AppArmor: Add ability to load extended policy

Add the base support for the new policy extensions. This does not bring
any additional functionality, or change current semantics.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>

1 files changed, 23 insertions, 1 deletions

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index c50634b724b5..25fd51edc8da 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -469,7 +469,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
 {
         struct aa_profile *profile = NULL;
         const char *name = NULL;
-        int error = -EPROTO;
+        int i, error = -EPROTO;
         kernel_cap_t tmpcap;
         u32 tmp;
 
@@ -562,6 +562,28 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
         if (!unpack_rlimits(e, profile))
                 goto fail;
 
+        if (unpack_nameX(e, AA_STRUCT, "policydb")) {
+                /* generic policy dfa - optional and may be NULL */
+                profile->policy.dfa = unpack_dfa(e);
+                if (IS_ERR(profile->policy.dfa)) {
+                        error = PTR_ERR(profile->policy.dfa);
+                        profile->policy.dfa = NULL;
+                        goto fail;
+                }
+                if (!unpack_u32(e, &profile->policy.start[0], "start"))
+                        /* default start state */
+                        profile->policy.start[0] = DFA_START;
+                /* setup class index */
+                for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) {
+                        profile->policy.start[i] =
+                                aa_dfa_next(profile->policy.dfa,
+                                            profile->policy.start[0],
+                                            i);
+                }
+                if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+                        goto fail;
+        }
+
         /* get file rules */
         profile->file.dfa = unpack_dfa(e);
         if (IS_ERR(profile->file.dfa)) {