projects/linux·blob master · refs

1821 lines · 43.6 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * AppArmor security module
4 *
5 * This file contains AppArmor functions for unpacking policy loaded from
6 * userspace.
7 *
8 * Copyright (C) 1998-2008 Novell/SUSE
9 * Copyright 2009-2010 Canonical Ltd.
10 *
11 * AppArmor uses a serialized binary format for loading policy. To find
12 * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst
13 * All policy is validated before it is used.
14 */
15
16#include <linux/unaligned.h>
17#include <kunit/visibility.h>
18#include <linux/ctype.h>
19#include <linux/errno.h>
20#include <linux/zstd.h>
21
22#include "include/apparmor.h"
23#include "include/audit.h"
24#include "include/cred.h"
25#include "include/crypto.h"
26#include "include/file.h"
27#include "include/match.h"
28#include "include/net.h"
29#include "include/path.h"
30#include "include/policy.h"
31#include "include/policy_unpack.h"
32#include "include/policy_compat.h"
33#include "include/signal.h"
34
35/* audit callback for unpack fields */
36static void audit_cb(struct audit_buffer *ab, void *va)
37{
38 struct common_audit_data *sa = va;
39 struct apparmor_audit_data *ad = aad(sa);
40
41 if (ad->iface.ns) {
42 audit_log_format(ab, " ns=");
43 audit_log_untrustedstring(ab, ad->iface.ns);
44 }
45 if (ad->name) {
46 audit_log_format(ab, " name=");
47 audit_log_untrustedstring(ab, ad->name);
48 }
49 if (ad->iface.pos)
50 audit_log_format(ab, " offset=%ld", ad->iface.pos);
51}
52
53/**
54 * audit_iface - do audit message for policy unpacking/load/replace/remove
55 * @new: profile if it has been allocated (MAYBE NULL)
56 * @ns_name: name of the ns the profile is to be loaded to (MAY BE NULL)
57 * @name: name of the profile being manipulated (MAYBE NULL)
58 * @info: any extra info about the failure (MAYBE NULL)
59 * @e: buffer position info
60 * @error: error code
61 *
62 * Returns: %0 or error
63 */
64static int audit_iface(struct aa_profile *new, const char *ns_name,
65 const char *name, const char *info, struct aa_ext *e,
66 int error)
67{
68 struct aa_profile *profile = labels_profile(aa_current_raw_label());
69 DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_NONE, AA_CLASS_NONE, NULL);
70 if (e)
71 ad.iface.pos = e->pos - e->start;
72 ad.iface.ns = ns_name;
73 if (new)
74 ad.name = new->base.hname;
75 else
76 ad.name = name;
77 ad.info = info;
78 ad.error = error;
79
80 return aa_audit(AUDIT_APPARMOR_STATUS, profile, &ad, audit_cb);
81}
82
83void __aa_loaddata_update(struct aa_loaddata *data, long revision)
84{
85 AA_BUG(!data);
86 AA_BUG(!data->ns);
87 AA_BUG(!mutex_is_locked(&data->ns->lock));
88 AA_BUG(data->revision > revision);
89
90 data->revision = revision;
91 if ((data->dents[AAFS_LOADDATA_REVISION])) {
92 struct inode *inode;
93
94 inode = d_inode(data->dents[AAFS_LOADDATA_DIR]);
95 inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
96
97 inode = d_inode(data->dents[AAFS_LOADDATA_REVISION]);
98 inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode));
99 }
100}
101
102bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r)
103{
104 if (l->size != r->size)
105 return false;
106 if (l->compressed_size != r->compressed_size)
107 return false;
108 if (aa_g_hash_policy && memcmp(l->hash, r->hash, aa_hash_size()) != 0)
109 return false;
110 return memcmp(l->data, r->data, r->compressed_size ?: r->size) == 0;
111}
112
113static void do_loaddata_free(struct aa_loaddata *d)
114{
115 kfree_sensitive(d->hash);
116 kfree_sensitive(d->name);
117 kvfree(d->data);
118 kfree_sensitive(d);
119}
120
121void aa_loaddata_kref(struct kref *kref)
122{
123 struct aa_loaddata *d = container_of(kref, struct aa_loaddata,
124 count.count);
125
126 do_loaddata_free(d);
127}
128
129/*
130 * need to take the ns mutex lock which is NOT safe most places that
131 * put_loaddata is called, so we have to delay freeing it
132 */
133static void do_ploaddata_rmfs(struct work_struct *work)
134{
135 struct aa_loaddata *d = container_of(work, struct aa_loaddata, work);
136 struct aa_ns *ns = aa_get_ns(d->ns);
137
138 if (ns) {
139 mutex_lock_nested(&ns->lock, ns->level);
140 /* remove fs ref to loaddata */
141 __aa_fs_remove_rawdata(d);
142 mutex_unlock(&ns->lock);
143 aa_put_ns(ns);
144 }
145 /* called by dropping last pcount, so drop its associated icount */
146 aa_put_i_loaddata(d);
147}
148
149void aa_ploaddata_kref(struct kref *kref)
150{
151 struct aa_loaddata *d = container_of(kref, struct aa_loaddata, pcount);
152
153 if (d) {
154 INIT_WORK(&d->work, do_ploaddata_rmfs);
155 schedule_work(&d->work);
156 }
157}
158
159struct aa_loaddata *aa_loaddata_alloc(size_t size)
160{
161 struct aa_loaddata *d;
162
163 d = kzalloc_obj(*d);
164 if (d == NULL)
165 return ERR_PTR(-ENOMEM);
166 d->data = kvzalloc(size, GFP_KERNEL);
167 if (!d->data) {
168 kfree(d);
169 return ERR_PTR(-ENOMEM);
170 }
171 kref_init(&d->count.count);
172 d->count.reftype = REF_RAWDATA;
173 kref_init(&d->pcount);
174 INIT_LIST_HEAD(&d->list);
175
176 return d;
177}
178
179/* test if read will be in packed data bounds */
180VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)
181{
182 return (size <= e->end - e->pos);
183}
184EXPORT_SYMBOL_IF_KUNIT(aa_inbounds);
185
186/**
187 * aa_unpack_u16_chunk - test and do bounds checking for a u16 size based chunk
188 * @e: serialized data read head (NOT NULL)
189 * @chunk: start address for chunk of data (NOT NULL)
190 *
191 * Returns: the size of chunk found with the read head at the end of the chunk.
192 */
193VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)
194{
195 size_t size = 0;
196 void *pos = e->pos;
197
198 if (!aa_inbounds(e, sizeof(u16)))
199 goto fail;
200 size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
201 e->pos += sizeof(__le16);
202 if (!aa_inbounds(e, size))
203 goto fail;
204 *chunk = e->pos;
205 e->pos += size;
206 return size;
207
208fail:
209 e->pos = pos;
210 return 0;
211}
212EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u16_chunk);
213
214/* unpack control byte */
215VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)
216{
217 if (!aa_inbounds(e, 1))
218 return false;
219 if (*(u8 *) e->pos != code)
220 return false;
221 e->pos++;
222 return true;
223}
224EXPORT_SYMBOL_IF_KUNIT(aa_unpack_X);
225
226/**
227 * aa_unpack_nameX - check is the next element is of type X with a name of @name
228 * @e: serialized data extent information (NOT NULL)
229 * @code: type code
230 * @name: name to match to the serialized element. (MAYBE NULL)
231 *
232 * check that the next serialized data element is of type X and has a tag
233 * name @name. If @name is specified then there must be a matching
234 * name element in the stream. If @name is NULL any name element will be
235 * skipped and only the typecode will be tested.
