58  * @e: buffer position info
64 		       const char *name, const char *info, struct aa_ext *e,  in audit_iface()  argument
69 	if (e)  in audit_iface()
70 		ad.iface.pos = e->pos - e->start;  in audit_iface()
163 VISIBLE_IF_KUNIT bool aa_inbounds(struct aa_ext *e, size_t size)  in aa_inbounds()  argument
165 	return (size <= e->end - e->pos);  in aa_inbounds()
171  * @e: serialized data read head (NOT NULL)
176 VISIBLE_IF_KUNIT size_t aa_unpack_u16_chunk(struct aa_ext *e, char **chunk)  in aa_unpack_u16_chunk()  argument
179 	void *pos = e->pos;  in aa_unpack_u16_chunk()
181 	if (!aa_inbounds(e, sizeof(u16)))  in aa_unpack_u16_chunk()
183 	size = le16_to_cpu(get_unaligned((__le16 *) e->pos));  in aa_unpack_u16_chunk()
184 	e->pos += sizeof(__le16);  in aa_unpack_u16_chunk()
185 	if (!aa_inbounds(e, size))  in aa_unpack_u16_chunk()
187 	*chunk = e->pos;  in aa_unpack_u16_chunk()
188 	e->pos += size;  in aa_unpack_u16_chunk()
192 	e->pos = pos;  in aa_unpack_u16_chunk()
198 VISIBLE_IF_KUNIT bool aa_unpack_X(struct aa_ext *e, enum aa_code code)  in aa_unpack_X()  argument
200 	if (!aa_inbounds(e, 1))  in aa_unpack_X()
202 	if (*(u8 *) e->pos != code)  in aa_unpack_X()
204 	e->pos++;  in aa_unpack_X()
211  * @e: serialized data extent information  (NOT NULL)
225 VISIBLE_IF_KUNIT bool aa_unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)  in aa_unpack_nameX()  argument
230 	void *pos = e->pos;  in aa_unpack_nameX()
235 	if (aa_unpack_X(e, AA_NAME)) {  in aa_unpack_nameX()
237 		size_t size = aa_unpack_u16_chunk(e, &tag);  in aa_unpack_nameX()
247 	if (aa_unpack_X(e, code))  in aa_unpack_nameX()
251 	e->pos = pos;  in aa_unpack_nameX()
256 static bool unpack_u8(struct aa_ext *e, u8 *data, const char *name)  in unpack_u8()  argument
258 	void *pos = e->pos;  in unpack_u8()
260 	if (aa_unpack_nameX(e, AA_U8, name)) {  in unpack_u8()
261 		if (!aa_inbounds(e, sizeof(u8)))  in unpack_u8()
264 			*data = *((u8 *)e->pos);  in unpack_u8()
265 		e->pos += sizeof(u8);  in unpack_u8()
270 	e->pos = pos;  in unpack_u8()
274 VISIBLE_IF_KUNIT bool aa_unpack_u32(struct aa_ext *e, u32 *data, const char *name)  in aa_unpack_u32()  argument
276 	void *pos = e->pos;  in aa_unpack_u32()
278 	if (aa_unpack_nameX(e, AA_U32, name)) {  in aa_unpack_u32()
279 		if (!aa_inbounds(e, sizeof(u32)))  in aa_unpack_u32()
282 			*data = le32_to_cpu(get_unaligned((__le32 *) e->pos));  in aa_unpack_u32()
283 		e->pos += sizeof(u32);  in aa_unpack_u32()
288 	e->pos = pos;  in aa_unpack_u32()
293 VISIBLE_IF_KUNIT bool aa_unpack_u64(struct aa_ext *e, u64 *data, const char *name)  in aa_unpack_u64()  argument
295 	void *pos = e->pos;  in aa_unpack_u64()
297 	if (aa_unpack_nameX(e, AA_U64, name)) {  in aa_unpack_u64()
298 		if (!aa_inbounds(e, sizeof(u64)))  in aa_unpack_u64()
301 			*data = le64_to_cpu(get_unaligned((__le64 *) e->pos));  in aa_unpack_u64()
302 		e->pos += sizeof(u64);  in aa_unpack_u64()
307 	e->pos = pos;  in aa_unpack_u64()
312 static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)  in aa_unpack_cap_low()  argument
316 	if (!aa_unpack_u32(e, &val, name))  in aa_unpack_cap_low()
322 static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)  in aa_unpack_cap_high()  argument
326 	if (!aa_unpack_u32(e, &val, name))  in aa_unpack_cap_high()
332 VISIBLE_IF_KUNIT bool aa_unpack_array(struct aa_ext *e, const char *name, u16 *size)  in aa_unpack_array()  argument
334 	void *pos = e->pos;  in aa_unpack_array()
336 	if (aa_unpack_nameX(e, AA_ARRAY, name)) {  in aa_unpack_array()
337 		if (!aa_inbounds(e, sizeof(u16)))  in aa_unpack_array()
339 		*size = le16_to_cpu(get_unaligned((__le16 *) e->pos));  in aa_unpack_array()
