2014-11-12 00:05:04 +01:00
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
# Copyright (C) 2013 Kshitij Gupta <kgupta8592@gmail.com>
|
2015-04-03 17:28:03 +02:00
|
|
|
# Copyright (C) 2014-2015 Christian Boltz <apparmor@cboltz.de>
|
2014-11-12 00:05:04 +01:00
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
# License as published by the Free Software Foundation.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
|
|
|
|
import re
|
2015-03-31 22:44:18 +02:00
|
|
|
from apparmor.common import AppArmorBug, AppArmorException
|
|
|
|
|
|
|
|
# setup module translations
|
|
|
|
from apparmor.translations import init_translation
|
|
|
|
_ = init_translation()
|
2014-11-12 00:05:04 +01:00
|
|
|
|
|
|
|
## Profile parsing Regex
|
|
|
|
RE_AUDIT_DENY = '^\s*(?P<audit>audit\s+)?(?P<allow>allow\s+|deny\s+)?' # line start, optionally: leading whitespace, <audit> and <allow>/deny
|
|
|
|
RE_EOL = '\s*(?P<comment>#.*?)?\s*$' # optional whitespace, optional <comment>, optional whitespace, end of the line
|
|
|
|
RE_COMMA_EOL = '\s*,' + RE_EOL # optional whitespace, comma + RE_EOL
|
|
|
|
|
2015-05-09 01:09:08 +02:00
|
|
|
RE_PROFILE_NAME = '(?P<%s>(\S+|"[^"]+"))' # string without spaces, or quoted string. %s is the match group name
|
2016-10-01 19:51:36 +02:00
|
|
|
RE_PATH = '/\S*|"/[^"]*"' # filename (starting with '/') without spaces, or quoted filename.
|
2015-07-08 22:49:10 +02:00
|
|
|
RE_PROFILE_PATH = '(?P<%s>(' + RE_PATH + '))' # quoted or unquoted filename. %s is the match group name
|
|
|
|
RE_PROFILE_PATH_OR_VAR = '(?P<%s>(' + RE_PATH + '|@{\S+}\S*|"@{\S+}[^"]*"))' # quoted or unquoted filename or variable. %s is the match group name
|
2016-07-20 17:24:11 -05:00
|
|
|
RE_SAFE_OR_UNSAFE = '(?P<execmode>(safe|unsafe))'
|
2019-08-17 05:22:10 -07:00
|
|
|
RE_XATTRS = '(\s+xattrs\s*=\s*\((?P<xattrs>([^)=]+(=[^)=]+)?\s?)+)\)\s*)?'
|
2018-12-06 21:56:33 +01:00
|
|
|
RE_FLAGS = '(\s+(flags\s*=\s*)?\((?P<flags>[^)]+)\))?'
|
2015-05-09 01:09:08 +02:00
|
|
|
|
2014-11-12 00:05:04 +01:00
|
|
|
RE_PROFILE_END = re.compile('^\s*\}' + RE_EOL)
|
|
|
|
RE_PROFILE_CAP = re.compile(RE_AUDIT_DENY + 'capability(?P<capability>(\s+\S+)+)?' + RE_COMMA_EOL)
|
|
|
|
RE_PROFILE_ALIAS = re.compile('^\s*alias\s+("??.+?"??)\s+->\s*("??.+?"??)' + RE_COMMA_EOL)
|
2015-07-11 14:05:32 +02:00
|
|
|
RE_PROFILE_RLIMIT = re.compile('^\s*set\s+rlimit\s+(?P<rlimit>[a-z]+)\s*<=\s*(?P<value>[^ ]+(\s+[a-zA-Z]+)?)' + RE_COMMA_EOL)
|
2014-11-12 00:05:04 +01:00
|
|
|
RE_PROFILE_BOOLEAN = re.compile('^\s*(\$\{?\w*\}?)\s*=\s*(true|false)\s*,?' + RE_EOL, flags=re.IGNORECASE)
|
|
|
|
RE_PROFILE_VARIABLE = re.compile('^\s*(@\{?\w+\}?)\s*(\+?=)\s*(@*.+?)\s*,?' + RE_EOL)
|
|
|
|
RE_PROFILE_CONDITIONAL = re.compile('^\s*if\s+(not\s+)?(\$\{?\w*\}?)\s*\{' + RE_EOL)
|
|
|
|
RE_PROFILE_CONDITIONAL_VARIABLE = re.compile('^\s*if\s+(not\s+)?defined\s+(@\{?\w+\}?)\s*\{\s*(#.*)?$')
|
|
|
|
RE_PROFILE_CONDITIONAL_BOOLEAN = re.compile('^\s*if\s+(not\s+)?defined\s+(\$\{?\w+\}?)\s*\{\s*(#.*)?$')
|
