2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-03 07:45:50 +00:00

Add checks to load_include() to ensure absolute paths

Also update the tests to the new behaviour.
This commit is contained in:
Christian Boltz
2020-06-01 17:06:45 +02:00
parent 9eb7a7581f
commit 4a265e4121
2 changed files with 10 additions and 8 deletions

View File

@@ -2412,6 +2412,9 @@ def load_include(incname):
load_includeslist = [incname]
while load_includeslist:
incfile = load_includeslist.pop(0)
if not incfile.startswith('/'):
raise AppArmorBug('incfile %s not starting with /' % incfile)
incfile_abs = get_include_path(incfile)
if include.get(incfile, {}).get(incfile, False):
pass # already read, do nothing

View File

@@ -859,15 +859,14 @@ class AaTest_propose_file_rules_with_absolute_includes(AATest):
class AaTest_nonexistent_includes(AATest):
def test_bad_includes(self):
tests = [
"/nonexistent/absolute/path",
"nonexistent/relative/path",
("/nonexistent/absolute/path", AppArmorException),
("nonexistent/relative/path", AppArmorBug), # load_include() only accepts absolute paths
]
for i in tests:
with self.assertRaises(AppArmorException):
apparmor.aa.load_include(i)
def _run_test(self, params, expected):
with self.assertRaises(expected):
apparmor.aa.load_include(params)
setup_aa(apparmor.aa)