mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity
apparmor/parser/libapparmor_re/chfa.h

72 lines
2.1 KiB
C
Raw Normal View History

Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
/*
* (C) 2006, 2007 Andreas Gruenbacher <agruen@suse.de>
* Copyright (c) 2003-2008 Novell, Inc. (All rights reserved)
Update the copyright dates for the apparmor_parser Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:21:59 -08:00
* Copyright 2009-2012 Canonical Ltd.
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
*
* The libapparmor library is licensed under the terms of the GNU
* Lesser General Public License, version 2.1. Please see the file
* COPYING.LGPL.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*
parser: if extended perms are supported by the kernel build a permstable If extended permissions are supported use them. We need to build a permission table and set the accept state of the chfa up as an index into the table. For now map the front end permission layout into the old format and then convert that to the perms table just as the kernel does. Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-18 05:49:20 -07:00
* Create a compressed hfa (chfa) from an hfa
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
*/
Rename compressed_hfa.{c,h} and TransitionTable within them to chfa. This is done to be clear what TransitionTable is, as we will then add matching capabilities. Renaming the files is just to make them consistent with the class in the file. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:06:32 -08:00
#ifndef __LIBAA_RE_CHFA_H
#define __LIBAA_RE_CHFA_H
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
#include <map>
#include <vector>
#include "hfa.h"
parser: Add work around for buggy permstable32 v1 of permstable32 has some broken verification checks. By using two copies of a merged dfa and an xtable the same size of the permstable we can work around the issue. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-20 08:31:12 -07:00
#include "../perms.h"
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
Add Differential State Compression to the DFA Differential state compression encodes a state's transitions as the difference between the state and its default state (the state it is relative too). This reduces the number of transitions that need to be stored in the transition table, hence reducing the size of the dfa. There is a trade off in that a single input character may have to traverse more than one state. This is somewhat offset by reduced table sizes providing better locality and caching properties. With carefully encoding we can still make constant match time guarentees. This patch guarentees that a state that is differentially encoded will do at most 3m state traversal to match an input of length m (as opposed to a non-differentially compressed dfa doing exactly m state traversals). In practice the actually number of extra traversals is less than this becaus we selectively choose which states are differentially encoded. In addition to reducing the size of the dfa by reducing the number of transitions that have to be stored. Differential encoding reduces the number of transitions that need to be considered by comb compression, which can result in tighter packing, due to a reduction in sparseness, and also reduces the time spent in comb compression which currently uses an O(n^2) algorithm. Differential encoding will always result in a DFA that is smaller or equal in size to the encoded DFA, and will usually improve compilation times, with the performance improvements increasing as the DFA gets larger. Eg. Given a example DFA that created 8991 states after minimization. * If only comb compression (current default) is used 52057 transitions are packed into a table of 69591 entries. Achieving an efficiency of about 75% (an average of about 7.74 table entries per state). With a resulting compressed dfa16 size of 404238 bytes and a run time for the dfa compilation of real 0m9.037s user 0m8.893s sys 0m0.036s * If differential encoding + comb compression is used, 8292 of the 8991 states are differentially encoded, with 31557 trans removed. Resulting in 20500 transitions are packed into a table of 20675 entries. Acheiving an efficiency of about 99.2% (an average of about 2.3 table entries per state With a resulting compressed dfa16 size of 207874 bytes (about 48.6% reduction) and a run time for the dfa compilation of real 0m5.416s (about 40% faster) user 0m5.280s sys 0m0.040s Repeating with a larger DFA that has 17033 states after minimization. * If only comb compression (current default) is used 102992 transitions are packed into a table of 137987 entries. Achieving an efficiency of about 75% (an average of about 8.10 entries per state). With a resultant compressed dfa16 size of 790410 bytes and a run time for d compilation of real 0m28.153s user 0m27.634s sys 0m0.120s * with differential encoding 39374 transition are packed into a table of 39594 entries. Achieving an efficiency of about 99.4% (an average of about 2.32 entries per state). With a resultant compressed dfa16 size of 396838 bytes (about 50% reduction and a run time for dfa compilation of real 0m11.804s (about 58% faster) user 0m11.657s sys 0m0.084s Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-01-09 16:55:55 -08:00
#define BASE32_FLAGS 0xff000000
#define DiffEncodeBit32 0x80000000
