Merge tag 'xtensa-20230905' of https://github.com/jcmvbkbc/linux-xtensa
[platform/kernel/linux-starfive.git] / security / apparmor / policy_unpack.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * AppArmor security module
4  *
5  * This file contains AppArmor functions for unpacking policy loaded from
6  * userspace.
7  *
8  * Copyright (C) 1998-2008 Novell/SUSE
9  * Copyright 2009-2010 Canonical Ltd.
10  *
11  * AppArmor uses a serialized binary format for loading policy. To find
12  * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
13  * All policy is validated before it is used.
14  */
15
16 #include <asm/unaligned.h>
17 #include <kunit/visibility.h>
18 #include <linux/ctype.h>
19 #include <linux/errno.h>
20 #include <linux/zstd.h>
21
22 #include "include/apparmor.h"
23 #include "include/audit.h"
24 #include "include/cred.h"
25 #include "include/crypto.h"
26 #include "include/file.h"
27 #include "include/match.h"
28 #include "include/path.h"
29 #include "include/policy.h"
30 #include "include/policy_unpack.h"
31 #include "include/policy_compat.h"
32
33 /* audit callback for unpack fields */
34 static void audit_cb(struct audit_buffer *ab, void *va)
35 {
36         struct common_audit_data *sa = va;
37
38         if (aad(sa)->iface.ns) {
39                 audit_log_format(ab, " ns=");
40                 audit_log_untrustedstring(ab, aad(sa)->iface.ns);
41         }
42         if (aad(sa)->name) {
43                 audit_log_format(ab, " name=");
44                 audit_log_untrustedstring(ab, aad(sa)->name);
45         }
46         if (aad(sa)->iface.pos)
47                 audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
48 }
49
50 /**
51  * audit_iface - do audit message for policy unpacking/load/replace/remove
52  * @new: profile if it has been allocated (MAYBE NULL)
53  * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
54  * @name: name of the profile being manipulated (MAYBE NULL)
55  * @info: any extra info about the failure (MAYBE NULL)
56  * @e: buffer position info
57  * @error: error code
58  *
59  * Returns: %0 or error
60  */
61 static int audit_iface(struct aa_profile *new, const char *ns_name,
62                        const char *name, const char *info, struct aa_ext *e,
63                        int error)
64 {
65         struct aa_profile *profile = labels_profile(aa_current_raw_label());
66         DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
67         if (e)
68                 aad(&sa)->iface.pos = e->pos - e->start;
69         aad(&sa)->iface.ns = ns_name;
70         if (new)
71                 aad(&sa)->name = new->base.hname;
72         else
73                 aad(&sa)->name = name;
74         aad(&sa)->info = info;
75         aad(&sa)->error = error;
76
77         return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
78 }
79
80 void __aa_loaddata_update(struct aa_loaddata *data, long revision)
81 {
82         AA_BUG(!data);
83         AA_BUG(!data->ns);
84         AA_BUG(!mutex_is_locked(&data->ns->lock));
85         AA_BUG(data->revision > revision);
86
87         data->revision = revision;
88         if ((data->dents[AAFS_LOADDATA_REVISION])) {
89                 struct inode *inode;
90
91                 inode = d_inode(data->dents[AAFS_LOADDATA_DIR]);
92                 inode->i_mtime = inode_set_ctime_current(inode);
93
94                 inode = d_inode(data->dents[AAFS_LOADDATA_REVISION]);
95                 inode->i_mtime = inode_set_ctime_current(inode);
96         }
97 }
98
99 bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
100 {
101         if (l->size != r->size)
102                 return false;
103         if (l->compressed_size != r->compressed_size)
104                 return false;
105         if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
106                 return false;
107         return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
108 }
109
110 /*
111  * need to take the ns mutex lock which is NOT safe most places that
112  * put_loaddata is called, so we have to delay freeing it
113  */
114 static void do_loaddata_free(struct work_struct *work)
115 {
116         struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
117         struct aa_ns *ns = aa_get_ns(d->ns);
118
119         if (ns) {
120                 mutex_lock_nested(&ns->lock, ns->level);
121                 __aa_fs_remove_rawdata(d);
122                 mutex_unlock(&ns->lock);
123                 aa_put_ns(ns);
124         }
125
126         kfree_sensitive(d->hash);
127         kfree_sensitive(d->name);
128         kvfree(d->data);
129         kfree_sensitive(d);
130 }
131
132 void aa_loaddata_kref(struct kref *kref)
133 {
134         struct aa_loaddata *d = container_of(kref, struct aa_loaddata, count);
135
136         if (d) {
137                 INIT_WORK(&d->work, do_loaddata_free);
138                 schedule_work(&d->work);
139         }
140 }
141
142 struct aa_loaddata *aa_loaddata_alloc(size_t size)
143 {
144         struct aa_loaddata *d;
145
146         d = kzalloc(sizeof(*d), GFP_KERNEL);
147         if (d == NULL)
148                 return ERR_PTR(-ENOMEM);
149         d->data = kvzalloc(size, GFP_KERNEL);
150         if (!d->data) {
151                 kfree(d);
152                 return ERR_PTR(-ENOMEM);
153         }
154         kref_init(&d->count);
155         INIT_LIST_HEAD(&d->list);
156
157         return d;
158 }
159
160 /* test if read will be in packed data bounds */
161 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
162 {
163         return (size <= e->end - e->pos);
164 }
165 EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
166
167 /**
168  * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
169  * @e: serialized data read head (NOT NULL)
170  * @chunk: start address for chunk of data (NOT NULL)
171  *
172  * Returns: the size of chunk found with the read head at the end of the chunk.
