mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-03 15:55:46 +00:00
Code Issues Releases Wiki Activity

Add checks to load_include() to ensure absolute paths

Browse Source 
Also update the tests to the new behaviour.
This commit is contained in:
Christian Boltz
2020-06-01 17:06:45 +02:00
parent 9eb7a7581f
commit 4a265e4121
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
utils/apparmor/aa.py
View File

@@ -2412,6 +2412,9 @@ def load_include(incname):
load_includeslist = [incname] load_includeslist = [incname]
while load_includeslist: while load_includeslist:
incfile = load_includeslist.pop(0) incfile = load_includeslist.pop(0)
if not incfile.startswith('/'):
raise AppArmorBug('incfile %s not starting with /' % incfile)
incfile_abs = get_include_path(incfile) incfile_abs = get_include_path(incfile)
if include.get(incfile, {}).get(incfile, False): if include.get(incfile, {}).get(incfile, False):
pass # already read, do nothing pass # already read, do nothing

11
utils/test/test-aa.py
View File

@@ -859,15 +859,14 @@ class AaTest_propose_file_rules_with_absolute_includes(AATest):
class AaTest_nonexistent_includes(AATest): class AaTest_nonexistent_includes(AATest):
def test_bad_includes(self):
tests = [ tests = [
"/nonexistent/absolute/path", ("/nonexistent/absolute/path", AppArmorException),
"nonexistent/relative/path", ("nonexistent/relative/path", AppArmorBug), # load_include() only accepts absolute paths
] ]
for i in tests: def _run_test(self, params, expected):
with self.assertRaises(AppArmorException): with self.assertRaises(expected):
apparmor.aa.load_include(i) apparmor.aa.load_include(params)
setup_aa(apparmor.aa) setup_aa(apparmor.aa)