236 *
237 * Returns true on success (both type code and name tests match) and the read
238 * head is advanced past the headers
239 *
240 * Returns: false if either match fails, the read head does not move
241 */
242VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
243{
244 /*
245 * May need to reset pos if name or type doesn't match
246 */
247 void *pos = e->pos;
248 /*
249 * Check for presence of a tagname, and if present name size
250 * AA_NAME tag value is a u16.
251 */
252 if (aa_unpack_X(e, AA_NAME)) {
253 char *tag = NULL;
254 size_t size = aa_unpack_u16_chunk(e, &tag);
255 /* if a name is specified it must match. otherwise skip tag */
256 if (name && (!size || tag[size-1] != '\0' || strcmp(name, tag)))
257 goto fail;
258 } else if (name) {
259 /* if a name is specified and there is no name tag fail */
260 goto fail;
261 }
262
263 /* now check if type code matches */
264 if (aa_unpack_X(e, code))
265 return true;
266
267fail:
268 e->pos = pos;
269 return false;
270}
271EXPORT_SYMBOL_IF_KUNIT(aa_unpack_nameX);
272
273static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)
274{
275 void *pos = e->pos;
276
277 if (aa_unpack_nameX(e, AA_U8, name)) {
278 if (!aa_inbounds(e, sizeof(u8)))
279 goto fail;
280 if (data)
281 *data = *((u8 *)e->pos);
282 e->pos += sizeof(u8);
283 return true;
284 }
285
286fail:
287 e->pos = pos;
288 return false;
289}
290
291VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)
292{
293 void *pos = e->pos;
294
295 if (aa_unpack_nameX(e, AA_U32, name)) {
296 if (!aa_inbounds(e, sizeof(u32)))
297 goto fail;
298 if (data)
299 *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
300 e->pos += sizeof(u32);
301 return true;
302 }
303
304fail:
305 e->pos = pos;
306 return false;
307}
308EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u32);
309
310VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)
311{
312 void *pos = e->pos;
313
314 if (aa_unpack_nameX(e, AA_U64, name)) {
315 if (!aa_inbounds(e, sizeof(u64)))
316 goto fail;
317 if (data)
318 *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
319 e->pos += sizeof(u64);
320 return true;
321 }
322
323fail:
324 e->pos = pos;
325 return false;
326}
327EXPORT_SYMBOL_IF_KUNIT(aa_unpack_u64);
328
329static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
330{
331 u32 val;
332
333 if (!aa_unpack_u32(e, &val, name))
334 return false;
335 data->val = val;
336 return true;
337}
338
339static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
340{
341 u32 val;
342
343 if (!aa_unpack_u32(e, &val, name))
344 return false;
345 data->val = (u32)data->val | ((u64)val << 32);
346 return true;
347}
348
349VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)
350{
351 void *pos = e->pos;
352
353 if (aa_unpack_nameX(e, AA_ARRAY, name)) {
354 if (!aa_inbounds(e, sizeof(u16)))
355 goto fail;
356 *size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
357 e->pos += sizeof(u16);
358 return true;
359 }
360
361fail:
362 e->pos = pos;
363 return false;
364}
365EXPORT_SYMBOL_IF_KUNIT(aa_unpack_array);
366
367VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)
368{
369 void *pos = e->pos;
370
371 if (aa_unpack_nameX(e, AA_BLOB, name)) {
372 u32 size;
373 if (!aa_inbounds(e, sizeof(u32)))
374 goto fail;
375 size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
376 e->pos += sizeof(u32);
377 if (aa_inbounds(e, (size_t) size)) {
378 *blob = e->pos;
379 e->pos += size;
380 return size;
381 }
382 }
383
384fail:
385 e->pos = pos;
386 return 0;
387}
388EXPORT_SYMBOL_IF_KUNIT(aa_unpack_blob);
389
390VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)
391{
392 char *src_str;
393 size_t size = 0;
394 void *pos = e->pos;
395 *string = NULL;
396 if (aa_unpack_nameX(e, AA_STRING, name)) {
397 size = aa_unpack_u16_chunk(e, &src_str);
398 if (size) {
399 /* strings are null terminated, length is size - 1 */
400 if (src_str[size - 1] != 0)
401 goto fail;
402 *string = src_str;
403
404 return size;
405 }
406 }
407
408fail:
409 e->pos = pos;
410 return 0;
411}
412EXPORT_SYMBOL_IF_KUNIT(aa_unpack_str);
413
414VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)
415{
416 const char *tmp;
417 void *pos = e->pos;
418 int res = aa_unpack_str(e, &tmp, name);
419 *string = NULL;
420
421 if (!res)
422 return 0;
423
424 *string = kmemdup(tmp, res, GFP_KERNEL);
425 if (!*string) {
426 e->pos = pos;
427 return 0;
428 }
429
430 return res;
431}
432EXPORT_SYMBOL_IF_KUNIT(aa_unpack_strdup);
433
434
435/**
436 * unpack_dfa - unpack a file rule dfa
437 * @e: serialized data extent information (NOT NULL)
438 * @flags: dfa flags to check
439 *
440 * returns dfa or ERR_PTR or NULL if no dfa
441 */
442static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)
443{
444 char *blob = NULL;
445 size_t size;
446 struct aa_dfa *dfa = NULL;
447
448 size = aa_unpack_blob(e, &blob, "aadfa");
449 if (size) {
450 /*
451 * The dfa is aligned with in the blob to 8 bytes
452 * from the beginning of the stream.