173  */
174 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
175 {
176         size_t size = 0;
177         void *pos = e->pos;
178
179         if (!aa_inbounds(e, sizeof(u16)))
180                 goto fail;
181         size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
182         e->pos += sizeof(__le16);
183         if (!aa_inbounds(e, size))
184                 goto fail;
185         *chunk = e->pos;
186         e->pos += size;
187         return size;
188
189 fail:
190         e->pos = pos;
191         return 0;
192 }
193 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
194
195 /* unpack control byte */
196 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
197 {
198         if (!aa_inbounds(e, 1))
199                 return false;
200         if (*(u8 *) e->pos != code)
201                 return false;
202         e->pos++;
203         return true;
204 }
205 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
206
207 /**
208  * aa_unpack_nameX - check is the next element is of type X with a name of @name
209  * @e: serialized data extent information  (NOT NULL)
210  * @code: type code
211  * @name: name to match to the serialized element.  (MAYBE NULL)
212  *
213  * check that the next serialized data element is of type X and has a tag
214  * name @name.  If @name is specified then there must be a matching
215  * name element in the stream.  If @name is NULL any name element will be
216  * skipped and only the typecode will be tested.
217  *
218  * Returns true on success (both type code and name tests match) and the read
219  * head is advanced past the headers
220  *
221  * Returns: false if either match fails, the read head does not move
222  */
223 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
224 {
225         /*
226          * May need to reset pos if name or type doesn't match
227          */
228         void *pos = e->pos;
229         /*
230          * Check for presence of a tagname, and if present name size
231          * AA_NAME tag value is a u16.
232          */
233         if (aa_unpack_X(e, AA_NAME)) {
234                 char *tag = NULL;
235                 size_t size = aa_unpack_u16_chunk(e, &tag);
236                 /* if a name is specified it must match. otherwise skip tag */
237                 if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
238                         goto fail;
239         } else if (name) {
240                 /* if a name is specified and there is no name tag fail */
241                 goto fail;
242         }
243
244         /* now check if type code matches */
245         if (aa_unpack_X(e, code))
246                 return true;
247
248 fail:
249         e->pos = pos;
250         return false;
251 }
252 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
253
254 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
255 {
256         void *pos = e->pos;
257
258         if (aa_unpack_nameX(e, AA_U8, name)) {
259                 if (!aa_inbounds(e, sizeof(u8)))
260                         goto fail;
261                 if (data)
262                         *data = *((u8 *)e->pos);
263                 e->pos += sizeof(u8);
264                 return true;
265         }
266
267 fail:
268         e->pos = pos;
269         return false;
270 }
271
272 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
273 {
274         void *pos = e->pos;
275
276         if (aa_unpack_nameX(e, AA_U32, name)) {
277                 if (!aa_inbounds(e, sizeof(u32)))
278                         goto fail;
279                 if (data)
280                         *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
281                 e->pos += sizeof(u32);
282                 return true;
283         }
284
285 fail:
286         e->pos = pos;
287         return false;
288 }
289 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
290
291 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
292 {
293         void *pos = e->pos;
294
295         if (aa_unpack_nameX(e, AA_U64, name)) {
296                 if (!aa_inbounds(e, sizeof(u64)))
297                         goto fail;
298                 if (data)
299                         *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
300                 e->pos += sizeof(u64);
301                 return true;
302         }
303
304 fail:
305         e->pos = pos;
306         return false;
307 }
308 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
309
310 static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
311 {
312         u32 val;
313
314         if (!aa_unpack_u32(e, &val, name))
315                 return false;
316         data->val = val;
317         return true;
318 }
319
320 static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
321 {
322         u32 val;
323
324         if (!aa_unpack_u32(e, &val, name))
325                 return false;
326         data->val = (u32)data->val | ((u64)val << 32);
327         return true;
328 }
329
330 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
331 {
332         void *pos = e->pos;
333
334         if (aa_unpack_nameX(e, AA_ARRAY, name)) {
335                 if (!aa_inbounds(e, sizeof(u16)))
336                         goto fail;
337                 *size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
338                 e->pos += sizeof(u16);
339                 return true;
340         }
341
342 fail:
343         e->pos = pos;
344         return false;
345 }
346 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
347
348 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
349 {
350         void *pos = e->pos;
351
352         if (aa_unpack_nameX(e, AA_BLOB, name)) {
353                 u32 size;
354                 if (!aa_inbounds(e, sizeof(u32)))
355                         goto fail;
356                 size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
357                 e->pos += sizeof(u32);
358                 if (aa_inbounds(e, (size_t) size)) {
359                         *blob = e->pos;
360                         e->pos += size;
361                         return size;
362                 }
363         }
364
365 fail:
366         e->pos = pos;
367         return 0;
368 }
369 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
370
371 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
372 {
373         char *src_str;
374         size_t size = 0;
375         void *pos = e->pos;
376         *string = NULL;
377         if (aa_unpack_nameX(e, AA_STRING, name)) {
378                 size = aa_unpack_u16_chunk(e, &src_str);
379                 if (size) {
380                         /* strings are null terminated, length is size - 1 */
381                         if (src_str[size - 1] != 0)
382                                 goto fail;
383                         *string = src_str;
384
385                         return size;
386                 }
387         }
388
389 fail:
390         e->pos = pos;
391         return 0;
392 }
393 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
394
395 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
396 {
397         const char *tmp;
398         void *pos = e->pos;
399         int res = aa_unpack_str(e, &tmp, name);
400         *string = NULL;
401
402         if (!res)
403                 return 0;
404
405         *string = kmemdup(tmp, res, GFP_KERNEL);
406         if (!*string) {
407                 e->pos = pos;
408                 return 0;
409         }
410
411         return res;
412 }
413 EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
414
415
416 /**
417  * unpack_dfa - unpack a file rule dfa
418  * @e: serialized data extent information (NOT NULL)
419  * @flags: dfa flags to check
420  *
421  * returns dfa or ERR_PTR or NULL if no dfa
422  */
423 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
424 {
425         char *blob = NULL;
426         size_t size;
427         struct aa_dfa *dfa = NULL;
428
429         size = aa_unpack_blob(e, &blob, "aadfa");
430         if (size) {
431                 /*
432                  * The dfa is aligned with in the blob to 8 bytes
433                  * from the beginning of the stream.
