mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

Make meaning of leading permissions consistent with trailing permissions

Browse Source 
x Permissions when specified as a the start of the rule had a differnt
meaning than when they appeared at the tail of a rule.

Specifically px,cx,ux were not treated as unsafe when they appeared at
the start of the rule.
  px /foo,
instead of at the tail of the rule
  /foo px,

the keyword unsafe had to be used to force the rule to cause the x transitio
to be its unsafe variant.

Fix leading permissions so that they are consistent with file rules that
use trailing permissions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2010-12-20 11:56:57 -08:00
parent c059224811
commit 4eea3ae073
3 changed files with 5 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
parser/parser_yacc.y
View File

@ -879,11 +879,12 @@ opt_unsafe: { /* nothing */ $$ = 0; }
rule: opt_unsafe file_mode opt_subset_flag id_or_var opt_named_transition TOK_END_OF_RULE
{
int mode = $2 & ~ALL_AA_EXEC_UNSAFE;
int mode = $2;
if ($1) {
if (!($2 & AA_EXEC_BITS))
yyerror(_("unsafe rule missing exec permissions"));
mode |= (($2 & AA_EXEC_BITS) << 8) & ALL_AA_EXEC_UNSAFE;
mode = ($2 & ~ALL_AA_EXEC_UNSAFE) |
((($2 & AA_EXEC_BITS) << 8) & ALL_AA_EXEC_UNSAFE);
}
if ($3 && ($2 & ~AA_LINK_BITS))

16
parser/tst/simple_tests/xtrans/simple_bad_x_mods_first_34.sd
View File

@ -1,16 +0,0 @@
#
#=DESCRIPTION test pix - in forward perms P and p are the same and the
# unsafe keyword is required. So these should conflict
#=EXRESULT FAIL
#
/usr/bin/foo {
/bin/cat pix,
/bin/foo Pix,
/bin/bar pIx,
/bin/a PIx,
pix /bin/cat,
Pix /bin/foo,
pIx /bin/bar,
PIx /bin/a,
}

4
parser/tst/simple_tests/xtrans/simple_ok_pix_1.sd
View File

@ -9,7 +9,7 @@
/bin/a PIx,
unsafe pix /bin/cat,
pix /bin/foo,
Pix /bin/foo,
unsafe pix /bin/bar,
pix /bin/a,
Pix /bin/a,
}