453 * alignment adjust needed by dfa unpack
454 */
455 size_t sz = blob - (char *) e->start -
456 ((e->pos - e->start) & 7);
457 size_t pad = ALIGN(sz, 8) - sz;
458 if (aa_g_paranoid_load)
459 flags |= DFA_FLAG_VERIFY_STATES;
460 dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
461
462 if (IS_ERR(dfa))
463 return dfa;
464
465 }
466
467 return dfa;
468}
469
470static int process_strs_entry(char *str, int size, bool multi)
471{
472 int c = 1;
473
474 if (size <= 0)
475 return -1;
476 if (multi) {
477 if (size < 2)
478 return -2;
479 /* multi ends with double \0 */
480 if (str[size - 2])
481 return -3;
482 }
483
484 char *save = str;
485 char *pos = str;
486 char *end = multi ? str + size - 2 : str + size - 1;
487 /* count # of internal \0 */
488 while (str < end) {
489 if (str == pos) {
490 /* starts with ... */
491 if (!*str) {
492 AA_DEBUG(DEBUG_UNPACK,
493 "starting with null save=%lu size %d c=%d",
494 (unsigned long)(str - save), size, c);
495 return -4;
496 }
497 if (isspace(*str))
498 return -5;
499 if (*str == ':') {
500 /* :ns_str\0str\0
501 * first character after : must be valid
502 */
503 if (!str[1])
504 return -6;
505 }
506 } else if (!*str) {
507 if (*pos == ':')
508 *str = ':';
509 else
510 c++;
511 pos = str + 1;
512 }
513 str++;
514 } /* while */
515
516 return c;
517}
518
519/**
520 * unpack_strs_table - unpack a profile transition table
521 * @e: serialized data extent information (NOT NULL)
522 * @name: name of table (MAY BE NULL)
523 * @multi: allow multiple strings on a single entry
524 * @strs: str table to unpack to (NOT NULL)
525 *
526 * Returns: 0 if table successfully unpacked or not present, else error
527 */
528static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi,
529 struct aa_str_table *strs)
530{
531 void *saved_pos = e->pos;
532 struct aa_str_table_ent *table = NULL;
533 int error = -EPROTO;
534
535 /* exec table is optional */
536 if (aa_unpack_nameX(e, AA_STRUCT, name)) {
537 u16 size;
538 int i;
539
540 if (!aa_unpack_array(e, NULL, &size))
541 /*
542 * Note: index into trans table array is a max
543 * of 2^24, but unpack array can only unpack
544 * an array of 2^16 in size atm so no need
545 * for size check here
546 */
547 goto fail;
548 table = kzalloc_objs(struct aa_str_table_ent, size);
549 if (!table) {
550 error = -ENOMEM;
551 goto fail;
552 }
553 strs->table = table;
554 strs->size = size;
555 for (i = 0; i < size; i++) {
556 char *str;
557 int c, size2 = aa_unpack_strdup(e, &str, NULL);
558 /* aa_unpack_strdup verifies that the last character is
559 * null termination byte.
560 */
561 c = process_strs_entry(str, size2, multi);
562 if (c <= 0) {
563 AA_DEBUG(DEBUG_UNPACK, "process_strs %d i %d pos %ld",
564 c, i,
565 (unsigned long)(e->pos - saved_pos));
566 goto fail;
567 }
568 if (!multi && c > 1) {
569 AA_DEBUG(DEBUG_UNPACK, "!multi && c > 1");
570 /* fail - all other cases with embedded \0 */
571 goto fail;
572 }
573 table[i].strs = str;
574 table[i].count = c;
575 table[i].size = size2;
576 }
577 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
578 goto fail;
579 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
580 goto fail;
581 }
582 return 0;
583
584fail:
585 aa_destroy_str_table(strs);
586 e->pos = saved_pos;
587 return error;
588}
589
590static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
591{
592 void *pos = e->pos;
593
594 if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {
595 u16 size;
596 int i;
597
598 if (!aa_unpack_array(e, NULL, &size))
599 goto fail;
600 profile->attach.xattr_count = size;
601 profile->attach.xattrs = kcalloc(size, sizeof(char *), GFP_KERNEL);
602 if (!profile->attach.xattrs)
603 goto fail;
604 for (i = 0; i < size; i++) {
605 if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))
606 goto fail;
607 }
608 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
609 goto fail;
610 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
611 goto fail;
612 }
613
614 return true;
615
616fail:
617 e->pos = pos;
618 return false;
619}
620
621static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)
622{
623 void *pos = e->pos;
624 u16 size;
625 int i;
626
627 if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {
628 if (!aa_unpack_array(e, NULL, &size))
629 goto fail;
630
631 rules->secmark = kzalloc_objs(struct aa_secmark, size);
632 if (!rules->secmark)
633 goto fail;
634
635 rules->secmark_count = size;
636
637 for (i = 0; i < size; i++) {
638 if (!unpack_u8(e, &rules->secmark[i].audit, NULL))
639 goto fail;
640 if (!unpack_u8(e, &rules->secmark[i].deny, NULL))
641 goto fail;
642 if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))
643 goto fail;
644 }
645 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
646 goto fail;
647 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
648 goto fail;
649 }
650
651 return true;
652
653fail:
654 if (rules->secmark) {
655 for (i = 0; i < size; i++)
656 kfree_sensitive(rules->secmark[i].label);
657 kfree_sensitive(rules->secmark);
658 rules->secmark_count = 0;
659 rules->secmark = NULL;
660 }
661
662 e->pos = pos;
663 return false;
664}
665
666static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)
667{
668 void *pos = e->pos;
669
670 /* rlimits are optional */
671 if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {
672 u16 size;
673 int i;
674 u32 tmp = 0;
675 if (!aa_unpack_u32(e, &tmp, NULL))
676 goto fail;
677 rules->rlimits.mask = tmp;
678
679 if (!aa_unpack_array(e, NULL, &size) ||
680 size > RLIM_NLIMITS)
681 goto fail;
682 for (i = 0; i < size; i++) {
683 u64 tmp2 = 0;
684 int a = aa_map_resource(i);
685 if (!aa_unpack_u64(e, &tmp2, NULL))
686 goto fail;
687 rules->rlimits.limits[a].rlim_max = tmp2;
688 }
689 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
690 goto fail;
691 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
692 goto fail;
693 }
694 return true;
695
696fail:
697 e->pos = pos;
698 return false;
699}
700
701
702static bool verify_tags(struct aa_tags_struct *tags, const char **info)
703{
704 if ((tags->hdrs.size && !tags->hdrs.table) ||
705 (!tags->hdrs.size && tags->hdrs.table)) {
706 *info = "failed verification tag.hdrs disagree";
707 return false;
708 }
709 if ((tags->sets.size && !tags->sets.table) ||
710 (!tags->sets.size && tags->sets.table)) {
711 *info = "failed verification tag.sets disagree";
712 return false;
713 }
714 if ((tags->strs.size && !tags->strs.table) ||
715 (!tags->strs.size && tags->strs.table)) {
716 *info = "failed verification tags->strs disagree";
717 return false;
718 }
719 /* no data present */
720 if (!tags->sets.size && !tags->hdrs.size && !tags->strs.size) {
721 return true;
722 } else if (!(tags->sets.size && tags->hdrs.size && tags->strs.size)) {
723 /* some data present but not all */
724 *info = "failed verification tags partial data present";
725 return false;
726 }
727
728 u32 i;
729
730 for (i = 0; i < tags->sets.size; i++) {
731 /* count followed by count indexes into hdrs */