2015-04-26 21:54:38 +02:00
|
|
|
RE_PROFILE_NETWORK = re.compile(RE_AUDIT_DENY + 'network(?P<details>\s+.*)?' + RE_COMMA_EOL)
|
2014-11-12 00:05:04 +01:00
|
|
|
RE_PROFILE_CHANGE_HAT = re.compile('^\s*\^(\"??.+?\"??)' + RE_COMMA_EOL)
|
2018-12-06 10:54:46 -08:00
|
|
|
RE_PROFILE_HAT_DEF = re.compile('^(?P<leadingspace>\s*)(?P<hat_keyword>\^|hat\s+)(?P<hat>\"??[^)]+?\"??)' + RE_FLAGS + '\s*\{' + RE_EOL)
|
2016-05-23 23:10:48 +02:00
|
|
|
RE_PROFILE_DBUS = re.compile(RE_AUDIT_DENY + '(dbus\s*,|dbus(?P<details>\s+[^#]*)\s*,)' + RE_EOL)
|
2014-11-12 00:05:04 +01:00
|
|
|
RE_PROFILE_MOUNT = re.compile(RE_AUDIT_DENY + '((mount|remount|umount|unmount)(\s+[^#]*)?\s*,)' + RE_EOL)
|
2015-11-23 23:46:32 +01:00
|
|
|
RE_PROFILE_SIGNAL = re.compile(RE_AUDIT_DENY + '(signal\s*,|signal(?P<details>\s+[^#]*)\s*,)' + RE_EOL)
|
2015-12-27 01:14:54 +01:00
|
|
|
RE_PROFILE_PTRACE = re.compile(RE_AUDIT_DENY + '(ptrace\s*,|ptrace(?P<details>\s+[^#]*)\s*,)' + RE_EOL)
|
2014-11-12 00:05:04 +01:00
|
|
|
RE_PROFILE_PIVOT_ROOT = re.compile(RE_AUDIT_DENY + '(pivot_root\s*,|pivot_root\s+[^#]*\s*,)' + RE_EOL)
|
|
|
|
RE_PROFILE_UNIX = re.compile(RE_AUDIT_DENY + '(unix\s*,|unix\s+[^#]*\s*,)' + RE_EOL)
|
|
|
|
|
|
|
|
# match anything that's not " or #, or matching quotes with anything except quotes inside
|
|
|
|
__re_no_or_quoted_hash = '([^#"]|"[^"]*")*'
|
|
|
|
|
|
|
|
RE_RULE_HAS_COMMA = re.compile('^' + __re_no_or_quoted_hash +
|
|
|
|
',\s*(#.*)?$') # match comma plus any trailing comment
|
|
|
|
RE_HAS_COMMENT_SPLIT = re.compile('^(?P<not_comment>' + __re_no_or_quoted_hash + ')' + # store in 'not_comment' group
|
|
|
|
'(?P<comment>#.*)$') # match trailing comment and store in 'comment' group
|
|
|
|
|
2015-03-03 20:15:00 +01:00
|
|
|
|
2015-03-31 22:44:18 +02:00
|
|
|
|
2015-04-03 17:28:03 +02:00
|
|
|
RE_PROFILE_START = re.compile(
|
2015-03-31 22:44:18 +02:00
|
|
|
'^(?P<leadingspace>\s*)' +
|
|
|
|
'(' +
|
2015-08-03 00:16:23 +02:00
|
|
|
RE_PROFILE_PATH_OR_VAR % 'plainprofile' + # just a path
|
2015-03-31 22:44:18 +02:00
|
|
|
'|' + # or
|
2015-08-03 00:16:23 +02:00
|
|
|
'(' + 'profile' + '\s+' + RE_PROFILE_NAME % 'namedprofile' + '(\s+' + RE_PROFILE_PATH_OR_VAR % 'attachment' + ')?' + ')' + # 'profile', profile name, optionally attachment
|
2015-03-31 22:44:18 +02:00
|
|
|
')' +
|
2018-11-28 11:04:49 -08:00
|
|
|
RE_XATTRS +
|
2018-12-06 21:56:33 +01:00
|
|
|
RE_FLAGS +
|
|
|
|
'\s*\{' +
|
2015-03-31 22:44:18 +02:00
|
|
|
RE_EOL)
|
|
|
|
|
2015-05-28 22:22:56 +02:00
|
|
|
|
2015-05-28 22:26:34 +02:00
|
|
|
RE_PROFILE_CHANGE_PROFILE = re.compile(
|
2015-05-28 22:22:56 +02:00
|
|
|
RE_AUDIT_DENY +
|
|
|
|
'change_profile' +
|
2016-07-20 17:24:11 -05:00
|
|
|
'(\s+' + RE_SAFE_OR_UNSAFE + ')?' + # optionally exec mode
|
2015-07-08 22:49:10 +02:00
|
|
|
'(\s+' + RE_PROFILE_PATH_OR_VAR % 'execcond' + ')?' + # optionally exec condition
|
2015-05-28 22:22:56 +02:00
|
|
|
'(\s+->\s*' + RE_PROFILE_NAME % 'targetprofile' + ')?' + # optionally '->' target profile
|
|
|
|
RE_COMMA_EOL)
