diff --git a/utils/apparmor/rule/mount.py b/utils/apparmor/rule/mount.py index a08105bf1..083a80766 100644 --- a/utils/apparmor/rule/mount.py +++ b/utils/apparmor/rule/mount.py @@ -54,7 +54,10 @@ option_pattern = r'\s*(\boption(s?)\b\s*(?P=|in)\s*'\ r'(?P\(\s*(' + join_valid_flags + r')(' + sep + r'(' + join_valid_flags + r'))*\s*\)|' \ r'(\s*' + join_valid_flags + r')'\ r'))?' -mount_condition_pattern = rf'({fs_type_pattern})?\s*({option_pattern})?' + +# allow any order of fstype and options +# Note: also matches if multiple fstype= or options= are given to keep the regex simpler +mount_condition_pattern = rf'({fs_type_pattern}\s*|{option_pattern}\s*)*' # Source can either be # - A path : /foo diff --git a/utils/test/test-parser-simple-tests.py b/utils/test/test-parser-simple-tests.py index 0695b9bbd..4016f9228 100644 --- a/utils/test/test-parser-simple-tests.py +++ b/utils/test/test-parser-simple-tests.py @@ -87,6 +87,8 @@ exception_not_raised = ( 'mount/bad_opt_31.sd', 'mount/bad_1.sd', 'mount/bad_2.sd', + 'mount/bad_3.sd', + 'mount/bad_4.sd', 'profile/flags/flags_bad10.sd', 'profile/flags/flags_bad11.sd', @@ -315,15 +317,6 @@ unknown_line = ( 'bare_include_tests/ok_85.sd', 'bare_include_tests/ok_86.sd', - # According to spec mount should be in the form fstype=... options=... and NOT in the form options=... fstype=... - 'mount/ok_opt_combo_3.sd', - 'mount/ok_opt_combo_2.sd', - 'mount/ok_opt_combo_1.sd', - 'mount/ok_opt_combo_4.sd', - - # Options should be comma separated - 'mount/in_4.sd', # also order option then fstype is invalid - # Unsupported \\" in unix AARE 'unix/ok_regex_03.sd', 'unix/ok_regex_09.sd', @@ -441,9 +434,6 @@ syntax_failure = ( 'network/network_ok_17.sd', 'network/network_ok_45.sd', 'network/network_ok_46.sd', - - # detached mount - 'mount/ok_opt_86.sd', )