732 u32 cnt = tags->sets.table[i];
733
734 if ((u64)i + cnt >= tags->sets.size) {
735 AA_DEBUG(DEBUG_UNPACK,
736 "tagset too large %d+%d > sets.table[%d]",
737 i, cnt, tags->sets.size);
738 *info = "failed verification tagset too large";
739 return false;
740 }
741 for (; cnt; cnt--) {
742 if (tags->sets.table[++i] >= tags->hdrs.size) {
743 AA_DEBUG(DEBUG_UNPACK,
744 "tagsets idx out of bounds cnt %d sets.table[%d] >= %d",
745 cnt, i-1, tags->hdrs.size);
746 *info = "failed verification tagsets idx out of bounds";
747 return false;
748 }
749 }
750 }
751 for (i = 0; i < tags->hdrs.size; i++) {
752 u32 idx = tags->hdrs.table[i].tags;
753
754 if (idx >= tags->strs.size) {
755 AA_DEBUG(DEBUG_UNPACK,
756 "tag.hdrs idx oob idx %d > tags->strs.size=%d",
757 idx, tags->strs.size);
758 *info = "failed verification tags.hdrs idx out of bounds";
759 return false;
760 }
761 if (tags->hdrs.table[i].count != tags->strs.table[idx].count) {
762 AA_DEBUG(DEBUG_UNPACK, "hdrs.table[%d].count=%d != tags->strs.table[%d]=%d",
763 i, tags->hdrs.table[i].count, idx, tags->strs.table[idx].count);
764 *info = "failed verification tagd.hdrs[idx].count";
765 return false;
766 }
767 if (tags->hdrs.table[i].size != tags->strs.table[idx].size) {
768 AA_DEBUG(DEBUG_UNPACK, "hdrs.table[%d].size=%d != strs.table[%d].size=%d",
769 i, tags->hdrs.table[i].size, idx, tags->strs.table[idx].size);
770 *info = "failed verification tagd.hdrs[idx].size";
771 return false;
772 }
773 }
774
775 return true;
776}
777
778static int unpack_tagsets(struct aa_ext *e, struct aa_tags_struct *tags)
779{
780 u32 *sets;
781 u16 i, size;
782 int error = -EPROTO;
783 void *pos = e->pos;
784
785 if (!aa_unpack_array(e, "sets", &size))
786 goto fail_reset;
787 sets = kcalloc(size, sizeof(u32), GFP_KERNEL);
788 if (!sets) {
789 error = -ENOMEM;
790 goto fail_reset;
791 }
792 for (i = 0; i < size; i++) {
793 if (!aa_unpack_u32(e, &sets[i], NULL))
794 goto fail;
795 }
796 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
797 goto fail;
798
799 tags->sets.size = size;
800 tags->sets.table = sets;
801
802 return 0;
803
804fail:
805 kfree_sensitive(sets);
806fail_reset:
807 e->pos = pos;
808 return error;
809}
810
811static bool unpack_tag_header_ent(struct aa_ext *e, struct aa_tags_header *h)
812{
813 return aa_unpack_u32(e, &h->mask, NULL) &&
814 aa_unpack_u32(e, &h->count, NULL) &&
815 aa_unpack_u32(e, &h->size, NULL) &&
816 aa_unpack_u32(e, &h->tags, NULL);
817}
818
819static int unpack_tag_headers(struct aa_ext *e, struct aa_tags_struct *tags)
820{
821 struct aa_tags_header *hdrs;
822 u16 i, size;
823 int error = -EPROTO;
824 void *pos = e->pos;
825
826 if (!aa_unpack_array(e, "hdrs", &size))
827 goto fail_reset;
828 hdrs = kzalloc_objs(struct aa_tags_header, size);
829 if (!hdrs) {
830 error = -ENOMEM;
831 goto fail_reset;
832 }
833 for (i = 0; i < size; i++) {
834 if (!unpack_tag_header_ent(e, &hdrs[i]))
835 goto fail;
836 }
837 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
838 goto fail;
839
840 tags->hdrs.size = size;
841 tags->hdrs.table = hdrs;
842 AA_DEBUG(DEBUG_UNPACK, "headers %ld size %d", (long) hdrs, size);
843 return true;
844
845fail:
846 kfree_sensitive(hdrs);
847fail_reset:
848 e->pos = pos;
849 return error;
850}
851
852
853static int unpack_tags(struct aa_ext *e, struct aa_tags_struct *tags,
854 const char **info)
855{
856 int error = -EPROTO;
857 void *pos = e->pos;
858
859 AA_BUG(!tags);
860 /* policy tags are optional */
861 if (aa_unpack_nameX(e, AA_STRUCT, "tags")) {
862 u32 version;
863
864 if (!aa_unpack_u32(e, &version, "version") || version != 1) {
865 *info = "invalid tags version";
866 goto fail_reset;
867 }
868 error = unpack_strs_table(e, "strs", true, &tags->strs);
869 if (error) {
870 *info = "failed to unpack profile tag.strs";
871 goto fail;
872 }
873 error = unpack_tag_headers(e, tags);
874 if (error) {
875 *info = "failed to unpack profile tag.headers";
876 goto fail;
877 }
878 error = unpack_tagsets(e, tags);
879 if (error) {
880 *info = "failed to unpack profile tag.sets";
881 goto fail;
882 }
883 error = -EPROTO;
884 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
885 goto fail;
886
887 if (!verify_tags(tags, info))
888 goto fail;
889 }
890
891 return 0;
892
893fail:
894 aa_destroy_tags(tags);
895fail_reset:
896 e->pos = pos;
897 return error;
898}
899
900static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)
901{
902 u32 reserved;
903
904 if (version != 1)
905 return false;
906
907 /* reserved entry is for later expansion, discard for now */
908 return aa_unpack_u32(e, &reserved, NULL) &&
909 aa_unpack_u32(e, &perm->allow, NULL) &&
910 aa_unpack_u32(e, &perm->deny, NULL) &&
911 aa_unpack_u32(e, &perm->subtree, NULL) &&
912 aa_unpack_u32(e, &perm->cond, NULL) &&
913 aa_unpack_u32(e, &perm->kill, NULL) &&
914 aa_unpack_u32(e, &perm->complain, NULL) &&
915 aa_unpack_u32(e, &perm->prompt, NULL) &&
916 aa_unpack_u32(e, &perm->audit, NULL) &&
917 aa_unpack_u32(e, &perm->quiet, NULL) &&
918 aa_unpack_u32(e, &perm->hide, NULL) &&
919 aa_unpack_u32(e, &perm->xindex, NULL) &&
920 aa_unpack_u32(e, &perm->tag, NULL) &&
921 aa_unpack_u32(e, &perm->label, NULL);
922}
923
924static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)
925{
926 void *pos = e->pos;
927 u16 size = 0;
928
929 AA_BUG(!perms);
930 /*
931 * policy perms are optional, in which case perms are embedded
932 * in the dfa accept table
933 */
934 if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {
935 int i;
936 u32 version;
937
938 if (!aa_unpack_u32(e, &version, "version"))
939 goto fail_reset;
940 if (!aa_unpack_array(e, NULL, &size))
941 goto fail_reset;
942 *perms = kzalloc_objs(struct aa_perms, size);
943 if (!*perms) {
944 e->pos = pos;
945 return -ENOMEM;
946 }
947 for (i = 0; i < size; i++) {
948 if (!unpack_perm(e, version, &(*perms)[i]))
949 goto fail;
950 }
951 if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
952 goto fail;
953 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
954 goto fail;
955 } else
956 *perms = NULL;
957
958 return size;
959
960fail:
961 kfree(*perms);
962fail_reset:
963 e->pos = pos;
964 return -EPROTO;
965}
966
967static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy,
968 bool required_dfa, bool required_trans,
969 const char **info)
970{
971 struct aa_policydb *pdb;
972 void *pos = e->pos;
973 int i, flags, error = -EPROTO;
974 ssize_t size;
975 u32 version = 0;
976
977 pdb = aa_alloc_pdb(GFP_KERNEL);
978 if (!pdb)
979 return -ENOMEM;
980
981 AA_DEBUG(DEBUG_UNPACK, "unpacking tags");
982 if (unpack_tags(e, &pdb->tags, info) < 0)
983 goto fail;
984 AA_DEBUG(DEBUG_UNPACK, "done unpacking tags");
985
986 size = unpack_perms_table(e, &pdb->perms);
987 if (size < 0) {
988 error = size;
989 pdb->perms = NULL;
990 *info = "failed to unpack - perms";
991 goto fail;
992 }
993 pdb->size = size;
994
995 if (pdb->perms) {
996 /* perms table present accept is index */
997 flags = TO_ACCEPT1_FLAG(YYTD_DATA32);
