mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00
Code Issues Releases Wiki Activity

Allow the parser to load opensuse 11.0 style hats and newer 2.3 style hats

Browse Source
This commit is contained in:
John Johansen
2008-09-10 08:42:49 +00:00
parent f2dec0e337
commit ac88f71c63
3 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
parser/parser_policy.c
View File

@@ -362,6 +362,28 @@ static void __add_hat_rules_parent(const void *nodep, const VISIT value,
if ((*t)->local)
return;
/* add rule to grant permission to change_hat
* An opensuse 11.0, AA 2.3 requirement,
* rules are added to the parent of the hat
*/
if ((flag_changehat_version == FLAG_CHANGEHAT_1_4) &&
(*t)->parent) {
char *buffer = malloc(strlen((*t)->name) + 1);
if (!buffer) {
PERROR("Memory allocation error\n");
exit(1);
}
strcpy(buffer, (*t)->name);
entry = new_entry(NULL, buffer, AA_CHANGE_HAT, NULL);
if (!entry) {
PERROR("Memory allocation error\n");
exit(1);
}
add_entry_to_policy((*t)->parent, entry);
}
entry = new_entry(NULL, strdup(CHANGEHAT_PATH), AA_MAY_WRITE, NULL);
if (!entry) {
PERROR(_("ERROR adding hat access rule for profile %s\n"),
@@ -373,10 +395,56 @@ static void __add_hat_rules_parent(const void *nodep, const VISIT value,
twalk((*t)->hat_table, __add_hat_rules_parent);
}
/* Deprecated: used to support changehat rules of AppArmor 2.3
* add the same hat rules to the hats as the parent so that hats can
* change to sibling hats
*/
static void __add_hat_rules_hats(const void *nodep, const VISIT value,
const int __unused depth)
{
struct codomain **t = (struct codomain **) nodep;
if (value == preorder || value == endorder)
return;
/* don't add hat rules if a parent profile with no hats */
if (!(*t)->hat_table && !(*t)->parent)
return;
/* don't add hat rules for local_profiles */
if ((*t)->local)
return;
/* hat */
if ((*t)->parent) {
struct cod_entry *entry, *new_ent;
list_for_each((*t)->parent->entries, entry) {
if (entry->mode & AA_CHANGE_HAT) {
char *buffer = strdup(entry->name);
if (!buffer) {
PERROR("Memory allocation error\n");
exit(1);
}
new_ent = new_entry(NULL, buffer,
AA_CHANGE_HAT, NULL);
if (!entry) {
PERROR("Memory allocation error\n");
exit(1);
}
add_entry_to_policy((*t), new_ent);
}
}
}
twalk((*t)->hat_table, __add_hat_rules_hats);
}
static int add_hat_rules(void)
{
twalk(policy_list, __add_hat_rules_parent);
/* support hat rules of AppArmor 2.3 in opensuse 11.0 */
if (flag_changehat_version == FLAG_CHANGEHAT_1_4)
twalk(policy_list, __add_hat_rules_hats);
return 0;
}