|
|
|
|
|
|
|
|
|
2016-10-01 19:46:37 +02:00
|
|
|
# RE_PATH_PERMS is as restrictive as possible, but might still cause mismatches when adding different rule types.
|
|
|
|
# Therefore parsing code should match against file rules only after trying to match all other rule types.
|
|
|
|
RE_PATH_PERMS = '(?P<%s>[mrwalkPUCpucix]+)'
|
|
|
|
|
|
|
|
RE_PROFILE_FILE_ENTRY = re.compile(
|
|
|
|
RE_AUDIT_DENY +
|
|
|
|
'(?P<owner>owner\s+)?' + # optionally: <owner>
|
|
|
|
'(' +
|
|
|
|
'(?P<bare_file>file)' + # bare 'file,'
|
|
|
|
'|' + # or
|
|
|
|
'(?P<file_keyword>file\s+)?' + # optional 'file' keyword
|
|
|
|
'(' +
|
|
|
|
RE_PROFILE_PATH_OR_VAR % 'path' + '\s+' + RE_PATH_PERMS % 'perms' + # path and perms
|
|
|
|
'|' + # or
|
|
|
|
RE_PATH_PERMS % 'perms2' + '\s+' + RE_PROFILE_PATH_OR_VAR % 'path2' + # perms and path
|
|
|
|
')' +
|
|
|
|
'(\s+->\s*' + RE_PROFILE_NAME % 'target' + ')?' +
|
2019-04-22 22:52:48 +02:00
|
|
|
'|' + # or
|
|
|
|
'(?P<link_keyword>link\s+)' + # 'link' keyword
|
|
|
|
'(?P<subset_keyword>subset\s+)?' + # optional 'subset' keyword
|
|
|
|
RE_PROFILE_PATH_OR_VAR % 'link_path' + # path
|
|
|
|
'\s+' + '->' + '\s+' + # ' -> '
|
|
|
|
RE_PROFILE_PATH_OR_VAR % 'link_target' + # path
|
2016-10-01 19:46:37 +02:00
|
|
|
')' +
|
|
|
|
RE_COMMA_EOL)
|
|
|
|
|
2015-05-28 22:22:56 +02:00
|
|
|
|
2015-03-31 22:44:18 +02:00
|
|
|
def parse_profile_start_line(line, filename):
|
2015-04-03 17:28:03 +02:00
|
|
|
matches = RE_PROFILE_START.search(line)
|
2015-03-31 22:44:18 +02:00
|
|
|
|
|
|
|
if not matches:
|
|
|
|
raise AppArmorBug('The given line from file %(filename)s is not the start of a profile: %(line)s' % { 'filename': filename, 'line': line } )
|
|
|
|
|
|
|
|
result = {}
|
|
|
|
|
2018-11-28 11:04:49 -08:00
|
|
|
for section in [ 'leadingspace', 'plainprofile', 'namedprofile', 'attachment', 'xattrs', 'flags', 'comment']:
|
2015-03-31 22:44:18 +02:00
|
|
|
if matches.group(section):
|
|
|
|
result[section] = matches.group(section)
|
|
|
|
|
|
|
|
# sections with optional quotes
|
|
|
|
if section in ['plainprofile', 'namedprofile', 'attachment']:
|
|
|
|
result[section] = strip_quotes(result[section])
|
|
|
|
else:
|
|
|
|
result[section] = None
|
|
|
|
|
|
|
|
if result['flags'] and result['flags'].strip() == '':
|
|
|
|
raise AppArmorException(_('Invalid syntax in %(filename)s: Empty set of flags in line %(line)s.' % { 'filename': filename, 'line': line } ))
|
|
|
|
|
|
|
|
if result['plainprofile']:
|
|
|
|
result['profile'] = result['plainprofile']
|
|
|
|
result['profile_keyword'] = False
|
|
|
|
else:
|
|
|
|
result['profile'] = result['namedprofile']
|
|
|
|
result['profile_keyword'] = True
|
|