434                  * alignment adjust needed by dfa unpack
435                  */
436                 size_t sz = blob - (char *) e->start -
437                         ((e->pos - e->start) & 7);
438                 size_t pad = ALIGN(sz, 8) - sz;
439                 if (aa_g_paranoid_load)
440                         flags |= DFA_FLAG_VERIFY_STATES;
441                 dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
442
443                 if (IS_ERR(dfa))
444                         return dfa;
445
446         }
447
448         return dfa;
449 }
450
451 /**
452  * unpack_trans_table - unpack a profile transition table
453  * @e: serialized data extent information  (NOT NULL)
454  * @strs: str table to unpack to (NOT NULL)
455  *
456  * Returns: true if table successfully unpacked or not present
457  */
458 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)
459 {
460         void *saved_pos = e->pos;
461         char **table = NULL;
462
463         /* exec table is optional */
464         if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {
465                 u16 size;
466                 int i;
467
468                 if (!aa_unpack_array(e, NULL, &size))
469                         /*
470                          * Note: index into trans table array is a max
471                          * of 2^24, but unpack array can only unpack
472                          * an array of 2^16 in size atm so no need
473                          * for size check here
474                          */
475                         goto fail;
476                 table = kcalloc(size, sizeof(char *), GFP_KERNEL);
477                 if (!table)
478                         goto fail;
479
480                 for (i = 0; i < size; i++) {
481                         char *str;
482                         int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);
483                         /* aa_unpack_strdup verifies that the last character is
484                          * null termination byte.
485                          */
486                         if (!size2)
487                                 goto fail;
488                         table[i] = str;
489                         /* verify that name doesn't start with space */
490                         if (isspace(*str))
491                                 goto fail;
492
493                         /* count internal #  of internal \0 */
494                         for (c = j = 0; j < size2 - 1; j++) {
495                                 if (!str[j]) {
496                                         pos = j;
497                                         c++;
498                                 }
499                         }
500                         if (*str == ':') {
501                                 /* first character after : must be valid */
502                                 if (!str[1])
503                                         goto fail;
504                                 /* beginning with : requires an embedded \0,
505                                  * verify that exactly 1 internal \0 exists
506                                  * trailing \0 already verified by aa_unpack_strdup
507                                  *
508                                  * convert \0 back to : for label_parse
509                                  */
510                                 if (c == 1)
511                                         str[pos] = ':';
512                                 else if (c > 1)
513                                         goto fail;
514                         } else if (c)
515                                 /* fail - all other cases with embedded \0 */
516                                 goto fail;
517                 }
518                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
519                         goto fail;
520                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
521                         goto fail;
522
523                 strs->table = table;
524                 strs->size = size;
525         }
526         return true;
527
528 fail:
529         kfree_sensitive(table);
530         e->pos = saved_pos;
531         return false;
532 }
533
534 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
535 {
536         void *pos = e->pos;
537
538         if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
539                 u16 size;
540                 int i;
541
542                 if (!aa_unpack_array(e, NULL, &size))
543                         goto fail;
544                 profile->attach.xattr_count = size;
545                 profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
546                 if (!profile->attach.xattrs)
547                         goto fail;
548                 for (i = 0; i < size; i++) {
549                         if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
550                                 goto fail;
551                 }
552                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
553                         goto fail;
554                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
555                         goto fail;
556         }
557
558         return true;
559
560 fail:
561         e->pos = pos;
562         return false;
563 }
564
565 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
566 {
567         void *pos = e->pos;
568         u16 size;
569         int i;
570
571         if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
572                 if (!aa_unpack_array(e, NULL, &size))
573                         goto fail;
574
575                 rules->secmark = kcalloc(size, sizeof(struct aa_secmark),
576                                            GFP_KERNEL);
577                 if (!rules->secmark)
578                         goto fail;
579
580                 rules->secmark_count = size;
581
582                 for (i = 0; i < size; i++) {
583                         if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
584                                 goto fail;
585                         if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
586                                 goto fail;
587                         if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
588                                 goto fail;
589                 }
590                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
591                         goto fail;
592                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
593                         goto fail;
594         }
595
596         return true;
597
598 fail:
599         if (rules->secmark) {
600                 for (i = 0; i < size; i++)
601                         kfree(rules->secmark[i].label);
602                 kfree(rules->secmark);
603                 rules->secmark_count = 0;
604                 rules->secmark = NULL;
605         }
606
607         e->pos = pos;
608         return false;
609 }
610
611 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
612 {
613         void *pos = e->pos;
614
615         /* rlimits are optional */
616         if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
617                 u16 size;
618                 int i;
619                 u32 tmp = 0;
