apparmor: Fix build failure when ZSTD_DECOMPRESS is not enabled

commit
17b5758bf35c ("apparmor: Initial support for compressed policies")

added the ability for apparmor to load compressed policy, unfortunately
it did not add a config option or select CONFIG_ZSTD_DECOMPRESS
which it depends on, leading to the following build failure

apparmorfs.c makes calls into zstd_*() even when
CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is not set, causing
build errors:

/usr/bin/ld.bfd: security/apparmor/apparmorfs.o: in function `policy_update':
apparmorfs.c:(.text+0x1307): undefined reference to `zstd_get_frame_header'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1359): undefined reference to `zstd_dctx_workspace_bound'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x13f7): undefined reference to `zstd_init_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x140c): undefined reference to `zstd_decompress_dctx'
/usr/bin/ld.bfd: apparmorfs.c:(.text+0x1411): undefined reference to `zstd_is_error'

Add a new config option to enable compress policy loading as using
the existing CONFIG_SECURITY_APPARMOR_EXPORT_BINARY is in appropriate
as that is about retaining loaded policy so that it can be introspected
at a later date.

Fixes: 17b5758bf35c ("apparmor: Initial support for compressed policies")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

2 files changed, 26 insertions, 1 deletions

diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
index e1bfd164a23a..a1f3749bdfd0 100644
--- a/security/apparmor/Kconfig
+++ b/security/apparmor/Kconfig
@@ -93,6 +93,18 @@ config SECURITY_APPARMOR_EXPORT_BINARY
 	  also increases policy load time. This option is required for
 	  checkpoint and restore support, and debugging of loaded policy.
 
+config SECURITY_APPARMOR_COMPRESSED_POLICY
+	bool "Allow loading policy in a compressed format"
+	depends on SECURITY_APPARMOR
+	select ZSTD_DECOMPRESS
+	default y
+	help
+	  This option allows loading policy from userspace in a
+	  compressed format. This allows for userspace to not have to
+	  decrompress caches before loading policy, and also allows
+	  for less kernel memory to be used when "exporting the raw
+	  binary policy" is enabled.
+
 config SECURITY_APPARMOR_PARANOID_LOAD
 	bool "Perform full verification of loaded policy"
 	depends on SECURITY_APPARMOR
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 79b91c680e46..4309555b5541 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -484,6 +484,7 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf,
 	return data;
 }
 
+#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
 static int decompress_zstd(char *src, size_t slen, char *dst, size_t dlen)
 {
 	if (slen < dlen) {
@@ -581,7 +582,15 @@ fail:
 	return ERR_PTR(error);
 
 }
-
+#else
+static struct aa_loaddata *aa_get_data_from_compressed(const char __user *userbuf __always_unused,
+						  size_t buffer_size __always_unused,
+						  loff_t *pos __always_unused,
+						  char **compressed_data __always_unused)
+{
+	return ERR_PTR(-EINVAL);
+}
+#endif /* CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY */
 struct aa_user_hdr {
 	uint8_t version;
 	uint8_t compress_level;
@@ -2604,8 +2613,10 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = {
 	AA_SFS_FILE_STRING("permstable32", PERMS32STR),
 	AA_SFS_FILE_U64("state32",	1),
 	AA_SFS_DIR("unconfined_restrictions",   aa_sfs_entry_unconfined),
+#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
 	AA_SFS_FILE_BOOLEAN("compressed_load",	1),
 	AA_SFS_FILE_BOOLEAN("extended_policy_header",	1),
+#endif
 	{ }
 };
 
@@ -2670,8 +2681,10 @@ static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {
 	AA_SFS_FILE_FOPS(".ns_level", 0444, &seq_ns_level_fops),
 	AA_SFS_FILE_FOPS(".ns_name", 0444, &seq_ns_name_fops),
 	AA_SFS_FILE_FOPS("profiles", 0444, &aa_sfs_profiles_fops),
+#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY
 	AA_SFS_FILE_FOPS("raw_data_compression_level_min", 0444, &seq_ns_compress_min_fops),
 	AA_SFS_FILE_FOPS("raw_data_compression_level_max", 0444, &seq_ns_compress_max_fops),
+#endif
 	AA_SFS_DIR("features", aa_sfs_entry_features),
 	{ }
 };