 	}
389 
390 fail:
391 	e->pos = pos;
392 	return 0;
393 }
394 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
395 
aa_unpack_strdup(struct aa_ext * e,char ** string,const char * name)396 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
397 {
398 	const char *tmp;
399 	void *pos = e->pos;
400 	int res = aa_unpack_str(e, &tmp, name);
401 	*string = NULL;
402 
403 	if (!res)
404 		return 0;
405 
406 	*string = kmemdup(tmp, res, GFP_KERNEL);
407 	if (!*string) {
408 		e->pos = pos;
409 		return 0;
410 	}
411 
412 	return res;
413 }
414 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
415 
416 
417 /**
418  * unpack_dfa - unpack a file rule dfa
419  * @e: serialized data extent information (NOT NULL)
420  * @flags: dfa flags to check
421  *
422  * returns dfa or ERR_PTR or NULL if no dfa
423  */
unpack_dfa(struct aa_ext * e,int flags)424 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
425 {
426 	char *blob = NULL;
427 	size_t size;
428 	struct aa_dfa *dfa = NULL;
429 
430 	size = aa_unpack_blob(e, &blob, "aadfa");
431 	if (size) {
432 		/*
433 		 * The dfa is aligned with in the blob to 8 bytes
434 		 * from the beginning of the stream.
435 		 * alignment adjust needed by dfa unpack
436 		 */
437 		size_t sz = blob - (char *) e->start -
438 			((e->pos - e->start) & 7);
439 		size_t pad = ALIGN(sz, 8) - sz;
440 		if (aa_g_paranoid_load)
441 			flags |= DFA_FLAG_VERIFY_STATES;
442 		dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
443 
444 		if (IS_ERR(dfa))
445 			return dfa;
446 
447 	}
448 
449 	return dfa;
450 }
451 
452 /**
453  * unpack_trans_table - unpack a profile transition table
454  * @e: serialized data extent information  (NOT NULL)
455  * @strs: str table to unpack to (NOT NULL)
456  *
457  * Returns: true if table successfully unpacked or not present
458  */
unpack_trans_table(struct aa_ext * e,struct aa_str_table * strs)459 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)
460 {
461 	void *saved_pos = e->pos;
462 	char **table = NULL;
463 
464 	/* exec table is optional */
465 	if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
466 		u16 size;
467 		int i;
468 
469 		if (!aa_unpack_array(e, NULL, &size))
470 			/*
471 			 * Note: index into trans table array is a max
472 			 * of 2^24, but unpack array can only unpack
473 			 * an array of 2^16 in size atm so no need
474 			 * for size check here
475 			 */
476 			goto fail;
477 		table = kcalloc(size, sizeof(char *), GFP_KERNEL);
478 		if (!table)
479 			goto fail;
480 
481 		strs->table = table;
482 		strs->size = size;
483 		for (i = 0; i < size; i++) {
484 			char *str;
485 			int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
486 			/* aa_unpack_strdup verifies that the last character is
487 			 * null termination byte.
488 			 */
489 			if (!size2)
490 				goto fail;
491 			table[i] = str;
492 			/* verify that name doesn't start with space */
493 			if (isspace(*str))
494 				goto fail;
495 
496 			/* count internal #  of internal \0 */
497 			for (c = j = 0; j < size2 - 1; j++) {
498 				if (!str[j]) {
499 					pos = j;
500 					c++;
501 				}
502 			}
503 			if (*str == ':') {
504 				/* first character after : must be valid */
505 				if (!str[1])
506 					goto fail;
507 				/* beginning with : requires an embedded \0,
508 				 * verify that exactly 1 internal \0 exists
509 				 * trailing \0 already verified by aa_unpack_strdup
510 				 *
511 				 * convert \0 back to : for label_parse
512 				 */
513 				if (c == 1)
514 					str[pos] = ':';
515 				else if (c > 1)
516 					goto fail;
517 			} else if (c)
518 				/* fail - all other cases with embedded \0 */
519 				goto fail;
520 		}
521 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
522 			goto fail;
523 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
524 			goto fail;
525 	}
526 	return true;
527 
528 fail:
529 	aa_free_str_table(strs);
530 	e->pos = saved_pos;
531 	return false;
532 }
533 
unpack_xattrs(struct aa_ext * e,struct aa_profile * profile)534 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
535 {
536 	void *pos = e->pos;
537 