620                 if (!aa_unpack_u32(e, &tmp, NULL))
621                         goto fail;
622                 rules->rlimits.mask = tmp;
623
624                 if (!aa_unpack_array(e, NULL, &size) ||
625                     size > RLIM_NLIMITS)
626                         goto fail;
627                 for (i = 0; i < size; i++) {
628                         u64 tmp2 = 0;
629                         int a = aa_map_resource(i);
630                         if (!aa_unpack_u64(e, &tmp2, NULL))
631                                 goto fail;
632                         rules->rlimits.limits[a].rlim_max = tmp2;
633                 }
634                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
635                         goto fail;
636                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
637                         goto fail;
638         }
639         return true;
640
641 fail:
642         e->pos = pos;
643         return false;
644 }
645
646 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
647 {
648         if (version != 1)
649                 return false;
650
651         return  aa_unpack_u32(e, &perm->allow, NULL) &&
652                 aa_unpack_u32(e, &perm->allow, NULL) &&
653                 aa_unpack_u32(e, &perm->deny, NULL) &&
654                 aa_unpack_u32(e, &perm->subtree, NULL) &&
655                 aa_unpack_u32(e, &perm->cond, NULL) &&
656                 aa_unpack_u32(e, &perm->kill, NULL) &&
657                 aa_unpack_u32(e, &perm->complain, NULL) &&
658                 aa_unpack_u32(e, &perm->prompt, NULL) &&
659                 aa_unpack_u32(e, &perm->audit, NULL) &&
660                 aa_unpack_u32(e, &perm->quiet, NULL) &&
661                 aa_unpack_u32(e, &perm->hide, NULL) &&
662                 aa_unpack_u32(e, &perm->xindex, NULL) &&
663                 aa_unpack_u32(e, &perm->tag, NULL) &&
664                 aa_unpack_u32(e, &perm->label, NULL);
665 }
666
667 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
668 {
669         void *pos = e->pos;
670         u16 size = 0;
671
672         AA_BUG(!perms);
673         /*
674          * policy perms are optional, in which case perms are embedded
675          * in the dfa accept table
676          */
677         if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
678                 int i;
679                 u32 version;
680
681                 if (!aa_unpack_u32(e, &version, "version"))
682                         goto fail_reset;
683                 if (!aa_unpack_array(e, NULL, &size))
684                         goto fail_reset;
685                 *perms = kcalloc(size, sizeof(struct aa_perms), GFP_KERNEL);
686                 if (!*perms)
687                         goto fail_reset;
688                 for (i = 0; i < size; i++) {
689                         if (!unpack_perm(e, version, &(*perms)[i]))
690                                 goto fail;
691                 }
692                 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
693                         goto fail;
694                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
695                         goto fail;
696         } else
697                 *perms = NULL;
698
699         return size;
700
701 fail:
702         kfree(*perms);
703 fail_reset:
704         e->pos = pos;
705         return -EPROTO;
706 }
707
708 static int unpack_pdb(struct aa_ext *e, struct aa_policydb *policy,
709                       bool required_dfa, bool required_trans,
710                       const char **info)
711 {
712         void *pos = e->pos;
713         int i, flags, error = -EPROTO;
714         ssize_t size;
715
716         size = unpack_perms_table(e, &policy->perms);
717         if (size < 0) {
718                 error = size;
719                 policy->perms = NULL;
720                 *info = "failed to unpack - perms";
721                 goto fail;
722         }
723         policy->size = size;
724
725         if (policy->perms) {
726                 /* perms table present accept is index */
727                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
728         } else {
729                 /* packed perms in accept1 and accept2 */
730                 flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
731                         TO_ACCEPT2_FLAG(YYTD_DATA32);
732         }
733
734         policy->dfa = unpack_dfa(e, flags);
735         if (IS_ERR(policy->dfa)) {
736                 error = PTR_ERR(policy->dfa);
737                 policy->dfa = NULL;
738                 *info = "failed to unpack - dfa";
739                 goto fail;
740         } else if (!policy->dfa) {
741                 if (required_dfa) {
742                         *info = "missing required dfa";
743                         goto fail;
744                 }
745                 goto out;
746         }
747
748         /*
749          * only unpack the following if a dfa is present
750          *
751          * sadly start was given different names for file and policydb
752          * but since it is optional we can try both
753          */
754         if (!aa_unpack_u32(e, &policy->start[0], "start"))
755                 /* default start state */
756                 policy->start[0] = DFA_START;
757         if (!aa_unpack_u32(e, &policy->start[AA_CLASS_FILE], "dfa_start")) {
758                 /* default start state for xmatch and file dfa */
759                 policy->start[AA_CLASS_FILE] = DFA_START;
760         }       /* setup class index */
761         for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
762                 policy->start[i] = aa_dfa_next(policy->dfa, policy->start[0],
763                                                i);
764         }
765         if (!unpack_trans_table(e, &policy->trans) && required_trans) {
766                 *info = "failed to unpack profile transition table";
767                 goto fail;
768         }
769
770         /* TODO: move compat mapping here, requires dfa merging first */
771         /* TODO: move verify here, it has to be done after compat mappings */
772 out:
773         return 0;
774
775 fail:
776         e->pos = pos;
777         return error;
778 }
779
780 static u32 strhash(const void *data, u32 len, u32 seed)
781 {
782         const char * const *key = data;
783
784         return jhash(*key, strlen(*key), seed);
785 }
786
787 static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
788 {
789         const struct aa_data *data = obj;
790         const char * const *key = arg->key;
791
792         return strcmp(data->key, *key);
793 }
794
795 /**
796  * unpack_profile - unpack a serialized profile
797  * @e: serialized data extent information (NOT NULL)
798  * @ns_name: pointer of newly allocated copy of %NULL in case of error
799  *
800  * NOTE: unpack profile sets audit struct if there is a failure
801  */
802 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
803 {
804         struct aa_ruleset *rules;
805         struct aa_profile *profile = NULL;
806         const char *tmpname, *tmpns = NULL, *name = NULL;
807         const char *info = "failed to unpack profile";
808         size_t ns_len;
809         struct rhashtable_params params = { 0 };
810         char *key = NULL;
811         struct aa_data *data;