998 if (aa_unpack_u32(e, &version, "permsv") && version > 2)
999 /* accept2 used for dfa flags */
1000 flags |= TO_ACCEPT2_FLAG(YYTD_DATA32);
1001 } else {
1002 /* packed perms in accept1 and accept2 */
1003 flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
1004 TO_ACCEPT2_FLAG(YYTD_DATA32);
1005 }
1006
1007 pdb->dfa = unpack_dfa(e, flags);
1008 if (IS_ERR(pdb->dfa)) {
1009 error = PTR_ERR(pdb->dfa);
1010 pdb->dfa = NULL;
1011 *info = "failed to unpack - dfa";
1012 goto fail;
1013 } else if (!pdb->dfa) {
1014 if (required_dfa) {
1015 *info = "missing required dfa";
1016 goto fail;
1017 }
1018 } else {
1019 /*
1020 * only unpack the following if a dfa is present
1021 *
1022 * sadly start was given different names for file and policydb
1023 * but since it is optional we can try both
1024 */
1025 if (!aa_unpack_u32(e, &pdb->start[0], "start"))
1026 /* default start state */
1027 pdb->start[0] = DFA_START;
1028 if (!aa_unpack_u32(e, &pdb->start[AA_CLASS_FILE], "dfa_start")) {
1029 /* default start state for xmatch and file dfa */
1030 pdb->start[AA_CLASS_FILE] = DFA_START;
1031 }
1032
1033 size_t state_count = pdb->dfa->tables[YYTD_ID_BASE]->td_lolen;
1034
1035 if (pdb->start[0] >= state_count ||
1036 pdb->start[AA_CLASS_FILE] >= state_count) {
1037 *info = "invalid dfa start state";
1038 goto fail;
1039 }
1040
1041 /* setup class index */
1042 for (i = AA_CLASS_FILE + 1; i <= AA_CLASS_LAST; i++) {
1043 pdb->start[i] = aa_dfa_next(pdb->dfa, pdb->start[0],
1044 i);
1045 }
1046 }
1047
1048 /* accept2 is in some cases being allocated, even with perms */
1049 if (pdb->dfa && pdb->perms && !pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
1050 /* add dfa flags table missing in v2 */
1051 u32 noents = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_lolen;
1052 u16 tdflags = pdb->dfa->tables[YYTD_ID_ACCEPT]->td_flags;
1053 size_t tsize = table_size(noents, tdflags);
1054
1055 pdb->dfa->tables[YYTD_ID_ACCEPT2] = kvzalloc(tsize, GFP_KERNEL);
1056 if (!pdb->dfa->tables[YYTD_ID_ACCEPT2]) {
1057 *info = "failed to alloc dfa flags table";
1058 error = -ENOMEM;
1059 goto fail;
1060 }
1061 pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_lolen = noents;
1062 pdb->dfa->tables[YYTD_ID_ACCEPT2]->td_flags = tdflags;
1063 }
1064 /*
1065 * Unfortunately due to a bug in earlier userspaces, a
1066 * transition table may be present even when the dfa is
1067 * not. For compatibility reasons unpack and discard.
1068 */
1069 error = unpack_strs_table(e, "xtable", false, &pdb->trans);
1070 if (error && required_trans) {
1071 *info = "failed to unpack profile transition table";
1072 goto fail;
1073 }
1074
1075 if (!pdb->dfa && pdb->trans.table)
1076 aa_destroy_str_table(&pdb->trans);
1077
1078 /* TODO:
1079 * - move compat mapping here, requires dfa merging first
1080 * - move verify here, it has to be done after compat mappings
1081 * - move free of unneeded trans table here, has to be done
1082 * after perm mapping.
1083 */
1084 *policy = pdb;
1085 return 0;
1086
1087fail:
1088 aa_put_pdb(pdb);
1089 e->pos = pos;
1090 return error;
1091}
1092
1093static u32 strhash(const void *data, u32 len, u32 seed)
1094{
1095 const char * const *key = data;
1096
1097 return jhash(*key, strlen(*key), seed);
1098}
1099
1100static int datacmp(struct rhashtable_compare_arg *arg, const void *obj)
1101{
1102 const struct aa_data *data = obj;
1103 const char * const *key = arg->key;
1104
1105 return strcmp(data->key, *key);
1106}
1107
1108/**
1109 * unpack_profile - unpack a serialized profile
1110 * @e: serialized data extent information (NOT NULL)
1111 * @ns_name: pointer of newly allocated copy of %NULL in case of error
1112 *
1113 * NOTE: unpack profile sets audit struct if there is a failure
1114 */
1115static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
1116{
1117 struct aa_ruleset *rules;
1118 struct aa_profile *profile = NULL;
1119 const char *tmpname, *tmpns = NULL, *name = NULL;
1120 const char *info = "failed to unpack profile";
1121 size_t ns_len;
1122 struct rhashtable_params params = { 0 };
1123 char *key = NULL, *disconnected = NULL;
1124 struct aa_data *data;
1125 int error = -EPROTO;
1126 kernel_cap_t tmpcap;
1127 u32 tmp;
1128
1129 *ns_name = NULL;
1130
1131 /* check that we have the right struct being passed */
1132 if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))
1133 goto fail;
1134 if (!aa_unpack_str(e, &name, NULL))
1135 goto fail;
1136 if (*name == '\0')
1137 goto fail;
1138
1139 tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
1140 if (tmpns) {
1141 if (!tmpname) {
1142 info = "empty profile name";
1143 goto fail;
1144 }
1145 *ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
1146 if (!*ns_name) {
1147 info = "out of memory";
1148 error = -ENOMEM;
1149 goto fail;
1150 }
1151 name = tmpname;
1152 }
1153
1154 profile = aa_alloc_profile(name, NULL, GFP_KERNEL);
1155 if (!profile) {
1156 info = "out of memory";
1157 error = -ENOMEM;
1158 goto fail;
1159 }
1160 rules = profile->label.rules[0];
1161
1162 /* profile renaming is optional */
1163 (void) aa_unpack_str(e, &profile->rename, "rename");
1164
1165 /* attachment string is optional */
1166 (void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");
1167
1168 /* xmatch is optional and may be NULL */
1169 error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);
1170 if (error) {
1171 info = "bad xmatch";
1172 goto fail;
1173 }
1174
1175 /* neither xmatch_len not xmatch_perms are optional if xmatch is set */
1176 if (profile->attach.xmatch->dfa) {
1177 if (!aa_unpack_u32(e, &tmp, NULL)) {
1178 info = "missing xmatch len";
1179 goto fail;
1180 }
1181 profile->attach.xmatch_len = tmp;
1182 profile->attach.xmatch->start[AA_CLASS_XMATCH] = DFA_START;
1183 if (!profile->attach.xmatch->perms) {
1184 error = aa_compat_map_xmatch(profile->attach.xmatch);
1185 if (error) {
1186 info = "failed to convert xmatch permission table";
1187 goto fail;
1188 }
1189 }
1190 }
1191
1192 /* disconnected attachment string is optional */
1193 (void) aa_unpack_strdup(e, &disconnected, "disconnected");
1194 profile->disconnected = disconnected;
1195
1196 /* optional */
1197 (void) aa_unpack_u32(e, &profile->signal, "kill");
1198 if (profile->signal < 1 || profile->signal > MAXMAPPED_SIG) {
1199 info = "profile kill.signal invalid value";
1200 goto fail;
1201 }
1202 /* per profile debug flags (complain, audit) */
1203 if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
1204 info = "profile missing flags";
1205 goto fail;
1206 }
1207 info = "failed to unpack profile flags";
1208 if (!aa_unpack_u32(e, &tmp, NULL))
1209 goto fail;
1210 if (tmp & PACKED_FLAG_HAT)
1211 profile->label.flags |= FLAG_HAT;
1212 if (tmp & PACKED_FLAG_DEBUG1)
1213 profile->label.flags |= FLAG_DEBUG1;
1214 if (tmp & PACKED_FLAG_DEBUG2)
1215 profile->label.flags |= FLAG_DEBUG2;
1216 if (!aa_unpack_u32(e, &tmp, NULL))
1217 goto fail;
1218 if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
1219 profile->mode = APPARMOR_COMPLAIN;