538 	if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
539 		u16 size;
540 		int i;
541 
542 		if (!aa_unpack_array(e, NULL, &size))
543 			goto fail;
544 		profile->attach.xattr_count = size;
545 		profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
546 		if (!profile->attach.xattrs)
547 			goto fail;
548 		for (i = 0; i < size; i++) {
549 			if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
550 				goto fail;
551 		}
552 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
553 			goto fail;
554 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
555 			goto fail;
556 	}
557 
558 	return true;
559 
560 fail:
561 	e->pos = pos;
562 	return false;
563 }
564 
unpack_secmark(struct aa_ext * e,struct aa_ruleset * rules)565 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
566 {
567 	void *pos = e->pos;
568 	u16 size;
569 	int i;
570 
571 	if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
572 		if (!aa_unpack_array(e, NULL, &size))
573 			goto fail;
574 
575 		rules->secmark = kcalloc(size, sizeof(struct aa_secmark),
576 					   GFP_KERNEL);
577 		if (!rules->secmark)
578 			goto fail;
579 
580 		rules->secmark_count = size;
581 
582 		for (i = 0; i < size; i++) {
583 			if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
584 				goto fail;
585 			if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
586 				goto fail;
587 			if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
588 				goto fail;
589 		}
590 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
591 			goto fail;
592 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
593 			goto fail;
594 	}
595 
596 	return true;
597 
598 fail:
599 	if (rules->secmark) {
600 		for (i = 0; i < size; i++)
601 			kfree(rules->secmark[i].label);
602 		kfree(rules->secmark);
603 		rules->secmark_count = 0;
604 		rules->secmark = NULL;
605 	}
606 
607 	e->pos = pos;
608 	return false;
609 }
610 
unpack_rlimits(struct aa_ext * e,struct aa_ruleset * rules)611 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
612 {
613 	void *pos = e->pos;
614 
615 	/* rlimits are optional */
616 	if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
617 		u16 size;
618 		int i;
619 		u32 tmp = 0;
620 		if (!aa_unpack_u32(e, &tmp, NULL))
621 			goto fail;
622 		rules->rlimits.mask = tmp;
623 
624 		if (!aa_unpack_array(e, NULL, &size) ||
625 		    size > RLIM_NLIMITS)
626 			goto fail;
627 		for (i = 0; i < size; i++) {
628 			u64 tmp2 = 0;
629 			int a = aa_map_resource(i);
630 			if (!aa_unpack_u64(e, &tmp2, NULL))
631 				goto fail;
632 			rules->rlimits.limits[a].rlim_max = tmp2;
633 		}
634 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
635 			goto fail;
636 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
637 			goto fail;
638 	}
639 	return true;
640 
641 fail:
642 	e->pos = pos;
643 	return false;
644 }
645 
unpack_perm(struct aa_ext * e,u32 version,struct aa_perms * perm)646 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
647 {
648 	if (version != 1)
649 		return false;
650 
651 	return	aa_unpack_u32(e, &perm->allow, NULL) &&
652 		aa_unpack_u32(e, &perm->allow, NULL) &&
653 		aa_unpack_u32(e, &perm->deny, NULL) &&
654 		aa_unpack_u32(e, &perm->subtree, NULL) &&
655 		aa_unpack_u32(e, &perm->cond, NULL) &&
656 		aa_unpack_u32(e, &perm->kill, NULL) &&
657 		aa_unpack_u32(e, &perm->complain, NULL) &&
658 		aa_unpack_u32(e, &perm->prompt, NULL) &&
659 		aa_unpack_u32(e, &perm->audit, NULL) &&
660 		aa_unpack_u32(e, &perm->quiet, NULL) &&
661 		aa_unpack_u32(e, &perm->hide, NULL) &&
662 		aa_unpack_u32(e, &perm->xindex, NULL) &&
663 		aa_unpack_u32(e, &perm->tag, NULL) &&
664 		aa_unpack_u32(e, &perm->label, NULL);
665 }
666 
unpack_perms_table(struct aa_ext * e,struct aa_perms ** perms)667 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
668 {
669 	void *pos = e->pos;
670 	u16 size = 0;
671 
672 	AA_BUG(!perms);
673 	/*
674 	 * policy perms are optional, in which case perms are embedded
675 	 * in the dfa accept table
676 	 */
677 	if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
678 		int i;
679 		u32 version;
680 