340 		e->pos += sizeof(u16);  in aa_unpack_array()
345 	e->pos = pos;  in aa_unpack_array()
350 VISIBLE_IF_KUNIT size_t aa_unpack_blob(struct aa_ext *e, char **blob, const char *name)  in aa_unpack_blob()  argument
352 	void *pos = e->pos;  in aa_unpack_blob()
354 	if (aa_unpack_nameX(e, AA_BLOB, name)) {  in aa_unpack_blob()
356 		if (!aa_inbounds(e, sizeof(u32)))  in aa_unpack_blob()
358 		size = le32_to_cpu(get_unaligned((__le32 *) e->pos));  in aa_unpack_blob()
359 		e->pos += sizeof(u32);  in aa_unpack_blob()
360 		if (aa_inbounds(e, (size_t) size)) {  in aa_unpack_blob()
361 			*blob = e->pos;  in aa_unpack_blob()
362 			e->pos += size;  in aa_unpack_blob()
368 	e->pos = pos;  in aa_unpack_blob()
373 VISIBLE_IF_KUNIT int aa_unpack_str(struct aa_ext *e, const char **string, const char *name)  in aa_unpack_str()  argument
377 	void *pos = e->pos;  in aa_unpack_str()
379 	if (aa_unpack_nameX(e, AA_STRING, name)) {  in aa_unpack_str()
380 		size = aa_unpack_u16_chunk(e, &src_str);  in aa_unpack_str()
392 	e->pos = pos;  in aa_unpack_str()
397 VISIBLE_IF_KUNIT int aa_unpack_strdup(struct aa_ext *e, char **string, const char *name)  in aa_unpack_strdup()  argument
400 	void *pos = e->pos;  in aa_unpack_strdup()
401 	int res = aa_unpack_str(e, &tmp, name);  in aa_unpack_strdup()
409 		e->pos = pos;  in aa_unpack_strdup()
420  * @e: serialized data extent information (NOT NULL)
425 static struct aa_dfa *unpack_dfa(struct aa_ext *e, int flags)  in unpack_dfa()  argument
431 	size = aa_unpack_blob(e, &blob, "aadfa");  in unpack_dfa()
438 		size_t sz = blob - (char *) e->start -  in unpack_dfa()
439 			((e->pos - e->start) & 7);  in unpack_dfa()
455  * @e: serialized data extent information  (NOT NULL)
460 static bool unpack_trans_table(struct aa_ext *e, struct aa_str_table *strs)  in unpack_trans_table()  argument
462 	void *saved_pos = e->pos;  in unpack_trans_table()
466 	if (aa_unpack_nameX(e, AA_STRUCT, "xtable")) {  in unpack_trans_table()
470 		if (!aa_unpack_array(e, NULL, &size))  in unpack_trans_table()
486 			int c, j, pos, size2 = aa_unpack_strdup(e, &str, NULL);  in unpack_trans_table()
522 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))  in unpack_trans_table()
524 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_trans_table()
531 	e->pos = saved_pos;  in unpack_trans_table()
535 static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)  in unpack_xattrs()  argument
537 	void *pos = e->pos;  in unpack_xattrs()
539 	if (aa_unpack_nameX(e, AA_STRUCT, "xattrs")) {  in unpack_xattrs()
543 		if (!aa_unpack_array(e, NULL, &size))  in unpack_xattrs()
550 			if (!aa_unpack_strdup(e, &profile->attach.xattrs[i], NULL))  in unpack_xattrs()
553 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))  in unpack_xattrs()
555 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_xattrs()
562 	e->pos = pos;  in unpack_xattrs()
566 static bool unpack_secmark(struct aa_ext *e, struct aa_ruleset *rules)  in unpack_secmark()  argument
568 	void *pos = e->pos;  in unpack_secmark()
572 	if (aa_unpack_nameX(e, AA_STRUCT, "secmark")) {  in unpack_secmark()
573 		if (!aa_unpack_array(e, NULL, &size))  in unpack_secmark()
584 			if (!unpack_u8(e, &rules->secmark[i].audit, NULL))  in unpack_secmark()
586 			if (!unpack_u8(e, &rules->secmark[i].deny, NULL))  in unpack_secmark()
588 			if (!aa_unpack_strdup(e, &rules->secmark[i].label, NULL))  in unpack_secmark()
591 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))  in unpack_secmark()
593 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_secmark()
608 	e->pos = pos;  in unpack_secmark()
