diff --git a/utils/apparmor/rule/unix.py b/utils/apparmor/rule/unix.py index c071a216a..ae8f978ee 100644 --- a/utils/apparmor/rule/unix.py +++ b/utils/apparmor/rule/unix.py @@ -47,7 +47,7 @@ sep = r'\s*[\s,]\s*' unix_accesses = rf'\s*(\s*(?P\({join_access}({sep}{join_access})*\s*\)|{join_access}))?' unix_rule_conds = rf'(\s*({re_cond_set("type")}|{re_cond_set("protocol")}))*' unix_local_expr = rf'(\s*({re_cond("addr")}|{re_cond("label")}|{re_cond("attr")}|{re_cond("opt")}))*' -unix_peer_expr = rf'peer\s*=\s*\((\s*({re_cond("addr", "addr_peer")}|{re_cond("label", "label_peer")}))*\)' +unix_peer_expr = rf'peer\s*=\s*\((\s*({re_cond("addr", "addr_peer")}|{re_cond("label", "label_peer")})(\s*,)?)*\)' RE_UNIX_DETAILS = re.compile(rf'^(\s*{unix_accesses})?(\s*{unix_rule_conds})?(\s*{unix_local_expr})?(\s*{unix_peer_expr})?\s*$') diff --git a/utils/test/test-unix.py b/utils/test/test-unix.py index 4a4cf0568..15614466a 100644 --- a/utils/test/test-unix.py +++ b/utils/test/test-unix.py @@ -42,6 +42,10 @@ class UnixTestParse(AATest): ('unix peer=(addr=@/tmp/foo-*),', UnixRule(UnixRule.ALL, UnixRule.ALL, UnixRule.ALL, {'addr': '@/tmp/foo-*'}, False, False, False, '')), ('unix (accept, rw) protocol=AA type=BB opt=AA label=bb peer=(addr=a label=bb),', UnixRule(('accept', 'rw'), {'type': 'BB', 'protocol': 'AA'}, {'opt': 'AA', 'label': 'bb'}, {'addr': 'a', 'label': 'bb'}, False, False, False, '')), # noqa: E127 + ('unix peer=( label=la, addr="@/h"),', UnixRule(UnixRule.ALL, UnixRule.ALL, UnixRule.ALL, {'addr': '@/h', 'label': 'la,'}, False, False, False, '')), + ('unix peer=(addr="@/h o", label="l a"),', UnixRule(UnixRule.ALL, UnixRule.ALL, UnixRule.ALL, {'addr': '@/h o', 'label': 'l a'}, False, False, False, '')), + ('unix addr="@/h" label=la,', UnixRule(UnixRule.ALL, UnixRule.ALL, {'addr': '@/h', 'label': 'la'}, UnixRule.ALL, False, False, False, '')), + ('unix addr="@/h o" label="l a",', UnixRule(UnixRule.ALL, UnixRule.ALL, {'addr': '@/h o', 'label': 'l a'}, UnixRule.ALL, False, False, False, '')), ) def _run_test(self, rawrule, expected):