681 		if (!aa_unpack_u32(e, &version, "version"))
682 			goto fail_reset;
683 		if (!aa_unpack_array(e, NULL, &size))
684 			goto fail_reset;
685 		*perms = kcalloc(size, sizeof(struct aa_perms), GFP_KERNEL);
686 		if (!*perms)
687 			goto fail_reset;
688 		for (i = 0; i < size; i++) {
689 			if (!unpack_perm(e, version, &(*perms)[i]))
690 				goto fail;
691 		}
692 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
693 			goto fail;
694 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
695 			goto fail;
696 	} else
697 		*perms = NULL;
698 
699 	return size;
700 
701 fail:
702 	kfree(*perms);
703 fail_reset:
704 	e->pos = pos;
705 	return -EPROTO;
706 }
707 
unpack_pdb(struct aa_ext * e,struct aa_policydb * policy,bool required_dfa,bool required_trans,const char ** info)708 static int unpack_pdb(struct aa_ext *e, struct aa_policydb *policy,
709 		      bool required_dfa, bool required_trans,
710 		      const char **info)
711 {
712 	void *pos = e->pos;
713 	int i, flags, error = -EPROTO;
714 	ssize_t size;
715 
716 	size = unpack_perms_table(e, &policy->perms);
717 	if (size < 0) {
718 		error = size;
719 		policy->perms = NULL;
720 		*info = "failed to unpack - perms";
721 		goto fail;
722 	}
723 	policy->size = size;
724 
725 	if (policy->perms) {
726 		/* perms table present accept is index */
727 		flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
728 	} else {
729 		/* packed perms in accept1 and accept2 */
730 		flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
731 			TO_ACCEPT2_FLAG(YYTD_DATA32);
732 	}
733 
734 	policy->dfa = unpack_dfa(e, flags);
735 	if (IS_ERR(policy->dfa)) {
736 		error = PTR_ERR(policy->dfa);
737 		policy->dfa = NULL;
738 		*info = "failed to unpack - dfa";
739 		goto fail;
740 	} else if (!policy->dfa) {
741 		if (required_dfa) {
742 			*info = "missing required dfa";
743 			goto fail;
744 		}
745 		goto out;
746 	}
747 
748 	/*
749 	 * only unpack the following if a dfa is present
750 	 *
751 	 * sadly start was given different names for file and policydb
752 	 * but since it is optional we can try both
753 	 */
754 	if (!aa_unpack_u32(e, &policy->start[0], "start"))
755 		/* default start state */
756 		policy->start[0] = DFA_START;
757 	if (!aa_unpack_u32(e, &policy->start[AA_CLASS_FILE], "dfa_start")) {
758 		/* default start state for xmatch and file dfa */
759 		policy->start[AA_CLASS_FILE] = DFA_START;
760 	}	/* setup class index */
761 	for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
762 		policy->start[i] = aa_dfa_next(policy->dfa, policy->start[0],
763 					       i);
764 	}
765 	if (!unpack_trans_table(e, &policy->trans) && required_trans) {
766 		*info = "failed to unpack profile transition table";
767 		goto fail;
768 	}
769 
770 	/* TODO: move compat mapping here, requires dfa merging first */
771 	/* TODO: move verify here, it has to be done after compat mappings */
772 out:
773 	return 0;
774 
775 fail:
776 	e->pos = pos;
777 	return error;
778 }
779 
strhash(const void * data,u32 len,u32 seed)780 static u32 strhash(const void *data, u32 len, u32 seed)
781 {
782 	const char * const *key = data;
783 
784 	return jhash(*key, strlen(*key), seed);
785 }
786 
datacmp(struct rhashtable_compare_arg * arg,const void * obj)787 static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
788 {
789 	const struct aa_data *data = obj;
790 	const char * const *key = arg->key;
791 
792 	return strcmp(data->key, *key);
793 }
794 
795 /**
796  * unpack_profile - unpack a serialized profile
797  * @e: serialized data extent information (NOT NULL)
798  * @ns_name: pointer of newly allocated copy of %NULL in case of error
799  *
800  * NOTE: unpack profile sets audit struct if there is a failure
801  */
unpack_profile(struct aa_ext * e,char ** ns_name)802 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
803 {
804 	struct aa_ruleset *rules;
805 	struct aa_profile *profile = NULL;
806 	const char *tmpname, *tmpns = NULL, *name = NULL;
807 	const char *info = "failed to unpack profile";
808 	size_t ns_len;
809 	struct rhashtable_params params = { 0 };
810 	char *key = NULL, *disconnected = NULL;