812         int error = -EPROTO;
813         kernel_cap_t tmpcap;
814         u32 tmp;
815
816         *ns_name = NULL;
817
818         /* check that we have the right struct being passed */
819         if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
820                 goto fail;
821         if (!aa_unpack_str(e, &name, NULL))
822                 goto fail;
823         if (*name == '\0')
824                 goto fail;
825
826         tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
827         if (tmpns) {
828                 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
829                 if (!*ns_name) {
830                         info = "out of memory";
831                         error = -ENOMEM;
832                         goto fail;
833                 }
834                 name = tmpname;
835         }
836
837         profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
838         if (!profile) {
839                 info = "out of memory";
840                 error = -ENOMEM;
841                 goto fail;
842         }
843         rules = list_first_entry(&profile->rules, typeof(*rules), list);
844
845         /* profile renaming is optional */
846         (void) aa_unpack_str(e, &profile->rename, "rename");
847
848         /* attachment string is optional */
849         (void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
850
851         /* xmatch is optional and may be NULL */
852         error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
853         if (error) {
854                 info = "bad xmatch";
855                 goto fail;
856         }
857
858         /* neither xmatch_len not xmatch_perms are optional if xmatch is set */
859         if (profile->attach.xmatch.dfa) {
860                 if (!aa_unpack_u32(e, &tmp, NULL)) {
861                         info = "missing xmatch len";
862                         goto fail;
863                 }
864                 profile->attach.xmatch_len = tmp;
865                 profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
866                 if (!profile->attach.xmatch.perms) {
867                         error = aa_compat_map_xmatch(&profile->attach.xmatch);
868                         if (error) {
869                                 info = "failed to convert xmatch permission table";
870                                 goto fail;
871                         }
872                 }
873         }
874
875         /* disconnected attachment string is optional */
876         (void) aa_unpack_str(e, &profile->disconnected, "disconnected");
877
878         /* per profile debug flags (complain, audit) */
879         if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
880                 info = "profile missing flags";
881                 goto fail;
882         }
883         info = "failed to unpack profile flags";
884         if (!aa_unpack_u32(e, &tmp, NULL))
885                 goto fail;
886         if (tmp & PACKED_FLAG_HAT)
887                 profile->label.flags |= FLAG_HAT;
888         if (tmp & PACKED_FLAG_DEBUG1)
889                 profile->label.flags |= FLAG_DEBUG1;
890         if (tmp & PACKED_FLAG_DEBUG2)
891                 profile->label.flags |= FLAG_DEBUG2;
892         if (!aa_unpack_u32(e, &tmp, NULL))
893                 goto fail;
894         if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
895                 profile->mode = APPARMOR_COMPLAIN;
896         } else if (tmp == PACKED_MODE_ENFORCE) {
897                 profile->mode = APPARMOR_ENFORCE;
898         } else if (tmp == PACKED_MODE_KILL) {
899                 profile->mode = APPARMOR_KILL;
900         } else if (tmp == PACKED_MODE_UNCONFINED) {
901                 profile->mode = APPARMOR_UNCONFINED;
902                 profile->label.flags |= FLAG_UNCONFINED;
903         } else if (tmp == PACKED_MODE_USER) {
904                 profile->mode = APPARMOR_USER;
905         } else {
906                 goto fail;
907         }
908         if (!aa_unpack_u32(e, &tmp, NULL))
909                 goto fail;
910         if (tmp)
911                 profile->audit = AUDIT_ALL;
912
913         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
914                 goto fail;
915
916         /* path_flags is optional */
917         if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
918                 profile->path_flags |= profile->label.flags &
919                         PATH_MEDIATE_DELETED;
920         else
921                 /* set a default value if path_flags field is not present */
922                 profile->path_flags = PATH_MEDIATE_DELETED;
923
924         info = "failed to unpack profile capabilities";
925         if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))
926                 goto fail;
927         if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))
928                 goto fail;
929         if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))
930                 goto fail;
931         if (!aa_unpack_cap_low(e, &tmpcap, NULL))
932                 goto fail;
933
934         info = "failed to unpack upper profile capabilities";
935         if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
936                 /* optional upper half of 64 bit caps */
937                 if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))
938                         goto fail;
939                 if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))
940                         goto fail;
941                 if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))
942                         goto fail;
943                 if (!aa_unpack_cap_high(e, &tmpcap, NULL))
944                         goto fail;
945                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
946                         goto fail;
947         }
948
949         info = "failed to unpack extended profile capabilities";
950         if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
951                 /* optional extended caps mediation mask */
952                 if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))
953                         goto fail;
954                 if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))
955                         goto fail;
956                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
957                         goto fail;
958         }
959
960         if (!unpack_xattrs(e, profile)) {
961                 info = "failed to unpack profile xattrs";
962                 goto fail;
963         }
964
965         if (!unpack_rlimits(e, rules)) {
966                 info = "failed to unpack profile rlimits";
967                 goto fail;
968         }
969
970         if (!unpack_secmark(e, rules)) {
971                 info = "failed to unpack profile secmark rules";
972                 goto fail;
973         }
974
975         if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
976                 /* generic policy dfa - optional and may be NULL */
977                 info = "failed to unpack policydb";
978                 error = unpack_pdb(e, &rules->policy, true, false,
979                                    &info);
980                 if (error)
981                         goto fail;