|
|
|
|
|
|
return result
|
|
|
|
|
2018-09-26 22:09:17 +02:00
|
|
|
RE_ABI = re.compile('^\s*#?abi\s*(<(?P<magicpath>.*)>|"(?P<quotedpath>.*)"|(?P<unquotedpath>[^<>"]*))' + RE_COMMA_EOL)
|
2015-03-31 22:44:18 +02:00
|
|
|
|
2017-12-18 19:37:35 +00:00
|
|
|
RE_INCLUDE = re.compile('^\s*#?include\s*(<(?P<magicpath>.*)>|"(?P<quotedpath>.*)"|(?P<unquotedpath>[^<>"]*))' + RE_EOL)
|
2015-06-19 21:41:41 +02:00
|
|
|
|
|
|
|
def re_match_include(line):
|
|
|
|
"""Matches the path for include and returns the include path"""
|
|
|
|
matches = RE_INCLUDE.search(line)
|
|
|
|
|
|
|
|
if not matches:
|
|
|
|
return None
|
|
|
|
|
2017-12-18 19:37:35 +00:00
|
|
|
path = None
|
|
|
|
if matches.group('magicpath'):
|
|
|
|
path = matches.group('magicpath').strip()
|
|
|
|
elif matches.group('unquotedpath'):
|
|
|
|
# LP: #1738879 - parser doesn't handle unquoted paths everywhere
|
|
|
|
# path = matches.group('unquotedpath').strip()
|
2017-12-22 21:40:18 +01:00
|
|
|
raise AppArmorException(_('Syntax error: #include must use quoted path or <...>'))
|
2017-12-18 19:37:35 +00:00
|
|
|
elif matches.group('quotedpath'):
|
2017-12-21 15:27:09 -06:00
|
|
|
path = matches.group('quotedpath')
|
2017-12-18 19:37:35 +00:00
|
|
|
# LP: 1738880 - parser doesn't handle relative paths everywhere, and
|
|
|
|
# neither do we (see aa.py)
|
|
|
|
if len(path) > 0 and path[0] != '/':
|
2017-12-21 15:29:52 -06:00
|
|
|
raise AppArmorException(_('Syntax error: #include must use quoted path or <...>'))
|
2017-12-18 19:37:35 +00:00
|
|
|
|
|
|
|
# if path is empty or the empty string
|
|
|
|
if path is None or path == "":
|
2015-06-19 21:41:41 +02:00
|
|
|
raise AppArmorException(_('Syntax error: #include rule with empty filename'))
|
|
|
|
|
2017-12-18 19:37:35 +00:00
|
|
|
# LP: #1738877 - parser doesn't handle files with spaces in the name
|
|
|
|
if re.search('\s', path):
|
|
|
|
raise AppArmorException(_('Syntax error: #include rule filename cannot contain spaces'))
|
|
|
|
|
|
|
|
return path
|
2015-06-19 21:41:41 +02:00
|
|
|
|
2016-05-23 23:12:07 +02:00
|
|
|
def strip_parenthesis(data):
|
|
|
|
'''strips parenthesis from the given string and returns the strip()ped result.
|
|
|
|
The parenthesis must be the first and last char, otherwise they won't be removed.
|
|
|
|
Even if no parenthesis get removed, the result will be strip()ped.
|
|
|
|
'''
|
|
|
|
if data[0] + data[-1] == '()':
|
|
|
|
return data[1:-1].strip()
|
|
|
|
else:
|
|
|
|
return data.strip()
|
2015-06-19 21:41:41 +02:00
|
|
|
|
2015-03-03 20:15:00 +01:00
|
|
|
def strip_quotes(data):
|
|
|
|
if data[0] + data[-1] == '""':
|
|
|
|
return data[1:-1]
|
|
|
|
else:
|
|
|
|
return data
|