811 	struct aa_data *data;
812 	int error = -EPROTO;
813 	kernel_cap_t tmpcap;
814 	u32 tmp;
815 
816 	*ns_name = NULL;
817 
818 	/* check that we have the right struct being passed */
819 	if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
820 		goto fail;
821 	if (!aa_unpack_str(e, &name, NULL))
822 		goto fail;
823 	if (*name == '\0')
824 		goto fail;
825 
826 	tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
827 	if (tmpns) {
828 		if (!tmpname) {
829 			info = "empty profile name";
830 			goto fail;
831 		}
832 		*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
833 		if (!*ns_name) {
834 			info = "out of memory";
835 			error = -ENOMEM;
836 			goto fail;
837 		}
838 		name = tmpname;
839 	}
840 
841 	profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
842 	if (!profile) {
843 		info = "out of memory";
844 		error = -ENOMEM;
845 		goto fail;
846 	}
847 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
848 
849 	/* profile renaming is optional */
850 	(void) aa_unpack_str(e, &profile->rename, "rename");
851 
852 	/* attachment string is optional */
853 	(void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
854 
855 	/* xmatch is optional and may be NULL */
856 	error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
857 	if (error) {
858 		info = "bad xmatch";
859 		goto fail;
860 	}
861 
862 	/* neither xmatch_len not xmatch_perms are optional if xmatch is set */
863 	if (profile->attach.xmatch.dfa) {
864 		if (!aa_unpack_u32(e, &tmp, NULL)) {
865 			info = "missing xmatch len";
866 			goto fail;
867 		}
868 		profile->attach.xmatch_len = tmp;
869 		profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
870 		if (!profile->attach.xmatch.perms) {
871 			error = aa_compat_map_xmatch(&profile->attach.xmatch);
872 			if (error) {
873 				info = "failed to convert xmatch permission table";
874 				goto fail;
875 			}
876 		}
877 	}
878 
879 	/* disconnected attachment string is optional */
880 	(void) aa_unpack_strdup(e, &disconnected, "disconnected");
881 	profile->disconnected = disconnected;
882 
883 	/* per profile debug flags (complain, audit) */
884 	if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
885 		info = "profile missing flags";
886 		goto fail;
887 	}
888 	info = "failed to unpack profile flags";
889 	if (!aa_unpack_u32(e, &tmp, NULL))
890 		goto fail;
891 	if (tmp & PACKED_FLAG_HAT)
892 		profile->label.flags |= FLAG_HAT;
893 	if (tmp & PACKED_FLAG_DEBUG1)
894 		profile->label.flags |= FLAG_DEBUG1;
895 	if (tmp & PACKED_FLAG_DEBUG2)
896 		profile->label.flags |= FLAG_DEBUG2;
897 	if (!aa_unpack_u32(e, &tmp, NULL))
898 		goto fail;
899 	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
900 		profile->mode = APPARMOR_COMPLAIN;
901 	} else if (tmp == PACKED_MODE_ENFORCE) {
902 		profile->mode = APPARMOR_ENFORCE;
903 	} else if (tmp == PACKED_MODE_KILL) {
904 		profile->mode = APPARMOR_KILL;
905 	} else if (tmp == PACKED_MODE_UNCONFINED) {
906 		profile->mode = APPARMOR_UNCONFINED;
907 		profile->label.flags |= FLAG_UNCONFINED;
908 	} else if (tmp == PACKED_MODE_USER) {
909 		profile->mode = APPARMOR_USER;
910 	} else {
911 		goto fail;
912 	}
913 	if (!aa_unpack_u32(e, &tmp, NULL))
914 		goto fail;
915 	if (tmp)
916 		profile->audit = AUDIT_ALL;
917 
918 	if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
919 		goto fail;
920 
921 	/* path_flags is optional */
922 	if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
923 		profile->path_flags |= profile->label.flags &
924 			PATH_MEDIATE_DELETED;
925 	else
926 		/* set a default value if path_flags field is not present */
927 		profile->path_flags = PATH_MEDIATE_DELETED;
928 
929 	info = "failed to unpack profile capabilities";
930 	if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))
931 		goto fail;
932 	if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))
933 		goto fail;
934 	if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))
935 		goto fail;
936 	if (!aa_unpack_cap_low(e, &tmpcap, NULL))
937 		goto fail;
938 
939 	info = "failed to unpack upper profile capabilities";