1220 } else if (tmp == PACKED_MODE_ENFORCE) {
1221 profile->mode = APPARMOR_ENFORCE;
1222 } else if (tmp == PACKED_MODE_KILL) {
1223 profile->mode = APPARMOR_KILL;
1224 } else if (tmp == PACKED_MODE_UNCONFINED) {
1225 profile->mode = APPARMOR_UNCONFINED;
1226 profile->label.flags |= FLAG_UNCONFINED;
1227 } else if (tmp == PACKED_MODE_USER) {
1228 profile->mode = APPARMOR_USER;
1229 } else {
1230 goto fail;
1231 }
1232 if (!aa_unpack_u32(e, &tmp, NULL))
1233 goto fail;
1234 if (tmp)
1235 profile->audit = AUDIT_ALL;
1236
1237 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
1238 goto fail;
1239
1240 /* path_flags is optional */
1241 if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))
1242 profile->path_flags |= profile->label.flags &
1243 PATH_MEDIATE_DELETED;
1244 else
1245 /* set a default value if path_flags field is not present */
1246 profile->path_flags = PATH_MEDIATE_DELETED;
1247
1248 info = "failed to unpack profile capabilities";
1249 if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))
1250 goto fail;
1251 if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))
1252 goto fail;
1253 if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))
1254 goto fail;
1255 if (!aa_unpack_cap_low(e, &tmpcap, NULL))
1256 goto fail;
1257
1258 info = "failed to unpack upper profile capabilities";
1259 if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {
1260 /* optional upper half of 64 bit caps */
1261 if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))
1262 goto fail;
1263 if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))
1264 goto fail;
1265 if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))
1266 goto fail;
1267 if (!aa_unpack_cap_high(e, &tmpcap, NULL))
1268 goto fail;
1269 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
1270 goto fail;
1271 }
1272
1273 info = "failed to unpack extended profile capabilities";
1274 if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {
1275 /* optional extended caps mediation mask */
1276 if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))
1277 goto fail;
1278 if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))
1279 goto fail;
1280 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
1281 goto fail;
1282 }
1283
1284 if (!unpack_xattrs(e, profile)) {
1285 info = "failed to unpack profile xattrs";
1286 goto fail;
1287 }
1288
1289 if (!unpack_rlimits(e, rules)) {
1290 info = "failed to unpack profile rlimits";
1291 goto fail;
1292 }
1293
1294 if (!unpack_secmark(e, rules)) {
1295 info = "failed to unpack profile secmark rules";
1296 goto fail;
1297 }
1298
1299 if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {
1300 /* generic policy dfa - optional and may be NULL */
1301 info = "failed to unpack policydb";
1302 error = unpack_pdb(e, &rules->policy, true, false,
1303 &info);
1304 if (error)
1305 goto fail;
1306 /* Fixup: drop when we get rid of start array */
1307 if (aa_dfa_next(rules->policy->dfa, rules->policy->start[0],
1308 AA_CLASS_FILE))
1309 rules->policy->start[AA_CLASS_FILE] =
1310 aa_dfa_next(rules->policy->dfa,
1311 rules->policy->start[0],
1312 AA_CLASS_FILE);
1313 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
1314 goto fail;
1315 if (!rules->policy->perms) {
1316 error = aa_compat_map_policy(rules->policy,
1317 e->version);
1318 if (error) {
1319 info = "failed to remap policydb permission table";
1320 goto fail;
1321 }
1322 }
1323 } else {
1324 rules->policy = aa_get_pdb(nullpdb);
1325 }
1326 /* get file rules */
1327 error = unpack_pdb(e, &rules->file, false, true, &info);
1328 if (error) {
1329 goto fail;
1330 } else if (rules->file->dfa) {
1331 if (!rules->file->perms) {
1332 AA_DEBUG(DEBUG_UNPACK, "compat mapping perms");
1333 error = aa_compat_map_file(rules->file);
1334 if (error) {
1335 info = "failed to remap file permission table";
1336 goto fail;
1337 }
1338 }
1339 } else if (rules->policy->dfa &&
1340 rules->policy->start[AA_CLASS_FILE]) {
1341 aa_put_pdb(rules->file);
1342 rules->file = aa_get_pdb(rules->policy);
1343 } else {
1344 aa_put_pdb(rules->file);
1345 rules->file = aa_get_pdb(nullpdb);
1346 }
1347 error = -EPROTO;
1348 if (aa_unpack_nameX(e, AA_STRUCT, "data")) {
1349 info = "out of memory";
1350 profile->data = kzalloc_obj(*profile->data);
1351 if (!profile->data) {
1352 error = -ENOMEM;
1353 goto fail;
1354 }
1355 params.nelem_hint = 3;
1356 params.key_len = sizeof(void *);
1357 params.key_offset = offsetof(struct aa_data, key);
1358 params.head_offset = offsetof(struct aa_data, head);
1359 params.hashfn = strhash;
1360 params.obj_cmpfn = datacmp;
1361
1362 if (rhashtable_init(profile->data, &params)) {
1363 info = "failed to init key, value hash table";
1364 goto fail;
1365 }
1366
1367 while (aa_unpack_strdup(e, &key, NULL)) {
1368 data = kzalloc_obj(*data);
1369 if (!data) {
1370 kfree_sensitive(key);
1371 error = -ENOMEM;
1372 goto fail;
1373 }
1374
1375 data->key = key;
1376 data->size = aa_unpack_blob(e, &data->data, NULL);
1377 data->data = kvmemdup(data->data, data->size, GFP_KERNEL);
1378 if (data->size && !data->data) {
1379 kfree_sensitive(data->key);
1380 kfree_sensitive(data);
1381 error = -ENOMEM;
1382 goto fail;
1383 }
1384
1385 if (rhashtable_insert_fast(profile->data, &data->head,
1386 profile->data->p)) {
1387 kvfree_sensitive(data->data, data->size);
1388 kfree_sensitive(data->key);
1389 kfree_sensitive(data);
1390 info = "failed to insert data to table";
1391 goto fail;
1392 }
1393 }
1394
1395 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1396 info = "failed to unpack end of key, value data table";
1397 goto fail;
1398 }
1399 }
1400
1401 if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {
1402 info = "failed to unpack end of profile";
1403 goto fail;
1404 }
1405
1406 aa_compute_profile_mediates(profile);
1407
1408 return profile;
1409
1410fail:
1411 if (error == 0)
1412 /* default error covers most cases */
1413 error = -EPROTO;
1414 if (*ns_name) {
1415 kfree(*ns_name);
1416 *ns_name = NULL;
1417 }
1418 if (profile)
1419 name = NULL;
1420 else if (!name)
1421 name = "unknown";
1422 audit_iface(profile, NULL, name, info, e, error);
1423 aa_free_profile(profile);
1424
1425 return ERR_PTR(error);
1426}
1427
1428/**
1429 * verify_header - unpack serialized stream header
1430 * @e: serialized data read head (NOT NULL)
1431 * @required: whether the header is required or optional
1432 * @ns: Returns - namespace if one is specified else NULL (NOT NULL)
1433 *
1434 * Returns: error or 0 if header is good
1435 */
1436static int verify_header(struct aa_ext *e, int required, const char **ns)
1437{
1438 int error = -EPROTONOSUPPORT;
1439 const char *name = NULL;
1440
1441 /* get the interface version */
1442 if (!aa_unpack_u32(e, &e->version, "version")) {
1443 if (required) {
1444 audit_iface(NULL, NULL, NULL, "invalid profile format",
1445 e, error);
1446 return error;
1447 }
1448 }
1449
1450 /* Check that the interface version is currently supported.
