mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 01:57:43 +00:00
Code Issues Releases Wiki Activity

utils: Improve rule priority support in is_covered/is_equal

Browse Source 
- `is_covered` was not checking priorities when checking if a rule is
  covered. With this fix, a rule of lower priority can no longer cover a
  higher priority one.
- Fixes `is_equal(strict=False)` so that priority=0 matches implicit
  priority (as it is defaulted to zero)

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
This commit is contained in:
Maxime Bélair 2025-07-15 16:42:31 +02:00 committed by Christian Boltz
parent 1c2f3582fe
commit ab9d359405
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
utils/apparmor/rule/__init__.py
View File

@ -176,7 +176,7 @@ class BaseRule(metaclass=ABCMeta):
else:
return self.get_clean(depth)
def is_covered(self, other_rule, check_allow_deny=True, check_audit=False):
def is_covered(self, other_rule, check_allow_deny=True, check_audit=False, check_priority=True):
"""check if other_rule is covered by this rule object"""
if type(other_rule) is not type(self):
@ -194,6 +194,9 @@ class BaseRule(metaclass=ABCMeta):
if other_rule.audit and not self.audit:
return False
if check_priority and (self.priority or 0) > (other_rule.priority or 0):
return False
# still here? -> then the common part is covered, check rule-specific things now
return self._is_covered_localvars(other_rule)
@ -250,13 +253,14 @@ class BaseRule(metaclass=ABCMeta):
"""compare if rule_obj == self
Calls _is_equal_localvars() to compare rule-specific variables"""
if (self.priority != rule_obj.priority
if ((self.priority or 0) != (rule_obj.priority or 0)
or self.audit != rule_obj.audit
or self.deny != rule_obj.deny):
return False
if strict and (
self.allow_keyword != rule_obj.allow_keyword
self.priority != rule_obj.priority
or self.allow_keyword != rule_obj.allow_keyword
or self.comment != rule_obj.comment
or self.raw_rule != rule_obj.raw_rule
):