940 	if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
941 		/* optional upper half of 64 bit caps */
942 		if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))
943 			goto fail;
944 		if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))
945 			goto fail;
946 		if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))
947 			goto fail;
948 		if (!aa_unpack_cap_high(e, &tmpcap, NULL))
949 			goto fail;
950 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
951 			goto fail;
952 	}
953 
954 	info = "failed to unpack extended profile capabilities";
955 	if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
956 		/* optional extended caps mediation mask */
957 		if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))
958 			goto fail;
959 		if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))
960 			goto fail;
961 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
962 			goto fail;
963 	}
964 
965 	if (!unpack_xattrs(e, profile)) {
966 		info = "failed to unpack profile xattrs";
967 		goto fail;
968 	}
969 
970 	if (!unpack_rlimits(e, rules)) {
971 		info = "failed to unpack profile rlimits";
972 		goto fail;
973 	}
974 
975 	if (!unpack_secmark(e, rules)) {
976 		info = "failed to unpack profile secmark rules";
977 		goto fail;
978 	}
979 
980 	if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
981 		/* generic policy dfa - optional and may be NULL */
982 		info = "failed to unpack policydb";
983 		error = unpack_pdb(e, &rules->policy, true, false,
984 				   &info);
985 		if (error)
986 			goto fail;
987 		/* Fixup: drop when we get rid of start array */
988 		if (aa_dfa_next(rules->policy.dfa, rules->policy.start[0],
989 				AA_CLASS_FILE))
990 			rules->policy.start[AA_CLASS_FILE] =
991 			  aa_dfa_next(rules->policy.dfa,
992 				      rules->policy.start[0],
993 				      AA_CLASS_FILE);
994 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
995 			goto fail;
996 		if (!rules->policy.perms) {
997 			error = aa_compat_map_policy(&rules->policy,
998 						     e->version);
999 			if (error) {
1000 				info = "failed to remap policydb permission table";
1001 				goto fail;
1002 			}
1003 		}
1004 	} else {
1005 		rules->policy.dfa = aa_get_dfa(nulldfa);
1006 		rules->policy.perms = kcalloc(2, sizeof(struct aa_perms),
1007 					      GFP_KERNEL);
1008 		if (!rules->policy.perms)
1009 			goto fail;
1010 		rules->policy.size = 2;
1011 	}
1012 	/* get file rules */
1013 	error = unpack_pdb(e, &rules->file, false, true, &info);
1014 	if (error) {
1015 		goto fail;
1016 	} else if (rules->file.dfa) {
1017 		if (!rules->file.perms) {
1018 			error = aa_compat_map_file(&rules->file);
1019 			if (error) {
1020 				info = "failed to remap file permission table";
1021 				goto fail;
1022 			}
1023 		}
1024 	} else if (rules->policy.dfa &&
1025 		   rules->policy.start[AA_CLASS_FILE]) {
1026 		rules->file.dfa = aa_get_dfa(rules->policy.dfa);
1027 		rules->file.start[AA_CLASS_FILE] = rules->policy.start[AA_CLASS_FILE];
1028 		rules->file.perms = kcalloc(rules->policy.size,
1029 					    sizeof(struct aa_perms),
1030 					    GFP_KERNEL);
1031 		if (!rules->file.perms)
1032 			goto fail;
1033 		memcpy(rules->file.perms, rules->policy.perms,
1034 		       rules->policy.size * sizeof(struct aa_perms));
1035 		rules->file.size = rules->policy.size;
1036 	} else {
1037 		rules->file.dfa = aa_get_dfa(nulldfa);
1038 		rules->file.perms = kcalloc(2, sizeof(struct aa_perms),
1039 					    GFP_KERNEL);
1040 		if (!rules->file.perms)
1041 			goto fail;
1042 		rules->file.size = 2;
1043 	}
1044 	error = -EPROTO;
1045 	if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1046 		info = "out of memory";
1047 		profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
1048 		if (!profile->data) {
1049 			error = -ENOMEM;
1050 			goto fail;
1051 		}
1052 		params.nelem_hint = 3;
1053 		params.key_len = sizeof(void *);
1054 		params.key_offset = offsetof(struct aa_data, key);
1055 		params.head_offset = offsetof(struct aa_data, head);
1056 		params.hashfn = strhash;
1057 		params.obj_cmpfn = datacmp;
1058 