add ability to use out of band transitions Currently the NULL character is used as an out of band transition for string/path elements. This works for them as the NULL character is not valid for this data. However this does not work for binary data that can contain a NULL character. So far we have only dealt with fixed length fields of binary data making the NULL separator either unnecessary. However binary data like in the xattr match and mount data field are variable length and can contain NULL characters. To deal with this add the ability to specify out of band transitions, that can only be triggered by code not input data. The out of band transition can be used to separate variable length data fields just as the NULL transition has been used to separate variable length strings. In the compressed hfa out of band transitions are expressed as a negative offset from the states base. This leaves us room to expand the character match range in the future if desired and on average makes the range between the out of band transition and the input transitions smaller than would be had if the out of band transition had been stored after the valid input transitions. Out of band transitions in the dfa will not break old kernels that don't know about them, but they won't be able to trigger the out of band transition match. So they should not be used unless the kernel indicates that it supports them. It should be noted that this patch only adds support for a single out of band transition. If multiple out of band transitions are required. It is trivial to extend. - Add a tag indicating support in the kernel - add a oob max range field to the dfa header so the kernel knows what the max range that needs verifying is. - extend oob generation fns to generate oob based on value instead of a fixed -1. Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-08-11 06:18:27 -07:00
#define MATCH_FLAG_OOB_TRANSITION 0x20000000
Add Differential State Compression to the DFA Differential state compression encodes a state's transitions as the difference between the state and its default state (the state it is relative too). This reduces the number of transitions that need to be stored in the transition table, hence reducing the size of the dfa. There is a trade off in that a single input character may have to traverse more than one state. This is somewhat offset by reduced table sizes providing better locality and caching properties. With carefully encoding we can still make constant match time guarentees. This patch guarentees that a state that is differentially encoded will do at most 3m state traversal to match an input of length m (as opposed to a non-differentially compressed dfa doing exactly m state traversals). In practice the actually number of extra traversals is less than this becaus we selectively choose which states are differentially encoded. In addition to reducing the size of the dfa by reducing the number of transitions that have to be stored. Differential encoding reduces the number of transitions that need to be considered by comb compression, which can result in tighter packing, due to a reduction in sparseness, and also reduces the time spent in comb compression which currently uses an O(n^2) algorithm. Differential encoding will always result in a DFA that is smaller or equal in size to the encoded DFA, and will usually improve compilation times, with the performance improvements increasing as the DFA gets larger. Eg. Given a example DFA that created 8991 states after minimization. * If only comb compression (current default) is used 52057 transitions are packed into a table of 69591 entries. Achieving an efficiency of about 75% (an average of about 7.74 table entries per state). With a resulting compressed dfa16 size of 404238 bytes and a run time for the dfa compilation of real 0m9.037s user 0m8.893s sys 0m0.036s * If differential encoding + comb compression is used, 8292 of the 8991 states are differentially encoded, with 31557 trans removed. Resulting in 20500 transitions are packed into a table of 20675 entries. Acheiving an efficiency of about 99.2% (an average of about 2.3 table entries per state With a resulting compressed dfa16 size of 207874 bytes (about 48.6% reduction) and a run time for the dfa compilation of real 0m5.416s (about 40% faster) user 0m5.280s sys 0m0.040s Repeating with a larger DFA that has 17033 states after minimization. * If only comb compression (current default) is used 102992 transitions are packed into a table of 137987 entries. Achieving an efficiency of about 75% (an average of about 8.10 entries per state). With a resultant compressed dfa16 size of 790410 bytes and a run time for d compilation of real 0m28.153s user 0m27.634s sys 0m0.120s * with differential encoding 39374 transition are packed into a table of 39594 entries. Achieving an efficiency of about 99.4% (an average of about 2.32 entries per state). With a resultant compressed dfa16 size of 396838 bytes (about 50% reduction and a run time for dfa compilation of real 0m11.804s (about 58% faster) user 0m11.657s sys 0m0.084s Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-01-09 16:55:55 -08:00
#define base_mask_size(X) ((X) & ~BASE32_FLAGS)
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
using namespace std;
Rename compressed_hfa.{c,h} and TransitionTable within them to chfa. This is done to be clear what TransitionTable is, as we will then add matching capabilities. Renaming the files is just to make them consistent with the class in the file. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:06:32 -08:00
class CHFA {
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
typedef vector<pair<const State *, size_t> > DefaultBase;
Lindent + some hand cleanups hfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@gmail.com>
2011-03-13 05:55:25 -07:00
typedef vector<pair<const State *, const State *> > NextCheck;
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
public:
parser: Add work around for buggy permstable32 v1 of permstable32 has some broken verification checks. By using two copies of a merged dfa and an xtable the same size of the permstable we can work around the issue. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-20 08:31:12 -07:00
CHFA(void);
parser: move perm to accept mapping into State Let the state deal with permission mappings and what to do if outputting an index. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-03 21:39:03 -07:00
CHFA(DFA &dfa, map<transchar, transchar> &eq, optflags const &opts,
bool permindex);