612 static bool unpack_rlimits(struct aa_ext *e, struct aa_ruleset *rules)  in unpack_rlimits()  argument
614 	void *pos = e->pos;  in unpack_rlimits()
617 	if (aa_unpack_nameX(e, AA_STRUCT, "rlimits")) {  in unpack_rlimits()
621 		if (!aa_unpack_u32(e, &tmp, NULL))  in unpack_rlimits()
625 		if (!aa_unpack_array(e, NULL, &size) ||  in unpack_rlimits()
631 			if (!aa_unpack_u64(e, &tmp2, NULL))  in unpack_rlimits()
635 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))  in unpack_rlimits()
637 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_rlimits()
643 	e->pos = pos;  in unpack_rlimits()
647 static bool unpack_perm(struct aa_ext *e, u32 version, struct aa_perms *perm)  in unpack_perm()  argument
655 	return	aa_unpack_u32(e, &reserved, NULL) &&  in unpack_perm()
656 		aa_unpack_u32(e, &perm->allow, NULL) &&  in unpack_perm()
657 		aa_unpack_u32(e, &perm->deny, NULL) &&  in unpack_perm()
658 		aa_unpack_u32(e, &perm->subtree, NULL) &&  in unpack_perm()
659 		aa_unpack_u32(e, &perm->cond, NULL) &&  in unpack_perm()
660 		aa_unpack_u32(e, &perm->kill, NULL) &&  in unpack_perm()
661 		aa_unpack_u32(e, &perm->complain, NULL) &&  in unpack_perm()
662 		aa_unpack_u32(e, &perm->prompt, NULL) &&  in unpack_perm()
663 		aa_unpack_u32(e, &perm->audit, NULL) &&  in unpack_perm()
664 		aa_unpack_u32(e, &perm->quiet, NULL) &&  in unpack_perm()
665 		aa_unpack_u32(e, &perm->hide, NULL) &&  in unpack_perm()
666 		aa_unpack_u32(e, &perm->xindex, NULL) &&  in unpack_perm()
667 		aa_unpack_u32(e, &perm->tag, NULL) &&  in unpack_perm()
668 		aa_unpack_u32(e, &perm->label, NULL);  in unpack_perm()
671 static ssize_t unpack_perms_table(struct aa_ext *e, struct aa_perms **perms)  in unpack_perms_table()  argument
673 	void *pos = e->pos;  in unpack_perms_table()
681 	if (aa_unpack_nameX(e, AA_STRUCT, "perms")) {  in unpack_perms_table()
685 		if (!aa_unpack_u32(e, &version, "version"))  in unpack_perms_table()
687 		if (!aa_unpack_array(e, NULL, &size))  in unpack_perms_table()
693 			if (!unpack_perm(e, version, &(*perms)[i]))  in unpack_perms_table()
696 		if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))  in unpack_perms_table()
698 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_perms_table()
708 	e->pos = pos;  in unpack_perms_table()
712 static int unpack_pdb(struct aa_ext *e, struct aa_policydb **policy,  in unpack_pdb()  argument
717 	void *pos = e->pos;  in unpack_pdb()
726 	size = unpack_perms_table(e, &pdb->perms);  in unpack_pdb()
738 		if (aa_unpack_u32(e, &version, "permsv") && version > 2)  in unpack_pdb()
747 	pdb->dfa = unpack_dfa(e, flags);  in unpack_pdb()
765 		if (!aa_unpack_u32(e, &pdb->start[0], "start"))  in unpack_pdb()
768 		if (!aa_unpack_u32(e, &pdb->start[AA_CLASS_FILE], "dfa_start")) {  in unpack_pdb()
798 	if (!unpack_trans_table(e, &pdb->trans) && required_trans) {  in unpack_pdb()
818 	e->pos = pos;  in unpack_pdb()
839  * @e: serialized data extent information (NOT NULL)
844 static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)  in unpack_profile()  argument
861 	if (!aa_unpack_nameX(e, AA_STRUCT, "profile"))  in unpack_profile()
863 	if (!aa_unpack_str(e, &name, NULL))  in unpack_profile()
892 	(void) aa_unpack_str(e, &profile->rename, "rename");  in unpack_profile()
895 	(void) aa_unpack_str(e, &profile->attach.xmatch_str, "attach");  in unpack_profile()
898 	error = unpack_pdb(e, &profile->attach.xmatch, false, false, &info);  in unpack_profile()
906 		if (!aa_unpack_u32(e, &tmp, NULL)) {  in unpack_profile()
922 	(void) aa_unpack_strdup(e, &disconnected, "disconnected");  in unpack_profile()
926 	(void) aa_unpack_u32(e, &profile->signal, "kill");  in unpack_profile()