982                 /* Fixup: drop when we get rid of start array */
983                 if (aa_dfa_next(rules->policy.dfa, rules->policy.start[0],
984                                 AA_CLASS_FILE))
985                         rules->policy.start[AA_CLASS_FILE] =
986                           aa_dfa_next(rules->policy.dfa,
987                                       rules->policy.start[0],
988                                       AA_CLASS_FILE);
989                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
990                         goto fail;
991                 if (!rules->policy.perms) {
992                         error = aa_compat_map_policy(&rules->policy,
993                                                      e->version);
994                         if (error) {
995                                 info = "failed to remap policydb permission table";
996                                 goto fail;
997                         }
998                 }
999         } else {
1000                 rules->policy.dfa = aa_get_dfa(nulldfa);
1001                 rules->policy.perms = kcalloc(2, sizeof(struct aa_perms),
1002                                               GFP_KERNEL);
1003                 if (!rules->policy.perms)
1004                         goto fail;
1005                 rules->policy.size = 2;
1006         }
1007         /* get file rules */
1008         error = unpack_pdb(e, &rules->file, false, true, &info);
1009         if (error) {
1010                 goto fail;
1011         } else if (rules->file.dfa) {
1012                 if (!rules->file.perms) {
1013                         error = aa_compat_map_file(&rules->file);
1014                         if (error) {
1015                                 info = "failed to remap file permission table";
1016                                 goto fail;
1017                         }
1018                 }
1019         } else if (rules->policy.dfa &&
1020                    rules->policy.start[AA_CLASS_FILE]) {
1021                 rules->file.dfa = aa_get_dfa(rules->policy.dfa);
1022                 rules->file.start[AA_CLASS_FILE] = rules->policy.start[AA_CLASS_FILE];
1023                 rules->file.perms = kcalloc(rules->policy.size,
1024                                             sizeof(struct aa_perms),
1025                                             GFP_KERNEL);
1026                 if (!rules->file.perms)
1027                         goto fail;
1028                 memcpy(rules->file.perms, rules->policy.perms,
1029                        rules->policy.size * sizeof(struct aa_perms));
1030                 rules->file.size = rules->policy.size;
1031         } else {
1032                 rules->file.dfa = aa_get_dfa(nulldfa);
1033                 rules->file.perms = kcalloc(2, sizeof(struct aa_perms),
1034                                             GFP_KERNEL);
1035                 if (!rules->file.perms)
1036                         goto fail;
1037                 rules->file.size = 2;
1038         }
1039         error = -EPROTO;
1040         if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1041                 info = "out of memory";
1042                 profile->data = kzalloc(sizeof(*profile->data), GFP_KERNEL);
1043                 if (!profile->data) {
1044                         error = -ENOMEM;
1045                         goto fail;
1046                 }
1047                 params.nelem_hint = 3;
1048                 params.key_len = sizeof(void *);
1049                 params.key_offset = offsetof(struct aa_data, key);
1050                 params.head_offset = offsetof(struct aa_data, head);
1051                 params.hashfn = strhash;
1052                 params.obj_cmpfn = datacmp;
1053
1054                 if (rhashtable_init(profile->data, &params)) {
1055                         info = "failed to init key, value hash table";
1056                         goto fail;
1057                 }
1058
1059                 while (aa_unpack_strdup(e, &key, NULL)) {
1060                         data = kzalloc(sizeof(*data), GFP_KERNEL);
1061                         if (!data) {
1062                                 kfree_sensitive(key);
1063                                 error = -ENOMEM;
1064                                 goto fail;
1065                         }
1066
1067                         data->key = key;
1068                         data->size = aa_unpack_blob(e, &data->data, NULL);
1069                         data->data = kvmemdup(data->data, data->size, GFP_KERNEL);
1070                         if (data->size && !data->data) {
1071                                 kfree_sensitive(data->key);
1072                                 kfree_sensitive(data);
1073                                 error = -ENOMEM;
1074                                 goto fail;
1075                         }
1076
1077                         if (rhashtable_insert_fast(profile->data, &data->head,
1078                                                    profile->data->p)) {
1079                                 kfree_sensitive(data->key);
1080                                 kfree_sensitive(data);
1081                                 info = "failed to insert data to table";
1082                                 goto fail;
1083                         }
1084                 }
1085
1086                 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1087                         info = "failed to unpack end of key, value data table";
1088                         goto fail;
1089                 }
1090         }
1091
1092         if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1093                 info = "failed to unpack end of profile";
1094                 goto fail;
1095         }
1096
1097         return profile;
1098
1099 fail:
1100         if (error == 0)
1101                 /* default error covers most cases */
1102                 error = -EPROTO;
1103         if (*ns_name) {
1104                 kfree(*ns_name);
1105                 *ns_name = NULL;
1106         }
1107         if (profile)
1108                 name = NULL;
1109         else if (!name)
1110                 name = "unknown";
1111         audit_iface(profile, NULL, name, info, e, error);
1112         aa_free_profile(profile);
1113
1114         return ERR_PTR(error);
1115 }
1116
1117 /**
1118  * verify_header - unpack serialized stream header
1119  * @e: serialized data read head (NOT NULL)
1120  * @required: whether the header is required or optional
1121  * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1122  *
1123  * Returns: error or 0 if header is good
1124  */
1125 static int verify_header(struct aa_ext *e, int required, const char **ns)
1126 {
1127         int error = -EPROTONOSUPPORT;
1128         const char *name = NULL;
1129         *ns = NULL;
1130
1131         /* get the interface version */
1132         if (!aa_unpack_u32(e, &e->version, "version")) {
1133                 if (required) {
1134                         audit_iface(NULL, NULL, NULL, "invalid profile format",
1135                                     e, error);
1136                         return error;
1137                 }
1138         }
1139
1140         /* Check that the interface version is currently supported.