1059 		if (rhashtable_init(profile->data, &params)) {
1060 			info = "failed to init key, value hash table";
1061 			goto fail;
1062 		}
1063 
1064 		while (aa_unpack_strdup(e, &key, NULL)) {
1065 			data = kzalloc(sizeof(*data), GFP_KERNEL);
1066 			if (!data) {
1067 				kfree_sensitive(key);
1068 				error = -ENOMEM;
1069 				goto fail;
1070 			}
1071 
1072 			data->key = key;
1073 			data->size = aa_unpack_blob(e, &data->data, NULL);
1074 			data->data = kvmemdup(data->data, data->size, GFP_KERNEL);
1075 			if (data->size && !data->data) {
1076 				kfree_sensitive(data->key);
1077 				kfree_sensitive(data);
1078 				error = -ENOMEM;
1079 				goto fail;
1080 			}
1081 
1082 			if (rhashtable_insert_fast(profile->data, &data->head,
1083 						   profile->data->p)) {
1084 				kvfree_sensitive(data->data, data->size);
1085 				kfree_sensitive(data->key);
1086 				kfree_sensitive(data);
1087 				info = "failed to insert data to table";
1088 				goto fail;
1089 			}
1090 		}
1091 
1092 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1093 			info = "failed to unpack end of key, value data table";
1094 			goto fail;
1095 		}
1096 	}
1097 
1098 	if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1099 		info = "failed to unpack end of profile";
1100 		goto fail;
1101 	}
1102 
1103 	return profile;
1104 
1105 fail:
1106 	if (error == 0)
1107 		/* default error covers most cases */
1108 		error = -EPROTO;
1109 	if (*ns_name) {
1110 		kfree(*ns_name);
1111 		*ns_name = NULL;
1112 	}
1113 	if (profile)
1114 		name = NULL;
1115 	else if (!name)
1116 		name = "unknown";
1117 	audit_iface(profile, NULL, name, info, e, error);
1118 	aa_free_profile(profile);
1119 
1120 	return ERR_PTR(error);
1121 }
1122 
1123 /**
1124  * verify_header - unpack serialized stream header
1125  * @e: serialized data read head (NOT NULL)
1126  * @required: whether the header is required or optional
1127  * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1128  *
1129  * Returns: error or 0 if header is good
1130  */
verify_header(struct aa_ext * e,int required,const char ** ns)1131 static int verify_header(struct aa_ext *e, int required, const char **ns)
1132 {
1133 	int error = -EPROTONOSUPPORT;
1134 	const char *name = NULL;
1135 	*ns = NULL;
1136 
1137 	/* get the interface version */
1138 	if (!aa_unpack_u32(e, &e->version, "version")) {
1139 		if (required) {
1140 			audit_iface(NULL, NULL, NULL, "invalid profile format",
1141 				    e, error);
1142 			return error;
1143 		}
1144 	}
1145 
1146 	/* Check that the interface version is currently supported.
1147 	 * if not specified use previous version
1148 	 * Mask off everything that is not kernel abi version
1149 	 */
1150 	if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1151 		audit_iface(NULL, NULL, NULL, "unsupported interface version",
1152 			    e, error);
1153 		return error;
1154 	}
1155 
1156 	/* read the namespace if present */
1157 	if (aa_unpack_str(e, &name, "namespace")) {
1158 		if (*name == '\0') {
1159 			audit_iface(NULL, NULL, NULL, "invalid namespace name",
1160 				    e, error);
1161 			return error;
1162 		}
1163 		if (*ns && strcmp(*ns, name)) {
1164 			audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1165 				    error);
1166 		} else if (!*ns) {
1167 			*ns = kstrdup(name, GFP_KERNEL);
1168 			if (!*ns)
1169 				return -ENOMEM;
1170 		}
1171 	}
1172 
1173 	return 0;
1174 }
1175 
1176 /**
1177  * verify_dfa_accept_index - verify accept indexes are in range of perms table
1178  * @dfa: the dfa to check accept indexes are in range
1179  * table_size: the permission table size the indexes should be within
1180  */
verify_dfa_accept_index(struct aa_dfa * dfa,int table_size)1181 static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
1182 {
1183 	int i;
1184 	for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1185 		if (ACCEPT_TABLE(dfa)[i] >= table_size)
1186 			return false;
1187 	}
1188 	return true;
1189 }
1190 
verify_perm(struct aa_perms * perm)1191 static bool verify_perm(struct aa_perms *perm)
1192 {
1193 	/* TODO: allow option to just force the perms into a valid state */