1451 * if not specified use previous version
1452 * Mask off everything that is not kernel abi version
1453 */
1454 if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {
1455 audit_iface(NULL, NULL, NULL, "unsupported interface version",
1456 e, error);
1457 return error;
1458 }
1459
1460 /* read the namespace if present */
1461 if (aa_unpack_str(e, &name, "namespace")) {
1462 if (*name == '\0') {
1463 audit_iface(NULL, NULL, NULL, "invalid namespace name",
1464 e, error);
1465 return error;
1466 }
1467 if (*ns && strcmp(*ns, name)) {
1468 audit_iface(NULL, NULL, NULL, "invalid ns change", e,
1469 error);
1470 return error;
1471 } else if (!*ns) {
1472 *ns = kstrdup(name, GFP_KERNEL);
1473 if (!*ns)
1474 return -ENOMEM;
1475 }
1476 }
1477
1478 return 0;
1479}
1480
1481/**
1482 * verify_dfa_accept_index - verify accept indexes are in range of perms table
1483 * @dfa: the dfa to check accept indexes are in range
1484 * @table_size: the permission table size the indexes should be within
1485 */
1486static bool verify_dfa_accept_index(const struct aa_dfa *dfa, int table_size)
1487{
1488 int i;
1489 for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
1490 if (ACCEPT_TABLE(dfa)[i] >= table_size)
1491 return false;
1492 }
1493 return true;
1494}
1495
1496static bool verify_perm(const struct aa_perms *perm)
1497{
1498 /* TODO: allow option to just force the perms into a valid state */
1499 if (perm->allow & perm->deny)
1500 return false;
1501 if (perm->subtree & ~perm->allow)
1502 return false;
1503 if (perm->cond & (perm->allow | perm->deny))
1504 return false;
1505 if (perm->kill & perm->allow)
1506 return false;
1507 if (perm->complain & (perm->allow | perm->deny))
1508 return false;
1509 if (perm->prompt & (perm->allow | perm->deny))
1510 return false;
1511 if (perm->complain & perm->prompt)
1512 return false;
1513 if (perm->hide & perm->allow)
1514 return false;
1515
1516 return true;
1517}
1518
1519static bool verify_perms(struct aa_policydb *pdb)
1520{
1521 int i;
1522 int xidx, xmax = -1;
1523
1524 for (i = 0; i < pdb->size; i++) {
1525 if (!verify_perm(&pdb->perms[i]))
1526 return false;
1527 /* verify indexes into str table */
1528 if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE) {
1529 xidx = pdb->perms[i].xindex & AA_X_INDEX_MASK;
1530 if (xidx >= pdb->trans.size)
1531 return false;
1532 if (xmax < xidx)
1533 xmax = xidx;
1534 }
1535 if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->tags.sets.size)
1536 return false;
1537 if (pdb->perms[i].label &&
1538 pdb->perms[i].label >= pdb->trans.size)
1539 return false;
1540 }
1541 /* deal with incorrectly constructed string tables */
1542 if (xmax == -1) {
1543 aa_destroy_str_table(&pdb->trans);
1544 } else if (pdb->trans.size > xmax + 1) {
1545 if (!aa_resize_str_table(&pdb->trans, xmax + 1, GFP_KERNEL))
1546 return false;
1547 }
1548 return true;
1549}
1550
1551/**
1552 * verify_profile - Do post unpack analysis to verify profile consistency
1553 * @profile: profile to verify (NOT NULL)
1554 *
1555 * Returns: 0 if passes verification else error
1556 *
1557 * This verification is post any unpack mapping or changes
1558 */
1559static int verify_profile(struct aa_profile *profile)
1560{
1561 struct aa_ruleset *rules = profile->label.rules[0];
1562
1563 if (!rules)
1564 return 0;
1565
1566 if (rules->file->dfa && !verify_dfa_accept_index(rules->file->dfa,
1567 rules->file->size)) {
1568 audit_iface(profile, NULL, NULL,
1569 "Unpack: file Invalid named transition", NULL,
1570 -EPROTO);
1571 return -EPROTO;
1572 }
1573 if (rules->policy->dfa &&
1574 !verify_dfa_accept_index(rules->policy->dfa, rules->policy->size)) {
1575 audit_iface(profile, NULL, NULL,
1576 "Unpack: policy Invalid named transition", NULL,
1577 -EPROTO);
1578 return -EPROTO;
1579 }
1580
1581 if (!verify_perms(rules->file)) {
1582 audit_iface(profile, NULL, NULL,
1583 "Unpack: Invalid perm index", NULL, -EPROTO);
1584 return -EPROTO;
1585 }
1586 if (!verify_perms(rules->policy)) {
1587 audit_iface(profile, NULL, NULL,
1588 "Unpack: Invalid perm index", NULL, -EPROTO);
1589 return -EPROTO;
1590 }
1591 if (!verify_perms(profile->attach.xmatch)) {
1592 audit_iface(profile, NULL, NULL,
1593 "Unpack: Invalid perm index", NULL, -EPROTO);
1594 return -EPROTO;
1595 }
1596
1597 return 0;
1598}
1599
1600void aa_load_ent_free(struct aa_load_ent *ent)
1601{
1602 if (ent) {
1603 aa_put_profile(ent->rename);
1604 aa_put_profile(ent->old);
1605 aa_put_profile(ent->new);
1606 kfree(ent->ns_name);
1607 kfree_sensitive(ent);
1608 }
1609}
1610
1611struct aa_load_ent *aa_load_ent_alloc(void)
1612{
1613 struct aa_load_ent *ent = kzalloc_obj(*ent);
1614 if (ent)
1615 INIT_LIST_HEAD(&ent->list);
1616 return ent;
1617}
1618
1619static int compress_zstd(const char *src, size_t slen, char **dst, size_t *dlen)
1620{
1621#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY
1622 const zstd_parameters params =
1623 zstd_get_params(aa_g_rawdata_compression_level, slen);