1141          * if not specified use previous version
1142          * Mask off everything that is not kernel abi version
1143          */
1144         if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1145                 audit_iface(NULL, NULL, NULL, "unsupported interface version",
1146                             e, error);
1147                 return error;
1148         }
1149
1150         /* read the namespace if present */
1151         if (aa_unpack_str(e, &name, "namespace")) {
1152                 if (*name == '\0') {
1153                         audit_iface(NULL, NULL, NULL, "invalid namespace name",
1154                                     e, error);
1155                         return error;
1156                 }
1157                 if (*ns && strcmp(*ns, name)) {
1158                         audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1159                                     error);
1160                 } else if (!*ns) {
1161                         *ns = kstrdup(name, GFP_KERNEL);
1162                         if (!*ns)
1163                                 return -ENOMEM;
1164                 }
1165         }
1166
1167         return 0;
1168 }
1169
1170 /**
1171  * verify_dfa_accept_index - verify accept indexes are in range of perms table
1172  * @dfa: the dfa to check accept indexes are in range
1173  * table_size: the permission table size the indexes should be within
1174  */
1175 static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size)
1176 {
1177         int i;
1178         for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1179                 if (ACCEPT_TABLE(dfa)[i] >= table_size)
1180                         return false;
1181         }
1182         return true;
1183 }
1184
1185 static bool verify_perm(struct aa_perms *perm)
1186 {
1187         /* TODO: allow option to just force the perms into a valid state */
1188         if (perm->allow & perm->deny)
1189                 return false;
1190         if (perm->subtree & ~perm->allow)
1191                 return false;
1192         if (perm->cond & (perm->allow | perm->deny))
1193                 return false;
1194         if (perm->kill & perm->allow)
1195                 return false;
1196         if (perm->complain & (perm->allow | perm->deny))
1197                 return false;
1198         if (perm->prompt & (perm->allow | perm->deny))
1199                 return false;
1200         if (perm->complain & perm->prompt)
1201                 return false;
1202         if (perm->hide & perm->allow)
1203                 return false;
1204
1205         return true;
1206 }
1207
1208 static bool verify_perms(struct aa_policydb *pdb)
1209 {
1210         int i;
1211
1212         for (i = 0; i < pdb->size; i++) {
1213                 if (!verify_perm(&pdb->perms[i]))
1214                         return false;
1215                 /* verify indexes into str table */
1216                 if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE &&
1217                     (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size)
1218                         return false;
1219                 if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size)
1220                         return false;
1221                 if (pdb->perms[i].label &&
1222                     pdb->perms[i].label >= pdb->trans.size)
1223                         return false;
1224         }
1225
1226         return true;
1227 }
1228
1229 /**
1230  * verify_profile - Do post unpack analysis to verify profile consistency
1231  * @profile: profile to verify (NOT NULL)
1232  *
1233  * Returns: 0 if passes verification else error
1234  *
1235  * This verification is post any unpack mapping or changes
1236  */
1237 static int verify_profile(struct aa_profile *profile)
1238 {
1239         struct aa_ruleset *rules = list_first_entry(&profile->rules,
1240                                                     typeof(*rules), list);
1241         if (!rules)
1242                 return 0;
1243
1244         if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa,
1245                                                          rules->file.size)) ||
1246             (rules->policy.dfa &&
1247              !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) {
1248                 audit_iface(profile, NULL, NULL,
1249                             "Unpack: Invalid named transition", NULL, -EPROTO);
1250                 return -EPROTO;
1251         }
1252
1253         if (!verify_perms(&rules->file)) {
1254                 audit_iface(profile, NULL, NULL,
1255                             "Unpack: Invalid perm index", NULL, -EPROTO);
1256                 return -EPROTO;
1257         }
1258         if (!verify_perms(&rules->policy)) {
1259                 audit_iface(profile, NULL, NULL,
1260                             "Unpack: Invalid perm index", NULL, -EPROTO);
1261                 return -EPROTO;
1262         }
1263         if (!verify_perms(&profile->attach.xmatch)) {
1264                 audit_iface(profile, NULL, NULL,
1265                             "Unpack: Invalid perm index", NULL, -EPROTO);
1266                 return -EPROTO;
1267         }
1268
1269         return 0;
1270 }
1271
1272 void aa_load_ent_free(struct aa_load_ent *ent)
1273 {
1274         if (ent) {
1275                 aa_put_profile(ent->rename);
1276                 aa_put_profile(ent->old);
1277                 aa_put_profile(ent->new);
1278                 kfree(ent->ns_name);
1279                 kfree_sensitive(ent);
1280         }
1281 }
1282
1283 struct aa_load_ent *aa_load_ent_alloc(void)
1284 {
1285         struct aa_load_ent *ent = kzalloc(sizeof(*ent), GFP_KERNEL);
1286         if (ent)
1287                 INIT_LIST_HEAD(&ent->list);
1288         return ent;
1289 }
1290
1291 static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1292 {
1293 #ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1294         const zstd_parameters params =
1295                 zstd_get_params(aa_g_rawdata_compression_level, slen);
1296         const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1297         void *wksp = NULL;