parser: Add work around for buggy permstable32 v1 of permstable32 has some broken verification checks. By using two copies of a merged dfa and an xtable the same size of the permstable we can work around the issue. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-20 08:31:12 -07:00
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
void dump(ostream & os);
chfa: get not-flextable size and padding correct The kernel does not expect a name and it is not used even within the parser so drop it. Correct the padding calculation. sizeof(th_version) includes the trailing \0 in the count so we should not be adding it explicitly. Doing so made it seem like we were writing an extra byte and messing things up, because the string write below did not include the \0 which we had to add explicitly. Switch to writing the th_version using size_of() bytes as is used in the pad calculation, to avoid confusion around the header padding. Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-07-18 06:29:44 -07:00
void flex_table(ostream &os);
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
void init_free_list(vector<pair<size_t, size_t> > &free_list,
size_t prev, size_t start);
bool fits_in(vector<pair<size_t, size_t> > &free_list, size_t base,
This helps make the meaning of things a little clearer and provides a clear distinction betwen NodeCases, and State transitions Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 04:58:33 -08:00
StateTrans &cases);
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
void insert_state(vector<pair<size_t, size_t> > &free_list,
State *state, DFA &dfa);
parser: Add work around for buggy permstable32 v1 of permstable32 has some broken verification checks. By using two copies of a merged dfa and an xtable the same size of the permstable we can work around the issue. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-20 08:31:12 -07:00
void weld_file_to_policy(CHFA &file_chfa, size_t &new_start,
bool accept_idx,
vector <aa_perms> &policy_perms,
vector <aa_perms> &file_perms);
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
private:
vector<uint32_t> accept;
vector<uint32_t> accept2;
DefaultBase default_base;
NextCheck next_check;
parser: Add work around for buggy permstable32 v1 of permstable32 has some broken verification checks. By using two copies of a merged dfa and an xtable the same size of the permstable we can work around the issue. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-20 08:31:12 -07:00
const State *start;
Lindent + hand cleanups compressed-dfa Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
map<const State *, size_t> num;
parser: fix chfa quivalence class handling The chfa equivalence class shouldn't be a reference. Its needs to actually exist and be part of the class during later method calls. As a reference it leads to bad references when used later. Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-04-22 17:01:36 -07:00
map<transchar, transchar> eq;
parser: rename uchar to transchar Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-08-08 00:41:57 -07:00
transchar max_eq;
add ability to use out of band transitions Currently the NULL character is used as an out of band transition for string/path elements. This works for them as the NULL character is not valid for this data. However this does not work for binary data that can contain a NULL character. So far we have only dealt with fixed length fields of binary data making the NULL separator either unnecessary. However binary data like in the xattr match and mount data field are variable length and can contain NULL characters. To deal with this add the ability to specify out of band transitions, that can only be triggered by code not input data. The out of band transition can be used to separate variable length data fields just as the NULL transition has been used to separate variable length strings. In the compressed hfa out of band transitions are expressed as a negative offset from the states base. This leaves us room to expand the character match range in the future if desired and on average makes the range between the out of band transition and the input transitions smaller than would be had if the out of band transition had been stored after the valid input transitions. Out of band transitions in the dfa will not break old kernels that don't know about them, but they won't be able to trigger the out of band transition match. So they should not be used unless the kernel indicates that it supports them. It should be noted that this patch only adds support for a single out of band transition. If multiple out of band transitions are required. It is trivial to extend. - Add a tag indicating support in the kernel - add a oob max range field to the dfa header so the kernel knows what the max range that needs verifying is. - extend oob generation fns to generate oob based on value instead of a fixed -1. Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-08-11 06:18:27 -07:00
ssize_t first_free;
Fixes to that where dropped from the diff-encode patch This diff is part of the diffencode patch but was dropped when it was applied to bzr. I have no idea why and status showed a clean tree. Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-01-09 17:24:40 -08:00
unsigned int chfaflags;
Split out compressed dfa "transition table" compression Split hfa into hfa and compressed_hfa files. The hfa portion focuses on creating an manipulating hfas, while compressed_hfa is used for creating compressed hfas that can be used/reused at run time with much less memory usage than the full blown hfa. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
};
Rename compressed_hfa.{c,h} and TransitionTable within them to chfa. This is done to be clear what TransitionTable is, as we will then add matching capabilities. Renaming the files is just to make them consistent with the class in the file. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:06:32 -08:00
#endif /* __LIBAA_RE_CHFA_H */
Reference in New Issue Copy Permalink