From 80b6e4ddff478de15e5a4f83d45f73302e2906a9 Mon Sep 17 00:00:00 2001 From: Georgia Garcia Date: Mon, 26 Aug 2024 12:39:26 +0000 Subject: [PATCH] Merge libapparmor: make af_protos.h consistent in different archs af_protos.h is a generated table of the protocols created by looking for definitions of IPPROTO_* in netinet/in.h. Depending on the architecture, the order of the table may change when using -dM in the compiler during the extraction of the defines. This causes an issue because there is more than one IPPROTO defined by the value 0: IPPROTO_IP and IPPROTO_HOPOPTS which is a header extension used by IPv6. So if IPPROTO_HOPOPTS was first in the table, then protocol=0 in the audit logs would be translated to hopopts. This caused a failure in arm 32bit: Output doesn't match expected data: --- ./test_multi/testcase_unix_01.out 2024-08-15 01:47:53.000000000 +0000 +++ ./test_multi/out/testcase_unix_01.out 2024-08-15 23:42:10.187416392 +0000 @@ -12,7 +12,7 @@ Peer Addr: @test_abstract_socket Network family: unix Socket type: stream -Protocol: ip +Protocol: hopopts Class: net Epoch: 1711454639 Audit subid: 322 By the time protocol is resolved in grammar.y, we don't have have access to the net family to check if it's inet6. Instead of making protocol dependent on the net family, make the order of the af_protos.h table consistent between architectures using -dD. Signed-off-by: Georgia Garcia MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1309 Approved-by: John Johansen Merged-by: Georgia Garcia (cherry picked from commit 0ec0e2b03571d78c41bec01b9b83b9cdeac0aefb) Signed-off-by: John Johansen --- libraries/libapparmor/src/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/libapparmor/src/Makefile.am b/libraries/libapparmor/src/Makefile.am index 9a9d12e39..239fc7506 100644 --- a/libraries/libapparmor/src/Makefile.am +++ b/libraries/libapparmor/src/Makefile.am @@ -52,7 +52,7 @@ scanner.h: scanner.l scanner.c: scanner.l af_protos.h: - echo '#include ' | $(CC) $(CPPFLAGS) -E -dM - | LC_ALL=C sed -n -e "/IPPROTO_MAX/d" -e "s/^\#define[ \\t]\\+IPPROTO_\\([A-Z0-9_]\\+\\)\\(.*\\)$$/AA_GEN_PROTO_ENT(\\UIPPROTO_\\1, \"\\L\\1\")/p" > $@ + echo '#include ' | $(CC) $(CPPFLAGS) -E -dD - | LC_ALL=C sed -n -e "/IPPROTO_MAX/d" -e "s/^\#define[ \\t]\\+IPPROTO_\\([A-Z0-9_]\\+\\)\\(.*\\)$$/AA_GEN_PROTO_ENT(\\UIPPROTO_\\1, \"\\L\\1\")/p" > $@ lib_LTLIBRARIES = libapparmor.la noinst_HEADERS = grammar.h parser.h scanner.h af_protos.h private.h PMurHash.h