1624 const size_t wksp_len = zstd_cctx_workspace_bound(&params.cParams);
1625 void *wksp = NULL;
1626 zstd_cctx *ctx = NULL;
1627 size_t out_len = zstd_compress_bound(slen);
1628 void *out = NULL;
1629 int ret = 0;
1630
1631 out = kvzalloc(out_len, GFP_KERNEL);
1632 if (!out) {
1633 ret = -ENOMEM;
1634 goto cleanup;
1635 }
1636
1637 wksp = kvzalloc(wksp_len, GFP_KERNEL);
1638 if (!wksp) {
1639 ret = -ENOMEM;
1640 goto cleanup;
1641 }
1642
1643 ctx = zstd_init_cctx(wksp, wksp_len);
1644 if (!ctx) {
1645 ret = -EINVAL;
1646 goto cleanup;
1647 }
1648
1649 out_len = zstd_compress_cctx(ctx, out, out_len, src, slen, &params);
1650 if (zstd_is_error(out_len) || out_len >= slen) {
1651 ret = -EINVAL;
1652 goto cleanup;
1653 }
1654
1655 if (is_vmalloc_addr(out)) {
1656 *dst = kvzalloc(out_len, GFP_KERNEL);
1657 if (*dst) {
1658 memcpy(*dst, out, out_len);
1659 kvfree(out);
1660 out = NULL;
1661 }
1662 } else {
1663 /*
1664 * If the staging buffer was kmalloc'd, then using krealloc is
1665 * probably going to be faster. The destination buffer will
1666 * always be smaller, so it's just shrunk, avoiding a memcpy
1667 */
1668 *dst = krealloc(out, out_len, GFP_KERNEL);
1669 }
1670
1671 if (!*dst) {
1672 ret = -ENOMEM;
1673 goto cleanup;
1674 }
1675
1676 *dlen = out_len;
1677
1678cleanup:
1679 if (ret) {
1680 kvfree(out);
1681 *dst = NULL;
1682 }
1683
1684 kvfree(wksp);
1685 return ret;
1686#else
1687 *dlen = slen;
1688 return 0;
1689#endif
1690}
1691
1692static int compress_loaddata(struct aa_loaddata *data)
1693{
1694 AA_BUG(data->compressed_size > 0);
1695
1696 /*
1697 * Shortcut the no compression case, else we increase the amount of
1698 * storage required by a small amount
1699 */
1700 if (aa_g_rawdata_compression_level != 0) {
1701 void *udata = data->data;
1702 int error = compress_zstd(udata, data->size, &data->data,
1703 &data->compressed_size);
1704 if (error) {
1705 data->compressed_size = data->size;
1706 return error;
1707 }
1708 if (udata != data->data)
1709 kvfree(udata);
1710 } else
1711 data->compressed_size = data->size;
1712
1713 return 0;
1714}
1715
1716/**
1717 * aa_unpack - unpack packed binary profile(s) data loaded from user space
1718 * @udata: user data copied to kmem (NOT NULL)
1719 * @lh: list to place unpacked profiles in a aa_repl_ws
1720 * @ns: Returns namespace profile is in if specified else NULL (NOT NULL)
1721 * @compressed_data: The userspace-provided compressed data. May be NULL
1722 * @compressed_size: If compressed_data is not NULL, the compressed data size
1723 *
1724 * Unpack user data and return refcounted allocated profile(s) stored in
1725 * @lh in order of discovery, with the list chain stored in base.list
1726 * or error
1727 *
1728 * Returns: profile(s) on @lh else error pointer if fails to unpack
1729 */
1730int aa_unpack(struct aa_loaddata *udata, struct list_head *lh,
1731 const char **ns, char *compressed_data, size_t compressed_size)
1732{
1733 struct aa_load_ent *tmp, *ent;
1734 struct aa_profile *profile = NULL;
1735 char *ns_name = NULL;
1736 int error = 0;
1737 struct aa_ext e = {
1738 .start = udata->data,
1739 .end = udata->data + udata->size,
1740 .pos = udata->data,
1741 };
1742
1743 *ns = NULL;
1744 while (e.pos < e.end) {
1745 void *start;
1746 error = verify_header(&e, e.pos == e.start, ns);
1747 if (error)
1748 goto fail;
1749
1750 start = e.pos;
1751 profile = unpack_profile(&e, &ns_name);
1752 if (IS_ERR(profile)) {
1753 error = PTR_ERR(profile);
1754 goto fail;
1755 }
1756
1757 error = verify_profile(profile);
1758 if (error)
1759 goto fail_profile;
1760
1761 if (aa_g_hash_policy)
1762 error = aa_calc_profile_hash(profile, e.version, start,
1763 e.pos - start);
1764 if (error)
1765 goto fail_profile;
1766
1767 ent = aa_load_ent_alloc();
1768 if (!ent) {
1769 error = -ENOMEM;
1770 goto fail_profile;
1771 }
1772
1773 ent->new = profile;
1774 ent->ns_name = ns_name;
1775 ns_name = NULL;
1776 list_add_tail(&ent->list, lh);
1777 }
1778 udata->abi = e.version & K_ABI_MASK;
1779 if (aa_g_hash_policy) {
1780 udata->hash = aa_calc_hash(udata->data, udata->size);
1781 if (IS_ERR(udata->hash)) {
1782 error = PTR_ERR(udata->hash);
1783 udata->hash = NULL;
1784 goto fail;
1785 }
1786 }
1787
1788 if (aa_g_export_binary) {
1789 /* Do we have userspace-compressed data? */
1790 if (compressed_data) {
1791 kvfree(udata->data);
1792 udata->data = compressed_data;
1793 udata->compressed_size = compressed_size;
1794 compressed_data = NULL; /* consumed */
1795
1796 } else
1797 error = compress_loaddata(udata);
1798
1799 if (error)
1800 goto fail;
1801 } else if (compressed_data) {
1802 kvfree(compressed_data);
1803 compressed_data = NULL;
1804 }
1805
1806 return 0;
1807
1808fail_profile:
1809 kfree(ns_name);
1810 aa_put_profile(profile);
1811
1812fail:
1813 if (compressed_data)
1814 kvfree(compressed_data);
1815 list_for_each_entry_safe(ent, tmp, lh, list) {
1816 list_del_init(&ent->list);
1817 aa_load_ent_free(ent);
1818 }
1819
1820 return error;
1821}