1298         zstd_cctx *ctx = NULL;
1299         size_t out_len = zstd_compress_bound(slen);
1300         void *out = NULL;
1301         int ret = 0;
1302
1303         out = kvzalloc(out_len, GFP_KERNEL);
1304         if (!out) {
1305                 ret = -ENOMEM;
1306                 goto cleanup;
1307         }
1308
1309         wksp = kvzalloc(wksp_len, GFP_KERNEL);
1310         if (!wksp) {
1311                 ret = -ENOMEM;
1312                 goto cleanup;
1313         }
1314
1315         ctx = zstd_init_cctx(wksp, wksp_len);
1316         if (!ctx) {
1317                 ret = -EINVAL;
1318                 goto cleanup;
1319         }
1320
1321         out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1322         if (zstd_is_error(out_len) || out_len >= slen) {
1323                 ret = -EINVAL;
1324                 goto cleanup;
1325         }
1326
1327         if (is_vmalloc_addr(out)) {
1328                 *dst = kvzalloc(out_len, GFP_KERNEL);
1329                 if (*dst) {
1330                         memcpy(*dst, out, out_len);
1331                         kvfree(out);
1332                         out = NULL;
1333                 }
1334         } else {
1335                 /*
1336                  * If the staging buffer was kmalloc'd, then using krealloc is
1337                  * probably going to be faster. The destination buffer will
1338                  * always be smaller, so it's just shrunk, avoiding a memcpy
1339                  */
1340                 *dst = krealloc(out, out_len, GFP_KERNEL);
1341         }
1342
1343         if (!*dst) {
1344                 ret = -ENOMEM;
1345                 goto cleanup;
1346         }
1347
1348         *dlen = out_len;
1349
1350 cleanup:
1351         if (ret) {
1352                 kvfree(out);
1353                 *dst = NULL;
1354         }
1355
1356         kvfree(wksp);
1357         return ret;
1358 #else
1359         *dlen = slen;
1360         return 0;
1361 #endif
1362 }
1363
1364 static int compress_loaddata(struct aa_loaddata *data)
1365 {
1366         AA_BUG(data->compressed_size > 0);
1367
1368         /*
1369          * Shortcut the no compression case, else we increase the amount of
1370          * storage required by a small amount
1371          */
1372         if (aa_g_rawdata_compression_level != 0) {
1373                 void *udata = data->data;
1374                 int error = compress_zstd(udata, data->size, &data->data,
1375                                           &data->compressed_size);
1376                 if (error) {
1377                         data->compressed_size = data->size;
1378                         return error;
1379                 }
1380                 if (udata != data->data)
1381                         kvfree(udata);
1382         } else
1383                 data->compressed_size = data->size;
1384
1385         return 0;
1386 }
1387
1388 /**
1389  * aa_unpack - unpack packed binary profile(s) data loaded from user space
1390  * @udata: user data copied to kmem  (NOT NULL)
1391  * @lh: list to place unpacked profiles in a aa_repl_ws
1392  * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1393  *
1394  * Unpack user data and return refcounted allocated profile(s) stored in
1395  * @lh in order of discovery, with the list chain stored in base.list
1396  * or error
1397  *
1398  * Returns: profile(s) on @lh else error pointer if fails to unpack
1399  */
1400 int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1401               const char **ns)
1402 {
1403         struct aa_load_ent *tmp, *ent;
1404         struct aa_profile *profile = NULL;
1405         char *ns_name = NULL;
1406         int error;
1407         struct aa_ext e = {
1408                 .start = udata->data,
1409                 .end = udata->data + udata->size,
1410                 .pos = udata->data,
1411         };
1412
1413         *ns = NULL;
1414         while (e.pos < e.end) {
1415                 void *start;
1416                 error = verify_header(&e, e.pos == e.start, ns);
1417                 if (error)
1418                         goto fail;
1419
1420                 start = e.pos;
1421                 profile = unpack_profile(&e, &ns_name);
1422                 if (IS_ERR(profile)) {
1423                         error = PTR_ERR(profile);
1424                         goto fail;
1425                 }
1426
1427                 error = verify_profile(profile);
1428                 if (error)
1429                         goto fail_profile;
1430
1431                 if (aa_g_hash_policy)
1432                         error = aa_calc_profile_hash(profile, e.version, start,
1433                                                      e.pos - start);
1434                 if (error)
1435                         goto fail_profile;
1436
1437                 ent = aa_load_ent_alloc();
1438                 if (!ent) {
1439                         error = -ENOMEM;
1440                         goto fail_profile;
1441                 }
1442
1443                 ent->new = profile;
1444                 ent->ns_name = ns_name;
1445                 ns_name = NULL;
1446                 list_add_tail(&ent->list, lh);
1447         }
1448         udata->abi = e.version & K_ABI_MASK;
1449         if (aa_g_hash_policy) {
1450                 udata->hash = aa_calc_hash(udata->data, udata->size);
1451                 if (IS_ERR(udata->hash)) {
1452                         error = PTR_ERR(udata->hash);
1453                         udata->hash = NULL;
1454                         goto fail;
1455                 }
1456         }
1457
1458         if (aa_g_export_binary) {
1459                 error = compress_loaddata(udata);
1460                 if (error)
1461                         goto fail;
1462         }
1463         return 0;
1464
1465 fail_profile:
1466         kfree(ns_name);
1467         aa_put_profile(profile);
1468
1469 fail:
1470         list_for_each_entry_safe(ent, tmp, lh, list) {
1471                 list_del_init(&ent->list);
1472                 aa_load_ent_free(ent);
1473         }
1474
1475         return error;
1476 }