1194 	if (perm->allow & perm->deny)
1195 		return false;
1196 	if (perm->subtree & ~perm->allow)
1197 		return false;
1198 	if (perm->cond & (perm->allow | perm->deny))
1199 		return false;
1200 	if (perm->kill & perm->allow)
1201 		return false;
1202 	if (perm->complain & (perm->allow | perm->deny))
1203 		return false;
1204 	if (perm->prompt & (perm->allow | perm->deny))
1205 		return false;
1206 	if (perm->complain & perm->prompt)
1207 		return false;
1208 	if (perm->hide & perm->allow)
1209 		return false;
1210 
1211 	return true;
1212 }
1213 
verify_perms(struct aa_policydb * pdb)1214 static bool verify_perms(struct aa_policydb *pdb)
1215 {
1216 	int i;
1217 
1218 	for (i = 0; i < pdb->size; i++) {
1219 		if (!verify_perm(&pdb->perms[i]))
1220 			return false;
1221 		/* verify indexes into str table */
1222 		if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE &&
1223 		    (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size)
1224 			return false;
1225 		if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size)
1226 			return false;
1227 		if (pdb->perms[i].label &&
1228 		    pdb->perms[i].label >= pdb->trans.size)
1229 			return false;
1230 	}
1231 
1232 	return true;
1233 }
1234 
1235 /**
1236  * verify_profile - Do post unpack analysis to verify profile consistency
1237  * @profile: profile to verify (NOT NULL)
1238  *
1239  * Returns: 0 if passes verification else error
1240  *
1241  * This verification is post any unpack mapping or changes
1242  */
verify_profile(struct aa_profile * profile)1243 static int verify_profile(struct aa_profile *profile)
1244 {
1245 	struct aa_ruleset *rules = list_first_entry(&profile->rules,
1246 						    typeof(*rules), list);
1247 	if (!rules)
1248 		return 0;
1249 
1250 	if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa,
1251 							 rules->file.size)) ||
1252 	    (rules->policy.dfa &&
1253 	     !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) {
1254 		audit_iface(profile, NULL, NULL,
1255 			    "Unpack: Invalid named transition", NULL, -EPROTO);
1256 		return -EPROTO;
1257 	}
1258 
1259 	if (!verify_perms(&rules->file)) {
1260 		audit_iface(profile, NULL, NULL,
1261 			    "Unpack: Invalid perm index", NULL, -EPROTO);
1262 		return -EPROTO;
1263 	}
1264 	if (!verify_perms(&rules->policy)) {
1265 		audit_iface(profile, NULL, NULL,
1266 			    "Unpack: Invalid perm index", NULL, -EPROTO);
1267 		return -EPROTO;
1268 	}
1269 	if (!verify_perms(&profile->attach.xmatch)) {
1270 		audit_iface(profile, NULL, NULL,
1271 			    "Unpack: Invalid perm index", NULL, -EPROTO);
1272 		return -EPROTO;
1273 	}
1274 
1275 	return 0;
1276 }
1277 
aa_load_ent_free(struct aa_load_ent * ent)1278 void aa_load_ent_free(struct aa_load_ent *ent)
1279 {
1280 	if (ent) {
1281 		aa_put_profile(ent->rename);
1282 		aa_put_profile(ent->old);
1283 		aa_put_profile(ent->new);
1284 		kfree(ent->ns_name);
1285 		kfree_sensitive(ent);
1286 	}
1287 }
1288 
aa_load_ent_alloc(void)1289 struct aa_load_ent *aa_load_ent_alloc(void)
1290 {
1291 	struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1292 	if (ent)
1293 		INIT_LIST_HEAD(&ent->list);
1294 	return ent;
1295 }
1296 
compress_zstd(const char * src,size_t slen,char ** dst,size_t * dlen)1297 static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1298 {
1299 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1300 	const zstd_parameters params =
1301 		zstd_get_params(aa_g_rawdata_compression_level, slen);
1302 	const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1303 	void *wksp = NULL;
1304 	zstd_cctx *ctx = NULL;
1305 	size_t out_len = zstd_compress_bound(slen);
1306 	void *out = NULL;
1307 	int ret = 0;
1308 
1309 	out = kvzalloc(out_len, GFP_KERNEL);
1310 	if (!out) {
1311 		ret = -ENOMEM;
1312 		goto cleanup;
1313 	}
1314 
1315 	wksp = kvzalloc(wksp_len, GFP_KERNEL);
1316 	if (!wksp) {
1317 		ret = -ENOMEM;
1318 		goto cleanup;
1319 	}
1320 
1321 	ctx = zstd_init_cctx(wksp, wksp_len);
1322 	if (!ctx) {
1323 		ret = -EINVAL;
1324 		goto cleanup;
1325 	}
1326 