932 	if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {  in unpack_profile()
937 	if (!aa_unpack_u32(e, &tmp, NULL))  in unpack_profile()
945 	if (!aa_unpack_u32(e, &tmp, NULL))  in unpack_profile()
947 	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {  in unpack_profile()
961 	if (!aa_unpack_u32(e, &tmp, NULL))  in unpack_profile()
966 	if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_profile()
970 	if (aa_unpack_u32(e, &profile->path_flags, "path_flags"))  in unpack_profile()
978 	if (!aa_unpack_cap_low(e, &rules->caps.allow, NULL))  in unpack_profile()
980 	if (!aa_unpack_cap_low(e, &rules->caps.audit, NULL))  in unpack_profile()
982 	if (!aa_unpack_cap_low(e, &rules->caps.quiet, NULL))  in unpack_profile()
984 	if (!aa_unpack_cap_low(e, &tmpcap, NULL))  in unpack_profile()
988 	if (aa_unpack_nameX(e, AA_STRUCT, "caps64")) {  in unpack_profile()
990 		if (!aa_unpack_cap_high(e, &rules->caps.allow, NULL))  in unpack_profile()
992 		if (!aa_unpack_cap_high(e, &rules->caps.audit, NULL))  in unpack_profile()
994 		if (!aa_unpack_cap_high(e, &rules->caps.quiet, NULL))  in unpack_profile()
996 		if (!aa_unpack_cap_high(e, &tmpcap, NULL))  in unpack_profile()
998 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_profile()
1003 	if (aa_unpack_nameX(e, AA_STRUCT, "capsx")) {  in unpack_profile()
1005 		if (!aa_unpack_cap_low(e, &rules->caps.extended, NULL))  in unpack_profile()
1007 		if (!aa_unpack_cap_high(e, &rules->caps.extended, NULL))  in unpack_profile()
1009 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_profile()
1013 	if (!unpack_xattrs(e, profile)) {  in unpack_profile()
1018 	if (!unpack_rlimits(e, rules)) {  in unpack_profile()
1023 	if (!unpack_secmark(e, rules)) {  in unpack_profile()
1028 	if (aa_unpack_nameX(e, AA_STRUCT, "policydb")) {  in unpack_profile()
1031 		error = unpack_pdb(e, &rules->policy, true, false,  in unpack_profile()
1042 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))  in unpack_profile()
1046 						     e->version);  in unpack_profile()
1056 	error = unpack_pdb(e, &rules->file, false, true, &info);  in unpack_profile()
1076 	if (aa_unpack_nameX(e, AA_STRUCT, "data")) {  in unpack_profile()
1095 		while (aa_unpack_strdup(e, &key, NULL)) {  in unpack_profile()
1104 			data->size = aa_unpack_blob(e, &data->data, NULL);  in unpack_profile()
1123 		if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {  in unpack_profile()
1129 	if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) {  in unpack_profile()
1150 	audit_iface(profile, NULL, name, info, e, error);  in unpack_profile()
1158  * @e: serialized data read head (NOT NULL)
1164 static int verify_header(struct aa_ext *e, int required, const char **ns)  in verify_header()  argument
1171 	if (!aa_unpack_u32(e, &e->version, "version")) {  in verify_header()
1174 				    e, error);  in verify_header()
1183 	if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v9)) {  in verify_header()
1185 			    e, error);  in verify_header()
1190 	if (aa_unpack_str(e, &name, "namespace")) {  in verify_header()
1193 				    e, error);  in verify_header()
1197 			audit_iface(NULL, NULL, NULL, "invalid ns change", e,  in verify_header()
1463 	struct aa_ext e = {  in aa_unpack()  local
1470 	while (e.pos < e.end) {  in aa_unpack()
1472 		error = verify_header(&e, e.pos == e.start, ns);  in aa_unpack()
1476 		start = e.pos;  in aa_unpack()
1477 		profile = unpack_profile(&e, &ns_name);  in aa_unpack()
1488 			error = aa_calc_profile_hash(profile, e.version, start,  in aa_unpack()
1489 						     e.pos - start);  in aa_unpack()
1504 	udata->abi = e.version & K_ABI_MASK;  in aa_unpack()