1327 	out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1328 	if (zstd_is_error(out_len) || out_len >= slen) {
1329 		ret = -EINVAL;
1330 		goto cleanup;
1331 	}
1332 
1333 	if (is_vmalloc_addr(out)) {
1334 		*dst = kvzalloc(out_len, GFP_KERNEL);
1335 		if (*dst) {
1336 			memcpy(*dst, out, out_len);
1337 			kvfree(out);
1338 			out = NULL;
1339 		}
1340 	} else {
1341 		/*
1342 		 * If the staging buffer was kmalloc'd, then using krealloc is
1343 		 * probably going to be faster. The destination buffer will
1344 		 * always be smaller, so it's just shrunk, avoiding a memcpy
1345 		 */
1346 		*dst = krealloc(out, out_len, GFP_KERNEL);
1347 	}
1348 
1349 	if (!*dst) {
1350 		ret = -ENOMEM;
1351 		goto cleanup;
1352 	}
1353 
1354 	*dlen = out_len;
1355 
1356 cleanup:
1357 	if (ret) {
1358 		kvfree(out);
1359 		*dst = NULL;
1360 	}
1361 
1362 	kvfree(wksp);
1363 	return ret;
1364 #else
1365 	*dlen = slen;
1366 	return 0;
1367 #endif
1368 }
1369 
compress_loaddata(struct aa_loaddata * data)1370 static int compress_loaddata(struct aa_loaddata *data)
1371 {
1372 	AA_BUG(data->compressed_size > 0);
1373 
1374 	/*
1375 	 * Shortcut the no compression case, else we increase the amount of
1376 	 * storage required by a small amount
1377 	 */
1378 	if (aa_g_rawdata_compression_level != 0) {
1379 		void *udata = data->data;
1380 		int error = compress_zstd(udata, data->size, &data->data,
1381 					  &data->compressed_size);
1382 		if (error) {
1383 			data->compressed_size = data->size;
1384 			return error;
1385 		}
1386 		if (udata != data->data)
1387 			kvfree(udata);
1388 	} else
1389 		data->compressed_size = data->size;
1390 
1391 	return 0;
1392 }
1393 
1394 /**
1395  * aa_unpack - unpack packed binary profile(s) data loaded from user space
1396  * @udata: user data copied to kmem  (NOT NULL)
1397  * @lh: list to place unpacked profiles in a aa_repl_ws
1398  * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1399  *
1400  * Unpack user data and return refcounted allocated profile(s) stored in
1401  * @lh in order of discovery, with the list chain stored in base.list
1402  * or error
1403  *
1404  * Returns: profile(s) on @lh else error pointer if fails to unpack
1405  */
aa_unpack(struct aa_loaddata * udata,struct list_head * lh,const char ** ns)1406 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1407 	      const char **ns)
1408 {
1409 	struct aa_load_ent *tmp, *ent;
1410 	struct aa_profile *profile = NULL;
1411 	char *ns_name = NULL;
1412 	int error;
1413 	struct aa_ext e = {
1414 		.start = udata->data,
1415 		.end = udata->data + udata->size,
1416 		.pos = udata->data,
1417 	};
1418 
1419 	*ns = NULL;
1420 	while (e.pos < e.end) {
1421 		void *start;
1422 		error = verify_header(&e, e.pos == e.start, ns);
1423 		if (error)
1424 			goto fail;
1425 
1426 		start = e.pos;
1427 		profile = unpack_profile(&e, &ns_name);
1428 		if (IS_ERR(profile)) {
1429 			error = PTR_ERR(profile);
1430 			goto fail;
1431 		}
1432 
1433 		error = verify_profile(profile);
1434 		if (error)
1435 			goto fail_profile;
1436 
1437 		if (aa_g_hash_policy)
1438 			error = aa_calc_profile_hash(profile, e.version, start,
1439 						     e.pos - start);
1440 		if (error)
1441 			goto fail_profile;
1442 
1443 		ent = aa_load_ent_alloc();
1444 		if (!ent) {
1445 			error = -ENOMEM;
1446 			goto fail_profile;
1447 		}
1448 
1449 		ent->new = profile;
1450 		ent->ns_name = ns_name;
1451 		ns_name = NULL;
1452 		list_add_tail(&ent->list, lh);
1453 	}
1454 	udata->abi = e.version & K_ABI_MASK;
1455 	if (aa_g_hash_policy) {
1456 		udata->hash = aa_calc_hash(udata->data, udata->size);
1457 		if (IS_ERR(udata->hash)) {
1458 			error = PTR_ERR(udata->hash);
1459 			udata->hash = NULL;
1460 			goto fail;
1461 		}
1462 	}
1463 
1464 	if (aa_g_export_binary) {
1465 		error = compress_loaddata(udata);
1466 		if (error)
1467 			goto fail;
1468 	}
1469 	return 0;
1470 
1471 fail_profile:
1472 	kfree(ns_name);
1473 	aa_put_profile(profile);
1474 
1475 fail:
1476 	list_for_each_entry_safe(ent, tmp, lh, list) {
1477 		list_del_init(&ent->list);
1478 		aa_load_ent_free(ent);
1479 	}
1480 
1481 	return error;
1482 }
1483